@auth-craft/aws-cf-stack 1.8.0 → 1.10.0

package/cdk/cdk.out/asset.530567cf1e6fd5236cd0e483ba02427949a4a68b619db930921f8d3ba9f03689/index.mjs

@@ -1,135 +0,0 @@
-import{createRequire}from'module';const require=createRequire(import.meta.url);
-var rT=Object.create;var Zl=Object.defineProperty;var nT=Object.getOwnPropertyDescriptor;var iT=Object.getOwnPropertyNames;var sT=Object.getPrototypeOf,oT=Object.prototype.hasOwnProperty;var ee=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var Q=(t,e)=>()=>(t&&(e=t(t=0)),e);var he=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),Ba=(t,e)=>{for(var r in e)Zl(t,r,{get:e[r],enumerable:!0})},aT=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of iT(e))!oT.call(t,i)&&i!==r&&Zl(t,i,{get:()=>e[i],enumerable:!(n=nT(e,i))||n.enumerable});return t};var Pf=(t,e,r)=>(r=t!=null?rT(sT(t)):{},aT(e||!t||!t.__esModule?Zl(r,"default",{value:t,enumerable:!0}):r,t));function rt(...t){let e=t.reduce((i,{length:s})=>i+s,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function su(t,e,r){if(e<0||e>=$a)throw new RangeError(`value must be >= 0 and <= ${$a-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function ou(t){let e=Math.floor(t/$a),r=t%$a,n=new Uint8Array(8);return su(n,e,0),su(n,r,4),n}function Wa(t){let e=new Uint8Array(4);return su(e,t),e}function ze(t){let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}var Yn,ct,$a,Tt=Q(()=>{Yn=new TextEncoder,ct=new TextDecoder,$a=2**32});function Zs(t){if(Uint8Array.prototype.toBase64)return t.toBase64();let e=32768,r=[];for(let n=0;n<t.length;n+=e)r.push(String.fromCharCode.apply(null,t.subarray(n,n+e)));return btoa(r.join(""))}function za(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t);let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}var au=Q(()=>{});var Ja={};Ba(Ja,{decode:()=>dt,encode:()=>De});function dt(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof t=="string"?t:ct.decode(t),{alphabet:"base64url"});let e=t;e instanceof Uint8Array&&(e=ct.decode(e)),e=e.replace(/-/g,"+").replace(/_/g,"/");try{return za(e)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function De(t){let e=t;return typeof e=="string"&&(e=Yn.encode(e)),Uint8Array.prototype.toBase64?e.toBase64({alphabet:"base64url",omitPadding:!0}):Zs(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var pt=Q(()=>{Tt();au()});function dT(t){return parseInt(t.name.slice(4),10)}function Ya(t,e){if(dT(t.hash)!==e)throw Dt(`SHA-${e}`,"algorithm.hash")}function pT(t){switch(t){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}function Lf(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function Mf(t,e,r){switch(e){case"HS256":case"HS384":case"HS512":{if(!Pr(t.algorithm,"HMAC"))throw Dt("HMAC");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"RS256":case"RS384":case"RS512":{if(!Pr(t.algorithm,"RSASSA-PKCS1-v1_5"))throw Dt("RSASSA-PKCS1-v1_5");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"PS256":case"PS384":case"PS512":{if(!Pr(t.algorithm,"RSA-PSS"))throw Dt("RSA-PSS");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"Ed25519":case"EdDSA":{if(!Pr(t.algorithm,"Ed25519"))throw Dt("Ed25519");break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{if(!Pr(t.algorithm,e))throw Dt(e);break}case"ES256":case"ES384":case"ES512":{if(!Pr(t.algorithm,"ECDSA"))throw Dt("ECDSA");let n=pT(e);if(t.algorithm.namedCurve!==n)throw Dt(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}Lf(t,r)}function Jt(t,e,r){switch(e){case"A128GCM":case"A192GCM":case"A256GCM":{if(!Pr(t.algorithm,"AES-GCM"))throw Dt("AES-GCM");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if(!Pr(t.algorithm,"AES-KW"))throw Dt("AES-KW");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"ECDH":{switch(t.algorithm.name){case"ECDH":case"X25519":break;default:throw Dt("ECDH or X25519")}break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if(!Pr(t.algorithm,"PBKDF2"))throw Dt("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(!Pr(t.algorithm,"RSA-OAEP"))throw Dt("RSA-OAEP");Ya(t.algorithm,parseInt(e.slice(9),10)||1);break}default:throw new TypeError("CryptoKey does not support this operation")}Lf(t,r)}var Dt,Pr,Xn=Q(()=>{Dt=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`),Pr=(t,e)=>t.name===e});function Kf(t,e,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}var nr,cu,Qn=Q(()=>{nr=(t,...e)=>Kf("Key must be ",t,...e),cu=(t,e,...r)=>Kf(`Key for the ${t} algorithm must be `,e,...r)});var lu={};Ba(lu,{JOSEAlgNotAllowed:()=>Tn,JOSEError:()=>nt,JOSENotSupported:()=>re,JWEDecryptionFailed:()=>Zr,JWEInvalid:()=>q,JWKInvalid:()=>eo,JWKSInvalid:()=>Ki,JWKSMultipleMatchingKeys:()=>to,JWKSNoMatchingKey:()=>Zn,JWKSTimeout:()=>ro,JWSInvalid:()=>Ee,JWSSignatureVerificationFailed:()=>ei,JWTClaimValidationFailed:()=>ft,JWTExpired:()=>Mi,JWTInvalid:()=>Xe});var nt,ft,Mi,Tn,re,Zr,q,Ee,Xe,eo,Ki,Zn,to,ro,ei,Te=Q(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ft=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Mi=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Tn=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},re=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},Zr=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},q=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},Ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},Xe=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},eo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},Ki=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},Zn=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},to=class extends nt{[Symbol.asyncIterator];static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},ro=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},ei=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});function Hi(t){if(!hr(t))throw new Error("CryptoKey instance expected")}var hr,ti,no,_n=Q(()=>{hr=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},ti=t=>t?.[Symbol.toStringTag]==="KeyObject",no=t=>hr(t)||ti(t)});function Qa(t){switch(t){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Xa(t,e){let r=t.byteLength<<3;if(r!==e)throw new q(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Hf(t){switch(t){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Ff(t,e){if(e.length<<3!==Hf(t))throw new q("Invalid Initialization Vector length")}async function Vf(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(nr(e,"Uint8Array"));let n=parseInt(t.slice(1,4),10),i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),s=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return{encKey:i,macKey:s,keySize:n}}async function Bf(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function mT(t,e,r,n,i){let{encKey:s,macKey:o,keySize:a}=await Vf(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},s,e)),l=rt(i,n,c,ou(i.length<<3)),d=await Bf(o,l,a);return{ciphertext:c,tag:d,iv:n}}async function hT(t,e){if(!(t instanceof Uint8Array))throw new TypeError("First argument must be a buffer");if(!(e instanceof Uint8Array))throw new TypeError("Second argument must be a buffer");let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign(r,n,t)),s=new Uint8Array(await crypto.subtle.sign(r,n,e)),o=0,a=-1;for(;++a<32;)o|=i[a]^s[a];return o===0}async function ET(t,e,r,n,i,s){let{encKey:o,macKey:a,keySize:c}=await Vf(t,e,"decrypt"),l=rt(s,n,r,ou(s.length<<3)),d=await Bf(a,l,c),p;try{p=await hT(i,d)}catch{}if(!p)throw new Zr;let m;try{m=new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},o,r))}catch{}if(!m)throw new Zr;return m}async function yT(t,e,r,n,i){let s;r instanceof Uint8Array?s=await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(Jt(r,t,"encrypt"),s=r);let o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),a=o.slice(-16);return{ciphertext:o.slice(0,-16),tag:a,iv:n}}async function gT(t,e,r,n,i,s){let o;e instanceof Uint8Array?o=await crypto.subtle.importKey("raw",e,"AES-GCM",!1,["decrypt"]):(Jt(e,t,"decrypt"),o=e);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:s,iv:n,name:"AES-GCM",tagLength:128},o,rt(r,i)))}catch{throw new Zr}}async function Za(t,e,r,n,i){if(!hr(r)&&!(r instanceof Uint8Array))throw new TypeError(nr(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));switch(n?Ff(t,n):n=fT(t),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r instanceof Uint8Array&&Xa(r,parseInt(t.slice(-3),10)),mT(t,e,r,n,i);case"A128GCM":case"A192GCM":case"A256GCM":return r instanceof Uint8Array&&Xa(r,parseInt(t.slice(1,4),10)),yT(t,e,r,n,i);default:throw new re(qf)}}async function ec(t,e,r,n,i,s){if(!hr(e)&&!(e instanceof Uint8Array))throw new TypeError(nr(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new q("JWE Initialization Vector missing");if(!i)throw new q("JWE Authentication Tag missing");switch(Ff(t,n),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return e instanceof Uint8Array&&Xa(e,parseInt(t.slice(-3),10)),ET(t,e,r,n,i,s);case"A128GCM":case"A192GCM":case"A256GCM":return e instanceof Uint8Array&&Xa(e,parseInt(t.slice(1,4),10)),gT(t,e,r,n,i,s);default:throw new re(qf)}}var Ur,fT,qf,ri=Q(()=>{Tt();Xn();Qn();Te();_n();Ur=t=>crypto.getRandomValues(new Uint8Array(Qa(t)>>3));fT=t=>crypto.getRandomValues(new Uint8Array(Hf(t)>>3));qf="Unsupported JWE Content Encryption Algorithm"});function Ge(t,e){if(t)throw new TypeError(`${e} can only be called once`)}function Pt(t,e,r){try{return dt(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}async function rc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var tc,Er=Q(()=>{pt();tc=Symbol()});function be(t){if(!vT(t)||Object.prototype.toString.call(t)!=="[object Object]")return!1;if(Object.getPrototypeOf(t)===null)return!0;let e=t;for(;Object.getPrototypeOf(e)!==null;)e=Object.getPrototypeOf(e);return Object.getPrototypeOf(t)===e}function Lr(...t){let e=t.filter(Boolean);if(e.length===0||e.length===1)return!0;let r;for(let n of e){let i=Object.keys(n);if(!r||r.size===0){r=new Set(i);continue}for(let s of i){if(r.has(s))return!1;r.add(s)}}return!0}var vT,ni,jf,Gf,$f,Qe=Q(()=>{vT=t=>typeof t=="object"&&t!==null;ni=t=>be(t)&&typeof t.kty=="string",jf=t=>t.kty!=="oct"&&(t.kty==="AKP"&&typeof t.priv=="string"||typeof t.d=="string"),Gf=t=>t.kty!=="oct"&&t.d===void 0&&t.priv===void 0,$f=t=>t.kty==="oct"&&typeof t.k=="string"});function Wf(t,e){if(t.algorithm.length!==parseInt(e.slice(1,4),10))throw new TypeError(`Invalid key size for alg: ${e}`)}function zf(t,e,r){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"AES-KW",!0,[r]):(Jt(t,e,r),t)}async function io(t,e,r){let n=await zf(e,t,"wrapKey");Wf(n,t);let i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function so(t,e,r){let n=await zf(e,t,"unwrapKey");Wf(n,t);let i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}var uu=Q(()=>{Xn()});function du(t){return rt(Wa(t.length),t)}async function TT(t,e,r){let n=e>>3,i=32,s=Math.ceil(n/i),o=new Uint8Array(s*i);for(let a=1;a<=s;a++){let c=new Uint8Array(4+t.length+r.length);c.set(Wa(a),0),c.set(t,4),c.set(r,4+t.length);let l=await rc("sha256",c);o.set(l,(a-1)*i)}return o.slice(0,n)}async function pu(t,e,r,n,i=new Uint8Array,s=new Uint8Array){Jt(t,"ECDH"),Jt(e,"ECDH","deriveBits");let o=du(ze(r)),a=du(i),c=du(s),l=Wa(n),d=new Uint8Array,p=rt(o,a,c,l,d),m=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,_T(t)));return TT(m,n,p)}function _T(t){return t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3}function fu(t){switch(t.algorithm.namedCurve){case"P-256":case"P-384":case"P-521":return!0;default:return t.algorithm.name==="X25519"}}var Yf=Q(()=>{Tt();Xn();Er()});function xT(t,e){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"PBKDF2",!1,["deriveBits"]):(Jt(t,e,"deriveBits"),t)}async function Xf(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new q("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new q("PBES2 Count Input must be a positive integer");let i=bT(e,t),s=parseInt(e.slice(13,16),10),o={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await xT(n,e);return new Uint8Array(await crypto.subtle.deriveBits(o,a,s))}async function Qf(t,e,r,n=2048,i=crypto.getRandomValues(new Uint8Array(16))){let s=await Xf(i,t,n,e);return{encryptedKey:await io(t.slice(-6),s,r),p2c:n,p2s:De(i)}}async function Zf(t,e,r,n,i){let s=await Xf(i,t,n,e);return so(t.slice(-6),s,r)}var bT,em=Q(()=>{pt();uu();Xn();Tt();Te();bT=(t,e)=>rt(ze(t),Uint8Array.of(0),e)});function oo(t,e){if(t.startsWith("RS")||t.startsWith("PS")){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}}function tm(t,e){let r=`SHA-${t.slice(-3)}`;switch(t){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:parseInt(t.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:e.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:t};default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}async function rm(t,e,r){if(e instanceof Uint8Array){if(!t.startsWith("HS"))throw new TypeError(nr(e,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",e,{hash:`SHA-${t.slice(-3)}`,name:"HMAC"},!1,[r])}return Mf(e,t,r),e}async function nm(t,e,r){let n=await rm(t,e,"sign");oo(t,n);let i=await crypto.subtle.sign(tm(t,n.algorithm),n,r);return new Uint8Array(i)}async function im(t,e,r,n){let i=await rm(t,e,"verify");oo(t,i);let s=tm(t,i.algorithm);try{return await crypto.subtle.verify(s,i,r,n)}catch{return!1}}var nc=Q(()=>{Te();Xn();Qn()});async function om(t,e,r){return Jt(e,t,"encrypt"),oo(t,e),new Uint8Array(await crypto.subtle.encrypt(sm(t),e,r))}async function am(t,e,r){return Jt(e,t,"decrypt"),oo(t,e),new Uint8Array(await crypto.subtle.decrypt(sm(t),e,r))}var sm,cm=Q(()=>{Xn();nc();Te();sm=t=>{switch(t){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}});function wT(t){let e,r;switch(t.kty){case"AKP":{switch(t.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":e={name:t.alg},r=t.priv?["sign"]:["verify"];break;default:throw new re(ic)}break}case"RSA":{switch(t.alg){case"PS256":case"PS384":case"PS512":e={name:"RSA-PSS",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":e={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":e={name:"RSA-OAEP",hash:`SHA-${parseInt(t.alg.slice(-3),10)||1}`},r=t.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new re(ic)}break}case"EC":{switch(t.alg){case"ES256":case"ES384":case"ES512":e={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[t.alg]},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:"ECDH",namedCurve:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(ic)}break}case"OKP":{switch(t.alg){case"Ed25519":case"EdDSA":e={name:"Ed25519"},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(ic)}break}default:throw new re('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:e,keyUsages:r}}async function Fi(t){if(!t.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:e,keyUsages:r}=wT(t),n={...t};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,e,t.ext??!(t.d||t.priv),t.key_ops??r)}var ic,mu=Q(()=>{Te();ic='Invalid or unsupported JWK "alg" (Algorithm) Parameter value'});async function ir(t,e){if(t instanceof Uint8Array||hr(t))return t;if(ti(t)){if(t.type==="secret")return t.export();if("toCryptoKey"in t&&typeof t.toCryptoKey=="function")try{return RT(t,e)}catch(n){if(n instanceof TypeError)throw n}let r=t.export({format:"jwk"});return lm(t,r,e)}if(ni(t))return t.k?dt(t.k):lm(t,t,e,!0);throw new Error("unreachable")}var Vi,Bi,lm,RT,ii=Q(()=>{Qe();pt();mu();_n();Vi="given KeyObject instance cannot be used for this algorithm",lm=async(t,e,r,n=!1)=>{Bi||=new WeakMap;let i=Bi.get(t);if(i?.[r])return i[r];let s=await Fi({...e,alg:r});return n&&Object.freeze(t),i?i[r]=s:Bi.set(t,{[r]:s}),s},RT=(t,e)=>{Bi||=new WeakMap;let r=Bi.get(t);if(r?.[e])return r[e];let n=t.type==="public",i=!!n,s;if(t.asymmetricKeyType==="x25519"){switch(e){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError(Vi)}s=t.toCryptoKey(t.asymmetricKeyType,i,n?[]:["deriveBits"])}if(t.asymmetricKeyType==="ed25519"){if(e!=="EdDSA"&&e!=="Ed25519")throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}switch(t.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":{if(e!==t.asymmetricKeyType.toUpperCase())throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}}if(t.asymmetricKeyType==="rsa"){let o;switch(e){case"RSA-OAEP":o="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":o="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":o="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":o="SHA-512";break;default:throw new TypeError(Vi)}if(e.startsWith("RSA-OAEP"))return t.toCryptoKey({name:"RSA-OAEP",hash:o},i,n?["encrypt"]:["decrypt"]);s=t.toCryptoKey({name:e.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:o},i,[n?"verify":"sign"])}if(t.asymmetricKeyType==="ec"){let a=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(t.asymmetricKeyDetails?.namedCurve);if(!a)throw new TypeError(Vi);let c={ES256:"P-256",ES384:"P-384",ES512:"P-521"};c[e]&&a===c[e]&&(s=t.toCryptoKey({name:"ECDSA",namedCurve:a},i,[n?"verify":"sign"])),e.startsWith("ECDH-ES")&&(s=t.toCryptoKey({name:"ECDH",namedCurve:a},i,n?[]:["deriveBits"]))}if(!s)throw new TypeError(Vi);return r?r[e]=s:Bi.set(t,{[e]:s}),s}});function kT(t){Mr(t,48,"Invalid PKCS#8 structure"),yr(t),Mr(t,2,"Expected version field");let e=yr(t);t.pos+=e,Mr(t,48,"Expected algorithm identifier");let r=yr(t);return{algIdStart:t.pos,algIdLength:r}}function CT(t){Mr(t,48,"Invalid SPKI structure"),yr(t),Mr(t,48,"Expected algorithm identifier");let e=yr(t);return{algIdStart:t.pos,algIdLength:e}}function DT(t){let e=yu(t);Mr(e,48,"Invalid certificate structure"),yr(e),Mr(e,48,"Invalid tbsCertificate structure"),yr(e),t[e.pos]===160?Eu(e,6):Eu(e,5);let r=e.pos;Mr(e,48,"Invalid SPKI structure");let n=yr(e);return t.subarray(r,r+n+(e.pos-r))}function PT(t){let e=gu(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);return DT(e)}var um,dm,pm,fm,hu,yu,yr,Eu,Mr,mm,OT,hm,Em,gu,ym,vu,gm,Au=Q(()=>{Qn();au();Te();_n();um=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
-`);return`-----BEGIN ${e}-----
-${r}
------END ${e}-----`},dm=async(t,e,r)=>{if(ti(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!hr(r))throw new TypeError(nr(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return um(Zs(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},pm=t=>dm("public","spki",t),fm=t=>dm("private","pkcs8",t),hu=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},yu=t=>({data:t,pos:0}),yr=t=>{let e=t.data[t.pos++];if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|t.data[t.pos++];return n}return e},Eu=(t,e=1)=>{if(e<=0)return;t.pos++;let r=yr(t);t.pos+=r,e>1&&Eu(t,e-1)},Mr=(t,e,r)=>{if(t.data[t.pos++]!==e)throw new Error(r)},mm=(t,e)=>{let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},OT=t=>{Mr(t,6,"Expected algorithm OID");let e=yr(t);return mm(t,e)};hm=t=>{let e=OT(t);if(hu(e,[43,101,110]))return"X25519";if(!hu(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Mr(t,6,"Expected curve OID");let r=yr(t),n=mm(t,r);for(let{name:i,oid:s}of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}])if(hu(n,s))return i;throw new Error("Unsupported named curve")},Em=async(t,e,r,n)=>{let i,s,o=t==="spki",a=()=>o?["verify"]:["sign"],c=()=>o?["encrypt","wrapKey"]:["decrypt","unwrapKey"];switch(r){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:`SHA-${r.slice(-3)}`},s=a();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${r.slice(-3)}`},s=a();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:`SHA-${parseInt(r.slice(-3),10)||1}`},s=c();break;case"ES256":case"ES384":case"ES512":{i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[r]},s=a();break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{try{let l=n.getNamedCurve(e);i=l==="X25519"?{name:"X25519"}:{name:"ECDH",namedCurve:l}}catch{throw new re("Invalid or unsupported key format")}s=o?[]:["deriveBits"];break}case"Ed25519":case"EdDSA":i={name:"Ed25519"},s=a();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:r},s=a();break;default:throw new re('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(t,e,i,n?.extractable??!!o,s)},gu=(t,e)=>za(t.replace(e,"")),ym=(t,e,r)=>{let n=gu(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g),i=r;return e?.startsWith?.("ECDH-ES")&&(i||={},i.getNamedCurve=s=>{let o=yu(s);return kT(o),hm(o)}),Em("pkcs8",n,e,i)},vu=(t,e,r)=>{let n=gu(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g),i=r;return e?.startsWith?.("ECDH-ES")&&(i||={},i.getNamedCurve=s=>{let o=yu(s);return CT(o),hm(o)}),Em("spki",n,e,i)};gm=(t,e,r)=>{let n;try{n=PT(t)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return vu(um(Zs(n),"PUBLIC KEY"),e,r)}});async function sc(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return vu(t,e,r)}async function vm(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return gm(t,e,r)}async function ao(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return ym(t,e,r)}async function it(t,e,r){if(!be(t))throw new TypeError("JWK must be an object");let n;switch(e??=t.alg,n??=r?.extractable??t.ext,t.kty){case"oct":if(typeof t.k!="string"||!t.k)throw new TypeError('missing "k" (Key Value) Parameter value');return dt(t.k);case"RSA":if("oth"in t&&t.oth!==void 0)throw new re('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return Fi({...t,alg:e,ext:n});case"AKP":{if(typeof t.alg!="string"||!t.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==void 0&&e!==t.alg)throw new TypeError("JWK alg and alg option value mismatch");return Fi({...t,ext:n})}case"EC":case"OKP":return Fi({...t,alg:e,ext:n});default:throw new re('Unsupported "kty" (Key Type) Parameter value')}}var co=Q(()=>{pt();Au();mu();Te();Qe()});async function Am(t){if(ti(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:De(t)};if(!hr(t))throw new TypeError(nr(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:e,key_ops:r,alg:n,use:i,...s}=await crypto.subtle.exportKey("jwk",t);return s.kty==="AKP"&&(s.alg=n),s}var Tm=Q(()=>{Qn();pt();_n()});async function _m(t){return pm(t)}async function Im(t){return fm(t)}async function qi(t){return Am(t)}var oc=Q(()=>{Au();Tm()});async function xm(t,e,r,n){let i=t.slice(0,7),s=await Za(i,r,e,n,new Uint8Array);return{encryptedKey:s.ciphertext,iv:De(s.iv),tag:De(s.tag)}}async function bm(t,e,r,n,i){let s=t.slice(0,7);return ec(s,e,r,n,i,new Uint8Array)}var Sm=Q(()=>{ri();pt()});function lo(t){if(t===void 0)throw new q("JWE Encrypted Key missing")}async function wm(t,e,r,n,i){switch(t){case"dir":{if(r!==void 0)throw new q("Encountered unexpected JWE Encrypted Key");return e}case"ECDH-ES":if(r!==void 0)throw new q("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!be(n.epk))throw new q('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(Hi(e),!fu(e))throw new re("ECDH with the provided key is not allowed or not supported by your javascript runtime");let s=await it(n.epk,t);Hi(s);let o,a;if(n.apu!==void 0){if(typeof n.apu!="string")throw new q('JOSE Header "apu" (Agreement PartyUInfo) invalid');o=Pt(n.apu,"apu",q)}if(n.apv!==void 0){if(typeof n.apv!="string")throw new q('JOSE Header "apv" (Agreement PartyVInfo) invalid');a=Pt(n.apv,"apv",q)}let c=await pu(s,e,t==="ECDH-ES"?n.enc:t,t==="ECDH-ES"?Qa(n.enc):parseInt(t.slice(-5,-2),10),o,a);return t==="ECDH-ES"?c:(lo(r),so(t.slice(-6),c,r))}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return lo(r),Hi(e),am(t,e,r);case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{if(lo(r),typeof n.p2c!="number")throw new q('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=i?.maxPBES2Count||1e4;if(n.p2c>s)throw new q('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof n.p2s!="string")throw new q('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let o;return o=Pt(n.p2s,"p2s",q),Zf(t,e,r,n.p2c,o)}case"A128KW":case"A192KW":case"A256KW":return lo(r),so(t,e,r);case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{if(lo(r),typeof n.iv!="string")throw new q('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof n.tag!="string")throw new q('JOSE Header "tag" (Authentication Tag) missing or invalid');let s;s=Pt(n.iv,"iv",q);let o;return o=Pt(n.tag,"tag",q),bm(t,e,r,s,o)}default:throw new re(Nm)}}async function ac(t,e,r,n,i={}){let s,o,a;switch(t){case"dir":{a=r;break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(Hi(r),!fu(r))throw new re("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:c,apv:l}=i,d;i.epk?d=await ir(i.epk,t):d=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;let{x:p,y:m,crv:E,kty:v}=await qi(d),b=await pu(r,d,t==="ECDH-ES"?e:t,t==="ECDH-ES"?Qa(e):parseInt(t.slice(-5,-2),10),c,l);if(o={epk:{x:p,crv:E,kty:v}},v==="EC"&&(o.epk.y=m),c&&(o.apu=De(c)),l&&(o.apv=De(l)),t==="ECDH-ES"){a=b;break}a=n||Ur(e);let k=t.slice(-6);s=await io(k,b,a);break}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{a=n||Ur(e),Hi(r),s=await om(t,r,a);break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{a=n||Ur(e);let{p2c:c,p2s:l}=i;({encryptedKey:s,...o}=await Qf(t,r,a,c,l));break}case"A128KW":case"A192KW":case"A256KW":{a=n||Ur(e),s=await io(t,r,a);break}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{a=n||Ur(e);let{iv:c}=i;({encryptedKey:s,...o}=await xm(t,r,a,c));break}default:throw new re(Nm)}return{cek:a,encryptedKey:s,parameters:o}}var Nm,cc=Q(()=>{uu();Yf();em();cm();pt();ii();Te();Er();ri();co();oc();Qe();Sm();_n();Nm='Invalid or unsupported "alg" (JWE Algorithm) header value'});function Kr(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(o=>typeof o!="string"||o.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s;r!==void 0?s=new Map([...Object.entries(r),...e.entries()]):s=e;for(let o of n.crit){if(!s.has(o))throw new re(`Extension Header Parameter "${o}" is not recognized`);if(i[o]===void 0)throw new t(`Extension Header Parameter "${o}" is missing`);if(s.get(o)&&n[o]===void 0)throw new t(`Extension Header Parameter "${o}" MUST be integrity protected`)}return new Set(n.crit)}var ji=Q(()=>{Te()});function uo(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);if(e)return new Set(e)}var Tu=Q(()=>{});function Hr(t,e,r){switch(t.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":UT(t,e,r);break;default:LT(t,e,r)}}var Gi,_u,UT,LT,$i=Q(()=>{Qn();_n();Qe();Gi=t=>t?.[Symbol.toStringTag],_u=(t,e,r)=>{if(e.use!==void 0){let n;switch(r){case"sign":case"verify":n="sig";break;case"encrypt":case"decrypt":n="enc";break}if(e.use!==n)throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`)}if(e.alg!==void 0&&e.alg!==t)throw new TypeError(`Invalid key for this operation, its "alg" must be "${t}" when present`);if(Array.isArray(e.key_ops)){let n;switch(!0){case(r==="sign"||r==="verify"):case t==="dir":case t.includes("CBC-HS"):n=r;break;case t.startsWith("PBES2"):n="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(t):!t.includes("GCM")&&t.endsWith("KW")?n=r==="encrypt"?"wrapKey":"unwrapKey":n=r;break;case(r==="encrypt"&&t.startsWith("RSA")):n="wrapKey";break;case r==="decrypt":n=t.startsWith("RSA")?"unwrapKey":"deriveBits";break}if(n&&e.key_ops?.includes?.(n)===!1)throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}return!0},UT=(t,e,r)=>{if(!(e instanceof Uint8Array)){if(ni(e)){if($f(e)&&_u(t,e,r))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!no(e))throw new TypeError(cu(t,e,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(e.type!=="secret")throw new TypeError(`${Gi(e)} instances for symmetric algorithms must be of type "secret"`)}},LT=(t,e,r)=>{if(ni(e))switch(r){case"decrypt":case"sign":if(jf(e)&&_u(t,e,r))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if(Gf(e)&&_u(t,e,r))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!no(e))throw new TypeError(cu(t,e,"CryptoKey","KeyObject","JSON Web Key"));if(e.type==="secret")throw new TypeError(`${Gi(e)} instances for asymmetric algorithms must not be of type "secret"`);if(e.type==="public")switch(r){case"sign":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm signing must be of type "private"`);case"decrypt":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm decryption must be of type "private"`)}if(e.type==="private")switch(r){case"verify":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm verifying must be of type "public"`);case"encrypt":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm encryption must be of type "public"`)}}});function Rm(t){if(typeof globalThis[t]>"u")throw new re(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Om(t){Rm("CompressionStream");let e=new CompressionStream("deflate-raw"),r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});let n=[],i=e.readable.getReader();for(;;){let{value:s,done:o}=await i.read();if(o)break;n.push(s)}return rt(...n)}async function km(t,e){Rm("DecompressionStream");let r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(t).catch(()=>{}),n.close().catch(()=>{});let i=[],s=0,o=r.readable.getReader();for(;;){let{value:a,done:c}=await o.read();if(c)break;if(i.push(a),s+=a.byteLength,e!==1/0&&s>e)throw new q("Decompressed plaintext exceeded the configured limit")}return rt(...i)}var Iu=Q(()=>{Te();Tt()});async function Wi(t,e,r){if(!be(t))throw new q("Flattened JWE must be an object");if(t.protected===void 0&&t.header===void 0&&t.unprotected===void 0)throw new q("JOSE Header missing");if(t.iv!==void 0&&typeof t.iv!="string")throw new q("JWE Initialization Vector incorrect type");if(typeof t.ciphertext!="string")throw new q("JWE Ciphertext missing or incorrect type");if(t.tag!==void 0&&typeof t.tag!="string")throw new q("JWE Authentication Tag incorrect type");if(t.protected!==void 0&&typeof t.protected!="string")throw new q("JWE Protected Header incorrect type");if(t.encrypted_key!==void 0&&typeof t.encrypted_key!="string")throw new q("JWE Encrypted Key incorrect type");if(t.aad!==void 0&&typeof t.aad!="string")throw new q("JWE AAD incorrect type");if(t.header!==void 0&&!be(t.header))throw new q("JWE Shared Unprotected Header incorrect type");if(t.unprotected!==void 0&&!be(t.unprotected))throw new q("JWE Per-Recipient Unprotected Header incorrect type");let n;if(t.protected)try{let G=dt(t.protected);n=JSON.parse(ct.decode(G))}catch{throw new q("JWE Protected Header is invalid")}if(!Lr(n,t.header,t.unprotected))throw new q("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let i={...n,...t.header,...t.unprotected};if(Kr(q,new Map,r?.crit,n,i),i.zip!==void 0&&i.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(i.zip!==void 0&&!n?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:s,enc:o}=i;if(typeof s!="string"||!s)throw new q("missing JWE Algorithm (alg) in JWE Header");if(typeof o!="string"||!o)throw new q("missing JWE Encryption Algorithm (enc) in JWE Header");let a=r&&uo("keyManagementAlgorithms",r.keyManagementAlgorithms),c=r&&uo("contentEncryptionAlgorithms",r.contentEncryptionAlgorithms);if(a&&!a.has(s)||!a&&s.startsWith("PBES2"))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(c&&!c.has(o))throw new Tn('"enc" (Encryption Algorithm) Header Parameter value not allowed');let l;t.encrypted_key!==void 0&&(l=Pt(t.encrypted_key,"encrypted_key",q));let d=!1;typeof e=="function"&&(e=await e(n,t),d=!0),Hr(s==="dir"?o:s,e,"decrypt");let p=await ir(e,s),m;try{m=await wm(s,p,l,i,r)}catch(G){if(G instanceof TypeError||G instanceof q||G instanceof re)throw G;m=Ur(o)}let E,v;t.iv!==void 0&&(E=Pt(t.iv,"iv",q)),t.tag!==void 0&&(v=Pt(t.tag,"tag",q));let b=t.protected!==void 0?ze(t.protected):new Uint8Array,k;t.aad!==void 0?k=rt(b,ze("."),ze(t.aad)):k=b;let C=Pt(t.ciphertext,"ciphertext",q),L=await ec(o,m,C,E,v,k),B={plaintext:L};if(i.zip==="DEF"){let G=r?.maxDecompressedLength??25e4;if(G===0)throw new re('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(G!==1/0&&(!Number.isSafeInteger(G)||G<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");B.plaintext=await km(L,G).catch(j=>{throw j instanceof q?j:new q("Failed to decompress plaintext",{cause:j})})}return t.protected!==void 0&&(B.protectedHeader=n),t.aad!==void 0&&(B.additionalAuthenticatedData=Pt(t.aad,"aad",q)),t.unprotected!==void 0&&(B.sharedUnprotectedHeader=t.unprotected),t.header!==void 0&&(B.unprotectedHeader=t.header),d?{...B,key:p}:B}var lc=Q(()=>{pt();ri();Er();Te();Qe();Qe();cc();Tt();ri();ji();Tu();ii();$i();Iu()});async function uc(t,e,r){if(t instanceof Uint8Array&&(t=ct.decode(t)),typeof t!="string")throw new q("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:s,3:o,4:a,length:c}=t.split(".");if(c!==5)throw new q("Invalid Compact JWE");let l=await Wi({ciphertext:o,iv:s||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r),d={plaintext:l.plaintext,protectedHeader:l.protectedHeader};return typeof e=="function"?{...d,key:l.key}:d}var xu=Q(()=>{lc();Te();Tt()});async function Cm(t,e,r){if(!be(t))throw new q("General JWE must be an object");if(!Array.isArray(t.recipients)||!t.recipients.every(be))throw new q("JWE Recipients missing or incorrect type");if(!t.recipients.length)throw new q("JWE Recipients has no members");for(let n of t.recipients)try{return await Wi({aad:t.aad,ciphertext:t.ciphertext,encrypted_key:n.encrypted_key,header:n.header,iv:t.iv,protected:t.protected,tag:t.tag,unprotected:t.unprotected},e,r)}catch{}throw new Zr}var Dm=Q(()=>{lc();Te();Qe()});var en,dc=Q(()=>{pt();Er();ri();cc();Te();Qe();Tt();ji();ii();$i();Iu();en=class{#e;#t;#r;#s;#n;#i;#a;#o;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this.#e=e}setKeyManagementParameters(e){return Ge(this.#o,"setKeyManagementParameters"),this.#o=e,this}setProtectedHeader(e){return Ge(this.#t,"setProtectedHeader"),this.#t=e,this}setSharedUnprotectedHeader(e){return Ge(this.#r,"setSharedUnprotectedHeader"),this.#r=e,this}setUnprotectedHeader(e){return Ge(this.#s,"setUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#n=e,this}setContentEncryptionKey(e){return Ge(this.#i,"setContentEncryptionKey"),this.#i=e,this}setInitializationVector(e){return Ge(this.#a,"setInitializationVector"),this.#a=e,this}async encrypt(e,r){if(!this.#t&&!this.#s&&!this.#r)throw new q("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!Lr(this.#t,this.#s,this.#r))throw new q("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let n={...this.#t,...this.#s,...this.#r};if(Kr(q,new Map,r?.crit,this.#t,n),n.zip!==void 0&&n.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(n.zip!==void 0&&!this.#t?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:i,enc:s}=n;if(typeof i!="string"||!i)throw new q('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof s!="string"||!s)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');let o;if(this.#i&&(i==="dir"||i==="ECDH-ES"))throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${i}`);Hr(i==="dir"?s:i,e,"encrypt");let a;{let C,L=await ir(e,i);({cek:a,encryptedKey:o,parameters:C}=await ac(i,s,L,this.#i,this.#o)),C&&(r&&tc in r?this.#s?this.#s={...this.#s,...C}:this.setUnprotectedHeader(C):this.#t?this.#t={...this.#t,...C}:this.setProtectedHeader(C))}let c,l,d,p;if(this.#t?(l=De(JSON.stringify(this.#t)),d=ze(l)):(l="",d=new Uint8Array),this.#n){p=De(this.#n);let C=ze(p);c=rt(d,ze("."),C)}else c=d;let m=this.#e;n.zip==="DEF"&&(m=await Om(m).catch(C=>{throw new q("Failed to compress plaintext",{cause:C})}));let{ciphertext:E,tag:v,iv:b}=await Za(s,m,a,this.#a,c),k={ciphertext:De(E)};return b&&(k.iv=De(b)),v&&(k.tag=De(v)),o&&(k.encrypted_key=De(o)),p&&(k.aad=p),this.#t&&(k.protected=l),this.#r&&(k.unprotected=this.#r),this.#s&&(k.header=this.#s),k}}});var bu,pc,Pm=Q(()=>{dc();Er();Te();ri();Qe();cc();pt();ji();ii();$i();bu=class{#e;unprotectedHeader;keyManagementParameters;key;options;constructor(e,r,n){this.#e=e,this.key=r,this.options=n}setUnprotectedHeader(e){return Ge(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=e,this}setKeyManagementParameters(e){return Ge(this.keyManagementParameters,"setKeyManagementParameters"),this.keyManagementParameters=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}},pc=class{#e;#t=[];#r;#s;#n;constructor(e){this.#e=e}addRecipient(e,r){let n=new bu(this,e,{crit:r?.crit});return this.#t.push(n),n}setProtectedHeader(e){return Ge(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return Ge(this.#s,"setSharedUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#n=e,this}async encrypt(){if(!this.#t.length)throw new q("at least one recipient must be added");if(this.#t.length===1){let[i]=this.#t,s=await new en(this.#e).setAdditionalAuthenticatedData(this.#n).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(i.unprotectedHeader).encrypt(i.key,{...i.options}),o={ciphertext:s.ciphertext,iv:s.iv,recipients:[{}],tag:s.tag};return s.aad&&(o.aad=s.aad),s.protected&&(o.protected=s.protected),s.unprotected&&(o.unprotected=s.unprotected),s.encrypted_key&&(o.recipients[0].encrypted_key=s.encrypted_key),s.header&&(o.recipients[0].header=s.header),o}let e;for(let i=0;i<this.#t.length;i++){let s=this.#t[i];if(!Lr(this.#r,this.#s,s.unprotectedHeader))throw new q("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let o={...this.#r,...this.#s,...s.unprotectedHeader},{alg:a}=o;if(typeof a!="string"||!a)throw new q('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(a==="dir"||a==="ECDH-ES")throw new q('"dir" and "ECDH-ES" alg may only be used with a single recipient');if(typeof o.enc!="string"||!o.enc)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(!e)e=o.enc;else if(e!==o.enc)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');if(Kr(q,new Map,s.options.crit,this.#r,o),o.zip!==void 0&&o.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(o.zip!==void 0&&!this.#r?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}let r=Ur(e),n={ciphertext:"",recipients:[]};for(let i=0;i<this.#t.length;i++){let s=this.#t[i],o={};if(n.recipients.push(o),i===0){let p=await new en(this.#e).setAdditionalAuthenticatedData(this.#n).setContentEncryptionKey(r).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(s.unprotectedHeader).setKeyManagementParameters(s.keyManagementParameters).encrypt(s.key,{...s.options,[tc]:!0});n.ciphertext=p.ciphertext,n.iv=p.iv,n.tag=p.tag,p.aad&&(n.aad=p.aad),p.protected&&(n.protected=p.protected),p.unprotected&&(n.unprotected=p.unprotected),o.encrypted_key=p.encrypted_key,p.header&&(o.header=p.header);continue}let a=s.unprotectedHeader?.alg||this.#r?.alg||this.#s?.alg;Hr(a==="dir"?e:a,s.key,"encrypt");let c=await ir(s.key,a),{encryptedKey:l,parameters:d}=await ac(a,e,c,r,s.keyManagementParameters);o.encrypted_key=De(l),(s.unprotectedHeader||d)&&(o.header={...s.unprotectedHeader,...d})}return n}}});async function zi(t,e,r){if(!be(t))throw new Ee("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new Ee('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new Ee("JWS Protected Header incorrect type");if(t.payload===void 0)throw new Ee("JWS Payload missing");if(typeof t.signature!="string")throw new Ee("JWS Signature missing or incorrect type");if(t.header!==void 0&&!be(t.header))throw new Ee("JWS Unprotected Header incorrect type");let n={};if(t.protected)try{let k=dt(t.protected);n=JSON.parse(ct.decode(k))}catch{throw new Ee("JWS Protected Header is invalid")}if(!Lr(n,t.header))throw new Ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let i={...n,...t.header},s=Kr(Ee,new Map([["b64",!0]]),r?.crit,n,i),o=!0;if(s.has("b64")&&(o=n.b64,typeof o!="boolean"))throw new Ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:a}=i;if(typeof a!="string"||!a)throw new Ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');let c=r&&uo("algorithms",r.algorithms);if(c&&!c.has(a))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(o){if(typeof t.payload!="string")throw new Ee("JWS Payload must be a string")}else if(typeof t.payload!="string"&&!(t.payload instanceof Uint8Array))throw new Ee("JWS Payload must be a string or an Uint8Array instance");let l=!1;typeof e=="function"&&(e=await e(n,t),l=!0),Hr(a,e,"verify");let d=rt(t.protected!==void 0?ze(t.protected):new Uint8Array,ze("."),typeof t.payload=="string"?o?ze(t.payload):Yn.encode(t.payload):t.payload),p=Pt(t.signature,"signature",Ee),m=await ir(e,a);if(!await im(a,m,p,d))throw new ei;let v;o?v=Pt(t.payload,"payload",Ee):typeof t.payload=="string"?v=Yn.encode(t.payload):v=t.payload;let b={payload:v};return t.protected!==void 0&&(b.protectedHeader=n),t.header!==void 0&&(b.unprotectedHeader=t.header),l?{...b,key:m}:b}var fc=Q(()=>{pt();nc();Te();Tt();Er();Qe();Qe();$i();ji();Tu();ii()});async function mc(t,e,r){if(t instanceof Uint8Array&&(t=ct.decode(t)),typeof t!="string")throw new Ee("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:s,length:o}=t.split(".");if(o!==3)throw new Ee("Invalid Compact JWS");let a=await zi({payload:i,protected:n,signature:s},e,r),c={payload:a.payload,protectedHeader:a.protectedHeader};return typeof e=="function"?{...c,key:a.key}:c}var Su=Q(()=>{fc();Te();Tt()});async function Um(t,e,r){if(!be(t))throw new Ee("General JWS must be an object");if(!Array.isArray(t.signatures)||!t.signatures.every(be))throw new Ee("JWS Signatures missing or incorrect type");for(let n of t.signatures)try{return await zi({header:n.header,payload:t.payload,protected:n.protected,signature:n.signature},e,r)}catch{}throw new ei}var Lm=Q(()=>{fc();Te();Qe()});function po(t){let e=HT.exec(t);if(!e||e[4]&&e[1])throw new TypeError("Invalid time period format");let r=parseFloat(e[2]),n=e[3].toLowerCase(),i;switch(n){case"sec":case"secs":case"second":case"seconds":case"s":i=Math.round(r);break;case"minute":case"minutes":case"min":case"mins":case"m":i=Math.round(r*Km);break;case"hour":case"hours":case"hr":case"hrs":case"h":i=Math.round(r*Hm);break;case"day":case"days":case"d":i=Math.round(r*Nu);break;case"week":case"weeks":case"w":i=Math.round(r*MT);break;default:i=Math.round(r*KT);break}return e[1]==="-"||e[4]==="ago"?-i:i}function si(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function Ji(t,e,r={}){let n;try{n=JSON.parse(ct.decode(e))}catch{}if(!be(n))throw new Xe("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i&&(typeof t.typ!="string"||Mm(t.typ)!==Mm(i)))throw new ft('unexpected "typ" JWT header value',n,"typ","check_failed");let{requiredClaims:s=[],issuer:o,subject:a,audience:c,maxTokenAge:l}=r,d=[...s];l!==void 0&&d.push("iat"),c!==void 0&&d.push("aud"),a!==void 0&&d.push("sub"),o!==void 0&&d.push("iss");for(let v of new Set(d.reverse()))if(!(v in n))throw new ft(`missing required "${v}" claim`,n,v,"missing");if(o&&!(Array.isArray(o)?o:[o]).includes(n.iss))throw new ft('unexpected "iss" claim value',n,"iss","check_failed");if(a&&n.sub!==a)throw new ft('unexpected "sub" claim value',n,"sub","check_failed");if(c&&!FT(n.aud,typeof c=="string"?[c]:c))throw new ft('unexpected "aud" claim value',n,"aud","check_failed");let p;switch(typeof r.clockTolerance){case"string":p=po(r.clockTolerance);break;case"number":p=r.clockTolerance;break;case"undefined":p=0;break;default:throw new TypeError("Invalid clockTolerance option type")}let{currentDate:m}=r,E=In(m||new Date);if((n.iat!==void 0||l)&&typeof n.iat!="number")throw new ft('"iat" claim must be a number',n,"iat","invalid");if(n.nbf!==void 0){if(typeof n.nbf!="number")throw new ft('"nbf" claim must be a number',n,"nbf","invalid");if(n.nbf>E+p)throw new ft('"nbf" claim timestamp check failed',n,"nbf","check_failed")}if(n.exp!==void 0){if(typeof n.exp!="number")throw new ft('"exp" claim must be a number',n,"exp","invalid");if(n.exp<=E-p)throw new Mi('"exp" claim timestamp check failed',n,"exp","check_failed")}if(l){let v=E-n.iat,b=typeof l=="number"?l:po(l);if(v-p>b)throw new Mi('"iat" claim timestamp check failed (too far in the past)',n,"iat","check_failed");if(v<0-p)throw new ft('"iat" claim timestamp check failed (it should be in the past)',n,"iat","check_failed")}return n}var In,Km,Hm,Nu,MT,KT,HT,Mm,FT,xn,Yi=Q(()=>{Te();Tt();Qe();In=t=>Math.floor(t.getTime()/1e3),Km=60,Hm=Km*60,Nu=Hm*24,MT=Nu*7,KT=Nu*365.25,HT=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;Mm=t=>t.includes("/")?t.toLowerCase():`application/${t.toLowerCase()}`,FT=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(Set.prototype.has.bind(new Set(t))):!1;xn=class{#e;constructor(e){if(!be(e))throw new TypeError("JWT Claims Set MUST be an object");this.#e=structuredClone(e)}data(){return Yn.encode(JSON.stringify(this.#e))}get iss(){return this.#e.iss}set iss(e){this.#e.iss=e}get sub(){return this.#e.sub}set sub(e){this.#e.sub=e}get aud(){return this.#e.aud}set aud(e){this.#e.aud=e}set jti(e){this.#e.jti=e}set nbf(e){typeof e=="number"?this.#e.nbf=si("setNotBefore",e):e instanceof Date?this.#e.nbf=si("setNotBefore",In(e)):this.#e.nbf=In(new Date)+po(e)}set exp(e){typeof e=="number"?this.#e.exp=si("setExpirationTime",e):e instanceof Date?this.#e.exp=si("setExpirationTime",In(e)):this.#e.exp=In(new Date)+po(e)}set iat(e){e===void 0?this.#e.iat=In(new Date):e instanceof Date?this.#e.iat=si("setIssuedAt",In(e)):typeof e=="string"?this.#e.iat=si("setIssuedAt",In(new Date)+po(e)):this.#e.iat=si("setIssuedAt",e)}}});async function bn(t,e,r){let n=await mc(t,e,r);if(n.protectedHeader.crit?.includes("b64")&&n.protectedHeader.b64===!1)throw new Xe("JWTs MUST NOT use unencoded payload");let s={payload:Ji(n.protectedHeader,n.payload,r),protectedHeader:n.protectedHeader};return typeof e=="function"?{...s,key:n.key}:s}var Fm=Q(()=>{Su();Yi();Te()});async function Vm(t,e,r){let n=await uc(t,e,r),i=Ji(n.protectedHeader,n.plaintext,r),{protectedHeader:s}=n;if(s.iss!==void 0&&s.iss!==i.iss)throw new ft('replicated "iss" claim header parameter mismatch',i,"iss","mismatch");if(s.sub!==void 0&&s.sub!==i.sub)throw new ft('replicated "sub" claim header parameter mismatch',i,"sub","mismatch");if(s.aud!==void 0&&JSON.stringify(s.aud)!==JSON.stringify(i.aud))throw new ft('replicated "aud" claim header parameter mismatch',i,"aud","mismatch");let o={payload:i,protectedHeader:s};return typeof e=="function"?{...o,key:n.key}:o}var Bm=Q(()=>{xu();Yi();Te()});var Xi,wu=Q(()=>{dc();Xi=class{#e;constructor(e){this.#e=new en(e)}setContentEncryptionKey(e){return this.#e.setContentEncryptionKey(e),this}setInitializationVector(e){return this.#e.setInitializationVector(e),this}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}setKeyManagementParameters(e){return this.#e.setKeyManagementParameters(e),this}async encrypt(e,r){let n=await this.#e.encrypt(e,r);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}});var Sn,hc=Q(()=>{pt();nc();Qe();Te();Tt();$i();ji();ii();Er();Sn=class{#e;#t;#r;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this.#e=e}setProtectedHeader(e){return Ge(this.#t,"setProtectedHeader"),this.#t=e,this}setUnprotectedHeader(e){return Ge(this.#r,"setUnprotectedHeader"),this.#r=e,this}async sign(e,r){if(!this.#t&&!this.#r)throw new Ee("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Lr(this.#t,this.#r))throw new Ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...this.#t,...this.#r},i=Kr(Ee,new Map([["b64",!0]]),r?.crit,this.#t,n),s=!0;if(i.has("b64")&&(s=this.#t.b64,typeof s!="boolean"))throw new Ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:o}=n;if(typeof o!="string"||!o)throw new Ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');Hr(o,e,"sign");let a,c;s?(a=De(this.#e),c=ze(a)):(c=this.#e,a="");let l,d;this.#t?(l=De(JSON.stringify(this.#t)),d=ze(l)):(l="",d=new Uint8Array);let p=rt(d,ze("."),c),m=await ir(e,o),E=await nm(o,m,p),v={signature:De(E),payload:a};return this.#r&&(v.header=this.#r),this.#t&&(v.protected=l),v}}});var Qi,Ru=Q(()=>{hc();Qi=class{#e;constructor(e){this.#e=new Sn(e)}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}async sign(e,r){let n=await this.#e.sign(e,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return`${n.protected}.${n.payload}.${n.signature}`}}});var Ou,Ec,qm=Q(()=>{hc();Te();Er();Ou=class{#e;protectedHeader;unprotectedHeader;options;key;constructor(e,r,n){this.#e=e,this.key=r,this.options=n}setProtectedHeader(e){return Ge(this.protectedHeader,"setProtectedHeader"),this.protectedHeader=e,this}setUnprotectedHeader(e){return Ge(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},Ec=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new Ou(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new Ee("at least one signature must be added");let e={signatures:[],payload:""};for(let r=0;r<this.#t.length;r++){let n=this.#t[r],i=new Sn(this.#e);i.setProtectedHeader(n.protectedHeader),i.setUnprotectedHeader(n.unprotectedHeader);let{payload:s,...o}=await i.sign(n.key,n.options);if(r===0)e.payload=s;else if(e.payload!==s)throw new Ee("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(o)}return e}}});var Zi,jm=Q(()=>{Ru();Te();Yi();Zi=class{#e;#t;constructor(e={}){this.#t=new xn(e)}setIssuer(e){return this.#t.iss=e,this}setSubject(e){return this.#t.sub=e,this}setAudience(e){return this.#t.aud=e,this}setJti(e){return this.#t.jti=e,this}setNotBefore(e){return this.#t.nbf=e,this}setExpirationTime(e){return this.#t.exp=e,this}setIssuedAt(e){return this.#t.iat=e,this}setProtectedHeader(e){return this.#e=e,this}async sign(e,r){let n=new Qi(this.#t.data());if(n.setProtectedHeader(this.#e),Array.isArray(this.#e?.crit)&&this.#e.crit.includes("b64")&&this.#e.b64===!1)throw new Xe("JWTs MUST NOT use unencoded payload");return n.sign(e,r)}}});var yc,Gm=Q(()=>{wu();Yi();Er();yc=class{#e;#t;#r;#s;#n;#i;#a;#o;constructor(e={}){this.#o=new xn(e)}setIssuer(e){return this.#o.iss=e,this}setSubject(e){return this.#o.sub=e,this}setAudience(e){return this.#o.aud=e,this}setJti(e){return this.#o.jti=e,this}setNotBefore(e){return this.#o.nbf=e,this}setExpirationTime(e){return this.#o.exp=e,this}setIssuedAt(e){return this.#o.iat=e,this}setProtectedHeader(e){return Ge(this.#s,"setProtectedHeader"),this.#s=e,this}setKeyManagementParameters(e){return Ge(this.#r,"setKeyManagementParameters"),this.#r=e,this}setContentEncryptionKey(e){return Ge(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return Ge(this.#t,"setInitializationVector"),this.#t=e,this}replicateIssuerAsHeader(){return this.#n=!0,this}replicateSubjectAsHeader(){return this.#i=!0,this}replicateAudienceAsHeader(){return this.#a=!0,this}async encrypt(e,r){let n=new Xi(this.#o.data());return this.#s&&(this.#n||this.#i||this.#a)&&(this.#s={...this.#s,iss:this.#n?this.#o.iss:void 0,sub:this.#i?this.#o.sub:void 0,aud:this.#a?this.#o.aud:void 0}),n.setProtectedHeader(this.#s),this.#t&&n.setInitializationVector(this.#t),this.#e&&n.setContentEncryptionKey(this.#e),this.#r&&n.setKeyManagementParameters(this.#r),n.encrypt(e,r)}}});async function ku(t,e){let r;if(ni(t))r=t;else if(no(t))r=await qi(t);else throw new TypeError(nr(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":Fr(r.alg,'"alg" (Algorithm) Parameter'),Fr(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":Fr(r.crv,'"crv" (Curve) Parameter'),Fr(r.x,'"x" (X Coordinate) Parameter'),Fr(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":Fr(r.crv,'"crv" (Subtype of Key Pair) Parameter'),Fr(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":Fr(r.e,'"e" (Exponent) Parameter'),Fr(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":Fr(r.k,'"k" (Key Value) Parameter'),n={k:r.k,kty:r.kty};break;default:throw new re('"kty" (Key Type) Parameter missing or unsupported')}let i=ze(JSON.stringify(n));return De(await rc(e,i))}async function $m(t,e){e??="sha256";let r=await ku(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var Fr,Wm=Q(()=>{Er();pt();Te();Tt();_n();Qe();oc();Qn();Fr=(t,e)=>{if(typeof t!="string"||!t)throw new eo(`${e} missing or invalid`)}});async function zm(t,e){let r={...t,...e?.header};if(!be(r.jwk))throw new Ee('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n=await it({...r.jwk,ext:!0},r.alg);if(n instanceof Uint8Array||n.type!=="public")throw new Ee('"jwk" (JSON Web Key) Header Parameter must be a public key');return n}var Jm=Q(()=>{co();Qe();Te()});function VT(t){switch(typeof t=="string"&&t.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new re('Unsupported "alg" value for a JSON Web Key Set')}}function BT(t){return t&&typeof t=="object"&&Array.isArray(t.keys)&&t.keys.every(qT)}function qT(t){return be(t)}async function Ym(t,e,r){let n=t.get(e)||t.set(e,{}).get(e);if(n[r]===void 0){let i=await it({...e,ext:!0},r);if(i instanceof Uint8Array||i.type!=="public")throw new Ki("JSON Web Key Set members must be public keys");n[r]=i}return n[r]}function fo(t){let e=new Cu(t),r=async(n,i)=>e.getKey(n,i);return Object.defineProperties(r,{jwks:{value:()=>structuredClone(e.jwks()),enumerable:!1,configurable:!1,writable:!1}}),r}var Cu,Du=Q(()=>{co();Te();Qe();Cu=class{#e;#t=new WeakMap;constructor(e){if(!BT(e))throw new Ki("JSON Web Key Set malformed");this.#e=structuredClone(e)}jwks(){return this.#e}async getKey(e,r){let{alg:n,kid:i}={...e,...r?.header},s=VT(n),o=this.#e.keys.filter(l=>{let d=s===l.kty;if(d&&typeof i=="string"&&(d=i===l.kid),d&&(typeof l.alg=="string"||s==="AKP")&&(d=n===l.alg),d&&typeof l.use=="string"&&(d=l.use==="sig"),d&&Array.isArray(l.key_ops)&&(d=l.key_ops.includes("verify")),d)switch(n){case"ES256":d=l.crv==="P-256";break;case"ES384":d=l.crv==="P-384";break;case"ES512":d=l.crv==="P-521";break;case"Ed25519":case"EdDSA":d=l.crv==="Ed25519";break}return d}),{0:a,length:c}=o;if(c===0)throw new Zn;if(c!==1){let l=new to,d=this.#t;throw l[Symbol.asyncIterator]=async function*(){for(let p of o)try{yield await Ym(d,p,n)}catch{}},l}return Ym(this.#t,a,n)}}});function jT(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function GT(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(s=>{throw s.name==="TimeoutError"?new ro:s});if(i.status!==200)throw new nt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new nt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function $T(t,e){return!(typeof t!="object"||t===null||!("uat"in t)||typeof t.uat!="number"||Date.now()-t.uat>=e||!("jwks"in t)||!be(t.jwks)||!Array.isArray(t.jwks.keys)||!Array.prototype.every.call(t.jwks.keys,be))}function Xm(t,e){let r=new Uu(t,e),n=async(i,s)=>r.getKey(i,s);return Object.defineProperties(n,{coolingDown:{get:()=>r.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>r.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>r.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>r.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>r.jwks(),enumerable:!0,configurable:!1,writable:!1}}),n}var Pu,Lu,mo,Uu,Qm=Q(()=>{Te();Du();Qe();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(Pu="jose/v6.2.3");Lu=Symbol();mo=Symbol();Uu=class{#e;#t;#r;#s;#n;#i;#a;#o;#l;#c;constructor(e,r){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");this.#e=new URL(e.href),this.#t=typeof r?.timeoutDuration=="number"?r?.timeoutDuration:5e3,this.#r=typeof r?.cooldownDuration=="number"?r?.cooldownDuration:3e4,this.#s=typeof r?.cacheMaxAge=="number"?r?.cacheMaxAge:6e5,this.#a=new Headers(r?.headers),Pu&&!this.#a.has("User-Agent")&&this.#a.set("User-Agent",Pu),this.#a.has("accept")||(this.#a.set("accept","application/json"),this.#a.append("accept","application/jwk-set+json")),this.#o=r?.[Lu],r?.[mo]!==void 0&&(this.#c=r?.[mo],$T(r?.[mo],this.#s)&&(this.#n=this.#c.uat,this.#l=fo(this.#c.jwks)))}pendingFetch(){return!!this.#i}coolingDown(){return typeof this.#n=="number"?Date.now()<this.#n+this.#r:!1}fresh(){return typeof this.#n=="number"?Date.now()<this.#n+this.#s:!1}jwks(){return this.#l?.jwks()}async getKey(e,r){(!this.#l||!this.fresh())&&await this.reload();try{return await this.#l(e,r)}catch(n){if(n instanceof Zn&&this.coolingDown()===!1)return await this.reload(),this.#l(e,r);throw n}}async reload(){this.#i&&jT()&&(this.#i=void 0),this.#i||=GT(this.#e.href,this.#a,AbortSignal.timeout(this.#t),this.#o).then(e=>{this.#l=fo(e),this.#c&&(this.#c.uat=Date.now(),this.#c.jwks=e),this.#n=Date.now(),this.#i=void 0}).catch(e=>{throw this.#i=void 0,e}),await this.#i}}});var gc,Zm=Q(()=>{pt();Tt();Te();Yi();gc=class{#e;constructor(e={}){this.#e=new xn(e)}encode(){let e=De(JSON.stringify({alg:"none"})),r=De(this.#e.data());return`${e}.${r}.`}setIssuer(e){return this.#e.iss=e,this}setSubject(e){return this.#e.sub=e,this}setAudience(e){return this.#e.aud=e,this}setJti(e){return this.#e.jti=e,this}setNotBefore(e){return this.#e.nbf=e,this}setExpirationTime(e){return this.#e.exp=e,this}setIssuedAt(e){return this.#e.iat=e,this}static decode(e,r){if(typeof e!="string")throw new Xe("Unsecured JWT must be a string");let{0:n,1:i,2:s,length:o}=e.split(".");if(o!==3||s!=="")throw new Xe("Invalid Unsecured JWT");let a;try{if(a=JSON.parse(ct.decode(dt(n))),a.alg!=="none")throw new Error}catch{throw new Xe("Invalid Unsecured JWT")}return{payload:Ji(a,dt(i),r),header:a}}}});function eh(t){let e;if(typeof t=="string"){let r=t.split(".");(r.length===3||r.length===5)&&([e]=r)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");try{if(typeof e!="string"||!e)throw new Error;let r=JSON.parse(ct.decode(dt(e)));if(!be(r))throw new Error;return r}catch{throw new TypeError("Invalid Token or Protected Header formatting")}}var th=Q(()=>{pt();Tt();Qe()});function rh(t){if(typeof t!="string")throw new Xe("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new Xe("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new Xe("Invalid JWT");if(!e)throw new Xe("JWTs must contain a payload");let n;try{n=dt(e)}catch{throw new Xe("Failed to base64url decode the payload")}let i;try{i=JSON.parse(ct.decode(n))}catch{throw new Xe("Failed to parse the decoded payload as JSON")}if(!be(i))throw new Xe("Invalid JWT Claims Set");return i}var nh=Q(()=>{pt();Tt();Qe();Te()});function Mu(t){let e=t?.modulusLength??2048;if(typeof e!="number"||e<2048)throw new re("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function ih(t,e){let r,n;switch(t){case"PS256":case"PS384":case"PS512":r={name:"RSA-PSS",hash:`SHA-${t.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["sign","verify"];break;case"RS256":case"RS384":case"RS512":r={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":r={name:"RSA-OAEP",hash:`SHA-${parseInt(t.slice(-3),10)||1}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":r={name:"ECDSA",namedCurve:"P-256"},n=["sign","verify"];break;case"ES384":r={name:"ECDSA",namedCurve:"P-384"},n=["sign","verify"];break;case"ES512":r={name:"ECDSA",namedCurve:"P-521"},n=["sign","verify"];break;case"Ed25519":case"EdDSA":{n=["sign","verify"],r={name:"Ed25519"};break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{n=["sign","verify"],r={name:t};break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{n=["deriveBits"];let i=e?.crv??"P-256";switch(i){case"P-256":case"P-384":case"P-521":{r={name:"ECDH",namedCurve:i};break}case"X25519":r={name:"X25519"};break;default:throw new re("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519")}break}default:throw new re('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(r,e?.extractable??!1,n)}var sh=Q(()=>{Te()});async function oh(t,e){let r,n,i;switch(t){case"HS256":case"HS384":case"HS512":r=parseInt(t.slice(-3),10),n={name:"HMAC",hash:`SHA-${r}`,length:r},i=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r=parseInt(t.slice(-3),10),crypto.getRandomValues(new Uint8Array(r>>3));case"A128KW":case"A192KW":case"A256KW":r=parseInt(t.slice(1,4),10),n={name:"AES-KW",length:r},i=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":r=parseInt(t.slice(1,4),10),n={name:"AES-GCM",length:r},i=["encrypt","decrypt"];break;default:throw new re('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(n,e?.extractable??!1,i)}var ah=Q(()=>{Te()});var ch={};Ba(ch,{CompactEncrypt:()=>Xi,CompactSign:()=>Qi,EmbeddedJWK:()=>zm,EncryptJWT:()=>yc,FlattenedEncrypt:()=>en,FlattenedSign:()=>Sn,GeneralEncrypt:()=>pc,GeneralSign:()=>Ec,SignJWT:()=>Zi,UnsecuredJWT:()=>gc,base64url:()=>Ja,calculateJwkThumbprint:()=>ku,calculateJwkThumbprintUri:()=>$m,compactDecrypt:()=>uc,compactVerify:()=>mc,createLocalJWKSet:()=>fo,createRemoteJWKSet:()=>Xm,cryptoRuntime:()=>WT,customFetch:()=>Lu,decodeJwt:()=>rh,decodeProtectedHeader:()=>eh,errors:()=>lu,exportJWK:()=>qi,exportPKCS8:()=>Im,exportSPKI:()=>_m,flattenedDecrypt:()=>Wi,flattenedVerify:()=>zi,generalDecrypt:()=>Cm,generalVerify:()=>Um,generateKeyPair:()=>ih,generateSecret:()=>oh,importJWK:()=>it,importPKCS8:()=>ao,importSPKI:()=>sc,importX509:()=>vm,jwksCache:()=>mo,jwtDecrypt:()=>Vm,jwtVerify:()=>bn});var WT,ho=Q(()=>{xu();lc();Dm();Pm();Su();fc();Lm();Fm();Bm();wu();dc();Ru();hc();qm();jm();Gm();Wm();Jm();Du();Qm();Zm();oc();co();th();nh();Te();sh();ah();pt();WT="WebCryptoAPI"});var eg=he((oa,wl)=>{(function(t,e){"use strict";var r="",n="?",i="function",s="undefined",o="object",a="string",c="major",l="model",d="name",p="type",m="vendor",E="version",v="architecture",b="console",k="mobile",C="tablet",L="smarttv",B="wearable",G="embedded",j=500,$="Amazon",te="Apple",A="ASUS",x="BlackBerry",S="Browser",y="Chrome",_="Edge",w="Firefox",R="Google",N="Huawei",O="LG",P="Microsoft",U="Motorola",K="Opera",W="Samsung",J="Sharp",de="Sony",ke="Xiaomi",He="Zebra",fe="Facebook",Ne="Chromium OS",at="Mac OS",Ri=function(ve,Ce){var pe={};for(var Ke in ve)Ce[Ke]&&Ce[Ke].length%2===0?pe[Ke]=Ce[Ke].concat(ve[Ke]):pe[Ke]=ve[Ke];return pe},gn=function(ve){for(var Ce={},pe=0;pe<ve.length;pe++)Ce[ve[pe].toUpperCase()]=ve[pe];return Ce},Oi=function(ve,Ce){return typeof ve===a?Nt(Ce).indexOf(Nt(ve))!==-1:!1},Nt=function(ve){return ve.toLowerCase()},Gn=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},wt=function(ve,Ce){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof Ce===s?ve:ve.substring(0,j)},Ye=function(ve,Ce){for(var pe=0,Ke,Xr,kr,Oe,ie,Cr;pe<Ce.length&&!ie;){var Ql=Ce[pe],Df=Ce[pe+1];for(Ke=Xr=0;Ke<Ql.length&&!ie&&Ql[Ke];)if(ie=Ql[Ke++].exec(ve),ie)for(kr=0;kr<Df.length;kr++)Cr=ie[++Xr],Oe=Df[kr],typeof Oe===o&&Oe.length>0?Oe.length===2?typeof Oe[1]==i?this[Oe[0]]=Oe[1].call(this,Cr):this[Oe[0]]=Oe[1]:Oe.length===3?typeof Oe[1]===i&&!(Oe[1].exec&&Oe[1].test)?this[Oe[0]]=Cr?Oe[1].call(this,Cr,Oe[2]):e:this[Oe[0]]=Cr?Cr.replace(Oe[1],Oe[2]):e:Oe.length===4&&(this[Oe[0]]=Cr?Oe[3].call(this,Cr.replace(Oe[1],Oe[2])):e):this[Oe]=Cr||e;pe+=2}},Me=function(ve,Ce){for(var pe in Ce)if(typeof Ce[pe]===o&&Ce[pe].length>0){for(var Ke=0;Ke<Ce[pe].length;Ke++)if(Oi(Ce[pe][Ke],ve))return pe===n?e:pe}else if(Oi(Ce[pe],ve))return pe===n?e:pe;return ve},tT={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},kf={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Cf={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[E,[d,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[E,[d,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[d,E],[/opios[\/ ]+([\w\.]+)/i],[E,[d,K+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[E,[d,K+" GX"]],[/\bopr\/([\w\.]+)/i],[E,[d,K]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[E,[d,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[d,E],[/\bddg\/([\w\.]+)/i],[E,[d,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[E,[d,"UC"+S]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[E,[d,"WeChat"]],[/konqueror\/([\w\.]+)/i],[E,[d,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[E,[d,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[E,[d,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[E,[d,"Smart Lenovo "+S]],[/(avast|avg)\/([\w\.]+)/i],[[d,/(.+)/,"$1 Secure "+S],E],[/\bfocus\/([\w\.]+)/i],[E,[d,w+" Focus"]],[/\bopt\/([\w\.]+)/i],[E,[d,K+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[E,[d,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[E,[d,"Dolphin"]],[/coast\/([\w\.]+)/i],[E,[d,K+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[E,[d,"MIUI "+S]],[/fxios\/([-\w\.]+)/i],[E,[d,w]],[/\bqihu|(qi?ho?o?|360)browser/i],[[d,"360 "+S]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[d,/(.+)/,"$1 "+S],E],[/samsungbrowser\/([\w\.]+)/i],[E,[d,W+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[d,/_/g," "],E],[/metasr[\/ ]?([\d\.]+)/i],[E,[d,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[d,"Sogou Mobile"],E],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[d,E],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[d],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[d,fe],E],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[d,E],[/\bgsa\/([\w\.]+) .*safari\//i],[E,[d,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[E,[d,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[E,[d,y+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[d,y+" WebView"],E],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[E,[d,"Android "+S]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[d,E],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[E,[d,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[E,d],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[d,[E,Me,tT]],[/(webkit|khtml)\/([\w\.]+)/i],[d,E],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[d,"Netscape"],E],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[E,[d,w+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[d,E],[/(cobalt)\/([\w\.]+)/i],[d,[E,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[v,"amd64"]],[/(ia32(?=;))/i],[[v,Nt]],[/((?:i[346]|x)86)[;\)]/i],[[v,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[v,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[v,"armhf"]],[/windows (ce|mobile); ppc;/i],[[v,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[v,/ower/,r,Nt]],[/(sun4\w)[;\)]/i],[[v,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[v,Nt]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[m,W],[p,C]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[m,W],[p,k]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[m,te],[p,k]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[m,te],[p,C]],[/(macintosh);/i],[l,[m,te]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[m,J],[p,k]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[m,N],[p,C]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[m,N],[p,k]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[m,ke],[p,k]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[m,ke],[p,C]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[m,"OPPO"],[p,k]],[/\b(opd2\d{3}a?) bui/i],[l,[m,"OPPO"],[p,C]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[m,"Vivo"],[p,k]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[m,"Realme"],[p,k]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[m,U],[p,k]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[m,U],[p,C]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[m,O],[p,C]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[m,O],[p,k]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[m,"Lenovo"],[p,C]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[m,"Nokia"],[p,k]],[/(pixel c)\b/i],[l,[m,R],[p,C]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[m,R],[p,k]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[m,de],[p,k]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[m,de],[p,C]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[m,"OnePlus"],[p,k]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[m,$],[p,C]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[m,$],[p,k]],[/(playbook);[-\w\),; ]+(rim)/i],[l,m,[p,C]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[m,x],[p,k]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[m,A],[p,C]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[m,A],[p,k]],[/(nexus 9)/i],[l,[m,"HTC"],[p,C]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[m,[l,/_/g," "],[p,k]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[m,"Acer"],[p,C]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[m,"Meizu"],[p,k]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[m,"Ulefone"],[p,k]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[m,l,[p,k]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[m,l,[p,C]],[/(surface duo)/i],[l,[m,P],[p,C]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[m,"Fairphone"],[p,k]],[/(u304aa)/i],[l,[m,"AT&T"],[p,k]],[/\bsie-(\w*)/i],[l,[m,"Siemens"],[p,k]],[/\b(rct\w+) b/i],[l,[m,"RCA"],[p,C]],[/\b(venue[\d ]{2,7}) b/i],[l,[m,"Dell"],[p,C]],[/\b(q(?:mv|ta)\w+) b/i],[l,[m,"Verizon"],[p,C]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[m,"Barnes & Noble"],[p,C]],[/\b(tm\d{3}\w+) b/i],[l,[m,"NuVision"],[p,C]],[/\b(k88) b/i],[l,[m,"ZTE"],[p,C]],[/\b(nx\d{3}j) b/i],[l,[m,"ZTE"],[p,k]],[/\b(gen\d{3}) b.+49h/i],[l,[m,"Swiss"],[p,k]],[/\b(zur\d{3}) b/i],[l,[m,"Swiss"],[p,C]],[/\b((zeki)?tb.*\b) b/i],[l,[m,"Zeki"],[p,C]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[m,"Dragon Touch"],l,[p,C]],[/\b(ns-?\w{0,9}) b/i],[l,[m,"Insignia"],[p,C]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[m,"NextBook"],[p,C]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[m,"Voice"],l,[p,k]],[/\b(lvtel\-)?(v1[12]) b/i],[[m,"LvTel"],l,[p,k]],[/\b(ph-1) /i],[l,[m,"Essential"],[p,k]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[m,"Envizen"],[p,C]],[/\b(trio[-\w\. ]+) b/i],[l,[m,"MachSpeed"],[p,C]],[/\btu_(1491) b/i],[l,[m,"Rotor"],[p,C]],[/(shield[\w ]+) b/i],[l,[m,"Nvidia"],[p,C]],[/(sprint) (\w+)/i],[m,l,[p,k]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[m,P],[p,k]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[m,He],[p,C]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[m,He],[p,k]],[/smart-tv.+(samsung)/i],[m,[p,L]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[m,W],[p,L]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[m,O],[p,L]],[/(apple) ?tv/i],[m,[l,te+" TV"],[p,L]],[/crkey/i],[[l,y+"cast"],[m,R],[p,L]],[/droid.+aft(\w+)( bui|\))/i],[l,[m,$],[p,L]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[m,J],[p,L]],[/(bravia[\w ]+)( bui|\))/i],[l,[m,de],[p,L]],[/(mitv-\w{5}) bui/i],[l,[m,ke],[p,L]],[/Hbbtv.*(technisat) (.*);/i],[m,l,[p,L]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[m,wt],[l,wt],[p,L]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,L]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[m,l,[p,b]],[/droid.+; (shield) bui/i],[l,[m,"Nvidia"],[p,b]],[/(playstation [345portablevi]+)/i],[l,[m,de],[p,b]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[m,P],[p,b]],[/((pebble))app/i],[m,l,[p,B]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[m,te],[p,B]],[/droid.+; (glass) \d/i],[l,[m,R],[p,B]],[/droid.+; (wt63?0{2,3})\)/i],[l,[m,He],[p,B]],[/(quest( \d| pro)?)/i],[l,[m,fe],[p,B]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[m,[p,G]],[/(aeobc)\b/i],[l,[m,$],[p,G]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,k]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,C]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,C]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,k]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[m,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[E,[d,_+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[E,[d,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[d,E],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[E,d]],os:[[/microsoft (windows) (vista|xp)/i],[d,E],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[d,[E,Me,kf]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[E,Me,kf],[d,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[E,/_/g,"."],[d,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[d,at],[E,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[E,d],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[d,E],[/\(bb(10);/i],[E,[d,x]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[E,[d,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[E,[d,w+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[E,[d,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[E,[d,"watchOS"]],[/crkey\/([\d\.]+)/i],[E,[d,y+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[d,Ne],E],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[d,E],[/(sunos) ?([\w\.\d]*)/i],[[d,"Solaris"],E],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[d,E]]},er=function(ve,Ce){if(typeof ve===o&&(Ce=ve,ve=e),!(this instanceof er))return new er(ve,Ce).getResult();var pe=typeof t!==s&&t.navigator?t.navigator:e,Ke=ve||(pe&&pe.userAgent?pe.userAgent:r),Xr=pe&&pe.userAgentData?pe.userAgentData:e,kr=Ce?Ri(Cf,Ce):Cf,Oe=pe&&pe.userAgent==Ke;return this.getBrowser=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.browser),ie[c]=Gn(ie[E]),Oe&&pe&&pe.brave&&typeof pe.brave.isBrave==i&&(ie[d]="Brave"),ie},this.getCPU=function(){var ie={};return ie[v]=e,Ye.call(ie,Ke,kr.cpu),ie},this.getDevice=function(){var ie={};return ie[m]=e,ie[l]=e,ie[p]=e,Ye.call(ie,Ke,kr.device),Oe&&!ie[p]&&Xr&&Xr.mobile&&(ie[p]=k),Oe&&ie[l]=="Macintosh"&&pe&&typeof pe.standalone!==s&&pe.maxTouchPoints&&pe.maxTouchPoints>2&&(ie[l]="iPad",ie[p]=C),ie},this.getEngine=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.engine),ie},this.getOS=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.os),Oe&&!ie[d]&&Xr&&Xr.platform&&Xr.platform!="Unknown"&&(ie[d]=Xr.platform.replace(/chrome os/i,Ne).replace(/macos/i,at)),ie},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return Ke},this.setUA=function(ie){return Ke=typeof ie===a&&ie.length>j?wt(ie,j):ie,this},this.setUA(Ke),this};er.BROWSER=gn([d,E,c]),er.CPU=gn([v]),er.DEVICE=gn([l,m,p,b,k,L,C,B,G]),er.ENGINE=er.OS=gn([d,E]),typeof oa!==s?(typeof wl!==s&&wl.exports&&(oa=wl.exports=er),oa.UAParser=er):typeof define===i&&define.amd?define(function(){return er}):typeof t!==s&&(t.UAParser=er);var ki=typeof t!==s&&(t.jQuery||t.Zepto);if(ki&&!ki.ua){var Va=new er;ki.ua=Va.getResult(),ki.ua.get=function(){return Va.getUA()},ki.ua.set=function(ve){Va.setUA(ve);var Ce=Va.getResult();for(var pe in Ce)ki.ua[pe]=Ce[pe]}}})(typeof window=="object"?window:oa)});var og=he((H7,sg)=>{"use strict";var ng=ee("url"),ig=1800,op=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=ng.parse(r||""),i=this.parse(e),s;return i.domain?(s=i.domain.replace(/^\./,""),(n.hostname.length<s.length||("."+n.hostname).substr(-s.length+1)!=="."+s)&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||ig)||ig)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={};return(e||"").toString().split(";").forEach(n=>{let i=n.split("="),s=i.shift().trim().toLowerCase(),o=i.join("=").trim(),a;if(s)switch(s){case"expires":o=new Date(o),o.toString()!=="Invalid Date"&&(r.expires=o);break;case"path":r.path=o;break;case"domain":a=o.toLowerCase(),a.length&&a.charAt(0)!=="."&&(a="."+a),r.domain=a;break;case"max-age":r.expires=new Date(Date.now()+(Number(o)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break;default:r.name||(r.name=s,r.value=o)}}),r}match(e,r){let n=ng.parse(r||"");return!(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain)||this.getPath(n.pathname).substr(0,e.path.length)!==e.path||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");return r.pop(),r=r.join("/").trim(),r.charAt(0)!=="/"&&(r="/"+r),r.substr(-1)!=="/"&&(r+="/"),r}};sg.exports=op});var br=he((F7,fS)=>{fS.exports={name:"nodemailer",version:"8.0.10",description:"Easy as cake e-mail sending from your Node.js applications",main:"lib/nodemailer.js",scripts:{test:"node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))","test:coverage":"c8 node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))",format:'prettier --write "**/*.{js,json,md}"',"format:check":'prettier --check "**/*.{js,json,md}"',lint:"eslint .","lint:fix":"eslint . --fix",update:"rm -rf node_modules/ package-lock.json && ncu -u && npm install","test:syntax":'docker run --rm -v "$PWD:/app:ro" -w /app node:6-alpine node test/syntax-compat.js'},repository:{type:"git",url:"https://github.com/nodemailer/nodemailer.git"},keywords:["Nodemailer"],author:"Andris Reinman",license:"MIT-0",bugs:{url:"https://github.com/nodemailer/nodemailer/issues"},homepage:"https://nodemailer.com/",devDependencies:{"@aws-sdk/client-sesv2":"3.1037.0",bunyan:"1.8.15",c8:"11.0.0",eslint:"10.2.1","eslint-config-prettier":"10.1.8",globals:"17.5.0",libbase64:"1.3.0",libmime:"5.3.8",libqp:"2.1.1",prettier:"3.8.3",proxy:"1.0.2","proxy-test-server":"1.0.0","smtp-server":"3.18.4"},engines:{node:">=6.0.0"}}});var lr=he((V7,ap)=>{"use strict";var ag={ECONNECTION:"Connection closed unexpectedly",ETIMEDOUT:"Connection or operation timed out",ESOCKET:"Socket-level error",EDNS:"DNS resolution failed",ETLS:"TLS handshake or STARTTLS failed",EREQUIRETLS:"REQUIRETLS not supported by server (RFC 8689)",EPROTOCOL:"Invalid SMTP server response",EENVELOPE:"Invalid mail envelope (sender or recipients)",EMESSAGE:"Message delivery error",ESTREAM:"Stream processing error",EAUTH:"Authentication failed",ENOAUTH:"Authentication credentials not provided",EOAUTH2:"OAuth2 token generation or refresh error",EMAXLIMIT:"Pool resource limit reached (max messages per connection)",ESENDMAIL:"Sendmail command error",ESES:"AWS SES transport error",ECONFIG:"Invalid configuration",EPROXY:"Proxy connection error",EFILEACCESS:"File access rejected (disableFileAccess is set)",EURLACCESS:"URL access rejected (disableUrlAccess is set)",EFETCH:"HTTP fetch error"};ap.exports={ERROR_CODES:ag};for(let t of Object.keys(ag))ap.exports[t]=t});var ca=he((B7,cp)=>{"use strict";var mS=ee("http"),hS=ee("https"),cg=ee("url"),ES=ee("zlib"),{PassThrough:yS}=ee("stream"),lg=og(),gS=br(),vS=ee("net"),Wr=lr(),AS=5;cp.exports=function(t,e){return ug(t,e)};cp.exports.Cookies=lg;function ug(t,e){e=e||{},e.fetchRes=e.fetchRes||new yS,e.cookies=e.cookies||new lg,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?AS:e.maxRedirects,e.cookie&&([].concat(e.cookie||[]).forEach(m=>{e.cookies.set(m,t)}),e.cookie=!1);let r=e.fetchRes,n=cg.parse(t),i=(e.method||"").toString().trim().toUpperCase()||"GET",s=!1,o,a,c=n.protocol==="https:"?hS:mS,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+gS.version};if(Object.keys(e.headers||{}).forEach(m=>{l[m.toLowerCase().trim()]=e.headers[m]}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(o=e.cookies.get(t))&&(l.cookie=o),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",m=>{s||(s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(m=>{let E=e.body[m].toString().trim();return encodeURIComponent(m)+"="+encodeURIComponent(E)}).join("&"))}catch(m){if(s)return;s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m);return}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let d,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!1,agent:!1};e.tls&&Object.assign(p,e.tls),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!vS.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{d=c.request(p)}catch(m){return s=!0,setImmediate(()=>{m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m)}),r}return e.timeout&&d.setTimeout(e.timeout,()=>{if(s)return;s=!0,d.abort();let m=new Error("Request Timeout");m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m)}),d.on("error",m=>{s||(s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m))}),d.on("response",m=>{let E;if(!s){switch(m.headers["content-encoding"]){case"gzip":case"deflate":E=ES.createUnzip();break}if(m.headers["set-cookie"]&&[].concat(m.headers["set-cookie"]||[]).forEach(v=>{e.cookies.set(v,t)}),[301,302,303,307,308].includes(m.statusCode)&&m.headers.location){if(e.redirects++,e.redirects>e.maxRedirects){s=!0;let v=new Error("Maximum redirect count exceeded");v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort();return}return e.method="GET",e.body=!1,ug(cg.resolve(t,m.headers.location),e)}if(r.statusCode=m.statusCode,r.headers=m.headers,m.statusCode>=300&&!e.allowErrorResponse){s=!0;let v=new Error("Invalid status code "+m.statusCode);v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort();return}m.on("error",v=>{s||(s=!0,v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort())}),E?(m.pipe(E).pipe(r),E.on("error",v=>{s||(s=!0,v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort())})):m.pipe(r)}}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(d);d.write(a)}catch(m){s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m);return}d.end()}),r}});var Kt=he((q7,gt)=>{"use strict";var TS=ee("url"),_S=ee("util"),IS=ee("fs"),xS=ca(),dg=lr(),zr=ee("dns"),bS=ee("net"),SS=ee("os"),la=300*1e3,NS=30*1e3,pg=1e3,Ol=0;gt.exports._lastCacheCleanup=()=>Ol;gt.exports._resetCacheCleanup=()=>{Ol=0};var mg;try{mg=SS.networkInterfaces()}catch{}gt.exports.networkInterfaces=mg;var hg=(t,e)=>{let r=gt.exports.networkInterfaces;return r?Object.keys(r).map(n=>r[n]).reduce((n,i)=>n.concat(i),[]).filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},fg=(t,e,r,n)=>{if(r=r||{},!hg(t,r.allowInternalNetworkInterfaces))return n(null,[]);(zr.Resolver?new zr.Resolver(r):zr)["resolve"+t](e,(s,o)=>{if(s){switch(s.code){case zr.NODATA:case zr.NOTFOUND:case zr.NOTIMP:case zr.SERVFAIL:case zr.CONNREFUSED:case zr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(s)}return n(null,Array.isArray(o)?o:[].concat(o||[]))})},ur=gt.exports.dnsCache=new Map,Fn=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({servername:t.servername,host:n,_addresses:r},e||{})};gt.exports.resolveHostname=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||bS.isIP(t.host)){let a={addresses:[t.host],servername:t.servername||!1};return e(null,Fn(a,{cached:!1}))}let r;if(ur.has(t.host)){r=ur.get(t.host);let a=Date.now();if(a-Ol>NS){Ol=a;for(let[c,l]of ur.entries())l.expires&&l.expires<a&&ur.delete(c);if(ur.size>pg){let c=Math.floor(pg*.1);Array.from(ur.keys()).slice(0,c).forEach(d=>ur.delete(d))}}if(!r.expires||r.expires>=a)return e(null,Fn(r.value,{cached:!0}))}let n=[],i=[],s=null,o=null;fg(4,t.host,t,(a,c)=>{a?s=a:n=c||[],fg(6,t.host,t,(l,d)=>{l?o=l:i=d||[];let p=n.concat(i);if(p.length){let m={addresses:p,servername:t.servername||t.host};return ur.set(t.host,{value:m,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(m,{cached:!1}))}if(s&&o&&r)return ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:s}));try{zr.lookup(t.host,{all:!0},(m,E)=>{if(m)return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:m}))):e(m);let v=E?E.filter(k=>hg(k.family)).map(k=>k.address):[];if(E&&E.length&&!v.length&&console.warn(`Failed to resolve IPv${E[0].family} addresses with current network`),!v.length&&r)return e(null,Fn(r.value,{cached:!0}));let b={addresses:v.length?v:[t.host],servername:t.servername||t.host};return ur.set(t.host,{value:b,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(b,{cached:!1}))})}catch(m){return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:m}))):e(s||o||m)}})})};gt.exports.parseConnectionUrl=t=>{t=t||"";let e={},r=TS.parse(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}if(!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),r.auth){let n=r.auth.split(":");e.auth={user:n.shift(),pass:n.join(":")}}return Object.keys(r.query||{}).forEach(n=>{let i=e,s=n,o=r.query[n];switch(isNaN(o)||(o=Number(o)),o){case"true":o=!0;break;case"false":o=!1;break}if(n.indexOf("tls.")===0)s=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;s in i||(i[s]=o)}),e};gt.exports._logFunc=(t,e,r,n,i,...s)=>{let o=Object.assign({},r||{},n||{});delete o.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](o,i,...s)};gt.exports.getLogger=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(s=>{r[s]=()=>!1}),r;let i=t.logger===!0?wS(n):t.logger;return n.forEach(s=>{r[s]=(o,a,...c)=>{gt.exports._logFunc(i,s,e,o,a,...c)}}),r};gt.exports.callbackPromise=(t,e)=>function(){let r=Array.from(arguments),n=r.shift();n?e(n):t(...r)};gt.exports.parseDataURI=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,s=n.split(";");if(s.length>0){let l=s[s.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,s.pop())}let o=s.length>0?s.shift():"application/octet-stream",a={};for(let l=0;l<s.length;l++){let d=s[l],p=d.indexOf("=");if(p>0){let m=d.substring(0,p).trim(),E=d.substring(p+1).trim();m&&(a[m]=E)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:o||"application/octet-stream",params:a}};gt.exports.resolveContent=(t,e,r,n)=>{!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;n||(i=new Promise((a,c)=>{n=gt.exports.callbackPromise(a,c)}));let s=t&&t[e]&&t[e].content||t[e],o=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!s)return n(null,s);if(typeof s=="object"){if(typeof s.pipe=="function")return lp(s,(a,c)=>{if(a)return n(a);t[e].content?t[e].content=c:t[e]=c,n(null,c)});if(/^https?:\/\//i.test(s.path||s.href))return r.disableUrlAccess?setImmediate(()=>{let a=new Error("Url access rejected for "+(s.path||s.href));a.code=dg.EURLACCESS,n(a)}):lp(xS(s.path||s.href),n);if(/^data:/i.test(s.path||s.href)){let a=gt.exports.parseDataURI(s.path||s.href);return!a||!a.data?n(null,Buffer.from(0)):n(null,a.data)}else if(s.path)return r.disableFileAccess?setImmediate(()=>{let a=new Error("File access rejected for "+s.path);a.code=dg.EFILEACCESS,n(a)}):lp(IS.createReadStream(s.path),n)}return typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(o)&&(s=Buffer.from(t[e].content,o)),setImmediate(()=>n(null,s)),i};gt.exports.assign=function(){let t=Array.from(arguments),e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=Object.assign(e[n]||{},r[n]):e[n]=r[n]})}),e};gt.exports.encodeXText=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let s=e[n];s<33||s>126||s===43||s===61?r+="+"+(s<16?"0":"")+s.toString(16).toUpperCase():r+=String.fromCharCode(s)}return r};function lp(t,e){let r=!1,n=[],i=0;t.on("error",s=>{r||(r=!0,e(s))}),t.on("readable",()=>{let s;for(;(s=t.read())!==null;)n.push(s),i+=s.length}),t.on("end",()=>{if(r)return;r=!0;let s;try{s=Buffer.concat(n,i)}catch(o){return e(o)}e(null,s)})}function wS(t){let e=t.reduce((s,o)=>Math.max(s,o.length),0),r=new Map;t.forEach(s=>{let o=s.toUpperCase();o.length<e&&(o+=" ".repeat(e-o.length)),r.set(s,o)});let n=(s,o,a,...c)=>{let l="";o&&(o.tnx==="server"?l="S: ":o.tnx==="client"&&(l="C: "),o.sid&&(l="["+o.sid+"] "+l),o.cid&&(l="[#"+o.cid+"] "+l)),a=_S.format(a,...c),a.split(/\r?\n/).forEach(d=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(s),l+d)})},i={};return t.forEach(s=>{i[s]=n.bind(null,s)}),i}});var up=he((j7,vg)=>{"use strict";var RS=ee("path"),Eg="application/octet-stream",OS="bin",yg=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),gg=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);vg.exports={detectMimeType(t){if(!t)return Eg;let e=RS.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=gg.has(r)?gg.get(r):Eg;return Array.isArray(n)?n[0]:n},detectExtension(t){if(!t)return OS;let e=(t||"").toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(yg.has(r+"/"+n)){let i=yg.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}}});var fp=he((G7,Sg)=>{"use strict";var kS=/^xn--/,CS=/[^\0-\x7F]/,DS=/[\x2E\u3002\uFF0E\uFF61]/g,PS={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},dp=35,Jr=Math.floor,pp=String.fromCharCode;function Vn(t){throw new RangeError(PS[t])}function US(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function Tg(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(DS,".");let i=t.split("."),s=US(i,e).join(".");return n+s}function _g(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let s=t.charCodeAt(r++);(s&64512)==56320?e.push(((i&1023)<<10)+(s&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var LS=t=>String.fromCodePoint(...t),MS=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},Ag=function(t,e){return t+22+75*(t<26)-((e!=0)<<5)},Ig=function(t,e,r){let n=0;for(t=r?Jr(t/700):t>>1,t+=Jr(t/e);t>dp*26>>1;n+=36)t=Jr(t/dp);return Jr(n+(dp+1)*t/(t+38))},xg=function(t){let e=[],r=t.length,n=0,i=128,s=72,o=t.lastIndexOf("-");o<0&&(o=0);for(let a=0;a<o;++a)t.charCodeAt(a)>=128&&Vn("not-basic"),e.push(t.charCodeAt(a));for(let a=o>0?o+1:0;a<r;){let c=n;for(let d=1,p=36;;p+=36){a>=r&&Vn("invalid-input");let m=MS(t.charCodeAt(a++));m>=36&&Vn("invalid-input"),m>Jr((2147483647-n)/d)&&Vn("overflow"),n+=m*d;let E=p<=s?1:p>=s+26?26:p-s;if(m<E)break;let v=36-E;d>Jr(2147483647/v)&&Vn("overflow"),d*=v}let l=e.length+1;s=Ig(n-c,l,c==0),Jr(n/l)>2147483647-i&&Vn("overflow"),i+=Jr(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},bg=function(t){let e=[];t=_g(t);let r=t.length,n=128,i=0,s=72;for(let c of t)c<128&&e.push(pp(c));let o=e.length,a=o;for(o&&e.push("-");a<r;){let c=2147483647;for(let d of t)d>=n&&d<c&&(c=d);let l=a+1;c-n>Jr((2147483647-i)/l)&&Vn("overflow"),i+=(c-n)*l,n=c;for(let d of t)if(d<n&&++i>2147483647&&Vn("overflow"),d===n){let p=i;for(let m=36;;m+=36){let E=m<=s?1:m>=s+26?26:m-s;if(p<E)break;let v=p-E,b=36-E;e.push(pp(Ag(E+v%b,0))),p=Jr(v/b)}e.push(pp(Ag(p,0))),s=Ig(i,l,a===o),i=0,++a}++i,++n}return e.join("")},KS=function(t){return Tg(t,function(e){return kS.test(e)?xg(e.slice(4).toLowerCase()):e})},HS=function(t){return Tg(t,function(e){return CS.test(e)?"xn--"+bg(e):e})},FS={version:"2.3.1",ucs2:{decode:_g,encode:LS},decode:xg,encode:bg,toASCII:HS,toUnicode:KS};Sg.exports=FS});var yp=he(($7,Ng)=>{"use strict";var{Transform:VS}=ee("stream");function mp(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function hp(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=[],n=0,i=e*1024,s=new RegExp(".{"+e+"}","g");for(;n<t.length;){let o=t.substr(n,i).replace(s,`$&\r
-`).trim();r.push(o),n+=i}return r.join(`\r
-`).trim()}var Ep=class extends VS{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return setImmediate(n);this.inputBytes+=e.length,this._remainingBytes&&this._remainingBytes.length&&(e=Buffer.concat([this._remainingBytes,e],this._remainingBytes.length+e.length),this._remainingBytes=!1),e.length%3?(this._remainingBytes=e.slice(e.length-e.length%3),e=e.slice(0,e.length-e.length%3)):this._remainingBytes=!1;let i=this._curLine+mp(e);if(this.options.lineLength){i=hp(i,this.options.lineLength);let s=i.lastIndexOf(`
-`);s<0?(this._curLine=i,i=""):s===i.length-1?this._curLine="":(this._curLine=i.substring(s+1),i=i.substring(0,s+1))}i&&(this.outputBytes+=i.length,this.push(Buffer.from(i,"ascii"))),setImmediate(n)}_flush(e){this._remainingBytes&&this._remainingBytes.length&&(this._curLine+=mp(this._remainingBytes)),this._curLine&&(this._curLine=hp(this._curLine,this.options.lineLength),this.outputBytes+=this._curLine.length,this.push(Buffer.from(this._curLine,"ascii")),this._curLine=""),e()}};Ng.exports={encode:mp,wrap:hp,Encoder:Ep}});var Ap=he((W7,Rg)=>{"use strict";var{Transform:BS}=ee("stream"),qS=[[9],[10],[13],[32,60],[62,126]];function gp(t){typeof t=="string"&&(t=Buffer.from(t,"utf-8"));let e="",r;for(let n=0,i=t.length;n<i;n++){if(r=t[n],jS(r,qS)&&!((r===32||r===9)&&(n===i-1||t[n+1]===10||t[n+1]===13))){e+=String.fromCharCode(r);continue}e+="="+(r<16?"0":"")+r.toString(16).toUpperCase()}return e}function wg(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=0,n=t.length,i,s,o,a=Math.floor(e/3),c="";for(;r<n;){if(o=t.substr(r,e),i=o.match(/\r\n/)){o=o.substr(0,i.index+i[0].length),c+=o,r+=o.length;continue}if(o.substr(-1)===`
-`){c+=o,r+=o.length;continue}if(i=o.substr(-a).match(/\n.*?$/)){o=o.substr(0,o.length-(i[0].length-1)),c+=o,r+=o.length;continue}if(o.length>e-a&&(i=o.substr(-a).match(/[ \t.,!?][^ \t.,!?]*$/)))o=o.substr(0,o.length-(i[0].length-1));else if(o.match(/[=][\da-f]{0,2}$/i))for((i=o.match(/[=][\da-f]{0,1}$/i))&&(o=o.substr(0,o.length-i[0].length));o.length>3&&o.length<n-r&&!o.match(/^(?:=[\da-f]{2}){1,4}$/i)&&(i=o.match(/[=][\da-f]{2}$/gi))&&(s=parseInt(i[0].substr(1,2),16),!(s<128||(o=o.substr(0,o.length-3),s>=192))););r+o.length<n&&o.substr(-1)!==`
-`?(o.length===e&&o.match(/[=][\da-f]{2}$/i)?o=o.substr(0,o.length-3):o.length===e&&(o=o.substr(0,o.length-1)),r+=o.length,o+=`=\r
-`):r+=o.length,c+=o}return c}function jS(t,e){for(let r=e.length-1;r>=0;r--){let n=e[r];if(n.length&&(n.length===1&&t===n[0]||n.length===2&&t>=n[0]&&t<=n[1]))return!0}return!1}var vp=class extends BS{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){let i;if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return n();this.inputBytes+=e.length,this.options.lineLength?(i=this._curLine+gp(e),i=wg(i,this.options.lineLength),i=i.replace(/(^|\n)([^\n]*)$/,(s,o,a)=>(this._curLine=a,o)),i&&(this.outputBytes+=i.length,this.push(i))):(i=gp(e),this.outputBytes+=i.length,this.push(i,"ascii")),n()}_flush(e){this._curLine&&(this.outputBytes+=this._curLine.length,this.push(this._curLine,"ascii")),e()}};Rg.exports={encode:gp,wrap:wg,Encoder:vp}});var da=he((z7,kg)=>{"use strict";var ua=yp(),GS=Ap(),Og=up();kg.exports={isPlainText(t,e){return typeof t=="string"&&!(e?/[\x00-\x08\x0b\x0c\x0e-\x1f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)},hasLongerLines(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)},encodeWord(t,e,r){e=(e||"Q").toString().toUpperCase().trim().charAt(0),r=r||0;let n,i="UTF-8";if(r&&r>7+i.length&&(r-=7+i.length),e==="Q"?n=GS.encode(t).replace(/[^a-z0-9!*+\-/=]/gi,s=>{let o=s.charCodeAt(0).toString(16).toUpperCase();return s===" "?"_":"="+(o.length===1?"0"+o:o)}):e==="B"&&(n=typeof t=="string"?t:ua.encode(t),r=r?Math.max(3,(r-r%4)/4*3):0),r&&(e!=="B"?n:ua.encode(t)).length>r)if(e==="Q")n=this.splitMimeEncodedString(n,r).join("?= =?"+i+"?"+e+"?");else{let s=[],o="";for(let a=0,c=n.length;a<c;a++){let l=n.charAt(a);/[\ud83c\ud83d\ud83e]/.test(l)&&a<c-1&&(l+=n.charAt(++a)),Buffer.byteLength(o+l)<=r||a===0?o+=l:(s.push(ua.encode(o)),o=l)}o&&s.push(ua.encode(o)),s.length>1?n=s.join("?= =?"+i+"?"+e+"?"):n=s.join("")}else e==="B"&&(n=ua.encode(t));return"=?"+i+"?"+e+"?"+n+(n.substr(-2)==="?="?"":"?=")},encodeWords(t,e,r,n){r=r||0;let i=t.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);if(!i)return t;if(n)return this.encodeWord(t,e,r);let s=t.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);if(!s)return t;let o=i.index+(i[0].match(/[^\s]/)||{index:0}).index,a=s.index+(s[1]||"").length;return(o?t.substr(0,o):"")+this.encodeWord(t.substring(o,a),e||"Q",r)+(a<t.length?t.substr(a):"")},buildHeaderValue(t){let e=[];return Object.keys(t.params||{}).forEach(r=>{let n=t.params[r];!this.isPlainText(n,!0)||n.length>=75?this.buildHeaderParam(r,n,50).forEach(i=>{!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(i.value)||i.key.substr(-1)==="*"?e.push(i.key+"="+i.value):e.push(i.key+"="+JSON.stringify(i.value))}):/[\s'"\\;:/=(),<>@[\]?]|^-/.test(n)?e.push(r+"="+JSON.stringify(n)):e.push(r+"="+n)}),t.value+(e.length?"; "+e.join("; "):"")},buildHeaderParam(t,e,r){let n=[],i=typeof e=="string"?e:(e||"").toString(),s,o,a,c=0,l,d;if(r=r||50,this.isPlainText(e,!0)){if(i.length<=r)return[{key:t,value:i}];i=i.replace(new RegExp(".{"+r+"}","g"),p=>(n.push({line:p}),"")),i&&n.push({line:i})}else{if(/[\uD800-\uDBFF]/.test(i)){let m=[];for(l=0,d=i.length;l<d;l++)s=i.charAt(l),o=s.charCodeAt(0),o>=55296&&o<=56319&&l<d-1?(s+=i.charAt(l+1),m.push(s),l++):m.push(s);i=m}a="utf-8''";let p=!0;for(c=0,l=0,d=i.length;l<d;l++){if(s=i[l],p)s=this.safeEncodeURIComponent(s);else if(s=s===" "?s:this.safeEncodeURIComponent(s),s!==i[l])if((this.safeEncodeURIComponent(a)+s).length>=r)n.push({line:a,encoded:p}),a="",c=l-1;else{p=!0,l=c,a="";continue}(a+s).length>=r?(n.push({line:a,encoded:p}),a=s=i[l]===" "?" ":this.safeEncodeURIComponent(i[l]),s===i[l]?(p=!1,c=l-1):p=!0):a+=s}a&&n.push({line:a,encoded:p})}return n.map((p,m)=>({key:t+"*"+m+(p.encoded?"*":""),value:p.line}))},parseHeaderValue(t){let e={value:!1,params:{}},r=!1,n="",i="value",s=!1,o=!1,a;for(let c=0,l=t.length;c<l;c++)if(a=t.charAt(c),i==="key"){if(a==="="){r=n.trim().toLowerCase(),i="value",n="";continue}n+=a}else{if(o)n+=a;else if(a==="\\"){o=!0;continue}else s&&a===s?s=!1:!s&&a==='"'?s=a:!s&&a===";"?(r===!1?e.value=n.trim():e.params[r]=n.trim(),i="key",n=""):n+=a;o=!1}return i==="value"?r===!1?e.value=n.trim():e.params[r]=n.trim():n.trim()&&(e.params[n.trim().toLowerCase()]=""),Object.keys(e.params).forEach(c=>{let l,d,p,m;(p=c.match(/(\*(\d+)|\*(\d+)\*|\*)$/))&&(l=c.substr(0,p.index),d=Number(p[2]||p[3])||0,(!e.params[l]||typeof e.params[l]!="object")&&(e.params[l]={charset:!1,values:[]}),m=e.params[c],d===0&&p[0].substr(-1)==="*"&&(p=m.match(/^([^']*)'[^']*'(.*)$/))&&(e.params[l].charset=p[1]||"iso-8859-1",m=p[2]),e.params[l].values[d]=m,delete e.params[c])}),Object.keys(e.params).forEach(c=>{let l;e.params[c]&&Array.isArray(e.params[c].values)&&(l=e.params[c].values.map(d=>d||"").join(""),e.params[c].charset?e.params[c]="=?"+e.params[c].charset+"?Q?"+l.replace(/[=?_\s]/g,d=>{let p=d.charCodeAt(0).toString(16);return d===" "?"_":"%"+(p.length<2?"0":"")+p}).replace(/%/g,"=")+"?=":e.params[c]=l)}),e},detectExtension:t=>Og.detectExtension(t),detectMimeType:t=>Og.detectMimeType(t),foldLines(t,e,r){t=(t||"").toString(),e=e||76;let n=0,i=t.length,s="",o,a;for(;n<i;){if(o=t.substr(n,e),o.length<e){s+=o;break}if(a=o.match(/^[^\n\r]*(\r?\n|\r)/)){o=a[0],s+=o,n+=o.length;continue}else(a=o.match(/(\s+)[^\s]*$/))&&a[0].length-(r?(a[1]||"").length:0)<o.length?o=o.substr(0,o.length-(a[0].length-(r?(a[1]||"").length:0))):(a=t.substr(n+o.length).match(/^[^\s]+(\s*)/))&&(o=o+a[0].substr(0,a[0].length-(r?0:(a[1]||"").length)));s+=o,n+=o.length,n<i&&(s+=`\r
-`)}return s},splitMimeEncodedString:(t,e)=>{let r=[],n,i,s,o;for(e=Math.max(e||0,12);t.length;){for(n=t.substr(0,e),(i=n.match(/[=][0-9A-F]?$/i))&&(n=n.substr(0,i.index)),o=!1;!o;)o=!0,(i=t.substr(n.length).match(/^[=]([0-9A-F]{2})/i))&&(s=parseInt(i[1],16),s<194&&s>127&&(n=n.substr(0,n.length-3),o=!1));n.length&&r.push(n),t=t.substr(n.length)}return r},encodeURICharComponent:t=>{let e="",r=t.charCodeAt(0).toString(16).toUpperCase();if(r.length%2&&(r="0"+r),r.length>2)for(let n=0,i=r.length/2;n<i;n++)e+="%"+r.substr(n,2);else e+="%"+r;return e},safeEncodeURIComponent(t){t=(t||"").toString();try{t=encodeURIComponent(t)}catch{return t.replace(/[^\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]+/g,"")}return t.replace(/[\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]/g,e=>this.encodeURICharComponent(e))}}});var Pg=he((J7,Dg)=>{"use strict";function $S(t,e){let r=!1,n="text",i=[],s={address:[],comment:[],group:[],text:[],textWasQuoted:[]},o=!1;for(let a=0,c=t.length;a<c;a++){let l=t[a],d=a?t[a-1]:null;if(l.type==="operator")switch(l.value){case"<":n="address",o=!1;break;case"(":n="comment",o=!1;break;case":":n="group",r=!0,o=!1;break;case'"':o=!o,n="text";break;default:n="text",o=!1;break}else l.value&&(n==="address"&&(l.value=l.value.replace(/^[^<]*<\s*/,"")),d&&d.noBreak&&s[n].length?(s[n][s[n].length-1]+=l.value,n==="text"&&o&&(s.textWasQuoted[s.textWasQuoted.length-1]=!0)):(s[n].push(l.value),n==="text"&&s.textWasQuoted.push(o)))}if(!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),r){s.text=s.text.join(" ");let a=[];s.group.length&&Cg(s.group.join(","),{_depth:e+1}).forEach(l=>{l.group?a=a.concat(l.group):a.push(l)}),i.push({name:s.text||"",group:a})}else{if(!s.address.length&&s.text.length){for(let c=s.text.length-1;c>=0;c--)if(!s.textWasQuoted[c]&&/^[^@\s]+@[^@\s]+$/.test(s.text[c])){s.address=s.text.splice(c,1),s.textWasQuoted.splice(c,1);break}if(!s.address.length){let c=!1;for(let l=s.text.length-1;l>=0&&!(!s.textWasQuoted[l]&&(s.text[l]=s.text[l].replace(/\s*\b[^@\s]+@[^\s]+\b\s*/,d=>c?d:(s.address=[d.trim()],c=!0," ")).trim(),c));l--);}}!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),s.address.length>1&&(s.text=s.text.concat(s.address.splice(1))),s.text=s.text.join(" "),s.address=s.address.join(" ");let a={address:s.address||s.text||"",name:s.text||s.address||""};a.address===a.name&&(/@/.test(a.address||"")?a.name="":a.address=""),i.push(a)}return i}var Tp=class{constructor(e){this.str=(e||"").toString(),this.operatorCurrent="",this.operatorExpecting="",this.node=null,this.escaped=!1,this.list=[],this.operators={'"':'"',"(":")","<":">",",":"",":":";",";":""}}tokenize(){let e=[];for(let r=0,n=this.str.length;r<n;r++){let i=this.str.charAt(r),s=r<n-1?this.str.charAt(r+1):null;this.checkChar(i,s)}return this.list.forEach(r=>{r.value=(r.value||"").toString().trim(),r.value&&e.push(r)}),e}checkChar(e,r){if(!this.escaped){if(e===this.operatorExpecting){this.node={type:"operator",value:e},r&&![" ","	","\r",`
-`,",",";"].includes(r)&&(this.node.noBreak=!0),this.list.push(this.node),this.node=null,this.operatorExpecting="",this.escaped=!1;return}else if(!this.operatorExpecting&&e in this.operators){this.node={type:"operator",value:e},this.list.push(this.node),this.node=null,this.operatorExpecting=this.operators[e],this.escaped=!1;return}else if(['"',"'"].includes(this.operatorExpecting)&&e==="\\"){this.escaped=!0;return}}this.node||(this.node={type:"text",value:""},this.list.push(this.node)),e===`
-`&&(e=" "),(e.charCodeAt(0)>=33||[" ","	"].includes(e))&&(this.node.value+=e),this.escaped=!1}},WS=50;function Cg(t,e){e=e||{};let r=e._depth||0;if(r>WS)return[];let i=new Tp(t).tokenize(),s=[],o=[],a=[];i.forEach(c=>{c.type==="operator"&&(c.value===","||c.value===";")?(o.length&&s.push(o),o=[]):o.push(c)}),o.length&&s.push(o),s.forEach(c=>{let l=$S(c,r);l.length&&(a=a.concat(l))});for(let c=a.length-2;c>=0;c--){let l=a[c],d=a[c+1];l.address===""&&l.name&&!l.group&&d.address&&d.name&&(d.name=l.name+", "+d.name,a.splice(c,1))}if(e.flatten){let c=[],l=d=>{d.forEach(p=>{if(p.group)return l(p.group);c.push(p)})};return l(a),c}return a}Dg.exports=Cg});var Lg=he((Y7,Ug)=>{"use strict";var{Transform:zS}=ee("stream"),_p=class extends zS{constructor(){super(),this.lastByte=!1}_transform(e,r,n){e.length&&(this.lastByte=e[e.length-1]),this.push(e),n()}_flush(e){return this.lastByte===10?e():this.lastByte===13?(this.push(Buffer.from(`
-`)),e()):(this.push(Buffer.from(`\r
-`)),e())}};Ug.exports=_p});var xp=he((X7,Mg)=>{"use strict";var{Transform:JS}=ee("stream"),Ip=class extends JS{constructor(e){super(e),this.lastByte=!1}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>s&&(i=e.slice(s,o),this.push(i)),this.push(Buffer.from(`\r
-`)),s=o+1);s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),this.lastByte=e[e.length-1],n()}};Mg.exports=Ip});var Hg=he((Q7,Kg)=>{"use strict";var{Transform:YS}=ee("stream"),bp=class extends YS{constructor(e){super(e)}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===13&&(i=e.slice(s,o),s=o+1,this.push(i));s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),n()}};Kg.exports=bp});var kl=he((Z7,Bg)=>{"use strict";var Sp=ee("crypto"),XS=ee("fs"),Fg=fp(),{PassThrough:pa}=ee("stream"),QS=Kt(),Sr=da(),ZS=Ap(),eN=yp(),tN=Pg(),rN=ca(),Vg=lr(),nN=Lg(),iN=xp(),sN=Hg(),oN=["From","Sender","To","Cc","Bcc","Reply-To","Date","References"],Np=class t{constructor(e,r){this.nodeCounter=0,r=r||{},this.baseBoundary=r.baseBoundary||Sp.randomBytes(8).toString("hex"),this.boundaryPrefix=r.boundaryPrefix||"--_NmP",this.disableFileAccess=!!r.disableFileAccess,this.disableUrlAccess=!!r.disableUrlAccess,this.normalizeHeaderKey=r.normalizeHeaderKey,this.date=r.parentNode?null:new Date,this.rootNode=r.rootNode||this,this.keepBcc=!!r.keepBcc,r.filename&&(this.filename=r.filename,e||(e=Sr.detectMimeType(this.filename.split(".").pop()))),this.textEncoding=(r.textEncoding||"").toString().trim().charAt(0).toUpperCase(),this.parentNode=r.parentNode,this.hostname=r.hostname,this.newline=r.newline,this.childNodes=[],this._nodeId=++this.rootNode.nodeCounter,this._headers=[],this._isPlainText=!1,this._hasLongLines=!1,this._envelope=!1,this._raw=!1,this._transforms=[],this._processFuncs=[],e&&this.setHeader("Content-Type",e)}createChild(e,r){!r&&typeof e=="object"&&(r=e,e=void 0);let n=new t(e,r);return this.appendChild(n),n}appendChild(e){return e.rootNode!==this.rootNode&&(e.rootNode=this.rootNode,e._nodeId=++this.rootNode.nodeCounter),e.parentNode=this,this.childNodes.push(e),e}replace(e){return e===this?this:(this.parentNode.childNodes.forEach((r,n)=>{r===this&&(e.rootNode=this.rootNode,e.parentNode=this.parentNode,e._nodeId=this._nodeId,this.rootNode=this,this.parentNode=void 0,e.parentNode.childNodes[n]=e)}),e)}remove(){if(!this.parentNode)return this;for(let e=this.parentNode.childNodes.length-1;e>=0;e--)if(this.parentNode.childNodes[e]===this)return this.parentNode.childNodes.splice(e,1),this.parentNode=void 0,this.rootNode=this,this}setHeader(e,r){let n=!1;if(!r&&e&&typeof e=="object")return e.key&&"value"in e?this.setHeader(e.key,e.value):Array.isArray(e)?e.forEach(s=>{this.setHeader(s.key,s.value)}):Object.keys(e).forEach(s=>{this.setHeader(s,e[s])}),this;e=this._normalizeHeaderKey(e);let i={key:e,value:r};for(let s=0,o=this._headers.length;s<o;s++)this._headers[s].key===e&&(n?(this._headers.splice(s,1),s--,o--):(this._headers[s]=i,n=!0));return n||this._headers.push(i),this}addHeader(e,r){return!r&&e&&typeof e=="object"?(e.key&&e.value?this.addHeader(e.key,e.value):Array.isArray(e)?e.forEach(n=>{this.addHeader(n.key,n.value)}):Object.keys(e).forEach(n=>{this.addHeader(n,e[n])}),this):Array.isArray(r)?(r.forEach(n=>{this.addHeader(e,n)}),this):(this._headers.push({key:this._normalizeHeaderKey(e),value:r}),this)}getHeader(e){e=this._normalizeHeaderKey(e);for(let r=0,n=this._headers.length;r<n;r++)if(this._headers[r].key===e)return this._headers[r].value}setContent(e){return this.content=e,typeof this.content.pipe=="function"?(this._contentErrorHandler=r=>{this.content.removeListener("error",this._contentErrorHandler),this.content=r},this.content.once("error",this._contentErrorHandler)):typeof this.content=="string"&&(this._isPlainText=Sr.isPlainText(this.content),this._isPlainText&&Sr.hasLongerLines(this.content,76)&&(this._hasLongLines=!0)),this}build(e){let r;e||(r=new Promise((a,c)=>{e=QS.callbackPromise(a,c)}));let n=this.createReadStream(),i=[],s=0,o=!1;return n.on("readable",()=>{let a;for(;(a=n.read())!==null;)i.push(a),s+=a.length}),n.once("error",a=>{if(!o)return o=!0,e(a)}),n.once("end",a=>{if(!o)return o=!0,a&&a.length&&(i.push(a),s+=a.length),e(null,Buffer.concat(i,s))}),r}getTransferEncoding(){let e=!1,r=(this.getHeader("Content-Type")||"").toString().toLowerCase().trim();return this.content&&(e=(this.getHeader("Content-Transfer-Encoding")||"").toString().toLowerCase().trim(),(!e||!["base64","quoted-printable"].includes(e))&&(/^text\//i.test(r)?this._isPlainText&&!this._hasLongLines?e="7bit":typeof this.content=="string"||this.content instanceof Buffer?e=this._getTextEncoding(this.content)==="Q"?"quoted-printable":"base64":e=this.textEncoding==="B"?"base64":"quoted-printable":/^(multipart|message)\//i.test(r)||(e=e||"base64"))),e}buildHeaders(){let e=this.getTransferEncoding(),r=[];if(e&&this.setHeader("Content-Transfer-Encoding",e),this.filename&&!this.getHeader("Content-Disposition")&&this.setHeader("Content-Disposition","attachment"),this.rootNode===this){this.getHeader("Date")||this.setHeader("Date",this.date.toUTCString().replace(/GMT/,"+0000")),this.messageId(),this.getHeader("MIME-Version")||this.setHeader("MIME-Version","1.0");for(let n=this._headers.length-2;n>=0;n--){let i=this._headers[n];i.key==="Content-Type"&&(this._headers.splice(n,1),this._headers.push(i))}}return this._headers.forEach(n=>{let i=n.key,s=n.value,o,a,c={};if(!(s&&typeof s=="object"&&!oN.includes(i)&&(Object.keys(s).forEach(d=>{d!=="value"&&(c[d]=s[d])}),s=(s.value||"").toString(),!s.trim()))){if(c.prepared){c.foldLines?r.push(Sr.foldLines(i+": "+s)):r.push(i+": "+s);return}switch(n.key){case"Content-Disposition":o=Sr.parseHeaderValue(s),this.filename&&(o.params.filename=this.filename),s=Sr.buildHeaderValue(o);break;case"Content-Type":o=Sr.parseHeaderValue(s),this._handleContentType(o),o.value.match(/^text\/plain\b/)&&typeof this.content=="string"&&/[\u0080-\uFFFF]/.test(this.content)&&(o.params.charset="utf-8"),s=Sr.buildHeaderValue(o),this.filename&&(a=this._encodeWords(this.filename),(a!==this.filename||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(a))&&(a='"'+a+'"'),s+="; name="+a);break;case"Bcc":if(!this.keepBcc)return;break}if(s=this._encodeHeaderValue(i,s),!!(s||"").toString().trim()){if(typeof this.normalizeHeaderKey=="function"){let d=this.normalizeHeaderKey(i,s);d&&typeof d=="string"&&d.length&&(i=d)}r.push(Sr.foldLines(i+": "+s,76))}}}),r.join(`\r
-`)}createReadStream(e){e=e||{};let r=new pa(e),n=r,i;this.stream(r,e,s=>{if(s){n.emit("error",s);return}r.end()});for(let s=0,o=this._transforms.length;s<o;s++)i=typeof this._transforms[s]=="function"?this._transforms[s]():this._transforms[s],n.once("error",a=>{i.emit("error",a)}),n=n.pipe(i);i=new nN,n.once("error",s=>{i.emit("error",s)}),n=n.pipe(i);for(let s=0,o=this._processFuncs.length;s<o;s++)i=this._processFuncs[s],n=i(n);if(this.newline){let o=["win","windows","dos",`\r
-`].includes(this.newline.toString().toLowerCase())?new iN:new sN,a=n.pipe(o);return n.on("error",c=>a.emit("error",c)),a}return n}transform(e){this._transforms.push(e)}processFunc(e){this._processFuncs.push(e)}stream(e,r,n){let i=this.getTransferEncoding(),s,o,a=!1,c=p=>{a||(a=!0,n(p))},l=()=>{let p=0,m=()=>{if(p>=this.childNodes.length)return e.write(`\r
---`+this.boundary+`--\r
-`),c();let E=this.childNodes[p++];e.write((p>1?`\r
-`:"")+"--"+this.boundary+`\r
-`),E.stream(e,r,v=>{if(v)return c(v);setImmediate(m)})};if(this.multipart)setImmediate(m);else return c()},d=()=>{if(this.content){if(Object.prototype.toString.call(this.content)==="[object Error]")return c(this.content);typeof this.content.pipe=="function"&&(this.content.removeListener("error",this._contentErrorHandler),this._contentErrorHandler=m=>c(m),this.content.once("error",this._contentErrorHandler));let p=()=>{["quoted-printable","base64"].includes(i)?(s=new(i==="base64"?eN:ZS).Encoder(r),s.pipe(e,{end:!1}),s.once("end",l),s.once("error",m=>c(m)),o=this._getStream(this.content),o.pipe(s)):(o=this._getStream(this.content),o.pipe(e,{end:!1}),o.once("end",l)),o.once("error",m=>c(m))};if(this.content._resolve){let m=[],E=0,v=!1,b=this._getStream(this.content);b.on("error",k=>{v||(v=!0,c(k))}),b.on("readable",()=>{let k;for(;(k=b.read())!==null;)m.push(k),E+=k.length}),b.on("end",()=>{v||(v=!0,this.content._resolve=!1,this.content._resolvedValue=Buffer.concat(m,E),setImmediate(p))})}else setImmediate(p);return}return setImmediate(l)};this._raw?setImmediate(()=>{if(Object.prototype.toString.call(this._raw)==="[object Error]")return c(this._raw);typeof this._raw.pipe=="function"&&this._raw.removeListener("error",this._contentErrorHandler);let p=this._getStream(this._raw);p.pipe(e,{end:!1}),p.on("error",m=>e.emit("error",m)),p.on("end",l)}):(e.write(this.buildHeaders()+`\r
-\r
-`),setImmediate(d))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseAddresses(e.from),r),r=r.filter(i=>i&&i.address),r.length&&r[0]&&(this._envelope.from=r[0].address)),["to","cc","bcc"].forEach(i=>{e[i]&&this._convertAddresses(this._parseAddresses(e[i]),this._envelope.to)}),this._envelope.to=this._envelope.to.map(i=>i.address).filter(i=>i);let n=["to","cc","bcc","from"];return Object.keys(e).forEach(i=>{n.includes(i)||(this._envelope[i]=e[i])}),this}getAddresses(){let e={};return this._headers.forEach(r=>{let n=r.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(n)&&(Array.isArray(e[n])||(e[n]=[]),this._convertAddresses(this._parseAddresses(r.value),e[n]))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]};return this._headers.forEach(r=>{let n=[];r.key==="From"||!e.from&&["Reply-To","Sender"].includes(r.key)?(this._convertAddresses(this._parseAddresses(r.value),n),n.length&&n[0]&&(e.from=n[0].address)):["To","Cc","Bcc"].includes(r.key)&&this._convertAddresses(this._parseAddresses(r.value),e.to)}),e.to=e.to.map(r=>r.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&(this._contentErrorHandler=r=>{this._raw.removeListener("error",this._contentErrorHandler),this._raw=r},this._raw.once("error",this._contentErrorHandler)),this}_getStream(e){let r;return e._resolvedValue?(r=new pa,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this.disableFileAccess?(r=new pa,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Vg.EFILEACCESS,r.emit("error",n)}),r):XS.createReadStream(e.path):e&&typeof e.href=="string"?this.disableUrlAccess?(r=new pa,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=Vg.EURLACCESS,r.emit("error",n)}),r):rN(e.href,{headers:e.httpHeaders}):(r=new pa,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){return[].concat.apply([],[].concat(e).map(r=>r&&r.address?(r.address=this._normalizeAddress(r.address),r.name=r.name||"",[r]):tN(r)))}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart?this.boundary=e.params.boundary=e.params.boundary||this.boundary||this._generateBoundary():this.boundary=!1}_generateBoundary(){return this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," "),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeWords(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeWords(r)}}_convertAddresses(e,r){let n=[];return r=r||[],[].concat(e||[]).forEach(i=>{if(i.address)i.address=this._normalizeAddress(i.address),i.name?n.push(`${this._encodeAddressName(i.name)} <${i.address}>`):n.push(i.address.indexOf(" ")>=0?`<${i.address}>`:`${i.address}`),r.some(s=>s.address===i.address)||r.push(i);else if(i.group){let s=(i.group.length?this._convertAddresses(i.group,r):"").trim();n.push(`${this._encodeAddressName(i.name)}:${s};`)}}),n.join(", ")}_normalizeAddress(e){e=(e||"").toString().replace(/[\x00-\x1F<>]+/g," ").trim();let r=e.lastIndexOf("@");if(r<0)return e;let n=e.substr(0,r),i=e.substr(r+1),s=i;try{/[\x80-\uFFFF]/.test(n)?s=Fg.toUnicode(i.toLowerCase()):s=Fg.toASCII(i.toLowerCase())}catch{}return n.indexOf(" ")>=0&&(n.charAt(0)!=='"'&&(n='"'+n),n.substr(-1)!=='"'&&(n=n+'"')),`${n}@${s}`}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?'"'+e.replace(/([\\"])/g,"\\$1")+'"':Sr.encodeWord(e,this._getTextEncoding(e),52)}_encodeWords(e){return Sr.encodeWords(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,s=e.length;i<s;i++){let o=e.charCodeAt(i);o>=0&&o<=8||o===11||o===12||o>=14&&o<=31||o>=128?r++:(o>=65&&o<=90||o>=97&&o<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+Sp.randomBytes(r).toString("hex"),Sp.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}};Bg.exports=Np});var jg=he((eX,qg)=>{"use strict";var fa=kl(),wp=da(),{parseDataURI:aN}=Kt(),Rp=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new fa("message/rfc822",{newline:this.mail.newline}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n,i=[].concat(this.mail.attachments||[]).map((s,o)=>{/^data:/i.test(s.path||s.href)&&(s=this._processDataUrl(s));let a=s.contentType||wp.detectMimeType(s.filename||s.path||s.href||"bin"),c=/^image\//i.test(a),l=/^message\//i.test(a),d=s.contentDisposition||(l||c&&s.cid?"inline":"attachment"),p;"contentTransferEncoding"in s?p=s.contentTransferEncoding:l?p="8bit":p="base64";let m={contentType:a,contentDisposition:d,contentTransferEncoding:p};return s.filename?m.filename=s.filename:!l&&s.filename!==!1&&(m.filename=(s.path||s.href||"").split("/").pop().split("?").shift()||"attachment-"+(o+1),m.filename.indexOf(".")<0&&(m.filename+="."+wp.detectExtension(m.contentType))),/^https?:\/\//i.test(s.path)&&(s.href=s.path,s.path=void 0),s.cid&&(m.cid=s.cid),s.raw?m.raw=s.raw:s.path?m.content={path:s.path}:s.href?m.content={href:s.href,httpHeaders:s.httpHeaders}:m.content=s.content||"",s.encoding&&(m.encoding=s.encoding),s.headers&&(m.headers=s.headers),m});return this.mail.icalEvent&&(typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?r=this.mail.icalEvent:r={content:this.mail.icalEvent},n=Object.assign({},r),n.contentType="application/ics",n.headers||(n.headers={}),n.filename=n.filename||"invite.ics",n.headers["Content-Disposition"]="attachment",n.headers["Content-Transfer-Encoding"]="base64"),e?{attached:i.filter(s=>!s.cid).concat(n||[]),related:i.filter(s=>!!s.cid)}:{attached:i.concat(n||[]),related:[]}}getAlternatives(){let e=[],r,n,i,s,o,a;return this.mail.text&&(typeof this.mail.text=="object"&&(this.mail.text.content||this.mail.text.path||this.mail.text.href||this.mail.text.raw)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(typeof this.mail.watchHtml=="object"&&(this.mail.watchHtml.content||this.mail.watchHtml.path||this.mail.watchHtml.href||this.mail.watchHtml.raw)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(typeof this.mail.amp=="object"&&(this.mail.amp.content||this.mail.amp.path||this.mail.amp.href||this.mail.amp.raw)?s=this.mail.amp:s={content:this.mail.amp},s.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?o=this.mail.icalEvent:o={content:this.mail.icalEvent},a=Object.assign({},o),a.content&&typeof a.content=="object"&&(a.content._resolve=!0),a.filename=!1,a.contentType="text/calendar; charset=utf-8; method="+(a.method||"PUBLISH").toString().trim().toUpperCase(),a.headers||(a.headers={})),this.mail.html&&(typeof this.mail.html=="object"&&(this.mail.html.content||this.mail.html.path||this.mail.html.href||this.mail.html.raw)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(s||[]).concat(n||[]).concat(a||[]).concat(this.mail.alternatives||[]).forEach(c=>{/^data:/i.test(c.path||c.href)&&(c=this._processDataUrl(c));let l={contentType:c.contentType||wp.detectMimeType(c.filename||c.path||c.href||"txt"),contentTransferEncoding:c.contentTransferEncoding};c.filename&&(l.filename=c.filename),/^https?:\/\//i.test(c.path)&&(c.href=c.path,c.path=void 0),c.raw?l.raw=c.raw:c.path?l.content={path:c.path}:c.href?l.content={href:c.href}:l.content=c.content||"",c.encoding&&(l.encoding=c.encoding),c.headers&&(l.headers=c.headers),e.push(l)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",s=r.indexOf(",");if(s>0&&s<200){let a=r.substring(5,s).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign({},e,{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=aN(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}};qg.exports=Rp});var $g=he((tX,Gg)=>{"use strict";var{Transform:cN}=ee("stream"),Op=class extends cN{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,s=r-n;i<s;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,s=this.lastBytes.length+e.length;i<s;i++){let o;if(i<r?o=this.lastBytes[i]:o=e[i-r],o===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length-1>n){let i=e.slice(n);this.bodySize+=i.length,setImmediate(()=>this.push(i))}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(s){return n(s)}i&&(this.bodySize+=e.length,this.push(e)),setImmediate(n)}_flush(e){if(this.headerChunks){let r=Buffer.concat(this.headerChunks,this.headerBytes);this.bodySize+=r.length,this.push(r),this.headerChunks=null}e()}parseHeaders(){let e=(this.rawHeaders||"").toString().split(/\r?\n/);for(let r=e.length-1;r>0;r--)/^\s/.test(e[r])&&(e[r-1]+=`
-`+e[r],e.splice(r,1));return e.filter(r=>r.trim()).map(r=>({key:r.substr(0,r.indexOf(":")).trim().toLowerCase(),line:r}))}};Gg.exports=Op});var zg=he((rX,Wg)=>{"use strict";var{Transform:lN}=ee("stream"),uN=ee("crypto"),kp=class extends lN{constructor(e){super(),e=e||{},this.chunkBuffer=[],this.chunkBufferLen=0,this.bodyHash=uN.createHash(e.hashAlgo||"sha1"),this.remainder="",this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1}updateHash(e){let r,n="",i="file";for(let o=e.length-1;o>=0;o--){let a=e[o];if(!(i==="file"&&(a===10||a===13))){if(i==="file"&&(a===9||a===32))i="line";else if(!(i==="line"&&(a===9||a===32))){if((i==="file"||i==="line")&&(i="body",o===e.length-1))break}}if(o===0){if(i==="file"&&(!this.remainder||/[\r\n]$/.test(this.remainder))||i==="line"&&(!this.remainder||/[ \t]$/.test(this.remainder))){this.remainder+=e.toString("binary");return}else if(i==="line"||i==="file"){n=e.toString("binary"),e=!1;break}}if(i==="body"){n=e.slice(o+1).toString("binary"),e=e.slice(0,o+1);break}}let s=!!this.remainder;if(e&&!s){for(let o=0,a=e.length;o<a;o++)if(o&&e[o]===10&&e[o-1]!==13){s=!0;break}else if(o&&e[o]===13&&e[o-1]===32){s=!0;break}else if(o&&e[o]===32&&e[o-1]===32){s=!0;break}else if(e[o]===9){s=!0;break}}s?(r=this.remainder+(e?e.toString("binary"):""),this.remainder=n,r=r.replace(/\r?\n/g,`
-`).replace(/[ \t]*$/gm,"").replace(/[ \t]+/gm," ").replace(/\n/g,`\r
-`),e=Buffer.from(r,"binary")):n&&(this.remainder=n),this.debug&&this._debugBody.push(e),this.bodyHash.update(e)}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r)),this.updateHash(e),this.byteLength+=e.length,this.push(e),n()}_flush(e){/[\r\n]$/.test(this.remainder)&&this.byteLength>2&&this.bodyHash.update(Buffer.from(`\r
-`)),this.byteLength||this.push(Buffer.from(`\r
-`)),this.emit("hash",this.bodyHash.digest("base64"),this.debug?Buffer.concat(this._debugBody):!1),e()}};Wg.exports=kp});var Xg=he((nX,Cp)=>{"use strict";var dN=fp(),pN=da(),fN=ee("crypto");Cp.exports=(t,e,r,n)=>{n=n||{};let s=n.headerFieldNames||"From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive",o=Jg(t,s,n.skipFields),a=mN(n.domainName,n.keySelector,o.fieldNames,e,r);o.headers+="dkim-signature:"+Yg(a);let c=fN.createSign(("rsa-"+e).toUpperCase());c.update(o.headers);let l;try{l=c.sign(n.privateKey,"base64")}catch{return!1}return a+l.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g,`$&\r
- `).trim()};Cp.exports.relaxedHeaders=Jg;function mN(t,e,r,n,i){let s=["v=1","a=rsa-"+n,"c=relaxed/relaxed","d="+dN.toASCII(t),"q=dns/txt","s="+e,"bh="+i,"h="+r].join("; ");return pN.foldLines("DKIM-Signature: "+s,76)+`;\r
- b=`}function Jg(t,e,r){let n=new Set,i=new Set,s=new Map;(r||"").toLowerCase().split(":").forEach(c=>{i.add(c.trim())}),(e||"").toLowerCase().split(":").filter(c=>!i.has(c.trim())).forEach(c=>{n.add(c.trim())});for(let c=t.length-1;c>=0;c--){let l=t[c];n.has(l.key)&&!s.has(l.key)&&s.set(l.key,Yg(l.line))}let o=[],a=[];return n.forEach(c=>{s.has(c)&&(a.push(c),o.push(c+":"+s.get(c)))}),{headers:o.join(`\r
-`)+`\r
-`,fieldNames:a.join(":")}}function Yg(t){return t.substr(t.indexOf(":")+1).replace(/\r?\n/g,"").replace(/\s+/g," ").trim()}});var Zg=he((iX,Qg)=>{"use strict";var hN=$g(),EN=zg(),yN=Xg(),{PassThrough:Dp}=ee("stream"),Pp=ee("fs"),gN=ee("path"),vN=ee("crypto"),AN="sha256",TN=2*1024*1024,Up=class{constructor(e,r,n,i){this.options=e||{},this.keys=r,this.cacheTreshold=Number(this.options.cacheTreshold)||TN,this.hashAlgo=this.options.hashAlgo||AN,this.cacheDir=this.options.cacheDir||!1,this.chunks=[],this.chunklen=0,this.readPos=0,this.cachePath=this.cacheDir?gN.join(this.cacheDir,"message."+Date.now()+"-"+vN.randomBytes(14).toString("hex")):!1,this.cache=!1,this.headers=!1,this.bodyHash=!1,this.parser=!1,this.relaxedBody=!1,this.input=n,this.output=i,this.output.usingCache=!1,this.hasErrored=!1,this.input.on("error",s=>{this.hasErrored=!0,this.cleanup(),i.emit("error",s)})}cleanup(){!this.cache||!this.cachePath||Pp.unlink(this.cachePath,()=>!1)}createReadCache(){this.cache=Pp.createReadStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.output.emit("error",e)}),this.cache.once("close",()=>{this.cleanup()}),this.cache.pipe(this.output)}sendNextChunk(){if(this.hasErrored)return;if(this.readPos>=this.chunks.length)return this.cache?this.createReadCache():this.output.end();let e=this.chunks[this.readPos++];if(this.output.write(e)===!1)return this.output.once("drain",()=>{this.sendNextChunk()});setImmediate(()=>this.sendNextChunk())}sendSignedOutput(){let e=0,r=()=>{if(e>=this.keys.length)return this.output.write(this.parser.rawHeaders),setImmediate(()=>this.sendNextChunk());let n=this.keys[e++],i=yN(this.headers,this.hashAlgo,this.bodyHash,{domainName:n.domainName,keySelector:n.keySelector,privateKey:n.privateKey,headerFieldNames:this.options.headerFieldNames,skipFields:this.options.skipFields});return i&&this.output.write(Buffer.from(i+`\r
-`)),setImmediate(r)};if(this.bodyHash&&this.headers)return r();this.output.write(this.parser.rawHeaders),this.sendNextChunk()}createWriteCache(){this.output.usingCache=!0,this.cache=Pp.createWriteStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.relaxedBody.unpipe(this.cache),this.relaxedBody.on("readable",()=>{for(;this.relaxedBody.read()!==null;);}),this.hasErrored=!0,this.output.emit("error",e)}),this.cache.once("close",()=>{this.sendSignedOutput()}),this.relaxedBody.removeAllListeners("readable"),this.relaxedBody.pipe(this.cache)}signStream(){this.parser=new hN,this.relaxedBody=new EN({hashAlgo:this.hashAlgo}),this.parser.on("headers",e=>{this.headers=e}),this.relaxedBody.on("hash",e=>{this.bodyHash=e}),this.relaxedBody.on("readable",()=>{let e;if(!this.cache){for(;(e=this.relaxedBody.read())!==null;)if(this.chunks.push(e),this.chunklen+=e.length,this.chunklen>=this.cacheTreshold&&this.cachePath)return this.createWriteCache()}}),this.relaxedBody.on("end",()=>{this.cache||this.sendSignedOutput()}),this.parser.pipe(this.relaxedBody),setImmediate(()=>this.input.pipe(this.parser))}},Lp=class{constructor(e){this.options=e||{},this.keys=[].concat(this.options.keys||{domainName:e.domainName,keySelector:e.keySelector,privateKey:e.privateKey})}sign(e,r){let n=new Dp,i=e,s=!1;Buffer.isBuffer(e)?(s=e,i=new Dp):typeof e=="string"&&(s=Buffer.from(e),i=new Dp);let o=this.options;r&&Object.keys(r).length&&(o=Object.assign({},r,this.options));let a=new Up(o,this.keys,i,n);return setImmediate(()=>{a.signStream(),s&&setImmediate(()=>{i.end(s)})}),n}};Qg.exports=Lp});var iv=he((sX,nv)=>{"use strict";var ev=ee("net"),tv=ee("tls"),_N=ee("url"),IN=lr();function rv(t,e,r,n){let i=_N.parse(t),s={host:i.hostname,port:Number(i.port)?Number(i.port):i.protocol==="https:"?443:80},o;i.protocol==="https:"?(s.rejectUnauthorized=!1,o=tv.connect.bind(tv)):o=ev.connect.bind(ev);let a,c=!1,l=p=>{if(!c){c=!0;try{a.destroy()}catch{}n(p)}},d=()=>{let p=new Error("Proxy socket timed out");p.code="ETIMEDOUT",l(p)};a=o(s,()=>{if(c)return;let p={Host:r+":"+e,Connection:"close"};i.auth&&(p["Proxy-Authorization"]="Basic "+Buffer.from(i.auth).toString("base64")),a.write("CONNECT "+r+":"+e+` HTTP/1.1\r
-`+Object.keys(p).map(v=>v+": "+p[v]).join(`\r
-`)+`\r
-\r
-`);let m="",E=v=>{let b,k;if(!c&&(m+=v.toString("binary"),b=m.match(/\r\n\r\n/))){if(a.removeListener("data",E),k=m.substr(b.index+b[0].length),m=m.substr(0,b.index),k&&a.unshift(Buffer.from(k,"binary")),c=!0,b=m.match(/^HTTP\/\d+\.\d+ (\d+)/i),!b||(b[1]||"").charAt(0)!=="2"){try{a.destroy()}catch{}let C=new Error("Invalid response from proxy"+(b&&": "+b[1]||""));return C.code=IN.EPROXY,n(C)}return a.removeListener("error",l),a.removeListener("timeout",d),a.setTimeout(0),n(null,a)}};a.on("data",E)}),a.setTimeout(rv.timeout||30*1e3),a.on("timeout",d),a.once("error",l)}nv.exports=rv});var av=he((oX,ov)=>{"use strict";var sv=Kt(),xN=kl(),Vs=da(),Mp=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};Object.assign(this.data,r),this.data.headers=this.data.headers||{},Object.keys(i).forEach(s=>{s in this.data?s==="headers"&&Object.keys(i.headers).forEach(o=>{o in this.data.headers||(this.data.headers[o]=i.headers[o])}):this.data[s]=i[s]}),["disableFileAccess","disableUrlAccess","normalizeHeaderKey"].forEach(s=>{s in n&&(this.data[s]=n[s])})}resolveContent(...e){return sv.resolveContent(...e)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split("/").pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Vs.detectExtension(c.contentType))),c.contentType||(c.contentType=Vs.detectMimeType(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new xN;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let o=0,a=()=>{if(o>=r.length)return e(null,this.data);let c=r[o++];if(!c[0]||!c[0][c[1]])return a();sv.resolveContent(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,d)=>{if(l)return e(l);let p={content:d};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&Object.keys(c[0][c[1]]).forEach(m=>{!(m in p)&&!["content","path","href","raw"].includes(m)&&(p[m]=c[0][c[1]][m])}),c[0][c[1]]=p,a()})};setImmediate(()=>a())}normalize(e){let r=this.data.envelope||this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,s)=>i?e(i):(s.envelope=r,s.messageId=n,["html","text","watchHtml","amp"].forEach(o=>{s[o]&&s[o].content&&(typeof s[o].content=="string"?s[o]=s[o].content:Buffer.isBuffer(s[o].content)&&(s[o]=s[o].content.toString()))}),s.icalEvent&&Buffer.isBuffer(s.icalEvent.content)&&(s.icalEvent.content=s.icalEvent.content.toString("base64"),s.icalEvent.encoding="base64"),s.alternatives&&s.alternatives.length&&s.alternatives.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.attachments&&s.attachments.length&&s.attachments.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.normalizedHeaders={},Object.keys(s.headers||{}).forEach(o=>{let a=[].concat(s.headers[o]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(o)&&(a=this.message._encodeHeaderValue(o,a)),s.normalizedHeaders[o]=a)}),s.list&&typeof s.list=="object"&&this._getListHeaders(s.list).forEach(a=>{s.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),s.references&&(s.normalizedHeaders.references=this.message._encodeHeaderValue("references",s.references)),s.inReplyTo&&(s.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",s.inReplyTo)),e(null,s)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){if(r.toLowerCase().trim()==="id"){let o=(i.comment||"").toString().replace(/\r?\n|\r/g," ");return Vs.isPlainText(o)?o='"'+o+'"':o=Vs.encodeWord(o),(i.comment?o+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+\/{,2}/,"")}let s=(i.comment||"").toString().replace(/\r?\n|\r/g," ");return Vs.isPlainText(s)||(s=Vs.encodeWord(s)),this._formatListUrl(i.url)+(i.comment?" ("+s+")":"")}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};ov.exports=Mp});var pv=he((aX,dv)=>{"use strict";var bN=ee("events"),cv=Kt(),SN=up(),NN=jg(),lv=Zg(),wN=iv(),uv=lr(),RN=ee("util"),ON=ee("url"),Kp=br(),kN=av(),CN=ee("net"),DN=ee("dns"),PN=ee("crypto"),Hp=class extends bN{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new lv(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=cv.getLogger(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...s)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...s)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((s,o)=>{r=cv.callbackPromise(s,o)})),typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let i=new kN(this,e);return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",i,s=>{if(s)return this.logger.error({err:s,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",s.message),r(s);i.message=new NN(i.data).compile(),i.setMailerHeader(),i.setPriorityHeaders(),i.setListHeaders(),this._processPlugins("stream",i,o=>{if(o)return this.logger.error({err:o,tnx:"plugin",action:"stream"},"PluginStream Error: %s",o.message),r(o);(i.data.dkim||this.dkim)&&i.message.processFunc(a=>{let c=i.data.dkim?new lv(i.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:i.message.messageId(),dkimDomains:c.keys.map(l=>l.keySelector+"."+l.domainName).join(", ")},"Signing outgoing message with %s keys",c.keys.length),c.sign(a,i.data._dkim)}),this.transporter.send(i,(...a)=>{a[0]&&this.logger.error({err:a[0],tnx:"transport",action:"send"},"Send Error: %s",a[0].message),r(...a)})})}),n}getVersionString(){return RN.format("%s (%s; +%s; %s/%s)",Kp.name,Kp.version,Kp.homepage,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],s=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+s.length===0)return n();let o=0,a="default",c=()=>{let l=a==="default"?s:i;if(o>=l.length)if(a==="default"&&i.length)a="user",o=0,l=i;else return n();let d=l[o++];d(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=ON.parse(e);this.getSocket=(n,i)=>{let s=r.protocol.replace(/:$/,"").toLowerCase();if(this.meta.has("proxy_handler_"+s))return this.meta.get("proxy_handler_"+s)(r,n,i);switch(s){case"http":case"https":wN(r.href,n.port,n.host,(a,c)=>a?i(a):i(null,{connection:c}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let c=new Error("Socks module not loaded");return c.code=uv.EPROXY,i(c)}let a=c=>{let l=!!this.meta.get("proxy_socks_module").SocksClient,d=l?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),p=Number(r.protocol.replace(/\D/g,""))||5,m={proxy:{ipaddress:c,port:Number(r.port),type:p},[l?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(r.auth){let E=decodeURIComponent(r.auth.split(":").shift()),v=decodeURIComponent(r.auth.split(":").pop());l?(m.proxy.userId=E,m.proxy.password=v):p===4?m.userid=E:m.authentication={username:E,password:v}}d.createConnection(m,(E,v)=>E?i(E):i(null,{connection:v.socket||v}))};return CN.isIP(r.hostname)?a(r.hostname):DN.resolve(r.hostname,(c,l)=>{if(c)return i(c);a(Array.isArray(l)?l[0]:l)})}}let o=new Error("Unknown proxy configuration");o.code=uv.EPROXY,i(o)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let s=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(o,a,c,l)=>{let d=PN.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:d,filename:"image-"+ ++s+"."+SN.detectExtension(l)}),a+"cid:"+d}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}};dv.exports=Hp});var mv=he((cX,fv)=>{"use strict";var{Transform:UN}=ee("stream"),Fp=class extends UN{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],s=0,o,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,o=0,a=e.length;o<a;o++)e[o]===46?(o&&e[o-1]===10||!o&&(!this.lastByte||this.lastByte===10))&&(l=e.slice(c,o+1),i.push(l),i.push(Buffer.from(".")),s+=l.length+1,c=o+1):e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>c?(l=e.slice(c,o),i.push(l),s+=l.length+2):s+=2,i.push(Buffer.from(`\r
-`)),c=o+1);s?(c<e.length&&(l=e.slice(c),i.push(l),s+=l.length),this.outByteCount+=s,this.push(Buffer.concat(i,s))):(this.outByteCount+=e.length,this.push(e)),this.lastByte=e[e.length-1],n()}_flush(e){let r;this.lastByte===10?r=Buffer.from(`.\r
-`):this.lastByte===13?r=Buffer.from(`
-.\r
-`):r=Buffer.from(`\r
-.\r
-`),this.outByteCount+=r.length,this.push(r),e()}};fv.exports=Fp});var Cl=he((lX,Tv)=>{"use strict";var LN=br(),{EventEmitter:MN}=ee("events"),hv=ee("net"),Ev=ee("tls"),KN=ee("os"),yv=ee("crypto"),HN=mv(),{PassThrough:gv}=ee("stream"),Ii=Kt(),FN=120*1e3,vv=600*1e3,VN=30*1e3,BN=30*1e3,qN=()=>{};function Av(t){if(!t)return t;let e=Buffer.from(t,"binary").toString("utf8");return e.includes("\uFFFD")?t:e}var Vp=class extends MN{constructor(e){super(e),this.id=yv.randomBytes(8).toString("base64").replace(/\W/g,""),this.stage="init",this.options=e||{},this.secureConnection=!!this.options.secure,this.alreadySecured=!!this.options.secured,this.port=Number(this.options.port)||(this.secureConnection?465:587),this.host=this.options.host||"localhost",this.servername=this.options.servername?this.options.servername:hv.isIP(this.host)?!1:this.host,this.allowInternalNetworkInterfaces=this.options.allowInternalNetworkInterfaces||!1,typeof this.options.secure>"u"&&this.port===465&&(this.secureConnection=!0),this.name=(this.options.name||this._getHostname()).toString().replace(/[\r\n]+/g,""),this.logger=Ii.getLogger(this.options,{component:this.options.component||"smtp-connection",sid:this.id}),this.customAuth=new Map;for(let r of Object.keys(this.options.customAuth||{})){let n=(r||"").toString().trim().toUpperCase();n&&this.customAuth.set(n,this.options.customAuth[r])}this.version=LN.version,this.authenticated=!1,this.destroyed=!1,this.secure=!!this.secureConnection,this._remainder="",this._responseQueue=[],this.lastServerResponse=!1,this._socket=!1,this._supportedAuth=[],this.allowsAuth=!1,this._envelope=!1,this._supportedExtensions=[],this._maxAllowedSize=0,this._responseActions=[],this._recipientQueue=[],this._greetingTimeout=!1,this._connectionTimeout=!1,this._destroyed=!1,this._closing=!1,this._currentDataStream=!1,this._onSocketData=r=>this._onData(r),this._onSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN"),this._onSocketClose=()=>this._onClose(),this._onSocketEnd=()=>this._onEnd(),this._onSocketTimeout=()=>this._onTimeout(),this._onConnectionSocketError=r=>this._onConnectionError(r,"ESOCKET"),this._connectionAttemptId=0}connect(e){if(typeof e=="function"){this.once("connect",()=>{this.logger.debug({tnx:"smtp"},"SMTP handshake finished"),e()});let n=this._isDestroyedMessage("connect");if(n)return e(this._formatError(n,"ECONNECTION",!1,"CONN"))}let r={port:this.port,host:this.host,allowInternalNetworkInterfaces:this.allowInternalNetworkInterfaces,timeout:this.options.dnsTimeout||BN};if(this.options.localAddress&&(r.localAddress=this.options.localAddress),this.options.connection){this._socket=this.options.connection,this._setupConnectionHandlers(),this.secureConnection&&!this.alreadySecured?setImmediate(()=>this._upgradeConnection(n=>{if(n){this._onError(new Error("Error initiating TLS - "+(n.message||n)),"ETLS",!1,"CONN");return}this._onConnect()})):setImmediate(()=>this._onConnect());return}else return this.options.socket?(this._socket=this.options.socket,this._resolveAndConnect(r,n=>{try{this._socket.connect(this.port,this.host,()=>{this._socket.setKeepAlive(!0),this._onConnect()}),this._setupConnectionHandlers()}catch(i){return setImmediate(()=>this._onError(i,"ECONNECTION",!1,"CONN"))}})):(this.secureConnection&&(Object.assign(r,this.options.tls||{}),this.servername&&!r.servername&&(r.servername=this.servername)),this._resolveAndConnect(r,n=>{this._fallbackAddresses=(n._addresses||[]).filter(i=>i!==r.host),this._connectOpts=Object.assign({},r),this._connectToHost(r,this.secureConnection)}))}_resolveAndConnect(e,r){return Ii.resolveHostname(e,(n,i)=>{if(n)return setImmediate(()=>this._onError(n,"EDNS",!1,"CONN"));this.logger.debug({tnx:"dns",source:e.host,resolved:i.host,cached:!!i.cached},"Resolved %s as %s [cache %s]",e.host,i.host,i.cached?"hit":"miss");for(let s of Object.keys(i))s.charAt(0)!=="_"&&i[s]&&(e[s]=i[s]);r(i)})}_connectToHost(e,r){this._connectionAttemptId++;let n=this._connectionAttemptId,i=r?Ev.connect:hv.connect;try{this._socket=i(e,()=>{this._connectionAttemptId===n&&(this._socket.setKeepAlive(!0),this._onConnect())}),this._setupConnectionHandlers()}catch(s){return setImmediate(()=>this._onError(s,"ECONNECTION",!1,"CONN"))}}_setupConnectionHandlers(){this._connectionTimeout=setTimeout(()=>{this._onConnectionError("Connection timeout","ETIMEDOUT")},this.options.connectionTimeout||FN),this._socket.on("error",this._onConnectionSocketError)}_onConnectionError(e,r){if(clearTimeout(this._connectionTimeout),!(this._fallbackAddresses&&this._fallbackAddresses.length&&this.stage==="init"&&!this._destroyed)){this._onError(e,r,!1,"CONN");return}let i=this._fallbackAddresses.shift();if(this.logger.info({tnx:"network",failedHost:this._connectOpts.host,nextHost:i,error:e.message||e},"Connection to %s failed, trying %s",this._connectOpts.host,i),this._socket){try{this._socket.removeListener("error",this._onConnectionSocketError),this._socket.destroy()}catch{}this._socket=null}this._connectOpts.host=i,this._connectToHost(this._connectOpts,this.secureConnection)}quit(){this._sendCommand("QUIT"),this._responseActions.push(this.close)}close(){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._responseActions=[],this._closing)return;this._closing=!0;let e=this.stage==="init"?"destroy":"end";this.logger.debug({tnx:"smtp"},'Closing connection to the server using "%s"',e);let r=this._socket&&this._socket.socket||this._socket;if(this._currentDataStream){try{this._currentDataStream.unpipe(this._socket)}catch{}this._currentDataStream=!1}if(r&&!r.destroyed)try{r.setTimeout(0),r.removeListener("data",this._onSocketData),r.removeListener("timeout",this._onSocketTimeout),r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError),r.removeListener("error",this._onConnectionSocketError),r.on("error",qN),r[e]()}catch{}this._destroy()}login(e,r){let n=this._isDestroyedMessage("login");if(n)return r(this._formatError(n,"ECONNECTION",!1,"API"));if(this._auth=e||{},this._authMethod=(this._auth.method||"").toString().trim().toUpperCase()||!1,!this._authMethod&&this._auth.oauth2&&!this._auth.credentials?this._authMethod="XOAUTH2":(!this._authMethod||this._authMethod==="XOAUTH2"&&!this._auth.oauth2)&&(this._authMethod=(this._supportedAuth[0]||"PLAIN").toUpperCase().trim()),this._authMethod!=="XOAUTH2"&&(!this._auth.credentials||!this._auth.credentials.user||!this._auth.credentials.pass))if(this._auth.user&&this._auth.pass||this.customAuth.has(this._authMethod))this._auth.credentials={user:this._auth.user,pass:this._auth.pass,options:this._auth.options};else return r(this._formatError('Missing credentials for "'+this._authMethod+'"',"EAUTH",!1,"API"));if(this.customAuth.has(this._authMethod)){let i=this.customAuth.get(this._authMethod),s,o=!1,a=()=>{o||(o=!0,this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0))},c=d=>{o||(o=!0,r(this._formatError(d,"EAUTH",s,"AUTH "+this._authMethod)))},l=i({auth:this._auth,method:this._authMethod,extensions:[].concat(this._supportedExtensions),authMethods:[].concat(this._supportedAuth),maxAllowedSize:this._maxAllowedSize||!1,sendCommand:(d,p)=>{let m;return p||(m=new Promise((E,v)=>{p=Ii.callbackPromise(E,v)})),this._responseActions.push(E=>{s=E;let v=E.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/),b={command:d,response:E};v?(b.status=Number(v[1])||0,v[2]&&(b.code=v[2]),b.text=E.substr(v[0].length)):(b.text=E,b.status=0),p(null,b)}),setImmediate(()=>this._sendCommand(d)),m},resolve:a,reject:c});l&&typeof l.catch=="function"&&l.then(a).catch(c);return}switch(this._authMethod){case"XOAUTH2":this._handleXOauth2Token(!1,r);return;case"LOGIN":this._responseActions.push(i=>{this._actionAUTH_LOGIN_USER(i,r)}),this._sendCommand("AUTH LOGIN");return;case"PLAIN":this._responseActions.push(i=>{this._actionAUTHComplete(i,r)}),this._sendCommand("AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0"+this._auth.credentials.pass,"utf-8").toString("base64"),"AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0/* secret */","utf-8").toString("base64"));return;case"CRAM-MD5":this._responseActions.push(i=>{this._actionAUTH_CRAM_MD5(i,r)}),this._sendCommand("AUTH CRAM-MD5");return}return r(this._formatError('Unknown authentication method "'+this._authMethod+'"',"EAUTH",!1,"API"))}send(e,r,n){if(!r)return n(this._formatError("Empty message","EMESSAGE",!1,"API"));let i=this._isDestroyedMessage("send message");if(i)return n(this._formatError(i,"ECONNECTION",!1,"API"));if(this._maxAllowedSize&&e.size>this._maxAllowedSize)return setImmediate(()=>{n(this._formatError("Message size larger than allowed "+this._maxAllowedSize,"EMESSAGE",!1,"MAIL FROM"))});let s=!1,o=function(){s||(s=!0,n(...arguments))};typeof r.on=="function"&&r.on("error",c=>o(this._formatError(c,"ESTREAM",!1,"API")));let a=Date.now();this._setEnvelope(e,(c,l)=>{if(c){let m=new gv;return typeof r.pipe=="function"?r.pipe(m):(m.write(r),m.end()),o(c)}let d=Date.now(),p=this._createSendStream((m,E)=>m?o(m):(l.envelopeTime=d-a,l.messageTime=Date.now()-d,l.messageSize=p.outByteCount,l.response=E,o(null,l)));typeof r.pipe=="function"?r.pipe(p):(p.write(r),p.end())})}reset(e){this._sendCommand("RSET"),this._responseActions.push(r=>r.charAt(0)!=="2"?e(this._formatError("Could not reset session state. response="+r,"EPROTOCOL",r,"RSET")):(this._envelope=!1,e(null,!0)))}_onConnect(){if(clearTimeout(this._connectionTimeout),this.logger.info({tnx:"network",localAddress:this._socket.localAddress,localPort:this._socket.localPort,remoteAddress:this._socket.remoteAddress,remotePort:this._socket.remotePort},"%s established to %s:%s",this.secure?"Secure connection":"Connection",this._socket.remoteAddress,this._socket.remotePort),this._destroyed){this.close();return}this.stage="connected",this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout),this._socket.removeListener("close",this._onSocketClose),this._socket.removeListener("end",this._onSocketEnd),this._socket.removeListener("error",this._onConnectionSocketError),this._socket.on("error",this._onSocketError),this._socket.on("data",this._onSocketData),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||vv),this._socket.on("timeout",this._onSocketTimeout),this._greetingTimeout=setTimeout(()=>{this._socket&&!this._destroyed&&this._responseActions[0]===this._actionGreeting&&this._onError("Greeting never received","ETIMEDOUT",!1,"CONN")},this.options.greetingTimeout||VN),this._responseActions.push(this._actionGreeting),this._socket.resume()}_onData(e){if(this._destroyed||!e||!e.length)return;let r=(e||"").toString("binary"),n=(this._remainder+r).split(/\r?\n/),i;this._remainder=n.pop();for(let s=0,o=n.length;s<o;s++){if(this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
-`).pop()))){this._responseQueue[this._responseQueue.length-1]+=`
-`+n[s];continue}this._responseQueue.push(n[s])}this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
-`).pop()))||this._processResponse()}_onError(e,r,n,i){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._destroyed)return;e=this._formatError(e,r,n,i),["ETIMEDOUT","ESOCKET","ECONNECTION"].includes(e.code)?this.logger.warn(n,e.message):this.logger.error(n,e.message),this.emit("error",e),this.close()}_formatError(e,r,n,i){let s;/Error\]$/i.test(Object.prototype.toString.call(e))?s=e:s=new Error(e),r&&r!=="Error"&&(s.code=r),n&&(s.response=n,s.message+=": "+n);let o=typeof n=="string"&&Number((n.match(/^\d+/)||[])[0])||!1;return o&&(s.responseCode=o),i&&(s.command=i),s}_onClose(){let e=!1;if(this._remainder&&this._remainder.trim()&&(this.lastServerResponse=e=Av(this._remainder.trim()),(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e)),this.logger.info({tnx:"network"},"Connection closed"),this.upgrading&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ETLS",e,"CONN");if(![this._actionGreeting,this.close].includes(this._responseActions[0])&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");if(/^[45]\d{2}\b/.test(e))return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");this._destroy()}_onEnd(){this._socket&&!this._socket.destroyed&&this._socket.end()}_onTimeout(){return this._onError(new Error("Timeout"),"ETIMEDOUT",!1,"CONN")}_destroy(){this._destroyed||(this._destroyed=!0,this.emit("end"))}_upgradeConnection(e){this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout);let r=this._socket,n=Object.assign({socket:this._socket,host:this.host},this.options.tls||{});this.servername&&!n.servername&&(n.servername=this.servername);let i=()=>{r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError)};this.upgrading=!0;try{this._socket=Ev.connect(n,()=>(this.secure=!0,this.upgrading=!1,this._socket.on("data",this._onSocketData),i(),e(null,!0)))}catch(s){return i(),e(s)}this._socket.on("error",this._onSocketError),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||vv),this._socket.on("timeout",this._onSocketTimeout),r.resume()}_processResponse(){if(!this._responseQueue.length)return!1;let e=this.lastServerResponse=Av((this._responseQueue.shift()||"").toString());if(/^\d+-/.test(e.split(`
-`).pop()))return;(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e.replace(/\r?\n$/,"")),e.trim()||setImmediate(()=>this._processResponse());let r=this._responseActions.shift();if(typeof r=="function")r.call(this,e),setImmediate(()=>this._processResponse());else return this._onError(new Error("Unexpected Response"),"EPROTOCOL",e,"CONN")}_sendCommand(e,r){if(!this._destroyed){if(this._socket.destroyed)return this.close();(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"client"},(r||e||"").toString().replace(/\r?\n$/,"")),this._socket.write(Buffer.from(e+`\r
-`,"utf-8"))}}_setEnvelope(e,r){let n=[],i=!1;if(this._envelope=e||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(),this._envelope.to=[].concat(this._envelope.to||[]).map(s=>(s&&s.address||s||"").toString().trim()),!this._envelope.to.length)return r(this._formatError("No recipients defined","EENVELOPE",!1,"API"));if(this._envelope.from&&/[\r\n<>]/.test(this._envelope.from))return r(this._formatError("Invalid sender "+JSON.stringify(this._envelope.from),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.from)&&(i=!0);for(let s=0,o=this._envelope.to.length;s<o;s++){if(!this._envelope.to[s]||/[\r\n<>]/.test(this._envelope.to[s]))return r(this._formatError("Invalid recipient "+JSON.stringify(this._envelope.to[s]),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.to[s])&&(i=!0)}if(this._envelope.rcptQueue=[].concat(this._envelope.to||[]),this._envelope.rejected=[],this._envelope.rejectedErrors=[],this._envelope.accepted=[],this._envelope.dsn)try{this._envelope.dsn=this._setDsnEnvelope(this._envelope.dsn)}catch(s){return r(this._formatError("Invalid DSN "+s.message,"EENVELOPE",!1,"API"))}if(this._responseActions.push(s=>{this._actionMAIL(s,r)}),i&&this._supportedExtensions.includes("SMTPUTF8")&&(n.push("SMTPUTF8"),this._usingSmtpUtf8=!0),this._envelope.use8BitMime&&this._supportedExtensions.includes("8BITMIME")&&(n.push("BODY=8BITMIME"),this._using8BitMime=!0),this._envelope.size&&this._supportedExtensions.includes("SIZE")){let s=Number(this._envelope.size)||0;s>0&&n.push("SIZE="+s)}if(this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.ret&&n.push("RET="+Ii.encodeXText(this._envelope.dsn.ret)),this._envelope.dsn.envid&&n.push("ENVID="+Ii.encodeXText(this._envelope.dsn.envid))),this._envelope.requireTLSExtensionEnabled){if(!this.secure)return r(this._formatError("REQUIRETLS can only be used over TLS connections (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));if(!this._supportedExtensions.includes("REQUIRETLS"))return r(this._formatError("Server does not support REQUIRETLS extension (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));n.push("REQUIRETLS")}this._sendCommand("MAIL FROM:<"+this._envelope.from+">"+(n.length?" "+n.join(" "):""))}_setDsnEnvelope(e){let r=(e.ret||e.return||"").toString().toUpperCase()||null;if(r)switch(r){case"HDRS":case"HEADERS":r="HDRS";break;case"FULL":case"BODY":r="FULL";break}if(r&&!["FULL","HDRS"].includes(r))throw new Error("ret: "+JSON.stringify(r));let n=(e.envid||e.id||"").toString()||null,i=e.notify||null;if(i){typeof i=="string"&&(i=i.split(",")),i=i.map(c=>c.trim().toUpperCase());let o=["NEVER","SUCCESS","FAILURE","DELAY"];if(i.filter(c=>!o.includes(c)).length||i.length>1&&i.includes("NEVER"))throw new Error("notify: "+JSON.stringify(i.join(",")));i=i.join(",")}let s=(e.recipient||e.orcpt||"").toString()||null;return s&&s.indexOf(";")<0&&(s="rfc822;"+s),{ret:r,envid:n,notify:i,orcpt:s}}_getDsnRcptToArgs(){let e=[];return this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.notify&&e.push("NOTIFY="+Ii.encodeXText(this._envelope.dsn.notify)),this._envelope.dsn.orcpt&&e.push("ORCPT="+Ii.encodeXText(this._envelope.dsn.orcpt))),e.length?" "+e.join(" "):""}_createSendStream(e){let r=new HN;if(this.options.lmtp?this._envelope.accepted.forEach((n,i)=>{let s=i===this._envelope.accepted.length-1;this._responseActions.push(o=>{this._actionLMTPStream(n,s,o,e)})}):this._responseActions.push(n=>{this._actionSMTPStream(n,e)}),this._currentDataStream=r,r.pipe(this._socket,{end:!1}),this.options.debug){let n=new gv;n.on("readable",()=>{let i;for(;i=n.read();)this.logger.debug({tnx:"message"},i.toString("binary").replace(/\r?\n$/,""))}),r.pipe(n)}return r.once("end",()=>{this._currentDataStream===r&&(this._currentDataStream=!1),this.logger.info({tnx:"message",inByteCount:r.inByteCount,outByteCount:r.outByteCount},"<%s bytes encoded mime message (source size %s bytes)>",r.outByteCount,r.inByteCount)}),r}_actionGreeting(e){if(clearTimeout(this._greetingTimeout),e.substr(0,3)!=="220"){this._onError(new Error("Invalid greeting. response="+e),"EPROTOCOL",e,"CONN");return}this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name))}_actionLHLO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid LHLO. response="+e),"EPROTOCOL",e,"LHLO");return}this._actionEHLO(e)}_actionEHLO(e){let r;if(e.substr(0,3)==="421"){this._onError(new Error("Server terminates connection. response="+e),"ECONNECTION",e,"EHLO");return}if(e.charAt(0)!=="2"){if(this.options.requireTLS){this._onError(new Error("EHLO failed but HELO does not support required STARTTLS. response="+e),"ECONNECTION",e,"EHLO");return}this._responseActions.push(this._actionHELO),this._sendCommand("HELO "+this.name);return}if(this._ehloLines=e.split(/\r?\n/).map(n=>n.replace(/^\d+[ -]/,"").trim()).filter(n=>n).slice(1),!this.secure&&!this.options.ignoreTLS&&(/[ -]STARTTLS\b/im.test(e)||this.options.requireTLS)){this._sendCommand("STARTTLS"),this._responseActions.push(this._actionSTARTTLS);return}/[ -]SMTPUTF8\b/im.test(e)&&this._supportedExtensions.push("SMTPUTF8"),/[ -]DSN\b/im.test(e)&&this._supportedExtensions.push("DSN"),/[ -]8BITMIME\b/im.test(e)&&this._supportedExtensions.push("8BITMIME"),/[ -]REQUIRETLS\b/im.test(e)&&this._supportedExtensions.push("REQUIRETLS"),/[ -]PIPELINING\b/im.test(e)&&this._supportedExtensions.push("PIPELINING"),/[ -]AUTH\b/i.test(e)&&(this.allowsAuth=!0),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)PLAIN/i.test(e)&&this._supportedAuth.push("PLAIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)LOGIN/i.test(e)&&this._supportedAuth.push("LOGIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)CRAM-MD5/i.test(e)&&this._supportedAuth.push("CRAM-MD5"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)XOAUTH2/i.test(e)&&this._supportedAuth.push("XOAUTH2"),(r=e.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))&&(this._supportedExtensions.push("SIZE"),this._maxAllowedSize=Number(r[1])||0),this.emit("connect")}_actionHELO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid HELO. response="+e),"EPROTOCOL",e,"HELO");return}this.allowsAuth=!0,this.emit("connect")}_actionSTARTTLS(e){if(e.charAt(0)!=="2"){if(this.options.opportunisticTLS)return this.logger.info({tnx:"smtp"},"Failed STARTTLS upgrade, continuing unencrypted"),this.emit("connect");this._onError(new Error("Error upgrading connection with STARTTLS"),"ETLS",e,"STARTTLS");return}this._upgradeConnection((r,n)=>{if(r){this._onError(new Error("Error initiating TLS - "+(r.message||r)),"ETLS",!1,"STARTTLS");return}this.logger.info({tnx:"smtp"},"Connection upgraded with STARTTLS"),n?this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name)):this.emit("connect")})}_actionAUTH_LOGIN_USER(e,r){if(!/^334[ -]/.test(e)){r(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"',"EAUTH",e,"AUTH LOGIN"));return}this._responseActions.push(n=>{this._actionAUTH_LOGIN_PASS(n,r)}),this._sendCommand(Buffer.from(this._auth.credentials.user+"","utf-8").toString("base64"))}_actionAUTH_CRAM_MD5(e,r){let n=e.match(/^334\s+(.+)$/);if(!n)return r(this._formatError("Invalid login sequence while waiting for server challenge string","EAUTH",e,"AUTH CRAM-MD5"));let i=Buffer.from(n[1],"base64").toString("ascii"),s=yv.createHmac("md5",this._auth.credentials.pass);s.update(i);let o=this._auth.credentials.user+" "+s.digest("hex");this._responseActions.push(a=>{this._actionAUTH_CRAM_MD5_PASS(a,r)}),this._sendCommand(Buffer.from(o).toString("base64"),Buffer.from(this._auth.credentials.user+" /* secret */").toString("base64"))}_actionAUTH_CRAM_MD5_PASS(e,r){if(!e.match(/^235\s+/))return r(this._formatError('Invalid login sequence while waiting for "235"',"EAUTH",e,"AUTH CRAM-MD5"));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0)}_actionAUTH_LOGIN_PASS(e,r){if(!/^334[ -]/.test(e))return r(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"',"EAUTH",e,"AUTH LOGIN"));this._responseActions.push(n=>{this._actionAUTHComplete(n,r)}),this._sendCommand(Buffer.from((this._auth.credentials.pass||"").toString(),"utf-8").toString("base64"),Buffer.from("/* secret */","utf-8").toString("base64"))}_actionAUTHComplete(e,r,n){if(!n&&typeof r=="function"&&(n=r,r=!1),e.substr(0,3)==="334"){this._responseActions.push(i=>{r||this._authMethod!=="XOAUTH2"?this._actionAUTHComplete(i,!0,n):setImmediate(()=>this._handleXOauth2Token(!0,n))}),this._sendCommand("");return}if(e.charAt(0)!=="2")return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),n(this._formatError("Invalid login","EAUTH",e,"AUTH "+this._authMethod));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,n(null,!0)}_actionMAIL(e,r){if(Number(e.charAt(0))!==2){let i=this._usingSmtpUtf8&&/^550 /.test(e)&&/[\x80-\uFFFF]/.test(this._envelope.from)?"Internationalized mailbox name not allowed":"Mail command failed";return r(this._formatError(i,"EENVELOPE",e,"MAIL FROM"))}if(!this._envelope.rcptQueue.length)return r(this._formatError("Can't send mail - no recipients defined","EENVELOPE",!1,"API"));this._recipientQueue=[];let n=this._supportedExtensions.includes("PIPELINING");do{let i=this._envelope.rcptQueue.shift();this._recipientQueue.push(i),this._responseActions.push(s=>{this._actionRCPT(s,r)}),this._sendCommand("RCPT TO:<"+i+">"+this._getDsnRcptToArgs())}while(n&&this._envelope.rcptQueue.length)}_actionRCPT(e,r){let n,i=this._recipientQueue.shift();if(Number(e.charAt(0))!==2){let s=this._usingSmtpUtf8&&/^553 /.test(e)&&/[\x80-\uFFFF]/.test(i)?"Internationalized mailbox name not allowed":"Recipient command failed";this._envelope.rejected.push(i),n=this._formatError(s,"EENVELOPE",e,"RCPT TO"),n.recipient=i,this._envelope.rejectedErrors.push(n)}else this._envelope.accepted.push(i);if(!this._envelope.rcptQueue.length&&!this._recipientQueue.length)if(this._envelope.rejected.length<this._envelope.to.length)this._responseActions.push(s=>{this._actionDATA(s,r)}),this._sendCommand("DATA");else return n=this._formatError("Can't send mail - all recipients were rejected","EENVELOPE",e,"RCPT TO"),n.rejected=this._envelope.rejected,n.rejectedErrors=this._envelope.rejectedErrors,r(n);else if(this._envelope.rcptQueue.length){let s=this._envelope.rcptQueue.shift();this._recipientQueue.push(s),this._responseActions.push(o=>{this._actionRCPT(o,r)}),this._sendCommand("RCPT TO:<"+s+">"+this._getDsnRcptToArgs())}}_actionDATA(e,r){if(!/^[23]/.test(e))return r(this._formatError("Data command failed","EENVELOPE",e,"DATA"));let n={accepted:this._envelope.accepted,rejected:this._envelope.rejected};this._ehloLines&&this._ehloLines.length&&(n.ehlo=this._ehloLines),this._envelope.rejectedErrors.length&&(n.rejectedErrors=this._envelope.rejectedErrors),r(null,n)}_actionSMTPStream(e,r){return Number(e.charAt(0))!==2?r(this._formatError("Message failed","EMESSAGE",e,"DATA")):r(null,e)}_actionLMTPStream(e,r,n,i){let s;if(Number(n.charAt(0))!==2){s=this._formatError("Message failed for recipient "+e,"EMESSAGE",n,"DATA"),s.recipient=e,this._envelope.rejected.push(e),this._envelope.rejectedErrors.push(s);for(let o=0,a=this._envelope.accepted.length;o<a;o++)this._envelope.accepted[o]===e&&this._envelope.accepted.splice(o,1)}if(r)return i(null,n)}_handleXOauth2Token(e,r){this._auth.oauth2.getToken(e,(n,i)=>{if(n)return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),r(this._formatError(n,"EAUTH",!1,"AUTH XOAUTH2"));this._responseActions.push(s=>{this._actionAUTHComplete(s,e,r)}),this._sendCommand("AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token(i),"AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token("/* secret */"))})}_isDestroyedMessage(e){if(this._destroyed)return"Cannot "+e+" - smtp connection is already destroyed.";if(this._socket){if(this._socket.destroyed)return"Cannot "+e+" - smtp connection socket is already destroyed.";if(!this._socket.writable)return"Cannot "+e+" - smtp connection socket is already half-closed."}}_getHostname(){let e;try{e=KN.hostname()||""}catch{e="localhost"}return(!e||e.indexOf(".")<0)&&(e="[127.0.0.1]"),e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)&&(e="["+e+"]"),e}};Tv.exports=Vp});var qp=he((uX,_v)=>{"use strict";var{Stream:jN}=ee("stream"),GN=ca(),$N=ee("crypto"),WN=Kt(),xi=lr(),Bp=class extends jN{constructor(e,r){if(super(),this.options=e||{},e&&e.serviceClient){if(!e.privateKey||!e.user){let i=new Error('Options "privateKey" and "user" are required for service account!');i.code=xi.EOAUTH2,setImmediate(()=>this.emit("error",i));return}let n=Math.min(Math.max(Number(this.options.serviceRequestTimeout)||0,0),3600);this.options.serviceRequestTimeout=n||300}if(this.logger=WN.getLogger({logger:r},{component:this.options.component||"OAuth2"}),this.provisionCallback=typeof this.options.provisionCallback=="function"?this.options.provisionCallback:!1,this.options.accessUrl=this.options.accessUrl||"https://accounts.google.com/o/oauth2/token",this.options.customHeaders=this.options.customHeaders||{},this.options.customParams=this.options.customParams||{},this.accessToken=this.options.accessToken||!1,this.options.expires&&Number(this.options.expires))this.expires=this.options.expires;else{let n=Math.max(Number(this.options.timeout)||0,0);this.expires=n&&Date.now()+n*1e3||0}this.renewing=!1,this.renewalQueue=[]}getToken(e,r){if(!e&&this.accessToken&&(!this.expires||this.expires>Date.now()))return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token for %s",this.options.user),r(null,this.accessToken);if(!this.provisionCallback&&!this.options.refreshToken&&!this.options.serviceClient){if(this.accessToken)return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token (no refresh capability) for %s",this.options.user),r(null,this.accessToken);this.logger.error({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Cannot renew access token for %s: No refresh mechanism available",this.options.user);let i=new Error("Can't create new access token for user");return i.code=xi.EOAUTH2,r(i)}if(this.renewing)return this.renewalQueue.push({renew:e,callback:r});this.renewing=!0;let n=(i,s)=>{this.renewalQueue.forEach(o=>o.callback(i,s)),this.renewalQueue=[],this.renewing=!1,i?this.logger.error({err:i,tnx:"OAUTH2",user:this.options.user,action:"renew"},"Failed generating new Access Token for %s",this.options.user):this.logger.info({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Generated new Access Token for %s",this.options.user),r(i,s)};this.provisionCallback?this.provisionCallback(this.options.user,!!e,(i,s,o)=>{!i&&s&&(this.accessToken=s,this.expires=o||0),n(i,s)}):this.generateToken(n)}updateToken(e,r){this.accessToken=e,r=Math.max(Number(r)||0,0),this.expires=r&&Date.now()+r*1e3||0,this.emit("token",{user:this.options.user,accessToken:e||"",expires:this.expires})}generateToken(e){let r,n;if(this.options.serviceClient){let i=Math.floor(Date.now()/1e3),s={iss:this.options.serviceClient,scope:this.options.scope||"https://mail.google.com/",sub:this.options.user,aud:this.options.accessUrl,iat:i,exp:i+this.options.serviceRequestTimeout},o;try{o=this.jwtSignRS256(s)}catch{let c=new Error("Can't generate token. Check your auth options");return c.code=xi.EOAUTH2,e(c)}r={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:o},n={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:s}}else{if(!this.options.refreshToken){let i=new Error("Can't create new access token for user");return i.code=xi.EOAUTH2,e(i)}r={client_id:this.options.clientId||"",client_secret:this.options.clientSecret||"",refresh_token:this.options.refreshToken,grant_type:"refresh_token"},n={client_id:this.options.clientId||"",client_secret:(this.options.clientSecret||"").substr(0,6)+"...",refresh_token:(this.options.refreshToken||"").substr(0,6)+"...",grant_type:"refresh_token"}}Object.assign(r,this.options.customParams),Object.assign(n,this.options.customParams),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"generate"},"Requesting token using: %s",JSON.stringify(n)),this.postRequest(this.options.accessUrl,r,this.options,(i,s)=>{let o;if(i)return e(i);try{o=JSON.parse(s.toString())}catch(l){return e(l)}if(!o||typeof o!="object"){this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",(s||"").toString());let l=new Error("Invalid authentication response");return l.code=xi.EOAUTH2,e(l)}let a=Object.assign({},o);if(a.access_token&&(a.access_token=(a.access_token||"").toString().substr(0,6)+"..."),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",JSON.stringify(a)),o.error){let l=o.error;o.error_description&&(l+=": "+o.error_description),o.error_uri&&(l+=" ("+o.error_uri+")");let d=new Error(l);return d.code=xi.EOAUTH2,e(d)}if(o.access_token)return this.updateToken(o.access_token,o.expires_in),e(null,this.accessToken);let c=new Error("No access token");return c.code=xi.EOAUTH2,e(c)})}buildXOAuth2Token(e){let r=["user="+(this.options.user||""),"auth=Bearer "+(e||this.accessToken),"",""];return Buffer.from(r.join("
"),"utf-8").toString("base64")}postRequest(e,r,n,i){let s=!1,o=[],a=0,c={method:"post",headers:n.customHeaders,body:r,allowErrorResponse:!0};/^https:/i.test(e)&&(c.tls=Object.assign({rejectUnauthorized:!0},n.tls||{}));let l=GN(e,c);l.on("readable",()=>{let d;for(;(d=l.read())!==null;)o.push(d),a+=d.length}),l.once("error",d=>{if(!s)return s=!0,i(d)}),l.once("end",()=>{if(!s)return s=!0,i(null,Buffer.concat(o,a))})}toBase64URL(e){return typeof e=="string"&&(e=Buffer.from(e)),e.toString("base64").replace(/[=]+/g,"").replace(/\+/g,"-").replace(/\//g,"_")}jwtSignRS256(e){e=['{"alg":"RS256","typ":"JWT"}',JSON.stringify(e)].map(n=>this.toBase64URL(n)).join(".");let r=$N.createSign("RSA-SHA256").update(e).sign(this.options.privateKey);return e+"."+this.toBase64URL(r)}};_v.exports=Bp});var bv=he((dX,xv)=>{"use strict";var zN=Cl(),JN=Kt().assign,YN=qp(),Iv=lr(),XN=ee("events"),jp=class extends XN{constructor(e){if(super(),this.pool=e,this.options=e.options,this.logger=this.pool.logger,this.options.auth)switch((this.options.auth.type||"").toString().toUpperCase()){case"OAUTH2":{let r=new YN(this.options.auth,this.logger);r.provisionCallback=this.pool.mailer&&this.pool.mailer.get("oauth2_provision_cb")||r.provisionCallback,this.auth={type:"OAUTH2",user:this.options.auth.user,oauth2:r,method:"XOAUTH2"},r.on("token",n=>this.pool.mailer.emit("token",n)),r.on("error",n=>this.emit("error",n));break}default:if(!this.options.auth.user&&!this.options.auth.pass)break;this.auth={type:(this.options.auth.type||"").toString().toUpperCase()||"LOGIN",user:this.options.auth.user,credentials:{user:this.options.auth.user||"",pass:this.options.auth.pass,options:this.options.auth.options},method:(this.options.auth.method||"").trim().toUpperCase()||this.options.authMethod||!1}}this._connection=!1,this._connected=!1,this.messages=0,this.available=!0}connect(e){this.pool.getSocket(this.options,(r,n)=>{if(r)return e(r);let i=!1,s=this.options;n&&n.connection&&(this.logger.info({tnx:"proxy",remoteAddress:n.connection.remoteAddress,remotePort:n.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",n.connection.remoteAddress,n.connection.remotePort,s.host||"",s.port||""),s=Object.assign(JN(!1,s),n)),this.connection=new zN(s),this.connection.once("error",o=>{if(this.emit("error",o),!i)return i=!0,e(o)}),this.connection.once("end",()=>{if(this.close(),i)return;i=!0;let o=setTimeout(()=>{if(i)return;let a=new Error("Unexpected socket close");this.connection&&this.connection._socket&&this.connection._socket.upgrading&&(a.code=Iv.ETLS),e(a)},1e3);try{o.unref()}catch{}}),this.connection.connect(()=>{if(!i)if(this.auth&&(this.connection.allowsAuth||s.forceAuth))this.connection.login(this.auth,o=>{if(!i){if(i=!0,o)return this.connection.close(),this.emit("error",o),e(o);this._connected=!0,e(null,!0)}});else return i=!0,this._connected=!0,e(null,!0)})})}send(e,r){if(!this._connected)return this.connect(o=>o?r(o):this.send(e,r));let n=e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i,cid:this.id},"Sending message %s using #%s to <%s>",i,this.id,s.join(", ")),e.data.dsn&&(n.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(n.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.connection.send(n,e.message.createReadStream(),(o,a)=>{if(this.messages++,o)return this.connection.close(),this.emit("error",o),r(o);a.envelope={from:n.from,to:n.to},a.messageId=i,setImmediate(()=>{if(this.messages>=this.options.maxMessages){let c=new Error("Resource exhausted");c.code=Iv.EMAXLIMIT,this.connection.close(),this.emit("error",c)}else this.pool._checkRateLimit(()=>{this.available=!0,this.emit("available")})}),r(null,a)})}close(){this._connected=!1,this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.connection&&this.connection.close(),this.emit("close")}};xv.exports=jp});var Sv=he((pX,QN)=>{QN.exports={"1und1":{description:"1&1 Mail (German hosting provider)",host:"smtp.1und1.de",port:465,secure:!0,authMethod:"LOGIN"},"126":{description:"126 Mail (NetEase)",host:"smtp.126.com",port:465,secure:!0},"163":{description:"163 Mail (NetEase)",host:"smtp.163.com",port:465,secure:!0},Aliyun:{description:"Alibaba Cloud Mail",domains:["aliyun.com"],host:"smtp.aliyun.com",port:465,secure:!0},AliyunQiye:{description:"Alibaba Cloud Enterprise Mail",host:"smtp.qiye.aliyun.com",port:465,secure:!0},AOL:{description:"AOL Mail",domains:["aol.com"],host:"smtp.aol.com",port:587},Aruba:{description:"Aruba PEC (Italian email provider)",domains:["aruba.it","pec.aruba.it"],aliases:["Aruba PEC"],host:"smtps.aruba.it",port:465,secure:!0,authMethod:"LOGIN"},Bluewin:{description:"Bluewin (Swiss email provider)",host:"smtpauths.bluewin.ch",domains:["bluewin.ch"],port:465},BOL:{description:"BOL Mail (Brazilian provider)",domains:["bol.com.br"],host:"smtp.bol.com.br",port:587,requireTLS:!0},DebugMail:{description:"DebugMail (email testing service)",host:"debugmail.io",port:25},Disroot:{description:"Disroot (privacy-focused provider)",domains:["disroot.org"],host:"disroot.org",port:587,secure:!1,authMethod:"LOGIN"},DynectEmail:{description:"Dyn Email Delivery",aliases:["Dynect"],host:"smtp.dynect.net",port:25},ElasticEmail:{description:"Elastic Email",aliases:["Elastic Email"],host:"smtp.elasticemail.com",port:465,secure:!0},Ethereal:{description:"Ethereal Email (email testing service)",aliases:["ethereal.email"],host:"smtp.ethereal.email",port:587},FastMail:{description:"FastMail",domains:["fastmail.fm"],host:"smtp.fastmail.com",port:465,secure:!0},"Feishu Mail":{description:"Feishu Mail (Lark)",aliases:["Feishu","FeishuMail"],domains:["www.feishu.cn"],host:"smtp.feishu.cn",port:465,secure:!0},"Forward Email":{description:"Forward Email (email forwarding service)",aliases:["FE","ForwardEmail"],domains:["forwardemail.net"],host:"smtp.forwardemail.net",port:465,secure:!0},GandiMail:{description:"Gandi Mail",aliases:["Gandi","Gandi Mail"],host:"mail.gandi.net",port:587},Gmail:{description:"Gmail",aliases:["Google Mail"],domains:["gmail.com","googlemail.com"],host:"smtp.gmail.com",port:465,secure:!0},GmailWorkspace:{description:"Gmail Workspace",aliases:["Google Workspace Mail"],host:"smtp-relay.gmail.com",port:465,secure:!0},GMX:{description:"GMX Mail",domains:["gmx.com","gmx.net","gmx.de"],host:"mail.gmx.com",port:587},Godaddy:{description:"GoDaddy Email (US)",host:"smtpout.secureserver.net",port:25},GodaddyAsia:{description:"GoDaddy Email (Asia)",host:"smtp.asia.secureserver.net",port:25},GodaddyEurope:{description:"GoDaddy Email (Europe)",host:"smtp.europe.secureserver.net",port:25},"hot.ee":{description:"Hot.ee (Estonian email provider)",host:"mail.hot.ee"},Hotmail:{description:"Outlook.com / Hotmail",aliases:["Outlook","Outlook.com","Hotmail.com"],domains:["hotmail.com","outlook.com"],host:"smtp-mail.outlook.com",port:587},iCloud:{description:"iCloud Mail",aliases:["Me","Mac"],domains:["me.com","mac.com"],host:"smtp.mail.me.com",port:587},Infomaniak:{description:"Infomaniak Mail (Swiss hosting provider)",host:"mail.infomaniak.com",domains:["ik.me","ikmail.com","etik.com"],port:587},KolabNow:{description:"KolabNow (secure email service)",domains:["kolabnow.com"],aliases:["Kolab"],host:"smtp.kolabnow.com",port:465,secure:!0,authMethod:"LOGIN"},Loopia:{description:"Loopia (Swedish hosting provider)",host:"mailcluster.loopia.se",port:465},Loops:{description:"Loops",host:"smtp.loops.so",port:587},"mail.ee":{description:"Mail.ee (Estonian email provider)",host:"smtp.mail.ee"},"Mail.ru":{description:"Mail.ru",host:"smtp.mail.ru",port:465,secure:!0},"Mailcatch.app":{description:"Mailcatch (email testing service)",host:"sandbox-smtp.mailcatch.app",port:2525},Maildev:{description:"MailDev (local email testing)",port:1025,ignoreTLS:!0},MailerSend:{description:"MailerSend",host:"smtp.mailersend.net",port:587},Mailgun:{description:"Mailgun",host:"smtp.mailgun.org",port:465,secure:!0},Mailjet:{description:"Mailjet",host:"in.mailjet.com",port:587},Mailosaur:{description:"Mailosaur (email testing service)",host:"mailosaur.io",port:25},Mailtrap:{description:"Mailtrap",host:"live.smtp.mailtrap.io",port:587},Mandrill:{description:"Mandrill (by Mailchimp)",host:"smtp.mandrillapp.com",port:587},Naver:{description:"Naver Mail (Korean email provider)",host:"smtp.naver.com",port:587},OhMySMTP:{description:"OhMySMTP (email delivery service)",host:"smtp.ohmysmtp.com",port:587,secure:!1},One:{description:"One.com Email",host:"send.one.com",port:465,secure:!0},OpenMailBox:{description:"OpenMailBox",aliases:["OMB","openmailbox.org"],host:"smtp.openmailbox.org",port:465,secure:!0},Outlook365:{description:"Microsoft 365 / Office 365",host:"smtp.office365.com",port:587,secure:!1},Postmark:{description:"Postmark",aliases:["PostmarkApp"],host:"smtp.postmarkapp.com",port:2525},Proton:{description:"Proton Mail",aliases:["ProtonMail","Proton.me","Protonmail.com","Protonmail.ch"],domains:["proton.me","protonmail.com","pm.me","protonmail.ch"],host:"smtp.protonmail.ch",port:587,requireTLS:!0},"qiye.aliyun":{description:"Alibaba Mail Enterprise Edition",host:"smtp.mxhichina.com",port:"465",secure:!0},QQ:{description:"QQ Mail",domains:["qq.com"],host:"smtp.qq.com",port:465,secure:!0},QQex:{description:"QQ Enterprise Mail",aliases:["QQ Enterprise"],domains:["exmail.qq.com"],host:"smtp.exmail.qq.com",port:465,secure:!0},Resend:{description:"Resend",host:"smtp.resend.com",port:465,secure:!0},Runbox:{description:"Runbox (Norwegian email provider)",domains:["runbox.com"],host:"smtp.runbox.com",port:465,secure:!0},SendCloud:{description:"SendCloud (Chinese email delivery)",host:"smtp.sendcloud.net",port:2525},SendGrid:{description:"SendGrid",host:"smtp.sendgrid.net",port:587},SendinBlue:{description:"Brevo (formerly Sendinblue)",aliases:["Brevo"],host:"smtp-relay.brevo.com",port:587},SendPulse:{description:"SendPulse",host:"smtp-pulse.com",port:465,secure:!0},SES:{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-1":{description:"AWS SES Asia Pacific (Tokyo)",host:"email-smtp.ap-northeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-2":{description:"AWS SES Asia Pacific (Seoul)",host:"email-smtp.ap-northeast-2.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-3":{description:"AWS SES Asia Pacific (Osaka)",host:"email-smtp.ap-northeast-3.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTH-1":{description:"AWS SES Asia Pacific (Mumbai)",host:"email-smtp.ap-south-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-1":{description:"AWS SES Asia Pacific (Singapore)",host:"email-smtp.ap-southeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-2":{description:"AWS SES Asia Pacific (Sydney)",host:"email-smtp.ap-southeast-2.amazonaws.com",port:465,secure:!0},"SES-CA-CENTRAL-1":{description:"AWS SES Canada (Central)",host:"email-smtp.ca-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-CENTRAL-1":{description:"AWS SES Europe (Frankfurt)",host:"email-smtp.eu-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-NORTH-1":{description:"AWS SES Europe (Stockholm)",host:"email-smtp.eu-north-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-1":{description:"AWS SES Europe (Ireland)",host:"email-smtp.eu-west-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-2":{description:"AWS SES Europe (London)",host:"email-smtp.eu-west-2.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-3":{description:"AWS SES Europe (Paris)",host:"email-smtp.eu-west-3.amazonaws.com",port:465,secure:!0},"SES-SA-EAST-1":{description:"AWS SES South America (S\xE3o Paulo)",host:"email-smtp.sa-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-1":{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-2":{description:"AWS SES US East (Ohio)",host:"email-smtp.us-east-2.amazonaws.com",port:465,secure:!0},"SES-US-GOV-EAST-1":{description:"AWS SES GovCloud (US-East)",host:"email-smtp.us-gov-east-1.amazonaws.com",port:465,secure:!0},"SES-US-GOV-WEST-1":{description:"AWS SES GovCloud (US-West)",host:"email-smtp.us-gov-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-1":{description:"AWS SES US West (N. California)",host:"email-smtp.us-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-2":{description:"AWS SES US West (Oregon)",host:"email-smtp.us-west-2.amazonaws.com",port:465,secure:!0},Seznam:{description:"Seznam Email (Czech email provider)",aliases:["Seznam Email"],domains:["seznam.cz","email.cz","post.cz","spoluzaci.cz"],host:"smtp.seznam.cz",port:465,secure:!0},SMTP2GO:{description:"SMTP2GO",host:"mail.smtp2go.com",port:2525},Sparkpost:{description:"SparkPost",aliases:["SparkPost","SparkPost Mail"],domains:["sparkpost.com"],host:"smtp.sparkpostmail.com",port:587,secure:!1},Tipimail:{description:"Tipimail (email delivery service)",host:"smtp.tipimail.com",port:587},Tutanota:{description:"Tutanota (Tuta Mail)",domains:["tutanota.com","tuta.com","tutanota.de","tuta.io"],host:"smtp.tutanota.com",port:465,secure:!0},Yahoo:{description:"Yahoo Mail",domains:["yahoo.com"],host:"smtp.mail.yahoo.com",port:465,secure:!0},Yandex:{description:"Yandex Mail",domains:["yandex.ru"],host:"smtp.yandex.ru",port:465,secure:!0},Zimbra:{description:"Zimbra Mail Server",aliases:["Zimbra Collaboration"],host:"smtp.zimbra.com",port:587,requireTLS:!0},Zoho:{description:"Zoho Mail",host:"smtp.zoho.com",port:465,secure:!0,authMethod:"LOGIN"}}});var Gp=he((fX,wv)=>{"use strict";var Nv=Sv(),Dl={};Object.keys(Nv).forEach(t=>{let e=Nv[t],r=ZN(e);Dl[Pl(t)]=r,[].concat(e.aliases||[]).forEach(n=>{Dl[Pl(n)]=r}),[].concat(e.domains||[]).forEach(n=>{Dl[Pl(n)]=r})});function Pl(t){return t.replace(/[^a-zA-Z0-9.-]/g,"").toLowerCase()}function ZN(t){let e={};return Object.keys(t).forEach(r=>{["domains","aliases"].includes(r)||(e[r]=t[r])}),e}wv.exports=function(t){return t=Pl(t.split("@").pop()),Dl[t]||!1}});var Dv=he((mX,Cv)=>{"use strict";var ew=ee("events"),Rv=bv(),tw=Cl(),rw=Gp(),ma=Kt(),Ov=lr(),kv=br(),$p=class extends ew{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=ma.parseConnectionUrl(e.url),n=n||r.service),this.options=ma.assign(!1,e,r,n&&rw(n)),this.options.maxConnections=this.options.maxConnections||5,this.options.maxMessages=this.options.maxMessages||100,this.logger=ma.getLogger(this.options,{component:this.options.component||"smtp-pool"}),this.name="SMTP (pool)",this.version=kv.version+"[client:"+kv.version+"]",this._rateLimit={counter:0,timeout:null,waiting:[],checkpoint:!1,delta:Number(this.options.rateDelta)||1e3,limit:Number(this.options.rateLimit)||0},this._closed=!1,this._queue=[],this._connections=[],this._connectionCounter=0,this.idling=!0,setImmediate(()=>{this.idling&&this.emit("idle")})}getSocket(e,r){return setImmediate(()=>r(null,!1))}send(e,r){return this._closed?!1:(this._queue.push({mail:e,requeueAttempts:0,callback:r}),this.idling&&this._queue.length>=this.options.maxConnections&&(this.idling=!1),setImmediate(()=>this._processMessages()),!0)}close(){let e,r=this._connections.length;if(this._closed=!0,clearTimeout(this._rateLimit.timeout),!r&&!this._queue.length)return;for(let i=r-1;i>=0;i--)this._connections[i]&&this._connections[i].available&&(e=this._connections[i],e.close(),this.logger.info({tnx:"connection",cid:e.id,action:"removed"},"Connection #%s removed",e.id));if(r&&!this._connections.length&&this.logger.debug({tnx:"connection"},"All connections removed"),!this._queue.length)return;let n=()=>{if(!this._queue.length){this.logger.debug({tnx:"connection"},"Pending queue entries cleared");return}let i=this._queue.shift();if(i&&typeof i.callback=="function")try{i.callback(new Error("Connection pool was closed"))}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}setImmediate(n)};setImmediate(n)}_processMessages(){if(this._closed)return;if(!this._queue.length){this.idling||(this.idling=!0,this.emit("idle"));return}let e=this._connections.find(n=>n.available);if(!e&&this._connections.length<this.options.maxConnections&&(e=this._createConnection()),!e){this.idling=!1;return}!this.idling&&this._queue.length<this.options.maxConnections&&(this.idling=!0,this.emit("idle"));let r=e.queueEntry=this._queue.shift();r.messageId=(e.queueEntry.mail.message.getHeader("message-id")||"").replace(/[<>\s]/g,""),e.available=!1,this.logger.debug({tnx:"pool",cid:e.id,messageId:r.messageId,action:"assign"},"Assigned message <%s> to #%s (%s)",r.messageId,e.id,e.messages+1),this._rateLimit.limit&&(this._rateLimit.counter++,this._rateLimit.checkpoint||(this._rateLimit.checkpoint=Date.now())),e.send(r.mail,(n,i)=>{if(r===e.queueEntry){try{r.callback(n,i)}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}e.queueEntry=!1}})}_createConnection(){let e=new Rv(this);return e.id=++this._connectionCounter,this.logger.info({tnx:"pool",cid:e.id,action:"conection"},"Created new pool resource #%s",e.id),e.on("available",()=>{this.logger.debug({tnx:"connection",cid:e.id,action:"available"},"Connection #%s became available",e.id),this._closed?this.close():this._processMessages()}),e.once("error",r=>{if(r.code!==Ov.EMAXLIMIT?this.logger.warn({err:r,tnx:"pool",cid:e.id},"Pool Error for #%s: %s",e.id,r.message):this.logger.debug({tnx:"pool",cid:e.id,action:"maxlimit"},"Max messages limit exchausted for #%s",e.id),e.queueEntry){try{e.queueEntry.callback(r)}catch(n){this.logger.error({err:n,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,n.message)}e.queueEntry=!1}this._removeConnection(e),this._continueProcessing()}),e.once("close",()=>{this.logger.info({tnx:"connection",cid:e.id,action:"closed"},"Connection #%s was closed",e.id),this._removeConnection(e),e.queueEntry?setTimeout(()=>{e.queueEntry&&(this._shouldRequeuOnConnectionClose(e.queueEntry)?this._requeueEntryOnConnectionClose(e):this._failDeliveryOnConnectionClose(e)),this._continueProcessing()},50):(!this._closed&&this.idling&&!this._connections.length&&this.emit("clear"),this._continueProcessing())}),this._connections.push(e),e}_shouldRequeuOnConnectionClose(e){return this.options.maxRequeues===void 0||this.options.maxRequeues<0?!0:e.requeueAttempts<this.options.maxRequeues}_failDeliveryOnConnectionClose(e){if(e.queueEntry&&e.queueEntry.callback){try{e.queueEntry.callback(new Error("Reached maximum number of retries after connection was closed"))}catch(r){this.logger.error({err:r,tnx:"callback",messageId:e.queueEntry.messageId,cid:e.id},"Callback error for #%s: %s",e.id,r.message)}e.queueEntry=!1}}_requeueEntryOnConnectionClose(e){e.queueEntry.requeueAttempts+=1,this.logger.debug({tnx:"pool",cid:e.id,messageId:e.queueEntry.messageId,action:"requeue"},"Re-queued message <%s> for #%s. Attempt: #%s",e.queueEntry.messageId,e.id,e.queueEntry.requeueAttempts),this._queue.unshift(e.queueEntry),e.queueEntry=!1}_continueProcessing(){this._closed?this.close():setTimeout(()=>this._processMessages(),100)}_removeConnection(e){let r=this._connections.indexOf(e);r!==-1&&this._connections.splice(r,1)}_checkRateLimit(e){if(!this._rateLimit.limit)return e();let r=Date.now();if(this._rateLimit.counter<this._rateLimit.limit)return e();if(this._rateLimit.waiting.push(e),this._rateLimit.checkpoint<=r-this._rateLimit.delta)return this._clearRateLimit();this._rateLimit.timeout||(this._rateLimit.timeout=setTimeout(()=>this._clearRateLimit(),this._rateLimit.delta-(r-this._rateLimit.checkpoint)),this._rateLimit.checkpoint=r)}_clearRateLimit(){for(clearTimeout(this._rateLimit.timeout),this._rateLimit.timeout=null,this._rateLimit.counter=0,this._rateLimit.checkpoint=!1;this._rateLimit.waiting.length;){let e=this._rateLimit.waiting.shift();setImmediate(e)}}isIdle(){return this.idling}verify(e){let r;e||(r=new Promise((i,s)=>{e=ma.callbackPromise(i,s)}));let n=new Rv(this).auth;return this.getSocket(this.options,(i,s)=>{if(i)return e(i);let o=this.options;s&&s.connection&&(this.logger.info({tnx:"proxy",remoteAddress:s.connection.remoteAddress,remotePort:s.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",s.connection.remoteAddress,s.connection.remotePort,o.host||"",o.port||""),o=Object.assign(ma.assign(!1,o),s));let a=new tw(o),c=!1;a.once("error",d=>{if(!c)return c=!0,a.close(),e(d)}),a.once("end",()=>{if(!c)return c=!0,e(new Error("Connection closed"))});let l=()=>{if(!c)return c=!0,a.quit(),e(null,!0)};a.connect(()=>{if(!c)if(n&&(a.allowsAuth||o.forceAuth))a.login(n,d=>{if(!c){if(d)return c=!0,a.close(),e(d);l()}});else if(!n&&a.allowsAuth&&o.forceAuth){let d=new Error("Authentication info was not provided");return d.code=Ov.ENOAUTH,c=!0,a.close(),e(d)}else l()})}),r}};Cv.exports=$p});var Kv=he((hX,Mv)=>{"use strict";var nw=ee("events"),Pv=Cl(),iw=Gp(),Bs=Kt(),sw=qp(),Uv=lr(),Lv=br(),Wp=class extends nw{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=Bs.parseConnectionUrl(e.url),n=n||r.service),this.options=Bs.assign(!1,e,r,n&&iw(n)),this.logger=Bs.getLogger(this.options,{component:this.options.component||"smtp-transport"}),this.name="SMTP",this.version=Lv.version+"[client:"+Lv.version+"]",this.options.auth&&(this.auth=this.getAuth({}))}getSocket(e,r){return setImmediate(()=>r(null,!1))}getAuth(e){if(!e)return this.auth;let r=Object.assign({},this.options.auth&&typeof this.options.auth=="object"?this.options.auth:{},e&&typeof e=="object"?e:{});if(Object.keys(r).length===0)return!1;switch((r.type||"").toString().toUpperCase()){case"OAUTH2":{if(!r.service&&!r.user)return!1;let n=new sw(r,this.logger);return n.provisionCallback=this.mailer&&this.mailer.get("oauth2_provision_cb")||n.provisionCallback,n.on("token",i=>this.mailer.emit("token",i)),n.on("error",i=>this.emit("error",i)),{type:"OAUTH2",user:r.user,oauth2:n,method:"XOAUTH2"}}default:return{type:(r.type||"").toString().toUpperCase()||"LOGIN",user:r.user,credentials:{user:r.user||"",pass:r.pass,options:r.options},method:(r.method||"").trim().toUpperCase()||this.options.authMethod||!1}}}send(e,r){this.getSocket(this.options,(n,i)=>{if(n)return r(n);let s=!1,o=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,o.host||"",o.port||""),o=Object.assign(Bs.assign(!1,o),i));let a=new Pv(o),c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};a.once("error",p=>{if(!s)return s=!0,l(),a.close(),r(p)}),a.once("end",()=>{if(s)return;let p=setTimeout(()=>{if(s)return;s=!0,l();let m=new Error("Unexpected socket close");a&&a._socket&&a._socket.upgrading&&(m.code=Uv.ETLS),r(m)},1e3);try{p.unref()}catch{}});let d=()=>{let p=e.message.getEnvelope(),m=e.message.messageId(),E=[].concat(p.to||[]);E.length>3&&E.push("...and "+E.splice(2).length+" more"),e.data.dsn&&(p.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(p.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.logger.info({tnx:"send",messageId:m},"Sending message %s to <%s>",m,E.join(", ")),a.send(p,e.message.createReadStream(),(v,b)=>{if(s=!0,l(),a.close(),v)return this.logger.error({err:v,tnx:"send"},"Send error for %s: %s",m,v.message),r(v);b.envelope={from:p.from,to:p.to},b.messageId=m;try{return r(null,b)}catch(k){this.logger.error({err:k,tnx:"callback"},"Callback error for %s: %s",m,k.message)}})};a.connect(()=>{s||(c=this.getAuth(e.data.auth),c&&(a.allowsAuth||o.forceAuth)?a.login(c,p=>{if(l(),!s){if(p)return s=!0,a.close(),r(p);d()}}):d())})})}verify(e){let r;return e||(r=new Promise((n,i)=>{e=Bs.callbackPromise(n,i)})),this.getSocket(this.options,(n,i)=>{if(n)return e(n);let s=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,s.host||"",s.port||""),s=Object.assign(Bs.assign(!1,s),i));let o=new Pv(s),a=!1,c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};o.once("error",p=>{if(!a)return a=!0,l(),o.close(),e(p)}),o.once("end",()=>{if(!a)return a=!0,l(),e(new Error("Connection closed"))});let d=()=>{if(!a)return a=!0,l(),o.quit(),e(null,!0)};o.connect(()=>{if(!a)if(c=this.getAuth({}),c&&(o.allowsAuth||s.forceAuth))o.login(c,p=>{if(l(),!a){if(p)return a=!0,o.close(),e(p);d()}});else if(!c&&o.allowsAuth&&s.forceAuth){let p=new Error("Authentication info was not provided");return p.code=Uv.ENOAUTH,a=!0,l(),o.close(),e(p)}else d()})}),r}close(){this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.emit("close")}};Mv.exports=Wp});var Fv=he((EX,Hv)=>{"use strict";var{spawn:ow}=ee("child_process"),aw=br(),cw=Kt(),zp=lr(),Jp=class{constructor(e){e=e||{},this._spawn=ow,this.options=e,this.name="Sendmail",this.version=aw.version,this.path="sendmail",this.args=!1,this.logger=cw.getLogger(this.options,{component:this.options.component||"sendmail"}),typeof e=="string"?this.path=e:typeof e=="object"&&(e.path&&(this.path=e.path),Array.isArray(e.args)&&(this.args=e.args))}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s;if([].concat(n.from||[]).concat(n.to||[]).some(d=>/^-/.test(d))){let d=new Error("Can not send mail. Invalid envelope addresses.");return d.code=zp.ESENDMAIL,r(d)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=d=>{if(!s&&(s=!0,typeof r=="function"))return d?r(d):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(d){return this.logger.error({err:d,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",d.message),c(d)}if(l){l.on("error",m=>{this.logger.error({err:m,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,m.message),c(m)}),l.once("exit",m=>{if(!m)return c();let E=new Error(m===127?"Sendmail command not found, process exited with code "+m:"Sendmail exited with code "+m);E.code=zp.ESENDMAIL,this.logger.error({err:E,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,E.message),c(E)}),l.once("close",c),l.stdin.on("error",m=>{this.logger.error({err:m,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,m.message),c(m)});let d=[].concat(n.to||[]);d.length>3&&d.push("...and "+d.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,d.join(", "));let p=e.message.createReadStream();p.once("error",m=>{this.logger.error({err:m,tnx:"stdin",messageId:i},"Error occurred when generating message %s. %s",i,m.message),l.kill("SIGINT"),c(m)}),p.pipe(l.stdin)}else{let d=new Error("sendmail was not found");return d.code=zp.ESENDMAIL,c(d)}}};Hv.exports=Jp});var Bv=he((yX,Vv)=>{"use strict";var lw=br(),uw=Kt(),Yp=class{constructor(e){e=e||{},this.options=e,this.name="StreamTransport",this.version=lw.version,this.logger=uw.getLogger(this.options,{component:this.options.component||"stream-transport"}),this.winbreak=["win","windows","dos",`\r
-`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,s.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let o;try{o=e.message.createReadStream()}catch(l){return this.logger.error({err:l,tnx:"send",messageId:i},"Creating send stream failed for %s. %s",i,l.message),r(l)}if(!this.options.buffer)return o.once("error",l=>{this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message)}),r(null,{envelope:n,messageId:i,message:o});let a=[],c=0;o.on("readable",()=>{let l;for(;(l=o.read())!==null;)a.push(l),c+=l.length}),o.once("error",l=>(this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message),r(l))),o.on("end",()=>r(null,{envelope:n,messageId:i,message:Buffer.concat(a,c)}))})}};Vv.exports=Yp});var jv=he((gX,qv)=>{"use strict";var dw=br(),pw=Kt(),Xp=class{constructor(e){e=e||{},this.options=e,this.name="JSONTransport",this.version=dw.version,this.logger=pw.getLogger(this.options,{component:this.options.component||"json-transport"})}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Composing JSON structure of %s to <%s>",i,s.join(", ")),setImmediate(()=>{e.normalize((o,a)=>o?(this.logger.error({err:o,tnx:"send",messageId:i},"Failed building JSON structure for %s. %s",i,o.message),r(o)):(delete a.envelope,delete a.normalizedHeaders,r(null,{envelope:n,messageId:i,message:this.options.skipEncoding?a:JSON.stringify(a)})))})}};qv.exports=Xp});var Wv=he((vX,$v)=>{"use strict";var fw=ee("events"),mw=br(),Gv=Kt(),hw=xp(),Ew=kl(),Qp=class extends fw{constructor(e){super(),e=e||{},this.options=e,this.ses=this.options.SES,this.name="SESTransport",this.version=mw.version,this.logger=Gv.getLogger(this.options,{component:this.options.component||"ses-transport"})}getRegion(e){return this.ses.sesClient.config&&typeof this.ses.sesClient.config.region=="function"?this.ses.sesClient.config.region().then(r=>e(null,r)).catch(r=>e(r)):e(null,!1)}send(e,r){let n=e.message._headers.find(c=>/^from$/i.test(c.key));if(n){let c=new Ew("text/plain");n=c._convertAddresses(c._parseAddresses(n.value))}let i=e.data.envelope||e.message.getEnvelope(),s=e.message.messageId(),o=[].concat(i.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:s},"Sending message %s to <%s>",s,o.join(", "));let a=c=>{e.data._dkim||(e.data._dkim={}),e.data._dkim.skipFields&&typeof e.data._dkim.skipFields=="string"?e.data._dkim.skipFields+=":date:message-id":e.data._dkim.skipFields="date:message-id";let l=e.message.createReadStream(),d=l.pipe(new hw),p=[],m=0;d.on("readable",()=>{let E;for(;(E=d.read())!==null;)p.push(E),m+=E.length}),l.once("error",E=>d.emit("error",E)),d.once("error",E=>c(E)),d.once("end",()=>c(null,Buffer.concat(p,m)))};setImmediate(()=>a((c,l)=>{if(c)return this.logger.error({err:c,tnx:"send",messageId:s},"Failed creating message for %s. %s",s,c.message),r(c);let d=Object.assign({Content:{Raw:{Data:l}},FromEmailAddress:n||i.from,Destination:{ToAddresses:i.to}},e.data.ses||{});this.getRegion((p,m)=>{(p||!m)&&(m="us-east-1");let E=new this.ses.SendEmailCommand(d);this.ses.sesClient.send(E).then(b=>{m==="us-east-1"&&(m="email"),r(null,{envelope:{from:i.from,to:i.to},messageId:"<"+b.MessageId+(/@/.test(b.MessageId)?"":"@"+m+".amazonses.com")+">",response:b.MessageId,raw:l})}).catch(b=>{this.logger.error({err:b,tnx:"send"},"Send error for %s: %s",s,b.message),r(b)})})}))}verify(e){let r;e||(r=new Promise((s,o)=>{e=Gv.callbackPromise(s,o)}));let n=s=>s&&!["InvalidParameterValue","MessageRejected"].includes(s.code||s.Code||s.name)?e(s):e(null,!0),i={Content:{Raw:{Data:Buffer.from(`From: <invalid@invalid>\r
-To: <invalid@invalid>\r
- Subject: Invalid\r
-\r
-Invalid`)}},FromEmailAddress:"invalid@invalid",Destination:{ToAddresses:["invalid@invalid"]}};return this.getRegion((s,o)=>{(s||!o)&&(o="us-east-1");let a=new this.ses.SendEmailCommand(i);this.ses.sesClient.send(a).then(l=>n(null,l)).catch(l=>n(l))}),r}};$v.exports=Qp});var Xv=he((AX,Ul)=>{"use strict";var yw=pv(),Yv=Kt(),gw=Dv(),vw=Kv(),Aw=Fv(),Tw=Bv(),_w=jv(),Iw=Wv(),xw=lr(),bw=ca(),zv=br(),Sw=(process.env.ETHEREAL_API||"https://api.nodemailer.com").replace(/\/+$/,""),Nw=(process.env.ETHEREAL_WEB||"https://ethereal.email").replace(/\/+$/,""),Jv=(process.env.ETHEREAL_API_KEY||"").replace(/\s*/g,"")||null,ww=["true","yes","y","1"].includes((process.env.ETHEREAL_CACHE||"yes").toString().trim().toLowerCase()),ha=!1;Ul.exports.createTransport=function(t,e){let r;if(typeof t=="object"&&typeof t.send!="function"||typeof t=="string"&&/^(smtps?|direct):/i.test(t)){let n=typeof t=="string"?t:t.url;if(n?r=Yv.parseConnectionUrl(n):r=t,r.pool)t=new gw(r);else if(r.sendmail)t=new Aw(r);else if(r.streamTransport)t=new Tw(r);else if(r.jsonTransport)t=new _w(r);else if(r.SES){if(r.SES.ses&&r.SES.aws){let i=new Error("Using legacy SES configuration, expecting @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw i.code=xw.ECONFIG,i}t=new Iw(r)}else t=new vw(r)}return new yw(t,r,e)};Ul.exports.createTestAccount=function(t,e){let r;if(!e&&typeof t=="function"&&(e=t,t=!1),e||(r=new Promise((l,d)=>{e=Yv.callbackPromise(l,d)})),ww&&ha)return setImmediate(()=>e(null,ha)),r;t=t||Sw;let n=[],i=0,s={},o={requestor:zv.name,version:zv.version};Jv&&(s.Authorization="Bearer "+Jv);let a={contentType:"application/json",method:"POST",headers:s,body:Buffer.from(JSON.stringify(o))};/^https:/i.test(t)&&(a.tls={rejectUnauthorized:!0});let c=bw(t+"/user",a);return c.on("readable",()=>{let l;for(;(l=c.read())!==null;)n.push(l),i+=l.length}),c.once("error",l=>e(l)),c.once("end",()=>{let l=Buffer.concat(n,i),d;try{d=JSON.parse(l.toString())}catch(p){return e(p)}if(d.status!=="success"||d.error)return e(new Error(d.error||"Request failed"));delete d.status,ha=d,e(null,ha)}),r};Ul.exports.getTestMessageUrl=function(t){if(!t||!t.response)return!1;let e=new Map;return t.response.replace(/\[([^\]]+)\]$/,(r,n)=>{n.replace(/\b([A-Z0-9]+)=([^\s]+)/g,(i,s,o)=>{e.set(s,o)})}),e.has("STATUS")&&e.has("MSGID")?(ha.web||Nw)+"/message/"+e.get("MSGID"):!1}});var YA={};Ba(YA,{RequestError:()=>jn,createAdaptorServer:()=>JA,getRequestListener:()=>zA,serve:()=>P0});import{createServer as y0}from"http";import{Http2ServerRequest as g0}from"http2";import{Http2ServerRequest as bf}from"http2";import{Readable as FA}from"stream";import O0 from"crypto";async function N0(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function jA(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(o,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function s(){t.read().then(o,i)}function o({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",s);else return t.read().then(o,i)}catch(l){i(l)}}}function w0(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:jA(t.getReader(),e)}var jn,v0,A0,Ha,T0,BA,_0,zs,I0,Jl,Yl,x0,Ws,b0,Xl,S0,VA,$s,Ni,wf,Fa,Sf,R0,Rf,k0,GA,Nf,$A,WA,C0,D0,zA,JA,P0,XA=Q(()=>{jn=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},v0=t=>t instanceof jn?t:new jn(t.message,{cause:t}),A0=global.Request,Ha=class extends A0{constructor(t,e){typeof t=="object"&&zs in t&&(t=t[zs]()),typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},T0=t=>{let e=[],r=t.rawHeaders;for(let n=0;n<r.length;n+=2){let{[n]:i,[n+1]:s}=r;i.charCodeAt(0)!==58&&e.push([i,s])}return new Headers(e)},BA=Symbol("wrapBodyStream"),_0=(t,e,r,n,i)=>{let s={method:t,headers:r,signal:i.signal};if(t==="TRACE"){s.method="GET";let o=new Ha(e,s);return Object.defineProperty(o,"method",{get(){return"TRACE"}}),o}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)s.body=new ReadableStream({start(o){o.enqueue(n.rawBody),o.close()}});else if(n[BA]){let o;s.body=new ReadableStream({async pull(a){try{o||=FA.toWeb(n).getReader();let{done:c,value:l}=await o.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else s.body=FA.toWeb(n);return new Ha(e,s)},zs=Symbol("getRequestCache"),I0=Symbol("requestCache"),Jl=Symbol("incomingKey"),Yl=Symbol("urlKey"),x0=Symbol("headersKey"),Ws=Symbol("abortControllerKey"),b0=Symbol("getAbortController"),Xl={get method(){return this[Jl].method||"GET"},get url(){return this[Yl]},get headers(){return this[x0]||=T0(this[Jl])},[b0](){return this[zs](),this[Ws]},[zs](){return this[Ws]||=new AbortController,this[I0]||=_0(this.method,this[Yl],this.headers,this[Jl],this[Ws])}};["body","bodyUsed","cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","signal","keepalive"].forEach(t=>{Object.defineProperty(Xl,t,{get(){return this[zs]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(Xl,t,{value:function(){return this[zs]()[t]()}})});Object.setPrototypeOf(Xl,Ha.prototype);S0=(t,e)=>{let r=Object.create(Xl);r[Jl]=t;let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof bf)throw new jn("Absolute URL for :path is not allowed in HTTP/2");try{let a=new URL(n);r[Yl]=a.href}catch(a){throw new jn("Invalid absolute URL",{cause:a})}return r}let i=(t instanceof bf?t.authority:t.headers.host)||e;if(!i)throw new jn("Missing host header");let s;if(t instanceof bf){if(s=t.scheme,!(s==="http"||s==="https"))throw new jn("Unsupported scheme")}else s=t.socket&&t.socket.encrypted?"https":"http";let o=new URL(`${s}://${i}${n}`);if(o.hostname.length!==i.length&&o.hostname!==i.replace(/:\d+$/,""))throw new jn("Invalid host header");return r[Yl]=o.href,r},VA=Symbol("responseCache"),$s=Symbol("getResponseCache"),Ni=Symbol("cache"),wf=global.Response,Fa=class qA{#e;#t;[$s](){return delete this[Ni],this[VA]||=new wf(this.#e,this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof qA){let i=r[VA];if(i){this.#t=i,this[$s]();return}else this.#t=r.#t,n=new Headers(r.#t.headers)}else this.#t=r;(typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[Ni]=[r?.status||200,e,n||r?.headers])}get headers(){let e=this[Ni];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||{"content-type":"text/plain; charset=UTF-8"})),e[2]):this[$s]().headers}get status(){return this[Ni]?.[0]??this[$s]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty(Fa.prototype,t,{get(){return this[$s]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(Fa.prototype,t,{value:function(){return this[$s]()[t]()}})});Object.setPrototypeOf(Fa,wf);Object.setPrototypeOf(Fa.prototype,wf.prototype);Sf=t=>{let e={};t instanceof Headers||(t=new Headers(t??void 0));let r=[];for(let[n,i]of t)n==="set-cookie"?r.push(i):e[n]=i;return r.length>0&&(e["set-cookie"]=r),e["content-type"]??="text/plain; charset=UTF-8",e},R0="x-hono-already-sent";typeof global.crypto>"u"&&(global.crypto=O0);Rf=Symbol("outgoingEnded"),k0=()=>new Response(null,{status:400}),GA=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),Nf=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||e.writeHead(500,{"Content-Type":"text/plain"}),e.end(`Error: ${r.message}`),e.destroy(r))},$A=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},WA=async(t,e)=>{let[r,n,i]=t[Ni],s=!1;if(!i)i={"content-type":"text/plain; charset=UTF-8"};else if(i instanceof Headers)s=i.has("content-length"),i=Sf(i);else if(Array.isArray(i)){let o=new Headers(i);s=o.has("content-length"),i=Sf(o)}else for(let o in i)if(o.length===14&&o.toLowerCase()==="content-length"){s=!0;break}s||(typeof n=="string"?i["Content-Length"]=Buffer.byteLength(n):n instanceof Uint8Array?i["Content-Length"]=n.byteLength:n instanceof Blob&&(i["Content-Length"]=n.size)),e.writeHead(r,i),typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):($A(e),await w0(n,e)?.catch(o=>Nf(o,e))),e[Rf]?.()},C0=t=>typeof t.then=="function",D0=async(t,e,r={})=>{if(C0(t))if(r.errorHandler)try{t=await t}catch(i){let s=await r.errorHandler(i);if(!s)return;t=s}else t=await t.catch(GA);if(Ni in t)return WA(t,e);let n=Sf(t.headers);if(t.body){let i=t.body.getReader(),s=[],o=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let d=await N0(a).catch(p=>{console.error(p),o=!0});if(!d){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,d.value&&s.push(d.value),d.done){o=!0;break}}o&&!("content-length"in n)&&(n["content-length"]=s.reduce((l,d)=>l+d.length,0))}e.writeHead(t.status,n),s.forEach(c=>{e.write(c)}),o?e.end():(s.length===0&&$A(e),await jA(i,e,a))}else n[R0]||(e.writeHead(t.status,n),e.end());e[Rf]?.()},zA=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==Ha&&(Object.defineProperty(global,"Request",{value:Ha}),Object.defineProperty(global,"Response",{value:Fa})),async(n,i)=>{let s,o;try{o=S0(n,e.hostname);let a=!r||n.method==="GET"||n.method==="HEAD";if(a||(n[BA]=!0,n.on("end",()=>{a=!0}),n instanceof g0&&(i[Rf]=()=>{a||setTimeout(()=>{a||setTimeout(()=>{n.destroy(),i.destroy()})})})),i.on("close",()=>{o[Ws]&&(n.errored?o[Ws].abort(n.errored.toString()):i.writableFinished||o[Ws].abort("Client connection prematurely closed.")),a||setTimeout(()=>{a||setTimeout(()=>{n.destroy()})})}),s=t(o,{incoming:n,outgoing:i}),Ni in s)return WA(s,i)}catch(a){if(s)return Nf(a,i);if(e.errorHandler){if(s=await e.errorHandler(o?a:v0(a)),!s)return}else o?s=GA(a):s=k0()}try{return await D0(s,i,e)}catch(a){return Nf(a,i)}}},JA=t=>{let e=t.fetch,r=zA(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming});return(t.createServer||y0)(t.serverOptions||{},r)},P0=(t,e)=>{let r=JA(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var Ci=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),cT=Ci.READ|Ci.WRITE|Ci.DELETE|Ci.APPROVE|Ci.EXECUTE,tt={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},tr={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var lT=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function Di(t){return lT?Object.freeze(t):t}function g(t,e){if(arguments.length===0)return Di({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),Di(r)}function u(t,e){let n={ok:!1,errors:Di(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),Di(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:o!=null,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c};return g(t,{...r,pagination:l})}function T(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function X(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let s in r){if(s==="message"||s==="field")continue;let o=r[s];(typeof o=="string"||typeof o=="number")&&(n=n.replace(new RegExp(`\\{${s}\\}`,"g"),String(o)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function Pi(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var $t=T("AUTH_NOT_AUTHENTICATED","Not authenticated"),rr=T("AUTH_MISSING_CREDENTIALS","Missing credentials"),Wt=T("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Dr=T("AUTH_TOKEN_EXPIRED","Token expired"),Qr=T("AUTH_TOKEN_MALFORMED","Token malformed"),zt=T("PERM_DENIED","Permission denied"),eu=X("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),$n=T("VALIDATION_ERROR","Validation failed"),Ui=X("INVALID_INPUT","Invalid input: {reason}"),Js=T("FORBIDDEN","Access forbidden"),tu=T("NOT_FOUND","Resource not found"),ru=X("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),Ys=X("ALREADY_EXISTS","{resource} already exists"),Xs=T("CONFLICT","Resource conflict"),Wn=T("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),Li=T("INTERNAL_ERROR","Internal server error"),oe={NotAuthenticated:$t,MissingCredentials:rr,InvalidCredentials:Wt,TokenExpired:Dr,TokenMalformed:Qr,PermissionDenied:zt,BoundaryViolation:eu,Forbidden:Js,ValidationError:$n,InvalidInput:Ui,NotFound:tu,ResourceNotFound:ru,AlreadyExists:Ys,Conflict:Xs,RateLimitExceeded:Wn,InternalError:Li};var Ct={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var qa=class{getMask(e,r){return Uf(e.perms,r)}check(e,r,n){if(r.roles?.length&&!(r.requireAllRoles?r.roles.every(a=>e.roles?.includes(a)):r.roles.some(a=>e.roles?.includes(a))))return u(zt({message:"Role requirement not met"}));if(r.allowOwner&&n?.ownerId!==void 0&&n.ownerId===e.id)return g();let i=this.getMask(e,r.resource),s=this.checkCapability(i,r.action);return s.ok?this.checkBoundary(e,r.boundary,n):s}checkCapability(e,r){return(e&r)!==r?u(zt()):g()}checkBoundary(e,r,n){if(r===tt.GLOBAL)return g();if(!n)return u(zt({message:"Resource context required for boundary check"}));let i=n;switch(r){case tt.TENANT:if(!e.tenantId||i.tenantId!==e.tenantId)return u(zt({message:"Tenant boundary violation"}));break;case tt.OWNER:case tt.SELF:if(i.ownerId!==e.id)return u(zt({message:"Owner boundary violation"}));break;default:return u(zt({message:`Unknown boundary type: ${r}`}))}return g()}can(e,r,n){return(this.getMask(e,r)&n)===n}compile(e){return(r,n)=>this.check(r,e,n).ok}checkCapabilityOnly(e,r,n){let i=this.getMask(e,r);return this.checkCapability(i,n)}hasAnyPermission(e,r,n){let i=this.getMask(e,r);return n.some(s=>(i&s)!==0)}hasAllPermissions(e,r,n){let i=this.getMask(e,r);return n.every(s=>(i&s)!==0)}explain(e,r,n){let i=["[Permission Check]"];if(i.push(`Resource: ${r.resource}`),r.roles?.length){let E=r.requireAllRoles?"ALL":"ANY",v=e.roles??[],b=r.requireAllRoles?r.roles.every(k=>v.includes(k)):r.roles.some(k=>v.includes(k));if(i.push(`Roles (${E}): ${r.roles.join(", ")} \u2014 user has: [${v.join(", ")}]`),!b)return i.push("Result: \u2717 DENIED (role requirement not met)"),i.join(`
-`);i.push("Roles: \u2713 OK")}if(r.allowOwner){let E=n?.ownerId!==void 0&&n.ownerId===e.id;if(i.push(`Owner bypass: resource.ownerId=${n?.ownerId??"undefined"}, user.id=${e.id}`),E)return i.push("Result: \u2713 ALLOWED (owner bypass)"),i.join(`
-`);i.push("Owner bypass: not owner, continuing to perm check")}let s=this.describeBits(r.action);i.push(`Required: ${s} (${r.action})`);let o=e.perms,a=o?.[r.resource],c=o?.["*"],l=a??c??0,d=a!==void 0?r.resource:c!==void 0?"*":"none",p=this.describeBits(l);if(i.push(`User Perms: ${p||"none"} (from: ${d})`),i.push(`User Mask: ${l}`),!((l&r.action)===r.action))return i.push(`Result: \u2717 DENIED (capability mismatch: ${l} & ${r.action} = ${l&r.action})`),i.join(`
-`);if(r.boundary!=="global"){if(!n)return i.push(`Boundary: ${r.boundary} - MISSING RESOURCE CONTEXT`),i.push("Result: \u2717 DENIED (no resource context for boundary check)"),i.join(`
-`);if(!this.checkBoundary(e,r.boundary,n).ok)return i.push(`Boundary: ${r.boundary} - VIOLATED`),r.boundary==="tenant"?(i.push(`  User tenantId: ${e.tenantId||"undefined"}`),i.push(`  Resource tenantId: ${n.tenantId||"undefined"}`)):(r.boundary==="owner"||r.boundary==="self")&&(i.push(`  User id: ${e.id}`),i.push(`  Resource ownerId: ${n.ownerId||"undefined"}`)),i.push("Result: \u2717 DENIED (boundary violation)"),i.join(`
-`);i.push(`Boundary: ${r.boundary} - OK`)}return i.push("Result: \u2713 ALLOWED"),i.join(`
-`)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function zn(){return new qa}function Uf(t,e){return t?.[e]??t?.["*"]??0}var uT="AUTH_INVALID_CREDENTIALS",ja=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[tr.JWT,tr.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return u($t({message:"No auth methods configured"}));for(let i of n){let s=this.methods.get(i);if(!s)continue;let o=await s.authenticate(r);if(o.ok)return g({user:o.data,method:i});if(!o.errors||o.errors.length===0)continue;let a=o.errors[0];if(a?.code===uT)return u(a)}return u($t())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function Jn(t,e={}){return new ja(t,e)}var Qs={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function vn(t,e){return{name:tr.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return u(rr({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return u(Qr({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return u(rr({message:"Bearer token is empty"}));let s=await e(i,t);if(!s.ok){let a=s.errors[0];return a?.code===Qs.TOKEN_EXPIRED?u(Dr()):a?.code===Qs.TOKEN_MALFORMED?u(Qr()):u(Wt())}let o=s.data;return o.exp&&o.exp<Date.now()/1e3?u(Dr()):g({id:o.sub,perms:o.perms,tenantId:o.tid,tenantType:o.tty,roles:o.roles??[]})}}}function Ga(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function An(t){return{name:tr.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return u(rr({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?g({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):u(Wt({message:"Invalid API key"}))}}}ho();function vc(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var zT="x-gateway-auth";function es(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??zT;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let s=vc(e);n=it({kty:"OKP",crv:"Ed25519",x:s},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:tr.GATEWAY_JWT,async authenticate(s){if(e!==void 0){let l=s.headers[r];if(!l)return u(rr({message:`${r} header required`}));if(!l.startsWith("Bearer "))return u(Wt({message:`${r} must use Bearer scheme`}));let d=l.slice(7);if(!d)return u(rr({message:"Gateway JWT is empty"}));let p;try{let m=await i(),{payload:E}=await bn(d,m,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=E}catch(m){return m.code==="ERR_JWT_EXPIRED"?u(Dr({message:"Gateway JWT expired"})):u(Wt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let m=typeof p.jti=="string"?p.jti:void 0;if(!m)return u(Wt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(m))return u(Wt({message:"Gateway JWT jti already used (replay)"}))}}let o=Ga(s.headers);if(o===null)return s.headers.authorization??s.headers.Authorization?u(Qr({message:"Authorization header must use Bearer scheme"})):u(rr({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(o,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===Qs.TOKEN_EXPIRED?u(Dr()):l?.code===Qs.TOKEN_MALFORMED?u(Qr()):u(Wt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?u(Dr()):g({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var qU=globalThis.performance;ho();var d_="TOKEN_EXPIRED",dh="TOKEN_MALFORMED";function p_(t){return"secret"in t}function f_(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function m_(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=vc(t);return it({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function ph(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function h_(t){try{let e=atob(t);return ph(e)}catch{return null}}async function E_(t){if(p_(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=ph(e);if(n)return it(n,r);let i=h_(e);return i?it(i,r):r==="EdDSA"&&f_(e)?m_(e):sc(e,r)}function y_(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function gr(t){let e=null;return async(r,n)=>{try{e||(e=E_(t));let i=await e,{payload:s}=await bn(r,i,y_(t));return g(s)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?u({code:d_,message:"Token has expired"}):u({code:dh,message:i.message}):u({code:dh,message:"JWT verification failed"})}}}function Fu(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??gr(s);e.push(vn(s,o))}t.auth.apiKey&&e.push(An(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Jn(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=zn(),i=t.errorHttpMap?{...Ct,...t.errorHttpMap}:{...Ct};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as g_}from"crypto";async function Vu(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??g_();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function tn(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:Pi(t)}:{status:e?.error??400,body:Pi(t)}}var ts=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function rs(t,e){let r=e?.name;return function(i){if(i.ok)return tn(i);let s=i.errors[0]?.code;if(!s||!(s in t))throw new ts(s,i,r);let o=t[s];return tn(i,{error:o})}}function ns(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof ts)return tn(n.result,{error:e});throw n}}}var v_={...Ct},aM=ns(rs(v_),400);var NM=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var Bu=(t,e,r)=>(n,i)=>{let s=-1;return o(0);async function o(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,d;if(t[a]?(d=t[a][0][0],n.req.routeIndex=a):d=a===t.length&&i||void 0,d)try{c=await d(n,()=>o(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var Eh=Symbol();var yh=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,s=(t instanceof Ic?t.raw.headers:t.headers).get("Content-Type");return s?.startsWith("multipart/form-data")||s?.startsWith("application/x-www-form-urlencoded")?S_(t,{all:r,dot:n}):{}};async function S_(t,e){let r=await t.formData();return r?N_(r,e):{}}function N_(t,e){let r=Object.create(null);return t.forEach((n,i)=>{e.all||i.endsWith("[]")?w_(r,i,n):r[i]=n}),e.dot&&Object.entries(r).forEach(([n,i])=>{n.includes(".")&&(R_(r,n,i),delete r[n])}),r}var w_=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},R_=(t,e,r)=>{if(/(?:^|\.)__proto__\./.test(e))return;let n=t,i=e.split(".");i.forEach((s,o)=>{o===i.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var ju=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},gh=t=>{let{groups:e,path:r}=O_(t),n=ju(r);return k_(n,e)},O_=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},k_=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},xc={},vh=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return xc[n]||(r[2]?xc[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:xc[n]=[t,r[1],!0]),xc[n]}return null},ss=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},C_=t=>ss(t,decodeURI),Gu=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let s=e.indexOf("?",n),o=e.indexOf("#",n),a=s===-1?o===-1?void 0:o:o===-1?s:Math.min(s,o),c=e.slice(r,a);return C_(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var Ah=t=>{let e=Gu(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},Nn=(t,e,...r)=>(r.length&&(e=Nn(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),bc=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(/\?/.test(i)){r.length===0&&n===""?r.push("/"):r.push(n);let s=i.replace("?","");n+="/"+s,r.push(n)}else n+="/"+i}),r.filter((i,s,o)=>o.indexOf(i)===s)},qu=t=>/[%+]/.test(t)?(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),t.indexOf("%")!==-1?ss(t,yo):t):t,Th=(t,e,r)=>{let n;if(!r&&e&&!/[%+]/.test(e)){let o=t.indexOf("?",8);if(o===-1)return;for(t.startsWith(e,o+1)||(o=t.indexOf(`&${e}`,o+1));o!==-1;){let a=t.charCodeAt(o+e.length+1);if(a===61){let c=o+e.length+2,l=t.indexOf("&",c);return qu(t.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";o=t.indexOf(`&${e}`,o+1)}if(n=/[%+]/.test(t),!n)return}let i={};n??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let o=t.indexOf("&",s+1),a=t.indexOf("=",s);a>o&&o!==-1&&(a=-1);let c=t.slice(s+1,a===-1?o===-1?void 0:o:a);if(n&&(c=qu(c)),s=o,c==="")continue;let l;a===-1?l="":(l=t.slice(a+1,o===-1?void 0:o),n&&(l=qu(l))),r?(i[c]&&Array.isArray(i[c])||(i[c]=[]),i[c].push(l)):i[c]??=l}return e?i[e]:i},_h=Th,Ih=(t,e)=>Th(t,e,!0),yo=decodeURIComponent;var xh=t=>ss(t,yo),Ic=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r,this.#e={}}param(t){return t?this.#r(t):this.#s()}#r(t){let e=this.#t[0][this.routeIndex][1][t],r=this.#n(e);return r&&/\%/.test(r)?xh(r):r}#s(){let t={},e=Object.keys(this.#t[0][this.routeIndex][1]);for(let r of e){let n=this.#n(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=/\%/.test(n)?xh(n):n)}return t}#n(t){return this.#t[1]?this.#t[1][t]:t}query(t){return _h(this.url,t)}queries(t){return Ih(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e={};return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return yh(this,t)}#i=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;let i=Object.keys(e)[0];return i?e[i].then(s=>(i==="json"&&(s=JSON.stringify(s)),new Response(s)[t]())):e[t]=r[t]()};json(){return this.#i("text").then(t=>JSON.parse(t))}text(){return this.#i("text")}arrayBuffer(){return this.#i("arrayBuffer")}bytes(){return this.#i("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#i("blob")}formData(){return this.#i("formData")}addValidatedData(t,e){this.#e[t]=e}valid(t){return this.#e[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[Eh](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var bh={Stringify:1,BeforeStream:2,Stream:3},D_=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var $u=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let s=t.callbacks;if(!s?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let o=Promise.all(s.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>$u(c,e,!1,n,i))).then(()=>i[0]));return r?D_(await o,s):o};var P_="text/plain; charset=UTF-8",Wu=(t,e)=>({"Content-Type":t,...e}),go=(t,e)=>new Response(t,e),zu=class{#e;#t;env={};#r;finalized=!1;error;#s;#n;#i;#a;#o;#l;#c;#d;#p;constructor(t,e){this.#e=t,e&&(this.#n=e.executionCtx,this.env=e.env,this.#l=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#t??=new Ic(this.#e,this.#p,this.#d),this.#t}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#i||=go(null,{headers:this.#c??=new Headers})}set res(t){if(this.#i&&t){t=go(t.body,t);for(let[e,r]of this.#i.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#i.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#i=t,this.finalized=!0}render=(...t)=>(this.#o??=e=>this.html(e),this.#o(...t));setLayout=t=>this.#a=t;getLayout=()=>this.#a;setRenderer=t=>{this.#o=t};header=(t,e,r)=>{this.finalized&&(this.#i=go(this.#i.body,this.#i));let n=this.#i?this.#i.headers:this.#c??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#s=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#u(t,e,r){let n=this.#i?new Headers(this.#i.headers):this.#c??new Headers;if(typeof e=="object"&&"headers"in e){let s=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[o,a]of s)o.toLowerCase()==="set-cookie"?n.append(o,a):n.set(o,a)}if(r)for(let[s,o]of Object.entries(r))if(typeof o=="string")n.set(s,o);else{n.delete(s);for(let a of o)n.append(s,a)}let i=typeof e=="number"?e:e?.status??this.#s;return go(t,{status:i,headers:n})}newResponse=(...t)=>this.#u(...t);body=(t,e,r)=>this.#u(t,e,r);text=(t,e,r)=>!this.#c&&!this.#s&&!e&&!r&&!this.finalized?new Response(t):this.#u(t,e,Wu(P_,r));json=(t,e,r)=>this.#u(JSON.stringify(t),e,Wu("application/json",r));html=(t,e,r)=>{let n=i=>this.#u(i,e,Wu("text/html; charset=UTF-8",r));return typeof t=="object"?$u(t,bh.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#l??=()=>go(),this.#l(this))};var Be="ALL",Sh="all",Nh=["get","post","put","delete","options","patch"],Sc="Can not add a route since the matcher is already built.",Nc=class extends Error{};var wh="__COMPOSED_HANDLER";var U_=t=>t.text("404 Not Found",404),Rh=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},Oh=class kh{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[...Nh,Sh].forEach(s=>{this[s]=(o,...a)=>(typeof o=="string"?this.#e=o:this.#s(s,this.#e,o),a.forEach(c=>{this.#s(s,this.#e,c)}),this)}),this.on=(s,o,...a)=>{for(let c of[o].flat()){this.#e=c;for(let l of[s].flat())a.map(d=>{this.#s(l.toUpperCase(),this.#e,d)})}return this},this.use=(s,...o)=>(typeof s=="string"?this.#e=s:(this.#e="*",o.unshift(s)),o.forEach(a=>{this.#s(Be,this.#e,a)}),this);let{strict:n,...i}=e;Object.assign(this,i),this.getPath=n??!0?e.getPath??Gu:Ah}#t(){let e=new kh({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=U_;errorHandler=Rh;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let s;r.errorHandler===Rh?s=i.handler:(s=async(o,a)=>(await Bu([],r.errorHandler)(o,()=>i.handler(o,a))).res,s[wh]=i.handler),n.#s(i.method,i.path,s,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=Nn(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let o=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=Nn(this._basePath,e),l=c==="/"?0:c.length;return d=>{let p=new URL(d.url);return p.pathname=this.getPath(d).slice(l)||"/",new Request(p,d)}})();let a=async(c,l)=>{let d=await r(i(c.req.raw),...o(c));if(d)return d;await l()};return this.#s(Be,Nn(e,"*"),a),this}#s(e,r,n,i){e=e.toUpperCase(),r=Nn(this._basePath,r);let s={basePath:i!==void 0?Nn(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,s]),this.routes.push(s)}#n(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#i(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#i(e,r,n,"GET")))();let s=this.getPath(e,{env:n}),o=this.router.match(i,s),a=new zu(e,{path:s,matchResult:o,env:n,executionCtx:r,notFoundHandler:this.#r});if(o[0].length===1){let l;try{l=o[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(d){return this.#n(d,a)}return l instanceof Promise?l.then(d=>d||(a.finalized?a.res:this.#r(a))).catch(d=>this.#n(d,a)):l??this.#r(a)}let c=Bu(o[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#n(l,a)}})()}fetch=(e,...r)=>this.#i(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${Nn("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#i(e.request,e,void 0,e.request.method))})}};var wc=[];function Ju(t,e){let r=this.buildAllMatchers(),n=((i,s)=>{let o=r[i]||r[Be],a=o[2][s];if(a)return a;let c=s.match(o[0]);if(!c)return[[],wc];let l=c.indexOf("",1);return[o[1][l],c]});return this.match=n,n(t,e)}var Rc="[^/]+",vo=".*",Ao="(?:|/.*)",oi=Symbol(),L_=new Set(".\\+*[^]$()");function M_(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1||t===vo||t===Ao?1:e===vo||e===Ao?-1:t===Rc?1:e===Rc?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var Ch=class Yu{#e;#t;#r=Object.create(null);insert(e,r,n,i,s){if(e.length===0){if(this.#e!==void 0)throw oi;if(s)return;this.#e=r;return}let[o,...a]=e,c=o==="*"?a.length===0?["","",vo]:["","",Rc]:o==="/*"?["","",Ao]:o.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),l;if(c){let d=c[1],p=c[2]||Rc;if(d&&c[2]&&(p===".*"||(p=p.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(p))))throw oi;if(l=this.#r[p],!l){if(Object.keys(this.#r).some(m=>m!==vo&&m!==Ao))throw oi;if(s)return;l=this.#r[p]=new Yu,d!==""&&(l.#t=i.varIndex++)}!s&&d!==""&&n.push([d,l.#t])}else if(l=this.#r[o],!l){if(Object.keys(this.#r).some(d=>d.length>1&&d!==vo&&d!==Ao))throw oi;if(s)return;l=this.#r[o]=new Yu}l.insert(a,r,n,i,s)}buildRegExpStr(){let r=Object.keys(this.#r).sort(M_).map(n=>{let i=this.#r[n];return(typeof i.#t=="number"?`(${n})@${i.#t}`:L_.has(n)?`\\${n}`:n)+i.buildRegExpStr()});return typeof this.#e=="number"&&r.unshift(`#${this.#e}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var Dh=class{#e={varIndex:0};#t=new Ch;insert(t,e,r){let n=[],i=[];for(let o=0;;){let a=!1;if(t=t.replace(/\{[^}]+\}/g,c=>{let l=`@\\${o}`;return i[o]=[l,c],o++,a=!0,l}),!a)break}let s=t.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let o=i.length-1;o>=0;o--){let[a]=i[o];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,i[o][1]);break}}return this.#t.insert(s,e,n,this.#e,r),n}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,s,o)=>s!==void 0?(r[++e]=Number(s),"$()"):(o!==void 0&&(n[Number(o)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var K_=[/^$/,[],Object.create(null)],Ph=Object.create(null);function Uh(t){return Ph[t]??=new RegExp(t==="*"?"":`^${t.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function H_(){Ph=Object.create(null)}function F_(t){let e=new Dh,r=[];if(t.length===0)return K_;let n=t.map(l=>[!/\*|\/:/.test(l[0]),...l]).sort(([l,d],[p,m])=>l?1:p?-1:d.length-m.length),i=Object.create(null);for(let l=0,d=-1,p=n.length;l<p;l++){let[m,E,v]=n[l];m?i[E]=[v.map(([k])=>[k,Object.create(null)]),wc]:d++;let b;try{b=e.insert(E,d,m)}catch(k){throw k===oi?new Nc(E):k}m||(r[d]=v.map(([k,C])=>{let L=Object.create(null);for(C-=1;C>=0;C--){let[B,G]=b[C];L[B]=G}return[k,L]}))}let[s,o,a]=e.buildRegExp();for(let l=0,d=r.length;l<d;l++)for(let p=0,m=r[l].length;p<m;p++){let E=r[l][p]?.[1];if(!E)continue;let v=Object.keys(E);for(let b=0,k=v.length;b<k;b++)E[v[b]]=a[E[v[b]]]}let c=[];for(let l in o)c[l]=r[o[l]];return[s,c,i]}function os(t,e){if(t){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(Uh(r).test(e))return[...t[r]]}}var Oc=class{name="RegExpRouter";#e;#t;constructor(){this.#e={[Be]:Object.create(null)},this.#t={[Be]:Object.create(null)}}add(t,e,r){let n=this.#e,i=this.#t;if(!n||!i)throw new Error(Sc);n[t]||[n,i].forEach(a=>{a[t]=Object.create(null),Object.keys(a[Be]).forEach(c=>{a[t][c]=[...a[Be][c]]})}),e==="/*"&&(e="*");let s=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let a=Uh(e);t===Be?Object.keys(n).forEach(c=>{n[c][e]||=os(n[c],e)||os(n[Be],e)||[]}):n[t][e]||=os(n[t],e)||os(n[Be],e)||[],Object.keys(n).forEach(c=>{(t===Be||t===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(i).forEach(c=>{(t===Be||t===c)&&Object.keys(i[c]).forEach(l=>a.test(l)&&i[c][l].push([r,s]))});return}let o=bc(e)||[e];for(let a=0,c=o.length;a<c;a++){let l=o[a];Object.keys(i).forEach(d=>{(t===Be||t===d)&&(i[d][l]||=[...os(n[d],l)||os(n[Be],l)||[]],i[d][l].push([r,s-c+a+1]))})}}match=Ju;buildAllMatchers(){let t=Object.create(null);return Object.keys(this.#t).concat(Object.keys(this.#e)).forEach(e=>{t[e]||=this.#r(e)}),this.#e=this.#t=void 0,H_(),t}#r(t){let e=[],r=t===Be;return[this.#e,this.#t].forEach(n=>{let i=n[t]?Object.keys(n[t]).map(s=>[s,n[t][s]]):[];i.length!==0?(r||=!0,e.push(...i)):t!==Be&&e.push(...Object.keys(n[Be]).map(s=>[s,n[Be][s]]))}),r?F_(e):null}};var Xu=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(Sc);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,s=0,o;for(;s<i;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);o=a.match(t,e)}catch(c){if(c instanceof Nc)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(s===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,o}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var To=Object.create(null),V_=t=>{for(let e in t)return!0;return!1},Lh=class Mh{#e;#t;#r;#s=0;#n=To;constructor(e,r,n){if(this.#t=n||Object.create(null),this.#e=[],e&&r){let i=Object.create(null);i[e]={handler:r,possibleKeys:[],score:0},this.#e=[i]}this.#r=[]}insert(e,r,n){this.#s=++this.#s;let i=this,s=gh(r),o=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],d=s[a+1],p=vh(l,d),m=Array.isArray(p)?p[0]:l;if(m in i.#t){i=i.#t[m],p&&o.push(p[1]);continue}i.#t[m]=new Mh,p&&(i.#r.push(p),o.push(p[1])),i=i.#t[m]}return i.#e.push({[e]:{handler:n,possibleKeys:o.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),i}#i(e,r,n,i,s){for(let o=0,a=r.#e.length;o<a;o++){let c=r.#e[o],l=c[n]||c[Be],d={};if(l!==void 0&&(l.params=Object.create(null),e.push(l),i!==To||s&&s!==To))for(let p=0,m=l.possibleKeys.length;p<m;p++){let E=l.possibleKeys[p],v=d[l.score];l.params[E]=s?.[E]&&!v?s[E]:i[E]??s?.[E],d[l.score]=!0}}}search(e,r){let n=[];this.#n=To;let s=[this],o=ju(r),a=[],c=o.length,l=null;for(let d=0;d<c;d++){let p=o[d],m=d===c-1,E=[];for(let b=0,k=s.length;b<k;b++){let C=s[b],L=C.#t[p];L&&(L.#n=C.#n,m?(L.#t["*"]&&this.#i(n,L.#t["*"],e,C.#n),this.#i(n,L,e,C.#n)):E.push(L));for(let B=0,G=C.#r.length;B<G;B++){let j=C.#r[B],$=C.#n===To?{}:{...C.#n};if(j==="*"){let y=C.#t["*"];y&&(this.#i(n,y,e,C.#n),y.#n=$,E.push(y));continue}let[te,A,x]=j;if(!p&&!(x instanceof RegExp))continue;let S=C.#t[te];if(x instanceof RegExp){if(l===null){l=new Array(c);let w=r[0]==="/"?1:0;for(let R=0;R<c;R++)l[R]=w,w+=o[R].length+1}let y=r.substring(l[d]),_=x.exec(y);if(_){if($[A]=_[0],this.#i(n,S,e,C.#n,$),V_(S.#t)){S.#n=$;let w=_[0].match(/\//)?.length??0;(a[w]||=[]).push(S)}continue}}(x===!0||x.test(p))&&($[A]=p,m?(this.#i(n,S,e,$,C.#n),S.#t["*"]&&this.#i(n,S.#t["*"],e,$,C.#n)):(S.#n=$,E.push(S)))}}let v=a.shift();s=v?E.concat(v):E}return n.length>1&&n.sort((d,p)=>d.score-p.score),[n.map(({handler:d,params:p})=>[d,p])]}};var Qu=class{name="TrieRouter";#e;constructor(){this.#e=new Lh}add(t,e,r){let n=bc(e);if(n){for(let i=0,s=n.length;i<s;i++)this.#e.insert(t,n[i],r);return}this.#e.insert(t,e,r)}match(t,e){return this.#e.search(t,e)}};var Vr=class extends Oh{constructor(t={}){super(t),this.router=t.router??new Xu({routers:[new Oc,new Qu]})}};function Zu(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??gr(s);e.push(vn(s,o))}t.auth.apiKey&&e.push(An(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Jn(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=zn(),i=t.errorHttpMap?{...Ct,...t.errorHttpMap}:{...Ct};return{auth:r,permission:n,errorHttpMap:i}}function sr(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var ed={...Ct},Kh=ns(rs(ed),400);function td(t){ed={...Ct,...t},Kh=ns(rs(ed),400)}function Hh(){return Kh}function qe(t,e,r){let{traceId:n,successStatus:i,adapter:s=Hh()}=r??{},o=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:o}},l=s(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let d=e.ok?g(e.data,a):{...e,meta:a},p=Pi(d);return t.json(p,l)}async function B_(t){let e={};t.req.raw.headers.forEach((o,a)=>{e[a]=o});let r={},n=t.req.query();for(let[o,a]of Object.entries(n))r[o]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function _o(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,s)=>{let o=sr(i);try{let a=await B_(i),c=await e.resolve(n,a);if(!c.ok){if(r){await s();return}return qe(i,u($t()),{traceId:o})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await s()}catch{if(r){await s();return}return qe(i,u($t()),{traceId:o})}}}function rd(t){return async(e,r)=>{let n=sr(e),i=e.get("authResult");if(!i)return qe(e,u($t()),{traceId:n});let{user:s}=i,o;if(t.loadResource){let l=e.req.param(),d=await t.loadResource(l,s);if(d===null)return qe(e,u(zt({message:"Resource not found for boundary check"})),{traceId:n});o=d}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(s,a,o);if(!c.ok)return qe(e,c,{traceId:n});await r()}}function Io(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?u(r.issues.map(n=>{let i=n.path?.map(s=>typeof s=="object"?s.key:s).join(".")??"";return $n({message:i?`${i}: ${n.message}`:n.message})})):g(r.value)}function xo(t){return async(e,r)=>{let n=sr(e);try{let i={};if(t.body){let s;try{s=await e.req.json()}catch{return qe(e,u(Ui({reason:"Request body is not valid JSON"})),{traceId:n})}let o=Io(t.body,s);if(!o.ok)return qe(e,o,{traceId:n});i.body=o.data}if(t.params){let s=Io(t.params,e.req.param());if(!s.ok)return qe(e,s,{traceId:n});i.params=s.data}if(t.query){let s=Io(t.query,e.req.query());if(!s.ok)return qe(e,s,{traceId:n});i.query=s.data}if(t.headers){let s={};e.req.raw.headers.forEach((a,c)=>{s[c]=a});let o=Io(t.headers,s);if(!o.ok)return qe(e,o,{traceId:n});i.headers=o.data}e.set("validatedData",i),await r()}catch(i){let s={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return qe(e,u($n(),s),{traceId:n})}}}function bo(t){return t.get("validatedData")?.body}function So(t){return t.get("validatedData")?.params}function No(t){return t.get("validatedData")?.query}var uH=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function q_(t,e){let r=[...t,e];return async(n,i)=>{let s,o=async a=>{if(s||a>=r.length){!s&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await o(a+1)});l instanceof Response&&(s=l)};return await o(0),s}}function Y(t,e){let r=[];if(e.auth!==!1){let s=Array.isArray(e.auth)?e.auth:void 0;r.push(_o({engine:t.auth,methods:s}))}e.permission&&r.push(rd({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(s,o)=>{let a={body:void 0,query:void 0,params:s,user:o};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(xo({body:e.input.body,query:e.input.query,params:e.input.params}));let i=q_(r,async s=>{let o=sr(s);try{let a=s.get("authResult"),c={body:bo(s),query:No(s),params:So(s),user:a?.user,tenantContext:s.get("tenantContext"),traceId:o},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},d=await e.handler(l),p=e.successStatus??200;return qe(s,d,{traceId:o,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:o,route:`${e.method} ${e.path}`,error:{message:c}})),qe(s,u(Li()),{traceId:o})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function nd(t,e){let r=new Vr;for(let n of e){let{method:i,path:s}=n.routeMeta,o=s==="/"?t:`${t}${s}`;switch(i){case"GET":r.get(o,n);break;case"POST":r.post(o,n);break;case"PUT":r.put(o,n);break;case"PATCH":r.patch(o,n);break;case"DELETE":r.delete(o,n);break}}return r}var Fh={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var kc,j_={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function G_(t){return!t&&!kc?j_:{lang:t?.lang??kc?.lang,message:t?.message,abortEarly:t?.abortEarly??kc?.abortEarly,abortPipeEarly:t?.abortPipeEarly??kc?.abortPipeEarly}}var $_;function W_(t){return $_?.get(t)}var z_;function J_(t){return z_?.get(t)}var Y_;function X_(t,e){return Y_?.get(t)?.get(e)}function ai(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function mt(t,e,r,n,i){let s=i&&"input"in i?i.input:r.value,o=i?.expected??t.expects??null,a=i?.received??ai(s),c={kind:t.kind,type:t.type,input:s,expected:o,received:a,message:`Invalid ${e}: ${o?`Expected ${o} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",d=i?.message??t.message??X_(t.reference,c.lang)??(l?J_(c.lang):null)??n.message??W_(c.lang);d!==void 0&&(c.message=typeof d=="function"?d(c):d),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}var Vh=new WeakMap;function Yt(t){let e=Vh.get(t);return e||(e={version:1,vendor:"valibot",validate(r){return t["~run"]({value:r},G_())}},Vh.set(t,e)),e}function Q_(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function qh(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}var Z_=/^[\w+-]+(?:\.[\w+-]+)*@[\da-z]+(?:[.-][\da-z]+)*\.[a-z]{2,}$/iu;function Cc(t,e){return{kind:"validation",type:"check",reference:Cc,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&mt(this,"input",r,n),r}}}function rn(t){return{kind:"validation",type:"email",reference:rn,expects:null,async:!1,requirement:Z_,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&mt(this,"email",e,r),e}}}function wn(t){return{kind:"validation",type:"integer",reference:wn,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&mt(this,"integer",e,r),e}}}function ht(t,e){return{kind:"validation",type:"max_length",reference:ht,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&mt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function as(t,e){return{kind:"validation",type:"max_value",reference:as,async:!1,expects:`<=${t instanceof Date?t.toJSON():ai(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&mt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():ai(r.value)}),r}}}function id(t,e){return{kind:"validation",type:"min_length",reference:id,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&mt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function cs(t,e){return{kind:"validation",type:"min_value",reference:cs,async:!1,expects:`>=${t instanceof Date?t.toJSON():ai(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&mt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():ai(r.value)}),r}}}function ls(t){return{kind:"transformation",type:"transform",reference:ls,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function eI(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function sd(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function Z(t,e){return{kind:"schema",type:"array",reference:Z,expects:"Array",async:!1,item:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let s=0;s<i.length;s++){let o=i[s],a=this.item["~run"]({value:o},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:s,value:o};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else mt(this,"type",r,n);return r}}}function _t(t){return{kind:"schema",type:"boolean",reference:_t,expects:"boolean",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:mt(this,"type",e,r),e}}}function us(t,e){return{kind:"schema",type:"literal",reference:us,expects:ai(t),async:!1,literal:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===this.literal?r.typed=!0:mt(this,"type",r,n),r}}}function ci(t,e){return{kind:"schema",type:"nullable",reference:ci,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=sd(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function $e(t){return{kind:"schema",type:"number",reference:$e,expects:"number",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:mt(this,"type",e,r),e}}}function H(t,e){return{kind:"schema",type:"object",reference:H,expects:"Object",async:!1,entries:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let s in this.entries){let o=this.entries[s];if(s in i||(o.type==="exact_optional"||o.type==="optional"||o.type==="nullish")&&o.default!==void 0){let a=s in i?i[s]:sd(o),c=o["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:s,value:a};for(let d of c.issues)d.path?d.path.unshift(l):d.path=[l],r.issues?.push(d);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[s]=c.value}else if(o.fallback!==void 0)r.value[s]=eI(o);else if(o.type!=="exact_optional"&&o.type!=="optional"&&o.type!=="nullish"&&(mt(this,"key",r,n,{input:void 0,expected:`"${s}"`,path:[{type:"object",origin:"key",input:i,key:s,value:i[s]}]}),n.abortEarly))break}}else mt(this,"type",r,n);return r}}}function I(t,e){return{kind:"schema",type:"optional",reference:I,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=sd(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function Xt(t,e){return{kind:"schema",type:"picklist",reference:Xt,expects:qh(t.map(ai),"|"),async:!1,options:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:mt(this,"type",r,n),r}}}function me(t,e,r){return{kind:"schema",type:"record",reference:me,expects:"Object",async:!1,key:t,value:e,message:r,get"~standard"(){return Yt(this)},"~run"(n,i){let s=n.value;if(s&&typeof s=="object"){n.typed=!0,n.value={};for(let o in s)if(Q_(s,o)){let a=s[o],c=this.key["~run"]({value:o},i);if(c.issues){let d={type:"object",origin:"key",input:s,key:o,value:a};for(let p of c.issues)p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let d={type:"object",origin:"value",input:s,key:o,value:a};for(let p of l.issues)p.path?p.path.unshift(d):p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else mt(this,"type",n,i);return n}}}function h(t){return{kind:"schema",type:"string",reference:h,expects:"string",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="string"?e.typed=!0:mt(this,"type",e,r),e}}}function Bh(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function wo(t,e){return{kind:"schema",type:"union",reference:wo,expects:qh(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i,s,o;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)s?s.push(c):s=[c];else{i=c;break}else o?o.push(c):o=[c]}if(i)return i;if(s){if(s.length===1)return s[0];mt(this,"type",r,n,{issues:Bh(s)}),r.typed=!0}else{if(o?.length===1)return o[0];mt(this,"type",r,n,{issues:Bh(o)})}return r}}}function ge(){return{kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,get"~standard"(){return Yt(this)},"~run"(t){return t.typed=!0,t}}}function we(...t){return{...t[0],pipe:t,get"~standard"(){return Yt(this)},"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}}}var Vt=(t=100)=>we(h(),ht(t)),Dc=we(h(),ht(320)),Rn=we(h(),ht(4096)),Ro=(t=256)=>we(h(),ht(t)),od=(t=8192)=>we(h(),ht(t)),Oo=we(ge(),ls(Number),$e(),wn(),cs(1),as(100));var Ut=H({message:I(h())}),jh=H({accessToken:h(),refreshToken:I(h()),expiresAt:$e()}),Gh=H({requiresChallenge:us(!0),challenge:H({type:I(h()),phase:I(h()),expiresAt:I(wo([h(),$e()])),data:me(h(),ge())})}),$h=H({requiresMfa:us(!0),mfa:H({phase:I(h()),challengeId:h(),methods:Z(h()),method:I(h()),expiresAt:wo([h(),$e()]),userId:h()})}),Wh=H({requiresVerification:us(!0),verification:H({channel:us("email"),challengeId:h(),expiresAt:h(),identityType:h(),identityValue:h(),userId:h()})}),li=wo([Gh,$h,Wh,jh]),ko=H({id:h(),contactEmail:I(h()),contactPhone:I(h()),username:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),metadata:I(me(h(),ge())),createdAt:h(),updatedAt:h()}),Co=H({challengeId:h(),expiresAt:h()});var ad=H({maskedRecipient:I(h()),expiresAt:h()}),cd=H({userId:h(),verification:I(H({channel:h(),challengeId:h(),expiresAt:h(),identityType:h(),identityValue:h()}))});var ld=H({userId:h(),identityType:h(),identityValue:h(),verifiedAt:h()});var zh=H({id:h(),tokenId:h(),tenantId:I(h()),deviceLabel:I(h()),country:I(h()),city:I(h()),createdAt:h(),expiresAt:h(),lastUsedAt:h(),revokedAt:I(ci(h())),metadata:I(me(h(),ge())),isCurrent:I(_t())}),ud=Z(zh);var dd=H({method:h(),data:me(h(),ge())}),pd=H({method:h(),verified:_t(),data:me(h(),ge())}),Jh=H({method:h(),verifiedAt:ci(h()),createdAt:h(),id:I(h()),label:I(h()),lastUsedAt:I(h())}),fd=H({authenticators:Z(Jh),total:$e()});var md=H({state:h()}),Yh=H({provider:h(),providerId:I(h()),email:I(h()),linkedAt:I(h())}),hd=Z(Yh);var Xh=H({id:h(),tenantId:h(),inviteeUserId:I(h()),inviteeEmail:I(h()),inviteePhone:I(h()),status:h(),roles:I(Z(h())),authPerms:Z(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h()),invitedBy:I(ge()),createdAt:h(),updatedAt:h(),expiresAt:h()}),Ed=Z(Xh),yd=H({inviteId:h(),inviteToken:h(),expiresAt:h()}),Qh=H({userId:h(),tenantId:h(),status:h(),roles:I(Z(h())),authPerms:Z(h()),isOwner:_t(),createdAt:h(),updatedAt:h()}),gd=H({members:Z(Qh)}),Pc=H({userId:h(),tenantId:h(),status:h(),roles:I(Z(h())),authPerms:Z(h()),isOwner:_t(),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),jobTitle:I(h()),contactEmail:I(h()),contactPhone:I(h()),bio:I(h()),locale:I(h()),metadata:I(me(h(),ge())),createdAt:I(h()),memberUpdatedAt:I(h()),profileUpdatedAt:I(h())}),vd=H({tenantId:h(),roles:I(Z(h())),authPerms:Z(h())});var rI={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:H({identityType:Vt(),identityValue:Dc,credentialType:Vt(),credentialValue:I(Rn),metadata:I(me(Vt(),ge())),country:I(Vt()),city:I(Vt())}),response:li},nI={method:"POST",path:"/auth/register",kind:"data",public:!0,body:H({identityType:Vt(),identityValue:Dc,credentialType:Vt(),credentialValue:Rn,displayName:I(Ro()),givenName:I(Ro()),familyName:I(Ro()),avatarUrl:I(od(2048)),locale:I(Vt()),metadata:I(me(Vt(),ge()))}),response:cd},iI={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:H({challengeId:h(),code:h()}),response:li},sI={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:H({challengeId:h(),method:h(),code:h()}),response:li},oI={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:H({challengeId:h(),method:h(),userId:h()}),response:ad},aI={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},cI={method:"POST",path:"/auth/logout",kind:"logout",public:!0},lI={method:"GET",path:"/auth/me",kind:"data",response:ko},uI={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:H({tenantId:h()})},Lt={authenticate:rI,register:nI,completeChallenge:iI,completeMfaChallenge:sI,issueMfaChallenge:oI,refresh:aI,logout:cI,me:lI,selectTenant:uI};var dI={method:"PATCH",path:"/password/change",kind:"data",body:H({currentPassword:Rn,newPassword:Rn}),response:Ut},pI={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:H({email:we(h(),ht(320),rn())}),response:Co},fI={method:"POST",path:"/password/reset",kind:"data",public:!0,body:H({challengeId:Vt(),code:Vt(),newPassword:Rn}),response:Ut},sn={changePassword:dI,forgotPassword:pI,resetPassword:fI};var mI={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:H({challengeId:h(),code:h()}),response:ld},hI={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:H({channel:Xt(["sms","email"]),identityValue:h(),previousChallengeId:I(h())}),response:Co},ui={verifyCode:mI,resendVerification:hI};var EI={method:"GET",path:"/sessions",kind:"data",query:H({includeRevoked:I(Xt(["true","false"])),limit:I(Oo),cursor:I(h())}),response:ud},yI={method:"DELETE",path:"/sessions",kind:"data",body:H({sessionId:h()}),response:Ut},gI={method:"POST",path:"/sessions/revoke",kind:"data",body:H({refreshToken:h()}),response:Ut},on={listSessions:EI,deleteSession:yI,revokeToken:gI};var vI={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:H({method:h(),data:I(me(h(),ge()))}),response:dd},AI={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:H({method:h(),data:I(me(h(),ge())),authenticatorId:I(h())}),response:pd},TI={method:"GET",path:"/mfa/authenticators",kind:"data",query:H({method:I(h()),verifiedOnly:I(_t())}),response:fd},_I={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:H({method:h(),authenticatorId:I(h()),password:I(h())}),response:H({message:I(h())})},II={method:"PATCH",path:"/mfa/settings",kind:"data",body:H({mfaRequired:I(_t()),mfaMethods:I(Z(h())),password:I(h())}),response:H({mfaRequired:I(_t()),mfaMethods:I(Z(h()))})},vr={setupAuthenticator:vI,verifyAuthenticator:AI,listAuthenticators:TI,removeAuthenticator:_I,updateMfaSettings:II};var xI={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:md},bI={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:H({provider:we(h(),ht(100)),code:I(we(h(),ht(8192))),credential:I(we(h(),ht(8192))),state:I(we(h(),ht(1024))),tenantId:I(we(h(),ht(100)))}),response:li},SI={method:"POST",path:"/oauth/link",kind:"data",body:H({provider:h(),code:I(h())}),response:Ut},NI={method:"POST",path:"/oauth/unlink",kind:"data",body:H({provider:h()}),response:Ut},wI={method:"GET",path:"/oauth/providers",kind:"data",response:hd},an={oauthState:xI,oauthCallback:bI,linkProvider:SI,unlinkProvider:NI,getProviders:wI};var RI={method:"PATCH",path:"/users/profile",kind:"data",body:H({email:I(we(h(),rn())),phone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),metadata:I(me(h(),ge()))}),response:ko},Do={updateProfile:RI};var OI={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:Pc},kI={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:H({contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),bio:I(h()),jobTitle:I(h()),metadata:I(me(h(),ge()))}),response:Pc},CI={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:H({inviteeEmail:I(we(h(),rn())),inviteeUserId:I(h()),inviteePhone:I(h()),role:I(h()),roles:I(Z(h())),authPerms:I(Z(h())),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h())}),response:yd},DI={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:H({status:I(h()),limit:I(Oo),cursor:I(h())}),response:Ed},PI={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:H({inviteId:I(h()),inviteToken:I(h())}),response:vd},UI={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:H({inviteId:I(h()),inviteToken:I(h())}),response:Ut},LI={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:H({inviteId:h()}),response:Ut},MI={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:H({limit:I(Oo),cursor:I(h())}),response:gd},KI={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:h(),role:I(h()),roles:I(Z(h())),authPerms:I(Z(h()))}),response:Ut},HI={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:h()}),response:Ut},Ad={getTenantProfile:OI,updateTenantProfile:kI,createInvite:CI,listInvites:DI,acceptInvite:PI,declineInvite:UI,revokeInvite:LI,listMembers:MI,updateMember:KI,removeMember:HI};var iF={...Lt,...sn,...ui,...on,...vr,...an,...Do,...Ad};var V={VALIDATION_ERROR:T("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:T("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:T("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:T("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:T("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:T("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:T("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:T("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:T("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:T("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:T("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:T("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:T("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:T("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:T("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function ds(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function On(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:s,device:o}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=o?.deviceLabel,d={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...o?.country&&{country:o.country},...o?.city&&{city:o.city},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}},p=await e.plugins.database.sessions.create(d);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u(V.DATABASE_ERROR());let m=p.data,E=ds(n,e.security),v=await e.plugins.token.signAccessToken({sub:r,sid:m.id,jti:m.tokenId,...E&&{aud:E},...n&&{tid:n},...i&&{tty:i},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}}),b=await e.plugins.token.signRefreshToken({sub:r,sid:m.id,jti:m.tokenId,...E&&{aud:E},...n&&{tid:n},...i&&{tty:i}});return g({accessToken:v.token,refreshToken:b.token,expiresAt:v.expiresAt,...n&&{tenantId:n}})}var Po={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};function Zh(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function Uo(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?u(Po.USER_NOT_FOUND()):g(Zh(r.data))}var Td={SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:V.DATABASE_ERROR};async function Uc(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return g();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(Td.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?g():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(Td.DATABASE_ERROR()):g():g()}var kn={INVALID_TOKEN:T("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:T("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR,ACCOUNT_SUSPENDED:V.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:V.ACCOUNT_DELETED};var cn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(cn||(cn={}));async function Lc(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return u(kn.INVALID_TOKEN());if(r.typ!==cn.Refresh)return u(kn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(V.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return u(kn.INVALID_TOKEN());let s=Date.now(),o=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&s-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!o&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(V.DATABASE_ERROR()):u(kn.INVALID_TOKEN());if(a&&!o){let v=ds(i.tenantId,e.security),b=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...v&&{aud:v},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),k=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...v&&{aud:v},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}});return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),g({accessToken:b.token,refreshToken:k.token,expiresAt:b.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:s,expiresAt:new Date(s+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return u(V.DATABASE_ERROR());let d=ds(i.tenantId,e.security);if(l.data===!1){let v=await e.plugins.database.sessions.get(i.id);if(v.ok===!1)return u(V.DATABASE_ERROR());let b=v.data;if(!b||b.revokedAt)return u(kn.INVALID_TOKEN());let k=await e.plugins.token.signAccessToken({sub:b.userId,sid:b.id,jti:b.tokenId,...d&&{aud:d},...b.tenantId&&{tid:b.tenantId},...b.tenantType&&{tty:b.tenantType},...b.perms!==void 0&&{perms:b.perms},...b.roles&&{roles:b.roles}}),C=await e.plugins.token.signRefreshToken({sub:b.userId,sid:b.id,jti:b.tokenId,...d&&{aud:d},...b.tenantId&&{tid:b.tenantId},...b.tenantType&&{tty:b.tenantType}});return g({accessToken:k.token,refreshToken:C.token,expiresAt:k.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),m=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}}),E={accessToken:p.token,refreshToken:m.token,expiresAt:p.expiresAt};return g(E)}var Rt={IDENTITY_PLUGIN_NOT_FOUND:X("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:X("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:T("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:X("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:X("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:X("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:T("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:X("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR,ACCOUNT_DELETED:V.ACCOUNT_DELETED};var Fe={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},Ar={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},Ie={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var or={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function _d(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function Mc(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let o=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(o)}async function eE(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:s,codeHash:o,challengeId:a,expiresAt:c,...l}=t.nextStepData,d={id:r,userId:t.userId,purpose:Ie.LOGIN,status:Fe.PENDING,phase:Ar.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(d.tenantId=t.tenantId),t.deviceLabel!==void 0&&(d.deviceLabel=t.deviceLabel),t.country!==void 0&&(d.country=t.country),t.city!==void 0&&(d.city=t.city),i!==void 0&&(d.codeHash=i),(await e.plugins.database.challenges.create(d)).ok===!1?u([V.DATABASE_ERROR()]):g({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:d.phase})}async function Kc(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,s=t.userHasMethods.length===1&&t.deliveryMethods.length===0,o=i?t.deliveryMethods[0]:s?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:Ie.LOGIN,status:Fe.PENDING,phase:o?Ar.VERIFY_MFA:Ar.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),o!==void 0&&(a.method=o),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return u(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...o!==void 0&&{selectedMethod:o}};return g(l)}var lt={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var Id={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},Hc={ACCOUNT_DELETED:V.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:T(Id.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:T(Id.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T(Id.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function Br(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return u(Hc.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return u(Hc.ACCOUNT_SUSPENDED());let s,o,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return u(Hc.NO_ACCESS_TO_TENANT());let d=l.data;if(d.status!==lt.ACTIVE)return u(Hc.SUSPENDED_IN_TENANT());if(o=d.roles,s=d.isOwner?{"*":-1}:d.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return s!==void 0&&(c.perms=s),o!==void 0&&(c.roles=o),a!==void 0&&(c.tenantType=a),g(c)}var Ze={SMS:"sms",EMAIL:"email"},di={PHONE:"phone",EMAIL:"email"},pi={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Cn={type:Ze.EMAIL,purpose:Ie.EMAIL_VERIFICATION,identityType:di.EMAIL,template:pi.EMAIL_CODE};var Dn={type:Ze.SMS,purpose:Ie.PHONE_VERIFICATION,identityType:di.PHONE,template:pi.SMS_CODE};var Re={CHANNEL_NOT_CONFIGURED:T("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:T("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:T("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:T("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:T("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:T("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:T("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function _e(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function ln(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function qr(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return FI(n)}async function ps(t,e){let r=await qr(t);return r.length!==e.length?!1:VI(r,e)}function FI(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function VI(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function BI(t){switch(t){case Ze.SMS:return Dn;case Ze.EMAIL:return Cn}}async function fs(t,e){let r=BI(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return u(Re.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return u(Re.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,s=await e.plugins.database.identities.get(r.identityType,i);if(!s.ok||!s.data)return u(Re.IDENTITY_NOT_FOUND());let o=s.data;if(o.verifiedAt)return u(Re.IDENTITY_ALREADY_VERIFIED());let a=o.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,d=t.previousChallengeId===void 0&&l===c;if(!l)return u(Re.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return u(p.errors,p.meta);let m=p.data;if(m&&(m.status!==Fe.PENDING||m.userId!==o.userId||m.purpose!==r.purpose||m.method!==r.type||m.identityType!==r.identityType||m.identityValue!==i))return u(Re.CHALLENGE_NOT_FOUND());if(!m&&!d)return u(Re.CHALLENGE_NOT_FOUND());let E=e.security.verificationResendCooldownSeconds*1e3,v=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(m?.createdAt.getTime()??0)+E;if(E>0&&Date.now()<v)return u(Re.RESEND_COOLDOWN_ACTIVE());let b=ln(6),k=await qr(b),C=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),L=e.plugins.database.challenges.generateChallengeId(),B=await e.plugins.database.challenges.create({id:L,userId:o.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:k,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:C});if(B.ok===!1)return u(B.errors,B.meta);let G=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,j=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:L,purpose:r.purpose,channel:r.type,expiresAt:C,resendAvailableAt:G}});return j.ok===!1?(await e.plugins.database.challenges.remove(L),u(j.errors,j.meta)):(await qI(t.channel,i,b,r.template,L,C,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(L),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),u(Re.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),_e(e,{event:`verification_code_resent_${t.channel}`,userId:o.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:L,previousChallengeId:l}})]),g({challengeId:L,expiresAt:C}))}async function qI(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Re.CHANNEL_NOT_CONFIGURED())}function jI(t){switch(t){case Ze.SMS:return Dn;case Ze.EMAIL:return Cn}}async function ms(t,e){let r=jI(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return u(Re.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return u(Re.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return u(Re.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return u(Re.IDENTITY_ALREADY_VERIFIED());let s=i.guards.email_verification;if(s?.lockedUntil&&new Date(s.lockedUntil)>new Date)return u(Re.VERIFICATION_COOLDOWN_ACTIVE());let o=i.pendingVerification,a=o&&o.purpose===r.purpose&&o.channel===r.type&&o.expiresAt>new Date?o.challengeId:null;if(o?.resendAvailableAt&&o.purpose===r.purpose&&o.channel===r.type&&o.resendAvailableAt>new Date)return u(Re.VERIFICATION_COOLDOWN_ACTIVE());let c=ln(6),l=await qr(c),d=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),m=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:d});if(m.ok===!1)return u(m.errors,m.meta);let E=Math.max(0,e.security.verificationResendCooldownSeconds),v=E>0?new Date(Date.now()+E*1e3):null,b=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:d,resendAvailableAt:v}});return b.ok===!1?(await e.plugins.database.challenges.remove(p),u(b.errors,b.meta)):(await GI(t.channel,t.identityValue,c,r.template,p,d,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:o??null}),u(Re.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),_e(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),g({challengeId:p,expiresAt:d}))}async function GI(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Re.CHANNEL_NOT_CONFIGURED())}var $I=[Ie.PHONE_VERIFICATION,Ie.EMAIL_VERIFICATION];async function hs(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(Re.CHALLENGE_NOT_FOUND());let n=r.data;if(!$I.includes(n.purpose))return u(Re.CHALLENGE_NOT_FOUND());if(n.status!==Fe.PENDING)return u(Re.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return u(Re.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?u(Re.TOO_MANY_ATTEMPTS()):u(i.errors,i.meta);if(!n.codeHash)return u(Re.INVALID_CODE());if(!await ps(t.code,n.codeHash))return u(Re.INVALID_CODE());let o=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:o,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await _e(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),g({userId:n.userId,identityType:a,identityValue:c,verifiedAt:o})}function Lo(t,e){return e[t]??null}function tE(t,e){return e[t]??null}async function rE(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function nE(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,s=r.security.maxFailedAttempts||5,o=i>=s,a=null;if(o){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>s){let d=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*d**(i-s),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function iE(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Mo(t,e){let r=t.tid,n=Lo(t.identityType,e.plugins.identity);if(!n)return u(Rt.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return u(Rt.INVALID_IDENTITY_FORMAT());let s=n.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,s);if(o.ok===!1||!o.data)return u(Rt.INVALID_CREDENTIALS());let a=o.data;if(!a.loginEnabled)return u(Rt.LOGIN_DISABLED());let c=_d(a,t.credentialType);if(c.locked)return u(Rt.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=tE(t.credentialType,e.plugins.credential);if(!l)return u(Rt.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let d=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=d.ok?d.data:null,m=await l.verify({userId:a.userId,identityValue:s,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(m.ok===!1)return await nE(a,t.credentialType,e),u(Rt.INVALID_CREDENTIALS());let{userId:E,nextStep:v,intents:b}=m.data;b&&b.length>0&&await rE(b,e);let k;if(t.userAgent&&e.plugins.deviceParser){let w=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),R=w.browser||"Unknown Browser",N=w.os||"Unknown OS";k=`${R} - ${N}`}if(v){let w={userId:E,credentialType:t.credentialType,identityType:t.identityType,identityValue:s,nextStepData:v.data,nextStepType:v.type};t.tid!==void 0&&(w.tenantId=t.tid),k!==void 0&&(w.deviceLabel=k),t.country!==void 0&&(w.country=t.country),t.city!==void 0&&(w.city=t.city);let R=await eE(w,e);if(R.ok===!1)return u(R.errors,R.meta);if(!R.ok)return u(Rt.INTERNAL_ERROR());let{challengeId:N,expiresAt:O,displayData:P,challengeType:U,phase:K}=R.data;return g({requiresChallenge:!0,challenge:{type:U,phase:K,expiresAt:O,data:{challengeId:N,expiresAt:O,...P}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return u(Rt.IDENTITY_NOT_VERIFIED());let w=a.pendingVerification;if(!!w&&w.purpose===Ie.EMAIL_VERIFICATION&&w.channel==="email"&&w.expiresAt>new Date&&w)return g({requiresVerification:!0,verification:{channel:"email",challengeId:w.challengeId,expiresAt:w.expiresAt,identityType:t.identityType,identityValue:s,userId:E}});let N=await ms({channel:"email",identityValue:s,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!N.ok){let O=await e.plugins.database.identities.get(t.identityType,s),P=O.ok&&O.data?O.data.pendingVerification:null;return P&&P.purpose===Ie.EMAIL_VERIFICATION&&P.channel==="email"&&P.expiresAt>new Date?g({requiresVerification:!0,verification:{channel:"email",challengeId:P.challengeId,expiresAt:P.expiresAt,identityType:t.identityType,identityValue:s,userId:E}}):u(Rt.IDENTITY_NOT_VERIFIED())}return g({requiresVerification:!0,verification:{channel:"email",challengeId:N.data.challengeId,expiresAt:N.data.expiresAt,identityType:t.identityType,identityValue:s,userId:E}})}let C=await e.plugins.database.userAuths.get(E);if(C.ok===!1||!C.data)return u(Rt.USER_AUTH_NOT_FOUND());let L=C.data,B={userStatus:L.userStatus,userId:E,...r&&{tenantId:r}},G=await Br(B,e);if(G.ok===!1)return u(G.errors,G.meta);if(!G.ok)return u(V.DATABASE_ERROR());let{perms:j,roles:$,tenantType:te}=G.data;if(L.mfaRequired){let w=L.mfaMethods;if(!(!w||w.length===0)){let R=w.filter(N=>e.plugins.mfa?.[N]);if(R.length!==0){let N=R.filter(fe=>e.plugins.mfa?.[fe]?.requiresServerDelivery),O=R.filter(fe=>!e.plugins.mfa?.[fe]?.requiresServerDelivery),P={};k!==void 0&&(P.deviceLabel=k),t.country!==void 0&&(P.country=t.country),t.city!==void 0&&(P.city=t.city);let U={userId:E,availableMethods:R,deliveryMethods:N,userHasMethods:O,device:P};t.tid!==void 0&&(U.tenantId=t.tid);let K=await Kc(U,e);if(K.ok===!1)return u(K.errors,K.meta);if(!K.ok)return u(Rt.INTERNAL_ERROR());let{challengeId:W,expiresAt:J,phase:de,selectedMethod:ke,availableMethods:He}=K.data;return g({requiresMfa:!0,mfa:{phase:de,challengeId:W,methods:He,...ke&&{method:ke},expiresAt:J,userId:E}})}}}let A={userId:E,...r&&{tenantId:r},...te&&{tenantType:te},...j!==void 0||$?{permissions:{...$&&{roles:$},...j!==void 0&&{perms:j}}}:{},...k||t.country||t.city?{device:{...k&&{deviceLabel:k},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},x=await On(A,e);if(x.ok===!1)return u(x.errors,x.meta);if(!x.ok)return u(V.DATABASE_ERROR());let{accessToken:S,refreshToken:y,expiresAt:_}=x.data;return await Mc(E,e),await iE(a,t.credentialType,e),g({accessToken:S,refreshToken:y,expiresAt:_})}var It={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:T("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};var WI={CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function cE(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:s,device:o}=t;if(!r)return g({requiresMfa:!1});if(!n||n.length===0)return g({requiresMfa:!1});let a=n.filter(C=>e.plugins.mfa?.[C]);if(a.length===0)return g({requiresMfa:!1});let c=a.filter(C=>e.plugins.mfa?.[C]?.requiresServerDelivery),l=a.filter(C=>!e.plugins.mfa?.[C]?.requiresServerDelivery),d={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};s!==void 0&&(d.tenantId=s),o!==void 0&&(d.device=o);let p=await Kc(d,e);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u([WI.CHALLENGE_CREATE_FAILED()]);let{challengeId:m,expiresAt:E,phase:v,selectedMethod:b,availableMethods:k}=p.data;return g({requiresMfa:!0,mfa:{phase:v,challengeId:m,methods:k,...b&&{method:b},expiresAt:E,userId:i}})}async function Ko(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return u(It.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Fe.PENDING)return u(It.INVALID_CHALLENGE_STATE());if(n.phase!==Ar.VERIFY_CREDENTIAL)return u(It.INVALID_CHALLENGE_STATE());if(n.purpose!==Ie.LOGIN)return u(It.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(It.CHALLENGE_EXPIRED());let s=n.method;if(!s)return u(It.INTERNAL_ERROR());let o=e.plugins.credential[s];if(!o)return u(It.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(_=>_.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Fe.EXPIRED}),u(It.MAX_ATTEMPTS_EXCEEDED())):u(a.errors,a.meta);if((await o.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return u(It.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return u(It.USER_AUTH_NOT_FOUND());let d=l.data,p={userStatus:d.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let m=await Br(p,e);if(m.ok===!1)return u(m.errors,m.meta);if(!m.ok)return u(It.INTERNAL_ERROR());let{perms:E,roles:v,tenantType:b}=m.data,k=n.deviceLabel,C=n.country,L=n.city,B={};k!==void 0&&(B.deviceLabel=k),C!==void 0&&(B.country=C),L!==void 0&&(B.city=L);let G={mfaRequired:d.mfaRequired,...d.mfaMethods&&{mfaMethods:d.mfaMethods},userId:n.userId,device:B},j=await cE(G,e);if(j.ok===!1)return u(j.errors,j.meta);if(!j.ok)return u(It.INTERNAL_ERROR());if(j.data.requiresMfa){let _={requiresMfa:!0,mfa:j.data.mfa};return g(_)}let $={};E!==void 0&&($.perms=E),v!==void 0&&($.roles=v);let te={userId:n.userId,permissions:$,device:B};i!==void 0&&(te.tenantId=i),b!==void 0&&(te.tenantType=b);let A=await On(te,e);if(A.ok===!1)return u(A.errors,A.meta);if(!A.ok)return u(It.INTERNAL_ERROR());let{accessToken:x,refreshToken:S,expiresAt:y}=A.data;return g({accessToken:x,refreshToken:S,expiresAt:y})}var ot={MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function Ho(t,e){if(!e.plugins.mfa)return u(ot.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(ot.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,s=n.deviceLabel,o=n.country,a=n.city;if(n.status!==Fe.PENDING)return u(ot.INVALID_CHALLENGE_STATE());if(n.phase!==Ar.VERIFY_MFA)return u(ot.INVALID_CHALLENGE_STATE());if(n.purpose!==Ie.LOGIN)return u(ot.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(ot.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return u(ot.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return u(ot.MFA_METHOD_NOT_SUPPORTED());let d=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(d.ok===!1)return d.errors.some(te=>te.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(ot.TOO_MANY_ATTEMPTS())):u(d.errors,d.meta);if(l.requiresServerDelivery){if(!n.codeHash)return u(ot.INVALID_CHALLENGE_STATE());if(!await ps(t.code,n.codeHash))return u(ot.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return u(ot.MFA_METHOD_NOT_SUPPORTED());let te=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if(te.ok===!1||!te.data)return u(ot.INVALID_MFA_CODE());let A=te.data;if(!A.verifiedAt)return u(ot.INVALID_MFA_CODE());let x=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(x.ok===!1||!x.data.verified)return u(ot.INVALID_MFA_CODE());let S=x.data.data?.usedBackupCodeHash;if(S){let _=(A.data.backupCodeHashes??[]).filter(w=>w!==S);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:_}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return u(ot.USER_AUTH_NOT_FOUND());let E={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},v=await Br(E,e);if(v.ok===!1)return u(v.errors,v.meta);if(!v.ok)return u(V.DATABASE_ERROR());let{perms:b,roles:k,tenantType:C}=v.data,L={userId:n.userId,...i&&{tenantId:i},...C&&{tenantType:C},...b!==void 0||k?{permissions:{...k&&{roles:k},...b!==void 0&&{perms:b}}}:{},...s||o||a?{device:{...s&&{deviceLabel:s},...o&&{country:o},...a&&{city:a}}}:{}},B=await On(L,e);if(B.ok===!1)return u(B.errors,B.meta);if(!B.ok)return u(V.DATABASE_ERROR());let{accessToken:G,refreshToken:j,expiresAt:$}=B.data;return g({accessToken:G,refreshToken:j,expiresAt:$})}var xt={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:X("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:X("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:X("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:X("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:T("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:T("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:T("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function Fo(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(xt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Fe.PENDING)return u(xt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return u(xt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return u(xt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return u(xt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return u(xt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return u(xt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let s=await e.plugins.database.userAuths.get(t.userId);if(!s.ok)return u(xt.CHALLENGE_ISSUE_FAILED());let o=s.data;if(!o)return u(xt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(m=>m.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(xt.TOO_MANY_ISSUES())):u(a.errors,a.meta);if(!i.sendCode)return u(xt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:o},e);if(!c.ok)return u(xt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,d=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:Ar.VERIFY_MFA,codeHash:l})).ok===!1?u(xt.CHALLENGE_UPDATE_FAILED()):g({maskedRecipient:d,expiresAt:n.expiresAt})}var je={IDENTITY_PLUGIN_NOT_FOUND:X("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:X("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:X("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:X("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:T("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:T("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:T("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:T("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:T("INTERNAL_ERROR","Internal error occurred during registration")};function zI(t,e){return e[t]}function JI(t,e){return e[t]}async function Vo(t,e){let r=zI(t.identityType,e.plugins.identity);if(!r)return u(je.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return u(je.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,i);if(s.ok===!1)return u(je.DATABASE_ERROR());if(s.data)return u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let o=JI(t.credentialType,e.plugins.credential);if(!o)return u(je.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await o.create({value:t.credentialValue});if(a.ok===!1)return u(je.INVALID_CREDENTIAL());if(!a.ok)return u(je.INTERNAL_ERROR());let{value:c,data:l}=a.data,d=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let m={id:d,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===or.EMAIL&&{contactEmail:t.identityValue},...t.identityType===or.PHONE&&{contactPhone:t.identityValue},...t.identityType===or.USERNAME&&{username:t.identityValue}},E={userId:d,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},v={type:t.identityType,value:i,userId:d,loginEnabled:!0,verifiedAt:null,guards:{}},b={userId:d,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===or.EMAIL&&e.plugins.database.registration){let j=await YI({profileData:{...m,id:d},userAuthData:E,identityData:v,credentialRepoData:b,identityValue:i},e);return j.ok===!1?j.errors.some($=>$.code==="UNIQUE_CONSTRAINT_VIOLATION")?u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):u(j.errors,j.meta):j.ok?g({userId:d,verification:{channel:"email",challengeId:j.data.challengeId,expiresAt:j.data.expiresAt,identityType:t.identityType,identityValue:i}}):u(je.INTERNAL_ERROR())}let k=await e.plugins.database.users.create(m);if(k.ok===!1||!k.data)return u(je.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(E)).ok===!1)return await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(v)).ok===!1)return await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let B=await e.plugins.database.credentials.create(b);if(B.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let G;if(t.identityType===or.EMAIL){let j=await ZI({userId:d,identityType:t.identityType,identityValue:i},e);if(j.ok===!1)return await e.plugins.database.credentials.remove(B.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(j.errors,j.meta);if(!j.ok)return await e.plugins.database.credentials.remove(B.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.INTERNAL_ERROR());G={channel:"email",challengeId:j.data.challengeId,expiresAt:j.data.expiresAt,identityType:t.identityType,identityValue:i}}return g({userId:d,...G&&{verification:G}})}async function YI(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await XI(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?u(je.USER_CREATION_FAILED()):((await QI({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),g({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function XI(t,e,r){let n=ln(6),i=await qr(n),s=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),o=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:o,userId:t,purpose:Ie.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:or.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:s},pendingVerification:{challengeId:o,purpose:Ie.EMAIL_VERIFICATION,channel:"email",expiresAt:s,resendAvailableAt:a}}}async function QI(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:Ie.EMAIL_VERIFICATION}})).ok===!1?u(je.VERIFICATION_EMAIL_SEND_FAILED()):g(void 0):u(je.EMAIL_SYSTEM_NOT_AVAILABLE())}async function ZI(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=ln(6),n=await qr(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),s=e.plugins.database.challenges.generateChallengeId(),o=await e.plugins.database.challenges.create({id:s,userId:t.userId,purpose:Ie.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(o.ok===!1)return u(o.errors,o.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:s,purpose:Ie.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(s),u(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:s,expiresAt:i.toISOString(),purpose:Ie.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(s),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),u(je.VERIFICATION_EMAIL_SEND_FAILED())):g({challengeId:s,expiresAt:i})}var Pn={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function Bo(t,e){let{sessionId:r,userId:n,tenantId:i}=t,s=await e.plugins.database.sessions.get(r);if(s.ok===!1)return u(s.errors,s.meta);if(!s.data)return u(Pn.SESSION_NOT_FOUND());let o=s.data;if(o.revokedAt)return u(Pn.SESSION_REVOKED());if(o.userId!==n)return u(Pn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return u(a.errors,a.meta);if(!a.data)return u(Pn.USER_NOT_FOUND());let c=a.data,l=await Br({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return u(l.errors,l.meta);if(!l.ok)return u(V.DATABASE_ERROR());let{perms:d,roles:p,tenantType:m}=l.data,E=e.plugins.database.sessions.generateTokenId(),v=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:E,...d!==void 0&&{perms:d},...p&&{roles:p},...m&&{tenantType:m}});if(v.ok===!1)return u(v.errors,v.meta);let b=ds(i,e.security),k=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:E,...b&&{aud:b},tid:i,...m&&{tty:m},...d!==void 0&&{perms:d},...p&&{roles:p}}),C=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:E,...b&&{aud:b},tid:i,...m&&{tty:m}});return g({accessToken:k.token,refreshToken:C.token,expiresAt:k.expiresAt,tenantId:i})}var uE=/^[\w!#$%&'*.^`|~+-]+$/,ex=/^[ !#-:<-[\]-~]*$/,lE=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},xd=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let s=i.indexOf("=");if(s===-1)continue;let o=lE(i.substring(0,s));if(e&&e!==o||!uE.test(o)||o in n)continue;let a=lE(i.substring(s+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),ex.test(a)&&(n[o]=a.indexOf("%")!==-1?ss(a,yo):a,e))break}return n};var tx=(t,e,r={})=>{if(!uE.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},Fc=(t,e,r)=>(e=encodeURIComponent(e),tx(t,e,r));var bd=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let s=e;return r==="secure"?s="__Secure-"+e:r==="host"&&(s="__Host-"+e),xd(n,s)[s]}return n?xd(n):{}};var rx=(t,e,r)=>{let n;return r?.prefix==="secure"?n=Fc("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=Fc("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=Fc(t,e,{path:"/",...r}),n},qo=(t,e,r,n)=>{let i=rx(e,r,n);t.header("Set-Cookie",i,{append:!0})};var jo=(t,e,r)=>{let n=bd(t,e,r?.prefix);return qo(t,e,"",{...r,maxAge:0}),n};function Sd(t,e){let r=t.tokenStrategy;return typeof r=="string"?r:r[e??"customer"]??"body"}function Vc(t){return t==="cookie"||t==="both"}function nx(t){let e=t.tokenStrategy;return typeof e=="string"?Vc(e):Object.values(e).some(r=>r!==void 0&&Vc(r))}function Nd(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function ix(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function dE(t,e,r,n,i){let s=r.refreshTokenCookie??{},o=i??ix(r,n),a=Sd(r,o),c=e.refreshToken;if(typeof c!="string"||!c)return e;if(a==="cookie"||a==="both"){let l=Nd(r,o);sx(t,c,{...s,name:l})}if(a==="cookie"){let{refreshToken:l,...d}=e;return d}return e}function pE(t,e,r){if(!(r?Vc(Sd(e,r)):nx(e)))return;let i=e.refreshTokenCookie??{},s={path:i.path??"/",...i.domain?{domain:i.domain}:{}},o=e.audienceCookieNames?.cookieNames;if(o&&!r){let c=i.name??"refresh_token",l=new Set([o.customer??c,o.tenant??c,o.system??c]);for(let d of l)jo(t,d,s);return}let a=Nd(e,r);jo(t,a,s)}function Bc(t,e,r){let n=Sd(e,r);if(!Vc(n)||!t)return;let i=Nd(e,r);return ox(t,i)}function sx(t,e,r){qo(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function ox(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var fE=new Set(["customer","tenant","system"]);function Ue(t,e){let r=[];if(e.auth!==!1&&r.push(_o({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(xo(a))}let n=async a=>{let c=sr(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let d=a.get("authResult"),p={body:bo(a),query:No(a),params:So(a),user:d?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},m=await e.handler(p),E=e.successStatus;if(m.ok&&m.data!==void 0&&e.tokenMode==="auth"){let v=m.data,b=typeof v.tenantId=="string"?v.tenantId:void 0,k=p.authContextHeader,C=b!==void 0?void 0:typeof k=="string"&&fE.has(k)?k:void 0,L=dE(a,v,t,b,C),B={...m,data:L};return qe(a,B,{traceId:c,...E!==void 0?{successStatus:E}:{}})}if(m.ok&&e.tokenMode==="logout"){let v=p.authContextHeader,b=typeof v=="string"&&fE.has(v)?v:void 0;pE(a,t,b)}return qe(a,m,{traceId:c,...E!==void 0?{successStatus:E}:{}})}catch(l){let d=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:d}})),qe(a,u(oe.InternalError()),{traceId:c})}},i=[...r,n],o=async(a,c)=>{let l,d=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let m=i[p],E=await m(a,async()=>{await d(p+1)});E instanceof Response&&(l=E)};return await d(0),l};return o.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},o}function jr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function mE(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function hE(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function EE(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function yE(t){return{plugins:{database:t.plugins.database}}}var dj=we(h(),ht(320)),pj=we(h(),ht(4096));function gE(t){return Ue(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Lt.authenticate.body},handler:async e=>{let r=jr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Mo(n,r)}})}function vE(t){return Ue(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Lt.completeChallenge.body},handler:async e=>{let r=jr(t.auth);return Ko({challengeId:e.body.challengeId,code:e.body.code},r)}})}function AE(t){return Ue(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Lt.completeMfaChallenge.body},handler:async e=>{let r=jr(t.auth);return Ho({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function TE(t){return Ue(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Lt.issueMfaChallenge.body},handler:async e=>{let r=jr(t.auth);return Fo({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function qc(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var ax=new Set(["customer","tenant","system"]);function _E(t){return Ue(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&ax.has(r)?r:void 0,i=Bc(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!qc(e.originHeader,t.trustedOrigins))return u(oe.NotAuthenticated());let a=o??i;if(!a)return u(oe.ValidationError());let c=hE(t.auth);return Uc({refreshToken:a},c)}})}function cx(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function Un(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=cx(e);return typeof r?.sid=="string"?r.sid:void 0}function IE(t){return Ue(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=Un(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return u(oe.NotAuthenticated())}let n=yE(t.auth);return Uo({userId:e.user.id},n)}})}var lx=new Set(["customer","tenant","system"]);function xE(t){return Ue(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&lx.has(r)?r:void 0,i=Bc(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!qc(e.originHeader,t.trustedOrigins))return u(oe.NotAuthenticated());let a=o??i;if(!a)return u(oe.ValidationError());let c=EE(t.auth);return Lc({refreshToken:a},c)}})}function bE(t){return Ue(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Lt.register.body},handler:async e=>{let r=mE(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),Vo(n,r)}})}function SE(t){return Ue(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Lt.selectTenant.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=Un(e.authorizationHeader);if(!r)return u(oe.NotAuthenticated());let n=jr(t.auth);return Bo({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var Go={USER_AUTH_NOT_FOUND:X("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:X("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:X("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function jc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Go.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return u(Go.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return u(i.errors,i.meta);let s=i.data??[];t.verifiedOnly&&(s=s.filter(a=>a.verifiedAt!==null));let o=s.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return g({authenticators:o,total:o.length})}var un={USER_AUTH_NOT_FOUND:X("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:X("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:X("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:X("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:X("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:X("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:X("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:X("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var dn={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function Gc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(un.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(un.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(un.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok||!i.data)return u(un.AUTHENTICATOR_NOT_FOUND());let s=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(s.ok===!1)return u(s.errors,s.meta);let o=s.data??[],a=o.filter(b=>b.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return u(un.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let b=await e.plugins.database.credentials.getByUserIdAndType(t.userId,dn.PASSWORD);if(b.ok===!1)return u(b.errors,b.meta);let k=b.data;if(k&&k.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:k.value,data:k.data??{}},credentialValue:t.password})).ok===!1)return u(un.INVALID_PASSWORD())}let d=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(d.ok===!1)return u(d.errors,d.meta);let m=o.filter(b=>b.method===t.method&&(b.id!==t.authenticatorId||b.method!==t.method)).length,E=a.length>1||a.length===1&&!l;await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:E,remainingCount:m}});let v={method:t.method,mfaStillEnabled:E,remainingCount:m};return t.authenticatorId!==void 0&&(v.authenticatorId=t.authenticatorId),g(v)}var pn={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:X("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function $c(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(pn.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(pn.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(pn.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return u(pn.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return u(pn.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let s=await i.setup({userId:t.userId,data:t.data||{}},e);if(s.ok===!1)return u(s.errors,s.meta);if(!s.ok)return u(pn.INTERNAL_ERROR());let o=s.data;if(o.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:o.credentialData});if(l.ok===!1)return u(l.errors,l.meta)}await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=o;return g({method:t.method,data:c})}var Et={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:T("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:T("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:T("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:T("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:X("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:X("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:T("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:V.INTERNAL_ERROR};var NE=["totp","webauthn","passkey","hardware"],wE=["email","sms","phone"],ux=new Set([...NE,...wE]);async function Wc(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return u(Et.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!ux.has(i))return u(Et.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return u(Et.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return u(Et.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Et.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(Et.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(Et.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return u(Et.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return u(Et.MFA_NOT_ENABLED());if(!t.password)return u(Et.PASSWORD_REQUIRED());let i=await dx(t.userId,t.password,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await px(t.userId,t.mfaMethods,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return u(i.errors,i.meta)}return await _e({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),g()}async function dx(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,dn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Et.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(Et.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return u(Et.PASSWORD_PLUGIN_NOT_CONFIGURED());let s=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return s.ok===!1?u(s.errors,s.meta):g()}async function px(t,e,r){let n=e.filter(s=>NE.includes(s)),i=e.filter(s=>wE.includes(s));if(n.length>0){let s=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!o.has(a))return u(Et.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let s=await r.plugins.database.identities.getByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!o.has(a))return u(Et.METHOD_NOT_VERIFIED({method:a}))}return g()}var Tr={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:X("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:T("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:T("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function zc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Tr.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(Tr.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(Tr.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok)return u(Tr.INTERNAL_ERROR());let s=i.data;if(!s)return u(Tr.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return u(Tr.MFA_NOT_AVAILABLE());let o=e.plugins.mfa[t.method];if(!o?.verifyWithCredentials)return u(Tr.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await o.verifyWithCredentials({credentialData:s.data,data:t.data||{}});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Tr.INTERNAL_ERROR());let c=a.data;if(!c.verified)return g({method:t.method,verified:!1,data:c.data||{}});if(!s.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return u(l.errors,l.meta);let d=n.mfaMethods||[];if(!d.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...d,t.method]);if(p.ok===!1)return u(p.errors,p.meta)}}return await _e(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),g({method:t.method,verified:!0,data:c.data||{}})}function $o(t){return{system:{systemId:t.system.system.systemId}}}function RE(t){let e={plugins:{database:t.plugins.database},system:$o(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function OE(t){let e={plugins:{database:t.plugins.database},system:$o(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function kE(t){return{plugins:{database:t.plugins.database},system:$o(t)}}function CE(t){let e={plugins:{database:t.plugins.database},system:$o(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function DE(t){let e={plugins:{database:t.plugins.database},system:$o(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function PE(t){return Y(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=kE(t.auth);return jc({userId:e.user.id},r)}})}function UE(t){return Y(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:vr.removeAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=CE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),Gc(n,r)}})}function LE(t){return Y(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:vr.setupAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=RE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),$c(n,r)}})}function ME(t){return Y(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:vr.updateMfaSettings.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=DE(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),Wc(n,r)}})}function KE(t){return Y(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:vr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=OE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),zc(n,r)}})}var Jc={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function Yc(t,e){if(!await e.plugins.database.users.getById(t.userId))return u(Jc.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(!i)return g([]);let s=i.map(o=>{let a={provider:o.provider,externalId:o.externalId,linkedAt:o.createdAt};return o.externalEmail&&(a.externalEmail=o.externalEmail),o.externalName&&(a.externalName=o.externalName),a});return g(s)}var bt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:T("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:T("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:T("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function fx(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return u(V.DATABASE_ERROR());let d=l.data;if(d.userStatus===ye.DELETED)return u(V.ACCOUNT_DELETED());if(d.userStatus===ye.SUSPENDED)return u(V.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let m=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(m.ok===!1)return u(m.errors,m.meta)}return g(c)}let s=null;if(t.email){let c=Lo(or.EMAIL,e.plugins.identity);if(!c)return u(V.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),d=await e.plugins.database.identities.get(or.EMAIL,l);if(d.ok===!1)return u(V.DATABASE_ERROR());if(d.data){if(t.emailVerified!==!0)return u(bt.EMAIL_NOT_VERIFIED_BY_PROVIDER());s=d.data.userId;let p=await e.plugins.database.userAuths.get(s);if(!p.ok||!p.data)return u(V.DATABASE_ERROR());let m=p.data;if(m.userStatus===ye.DELETED)return u(V.ACCOUNT_DELETED());if(m.userStatus===ye.SUSPENDED)return u(V.ACCOUNT_SUSPENDED())}}if(!s){if(!t.email)return u(bt.EMAIL_REQUIRED());s=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let k=t.name.trim().split(/\s+/);c=k[0]||"",l=k.slice(1).join(" ")||""}let d={id:s,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(d)).ok)return u(V.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:s,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(s),u(V.DATABASE_ERROR());let E=Lo(or.EMAIL,e.plugins.identity);if(!E)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(V.PLUGIN_NOT_FOUND());let v=E.normalize(t.email),b=await e.plugins.database.identities.create({type:or.EMAIL,value:v,userId:s,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(b.ok===!1)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(b.errors,b.meta)}let o={userId:s,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(o.externalEmail=t.email),t.name!==void 0&&(o.externalName=t.name),t.avatarUrl!==void 0&&(o.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(o);return a.ok===!1?u(a.errors,a.meta):g(s)}async function Xc(t,e){if(!t.provider)return u(bt.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return u(bt.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return u(bt.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return u(bt.PROVIDER_NOT_FOUND());let b=await r.verifyCredential(t.credential);if(b.ok===!1)return u(bt.CODE_EXCHANGE_FAILED());if(n=b.data,!n)return u(bt.PROFILE_FETCH_FAILED())}else if(t.code){let b=await r.exchangeCodeForToken(t.code);if(b.ok===!1)return u(bt.CODE_EXCHANGE_FAILED());let k=b.data;if(!k)return u(bt.CODE_EXCHANGE_FAILED());i=k.accessToken}if(!n){if(!i)return u(bt.INVALID_ACCESS_TOKEN());let b=await r.getUserProfile(i);if(b.ok===!1)return u(bt.PROFILE_FETCH_FAILED());if(n=b.data,!n)return u(bt.PROFILE_FETCH_FAILED())}let s=await fx(n,e,t);if(!s.ok)return u(s.errors,s.meta);let o=s.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(o);if(!c.ok||!c.data)return u(V.DATABASE_ERROR());let l=await Br({userStatus:c.data.userStatus,userId:o,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return u(l.errors,l.meta);let{perms:d,roles:p,tenantType:m}=l.data,E={userId:o,...t.tenantId&&{tenantId:t.tenantId},...m&&{tenantType:m},...d!==void 0||p?{permissions:{...p&&{roles:p},...d!==void 0&&{perms:d}}}:{}},v=await On(E,a);return v.ok===!1?u(v.errors,v.meta):(await _e(e,{event:"oauth_login_success",userId:o,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await Mc(o,e),g({accessToken:v.data.accessToken,refreshToken:v.data.refreshToken,expiresAt:v.data.expiresAt}))}catch(n){return await _e(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),u(bt.PROFILE_FETCH_FAILED())}}var Mt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:T("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:T("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function Qc(t,e){if(!t.code)return u(Mt.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return u(Mt.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return u(Mt.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let m=await n.exchangeCodeForToken(t.code);if(m.ok===!1)return u(Mt.CODE_EXCHANGE_FAILED());let E=m.data;if(!E)return u(Mt.CODE_EXCHANGE_FAILED());i=E.accessToken}if(!i)return u(Mt.INVALID_ACCESS_TOKEN());let s=await n.getUserProfile(i);if(s.ok===!1)return u(Mt.PROFILE_FETCH_FAILED());let o=s.data;if(!o)return u(Mt.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,o.id);if(a.ok===!1)return u(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?u(Mt.PROVIDER_ALREADY_LINKED()):u(Mt.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:o.id,createdAt:new Date};o.email!==void 0&&(l.externalEmail=o.email),o.name!==void 0&&(l.externalName=o.name),o.avatarUrl!==void 0&&(l.externalAvatarUrl=o.avatarUrl);let d=await e.plugins.database.userProviders.create(l);if(d.ok===!1)return u(d.errors,d.meta);let p=d.data;return p?(await _e(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:o.id}}),g(p)):u(Mt.PROFILE_FETCH_FAILED())}catch(i){return await _e(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),u(Mt.PROFILE_FETCH_FAILED())}}var Es={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:T("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:T("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function Zc(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return u(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return u(Es.PROVIDER_NOT_LINKED());let i=n.find(o=>o.provider===t.provider);if(!i)return u(Es.PROVIDER_NOT_LINKED());if(n.length<=1){let o=await e.plugins.database.identities.getByUserId(t.userId);if(!(o.ok&&o.data&&o.data.length>0))return u(Es.CANNOT_UNLINK_LAST_PROVIDER())}let s=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return s.ok===!1?u(s.errors,s.meta):(await _e(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),g())}function HE(t){return Y(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth;return Yc({userId:e.user.id},r)}})}function FE(t){return Y(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:an.linkProvider.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),Qc(n,r)}})}function VE(t){return Ue(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:an.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),Xc(n,r)}})}function BE(t){return Y(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:an.unlinkProvider.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth;return Zc({userId:e.user.id,provider:e.body.provider},r)}})}var Ot={PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:T("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:T("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:T("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:T("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},_r={PASSWORD_PLUGIN_NOT_CONFIGURED:Ot.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:Ot.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:Ot.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:Ot.SAME_PASSWORD},fi={EMAIL_SYSTEM_NOT_AVAILABLE:Ot.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:Ot.SEND_EMAIL_ERROR},Bt={PASSWORD_PLUGIN_NOT_CONFIGURED:Ot.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:Ot.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:Ot.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:Ot.CHALLENGE_ALREADY_USED,INVALID_CODE:Ot.INVALID_CODE,TOO_MANY_ATTEMPTS:Ot.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:Ot.AUTH_SCOPE_MISMATCH};async function ys(t,e){if(!e.plugins.credential?.password)return u(_r.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,dn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(_r.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(_r.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return u(_r.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return u(_r.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(_r.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return u(l.errors,l.meta);let d=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return d.ok===!1&&console.error("Failed to revoke sessions after password change:",d.errors),await _e(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),g()}async function gs(t,e){if(!e.plugins.emailSystem)return u(fi.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=ln(6),s=await qr(i),o=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return g({challengeId:`fake_challenge_${Date.now()}`,expiresAt:o});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===Ie.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return g({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),d=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:Ie.PASSWORD_RESET,status:Fe.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:s,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:o});if(d.ok===!1)return u(d.errors,d.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:o.toISOString(),purpose:Ie.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),u(fi.SEND_EMAIL_ERROR());let m=Math.max(0,e.security.verificationResendCooldownSeconds),E=m>0?new Date(Date.now()+m*1e3):null,v=!c||c.purpose===Ie.PASSWORD_RESET;return await Promise.all([v?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:Ie.PASSWORD_RESET,channel:"email",expiresAt:o,resendAvailableAt:E}}):Promise.resolve(),_e(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),g({challengeId:l,expiresAt:o})}async function vs(t,e){if(!e.plugins.credential?.password)return u(Bt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Bt.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==Ie.PASSWORD_RESET)return u(Bt.CHALLENGE_NOT_FOUND());if(i.status!==Fe.PENDING)return u(Bt.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return u(Bt.CHALLENGE_EXPIRED());let s=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(s.ok===!1)return s.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?u(Bt.TOO_MANY_ATTEMPTS()):u(s.errors,s.meta);if(!i.codeHash)return u(Bt.INVALID_CODE());if(!await ps(t.code,i.codeHash))return u(Bt.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Bt.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,dn.PASSWORD);if(l.ok===!1)return u(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return u(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:dn.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return u(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let d=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return d.ok===!1&&console.error("Failed to revoke sessions after password reset:",d.errors),await _e(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),g()}var el={NO_CHANGES_PROVIDED:T("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function tl(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return u(el.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return u(V.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return u(V.INTERNAL_ERROR());await _e(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let o=await e.plugins.database.users.getById(t.userId);return!o.ok||o.data===null?u(V.NOT_FOUND()):g(o.data)}function As(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function qE(t){return Ue(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:sn.changePassword.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=As(t.auth),n=e.body,i=Un(e.authorizationHeader);return ys({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function jE(t){return Ue(t,{method:"POST",path:"/password/forgot",auth:!1,input:{body:sn.forgotPassword.body},handler:async e=>{let r=As(t.auth),n={email:e.body.email};return e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),gs(n,r)}})}function GE(t){return Y(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:sn.resetPassword.body},handler:async e=>{let r=As(t.auth);return vs({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var Wo={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:T("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to delete session")};async function zo(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?u(Wo.DATABASE_ERROR()):(await _e(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),g())}var Jo={DATABASE_ERROR:T("DATABASE_ERROR","Failed to retrieve sessions")};async function Yo(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return u(Jo.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return g(a,i.meta)}var Ts={INVALID_TOKEN:T("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to revoke token")};async function Xo(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?u(Ts.DATABASE_ERROR()):(await _e(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),g()):u(Ts.INVALID_TOKEN())}function $E(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function WE(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function zE(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function JE(t){return Y(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:on.deleteSession.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=WE(t.auth);return zo({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function YE(t){return Ue(t,{method:"GET",path:"/sessions",auth:!0,input:{query:on.listSessions.query},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=$E(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await Yo(n,r);if(!i.ok)return i;let s=Un(e.authorizationHeader);if(s&&i.data){let o=i.data.map(a=>a.id===s?{...a,isCurrent:!0}:a);return g(o,i.meta)}return i}})}function XE(t){return Y(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:on.revokeToken.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=zE(t.auth);return Xo({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},Qo=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function Zo(t,e){return t===void 0?!1:(t&e)===e}var wd={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},QE=Object.fromEntries(Object.entries(wd).map(([t,e])=>[e,Number(t)]));function Qt(t){return t?Object.entries(wd).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function Ln(t){let e=0;for(let r of t){let n=QE[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var Zt={SYSTEM:"system",DEFAULT:"org"};var ar={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var Gr={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:T("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:T("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),DATABASE_ERROR:V.DATABASE_ERROR};var mx={IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:T("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:T("IDENTITY_ALREADY_EXISTS","This identity is already registered")},hx={GUARD_LOCKED:T("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},Ex={INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:T("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:T("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:T("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:T("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},yx={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:T("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:T("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:T("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},gx={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:T("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:T("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},vx={MFA_NOT_CONFIGURED:T("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:T("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:T("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:T("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},Ax={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:T("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:T("INVALID_SESSION","Invalid session")},Tx={TOKEN_NOT_FOUND:T("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:T("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:T("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:T("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:T("TOKEN_VERIFICATION_FAILED","Token verification failed")},kt={NOT_MEMBER_OF_TENANT:T("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:T("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:T("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:T("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:T("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},Z$={...mx,...hx,...Ex,...yx,...gx,...vx,...Ax,...Tx,...kt};async function _s(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Gr.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let k=await s.tenantInvites.getById(r);if(!k.ok)return u(k.errors,k.meta);o=k.data}else if(n){let k=await s.tenantInvites.getByToken(n);if(!k.ok)return u(k.errors,k.meta);o=k.data}if(!o)return u(Gr.INVITE_NOT_FOUND());if(o.status!==ar.PENDING)return u(Gr.INVITE_NOT_PENDING());if(o.expiresAt<new Date)return u(Gr.INVITE_EXPIRED());if(o.inviteeUserId&&o.inviteeUserId!==i)return u(Gr.INVITE_USER_MISMATCH());if(!o.inviteeUserId&&(o.inviteeEmail||o.inviteePhone)){let k=await s.identities.getByUserId(i);if(!k.ok)return u(k.errors,k.meta);let C=k.data.filter(j=>j.verifiedAt!==null),L=(j,$)=>{let te=$.trim().toLowerCase();return C.some(A=>A.type===j&&A.value.trim().toLowerCase()===te)},B=o.inviteeEmail?L("email",o.inviteeEmail):!1,G=o.inviteePhone?L("phone",o.inviteePhone):!1;if(!B&&!G)return u(Gr.INVITE_IDENTITY_MISMATCH())}let a=await s.tenantMembers.get(o.tenantId,i);if(!a.ok)return u(a.errors,a.meta);if(a.data&&a.data.status!==lt.REMOVED)return u(Gr.ALREADY_MEMBER());let c=await s.tenants.get(o.tenantId);if(!c.ok)return u(c.errors,c.meta);if(o.authPerm!==void 0&&(o.authPerm&Qo)!==0){if(!c.data)return u(kt.TENANT_NOT_FOUND());if(c.data.type!==Zt.SYSTEM)return u(kt.ACCOUNT_PERMS_SYSTEM_ONLY())}let l={tenantId:o.tenantId,userId:i,status:lt.ACTIVE,isOwner:!1,tenantType:o.tenantType};c.data?.parentTenantId!==void 0&&(l.parentTenantId=c.data.parentTenantId),o.roles!==void 0&&(l.roles=o.roles),o.perms!==void 0&&(l.perms=o.perms),o.authPerm!==void 0&&(l.authPerm=o.authPerm);let d=await s.tenantMembers.create(l);if(!d.ok)return u(d.errors,d.meta);let p={tenantId:o.tenantId,userId:i},m=await s.users.getById(i);m.ok&&m.data&&(m.data.contactEmail&&(p.contactEmail=m.data.contactEmail),m.data.contactPhone&&(p.contactPhone=m.data.contactPhone),m.data.displayName&&(p.displayName=m.data.displayName),m.data.givenName&&(p.givenName=m.data.givenName),m.data.familyName&&(p.familyName=m.data.familyName),m.data.avatarUrl&&(p.avatarUrl=m.data.avatarUrl),m.data.locale&&(p.locale=m.data.locale)),o.displayName&&(p.displayName=o.displayName),o.givenName&&(p.givenName=o.givenName),o.familyName&&(p.familyName=o.familyName),o.jobTitle&&(p.jobTitle=o.jobTitle);let E=await s.userTenantProfiles.create(p);if(!E.ok)return u(E.errors,E.meta);let v=await s.tenantInvites.updateStatus(o.id,{status:ar.ACCEPTED,acceptedAt:new Date});if(!v.ok)return u(v.errors,v.meta);let b={tenantId:o.tenantId};return o.roles!==void 0&&(b.roles=o.roles),o.perms!==void 0&&(b.perms=o.perms),o.authPerm!==void 0&&(b.authPerm=o.authPerm),g(b)}var mi={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function hi(t,e,r){if(t===void 0||(t&Qo)===0)return g(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==Zt.SYSTEM?u(kt.ACCOUNT_PERMS_SYSTEM_ONLY()):g(void 0):u(kt.TENANT_NOT_FOUND()):u(n.errors,n.meta)}var rl={NOT_MEMBER:kt.NOT_MEMBER_OF_TENANT,SUSPENDED:kt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:kt.INSUFFICIENT_TENANT_PERMISSIONS};async function ut(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,s=await e.tenantMembers.get(r,n);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(rl.NOT_MEMBER());let o=s.data;return o.status!==lt.ACTIVE?u(rl.SUSPENDED()):o.isOwner?g(o):Zo(o.authPerm,i)?g(o):u(rl.INSUFFICIENT_PERMISSIONS())}async function nl(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(t.authPerm!==void 0&&(t.authPerm&se.CHANGE_MEMBER_PERMISSION)!==0&&!o.data.isOwner)return u(mi.CANNOT_ESCALATE_PERMISSIONS());let a=await hi(t.authPerm,r,s.tenants);if(!a.ok)return u(a.errors,a.meta);let c=await s.users.getById(n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(mi.USER_NOT_FOUND());let l=c.data,d=await s.tenantMembers.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(d.data&&d.data.status!==lt.REMOVED)return u(mi.ALREADY_MEMBER());let p=await s.tenants.get(r);if(!p.ok)return u(p.errors,p.meta);if(!p.data)return u(mi.TENANT_NOT_FOUND());let m=p.data,E={tenantId:r,userId:n,status:lt.ACTIVE,isOwner:!1,tenantType:m.type};m.parentTenantId!==void 0&&(E.parentTenantId=m.parentTenantId),t.roles!==void 0&&(E.roles=t.roles),t.perms!==void 0&&(E.perms=t.perms),t.authPerm!==void 0&&(E.authPerm=t.authPerm);let v=await s.tenantMembers.create(E);if(!v.ok)return u(v.errors,v.meta);let b={tenantId:r,userId:n};l.contactEmail&&(b.contactEmail=l.contactEmail),l.contactPhone&&(b.contactPhone=l.contactPhone),l.displayName&&(b.displayName=l.displayName),l.givenName&&(b.givenName=l.givenName),l.familyName&&(b.familyName=l.familyName),l.avatarUrl&&(b.avatarUrl=l.avatarUrl),l.locale&&(b.locale=l.locale),t.contactEmail!==void 0&&(b.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(b.contactPhone=t.contactPhone),t.displayName!==void 0&&(b.displayName=t.displayName),t.givenName!==void 0&&(b.givenName=t.givenName),t.familyName!==void 0&&(b.familyName=t.familyName),t.avatarUrl!==void 0&&(b.avatarUrl=t.avatarUrl),t.locale!==void 0&&(b.locale=t.locale),t.jobTitle!==void 0&&(b.jobTitle=t.jobTitle),t.bio!==void 0&&(b.bio=t.bio),t.metadata!==void 0&&(b.metadata=t.metadata);let k=await s.userTenantProfiles.create(b);return k.ok?g({tenantId:r,userId:n}):u(k.errors,k.meta)}var Is={TENANT_ALREADY_HAS_OWNER:T("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:T("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:V.DATABASE_ERROR};async function il(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:s,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:m,locale:E,jobTitle:v,bio:b,metadata:k}=t,C=e.plugins.database,L=i??"org";if(L===Zt.SYSTEM)return u(Is.SYSTEM_TYPE_FORBIDDEN());let B=await C.users.getById(n);if(!B.ok)return u(B.errors,B.meta);if(!B.data)return u(Is.USER_NOT_FOUND());let G=await C.tenants.get(r);if(!G.ok)return u(G.errors,G.meta);if(!G.data){let S={id:r,type:L,ownerId:n};s!==void 0&&(S.parentTenantId=s);let y=await C.tenants.create(S);if(!y.ok)return u(y.errors,y.meta)}let j=await C.tenantMembers.hasOwner(r);if(!j.ok)return u(j.errors,j.meta);if(j.data)return u(Is.TENANT_ALREADY_HAS_OWNER());let $=G.data?.parentTenantId??s,te={tenantId:r,userId:n,status:lt.ACTIVE,isOwner:!0,tenantType:L};$!==void 0&&(te.parentTenantId=$);let A=await C.tenantMembers.create(te);if(!A.ok)return u(A.errors,A.meta);let x=await C.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:m,locale:E,jobTitle:v,bio:b,metadata:k});return x.ok?g({tenantId:r,userId:n}):u(x.errors,x.meta)}async function sl(t,e){let{email:r,phone:n}=t,i=e.plugins.database,s=[],o=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}return g({pendingInvites:s})}var Ei={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),DATABASE_ERROR:V.DATABASE_ERROR};async function xs(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Ei.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let c=await s.tenantInvites.getById(r);if(!c.ok)return u(c.errors,c.meta);o=c.data}else if(n){let c=await s.tenantInvites.getByToken(n);if(!c.ok)return u(c.errors,c.meta);o=c.data}if(!o)return u(Ei.INVITE_NOT_FOUND());if(o.status!==ar.PENDING)return u(Ei.INVITE_NOT_PENDING());if(o.inviteeUserId&&o.inviteeUserId!==i)return u(Ei.INVITE_USER_MISMATCH());let a=await s.tenantInvites.updateStatus(o.id,{status:ar.DECLINED,declinedAt:new Date});return a.ok?g(void 0):u(a.errors,a.meta)}async function yi(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[s,o]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(kt.NOT_MEMBER_OF_TENANT());if(!o.ok)return u(o.errors,o.meta);let a=s.data,c=o.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),g(l)}var qt={INVITEE_REQUIRED:T("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:X("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:T("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:X("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:V.DATABASE_ERROR};function _x(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function bs(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:s,inviteePhone:o,roles:a,perms:c,authPerm:l,displayName:d,givenName:p,familyName:m,jobTitle:E}=t,v=e.plugins.database,b=await ut({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:v.tenantMembers});if(!b.ok)return u(b.errors,b.meta);if(l!==void 0&&(l&se.CHANGE_MEMBER_PERMISSION)!==0&&!b.data.isOwner)return u(qt.CANNOT_ESCALATE_PERMISSIONS());if(a?.includes("owner")&&!b.data.isOwner)return u(qt.CANNOT_ESCALATE_PERMISSIONS());let k=await hi(l,r,v.tenants);if(!k.ok)return u(k.errors,k.meta);if(!i&&!s&&!o)return u(qt.INVITEE_REQUIRED());if(i){let R=await v.users.getById(i);if(!R.ok)return u(R.errors,R.meta);if(!R.data)return u(qt.INVITEE_USER_NOT_FOUND({userId:i}));let N=await v.tenantMembers.get(r,i);if(!N.ok)return u(N.errors,N.meta);if(N.data&&N.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER());let O=await v.tenantInvites.findByTenantAndUserId(r,i);if(!O.ok)return u(O.errors,O.meta);if(O.data)return u(qt.INVITE_ALREADY_EXISTS())}if(s){let R=await v.identities.get("email",s);if(!R.ok)return u(R.errors,R.meta);if(R.data){let O=await v.tenantMembers.get(r,R.data.userId);if(!O.ok)return u(O.errors,O.meta);if(O.data&&O.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER())}let N=await v.tenantInvites.findByTenantAndEmail(r,s);if(!N.ok)return u(N.errors,N.meta);if(N.data)return u(qt.INVITE_ALREADY_EXISTS())}if(o){let R=await v.identities.get("phone",o);if(!R.ok)return u(R.errors,R.meta);if(R.data){let O=await v.tenantMembers.get(r,R.data.userId);if(!O.ok)return u(O.errors,O.meta);if(O.data&&O.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER())}let N=await v.tenantInvites.findByTenantAndPhone(r,o);if(!N.ok)return u(N.errors,N.meta);if(N.data)return u(qt.INVITE_ALREADY_EXISTS())}let C=await v.tenantInvites.countPendingByTenant(r);if(!C.ok)return u(C.errors,C.meta);if(C.data>=e.security.maxPendingInvitesPerTenant)return u(qt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let L,B,G,j=await v.users.getById(n);j.ok&&j.data&&(j.data.displayName!==void 0&&(L=j.data.displayName),j.data.contactEmail!==void 0&&(B=j.data.contactEmail));let $=await v.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(L=$.data.displayName),$.data.jobTitle!==void 0&&(G=$.data.jobTitle));let te=Zt.DEFAULT,A=await v.tenants.get(r);A.ok&&A.data&&(te=A.data.type);let x=v.tenantInvites.generateInviteId(),S=_x(),y=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),_={id:x,tenantId:r,tenantType:te,invitedById:n,status:ar.PENDING,inviteToken:S,expiresAt:y};L!==void 0&&(_.invitedByName=L),B!==void 0&&(_.invitedByEmail=B),G!==void 0&&(_.invitedByJobTitle=G),i!==void 0&&(_.inviteeUserId=i),s!==void 0&&(_.inviteeEmail=s),o!==void 0&&(_.inviteePhone=o),a!==void 0&&(_.roles=a),c!==void 0&&(_.perms=c),l!==void 0&&(_.authPerm=l),d!==void 0&&(_.displayName=d),p!==void 0&&(_.givenName=p),m!==void 0&&(_.familyName=m),E!==void 0&&(_.jobTitle=E);let w=await v.tenantInvites.create(_);return w.ok?g({inviteId:x,inviteToken:S,expiresAt:y}):u(w.errors,w.meta)}async function Ss(t,e){let{tenantId:r,actorUserId:n,status:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await s.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?g(c.data,c.meta):u(c.errors,c.meta)}async function Ns(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,s=await ut({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return u(s.errors,s.meta);let o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(o).length>0?o:void 0);return a.ok?g(a.data,a.meta):u(a.errors,a.meta)}async function ol(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let s=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return s.ok?g(s.data,s.meta):u(s.errors,s.meta)}var gi={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:T("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:T("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:V.DATABASE_ERROR};async function ws(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(i===n)return u(gi.CANNOT_REMOVE_SELF());let a=await s.tenantMembers.get(r,n);if(!a.ok)return u(a.errors,a.meta);if(!a.data)return u(gi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!o.data.isOwner)return u(gi.CANNOT_MODIFY_OWNER());if(c.isOwner){let d=await s.tenantMembers.listByTenant(r);if(!d.ok)return u(d.errors,d.meta);if(d.data.filter(m=>m.isOwner&&m.status===lt.ACTIVE).length<=1)return u(gi.CANNOT_REMOVE_LAST_OWNER())}let l=await s.tenantMembers.remove(r,n);return l.ok?(await s.userTenantProfiles.remove(r,n),g(void 0)):u(l.errors,l.meta)}var ea={INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:V.DATABASE_ERROR};async function Rs(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,s=await i.tenantInvites.getById(r);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(ea.INVITE_NOT_FOUND());let o=await ut({tenantId:s.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(s.data.status!==ar.PENDING)return u(ea.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:ar.REVOKED,revokedAt:new Date});return a.ok?g(void 0):u(a.errors,a.meta)}var Mn={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:V.DATABASE_ERROR};async function Os(t,e){let{tenantId:r,userId:n,actorUserId:i,role:s,perms:o,authPerm:a}=t,c=t.roles??(s!==void 0?[s]:void 0),l=e.plugins.database,d=await ut({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!d.ok)return u(d.errors,d.meta);let p=d.data;if(i===n)return u(Mn.CANNOT_MODIFY_SELF());let m=await l.tenantMembers.get(r,n);if(!m.ok)return u(m.errors,m.meta);if(!m.data)return u(Mn.MEMBER_NOT_FOUND());if(m.data.isOwner)return u(Mn.CANNOT_MODIFY_OWNER());if(a!==void 0&&!p.isOwner&&(a&se.CHANGE_MEMBER_PERMISSION)!==0)return u(Mn.CANNOT_ESCALATE_PERMISSIONS());if(c?.includes("owner")&&!p.isOwner)return u(Mn.CANNOT_ESCALATE_PERMISSIONS());let E=await hi(a,r,l.tenants);if(!E.ok)return u(E.errors,E.meta);let v={};if(c!==void 0&&(v.roles=c),o!==void 0&&(v.perms=o),a!==void 0&&(v.authPerm=a),Object.keys(v).length>0){let b=await l.tenantMembers.updatePermissions(r,n,v);if(!b.ok)return u(b.errors,b.meta)}return g(void 0)}var ta={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:V.DATABASE_ERROR};async function Rd(t,e){let{tenantId:r,userId:n,actorUserId:i,status:s}=t,o=e.plugins.database,a=await ut({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:o.tenantMembers});if(!a.ok)return u(a.errors,a.meta);if(i===n)return u(ta.CANNOT_MODIFY_SELF());let c=await o.tenantMembers.get(r,n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(ta.MEMBER_NOT_FOUND());if(c.data.isOwner)return u(ta.CANNOT_MODIFY_OWNER());let l=await o.tenantMembers.updateStatus(r,n,s);return l.ok?g(void 0):u(l.errors,l.meta)}var al={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:T("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:V.DATABASE_ERROR};async function ks(t,e){let{tenantId:r,userId:n,...i}=t,s=e.plugins.database,o=await s.tenantMembers.get(r,n);if(!o.ok)return u(o.errors,o.meta);if(!o.data)return u(al.MEMBER_NOT_FOUND());let a=o.data,c=a.isOwner||Zo(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let d=await s.userTenantProfiles.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(!d.data){let m=await s.userTenantProfiles.create({tenantId:r,userId:n,...l});return m.ok?g(void 0):u(m.errors,m.meta)}let p=await s.userTenantProfiles.update(r,n,l);return p.ok?g(void 0):u(p.errors,p.meta)}var Ix=10080,xx=100;function bx(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??Ix,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??xx}}}var $r=H({tenantId:we(h(),id(1))}),Sx=H({limit:I(we(ge(),ls(Number),$e(),wn(),cs(1),as(100))),cursor:I(h())}),Nx=we(H({inviteeEmail:I(we(h(),rn())),inviteeUserId:I(h()),inviteePhone:I(h()),role:I(h()),roles:I(Z(h())),authPerms:I(Z(h())),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h())}),Cc(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),ZE=we(H({inviteId:I(h()),inviteToken:I(h())}),Cc(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),wx=H({inviteId:h()}),Rx=H({status:I(h()),limit:I(we(ge(),ls(Number),$e(),wn(),cs(1),as(100))),cursor:I(h())}),Ox=H({userId:h(),role:I(h()),roles:I(Z(h())),authPerms:I(Z(h()))}),kx=H({userId:h()}),Cx=H({contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),bio:I(h()),jobTitle:I(h()),metadata:I(me(h(),ge()))});function ey(t){let{auth:e,policy:r}=t,n=Y(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r},handler:async E=>{let v=await yi({tenantId:E.params.tenantId,userId:E.user.id},e);if(!v.ok)return v;let b=v.data;if(!b)return g({});let{authPerm:k,...C}=b;return g({...C,authPerms:Qt(k)})}}),i=Y(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Cx},handler:async E=>{let v=E.params.tenantId,b=E.user.id,k={tenantId:v,userId:b},C=E.body;C.contactEmail!==void 0&&(k.contactEmail=C.contactEmail),C.contactPhone!==void 0&&(k.contactPhone=C.contactPhone),C.displayName!==void 0&&(k.displayName=C.displayName),C.givenName!==void 0&&(k.givenName=C.givenName),C.familyName!==void 0&&(k.familyName=C.familyName),C.avatarUrl!==void 0&&(k.avatarUrl=C.avatarUrl),C.locale!==void 0&&(k.locale=C.locale),C.bio!==void 0&&(k.bio=C.bio),C.jobTitle!==void 0&&(k.jobTitle=C.jobTitle),C.metadata!==void 0&&(k.metadata=C.metadata);let L=await ks(k,e);if(!L.ok)return L;let B=await yi({tenantId:v,userId:b},e);if(!B.ok)return B;let G=B.data;if(!G)return g({});let{authPerm:j,...$}=G;return g({...$,authPerms:Qt(j)})}}),s=Y(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Nx},handler:async E=>{let{inviteeEmail:v,inviteeUserId:b,inviteePhone:k,role:C,roles:L,authPerms:B,displayName:G,givenName:j,familyName:$,jobTitle:te}=E.body,A={tenantId:E.params.tenantId,invitedBy:E.user.id};return v!==void 0&&(A.inviteeEmail=v),b!==void 0&&(A.inviteeUserId=b),k!==void 0&&(A.inviteePhone=k),C!==void 0&&(A.role=C),L!==void 0&&(A.roles=L),B!==void 0&&(A.authPerm=Ln(B)),G!==void 0&&(A.displayName=G),j!==void 0&&(A.givenName=j),$!==void 0&&(A.familyName=$),te!==void 0&&(A.jobTitle=te),bs(A,bx(t))}}),o=Y(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,query:Rx},handler:async E=>{let v={tenantId:E.params.tenantId,actorUserId:E.user.id};E.query.status!==void 0&&(v.status=E.query.status),E.query.limit!==void 0&&(v.limit=E.query.limit),E.query.cursor!==void 0&&(v.cursor=E.query.cursor);let b=await Ss(v,e);if(!b.ok)return b;let k=b.data.map(({authPerm:C,...L})=>({...L,authPerms:Qt(C)}));return g(k,b.meta)}}),a=Y(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.GLOBAL},input:{params:$r,body:ZE},handler:async E=>{let v={userId:E.user.id};E.body.inviteId!==void 0&&(v.inviteId=E.body.inviteId),E.body.inviteToken!==void 0&&(v.inviteToken=E.body.inviteToken);let b=await _s(v,e);if(!b.ok)return b;let k=b.data;if(!k)return b;let{authPerm:C,...L}=k;return g({...L,authPerms:Qt(C)})}}),c=Y(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.GLOBAL},input:{params:$r,body:ZE},handler:async E=>{let v={userId:E.user.id};return E.body.inviteId!==void 0&&(v.inviteId=E.body.inviteId),E.body.inviteToken!==void 0&&(v.inviteToken=E.body.inviteToken),xs(v,e)}}),l=Y(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:wx},handler:async E=>Rs({inviteId:E.body.inviteId,revokedBy:E.user.id},e)}),d=Y(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,query:Sx},handler:async E=>{let v={tenantId:E.params.tenantId,actorUserId:E.user.id};E.query.limit!==void 0&&(v.limit=E.query.limit),E.query.cursor!==void 0&&(v.cursor=E.query.cursor);let b=await Ns(v,e);if(!b.ok)return b;let k=b.data.map(({authPerm:C,...L})=>({...L,authPerms:Qt(C)}));return g({members:k},b.meta)}}),p=Y(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Ox},handler:async E=>{let v={tenantId:E.params.tenantId,userId:E.body.userId,actorUserId:E.user.id};return E.body.role!==void 0&&(v.role=E.body.role),E.body.roles!==void 0&&(v.roles=E.body.roles),E.body.authPerms!==void 0&&(v.authPerm=Ln(E.body.authPerms)),Os(v,e)}}),m=Y(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:kx},handler:async E=>ws({tenantId:E.params.tenantId,userId:E.body.userId,actorUserId:E.user.id},e)});return nd("/tenants",[n,i,s,o,a,c,l,d,p,m])}function ty(t){return Y(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:Do.updateProfile.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),tl(n,r)}})}function cl(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function ry(t){return Ue(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:ui.resendVerification.body},handler:async e=>{let r=cl(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),fs(n,r)}})}function ny(t){return Y(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:ui.verifyCode.body},handler:async e=>{let r=cl(t.auth);return hs({challengeId:e.body.challengeId,code:e.body.code},r)}})}var Od="oauth_state",Dx=600;function iy(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function sy(t,e,r){qo(t,Od,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:Dx})}function Px(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function oy(t,e){let r=bd(t,Od);return jo(t,Od,{path:"/"}),!r||!e?!1:Px(r,e)}function Ux(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function Lx(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function ay(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:s=[]}=e;return async(o,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=Ux(o),d=await Lx(o,s),p=[`${i}:ip:${l}`];d&&p.push(`${i}:id:${d}`);for(let m of p){let E=await c.consume(m,{limit:r,windowMs:n});if(!E.allowed){let v=Math.ceil(E.retryAfterMs/1e3);return o.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(v)})}}return a()}}function Le(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function cy(t,e,r={}){let n=Object.keys(r).length===0,i=o=>n||r[o]!==!1;t.get("/health",o=>o.json({ok:!0},200));let s=(o,a)=>t.use(o,ay(e.auth,a));if(s("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),s("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),s("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),s("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),s("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),s("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),s("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),s("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),s("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Le(t,gE(e)),Le(t,bE(e)),Le(t,_E(e)),Le(t,xE(e)),Le(t,IE(e)),Le(t,SE(e)),Le(t,vE(e)),Le(t,AE(e)),Le(t,TE(e))),i("password")&&(Le(t,qE(e)),Le(t,jE(e)),Le(t,GE(e))),i("verification")&&(Le(t,ny(e)),Le(t,ry(e))),i("sessions")&&(Le(t,YE(e)),Le(t,JE(e)),Le(t,XE(e))),i("mfa")&&(Le(t,LE(e)),Le(t,KE(e)),Le(t,PE(e)),Le(t,UE(e)),Le(t,ME(e))),i("oauth")){let o=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=iy();return sy(a,c,o),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let d=await a.req.raw.clone().json();typeof d.state=="string"&&(l=d.state)}catch{l=void 0}return l!==void 0&&!oy(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Le(t,VE(e)),Le(t,FE(e)),Le(t,BE(e)),Le(t,HE(e))}i("users")&&Le(t,ty(e)),i("tenants")&&t.route("",ey(e))}function kd(t){td(Fh);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:s,features:o}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),s&&s.length>0&&(a.trustedOrigins=s);let c=e.security.tokenAudiences?.cookieNames;if(c){let d={cookieNames:c};e.security.systemTenantId&&(d.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=d}let l=new Vr;return cy(l,a,o),l}async function Kn(t,e,r,n){let i=await ut({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return u(i.errors,i.meta);let s=await n.tenants.get(e);return s.ok?s.data?s.data.type!==Zt.SYSTEM?u(kt.ACCOUNT_PERMS_SYSTEM_ONLY()):g({actor:i.data}):u(kt.TENANT_NOT_FOUND()):u(s.errors,s.meta)}var fn={CANNOT_REMOVE_ACTIVE_ACCOUNT:T("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:T("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:T("NO_CHANGES","At least one field must be provided")};var Mx=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function Cd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=t.status??"active",s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let o=await r.users.getByStatus(i,s);if(!o.ok)return u(o.errors,o.meta);let a=[];for(let c of o.data){let l=await r.users.getById(c);if(l.ok&&l.data){let d=l.data,p={id:d.id,status:d.status,createdAt:d.createdAt,updatedAt:d.updatedAt};d.contactEmail!==void 0&&(p.contactEmail=d.contactEmail),d.contactPhone!==void 0&&(p.contactPhone=d.contactPhone),d.displayName!==void 0&&(p.displayName=d.displayName),a.push(p)}}return g(a,o.meta)}async function Dd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return u(i.errors,i.meta);if(!i.data)return u(V.NOT_FOUND());let s=i.data,o=await r.userAuths.get(t.userId),a={id:s.id,status:s.status,createdAt:s.createdAt,updatedAt:s.updatedAt,mfaRequired:o.ok&&o.data?o.data.mfaRequired:!1,mfaMethods:o.ok&&o.data?o.data.mfaMethods:null};return s.contactEmail!==void 0&&(a.contactEmail=s.contactEmail),s.contactPhone!==void 0&&(a.contactPhone=s.contactPhone),s.displayName!==void 0&&(a.displayName=s.displayName),s.givenName!==void 0&&(a.givenName=s.givenName),s.familyName!==void 0&&(a.familyName=s.familyName),s.avatarUrl!==void 0&&(a.avatarUrl=s.avatarUrl),s.locale!==void 0&&(a.locale=s.locale),s.username!==void 0&&(a.username=s.username),s.metadata!==void 0&&(a.metadata=s.metadata),g(a)}async function Pd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return u(fn.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?g(void 0):u(c.errors,c.meta)}async function Ud(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);if(!Mx.has(t.status))return u(fn.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());let o=await r.userAuths.updateStatus(t.userId,t.status);if(!o.ok)return u(o.errors,o.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?g(void 0):u(a.errors,a.meta)}async function Ld(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());let o=await r.credentials.getByUserId(t.userId);if(!o.ok)return u(o.errors,o.meta);for(let a of o.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return u(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return u(a.errors,a.meta)}return g(void 0)}async function Md(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());if(s.data.status===ye.ACTIVE)return u(fn.CANNOT_REMOVE_ACTIVE_ACCOUNT());let o=await r.credentials.getByUserId(t.userId);if(o.ok)for(let l of o.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?g(void 0):u(c.errors,c.meta)}var Ir=H({message:I(h())}),ly=H({message:I(h()),tenantId:h(),userId:h()}),Kd={tenantId:h(),userId:h(),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),displayNameSource:I(Xt(["user","admin","system"])),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),jobTitle:I(h()),bio:I(h()),metadata:I(me(h(),ge()))},uy=H({...Kd,status:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:Z(h()),isOwner:_t(),createdAt:h(),memberUpdatedAt:h(),profileUpdatedAt:I(h())}),Kx=H({...Kd,createdAt:h(),updatedAt:h()}),Hx=H({tenantId:h(),userId:h(),status:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:Z(h()),isOwner:_t(),createdAt:h(),updatedAt:h(),tenantProfile:I(Kx)}),dy=Z(Hx),py=H({tenantId:h(),userId:h()}),Fx=H({...Kd,status:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerm:I($e()),isOwner:_t(),createdAt:h(),updatedAt:h()}),fy=Z(Fx),Vx=H({id:h(),name:I(h()),email:I(h()),jobTitle:I(h())}),my=H({id:h(),tenantId:h(),invitedBy:Vx,inviteeUserId:I(h()),inviteeEmail:I(h()),inviteePhone:I(h()),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:Z(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h()),status:h(),expiresAt:h(),createdAt:h(),updatedAt:h()}),hy=Z(my),Ey=H({inviteId:h(),inviteToken:h(),expiresAt:h()}),yy=H({tenantId:h(),userId:h()}),gy=H({invites:Z(my)}),Bx=H({id:h(),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),status:h(),createdAt:h(),updatedAt:h()}),vy=Z(Bx),Ay=H({id:h(),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),status:h(),createdAt:h(),updatedAt:h(),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),username:I(h()),metadata:I(me(h(),ge())),mfaRequired:_t(),mfaMethods:ci(Z(h()))});var ll={limit:I(we($e(),wn())),cursor:I(h())},qx={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:H({tenantId:h(),userId:h(),tenantType:I(h()),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),displayNameSource:I(Xt(["user","admin","system"])),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),jobTitle:I(h()),bio:I(h()),metadata:I(me(h(),ge()))}),response:ly},jx={method:"POST",path:"/tenant/profile",kind:"data",body:H({tenantId:h(),userId:h()}),response:uy},Gx={method:"POST",path:"/tenant/profile/update",kind:"data",body:H({tenantId:h(),userId:h(),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),bio:I(h()),jobTitle:I(h()),metadata:I(me(h(),ge()))}),response:Ir},$x={method:"POST",path:"/tenant/members/list",kind:"data",body:H({tenantId:h(),actorUserId:h(),...ll}),response:dy},Wx={method:"POST",path:"/tenant/members/update-status",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),status:Xt(["invited","active","suspended","removed"])}),response:Ir},zx={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:I(Z(h()))}),response:Ir},Jx={method:"POST",path:"/tenant/members/remove",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h()}),response:Ir},Yx={method:"POST",path:"/tenant/members/add",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:I(Z(h())),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),jobTitle:I(h()),bio:I(h()),metadata:I(me(h(),ge()))}),response:py},Xx={method:"POST",path:"/tenant/invites/list",kind:"data",body:H({tenantId:h(),actorUserId:h(),status:I(Xt(["pending","accepted","declined","revoked","expired"])),...ll}),response:hy},Qx={method:"POST",path:"/tenant/invites/create",kind:"data",body:H({tenantId:h(),invitedBy:h(),inviteeUserId:I(h()),inviteeEmail:I(h()),inviteePhone:I(h()),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:I(Z(h())),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h())}),response:Ey},_y=H({userId:h(),inviteId:I(h()),inviteToken:I(h())}),Zx={method:"POST",path:"/tenant/invites/accept",kind:"data",body:_y,response:yy},eb={method:"POST",path:"/tenant/invites/decline",kind:"data",body:_y,response:Ir},tb={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:H({inviteId:h(),revokedBy:h()}),response:Ir},rb={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:H({email:I(h()),phone:I(h())}),response:gy},nb={method:"POST",path:"/user/tenants/list",kind:"data",body:H({userId:h(),tenantType:I(h()),parentTenantId:I(h()),...ll}),response:fy},Cs={actorUserId:h(),systemTenantId:h()},ib={method:"POST",path:"/accounts/list",kind:"data",body:H({...Cs,status:I(Xt(["active","inactive"])),...ll}),response:vy},sb={method:"POST",path:"/accounts/get",kind:"data",body:H({...Cs,userId:h()}),response:Ay},ob={method:"POST",path:"/accounts/update-profile",kind:"data",body:H({...Cs,userId:h(),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),contactEmail:I(h()),contactPhone:I(h()),metadata:I(me(h(),ge()))}),response:Ir},ab={method:"POST",path:"/accounts/update-status",kind:"data",body:H({...Cs,userId:h(),status:Xt(["active","suspended","deleted"])}),response:Ir},cb={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:H({...Cs,userId:h(),credentialType:I(h())}),response:Ir},lb={method:"POST",path:"/accounts/remove",kind:"data",body:H({...Cs,userId:h()}),response:Ir},Je={bootstrapTenantOwner:qx,getTenantProfile:jx,updateTenantProfile:Gx,listTenantMembers:$x,updateTenantMemberStatus:Wx,updateTenantMemberPermission:zx,removeTenantMember:Jx,addMemberToTenant:Yx,listTenantInvites:Xx,inviteToTenant:Qx,acceptInvite:Zx,declineInvite:eb,revokeInvite:tb,checkPendingInvites:rb,listUserTenants:nb,listAccounts:ib,getAccount:sb,updateAccountProfile:ob,updateAccountStatus:ab,resetAccountCredentials:cb,removeAccount:lb};var ub=3,db=10080,pb=100;function fb(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??db,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??pb}}}function Ds(t){return{plugins:{database:t.plugins.database}}}function mb(t){return Zu({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Hd(t){let{auth:e,internal:r}=t,n=mb(r),i=new Vr;i.use("/*",async(y,_)=>{let w=y.req.header("Authorization");if(!w){await _();return}let R=w.match(/^Bearer\s+(.+)$/i);if(!R){await _();return}let O=R[1].split(".");if(O.length!==3||!O[1]){await _();return}let P;try{let U=O[1].replace(/-/g,"+").replace(/_/g,"/");P=JSON.parse(atob(U))}catch{await _();return}if(P.typ!==ub)return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let U=P.roles,K=Array.isArray(U)?U:[];if(!r.requiredRoles.some(J=>K.includes(J)))return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await _()});let s=Y(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:Je.bootstrapTenantOwner.body},handler:async y=>{let _={tenantId:y.body.tenantId,userId:y.body.userId};return y.body.tenantType!==void 0&&(_.tenantType=y.body.tenantType),y.body.contactEmail!==void 0&&(_.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(_.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(_.displayName=y.body.displayName),y.body.displayNameSource!==void 0&&(_.displayNameSource=y.body.displayNameSource),y.body.givenName!==void 0&&(_.givenName=y.body.givenName),y.body.familyName!==void 0&&(_.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(_.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(_.locale=y.body.locale),y.body.jobTitle!==void 0&&(_.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(_.bio=y.body.bio),y.body.metadata!==void 0&&(_.metadata=y.body.metadata),il(_,e)}}),o=Y(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:Je.getTenantProfile.body},handler:async y=>{let _=await yi({tenantId:y.body.tenantId,userId:y.body.userId},e);if(!_.ok)return _;let w=_.data;if(!w)return _;let{authPerm:R,...N}=w;return g({...N,authPerms:Qt(R)})}}),a=Y(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:Je.updateTenantProfile.body},handler:async y=>{let{tenantId:_,userId:w,...R}=y.body,N={tenantId:_,userId:w};return R.contactEmail!==void 0&&(N.contactEmail=R.contactEmail),R.contactPhone!==void 0&&(N.contactPhone=R.contactPhone),R.displayName!==void 0&&(N.displayName=R.displayName),R.givenName!==void 0&&(N.givenName=R.givenName),R.familyName!==void 0&&(N.familyName=R.familyName),R.avatarUrl!==void 0&&(N.avatarUrl=R.avatarUrl),R.locale!==void 0&&(N.locale=R.locale),R.bio!==void 0&&(N.bio=R.bio),R.jobTitle!==void 0&&(N.jobTitle=R.jobTitle),R.metadata!==void 0&&(N.metadata=R.metadata),ks(N,e)}}),c=Y(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:Je.listTenantMembers.body},handler:async y=>{let _={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.limit!==void 0&&(_.limit=y.body.limit),y.body.cursor!==void 0&&(_.cursor=y.body.cursor);let w=await Ns(_,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),l=Y(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:Je.updateTenantMemberStatus.body},handler:async y=>Rd({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId,status:y.body.status},e)}),d=Y(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:Je.updateTenantMemberPermission.body},handler:async y=>{let _={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(_.roles=y.body.roles),y.body.perms!==void 0&&(_.perms=y.body.perms),y.body.authPerms!==void 0&&(_.authPerm=Ln(y.body.authPerms)),Os(_,e)}}),p=Y(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:Je.removeTenantMember.body},handler:async y=>ws({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId},e)}),m=Y(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:Je.addMemberToTenant.body},handler:async y=>{let _={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(_.roles=y.body.roles),y.body.perms!==void 0&&(_.perms=y.body.perms),y.body.authPerms!==void 0&&(_.authPerm=Ln(y.body.authPerms)),y.body.contactEmail!==void 0&&(_.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(_.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(_.displayName=y.body.displayName),y.body.givenName!==void 0&&(_.givenName=y.body.givenName),y.body.familyName!==void 0&&(_.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(_.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(_.locale=y.body.locale),y.body.jobTitle!==void 0&&(_.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(_.bio=y.body.bio),y.body.metadata!==void 0&&(_.metadata=y.body.metadata),nl(_,e)}}),E=Y(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:Je.listTenantInvites.body},handler:async y=>{let _={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.status!==void 0&&(_.status=y.body.status),y.body.limit!==void 0&&(_.limit=y.body.limit),y.body.cursor!==void 0&&(_.cursor=y.body.cursor);let w=await Ss(_,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),v=Y(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:Je.inviteToTenant.body},handler:async y=>{let _={tenantId:y.body.tenantId,invitedBy:y.body.invitedBy};return y.body.inviteeUserId!==void 0&&(_.inviteeUserId=y.body.inviteeUserId),y.body.inviteeEmail!==void 0&&(_.inviteeEmail=y.body.inviteeEmail),y.body.inviteePhone!==void 0&&(_.inviteePhone=y.body.inviteePhone),y.body.roles!==void 0&&(_.roles=y.body.roles),y.body.perms!==void 0&&(_.perms=y.body.perms),y.body.authPerms!==void 0&&(_.authPerm=Ln(y.body.authPerms)),y.body.displayName!==void 0&&(_.displayName=y.body.displayName),y.body.givenName!==void 0&&(_.givenName=y.body.givenName),y.body.familyName!==void 0&&(_.familyName=y.body.familyName),y.body.jobTitle!==void 0&&(_.jobTitle=y.body.jobTitle),bs(_,fb(e))}}),b=Y(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:Je.acceptInvite.body},handler:async y=>{let _={userId:y.body.userId};y.body.inviteId!==void 0&&(_.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(_.inviteToken=y.body.inviteToken);let w=await _s(_,e);if(!w.ok)return w;let R=w.data;if(!R)return w;let{authPerm:N,...O}=R;return g({...O,authPerms:Qt(N)})}}),k=Y(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:Je.declineInvite.body},handler:async y=>{let _={userId:y.body.userId};return y.body.inviteId!==void 0&&(_.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(_.inviteToken=y.body.inviteToken),xs(_,e)}}),C=Y(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:Je.revokeInvite.body},handler:async y=>Rs({inviteId:y.body.inviteId,revokedBy:y.body.revokedBy},e)}),L=Y(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:Je.checkPendingInvites.body},handler:async y=>{let _={};return y.body.email!==void 0&&(_.email=y.body.email),y.body.phone!==void 0&&(_.phone=y.body.phone),sl(_,e)}}),B=Y(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:Je.listUserTenants.body},handler:async y=>{let _={userId:y.body.userId};y.body.tenantType!==void 0&&(_.tenantType=y.body.tenantType),y.body.parentTenantId!==void 0&&(_.parentTenantId=y.body.parentTenantId),y.body.limit!==void 0&&(_.limit=y.body.limit),y.body.cursor!==void 0&&(_.cursor=y.body.cursor);let w=await ol(_,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),G=Y(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:Je.listAccounts.body},handler:async y=>{let _={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId};return y.body.status!==void 0&&(_.status=y.body.status),y.body.limit!==void 0&&(_.limit=y.body.limit),y.body.cursor!==void 0&&(_.cursor=y.body.cursor),Cd(_,Ds(e))}}),j=Y(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:Je.getAccount.body},handler:async y=>Dd({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},Ds(e))}),$=Y(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:Je.updateAccountProfile.body},handler:async y=>{let{actorUserId:_,systemTenantId:w,userId:R,...N}=y.body,O={actorUserId:_,systemTenantId:w,userId:R};return N.displayName!==void 0&&(O.displayName=N.displayName),N.givenName!==void 0&&(O.givenName=N.givenName),N.familyName!==void 0&&(O.familyName=N.familyName),N.avatarUrl!==void 0&&(O.avatarUrl=N.avatarUrl),N.locale!==void 0&&(O.locale=N.locale),N.contactEmail!==void 0&&(O.contactEmail=N.contactEmail),N.contactPhone!==void 0&&(O.contactPhone=N.contactPhone),N.metadata!==void 0&&(O.metadata=N.metadata),Pd(O,Ds(e))}}),te=Y(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:Je.updateAccountStatus.body},handler:async y=>Ud({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId,status:y.body.status},Ds(e))}),A=Y(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:Je.resetAccountCredentials.body},handler:async y=>{let _={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId};return y.body.credentialType!==void 0&&(_.credentialType=y.body.credentialType),Ld(_,Ds(e))}}),x=Y(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:Je.removeAccount.body},handler:async y=>Md({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},Ds(e))});function S(y){let{method:_,path:w}=y.routeMeta,R=_.toLowerCase();i[R](w,y)}return S(s),S(o),S(a),S(c),S(l),S(d),S(p),S(m),S(E),S(v),S(b),S(k),S(C),S(L),S(B),S(G),S(j),S($),S(te),S(A),S(x),i}var Iy=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},xy=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,s=e.length-1;i<=n;i++,s--)r[i]=e.charCodeAt(i),r[s]=e.charCodeAt(s);return r};function ra(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var hb=t=>t.requestContext;var Fd=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=xb(r),s,o;try{s=i.createRequest(r),o=hb(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(s,{event:r,requestContext:o,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},ul=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=this.getDomainName(t),n=this.getPath(t),i=`https://${r}${n}`,s=e?`${i}?${e}`:i,o=this.getHeaders(t),a=this.getMethod(t),c={headers:o,method:a};if(t.body){let l=t.isBase64Encoded?xy(t.body):new TextEncoder().encode(t.body);c.body=l,o.set("content-length",l.length.toString())}return new Request(s,c)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??by,s=!!(n&&i(n));if(!s){let c=e.headers.get("content-encoding");s=wb(c)}let a={body:s?Iy(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:s,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,a),a.multiValueHeaders?e.headers.forEach((c,l)=>{a.multiValueHeaders[l]=[c]}):e.headers.forEach((c,l)=>{a.headers[l]=c}),a}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},Eb=class extends ul{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},yb=new Eb,gb=class extends ul{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,ra(n));if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n){let i=e.get(r);n.forEach(s=>{let o=ra(s);return(!i||!i.includes(o))&&e.append(r,o)})}}return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},vb=new gb,Ab=class extends ul{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=ra(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,ra(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},Tb=new Ab,_b=class extends ul{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers){for(let[r,n]of Object.entries(t.headers))if(n){let i=e.get(r);n.forEach(s=>{let o=ra(s);return(!i||!i.includes(o))&&e.append(r,o)})}}return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},Ib=new _b,xb=t=>bb(t)?Tb:Sb(t)?yb:Nb(t)?Ib:vb,bb=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,Sb=t=>Object.hasOwn(t,"rawPath"),Nb=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,by=t=>!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/.test(t),wb=t=>t===null?!1:/^(gzip|deflate|compress|br)/.test(t);var Sy=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[],...t},r=(i=>typeof i=="string"?i==="*"?()=>i:s=>i===s?s:null:typeof i=="function"?i:s=>i.includes(s)?s:null)(e.origin),n=(i=>typeof i=="function"?i:Array.isArray(i)?()=>i:()=>[])(e.allowMethods);return async function(s,o){function a(l,d){s.res.headers.set(l,d)}let c=await r(s.req.header("origin")||"",s);if(c&&a("Access-Control-Allow-Origin",c),e.credentials&&a("Access-Control-Allow-Credentials","true"),e.exposeHeaders?.length&&a("Access-Control-Expose-Headers",e.exposeHeaders.join(",")),s.req.method==="OPTIONS"){e.origin!=="*"&&a("Vary","Origin"),e.maxAge!=null&&a("Access-Control-Max-Age",e.maxAge.toString());let l=await n(s.req.header("origin")||"",s);l.length&&a("Access-Control-Allow-Methods",l.join(","));let d=e.allowHeaders;if(!d?.length){let p=s.req.header("Access-Control-Request-Headers");p&&(d=p.split(/\s*,\s*/))}return d?.length&&(a("Access-Control-Allow-Headers",d.join(",")),s.res.headers.append("Vary","Access-Control-Request-Headers")),s.res.headers.delete("Content-Length"),s.res.headers.delete("Content-Type"),new Response(null,{headers:s.res.headers,status:204,statusText:"No Content"})}await o(),e.origin!=="*"&&s.header("Vary","Origin",{append:!0})}};var Rb={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function vi(t={}){let e={...Rb,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var Vd={LOW:vi({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:vi({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:vi({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:vi({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var Ny={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function Bd(t,e={}){return{system:t,policy:{...Ny.policy,...e.policy??{}},version:e.version??Ny.version,...e.email&&{email:e.email}}}var wy=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],Ry=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],qd=[...wy,...Ry];var cr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function Oy(t,e){if(!t||typeof t!="object")throw new cr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new cr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new cr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new cr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new cr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new cr(e,'"health" must be a function if provided')}function ky(t,e,r){for(let n of r){if(!(n in t))throw new cr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new cr(e,`"${n}" must be a function`)}}var Cy={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function Dy(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",s=typeof r.parseUserAgent=="function";if(!i&&!s)throw new cr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Cy[e];n&&ky(t,String(e),n)}function jd(t,e){Oy(t,String(e)),Dy(t,e)}var Py={debug:0,info:1,warn:2,error:3},dl=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=Py[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&Py[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),s=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${s} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function Uy(t){return new dl(t)}var pl=new dl({enabled:!1});function Ps(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Ai(t,e){let r=Ps(t),n=Ps(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Ly(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Ai(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=Ps(r),i=Ps(t);return!n||!i?!1:i.major===n.major&&Ai(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=Ps(r),i=Ps(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Ai(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Ai(t,e.slice(2))>=0:e.startsWith(">")?Ai(t,e.slice(1))>0:e.startsWith("<=")?Ai(t,e.slice(2))<=0:e.startsWith("<")?Ai(t,e.slice(1))<0:!1}function Ob(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function kb(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function Us(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())Gd(n,i);return t}let e=[];if(Ob(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,s]=n;Gd(i,s),r.set(i,s)}return r}function Gd(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");kb(t,e)}function $d(t,e){Gd(t,e)}function fl(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function ml(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function Wd(t,e={},r,n=pl,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let s=new Map;for(let v of t)s.set(v.name,v);let o=new Map,a=new Map;for(let v of s.keys())o.set(v,0),a.set(v,[]);for(let v of s.values()){let b=v.dependencies??[];for(let k of b){let C=typeof k=="string"?k:k.name,L=typeof k=="string"?void 0:k.version;if(!s.has(C))throw new Error(`Plugin '${String(v.name)}' depends on '${String(C)}' which is not defined`);if(L){let B=s.get(C);if(B.version&&!Ly(B.version,L))throw new Error(`Plugin '${String(v.name)}' requires '${String(C)}' ${L}, but version ${B.version} is provided`)}a.get(C).push(v.name),o.set(v.name,(o.get(v.name)??0)+1)}}let c=[];for(let[v,b]of o.entries())b===0&&c.push(v);let l=[];for(;c.length>0;){let v=c.shift();l.push(v);for(let b of a.get(v)??[]){let k=(o.get(b)??0)-1;o.set(b,k),k===0&&c.push(b)}}if(l.length!==s.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let d={},p={get(v){if(!d[v])throw new Error(`Plugin '${String(v)}' not found or not yet initialized`);return d[v]},has(v){return v in d},getRegistry(){return d}};for(let v of l){n.group(`Initializing plugin: ${String(v)}`),n.time(`Plugin: ${String(v)}`);let b=s.get(v),k=e[v],C=null;if(k!==void 0?(n.debug("Using override"),fl(k)?(n.debug("Creating from factory wrapper"),C=await k.create(p)):ml(k)?(n.debug("Lazy loading plugin"),C=await k.load()):(n.debug("Using direct instance"),C=k)):b.factory?(n.debug("Creating from descriptor factory"),C=await b.factory(p)):b.instance&&(n.debug("Using descriptor instance"),C=b.instance),!C&&b.required)throw new Error(`Required plugin '${String(v)}' is missing`);if(C){if(v==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{jd(C,v),n.debug("Validation passed")}catch(G){throw n.error("Validation failed:",G),new Error(`Plugin '${String(v)}' validation failed: ${G instanceof Error?G.message:String(G)}`)}}d[v]=C;let B=C;B.initialize&&(n.debug("Calling plugin initialize()"),await B.initialize()),n.info(`Plugin '${String(v)}' initialized successfully`)}else n.warn(`Plugin '${String(v)}' is null/undefined`);n.timeEnd(`Plugin: ${String(v)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),d.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),d.credential=e.credential),i.extraEntries&&Object.assign(d,i.extraEntries),!Cb(d))throw new Error("Plugin registry is incomplete - missing required plugins");let m=d,E=Us(m.oauthProviders);if(!E){let v=e.oauthProviders;v!==void 0&&!fl(v)&&!ml(v)?E=Us(v)??new Map:E=new Map}return m.oauthProviders=E,await r?.afterInit?.(m),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),m}function Cb(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function zd(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function na(t){let e=t.debug?Uy({enabled:!0,prefix:"[auth-core SDK]"}):pl;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=Us(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await Wd(qd,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let s=vi(t.security??{});e.debug("Security level:",s.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let o=Bd({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",o.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:s,system:o,async healthCheck(){let a=[];for(let[l,d]of Object.entries(i)){if(!d||typeof d!="object")continue;let p=d,m={name:String(l),healthy:!0};if(p.health)try{let E=await p.health();m.healthy=E,E||(m.error=`Plugin '${l}' health check failed`)}catch(E){m.healthy=!1,m.error=E instanceof Error?E.message:"Health check threw error"}a.push(m)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await zd(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");$d(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var El=[];function ia(t){let e=process.env[t];return e||(El.push(t),"")}function Jd(t,e){return e?ia(t):process.env[t]??""}function My(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function Lb(t){let e=My(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var Mb=process.env.SMTP_MODE==="smtp"?"smtp":"console",Ti=process.env.EMAIL_MODE;if(Ti&&Ti!=="queue"&&Ti!=="smtp"&&Ti!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Ti}`);var Ls=Ti||Mb,Kb=Ls==="console"?"console":"smtp",Yd=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",yl=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(Ls==="queue"&&Yd!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${Yd}`);if(yl!=="generic"&&yl!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${yl}`);function hl(t,e){if(t){if(t==="body"||t==="cookie"||t==="both")return t;throw new Error(`${e} must be one of body|cookie|both, got: ${t}`)}}function Hb(){let t=hl(process.env.REFRESH_TOKEN_STRATEGY,"REFRESH_TOKEN_STRATEGY"),e=hl(process.env.REFRESH_TOKEN_STRATEGY_CUSTOMER,"REFRESH_TOKEN_STRATEGY_CUSTOMER"),r=hl(process.env.REFRESH_TOKEN_STRATEGY_TENANT,"REFRESH_TOKEN_STRATEGY_TENANT"),n=hl(process.env.REFRESH_TOKEN_STRATEGY_SYSTEM,"REFRESH_TOKEN_STRATEGY_SYSTEM");if(e||r||n){let i=t??"body";return{customer:e??i,tenant:r??i,system:n??i}}return t??"cookie"}var sa=Hb(),Fb=typeof sa=="string"?sa==="cookie"||sa==="both":Object.values(sa).some(t=>t==="cookie"||t==="both"),F={dynamodbTableName:ia("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:ia("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:ia("JWT_PRIVATE_KEY"),jwtPublicKey:ia("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:Jd("SMTP_USER",Ls==="smtp"),pass:Jd("SMTP_PASS",Ls==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:Kb},email:{mode:Ls,queue:{provider:Yd,url:Jd("EMAIL_QUEUE_URL",Ls==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:yl,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:Lb("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:My("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:sa,...Fb?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__",tokenAudiences:{customer:process.env.TOKEN_AUD_CUSTOMER||"customer",tenant:process.env.TOKEN_AUD_TENANT||"tenant",system:process.env.TOKEN_AUD_SYSTEM||"system",cookieNames:{customer:process.env.REFRESH_COOKIE_CUSTOMER||"refresh_token",tenant:process.env.REFRESH_COOKIE_TENANT||"refresh_token_tenant",system:process.env.REFRESH_COOKIE_SYSTEM||"refresh_token_system"}}},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function Ky(){if(El.length>0){let t=El.map(e=>`  - ${e}`).join(`
-`);throw new Error(`Missing required environment variables (${El.length}):
-${t}`)}if(F.nodeEnv==="production"&&!F.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Xd(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function Vb(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function gl(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Vb(r)}async function Qd(t,e){let r=await gl(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var Bb="otp",Hy={INVALID_CODE:T("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:T("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function qb(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function Fy(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:Bb,challengeType:"verification-code",async create(){return g({value:"",data:null})},async update(){return g({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let o=Xd(e),a=await gl(o),c=new Date(Date.now()+r*60*1e3);return g({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:o,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:qb(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await Qd(n.credentialValue,i)?g({userId:n.userId,intents:[]}):u(Hy.INVALID_CODE()):u(Hy.MISSING_CHALLENGE_CONTEXT())}}}function jb(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}function yt(t,e=""){if(typeof t!="number"){let r=e&&`"${e}" `;throw new TypeError(`${r}expected number, got ${typeof t}`)}if(!Number.isSafeInteger(t)||t<0){let r=e&&`"${e}" `;throw new RangeError(`${r}expected integer >= 0, got ${t}`)}}function mn(t,e,r=""){let n=jb(t),i=t?.length,s=e!==void 0;if(!n||s&&i!==e){let o=r&&`"${r}" `,a=s?` of length ${e}`:"",c=n?`length=${i}`:`type=${typeof t}`,l=o+"expected Uint8Array"+a+", got "+c;throw n?new RangeError(l):new TypeError(l)}return t}function vl(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("Hash must wrapped by utils.createHasher");if(yt(t.outputLen),yt(t.blockLen),t.outputLen<1)throw new Error('"outputLen" must be >= 1');if(t.blockLen<1)throw new Error('"blockLen" must be >= 1')}function hn(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function Ms(t,e){mn(t,void 0,"digestInto() output");let r=e.outputLen;if(t.length<r)throw new RangeError('"digestInto() output" expected to be of length >='+r)}function Ks(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function jt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function Hs(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function xr(t,e){return t<<32-e|t>>>e}function xe(t,e){return t<<e|t>>>32-e>>>0}var Gb=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function $b(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function Wb(t){for(let e=0;e<t.length;e++)t[e]=$b(t[e]);return t}var Fs=Gb?t=>t:Wb;function zb(t){if(typeof t!="string")throw new TypeError("string expected");return new Uint8Array(new TextEncoder().encode(t))}function Zd(t,e=""){return typeof t=="string"?zb(t):mn(t,void 0,e)}function Al(t,e){if(e!==void 0&&{}.toString.call(e)!=="[object Object]")throw new TypeError("options must be object or undefined");return Object.assign(t,e)}function Tl(t,e={}){let r=(i,s)=>t(s).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function ep(t=32){yt(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var _l=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var Il=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(vl(e),mn(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let s=0;s<i.length;s++)i[s]^=54;this.iHash.update(i),this.oHash=e.create();for(let s=0;s<i.length;s++)i[s]^=106;this.oHash.update(i),jt(i)}update(e){return hn(this),this.iHash.update(e),this}digestInto(e){hn(this),Ms(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:s,blockLen:o,outputLen:a}=this;return e=e,e.finished=i,e.destroyed=s,e.blockLen=o,e.outputLen=a,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Vy=(()=>{let t=((e,r,n)=>new Il(e,r).update(n).digest());return t.create=(e,r)=>new Il(e,r),t})();function Yb(t,e,r,n){vl(t);let i=Al({dkLen:32,asyncTick:10},n),{c:s,dkLen:o,asyncTick:a}=i;if(yt(s,"c"),yt(o,"dkLen"),yt(a,"asyncTick"),s<1)throw new Error("iterations (c) must be >= 1");if(o<1)throw new Error('"dkLen" must be >= 1');if(o>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=Zd(e,"password"),l=Zd(r,"salt"),d=new Uint8Array(o),p=Vy.create(t,c),m=p._cloneInto().update(l);return{c:s,dkLen:o,asyncTick:a,DK:d,PRF:p,PRFSalt:m}}function Xb(t,e,r,n,i){return t.destroy(),e.destroy(),n&&n.destroy(),jt(i),r}function tp(t,e,r,n){let{c:i,dkLen:s,DK:o,PRF:a,PRFSalt:c}=Yb(t,e,r,n),l,d=new Uint8Array(4),p=Hs(d),m=new Uint8Array(a.outputLen);for(let E=1,v=0;v<s;E++,v+=a.outputLen){let b=o.subarray(v,v+a.outputLen);p.setInt32(0,E,!1),(l=c._cloneInto(l)).update(d).digestInto(m),b.set(m.subarray(0,b.length));for(let k=1;k<i;k++){a._cloneInto(l).update(m).digestInto(m);for(let C=0;C<b.length;C++)b[C]^=m[C]}}return Xb(a,c,o,l,m)}function By(t,e,r){return t&e^~t&r}function qy(t,e,r){return t&e^t&r^e&r}var xl=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=Hs(this.buffer)}update(e){hn(this),mn(e);let{view:r,buffer:n,blockLen:i}=this,s=e.length;for(let o=0;o<s;){let a=Math.min(i-this.pos,s-o);if(a===i){let c=Hs(e);for(;i<=s-o;o+=i)this.process(c,o);continue}n.set(e.subarray(o,o+a),this.pos),this.pos+=a,o+=a,this.pos===i&&(this.process(r,0),this.pos=0)}return this.length+=e.length,this.roundClean(),this}digestInto(e){hn(this),Ms(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:s}=this,{pos:o}=this;r[o++]=128,jt(this.buffer.subarray(o)),this.padOffset>i-o&&(this.process(n,0),o=0);for(let p=o;p<i;p++)r[p]=0;n.setBigUint64(i-8,BigInt(this.length*8),s),this.process(n,0);let a=Hs(e),c=this.outputLen;if(c%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let l=c/4,d=this.get();if(l>d.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<l;p++)a.setUint32(4*p,d[p],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneInto(e){e||=new this.constructor,e.set(...this.get());let{blockLen:r,buffer:n,length:i,finished:s,destroyed:o,pos:a}=this;return e.destroyed=o,e.finished=s,e.length=i,e.pos=a,i%r&&e.buffer.set(n),e}clone(){return this._cloneInto()}},En=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var bl=BigInt(4294967295),jy=BigInt(32);function Qb(t,e=!1){return e?{h:Number(t&bl),l:Number(t>>jy&bl)}:{h:Number(t>>jy&bl)|0,l:Number(t&bl)|0}}function Gy(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let s=0;s<r;s++){let{h:o,l:a}=Qb(t[s],e);[n[s],i[s]]=[o,a]}return[n,i]}var $y=(t,e,r)=>t<<r|e>>>32-r,Wy=(t,e,r)=>e<<r|t>>>32-r,zy=(t,e,r)=>e<<r-32|t>>>64-r,Jy=(t,e,r)=>t<<r-32|e>>>64-r;var Zb=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Hn=new Uint32Array(64),rp=class extends xl{constructor(e){super(64,e,8,!1)}get(){let{A:e,B:r,C:n,D:i,E:s,F:o,G:a,H:c}=this;return[e,r,n,i,s,o,a,c]}set(e,r,n,i,s,o,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=s|0,this.F=o|0,this.G=a|0,this.H=c|0}process(e,r){for(let p=0;p<16;p++,r+=4)Hn[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let m=Hn[p-15],E=Hn[p-2],v=xr(m,7)^xr(m,18)^m>>>3,b=xr(E,17)^xr(E,19)^E>>>10;Hn[p]=b+Hn[p-7]+v+Hn[p-16]|0}let{A:n,B:i,C:s,D:o,E:a,F:c,G:l,H:d}=this;for(let p=0;p<64;p++){let m=xr(a,6)^xr(a,11)^xr(a,25),E=d+m+By(a,c,l)+Zb[p]+Hn[p]|0,b=(xr(n,2)^xr(n,13)^xr(n,22))+qy(n,i,s)|0;d=l,l=c,c=a,a=o+E|0,o=s,s=i,i=n,n=E+b|0}n=n+this.A|0,i=i+this.B|0,s=s+this.C|0,o=o+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,d=d+this.H|0,this.set(n,i,s,o,a,c,l,d)}roundClean(){jt(Hn)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),jt(this.buffer)}},np=class extends rp{A=En[0]|0;B=En[1]|0;C=En[2]|0;D=En[3]|0;E=En[4]|0;F=En[5]|0;G=En[6]|0;H=En[7]|0;constructor(){super(32)}};var ip=Tl(()=>new np,_l(1));function Yy(t,e,r,n,i,s){let o=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],d=t[e++]^r[n++],p=t[e++]^r[n++],m=t[e++]^r[n++],E=t[e++]^r[n++],v=t[e++]^r[n++],b=t[e++]^r[n++],k=t[e++]^r[n++],C=t[e++]^r[n++],L=t[e++]^r[n++],B=t[e++]^r[n++],G=t[e++]^r[n++],j=t[e++]^r[n++],$=o,te=a,A=c,x=l,S=d,y=p,_=m,w=E,R=v,N=b,O=k,P=C,U=L,K=B,W=G,J=j;for(let de=0;de<8;de+=2)S^=xe($+U|0,7),R^=xe(S+$|0,9),U^=xe(R+S|0,13),$^=xe(U+R|0,18),N^=xe(y+te|0,7),K^=xe(N+y|0,9),te^=xe(K+N|0,13),y^=xe(te+K|0,18),W^=xe(O+_|0,7),A^=xe(W+O|0,9),_^=xe(A+W|0,13),O^=xe(_+A|0,18),x^=xe(J+P|0,7),w^=xe(x+J|0,9),P^=xe(w+x|0,13),J^=xe(P+w|0,18),te^=xe($+x|0,7),A^=xe(te+$|0,9),x^=xe(A+te|0,13),$^=xe(x+A|0,18),_^=xe(y+S|0,7),w^=xe(_+y|0,9),S^=xe(w+_|0,13),y^=xe(S+w|0,18),P^=xe(O+N|0,7),R^=xe(P+O|0,9),N^=xe(R+P|0,13),O^=xe(N+R|0,18),U^=xe(J+W|0,7),K^=xe(U+J|0,9),W^=xe(K+U|0,13),J^=xe(W+K|0,18);i[s++]=o+$|0,i[s++]=a+te|0,i[s++]=c+A|0,i[s++]=l+x|0,i[s++]=d+S|0,i[s++]=p+y|0,i[s++]=m+_|0,i[s++]=E+w|0,i[s++]=v+R|0,i[s++]=b+N|0,i[s++]=k+O|0,i[s++]=C+P|0,i[s++]=L+U|0,i[s++]=B+K|0,i[s++]=G+W|0,i[s++]=j+J|0}function sp(t,e,r,n,i){let s=n+0,o=n+16*i;for(let a=0;a<16;a++)r[o+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,s+=16,e+=16)Yy(r,o,t,e,r,s),a>0&&(o+=16),Yy(r,s,t,e+=16,r,o)}function eS(t,e,r){let n=Al({dkLen:32,asyncTick:10,maxmem:1073742848},r),{N:i,r:s,p:o,dkLen:a,asyncTick:c,maxmem:l,onProgress:d}=n;if(yt(i,"N"),yt(s,"r"),yt(o,"p"),yt(a,"dkLen"),yt(c,"asyncTick"),yt(l,"maxmem"),d!==void 0&&typeof d!="function")throw new Error("progressCb must be a function");let p=128*s,m=p/4,E=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>E)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(o<1||o>(E-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(E-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let v=p*(i+o+1);if(v>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+v+", maxmem="+l);let b=tp(ip,t,e,{c:1,dkLen:p*o}),k=Ks(b),C=Ks(new Uint8Array(p*i)),L=Ks(new Uint8Array(p)),B=()=>{};if(d){let G=2*i*o,j=Math.max(Math.floor(G/1e4),1),$=0;B=()=>{$++,d&&(!($%j)||$===G)&&d($/G)}}return{N:i,r:s,p:o,dkLen:a,blockSize32:m,V:C,B32:k,B:b,tmp:L,blockMixCb:B,asyncTick:c}}function tS(t,e,r,n,i){let s=tp(ip,t,r,{c:1,dkLen:e});return jt(r,n,i),s}function Sl(t,e,r){let{N:n,r:i,p:s,dkLen:o,blockSize32:a,V:c,B32:l,B:d,tmp:p,blockMixCb:m}=eS(t,e,r);Fs(l);for(let E=0;E<s;E++){let v=a*E;for(let b=0;b<a;b++)c[b]=l[v+b];for(let b=0,k=0;b<n-1;b++)sp(c,k,c,k+=a,i),m();sp(c,(n-1)*a,l,v,i),m();for(let b=0;b<n;b++){let k=(l[v+a-16]&n-1)>>>0;for(let C=0;C<a;C++)p[C]=l[v+C]^c[k*a+C];sp(p,0,l,v,i),m()}}return Fs(l),tS(t,o,d,c,p)}var rS={N:2**15,r:8,p:1,dkLen:32,saltLength:32},nS={N:2**14,r:8,p:1};function Xy(t,e,r){return`${t.N}.${t.r}.${t.p}.${Qy(e)}.${Qy(r)}`}function iS(t){let e=t.split(".");if(e.length===5){let[r,n,i,s,o]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:Nl(s),expected:Nl(o)}}if(e.length===2){let[r,n]=e;return{params:nS,salt:Nl(r),expected:Nl(n)}}return null}function Qy(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Nl(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function Zy(t={}){let e={...rS,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=ep(e.saltLength),s=await Sl(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),o=Xy({N:e.N,r:e.r,p:e.p},i,s);return g({value:o,data:n.metadata??null})}catch(i){let s=i instanceof Error?i.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async update(n,i){if(!n.value)return g({});try{if(typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let s=ep(e.saltLength),o=await Sl(r.encode(n.value),s,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=Xy({N:e.N,r:e.r,p:e.p},s,o);return g({value:a,...n.data&&{data:n.data}})}catch(s){let o=s instanceof Error?s.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async verify(n){try{if(!n.credential?.value)return u([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return u([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=iS(n.credential.value);if(!i)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:s,salt:o,expected:a}=i;if(o.length!==e.saltLength||a.length!==e.dkLen)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await Sl(r.encode(n.credentialValue),o,{N:s.N,r:s.r,p:s.p,dkLen:e.dkLen});if(c.length!==a.length)return u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?g({userId:n.userId,credentialId:"password"}):u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),u([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var tg=Pf(eg(),1);function rg(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new tg.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let s=r.browser.name??"",o=r.os.name??"";return{deviceName:i,browser:s,os:o,browserName:s,osName:o}}}}import{createHash as sS}from"node:crypto";import{SendMessageCommand as oS,SQSClient as aS}from"@aws-sdk/client-sqs";var cS={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var Rl=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new aS(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new oS({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:lS(n)})}return g(void 0)}catch(r){return u({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},s=this.config.eventTypeMap?.[e.template]??cS[e.template]??e.template,o=_i(i.eventId)??_i(i.challengeId)??crypto.randomUUID(),a=n?`${o}:${uS(r)}`:o,c=_i(i.locale),l=_i(i.traceId)??a,d=dS(this.config.defaultMetadata,i),p=pS(i);if(this.config.envelope==="snapshot-auth-v1"){let m=_i(d?.tenantId),E=_i(d?.tenantType),v=_i(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:s,to:r,...v?{userId:v}:{},...m?{tenantId:m}:{},...E?{tenantType:E}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:s,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...d?{metadata:d}:{},data:p}}};function _i(t){return typeof t=="string"&&t.length>0?t:void 0}function lS(t){return t.split("@")[1]||"(unknown)"}function uS(t){return sS("sha256").update(t).digest("hex").slice(0,16)}function dS(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function pS(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var aa=class t{static createAwsSqs(e){return new Rl(e)}static create(e){return t.createAwsSqs(e.sqs)}};var Qv=Pf(Xv(),1);var Ll=class{transporter;config;name="email-system-direct-smtp";version="1.0.0";constructor(e){this.config=e,this.transporter=Qv.default.createTransport({host:e.host,port:e.port,secure:e.secure||!1,auth:e.auth,tls:e.tls})}async initialize(){await this.transporter.verify()}async send(e){try{let r=e,n,i,s;switch(e.template){case"verification":{let a=e.variables?.code;n="X\xE1c th\u1EF1c t\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n",i=this.getVerificationEmailTemplate(a),s=`M\xE3 x\xE1c th\u1EF1c c\u1EE7a b\u1EA1n l\xE0: ${a}`;break}case"password-reset":{let a=e.variables?.token;n="\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u",i=this.getPasswordResetEmailTemplate(a),s=`\u0110\u1EC3 \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, h\xE3y s\u1EED d\u1EE5ng token sau: ${a}`;break}case"custom":n=e.variables?.subject||e.subject||"Th\xF4ng b\xE1o",i=e.variables?.html||r.html||"",s=e.variables?.text||r.text||"";break;default:n=e.subject||"Th\xF4ng b\xE1o",i=r.html||"",s=r.text||""}let o={from:`${this.config.fromName||""} <${this.config.fromEmail}>`,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:n,text:s,html:i,replyTo:r.replyTo,cc:r.cc?Array.isArray(r.cc)?r.cc.join(", "):r.cc:void 0,bcc:r.bcc?Array.isArray(r.bcc)?r.bcc.join(", "):r.bcc:void 0};return await this.transporter.sendMail(o),g(void 0)}catch(r){return u({code:"EMAIL_SEND_ERROR",message:r instanceof Error?r.message:"Failed to send email"})}}async cleanup(){this.transporter.close()}getVerificationEmailTemplate(e){return`
-      <!DOCTYPE html>
-      <html>
-      <head>
-        <meta charset="utf-8">
-        <title>X\xE1c th\u1EF1c t\xE0i kho\u1EA3n</title>
-        <style>
-          body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
-          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
-          .header { background-color: #f4f4f4; padding: 20px; text-align: center; }
-          .content { padding: 20px; }
-          .code { background-color: #f8f9fa; padding: 15px; text-align: center; font-size: 24px; font-weight: bold; letter-spacing: 2px; margin: 20px 0; border: 2px dashed #007bff; }
-          .footer { background-color: #f8f9fa; padding: 15px; text-align: center; font-size: 12px; color: #666; }
-        </style>
-      </head>
-      <body>
-        <div class="container">
-          <div class="header">
-            <h1>X\xE1c th\u1EF1c t\xE0i kho\u1EA3n</h1>
-          </div>
-          <div class="content">
-            <p>Xin ch\xE0o,</p>
-            <p>C\u1EA3m \u01A1n b\u1EA1n \u0111\xE3 \u0111\u0103ng k\xFD t\xE0i kho\u1EA3n. \u0110\u1EC3 ho\xE0n t\u1EA5t qu\xE1 tr\xECnh \u0111\u0103ng k\xFD, vui l\xF2ng s\u1EED d\u1EE5ng m\xE3 x\xE1c th\u1EF1c sau:</p>
-            <div class="code">${e}</div>
-            <p>M\xE3 n\xE0y c\xF3 hi\u1EC7u l\u1EF1c trong 15 ph\xFAt. N\u1EBFu b\u1EA1n kh\xF4ng y\xEAu c\u1EA7u m\xE3 n\xE0y, vui l\xF2ng b\u1ECF qua email n\xE0y.</p>
-            <p>Tr\xE2n tr\u1ECDng,<br>\u0110\u1ED9i ng\u0169 h\u1ED7 tr\u1EE3</p>
-          </div>
-          <div class="footer">
-            <p>Email n\xE0y \u0111\u01B0\u1EE3c g\u1EEDi t\u1EF1 \u0111\u1ED9ng, vui l\xF2ng kh\xF4ng tr\u1EA3 l\u1EDDi.</p>
-          </div>
-        </div>
-      </body>
-      </html>
-    `}getPasswordResetEmailTemplate(e){return`
-      <!DOCTYPE html>
-      <html>
-      <head>
-        <meta charset="utf-8">
-        <title>\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u</title>
-        <style>
-          body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
-          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
-          .header { background-color: #f4f4f4; padding: 20px; text-align: center; }
-          .content { padding: 20px; }
-          .token { background-color: #f8f9fa; padding: 15px; text-align: center; font-size: 18px; font-weight: bold; word-break: break-all; margin: 20px 0; border: 2px dashed #dc3545; }
-          .footer { background-color: #f8f9fa; padding: 15px; text-align: center; font-size: 12px; color: #666; }
-        </style>
-      </head>
-      <body>
-        <div class="container">
-          <div class="header">
-            <h1>\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u</h1>
-          </div>
-          <div class="content">
-            <p>Xin ch\xE0o,</p>
-            <p>Ch\xFAng t\xF4i nh\u1EADn \u0111\u01B0\u1EE3c y\xEAu c\u1EA7u \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u cho t\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n. \u0110\u1EC3 \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, vui l\xF2ng s\u1EED d\u1EE5ng token sau:</p>
-            <div class="token">${e}</div>
-            <p>Token n\xE0y c\xF3 hi\u1EC7u l\u1EF1c trong 1 gi\u1EDD. N\u1EBFu b\u1EA1n kh\xF4ng y\xEAu c\u1EA7u \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, vui l\xF2ng b\u1ECF qua email n\xE0y.</p>
-            <p>Tr\xE2n tr\u1ECDng,<br>\u0110\u1ED9i ng\u0169 h\u1ED7 tr\u1EE3</p>
-          </div>
-          <div class="footer">
-            <p>Email n\xE0y \u0111\u01B0\u1EE3c g\u1EEDi t\u1EF1 \u0111\u1ED9ng, vui l\xF2ng kh\xF4ng tr\u1EA3 l\u1EDDi.</p>
-          </div>
-        </div>
-      </body>
-      </html>
-    `}};var Ea=class t{static createDirectSmtp(e){return new Ll(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var Rw={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function Zv(t={}){let e={...Rw,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let s=e.requireTLD?"[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${s}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return u([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return u([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return u([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let s=i.split("@");if(s.length!==2)return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[o,a]=s;return!o||o.length>64?u([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?u([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):g()}}}function Zp(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function Ow(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function ef(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Ow(r)}var tf="email",Ml={EMAIL_SYSTEM_NOT_AVAILABLE:T("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:T("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:T("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:T("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function kw(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function eA(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:tf,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return u(Ml.EMAIL_SYSTEM_NOT_AVAILABLE());let s=await i.plugins.database.users.getById(n.userId),o=s.ok&&s.data?s.data.contactEmail:void 0;if(!o)return u(Ml.RECIPIENT_NOT_FOUND());let a=Zp(e),c=await ef(a);return(await i.plugins.emailSystem.send({to:o,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?u(Ml.SEND_FAILED()):g({codeHash:c,maskedRecipient:kw(o)})},async issueChallenge(n){return g({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(tf)?[tf]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(Ml.USE_CHALLENGE_CODE_HASH())}}}var tA="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function Kl(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let s="";for(let o of i)s+=tA[o%tA.length];r.push(s)}return r}function Cw(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Hl(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return Cw(r)}function Dw(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function rf(t,e){let r=await Hl(t),n=null;for(let i of e)Dw(r,i)&&(n=i);return n}var nf="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function rA(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let s of e){let o=nf.indexOf(s);if(o===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|o,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function nA(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=nf[r>>>e&31];return e>0&&(n+=nf[r<<5-e&31]),n}function Fl(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),nA(e)}function Pw(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function Uw(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,Pw(e))),s=i[i.length-1]&15;return(((i[s]&127)<<24|(i[s+1]&255)<<16|(i[s+2]&255)<<8|i[s+3]&255)%10**r).toString().padStart(r,"0")}async function Vl(t,e,r=Date.now(),n={}){let i=n.period??30,s=n.digits??6,o=n.window??1,a=e.trim();if(a.length!==s||!/^\d+$/u.test(a))return!1;let c=rA(t),l=Math.floor(r/1e3/i),d=!1;for(let p=-o;p<=o;p++){let m=await Uw(c,l+p,s);Lw(m,a)&&(d=!0)}return d}function Lw(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function iA(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var sf="totp",Mw={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function sA(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:sf,requiresServerDelivery:!1,generateSecret(){return Fl()},generateBackupCodes(i){return Kl(i||r)},async issueChallenge(i){return g({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(sf)?[sf]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(Mw.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let s=Fl(),o=Kl(r),a=await Promise.all(o.map(p=>Hl(p))),c=i.data.accountName??i.userId,l=iA({secretBase32:s,accountName:c,issuer:e});return g({secret:s,otpauthUri:l,backupCodes:o,credentialData:{secret:s,backupCodeHashes:a}})},async verifyWithCredentials(i){let s=i.credentialData,o=i.data.code?.trim();if(!o||!s?.secret)return g({verified:!1,data:{}});if(await Vl(s.secret,o,Date.now(),{window:n}))return g({verified:!0,data:{}});let c=s.backupCodeHashes??[];if(c.length>0){let l=await rf(o,c);if(l)return g({verified:!0,data:{usedBackupCodeHash:l}})}return g({verified:!1,data:{}})},async verifyCredential(i,s){let o=i.data.code,a=i.data.secret;if(!o||!a)return g({verified:!1,data:{}});let c=await Vl(a,o,Date.now(),{window:n});return g({verified:c,data:{}})}}}var of={scopes:["email","public_profile"],apiVersion:"v18.0"};var Yr={INVALID_CODE:T("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:T("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function af(t={}){let{scopes:e=of.scopes,apiVersion:r=of.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,s){let o=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...s&&{state:s}});return`${n.AUTHORIZATION}?${o.toString()}`},async exchangeCodeForToken(i,s){try{if(!i)return u(Yr.INVALID_CODE());let o=new URLSearchParams({client_id:s.clientId,client_secret:s.clientSecret,code:i,redirect_uri:s.redirectUri}),a=await fetch(`${n.TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Yr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return g({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(o){return console.error("Facebook token exchange error:",o),u(Yr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return u(Yr.INVALID_TOKEN());let s=["id","email","name","first_name","last_name","picture","locale"],o=new URLSearchParams({fields:s.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Yr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return g(l)}catch(s){return console.error("Facebook user profile error:",s),u(Yr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return u(Yr.INVALID_TOKEN());let s=`${t.appId}|${t.appSecret}`,o=new URLSearchParams({input_token:i,access_token:s}),a=await fetch(`${n.DEBUG_TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):u(Yr.INVALID_TOKEN()):u(Yr.INVALID_TOKEN())}catch(s){return console.error("Facebook token verification error:",s),u(Yr.INVALID_TOKEN())}}}}var Bl={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},bi={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var et={INVALID_CODE:T("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:T("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:T("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:T("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:T("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function Kw(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function Hw(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=Kw(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function cf(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=Bl.scopes,accessType:s=Bl.accessType,includeGrantedScopes:o=Bl.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let d=c?.clientId??e,p=c?.redirectUri??n;if(!d||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let m=new URLSearchParams({client_id:d,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:s,...l&&{state:l},...a&&{prompt:a},...o&&{include_granted_scopes:"true"}});return`${bi.AUTHORIZATION}?${m.toString()}`},async exchangeCodeForToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r,m=l?.redirectUri??n;try{if(!c)return u(et.INVALID_CODE());if(!d||!p||!m)return u(et.MISSING_CONFIG());let E=new URLSearchParams({client_id:d,client_secret:p,code:c,redirect_uri:m,grant_type:"authorization_code"}),v=await fetch(bi.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E.toString()});if(!v.ok)return console.error("Google token exchange failed with status:",v.status),u(et.TOKEN_EXCHANGE_FAILED());let b=await v.json();return g({accessToken:b.access_token,...b.refresh_token&&{refreshToken:b.refresh_token},...b.expires_in&&{expiresIn:b.expires_in}})}catch(E){return console.error("Google token exchange error:",E),u(et.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return u(et.INVALID_TOKEN());let l=await fetch(bi.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),u(et.USER_PROFILE_FAILED());let d=await l.json(),p={id:d.id,...d.email&&{email:d.email},...d.verified_email!==void 0&&{emailVerified:d.verified_email},...d.name&&{name:d.name},...d.given_name&&{givenName:d.given_name},...d.family_name&&{familyName:d.family_name},...d.picture&&{avatarUrl:d.picture},...d.locale&&{locale:d.locale},provider:"google"};return g(p)}catch(l){return console.error("Google user profile error:",l),u(et.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return u(et.INVALID_TOKEN());let l=await fetch(`${bi.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return u(et.INVALID_TOKEN());let d=await l.json();return parseInt(d.expires_in,10)<=0?u(et.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),u(et.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return u(et.INVALID_CREDENTIAL());let l=await fetch(`${bi.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),u(et.INVALID_CREDENTIAL());let d=await l.json();if(!e)return u(et.MISSING_CONFIG());if(d.aud!==e)return u(et.INVALID_CREDENTIAL());if(parseInt(d.expires_in,10)<=0)return u(et.INVALID_CREDENTIAL());let m=d.email_verified==="true",E=Hw(c),v={id:d.sub,...d.email&&{email:d.email},...d.email&&{emailVerified:m},...E?.name&&{name:E.name},...E?.given_name&&{givenName:E.given_name},...E?.family_name&&{familyName:E.family_name},...E?.picture&&{avatarUrl:E.picture},...E?.locale&&{locale:E.locale},provider:"google"};return g(v)}catch(l){return console.error("Google credential verification error:",l),u(et.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return u(et.INVALID_TOKEN());if(!d||!p)return u(et.MISSING_CONFIG());let m=new URLSearchParams({client_id:d,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),E=await fetch(bi.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:m.toString()});if(!E.ok)return console.error("Google refresh token failed with status:",E.status),u(et.REFRESH_TOKEN_FAILED());let v=await E.json();return g({accessToken:v.access_token,...v.expires_in&&{expiresIn:v.expires_in}})}catch(m){return console.error("Google refresh token error:",m),u(et.REFRESH_TOKEN_FAILED())}}}}function oA(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function s(){if(n===0)return;let o=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(d=>d>o);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(s,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(o,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let d=Date.now(),p=d-l,m=e.get(o)??{hits:[]},E=m.hits.filter(v=>v>p);if(E.length>=c){let v=E[0]??d,b=Math.max(0,v+l-d);return m.hits=E,e.set(o,m),{allowed:!1,remaining:0,retryAfterMs:b,limit:c}}return E.push(d),m.hits=E,e.set(o,m),{allowed:!0,remaining:c-E.length,retryAfterMs:0,limit:c}},async reset(o){e.delete(o)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as a0,DynamoDBClient as c0}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as l0}from"@aws-sdk/lib-dynamodb";var M={DatabaseConnectionError:T("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:X("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:X("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:X("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:X("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:T("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:T("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:X("INVALID_DATA","Invalid data: {reason}"),Timeout:T("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:T("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:X("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:X("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function ne(t){return t.getTime()}function z(t){return new Date(t)}function aA(t){return Math.floor(t/1e3)}function ae(){return Date.now()}function ya(t){return t instanceof Date?aA(t.getTime()):aA(t)}function lf(t){return t<Date.now()}function Nr(t){return t?ne(t):null}function Ht(t){return t==null?null:z(t)}function Ft(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function wr(t){let e=[],r=[],n={},i={},s=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let d=`#${c}`;if(n[d]=c,l==null)r.push(d);else{let p=`:val${s}`;e.push(`${d} = ${p}`),i[p]=l,s++}}let o=[];return e.length>0&&o.push(`SET ${e.join(", ")}`),r.length>0&&o.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:o.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function uf(t="PK"){return`attribute_not_exists(${t})`}var df={USER:"USR"},ce={USER:`${df.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Ve={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},St="#",D={USER_PK:t=>`${ce.USER}${t}`,USER_AUTH_SK:()=>Ve.AUTH,USER_PROFILE_SK:()=>Ve.PROFILE,USER_MFA_SK:t=>`${Ve.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Ve.MFA}${t}${St}${e}`,TENANT_MEMBER_PK:t=>`${ce.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ce.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Ve.OWNER,TENANT_PK:t=>`${ce.TENANT}${t}`,TENANT_SK:()=>Ve.METADATA,INVITE_PK:t=>`${ce.INVITE}${t}`,INVITE_SK:()=>Ve.METADATA,TENANT_PROFILE_PK:t=>`${ce.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Ve.TENANT_PROFILE}${ce.USER}${t}`,SESSION_PK:t=>`${ce.SESSION}${t}`,SESSION_METADATA_SK:()=>Ve.METADATA,SESSION_SK:()=>Ve.METADATA,PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${St}${e}`,PROVIDER_PK:(t,e)=>`${ce.PROVIDER}${t}${St}${e}`,PROVIDER_METADATA_SK:()=>Ve.METADATA,CHALLENGE_PK:t=>`${ce.CHALLENGE}${t}`,CHALLENGE_SK:()=>Ve.METADATA,IDENTITY_PK:(t,e)=>`${ce.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Ve.METADATA,CREDENTIAL_PK:t=>`${ce.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Ve.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ce.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ce.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ce.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ce.IDENTITY}${t}#${e}`},le={userId:t=>t.slice(ce.USER.length),sessionId:t=>t.slice(ce.SESSION.length),providerPKInfo:t=>{let e=t.slice(ce.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Ve.PROVIDER.length),r=e.indexOf(St);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Ve.MFA.length),r=e.indexOf(St);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ce.TENANT.length),tenantMemberUserId:t=>t.slice(ce.USER.length),challengeIdFromPK:t=>t.slice(ce.CHALLENGE.length),inviteId:t=>t.slice(ce.INVITE.length),tenantProfileUserId:t=>t.slice(Ve.TENANT_PROFILE.length+ce.USER.length),identityPKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ce.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ce.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ce.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${St}${e}`,USER_SESSION_PK:t=>`${ce.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${St}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${df.USER}${St}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ce.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${St}${e}`,INVITE_TENANT_PK:t=>`${ce.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${St}${e}${St}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${St}`,USER_TENANT_PK:t=>`${ce.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${St}${e??"ROOT"}${St}${r}${St}${n}`},f={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},Se={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},ql={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${St}${e}`,extractCreatedAt:t=>{let e=t.indexOf(St),r=e===-1?t:t.slice(0,e);return Number(r)}};import{DeleteCommand as sR,GetCommand as oR,PutCommand as aR,UpdateCommand as TA}from"@aws-sdk/lib-dynamodb";var Fw=BigInt(0),ga=BigInt(1),Vw=BigInt(2),Bw=BigInt(7),qw=BigInt(256),jw=BigInt(113),uA=[],dA=[],pA=[];for(let t=0,e=ga,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],uA.push(2*(5*n+r)),dA.push((t+1)*(t+2)/2%64);let i=Fw;for(let s=0;s<7;s++)e=(e<<ga^(e>>Bw)*jw)%qw,e&Vw&&(i^=ga<<(ga<<BigInt(s))-ga);pA.push(i)}var fA=Gy(pA,!0),Gw=fA[0],$w=fA[1],cA=(t,e,r)=>r>32?zy(t,e,r):$y(t,e,r),lA=(t,e,r)=>r>32?Jy(t,e,r):Wy(t,e,r);function Ww(t,e=24){if(yt(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');let r=new Uint32Array(10);for(let n=24-e;n<24;n++){for(let o=0;o<10;o++)r[o]=t[o]^t[o+10]^t[o+20]^t[o+30]^t[o+40];for(let o=0;o<10;o+=2){let a=(o+8)%10,c=(o+2)%10,l=r[c],d=r[c+1],p=cA(l,d,1)^r[a],m=lA(l,d,1)^r[a+1];for(let E=0;E<50;E+=10)t[o+E]^=p,t[o+E+1]^=m}let i=t[2],s=t[3];for(let o=0;o<24;o++){let a=dA[o],c=cA(i,s,a),l=lA(i,s,a),d=uA[o];i=t[d],s=t[d+1],t[d]=c,t[d+1]=l}for(let o=0;o<50;o+=10){let a=t[o],c=t[o+1],l=t[o+2],d=t[o+3];t[o]^=~t[o+2]&t[o+4],t[o+1]^=~t[o+3]&t[o+5],t[o+2]^=~t[o+4]&t[o+6],t[o+3]^=~t[o+5]&t[o+7],t[o+4]^=~t[o+6]&t[o+8],t[o+5]^=~t[o+7]&t[o+9],t[o+6]^=~t[o+8]&a,t[o+7]^=~t[o+9]&c,t[o+8]^=~a&l,t[o+9]^=~c&d}t[0]^=Gw[n],t[1]^=$w[n]}jt(r)}var pf=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,s=24){if(this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=s,yt(n,"outputLen"),!(0<e&&e<200))throw new Error("only keccak-f1600 function is supported");this.state=new Uint8Array(200),this.state32=Ks(this.state)}clone(){return this._cloneInto()}keccak(){Fs(this.state32),Ww(this.state32,this.rounds),Fs(this.state32),this.posOut=0,this.pos=0}update(e){hn(this),mn(e);let{blockLen:r,state:n}=this,i=e.length;for(let s=0;s<i;){let o=Math.min(r-this.pos,i-s);for(let a=0;a<o;a++)n[this.pos++]^=e[s++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){hn(this,!1),mn(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,s=e.length;i<s;){this.posOut>=n&&this.keccak();let o=Math.min(n-this.posOut,s-i);e.set(r.subarray(this.posOut,this.posOut+o),i),this.posOut+=o,i+=o}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not possible for this instance");return this.writeInto(e)}xof(e){return yt(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(Ms(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,jt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:s,enableXOF:o}=this;return e||=new t(r,n,i,o,s),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=s,e.suffix=n,e.outputLen=i,e.enableXOF=o,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},zw=(t,e,r,n={})=>Tl(()=>new pf(e,t,r),n);var mA=zw(6,72,64,_l(10));var Jw=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,ff=Math.ceil,pr=Math.floor,Gt="[BigNumber Error] ",hA=Gt+"Number primitive has more than 15 significant digits: ",Rr=1e14,ue=14,mf=9007199254740991,hf=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],Bn=1e7,vt=1e9;function EA(t){var e,r,n,i=L.prototype={constructor:L,toString:null,valueOf:null},s=new L(1),o=20,a=4,c=-7,l=21,d=-1e7,p=1e7,m=!1,E=1,v=0,b={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},k="0123456789abcdefghijklmnopqrstuvwxyz",C=!0;function L(A,x){var S,y,_,w,R,N,O,P,U=this;if(!(U instanceof L))return new L(A,x);if(x==null){if(A&&A._isBigNumber===!0){U.s=A.s,!A.c||A.e>p?U.c=U.e=null:A.e<d?U.c=[U.e=0]:(U.e=A.e,U.c=A.c.slice());return}if((N=typeof A=="number")&&A*0==0){if(U.s=1/A<0?(A=-A,-1):1,A===~~A){for(w=0,R=A;R>=10;R/=10,w++);w>p?U.c=U.e=null:(U.e=w,U.c=[A]);return}P=String(A)}else{if(!Jw.test(P=String(A)))return n(U,P,N);U.s=P.charCodeAt(0)==45?(P=P.slice(1),-1):1}(w=P.indexOf("."))>-1&&(P=P.replace(".","")),(R=P.search(/e/i))>0?(w<0&&(w=R),w+=+P.slice(R+1),P=P.substring(0,R)):w<0&&(w=P.length)}else{if(We(x,2,k.length,"Base"),x==10&&C)return U=new L(A),$(U,o+U.e+1,a);if(P=String(A),N=typeof A=="number"){if(A*0!=0)return n(U,P,N,x);if(U.s=1/A<0?(P=P.slice(1),-1):1,L.DEBUG&&P.replace(/^0\.0*|\./,"").length>15)throw Error(hA+A)}else U.s=P.charCodeAt(0)===45?(P=P.slice(1),-1):1;for(S=k.slice(0,x),w=R=0,O=P.length;R<O;R++)if(S.indexOf(y=P.charAt(R))<0){if(y=="."){if(R>w){w=O;continue}}else if(!_&&(P==P.toUpperCase()&&(P=P.toLowerCase())||P==P.toLowerCase()&&(P=P.toUpperCase()))){_=!0,R=-1,w=0;continue}return n(U,String(A),N,x)}N=!1,P=r(P,x,10,U.s),(w=P.indexOf("."))>-1?P=P.replace(".",""):w=P.length}for(R=0;P.charCodeAt(R)===48;R++);for(O=P.length;P.charCodeAt(--O)===48;);if(P=P.slice(R,++O)){if(O-=R,N&&L.DEBUG&&O>15&&(A>mf||A!==pr(A)))throw Error(hA+U.s*A);if((w=w-R-1)>p)U.c=U.e=null;else if(w<d)U.c=[U.e=0];else{if(U.e=w,U.c=[],R=(w+1)%ue,w<0&&(R+=ue),R<O){for(R&&U.c.push(+P.slice(0,R)),O-=ue;R<O;)U.c.push(+P.slice(R,R+=ue));R=ue-(P=P.slice(R)).length}else R-=O;for(;R--;P+="0");U.c.push(+P)}}else U.c=[U.e=0]}L.clone=EA,L.ROUND_UP=0,L.ROUND_DOWN=1,L.ROUND_CEIL=2,L.ROUND_FLOOR=3,L.ROUND_HALF_UP=4,L.ROUND_HALF_DOWN=5,L.ROUND_HALF_EVEN=6,L.ROUND_HALF_CEIL=7,L.ROUND_HALF_FLOOR=8,L.EUCLID=9,L.config=L.set=function(A){var x,S;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(x="DECIMAL_PLACES")&&(S=A[x],We(S,0,vt,x),o=S),A.hasOwnProperty(x="ROUNDING_MODE")&&(S=A[x],We(S,0,8,x),a=S),A.hasOwnProperty(x="EXPONENTIAL_AT")&&(S=A[x],S&&S.pop?(We(S[0],-vt,0,x),We(S[1],0,vt,x),c=S[0],l=S[1]):(We(S,-vt,vt,x),c=-(l=S<0?-S:S))),A.hasOwnProperty(x="RANGE"))if(S=A[x],S&&S.pop)We(S[0],-vt,-1,x),We(S[1],1,vt,x),d=S[0],p=S[1];else if(We(S,-vt,vt,x),S)d=-(p=S<0?-S:S);else throw Error(Gt+x+" cannot be zero: "+S);if(A.hasOwnProperty(x="CRYPTO"))if(S=A[x],S===!!S)if(S)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))m=S;else throw m=!S,Error(Gt+"crypto unavailable");else m=S;else throw Error(Gt+x+" not true or false: "+S);if(A.hasOwnProperty(x="MODULO_MODE")&&(S=A[x],We(S,0,9,x),E=S),A.hasOwnProperty(x="POW_PRECISION")&&(S=A[x],We(S,0,vt,x),v=S),A.hasOwnProperty(x="FORMAT"))if(S=A[x],typeof S=="object")b=S;else throw Error(Gt+x+" not an object: "+S);if(A.hasOwnProperty(x="ALPHABET"))if(S=A[x],typeof S=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(S))C=S.slice(0,10)=="0123456789",k=S;else throw Error(Gt+x+" invalid: "+S)}else throw Error(Gt+"Object expected: "+A);return{DECIMAL_PLACES:o,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[d,p],CRYPTO:m,MODULO_MODE:E,POW_PRECISION:v,FORMAT:b,ALPHABET:k}},L.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!L.DEBUG)return!0;var x,S,y=A.c,_=A.e,w=A.s;e:if({}.toString.call(y)=="[object Array]"){if((w===1||w===-1)&&_>=-vt&&_<=vt&&_===pr(_)){if(y[0]===0){if(_===0&&y.length===1)return!0;break e}if(x=(_+1)%ue,x<1&&(x+=ue),String(y[0]).length==x){for(x=0;x<y.length;x++)if(S=y[x],S<0||S>=Rr||S!==pr(S))break e;if(S!==0)return!0}}}else if(y===null&&_===null&&(w===null||w===1||w===-1))return!0;throw Error(Gt+"Invalid BigNumber: "+A)},L.maximum=L.max=function(){return G(arguments,-1)},L.minimum=L.min=function(){return G(arguments,1)},L.random=(function(){var A=9007199254740992,x=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(S){var y,_,w,R,N,O=0,P=[],U=new L(s);if(S==null?S=o:We(S,0,vt),R=ff(S/ue),m)if(crypto.getRandomValues){for(y=crypto.getRandomValues(new Uint32Array(R*=2));O<R;)N=y[O]*131072+(y[O+1]>>>11),N>=9e15?(_=crypto.getRandomValues(new Uint32Array(2)),y[O]=_[0],y[O+1]=_[1]):(P.push(N%1e14),O+=2);O=R/2}else if(crypto.randomBytes){for(y=crypto.randomBytes(R*=7);O<R;)N=(y[O]&31)*281474976710656+y[O+1]*1099511627776+y[O+2]*4294967296+y[O+3]*16777216+(y[O+4]<<16)+(y[O+5]<<8)+y[O+6],N>=9e15?crypto.randomBytes(7).copy(y,O):(P.push(N%1e14),O+=7);O=R/7}else throw m=!1,Error(Gt+"crypto unavailable");if(!m)for(;O<R;)N=x(),N<9e15&&(P[O++]=N%1e14);for(R=P[--O],S%=ue,R&&S&&(N=hf[ue-S],P[O]=pr(R/N)*N);P[O]===0;P.pop(),O--);if(O<0)P=[w=0];else{for(w=-1;P[0]===0;P.splice(0,1),w-=ue);for(O=1,N=P[0];N>=10;N/=10,O++);O<ue&&(w-=ue-O)}return U.e=w,U.c=P,U}})(),L.sum=function(){for(var A=1,x=arguments,S=new L(x[0]);A<x.length;)S=S.plus(x[A++]);return S},r=(function(){var A="0123456789";function x(S,y,_,w){for(var R,N=[0],O,P=0,U=S.length;P<U;){for(O=N.length;O--;N[O]*=y);for(N[0]+=w.indexOf(S.charAt(P++)),R=0;R<N.length;R++)N[R]>_-1&&(N[R+1]==null&&(N[R+1]=0),N[R+1]+=N[R]/_|0,N[R]%=_)}return N.reverse()}return function(S,y,_,w,R){var N,O,P,U,K,W,J,de,ke=S.indexOf("."),He=o,fe=a;for(ke>=0&&(U=v,v=0,S=S.replace(".",""),de=new L(y),W=de.pow(S.length-ke),v=U,de.c=x(yn(dr(W.c),W.e,"0"),10,_,A),de.e=de.c.length),J=x(S,y,_,R?(N=k,A):(N=A,k)),P=U=J.length;J[--U]==0;J.pop());if(!J[0])return N.charAt(0);if(ke<0?--P:(W.c=J,W.e=P,W.s=w,W=e(W,de,He,fe,_),J=W.c,K=W.r,P=W.e),O=P+He+1,ke=J[O],U=_/2,K=K||O<0||J[O+1]!=null,K=fe<4?(ke!=null||K)&&(fe==0||fe==(W.s<0?3:2)):ke>U||ke==U&&(fe==4||K||fe==6&&J[O-1]&1||fe==(W.s<0?8:7)),O<1||!J[0])S=K?yn(N.charAt(1),-He,N.charAt(0)):N.charAt(0);else{if(J.length=O,K)for(--_;++J[--O]>_;)J[O]=0,O||(++P,J=[1].concat(J));for(U=J.length;!J[--U];);for(ke=0,S="";ke<=U;S+=N.charAt(J[ke++]));S=yn(S,P,N.charAt(0))}return S}})(),e=(function(){function A(y,_,w){var R,N,O,P,U=0,K=y.length,W=_%Bn,J=_/Bn|0;for(y=y.slice();K--;)O=y[K]%Bn,P=y[K]/Bn|0,R=J*O+P*W,N=W*O+R%Bn*Bn+U,U=(N/w|0)+(R/Bn|0)+J*P,y[K]=N%w;return U&&(y=[U].concat(y)),y}function x(y,_,w,R){var N,O;if(w!=R)O=w>R?1:-1;else for(N=O=0;N<w;N++)if(y[N]!=_[N]){O=y[N]>_[N]?1:-1;break}return O}function S(y,_,w,R){for(var N=0;w--;)y[w]-=N,N=y[w]<_[w]?1:0,y[w]=N*R+y[w]-_[w];for(;!y[0]&&y.length>1;y.splice(0,1));}return function(y,_,w,R,N){var O,P,U,K,W,J,de,ke,He,fe,Ne,at,Ri,gn,Oi,Nt,Gn,wt=y.s==_.s?1:-1,Ye=y.c,Me=_.c;if(!Ye||!Ye[0]||!Me||!Me[0])return new L(!y.s||!_.s||(Ye?Me&&Ye[0]==Me[0]:!Me)?NaN:Ye&&Ye[0]==0||!Me?wt*0:wt/0);for(ke=new L(wt),He=ke.c=[],P=y.e-_.e,wt=w+P+1,N||(N=Rr,P=fr(y.e/ue)-fr(_.e/ue),wt=wt/ue|0),U=0;Me[U]==(Ye[U]||0);U++);if(Me[U]>(Ye[U]||0)&&P--,wt<0)He.push(1),K=!0;else{for(gn=Ye.length,Nt=Me.length,U=0,wt+=2,W=pr(N/(Me[0]+1)),W>1&&(Me=A(Me,W,N),Ye=A(Ye,W,N),Nt=Me.length,gn=Ye.length),Ri=Nt,fe=Ye.slice(0,Nt),Ne=fe.length;Ne<Nt;fe[Ne++]=0);Gn=Me.slice(),Gn=[0].concat(Gn),Oi=Me[0],Me[1]>=N/2&&Oi++;do{if(W=0,O=x(Me,fe,Nt,Ne),O<0){if(at=fe[0],Nt!=Ne&&(at=at*N+(fe[1]||0)),W=pr(at/Oi),W>1)for(W>=N&&(W=N-1),J=A(Me,W,N),de=J.length,Ne=fe.length;x(J,fe,de,Ne)==1;)W--,S(J,Nt<de?Gn:Me,de,N),de=J.length,O=1;else W==0&&(O=W=1),J=Me.slice(),de=J.length;if(de<Ne&&(J=[0].concat(J)),S(fe,J,Ne,N),Ne=fe.length,O==-1)for(;x(Me,fe,Nt,Ne)<1;)W++,S(fe,Nt<Ne?Gn:Me,Ne,N),Ne=fe.length}else O===0&&(W++,fe=[0]);He[U++]=W,fe[0]?fe[Ne++]=Ye[Ri]||0:(fe=[Ye[Ri]],Ne=1)}while((Ri++<gn||fe[0]!=null)&&wt--);K=fe[0]!=null,He[0]||He.splice(0,1)}if(N==Rr){for(U=1,wt=He[0];wt>=10;wt/=10,U++);$(ke,w+(ke.e=U+P*ue-1)+1,R,K)}else ke.e=P,ke.r=+K;return ke}})();function B(A,x,S,y){var _,w,R,N,O;if(S==null?S=a:We(S,0,8),!A.c)return A.toString();if(_=A.c[0],R=A.e,x==null)O=dr(A.c),O=y==1||y==2&&(R<=c||R>=l)?Gl(O,R):yn(O,R,"0");else if(A=$(new L(A),x,S),w=A.e,O=dr(A.c),N=O.length,y==1||y==2&&(x<=w||w<=c)){for(;N<x;O+="0",N++);O=Gl(O,w)}else if(x-=R+(y===2&&w>R),O=yn(O,w,"0"),w+1>N){if(--x>0)for(O+=".";x--;O+="0");}else if(x+=w-N,x>0)for(w+1==N&&(O+=".");x--;O+="0");return A.s<0&&_?"-"+O:O}function G(A,x){for(var S,y,_=1,w=new L(A[0]);_<A.length;_++)y=new L(A[_]),(!y.s||(S=Si(w,y))===x||S===0&&w.s===x)&&(w=y);return w}function j(A,x,S){for(var y=1,_=x.length;!x[--_];x.pop());for(_=x[0];_>=10;_/=10,y++);return(S=y+S*ue-1)>p?A.c=A.e=null:S<d?A.c=[A.e=0]:(A.e=S,A.c=x),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,x=/^([^.]+)\.$/,S=/^\.([^.]+)$/,y=/^-?(Infinity|NaN)$/,_=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(w,R,N,O){var P,U=N?R:R.replace(_,"");if(y.test(U))w.s=isNaN(U)?null:U<0?-1:1;else{if(!N&&(U=U.replace(A,function(K,W,J){return P=(J=J.toLowerCase())=="x"?16:J=="b"?2:8,!O||O==P?W:K}),O&&(P=O,U=U.replace(x,"$1").replace(S,"0.$1")),R!=U))return new L(U,P);if(L.DEBUG)throw Error(Gt+"Not a"+(O?" base "+O:"")+" number: "+R);w.s=null}w.c=w.e=null}})();function $(A,x,S,y){var _,w,R,N,O,P,U,K=A.c,W=hf;if(K){e:{for(_=1,N=K[0];N>=10;N/=10,_++);if(w=x-_,w<0)w+=ue,R=x,O=K[P=0],U=pr(O/W[_-R-1]%10);else if(P=ff((w+1)/ue),P>=K.length)if(y){for(;K.length<=P;K.push(0));O=U=0,_=1,w%=ue,R=w-ue+1}else break e;else{for(O=N=K[P],_=1;N>=10;N/=10,_++);w%=ue,R=w-ue+_,U=R<0?0:pr(O/W[_-R-1]%10)}if(y=y||x<0||K[P+1]!=null||(R<0?O:O%W[_-R-1]),y=S<4?(U||y)&&(S==0||S==(A.s<0?3:2)):U>5||U==5&&(S==4||y||S==6&&(w>0?R>0?O/W[_-R]:0:K[P-1])%10&1||S==(A.s<0?8:7)),x<1||!K[0])return K.length=0,y?(x-=A.e+1,K[0]=W[(ue-x%ue)%ue],A.e=-x||0):K[0]=A.e=0,A;if(w==0?(K.length=P,N=1,P--):(K.length=P+1,N=W[ue-w],K[P]=R>0?pr(O/W[_-R]%W[R])*N:0),y)for(;;)if(P==0){for(w=1,R=K[0];R>=10;R/=10,w++);for(R=K[0]+=N,N=1;R>=10;R/=10,N++);w!=N&&(A.e++,K[0]==Rr&&(K[0]=1));break}else{if(K[P]+=N,K[P]!=Rr)break;K[P--]=0,N=1}for(w=K.length;K[--w]===0;K.pop());}A.e>p?A.c=A.e=null:A.e<d&&(A.c=[A.e=0])}return A}function te(A){var x,S=A.e;return S===null?A.toString():(x=dr(A.c),x=S<=c||S>=l?Gl(x,S):yn(x,S,"0"),A.s<0?"-"+x:x)}return i.absoluteValue=i.abs=function(){var A=new L(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,x){return Si(this,new L(A,x))},i.decimalPlaces=i.dp=function(A,x){var S,y,_,w=this;if(A!=null)return We(A,0,vt),x==null?x=a:We(x,0,8),$(new L(w),A+w.e+1,x);if(!(S=w.c))return null;if(y=((_=S.length-1)-fr(this.e/ue))*ue,_=S[_])for(;_%10==0;_/=10,y--);return y<0&&(y=0),y},i.dividedBy=i.div=function(A,x){return e(this,new L(A,x),o,a)},i.dividedToIntegerBy=i.idiv=function(A,x){return e(this,new L(A,x),0,1)},i.exponentiatedBy=i.pow=function(A,x){var S,y,_,w,R,N,O,P,U,K=this;if(A=new L(A),A.c&&!A.isInteger())throw Error(Gt+"Exponent not an integer: "+te(A));if(x!=null&&(x=new L(x)),N=A.e>14,!K.c||!K.c[0]||K.c[0]==1&&!K.e&&K.c.length==1||!A.c||!A.c[0])return U=new L(Math.pow(+te(K),N?A.s*(2-jl(A)):+te(A))),x?U.mod(x):U;if(O=A.s<0,x){if(x.c?!x.c[0]:!x.s)return new L(NaN);y=!O&&K.isInteger()&&x.isInteger(),y&&(K=K.mod(x))}else{if(A.e>9&&(K.e>0||K.e<-1||(K.e==0?K.c[0]>1||N&&K.c[1]>=24e7:K.c[0]<8e13||N&&K.c[0]<=9999975e7)))return w=K.s<0&&jl(A)?-0:0,K.e>-1&&(w=1/w),new L(O?1/w:w);v&&(w=ff(v/ue+2))}for(N?(S=new L(.5),O&&(A.s=1),P=jl(A)):(_=Math.abs(+te(A)),P=_%2),U=new L(s);;){if(P){if(U=U.times(K),!U.c)break;w?U.c.length>w&&(U.c.length=w):y&&(U=U.mod(x))}if(_){if(_=pr(_/2),_===0)break;P=_%2}else if(A=A.times(S),$(A,A.e+1,1),A.e>14)P=jl(A);else{if(_=+te(A),_===0)break;P=_%2}K=K.times(K),w?K.c&&K.c.length>w&&(K.c.length=w):y&&(K=K.mod(x))}return y?U:(O&&(U=s.div(U)),x?U.mod(x):w?$(U,v,a,R):U)},i.integerValue=function(A){var x=new L(this);return A==null?A=a:We(A,0,8),$(x,x.e+1,A)},i.isEqualTo=i.eq=function(A,x){return Si(this,new L(A,x))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,x){return Si(this,new L(A,x))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,x){return(x=Si(this,new L(A,x)))===1||x===0},i.isInteger=function(){return!!this.c&&fr(this.e/ue)>this.c.length-2},i.isLessThan=i.lt=function(A,x){return Si(this,new L(A,x))<0},i.isLessThanOrEqualTo=i.lte=function(A,x){return(x=Si(this,new L(A,x)))===-1||x===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,x){var S,y,_,w,R=this,N=R.s;if(A=new L(A,x),x=A.s,!N||!x)return new L(NaN);if(N!=x)return A.s=-x,R.plus(A);var O=R.e/ue,P=A.e/ue,U=R.c,K=A.c;if(!O||!P){if(!U||!K)return U?(A.s=-x,A):new L(K?R:NaN);if(!U[0]||!K[0])return K[0]?(A.s=-x,A):new L(U[0]?R:a==3?-0:0)}if(O=fr(O),P=fr(P),U=U.slice(),N=O-P){for((w=N<0)?(N=-N,_=U):(P=O,_=K),_.reverse(),x=N;x--;_.push(0));_.reverse()}else for(y=(w=(N=U.length)<(x=K.length))?N:x,N=x=0;x<y;x++)if(U[x]!=K[x]){w=U[x]<K[x];break}if(w&&(_=U,U=K,K=_,A.s=-A.s),x=(y=K.length)-(S=U.length),x>0)for(;x--;U[S++]=0);for(x=Rr-1;y>N;){if(U[--y]<K[y]){for(S=y;S&&!U[--S];U[S]=x);--U[S],U[y]+=Rr}U[y]-=K[y]}for(;U[0]==0;U.splice(0,1),--P);return U[0]?j(A,U,P):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,x){var S,y,_=this;return A=new L(A,x),!_.c||!A.s||A.c&&!A.c[0]?new L(NaN):!A.c||_.c&&!_.c[0]?new L(_):(E==9?(y=A.s,A.s=1,S=e(_,A,0,3),A.s=y,S.s*=y):S=e(_,A,0,E),A=_.minus(S.times(A)),!A.c[0]&&E==1&&(A.s=_.s),A)},i.multipliedBy=i.times=function(A,x){var S,y,_,w,R,N,O,P,U,K,W,J,de,ke,He,fe=this,Ne=fe.c,at=(A=new L(A,x)).c;if(!Ne||!at||!Ne[0]||!at[0])return!fe.s||!A.s||Ne&&!Ne[0]&&!at||at&&!at[0]&&!Ne?A.c=A.e=A.s=null:(A.s*=fe.s,!Ne||!at?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(y=fr(fe.e/ue)+fr(A.e/ue),A.s*=fe.s,O=Ne.length,K=at.length,O<K&&(de=Ne,Ne=at,at=de,_=O,O=K,K=_),_=O+K,de=[];_--;de.push(0));for(ke=Rr,He=Bn,_=K;--_>=0;){for(S=0,W=at[_]%He,J=at[_]/He|0,R=O,w=_+R;w>_;)P=Ne[--R]%He,U=Ne[R]/He|0,N=J*P+U*W,P=W*P+N%He*He+de[w]+S,S=(P/ke|0)+(N/He|0)+J*U,de[w--]=P%ke;de[w]=S}return S?++y:de.splice(0,1),j(A,de,y)},i.negated=function(){var A=new L(this);return A.s=-A.s||null,A},i.plus=function(A,x){var S,y=this,_=y.s;if(A=new L(A,x),x=A.s,!_||!x)return new L(NaN);if(_!=x)return A.s=-x,y.minus(A);var w=y.e/ue,R=A.e/ue,N=y.c,O=A.c;if(!w||!R){if(!N||!O)return new L(_/0);if(!N[0]||!O[0])return O[0]?A:new L(N[0]?y:_*0)}if(w=fr(w),R=fr(R),N=N.slice(),_=w-R){for(_>0?(R=w,S=O):(_=-_,S=N),S.reverse();_--;S.push(0));S.reverse()}for(_=N.length,x=O.length,_-x<0&&(S=O,O=N,N=S,x=_),_=0;x;)_=(N[--x]=N[x]+O[x]+_)/Rr|0,N[x]=Rr===N[x]?0:N[x]%Rr;return _&&(N=[_].concat(N),++R),j(A,N,R)},i.precision=i.sd=function(A,x){var S,y,_,w=this;if(A!=null&&A!==!!A)return We(A,1,vt),x==null?x=a:We(x,0,8),$(new L(w),A,x);if(!(S=w.c))return null;if(_=S.length-1,y=_*ue+1,_=S[_]){for(;_%10==0;_/=10,y--);for(_=S[0];_>=10;_/=10,y++);}return A&&w.e+1>y&&(y=w.e+1),y},i.shiftedBy=function(A){return We(A,-mf,mf),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,x,S,y,_,w=this,R=w.c,N=w.s,O=w.e,P=o+4,U=new L("0.5");if(N!==1||!R||!R[0])return new L(!N||N<0&&(!R||R[0])?NaN:R?w:1/0);if(N=Math.sqrt(+te(w)),N==0||N==1/0?(x=dr(R),(x.length+O)%2==0&&(x+="0"),N=Math.sqrt(+x),O=fr((O+1)/2)-(O<0||O%2),N==1/0?x="5e"+O:(x=N.toExponential(),x=x.slice(0,x.indexOf("e")+1)+O),S=new L(x)):S=new L(N+""),S.c[0]){for(O=S.e,N=O+P,N<3&&(N=0);;)if(_=S,S=U.times(_.plus(e(w,_,P,1))),dr(_.c).slice(0,N)===(x=dr(S.c)).slice(0,N))if(S.e<O&&--N,x=x.slice(N-3,N+1),x=="9999"||!y&&x=="4999"){if(!y&&($(_,_.e+o+2,0),_.times(_).eq(w))){S=_;break}P+=4,N+=4,y=1}else{(!+x||!+x.slice(1)&&x.charAt(0)=="5")&&($(S,S.e+o+2,1),A=!S.times(S).eq(w));break}}return $(S,S.e+o+1,a,A)},i.toExponential=function(A,x){return A!=null&&(We(A,0,vt),A++),B(this,A,x,1)},i.toFixed=function(A,x){return A!=null&&(We(A,0,vt),A=A+this.e+1),B(this,A,x)},i.toFormat=function(A,x,S){var y,_=this;if(S==null)A!=null&&x&&typeof x=="object"?(S=x,x=null):A&&typeof A=="object"?(S=A,A=x=null):S=b;else if(typeof S!="object")throw Error(Gt+"Argument not an object: "+S);if(y=_.toFixed(A,x),_.c){var w,R=y.split("."),N=+S.groupSize,O=+S.secondaryGroupSize,P=S.groupSeparator||"",U=R[0],K=R[1],W=_.s<0,J=W?U.slice(1):U,de=J.length;if(O&&(w=N,N=O,O=w,de-=w),N>0&&de>0){for(w=de%N||N,U=J.substr(0,w);w<de;w+=N)U+=P+J.substr(w,N);O>0&&(U+=P+J.slice(w)),W&&(U="-"+U)}y=K?U+(S.decimalSeparator||"")+((O=+S.fractionGroupSize)?K.replace(new RegExp("\\d{"+O+"}\\B","g"),"$&"+(S.fractionGroupSeparator||"")):K):U}return(S.prefix||"")+y+(S.suffix||"")},i.toFraction=function(A){var x,S,y,_,w,R,N,O,P,U,K,W,J=this,de=J.c;if(A!=null&&(N=new L(A),!N.isInteger()&&(N.c||N.s!==1)||N.lt(s)))throw Error(Gt+"Argument "+(N.isInteger()?"out of range: ":"not an integer: ")+te(N));if(!de)return new L(J);for(x=new L(s),P=S=new L(s),y=O=new L(s),W=dr(de),w=x.e=W.length-J.e-1,x.c[0]=hf[(R=w%ue)<0?ue+R:R],A=!A||N.comparedTo(x)>0?w>0?x:P:N,R=p,p=1/0,N=new L(W),O.c[0]=0;U=e(N,x,0,1),_=S.plus(U.times(y)),_.comparedTo(A)!=1;)S=y,y=_,P=O.plus(U.times(_=P)),O=_,x=N.minus(U.times(_=x)),N=_;return _=e(A.minus(S),y,0,1),O=O.plus(_.times(P)),S=S.plus(_.times(y)),O.s=P.s=J.s,w=w*2,K=e(P,y,w,a).minus(J).abs().comparedTo(e(O,S,w,a).minus(J).abs())<1?[P,y]:[O,S],p=R,K},i.toNumber=function(){return+te(this)},i.toPrecision=function(A,x){return A!=null&&We(A,1,vt),B(this,A,x,2)},i.toString=function(A){var x,S=this,y=S.s,_=S.e;return _===null?y?(x="Infinity",y<0&&(x="-"+x)):x="NaN":(A==null?x=_<=c||_>=l?Gl(dr(S.c),_):yn(dr(S.c),_,"0"):A===10&&C?(S=$(new L(S),o+_+1,a),x=yn(dr(S.c),S.e,"0")):(We(A,2,k.length,"Base"),x=r(yn(dr(S.c),_,"0"),10,A,y,!0)),y<0&&S.c[0]&&(x="-"+x)),x},i.valueOf=i.toJSON=function(){return te(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&L.set(t),L}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,s=t[0]+"";n<i;){for(e=t[n++]+"",r=ue-e.length;r--;e="0"+e);s+=e}for(i=s.length;s.charCodeAt(--i)===48;);return s.slice(0,i+1||1)}function Si(t,e){var r,n,i=t.c,s=e.c,o=t.s,a=e.s,c=t.e,l=e.e;if(!o||!a)return null;if(r=i&&!i[0],n=s&&!s[0],r||n)return r?n?0:-a:o;if(o!=a)return o;if(r=o<0,n=c==l,!i||!s)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=s.length)?c:l,o=0;o<a;o++)if(i[o]!=s[o])return i[o]>s[o]^r?1:-1;return c==l?0:c>l^r?1:-1}function We(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Gt+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function jl(t){var e=t.c.length-1;return fr(t.e/ue)==e&&t.c[e]%2!=0}function Gl(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function yn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var Yw=EA(),yA=Yw;var Xw=24,va=32,Qw=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,yf=Qw(),Ef=(t=4,e=yf)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function Zw(t){let e=new yA(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var vA=(t="")=>{let e=new TextEncoder;return Zw(mA(e.encode(t))).toString(36).slice(1)},gA=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),eR=t=>gA[Math.floor(t()*gA.length)],tR=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=yf}={})=>{let r=Object.keys(t).toString(),n=r.length?r+Ef(va,e):Ef(va,e);return vA(n).substring(0,va)},rR=t=>()=>t++,nR=476782367,AA=({random:t=yf,counter:e=rR(Math.floor(t()*nR)),length:r=Xw,fingerprint:n=tR({random:t})}={})=>{if(r>va)throw new Error(`Length must be between 2 and ${va}. Received: ${r}`);return function(){let s=eR(t),o=Date.now().toString(36),a=e().toString(36),c=Ef(r,t),l=`${o+c+a+n}`;return`${s+vA(l).substring(1,r)}`}},At=iR(AA);function iR(t){let e;return()=>(e||(e=t()),e())}function Aa(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Pe(t){return Aa(t)==="ConditionalCheckFailedException"}var Ta=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return At()}async get(e){try{let r=await this.docClient.send(new oR({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()}}));if(!r.Item)return g(null);let n=this.unmarshall(r.Item);return lf(ne(n.expiresAt))?g(null):g(n)}catch{return u(M.DatabaseQueryError({query:"get challenge"}))}}async create(e){try{let r=ae(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:z(r)},s=ne(e.expiresAt),o=Math.floor((s+this.ttlGracePeriod)/1e3);return await this.docClient.send(new aR({TableName:this.tableName,Item:this.marshall(i,o)})),g(i)}catch{return u(M.DatabaseQueryError({query:"create challenge"}))}}async update(e,r){try{let n=[],i={},s={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=f.METHOD,s[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=f.PHASE,s[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=f.CODE_HASH,s[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=f.CHALLENGE_STATUS,s[":challengeStatus"]=r.status),n.length===0?g(void 0):(await this.docClient.send(new TA({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),g(void 0))}catch{return u(M.DatabaseQueryError({query:"update challenge"}))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let o=(await this.docClient.send(new TA({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":f.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[f.ATTEMPTS]??0;return g(o)}catch(s){return Pe(s)?u(M.AttemptsExceeded()):u(M.DatabaseQueryError({query:"increment challenge attempts"}))}}async remove(e){try{return await this.docClient.send(new sR({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":f.PK}})),g(void 0)}catch(r){return Pe(r)?g(void 0):u(M.DatabaseQueryError({query:"remove challenge"}))}}marshall(e,r){let n={[f.PK]:D.CHALLENGE_PK(e.id),[f.SK]:D.CHALLENGE_SK(),[f.USER_ID]:e.userId,[f.PURPOSE]:e.purpose,[f.CHALLENGE_STATUS]:e.status,[f.EXPIRES_AT]:ne(e.expiresAt),[f.CREATED_AT]:ne(e.createdAt),[f.TTL]:r};return e.tenantId&&(n[f.TENANT_ID]=e.tenantId),e.phase&&(n[f.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[f.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[f.METHOD]=e.method),e.codeHash&&(n[f.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[f.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[f.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[f.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[f.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[f.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[f.COUNTRY]=e.country),e.city&&(n[f.CITY]=e.city),e.metadata&&(n[f.METADATA]=e.metadata),e.flowKey&&(n[f.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:le.challengeIdFromPK(e[f.PK]),userId:e[f.USER_ID],purpose:e[f.PURPOSE],status:e[f.CHALLENGE_STATUS],expiresAt:z(e[f.EXPIRES_AT]),createdAt:z(e[f.CREATED_AT])};return e[f.TENANT_ID]&&(n.tenantId=e[f.TENANT_ID]),e[f.PHASE]&&(n.phase=e[f.PHASE]),e[f.ALLOWED_METHODS]&&(n.allowedMethods=e[f.ALLOWED_METHODS]),e[f.METHOD]&&(n.method=e[f.METHOD]),e[f.CODE_HASH]&&(n.codeHash=e[f.CODE_HASH]),e[f.ATTEMPTS]!==void 0&&(n.attempts=e[f.ATTEMPTS]),e[f.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[f.MAX_ATTEMPTS]),e[f.IDENTITY_TYPE]&&(n.identityType=e[f.IDENTITY_TYPE]),e[f.IDENTITY_VALUE]&&(n.identityValue=e[f.IDENTITY_VALUE]),e[f.DEVICE_LABEL]&&(n.deviceLabel=e[f.DEVICE_LABEL]),e[f.COUNTRY]&&(n.country=e[f.COUNTRY]),e[f.CITY]&&(n.city=e[f.CITY]),e[f.METADATA]&&(n.metadata=e[f.METADATA]),e[f.FLOW_KEY]&&(n.flowKey=e[f.FLOW_KEY]),n}};import{BatchGetCommand as cR,DeleteCommand as lR,GetCommand as uR,PutCommand as dR,QueryCommand as $l,UpdateCommand as pR}from"@aws-sdk/lib-dynamodb";var _a=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return At()}async get(e){try{let r=await this.docClient.send(new uR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()}}));return r.Item?g(this.unmarshall(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get credential"}))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk AND begins_with(${f.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":D.USER_PK(e),":typePrefix":D.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return g(null);let i=n.Items[0];if(!i)return g(null);let s=le.credentialId(i[f.PK]);return this.get(s)}catch{return u(M.DatabaseQueryError({query:"get credential by user and type"}))}}async getByUserId(e){try{let r=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return g([]);let n=r.Items.map(o=>le.credentialId(o[f.PK])),i=await this.batchGet(n);if(i.ok===!1)return u(i.errors,i.meta);if(!i.data)return g([]);let s=i.data.filter(o=>o!==null);return g(s)}catch{return u(M.DatabaseQueryError({query:"get credentials by user"}))}}async create(e){try{let r=ae(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new dR({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${f.PK})`})),g(i)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"credential"})):u(M.DatabaseQueryError({query:"create credential"}))}}async update(e,r){try{let n=ae(),i=[],s={},o={};return i.push(`#${f.UPDATED_AT} = :updatedAt`),s[`#${f.UPDATED_AT}`]=f.UPDATED_AT,o[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${f.CREDENTIAL_VALUE} = :value`),s[`#${f.CREDENTIAL_VALUE}`]=f.CREDENTIAL_VALUE,o[":value"]=r.value),r.data!==void 0&&(i.push(`#${f.METADATA} = :data`),s[`#${f.METADATA}`]=f.METADATA,o[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${f.REVOKED_AT} = :revokedAt`),s[`#${f.REVOKED_AT}`]=f.REVOKED_AT,o[":revokedAt"]=r.revokedAt?ne(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${f.LAST_USED_AT} = :lastUsedAt`),s[`#${f.LAST_USED_AT}`]=f.LAST_USED_AT,o[":lastUsedAt"]=r.lastUsedAt?ne(r.lastUsedAt):null),await this.docClient.send(new pR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"update credential"}))}}async remove(e){try{return await this.docClient.send(new lR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(r){return Pe(r)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"delete credential"}))}}async hasType(e,r){try{let n=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk AND begins_with(${f.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":D.USER_PK(e),":typePrefix":D.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return g((n.Count||0)>0)}catch{return u(M.DatabaseQueryError({query:"check credential type"}))}}async countByUserId(e){try{let r=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)},Select:"COUNT"}));return g(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count credentials"}))}}async batchGet(e){if(e.length===0)return g([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let o=(await this.docClient.send(new cR({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[f.PK]:D.CREDENTIAL_PK(c),[f.SK]:D.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of o){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return g(n)}catch{return u(M.DatabaseQueryError({query:"batch get credentials"}))}}marshall(e){let r={[f.PK]:D.CREDENTIAL_PK(e.id),[f.SK]:D.CREDENTIAL_SK(),[f.CREDENTIAL_USER_PK]:D.USER_PK(e.userId),[f.CREDENTIAL_USER_SK]:D.CREDENTIAL_USER_SK(e.type,e.id),[f.USER_ID]:e.userId,[f.CREDENTIAL_VALUE]:e.value,[f.METADATA]:e.data,[f.REVOKED_AT]:e.revokedAt?ne(e.revokedAt):null,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)};return e.lastUsedAt&&(r[f.LAST_USED_AT]=ne(e.lastUsedAt)),r}unmarshall(e){let r=le.credentialId(e[f.PK]),n=le.credentialTypeFromUserSK(e[f.CREDENTIAL_USER_SK]);return{id:r,userId:e[f.USER_ID],type:n,value:e[f.CREDENTIAL_VALUE],data:e[f.METADATA]||{},revokedAt:Ht(e[f.REVOKED_AT]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT]),lastUsedAt:Ht(e[f.LAST_USED_AT])}}};import{BatchGetCommand as fR,DeleteCommand as mR,GetCommand as hR,PutCommand as ER,QueryCommand as yR,UpdateCommand as gf}from"@aws-sdk/lib-dynamodb";function vf(t){return{failedAttempts:t.failedAttempts,lastFailedAt:Nr(t.lastFailedAt),lockedUntil:Nr(t.lockedUntil)}}function _A(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Ht(n.lastFailedAt),lockedUntil:Ht(n.lockedUntil)};return e}function IA(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=vf(n));return e}var Ia=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new hR({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()}}));if(!n.Item)return g(null);let i=this.unmarshall(n.Item);return g(i)}catch(n){return console.error("[DynamoDB] identities.get error:",n),u(M.DatabaseQueryError({query:"get identity"}))}}async getByUserId(e){try{let r=await this.docClient.send(new yR({TableName:this.tableName,IndexName:Se.USER_IDENTITIES,KeyConditionExpression:`${f.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":D.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let s=this.unmarshall(i);s!==null&&n.push(s)}return g(n)}catch{return u(M.DatabaseQueryError({query:"get identities by userId"}))}}async create(e){try{let r=ae(),n={...e,createdAt:z(r),updatedAt:z(r)};return await this.docClient.send(new ER({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),g(n)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"identity"})):u(M.DatabaseQueryError({query:"create identity"}))}}async update(e,r,n){try{let i=[],s=[],o={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),o["#loginEnabled"]=f.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=Nr(n.verifiedAt);l===null?(s.push("#verifiedAt"),o["#verifiedAt"]=f.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),o["#verifiedAt"]=f.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),o["#guards"]=f.GUARDS,a[":guards"]=IA(n.guards)),n.pendingVerification!==void 0&&(o["#pendingVerification"]=f.PENDING_VERIFICATION,n.pendingVerification===null?s.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Ft({...n.pendingVerification,expiresAt:ne(n.pendingVerification.expiresAt),resendAvailableAt:Nr(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),o["#updatedAt"]=f.UPDATED_AT,a[":updatedAt"]=ae();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),s.length>0&&c.push(`REMOVE ${s.join(", ")}`),await this.docClient.send(new gf({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:o,ExpressionAttributeValues:a})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update identity"}))}}async remove(e,r){try{return await this.docClient.send(new mR({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove identity"}))}}async updateGuard(e,r,n,i){let s={[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()};try{return await this.docClient.send(new gf({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":f.GUARDS,"#guardKey":n,"#updatedAt":f.UPDATED_AT},ExpressionAttributeValues:{":guard":vf(i),":updatedAt":ae()}})),g(void 0)}catch(o){if(Pe(o))try{return await this.docClient.send(new gf({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":f.GUARDS,"#updatedAt":f.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:vf(i)},":updatedAt":ae()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update guard"}))}return u(M.DatabaseQueryError({query:"update guard"}))}}async batchGet(e){try{if(e.length===0)return g([]);let n=(await this.docClient.send(new fR({RequestItems:{[this.tableName]:{Keys:e.map(({type:o,value:a})=>({[f.PK]:D.IDENTITY_PK(o,a),[f.SK]:D.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let o of n){let a=this.unmarshall(o);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let s=e.map(({type:o,value:a})=>{let c=`${o}#${a}`;return i.get(c)||null});return g(s)}catch{return u(M.DatabaseQueryError({query:"batch get identities"}))}}marshall(e){let r={[f.PK]:D.IDENTITY_PK(e.type,e.value),[f.SK]:D.IDENTITY_SK(),[f.IDENTITY_USER_PK]:D.USER_INDEX_PK(e.userId),[f.IDENTITY_USER_SK]:D.USER_INDEX_SK(e.type,e.value),[f.USER_ID]:e.userId,[f.LOGIN_ENABLED]:e.loginEnabled,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)},n=Nr(e.verifiedAt);return n!==null&&(r[f.VERIFIED_AT]=n),r[f.GUARDS]=IA(e.guards),e.pendingVerification&&(r[f.PENDING_VERIFICATION]=Ft({...e.pendingVerification,expiresAt:ne(e.pendingVerification.expiresAt),resendAvailableAt:Nr(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=le.identityPKInfo(e[f.PK]);if(!r){let n=e[f.IDENTITY_USER_SK]?le.userIndexSKInfo(e[f.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[f.USER_ID],loginEnabled:e[f.LOGIN_ENABLED],verifiedAt:Ht(e[f.VERIFIED_AT]),guards:_A(e[f.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[f.PENDING_VERIFICATION]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[f.PK],GSI1SK:e[f.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[f.USER_ID],loginEnabled:e[f.LOGIN_ENABLED],verifiedAt:Ht(e[f.VERIFIED_AT]),guards:_A(e[f.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[f.PENDING_VERIFICATION]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:z(r.expiresAt),resendAvailableAt:Ht(r.resendAvailableAt)}}};import{TransactWriteCommand as gR}from"@aws-sdk/lib-dynamodb";var xa=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=ae(),n=At(),i=ne(e.challenge.expiresAt),s=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new gR({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,s))]})),g(void 0)}catch(r){return Aa(r)==="TransactionCanceledException"||Pe(r)?u(M.UniqueConstraintViolation({field:"registration"})):u(M.DatabaseQueryError({query:"create email verification registration transaction"}))}}putItem(e){return{Put:{TableName:this.tableName,Item:Ft(e),ConditionExpression:`attribute_not_exists(${f.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[f.PK]:D.USER_PK(e.profile.id),[f.SK]:D.USER_PROFILE_SK(),userStatus:n,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[f.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[f.PK]:D.USER_PK(e.userAuth.userId),[f.SK]:D.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[f.CREATED_AT]:r,[f.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[f.PK]:D.IDENTITY_PK(n.type,n.value),[f.SK]:D.IDENTITY_SK(),[f.IDENTITY_USER_PK]:D.USER_INDEX_PK(n.userId),[f.IDENTITY_USER_SK]:D.USER_INDEX_SK(n.type,n.value),[f.USER_ID]:n.userId,[f.LOGIN_ENABLED]:n.loginEnabled,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.PENDING_VERIFICATION]:Ft({...n.pendingVerification,expiresAt:ne(n.pendingVerification.expiresAt),resendAvailableAt:Nr(n.pendingVerification.resendAvailableAt)})},s=Nr(n.verifiedAt);return s!==null&&(i[f.VERIFIED_AT]=s),i[f.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,s={[f.PK]:D.CREDENTIAL_PK(r),[f.SK]:D.CREDENTIAL_SK(),[f.CREDENTIAL_USER_PK]:D.USER_PK(i.userId),[f.CREDENTIAL_USER_SK]:D.CREDENTIAL_USER_SK(i.type,r),[f.USER_ID]:i.userId,[f.CREDENTIAL_VALUE]:i.value,[f.METADATA]:i.data,[f.REVOKED_AT]:i.revokedAt?ne(i.revokedAt):null,[f.CREATED_AT]:n,[f.UPDATED_AT]:n};return i.lastUsedAt&&(s[f.LAST_USED_AT]=ne(i.lastUsedAt)),s}marshallChallenge(e,r,n){let i=e.challenge,s={[f.PK]:D.CHALLENGE_PK(i.id),[f.SK]:D.CHALLENGE_SK(),[f.USER_ID]:i.userId,[f.PURPOSE]:i.purpose,[f.CHALLENGE_STATUS]:i.status,[f.EXPIRES_AT]:ne(i.expiresAt),[f.CREATED_AT]:r,[f.TTL]:n};return i.tenantId&&(s[f.TENANT_ID]=i.tenantId),i.phase&&(s[f.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(s[f.ALLOWED_METHODS]=i.allowedMethods),i.method&&(s[f.METHOD]=i.method),i.codeHash&&(s[f.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(s[f.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(s[f.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(s[f.IDENTITY_TYPE]=i.identityType),i.identityValue&&(s[f.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(s[f.DEVICE_LABEL]=i.deviceLabel),i.country&&(s[f.COUNTRY]=i.country),i.city&&(s[f.CITY]=i.city),i.metadata&&(s[f.METADATA]=i.metadata),i.flowKey&&(s[f.FLOW_KEY]=i.flowKey),s}};import{DynamoDBClient as TR}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as _R,GetCommand as SA,PutCommand as IR,QueryCommand as ba,UpdateCommand as js}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as vR}from"@aws-sdk/lib-dynamodb";var xA=100,bA=5;function AR(t){return new Promise(e=>setTimeout(e,t))}async function qs(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=xA){let s=r.slice(i,i+xA),o=0;for(;s.length>0;){let a=await t.send(new vR({RequestItems:{[e]:{Keys:s}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(o+=1,o>bA)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${bA} retries`);s=l,await AR(2**o*25)}}return n}var Sa=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new TR({});this.docClient=e.docClient||_R.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return At()}generateTokenId(){return At()}async get(e){try{let r=await this.docClient.send(new SA({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()}}));return r.Item?g(this.unmarshall(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get session"}))}}async create(e){try{let r=ae(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),s={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},o=ya(ne(e.expiresAt)+this.ttlGracePeriod),a=ql.sessionSK(r,n);return await this.docClient.send(new IR({TableName:this.tableName,Item:this.marshall(s,o,a)})),g(s)}catch{return u(M.DatabaseQueryError({query:"create session"}))}}async update(e,r){try{let n=[],i={},s={};if(r.tokenId!==void 0&&(n.push(`#${f.TOKEN_ID} = :tokenId`),i[`#${f.TOKEN_ID}`]=f.TOKEN_ID,s[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${f.EXPIRES_AT} = :expiresAt`),i[`#${f.EXPIRES_AT}`]=f.EXPIRES_AT,s[":expiresAt"]=ne(r.expiresAt);let o=ya(ne(r.expiresAt)+this.ttlGracePeriod);n.push(`#${f.TTL} = :ttl`),i[`#${f.TTL}`]=f.TTL,s[":ttl"]=o}return r.lastUsedAt!==void 0&&(n.push(`#${f.LAST_USED_AT} = :lastUsedAt`),i[`#${f.LAST_USED_AT}`]=f.LAST_USED_AT,s[":lastUsedAt"]=ne(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${f.METADATA} = :metadata`),i[`#${f.METADATA}`]=f.METADATA,s[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${f.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${f.PREVIOUS_TOKEN_ID}`]=f.PREVIOUS_TOKEN_ID,s[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${f.ROTATED_AT} = :rotatedAt`),i[`#${f.ROTATED_AT}`]=f.ROTATED_AT,s[":rotatedAt"]=r.rotatedAt),n.length===0?g():(await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),g())}catch{return u(M.DatabaseQueryError({query:"update session"}))}}async rotateToken(e,r,n){try{let i=ya(ne(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.TOKEN_ID} = :tokenId, #${f.PREVIOUS_TOKEN_ID} = :previousTokenId, #${f.ROTATED_AT} = :rotatedAt, #${f.EXPIRES_AT} = :expiresAt, #${f.LAST_USED_AT} = :lastUsedAt, #${f.TTL} = :ttl`,ConditionExpression:`#${f.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${f.TOKEN_ID}`]:f.TOKEN_ID,[`#${f.PREVIOUS_TOKEN_ID}`]:f.PREVIOUS_TOKEN_ID,[`#${f.ROTATED_AT}`]:f.ROTATED_AT,[`#${f.EXPIRES_AT}`]:f.EXPIRES_AT,[`#${f.LAST_USED_AT}`]:f.LAST_USED_AT,[`#${f.TTL}`]:f.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":ne(n.expiresAt),":lastUsedAt":ne(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),g(!0)}catch(i){return Pe(i)?g(!1):u(M.DatabaseQueryError({query:"rotate session token"}))}}async switchTenant(e,r){try{let n=[`#${f.TENANT_ID} = :tenantId`,`#${f.TOKEN_ID} = :tokenId`,`#${f.LAST_USED_AT} = :lastUsedAt`],i=[],s={[`#${f.TENANT_ID}`]:f.TENANT_ID,[`#${f.TOKEN_ID}`]:f.TOKEN_ID,[`#${f.LAST_USED_AT}`]:f.LAST_USED_AT},o={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":ae()};s[`#${f.TENANT_TYPE}`]=f.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${f.TENANT_TYPE} = :tenantType`),o[":tenantType"]=r.tenantType):i.push(`#${f.TENANT_TYPE}`),s[`#${f.PERM}`]=f.PERM,r.perms!==void 0?(n.push(`#${f.PERM} = :perms`),o[":perms"]=JSON.stringify(r.perms)):i.push(`#${f.PERM}`),s[`#${f.ROLES}`]=f.ROLES,r.roles!==void 0?(n.push(`#${f.ROLES} = :roles`),o[":roles"]=r.roles):i.push(`#${f.ROLES}`),s["#revokedAt"]=f.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${f.PK}) AND attribute_not_exists(#revokedAt)`})),g()}catch(n){return Pe(n)?u(M.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):u(M.DatabaseQueryError({query:"switch tenant"}))}}async revoke(e){try{return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":ne(new Date)},ConditionExpression:`attribute_exists(${f.PK})`})),g()}catch(r){return Pe(r)?g():u(M.DatabaseQueryError({query:"revoke session"}))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ConditionExpression:`#${f.USER_ID} = :userId AND attribute_not_exists(#${f.REVOKED_AT})`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.USER_ID}`]:f.USER_ID,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":ne(new Date),":userId":r}})),g()}catch(n){return Pe(n)?g():u(M.DatabaseQueryError({query:"revoke session by user"}))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.USER_SESSIONS,KeyConditionExpression:`${f.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let E={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return g([],{pagination:E})}let a=s.Items.map(E=>le.sessionId(E[f.PK])).map(E=>({[f.PK]:D.SESSION_PK(E),[f.SK]:D.SESSION_SK()})),l=(await qs(this.docClient,this.tableName,a)).map(E=>this.unmarshall(E)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,m={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return g(l,{pagination:m})}catch{return u(M.DatabaseQueryError({query:"find sessions by user"}))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let E={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return g([],{pagination:E})}let a=s.Items.map(E=>le.sessionId(E[f.PK])).map(E=>({[f.PK]:D.SESSION_PK(E),[f.SK]:D.SESSION_SK()})),l=(await qs(this.docClient,this.tableName,a)).map(E=>this.unmarshall(E)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,m={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return g(l,{pagination:m})}catch{return u(M.DatabaseQueryError({query:"find active sessions by user"}))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return g([]);let n=r.Items.map(i=>{let s=le.sessionId(i[f.PK]),o=ql.extractCreatedAt(i[f.ACTIVE_SESSION_SK]);return{id:s,createdAt:new Date(o)}});return g(n)}catch{return u(M.DatabaseQueryError({query:"get active sessions for limit"}))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=ne(new Date),i=await Promise.allSettled(e.map(o=>this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(o),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),s=0;for(let o of i)o.status==="fulfilled"?s+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:Aa(o.reason)});return s}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return g(0);let i=n.Items.map(o=>le.sessionId(o[f.PK])).filter(o=>!r||o!==r),s=await this.revokeSessionsByIds(i,"revokeAllByUserId");return g(s)}catch{return u(M.DatabaseQueryError({query:"revoke all sessions by user"}))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return g(r)}catch{return u(M.DatabaseQueryError({query:"revoke batch sessions"}))}}async countByUserId(e){try{let r=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return g(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count active sessions by user"}))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new SA({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(r),[f.SK]:D.SESSION_SK()},ProjectionExpression:`${f.TOKEN_ID}, ${f.REVOKED_AT}, ${f.EXPIRES_AT}`}));if(!n.Item)return g(!1);let i=n.Item,s=i[f.TOKEN_ID]===e&&!i[f.REVOKED_AT]&&z(i[f.EXPIRES_AT])>new Date;return g(s)}catch{return u(M.DatabaseQueryError({query:"check token active"}))}}marshall(e,r,n){let i={[f.PK]:D.SESSION_PK(e.id),[f.SK]:D.SESSION_SK(),[f.USER_SESSION_PK]:D.USER_PK(e.userId),[f.USER_SESSION_SK]:n,...!e.revokedAt&&{[f.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[f.ACTIVE_SESSION_SK]:n},[f.USER_ID]:e.userId,[f.TOKEN_ID]:e.tokenId,[f.EXPIRES_AT]:ne(e.expiresAt),[f.CREATED_AT]:ne(e.createdAt),[f.LAST_USED_AT]:ne(e.lastUsedAt),[f.TTL]:r};return e.tenantId&&(i[f.TENANT_ID]=e.tenantId),e.tenantType&&(i[f.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[f.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[f.ROLES]=e.roles),e.deviceLabel&&(i[f.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[f.COUNTRY]=e.country),e.city&&(i[f.CITY]=e.city),e.metadata&&(i[f.METADATA]=e.metadata),e.revokedAt&&(i[f.REVOKED_AT]=ne(e.revokedAt)),e.previousTokenId&&(i[f.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[f.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:le.sessionId(e[f.PK]),userId:e[f.USER_ID],tokenId:e[f.TOKEN_ID],expiresAt:z(e[f.EXPIRES_AT]),createdAt:z(e[f.CREATED_AT]),lastUsedAt:z(e[f.LAST_USED_AT]),revokedAt:e[f.REVOKED_AT]?z(e[f.REVOKED_AT]):null};return e[f.TENANT_ID]&&(n.tenantId=e[f.TENANT_ID]),e[f.TENANT_TYPE]&&(n.tenantType=e[f.TENANT_TYPE]),e[f.PERM]!==void 0&&(n.perms=JSON.parse(e[f.PERM])),e[f.ROLES]!==void 0&&(n.roles=e[f.ROLES]),e[f.DEVICE_LABEL]&&(n.deviceLabel=e[f.DEVICE_LABEL]),e[f.COUNTRY]&&(n.country=e[f.COUNTRY]),e[f.CITY]&&(n.city=e[f.CITY]),e[f.METADATA]&&(n.metadata=e[f.METADATA]),e[f.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[f.PREVIOUS_TOKEN_ID]),e[f.ROTATED_AT]!==void 0&&(n.rotatedAt=e[f.ROTATED_AT]),n}};import{QueryCommand as xR}from"@aws-sdk/lib-dynamodb";var Na=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":f.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=f.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new xR(o)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch(n){return console.error("[DynamoDBTenantInviteQuery.listByTenant] Error:",n instanceof Error?n.message:n),u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e){let r=le.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(i.declinedAt=z(e.declinedAt)),e.revokedAt&&(i.revokedAt=z(e.revokedAt)),i}};import{GetCommand as NA,PutCommand as bR,QueryCommand as qn,UpdateCommand as SR}from"@aws-sdk/lib-dynamodb";var NR=10080*60*1e3,wa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:le.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[f.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(n.declinedAt=z(e.declinedAt)),e.revokedAt&&(n.revokedAt=z(e.revokedAt)),n}generateInviteId(){return At()}async getById(e){try{let r=await this.docClient.send(new NA({TableName:this.tableName,Key:{PK:D.INVITE_PK(e),SK:D.INVITE_SK()}}));return r.Item?g(this.mapItemToEntity(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"getById invite"}))}}async getByToken(e){try{let n=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":f.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return g(null);let i=n[0],s=await this.docClient.send(new NA({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return s.Item?g(this.mapItemToEntity(s.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"getByToken invite"}))}}async create(e){try{let r=ae(),n=ne(e.expiresAt),i=Math.floor((n+NR)/1e3),s={PK:D.INVITE_PK(e.id),SK:D.INVITE_SK(),[f.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[f.INVITED_BY_ID]:e.invitedById,[f.INVITE_STATUS]:e.status,[f.INVITE_TOKEN]:e.inviteToken,[f.EXPIRES_AT]:n,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.TTL]:i,[f.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[f.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[f.INVITE_TOKEN_GSI]:e.inviteToken},o={};e.invitedByName&&(o.name=e.invitedByName),e.invitedByEmail&&(o.email=e.invitedByEmail),e.invitedByJobTitle&&(o.jobTitle=e.invitedByJobTitle),Object.keys(o).length>0&&(s[f.INVITED_BY_INFO]=o),e.inviteeUserId&&(s[f.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(s[f.INVITEE_EMAIL]=e.inviteeEmail,s[f.INVITEE_EMAIL_GSI]=e.inviteeEmail,s[f.INVITEE_EMAIL_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.inviteePhone&&(s[f.INVITEE_PHONE]=e.inviteePhone,s[f.INVITEE_PHONE_GSI]=e.inviteePhone,s[f.INVITEE_PHONE_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.roles!==void 0&&(s[f.ROLES]=e.roles),e.perms!==void 0&&(s[f.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(s[f.AUTH_PERM]=e.authPerm),e.displayName&&(s[f.DISPLAY_NAME]=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.jobTitle&&(s.jobTitle=e.jobTitle),await this.docClient.send(new bR({TableName:this.tableName,Item:s,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:z(r),updatedAt:z(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),g(a)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"invite id"})):u(M.UnknownError({message:r.message}))}}async updateStatus(e,r){try{let n=ae(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],s={"#inviteStatus":f.INVITE_STATUS,"#inviteTenantSk":f.INVITE_TENANT_SK,"#updatedAt":f.UPDATED_AT},o={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),s["#acceptedAt"]=f.ACCEPTED_AT,o[":acceptedAt"]=ne(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),s["#declinedAt"]=f.DECLINED_AT,o[":declinedAt"]=ne(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),s["#revokedAt"]=f.REVOKED_AT,o[":revokedAt"]=ne(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),s["#inviteTokenGsi"]=f.INVITE_TOKEN_GSI,s["#inviteeEmailGsi"]=f.INVITEE_EMAIL_GSI,s["#inviteeEmailTenantSk"]=f.INVITEE_EMAIL_TENANT_SK,s["#inviteePhoneGsi"]=f.INVITEE_PHONE_GSI,s["#inviteePhoneTenantSk"]=f.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new SR({TableName:this.tableName,Key:{PK:D.INVITE_PK(e),SK:D.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantInvite",id:e})):u(M.UnknownError({message:n.message}))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":f.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":f.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndEmail"}))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":f.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":f.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndPhone"}))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":f.INVITE_TENANT_PK,"#sk":f.INVITE_TENANT_SK,"#inviteeUserId":f.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndUserId"}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":f.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=f.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new qn(o)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant"}))}}async findPendingByEmail(e){try{let r=ae(),i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":f.INVITEE_EMAIL_GSI,"#expiresAt":f.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return g([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await qs(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return g(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByEmail"}))}}async findPendingByPhone(e){try{let r=ae(),i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":f.INVITEE_PHONE_GSI,"#expiresAt":f.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return g([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await qs(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return g(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByPhone"}))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":f.INVITE_TENANT_PK,"#sk":f.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return g(r.Count??0)}catch{return u(M.DatabaseQueryError({query:"countPendingByTenant"}))}}async expireOld(e){return g(0)}};import{QueryCommand as wR}from"@aws-sdk/lib-dynamodb";var Ra=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":D.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=(await this.docClient.send(new wR(i))).Items||[],a=[],c=new Map;for(let E of o){let v=E.SK;if(v.startsWith(Ve.TENANT_PROFILE)){let b=le.tenantProfileUserId(v);c.set(b,E)}else v.startsWith(ce.USER)&&a.push(E)}a.sort((E,v)=>v.createdAt-E.createdAt);let l=a.slice(0,n),d=a.length>n,p=l.map(E=>{let v=le.tenantMemberUserId(E.SK),b=c.get(v);return this.toListItem(E,e,v,b)}),m=d&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:d,cursor:m,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e,r,n,i){let s={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};if(e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm),i){let o={tenantId:r,userId:n,createdAt:z(i.createdAt),updatedAt:z(i.updatedAt)};i.contactEmail&&(o.contactEmail=i.contactEmail),i.contactPhone&&(o.contactPhone=i.contactPhone),i.displayName&&(o.displayName=i.displayName),i.displayNameSource&&(o.displayNameSource=i.displayNameSource),i.givenName&&(o.givenName=i.givenName),i.familyName&&(o.familyName=i.familyName),i.avatarUrl&&(o.avatarUrl=i.avatarUrl),i.locale&&(o.locale=i.locale),i.jobTitle&&(o.jobTitle=i.jobTitle),i.bio&&(o.bio=i.bio),i.metadata&&(o.metadata=JSON.parse(i.metadata)),s.tenantProfile=o}return s}};import{DeleteCommand as RR,DynamoDBDocumentClient as OR,GetCommand as wA,PutCommand as kR,QueryCommand as CR,TransactWriteCommand as DR,UpdateCommand as RA}from"@aws-sdk/lib-dynamodb";var Oa=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=OR.from(e)}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new wA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)}}));if(!n.Item)return g(null);let i=this.mapItemToEntity(n.Item);return g(i)}catch{return u(M.DatabaseQueryError({query:"get"}))}}async create(e){try{let r=ae(),n=e.isOwner?void 0:e.authPerm,i=Ft({PK:D.TENANT_MEMBER_PK(e.tenantId),SK:D.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new DR({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:D.TENANT_MEMBER_PK(e.tenantId),SK:D.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new kR({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?u(M.UniqueConstraintViolation({field:"tenant owner"})):u(M.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant member"})):u(M.UnknownError({message:r.message}))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:ae()},{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new RA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async updateStatus(e,r,n){try{return await this.docClient.send(new RA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":ae()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.TENANT_MEMBER_PK(e),":skPrefix":ce.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=await this.docClient.send(new CR(i)),o=(s.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!s.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return mr(o,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch(n){let i=n instanceof Error?`${n.name}: ${n.message}`:String(n);return console.error("[DynamoDBTenantMemberRepository.listByTenant] Error:",i),u(M.DatabaseQueryError({query:`listByTenant \u2014 ${i}`}))}}async hasOwner(e){try{let r=await this.docClient.send(new wA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_OWNER_MARKER_SK()}}));return g(!!r.Item)}catch{return u(M.DatabaseQueryError({query:"hasOwner"}))}}async remove(e,r){try{return await this.docClient.send(new RR({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};import{BatchGetCommand as PR,QueryCommand as UR}from"@aws-sdk/lib-dynamodb";var ka=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??Zt.DEFAULT,s=r?.parentTenantId,o=s?`${i}#${s}#`:`${i}#`,a={TableName:this.tableName,IndexName:Se.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":o},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new UR(a)),l=c.Items??[],d=await this.fetchProfileMap(e,l),p=l.map(v=>this.toListItem(v,e,d)),m=!!c.LastEvaluatedKey,E=m?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:m,cursor:E,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByUser query"}))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(o=>({PK:D.TENANT_PROFILE_PK(le.tenantId(o.PK)),SK:D.TENANT_PROFILE_SK(e)})),s=await this.docClient.send(new PR({RequestItems:{[this.tableName]:{Keys:i}}}));for(let o of s.Responses?.[this.tableName]??[]){let a=o,c=le.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=le.tenantId(e.PK),s={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm);let o=n.get(i);return o&&(o.contactEmail&&(s.contactEmail=o.contactEmail),o.contactPhone&&(s.contactPhone=o.contactPhone),o.displayName&&(s.displayName=o.displayName),o.displayNameSource&&(s.displayNameSource=o.displayNameSource),o.givenName&&(s.givenName=o.givenName),o.familyName&&(s.familyName=o.familyName),o.avatarUrl&&(s.avatarUrl=o.avatarUrl),o.locale&&(s.locale=o.locale),o.jobTitle&&(s.jobTitle=o.jobTitle),o.bio&&(s.bio=o.bio),o.metadata&&(s.metadata=JSON.parse(o.metadata))),s}};import{DeleteCommand as LR,GetCommand as MR,PutCommand as KR,UpdateCommand as HR}from"@aws-sdk/lib-dynamodb";var Ca=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return At()}toEntity(e){let n={id:le.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new MR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()}}));return r.Item?g(this.toEntity(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get tenant"}))}}async create(e){try{let r=e.id??this.generateTenantId(),n=ae(),i=Ft({PK:D.TENANT_PK(r),SK:D.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new KR({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant"})):u(M.UnknownError({message:r.message}))}}async update(e,r){try{let n={updatedAt:ae()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o}=wr(n);return await this.docClient.send(new HR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:n.message}))}}async delete(e){try{return await this.docClient.send(new LR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:r.message}))}}async list(){return u(M.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return u(M.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return u(M.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as FR,GetCommand as VR,PutCommand as BR,UpdateCommand as Wl}from"@aws-sdk/lib-dynamodb";var Da=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new VR({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()}}));return r.Item?g(this.unmarshall(r.Item,e)):g(null)}catch{return u(M.DatabaseQueryError({query:"get user auth"}))}}async create(e){try{let r=ae(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new BR({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${f.PK})`})),g(n)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"userAuth"})):u(M.DatabaseQueryError({query:"create user auth"}))}}async updateStatus(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update user auth status"}))}}async updateMfaRequired(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa required"}))}}async updateMfaMethods(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa methods"}))}}async updateMfaSettings(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa settings"}))}}async remove(e){try{return await this.docClient.send(new FR({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user auth"}))}}marshall(e){return{[f.PK]:D.USER_PK(e.userId),[f.SK]:D.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}}};import{DynamoDBDocumentClient as qR,DeleteCommand as jR,GetCommand as GR,PutCommand as $R,QueryCommand as OA,UpdateCommand as Af}from"@aws-sdk/lib-dynamodb";function Gs(t,e){return e?D.USER_MFA_WITH_ID_SK(t,e):D.USER_MFA_SK(t)}var Pa=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=qR.from(e)}toDynamoDBItem(e){let r={PK:D.USER_PK(e.userId),SK:Gs(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=le.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:z(e.createdAt),verifiedAt:Ht(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Ht(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Ht(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Ht(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=Gs(r,n),s=await this.docClient.send(new GR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i}}));return s.Item?g(this.fromDynamoDBItem(s.Item,e)):g(null)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.get error:",i),u(M.DatabaseQueryError({query:"get MFA authenticator"}))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.USER_PK(e),":skPrefix":Ve.MFA}},s=((await this.docClient.send(new OA(r))).Items??[]).map(o=>this.fromDynamoDBItem(o,e));return g(s)}catch(r){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserId error:",r),u(M.DatabaseQueryError({query:"find MFA authenticators by user"}))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.USER_PK(e),":skPrefix":`${Ve.MFA}${r}`}},o=((await this.docClient.send(new OA(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return g(o)}catch(n){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserIdAndMethod error:",n),u(M.DatabaseQueryError({query:"find MFA authenticators by method"}))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=At());let n=this.toDynamoDBItem(r);return await this.docClient.send(new $R({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(this.fromDynamoDBItem(n,e.userId))}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"MFA authenticator"})):(console.error("DynamoDBUserMFAAuthenticatorRepository.create error:",r),u(M.DatabaseQueryError({query:"create MFA authenticator"})))}}async update(e,r,n,i){try{let s=Gs(r,n),o=[],a={},c={};if(i.label!==void 0&&(o.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(o.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(o.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(o.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(o.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(o.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(o.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(o.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),o.length===0)return g(void 0);let l={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:s},UpdateExpression:`SET ${o.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new Af(l)),g(void 0)}catch(s){return console.error("DynamoDBUserMFAAuthenticatorRepository.update error:",s),u(M.DatabaseQueryError({query:"update MFA authenticator"}))}}async remove(e,r,n){try{let i=Gs(r,n);return await this.docClient.send(new jR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i}})),g(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.remove error:",i),u(M.DatabaseQueryError({query:"remove MFA authenticator"}))}}async incrementFailedAttempts(e,r,n,i,s){try{let o=Gs(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},d={":zero":0,":inc":1,":lastFailedAt":a};s!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",d[":lockedUntil"]=a+s*60*1e3,d[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:o},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:d};return await this.docClient.send(new Af(p)),g(void 0)}catch(o){return console.error("DynamoDBUserMFAAuthenticatorRepository.incrementFailedAttempts error:",o),u(M.DatabaseQueryError({query:"increment failed attempts"}))}}async resetFailedAttempts(e,r,n){try{let i=Gs(r,n),s={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new Af(s)),g(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.resetFailedAttempts error:",i),u(M.DatabaseQueryError({query:"reset failed attempts"}))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as WR,DynamoDBDocumentClient as zR,GetCommand as JR,PutCommand as YR,QueryCommand as kA,UpdateCommand as CA}from"@aws-sdk/lib-dynamodb";var Ua=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=zR.from(e)}generateUserId(){return At()}async getById(e){try{let r=await this.docClient.send(new JR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()}}));if(!r.Item)return g(null);let n=r.Item;if(n.deletedAt)return g(null);let s={id:le.userId(n.PK),status:n.userStatus,createdAt:z(n.createdAt),updatedAt:z(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:z(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return g(s)}catch{return u(M.DatabaseQueryError({query:"getById user"}))}}async create(e){try{let r=ae(),n=e.id||this.generateUserId(),i=e.status||"pending",s={PK:D.USER_PK(n),SK:D.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(s.contactEmail=e.contactEmail),e.contactPhone&&(s.contactPhone=e.contactPhone),e.username&&(s.username=e.username),e.displayName&&(s.displayName=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.avatarUrl&&(s.avatarUrl=e.avatarUrl),e.locale&&(s.locale=e.locale),e.metadata&&(s.metadata=JSON.stringify(e.metadata)),s[f.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),s[f.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new YR({TableName:this.tableName,Item:Ft(s),ConditionExpression:uf("PK")}));let o={id:n,status:i,createdAt:z(r),updatedAt:z(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return g(o)}catch{return u(M.DatabaseQueryError({query:"create user"}))}}async updateProfile(e,r){try{let n=ae(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return g(void 0);i.updatedAt=n;let s=wr(i);return await this.docClient.send(new CA({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()},UpdateExpression:s.UpdateExpression,ExpressionAttributeNames:s.ExpressionAttributeNames,ExpressionAttributeValues:s.ExpressionAttributeValues})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"updateProfile"}))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=Ae.USER_STATUS_PK(e),o=await this.docClient.send(new kA({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${f.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":s},Limit:n,ExclusiveStartKey:i})),a=[];if(o.Items&&o.Items.length>0)for(let d of o.Items){let p=le.userId(d.PK);a.push(p)}let c=!!o.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return g(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch{return u(M.DatabaseQueryError({query:"get users by status"}))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new kA({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${f.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return g(n.Count||0)}catch{return u(M.DatabaseQueryError({query:"count users by status"}))}}async syncAuthStatus(e,r){try{let n=ae(),i=`SET userStatus = :userStatus, #${f.UPDATED_AT} = :updatedAt, #${f.USER_STATUS_PK} = :statusPk, #${f.USER_STATUS_SK} = :statusSk`,s={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",s[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new CA({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${f.UPDATED_AT}`]:f.UPDATED_AT,[`#${f.USER_STATUS_PK}`]:f.USER_STATUS_PK,[`#${f.USER_STATUS_SK}`]:f.USER_STATUS_SK},ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userProfile",id:e})):u(M.DatabaseQueryError({query:"sync auth status"}))}}async remove(e){try{return await this.docClient.send(new WR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user profile"}))}}};import{DeleteCommand as XR,DynamoDBDocumentClient as QR,GetCommand as ZR,PutCommand as e0,QueryCommand as t0,UpdateCommand as r0}from"@aws-sdk/lib-dynamodb";var La=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=QR.from(e)}mapItemToUserProviderLink(e){let r=le.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:z(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=ae(),n={PK:D.PROVIDER_PK(e.provider,e.externalId),SK:D.PROVIDER_METADATA_SK(),userProviderPk:D.USER_PK(e.userId),userProviderSk:D.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?ne(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Ft(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new ZR({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()}}));return n.Item?g(this.mapItemToUserProviderLink(n.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"find provider by external id"}))}}async findByUserId(e){try{let r=await this.docClient.send(new t0({TableName:this.tableName,IndexName:Se.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":f.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":D.USER_PK(e)}}));return!r.Items||r.Items.length===0?g([]):g(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch{return u(M.DatabaseQueryError({query:"find providers by user id"}))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new e0({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),g(this.mapItemToUserProviderLink(n))}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):u(M.DatabaseQueryError({query:"create user provider"}))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return g(void 0);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new r0({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update user provider"}))}}async remove(e,r){try{return await this.docClient.send(new XR({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"delete user provider"}))}}};import{DeleteCommand as n0,GetCommand as i0,PutCommand as s0,UpdateCommand as o0}from"@aws-sdk/lib-dynamodb";var Ma=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new i0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)}}));return n.Item?g(this.mapItemToEntity(n.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get user tenant profile"}))}}async create(e){try{let r=ae(),n={PK:D.TENANT_PROFILE_PK(e.tenantId),SK:D.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new s0({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:z(r),updatedAt:z(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),g(i)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"user tenant profile"})):u(M.UnknownError({message:r.message}))}}async update(e,r,n){try{let i={updatedAt:ae()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new o0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async remove(e,r){try{return await this.docClient.send(new n0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};var Tf=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new c0(e.clientConfig||{});let r=l0.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Ua(this.client,this.tableName),this.sessions=new Sa({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new La(this.client,this.tableName),this.userMfaAuthenticators=new Pa(this.client,this.tableName),this.challenges=new Ta({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new Ia({docClient:r,tableName:this.tableName}),this.credentials=new _a({docClient:r,tableName:this.tableName}),this.registration=new xa({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Da({docClient:r,tableName:this.tableName}),this.tenantMembers=new Oa(this.client,this.tableName),this.tenantInvites=new wa({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new Ma(r,this.tableName),this.tenants=new Ca({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new Na({docClient:r,tableName:this.tableName}),tenantMembers:new Ra({docClient:r,tableName:this.tableName}),tenants:new ka({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new a0({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function DA(t){return new Tf(t)}ho();var _f=1,PA=2,UA=3,LA="auth-craft:internal";async function u0(t){let e=t.replace(/^0x/,""),r=KA(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let s=`-----BEGIN PRIVATE KEY-----
-`+btoa(String.fromCharCode(...i)).match(/.{1,64}/g).join(`
-`)+`
------END PRIVATE KEY-----`;return ao(s,"EdDSA")}async function d0(t){let e=t.replace(/^0x/,""),r=KA(e),n=f0(r);return it({kty:"OKP",crv:"Ed25519",x:n},"EdDSA")}async function If(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return it(JSON.parse(r),e);if(!r.includes(`
-`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return it(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return u0(r)}if(r.startsWith("-----"))return ao(r,e)}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function MA(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return it(JSON.parse(r),e);if(!r.includes(`
-`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return it(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return d0(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(ho(),ch));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function p0(t){return new TextEncoder().encode(t)}function KA(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function f0(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var zl=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await p0(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await If(this.config.privateKey,e),i=await MA(this.config.publicKey,e),s,o;return this.config.servicePrivateKey&&this.config.servicePublicKey?(s=await If(this.config.servicePrivateKey,e),o=await MA(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(s=await If(this.config.servicePrivateKey,e),o=i):(s=n,o=i),{privateKey:n,publicKey:i,servicePrivateKey:s,servicePublicKey:o}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),s=i+r*60,o=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:o??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?PA:_f,iat:i,exp:s};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new Zi(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,s=this.config.clockTolerance??0,o={algorithms:[i],clockTolerance:s};this.config.issuer&&(o.issuer=this.config.issuer),n&&(typeof n=="string"||n.length>0)&&(o.audience=n);let{payload:a}=await bn(e,r,o);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1);return this.signJwt(s,n.privateKey)}accessVerifyAudience(){return this.config.accessTokenAudiences&&this.config.accessTokenAudiences.length>0?this.config.accessTokenAudiences:this.config.accessTokenAudience??this.config.audience}refreshVerifyAudience(){return this.config.refreshTokenAudiences&&this.config.refreshTokenAudiences.length>0?this.config.refreshTokenAudiences:this.config.refreshTokenAudience??this.config.audience}async verify(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==_f?null:n}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1),o={...s};return e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=e.perms),{token:await this.signJwt(o,n.privateKey),expiresAt:s.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==_f||!("jti"in n)?null:n}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,s=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(s,n.privateKey),expiresAt:s.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.refreshVerifyAudience());return!n||n.typ!==PA||!("sid"in n)||!("jti"in n)?null:n}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,s=e.aud??this.config.serviceTokenAudience??LA,o={sub:e.sub,aud:s,iss:this.config.issuer??"",jti:e.jti,typ:UA,iat:n,exp:n+i*60};return e.roles!==void 0&&(o.roles=e.roles),this.signJwt(o,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??LA,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==UA?null:i}async initialize(){}async cleanup(){}};function xf(t){return new zl(t)}import{DynamoDBClient as m0}from"@aws-sdk/client-dynamodb";function h0(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),g(void 0)}}}function E0(){return F.email.mode==="console"?h0():F.email.mode==="queue"?aa.createAwsSqs({queueUrl:F.email.queue.url,...F.email.queue.region?{region:F.email.queue.region}:{},envelope:F.email.queue.envelope,sourceSystem:F.email.queue.sourceSystem,eventTypeMap:F.email.queue.eventTypeMap,defaultMetadata:F.email.queue.defaultMetadata}):Ea.createDirectSmtp({host:F.smtp.host,port:F.smtp.port,secure:F.smtp.secure,auth:{user:F.smtp.user,pass:F.smtp.pass},fromEmail:F.smtp.from,fromName:"Auth Craft"})}async function HA(){let t=Zy(),e=Fy({codeLifetimeMinutes:F.auth.verificationCodeLifetimeMinutes}),r=Zv(),n=xf({algorithm:F.jwtAlgorithm,privateKey:F.jwtPrivateKey,publicKey:F.jwtPublicKey,accessTokenExpiresIn:F.auth.tokens.accessTokenLifetimeMinutes*60,refreshTokenExpiresIn:F.auth.tokens.refreshTokenLifetimeMinutes*60,issuer:F.jwtIssuer,accessTokenAudience:F.jwtAccessTokenAudience,refreshTokenAudience:F.jwtRefreshTokenAudience,accessTokenAudiences:[F.security.tokenAudiences.customer,F.security.tokenAudiences.tenant,F.security.tokenAudiences.system],refreshTokenAudiences:[F.security.tokenAudiences.customer,F.security.tokenAudiences.tenant,F.security.tokenAudiences.system]}),i=new m0({region:F.awsRegion,...F.dynamodbEndpoint?{endpoint:F.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),s=DA({tableName:F.dynamodbTableName,client:i}),o=E0(),a=new Map;F.oauth.facebook&&a.set("facebook",af({appId:F.oauth.facebook.clientId,appSecret:F.oauth.facebook.clientSecret,redirectUri:F.oauth.facebook.redirectUri})),F.oauth.google&&a.set("google",cf({clientId:F.oauth.google.clientId,clientSecret:F.oauth.google.clientSecret,redirectUri:F.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:s,emailSystem:o,deviceParser:rg(),rateLimiter:oA(),mfa:{totp:sA({issuer:F.auth.systemName}),email:eA()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await na({systemId:F.auth.systemName,plugins:c,security:{...Vd.HIGH,maxFailedAttempts:F.security.maxLoginAttempts,lockoutDurationMinutes:F.security.lockoutDurationMinutes,requireVerifiedIdentity:F.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:F.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:F.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:F.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:F.auth.verificationResendCooldownSeconds,verifySessionOnAuth:F.security.verifySessionOnAuth,systemTenantId:F.security.systemTenantId,tokenAudiences:F.security.tokenAudiences},system:{environment:F.nodeEnv},policy:{auditEnabled:F.features.auditEnabled,deviceTrackingEnabled:F.features.deviceTracking,sessionRotationEnabled:!0},version:F.auth.appVersion,email:{appName:"Auth Craft",appUrl:F.auth.appUrl,supportEmail:F.auth.supportEmail}})}var Ka={INTERNAL_ERROR:X("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:T("INVALID_TOKEN_TYPE","Access token required")};function QA(t,e){let r=tn(e);return t.json(r.body,r.status)}function U0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}Ky();var wi=F.appBasePath?(F.appBasePath.startsWith("/")?F.appBasePath:`/${F.appBasePath}`).replace(/\/$/,""):"",ZA=wi?`${wi}/health`:"/health",Of=null,Or=null;async function L0(){return Of||(Of=await HA(),console.log("\u2705 Auth SDK initialized")),Of}async function eT(){if(!Or){let t=await L0(),e={algorithm:F.jwtAlgorithm,publicKey:F.jwtPublicKey,issuer:F.jwtIssuer},r=gr(e),n=es({gateway:{...F.gatewayJwt.publicKeyHex?{publicKeyHex:F.gatewayJwt.publicKeyHex}:{},expectedIssuer:F.gatewayJwt.issuer,expectedAudience:F.gatewayJwt.audience,header:F.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==cn.Access?u(Ka.INVALID_TOKEN_TYPE()):c}}}),i=Fu({auth:{jwt:{...e,verify:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==cn.Access?u(Ka.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Or=new Vr,F.nodeEnv!=="production"&&Or.use("*",async(o,a)=>{let c=o.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:o.req.method,path:o.req.path,gatewaySecret:o.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:o.res.status,duration:`${Date.now()-l}ms`}))}),F.corsOrigins.length>0&&Or.use("*",Sy({origin:F.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),F.gatewaySecret&&Or.use("*",async(o,a)=>{if(o.req.path===ZA)return a();let c=o.req.header("X-Gateway-Secret");return!c||!U0(c,F.gatewaySecret)?(F.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),o.notFound()):a()}),Or.get(ZA,o=>QA(o,g({status:"healthy",timestamp:new Date().toISOString()}))),Or.use("*",Vu);let s=kd({auth:t,policy:i,tokenStrategy:F.auth.tokens.refreshTokenStrategy,...F.auth.tokens.refreshTokenCookie?{refreshTokenCookie:F.auth.tokens.refreshTokenCookie}:{},...F.corsOrigins.length>0?{trustedOrigins:F.corsOrigins}:{}});if(Or.route(wi,s),console.log(`\u{1F510} Auth routes mounted at ${wi||"/"}`),F.internal.publicKey){let o=wi?`${wi}${F.internal.serviceRoutePath}`:F.internal.serviceRoutePath,a=Hd({auth:t,internal:{publicKeyJwk:F.internal.publicKey,alg:F.internal.alg,audience:F.internal.audience,issuer:F.internal.issuer}});Or.route(o,a),console.log(`\u{1F512} Internal routes mounted at ${o}`)}Or.onError((o,a)=>{console.error("\u274C [Error]",{message:o.message,stack:o.stack,path:a.req.path});let c=F.nodeEnv==="production"?"Internal Server Error":o.message||"Internal Server Error";return QA(a,u(Ka.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Or}var zte=async(t,e)=>{try{let r=await eT();return Fd(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=F.nodeEnv==="production"?"Internal Server Error":n,s=tn(u(Ka.INTERNAL_ERROR({message:i})));return{statusCode:s.status,body:JSON.stringify(s.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(XA(),YA));eT().then(e=>{let r=F.port,n=F.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${F.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${wi||""}`),console.log(`\u{1F511} Gateway secret: ${F.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${F.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{zte as handler};
-//# sourceMappingURL=index.mjs.map