@auth-craft/aws-cf-stack 1.9.0 → 1.10.1

package/assets/lambda/index.mjs

@@ -1,71 +1,68 @@
 import{createRequire}from'module';const require=createRequire(import.meta.url);
-var M_=Object.create;var Fu=Object.defineProperty;var K_=Object.getOwnPropertyDescriptor;var H_=Object.getOwnPropertyNames;var F_=Object.getPrototypeOf,V_=Object.prototype.hasOwnProperty;var re=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var Q=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var me=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},cc=(t,e)=>{for(var r in e)Fu(t,r,{get:e[r],enumerable:!0})},B_=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of H_(e))!V_.call(t,i)&&i!==r&&Fu(t,i,{get:()=>e[i],enumerable:!(n=K_(e,i))||n.enumerable});return t};var qm=(t,e,r)=>(r=t!=null?M_(F_(t)):{},B_(e||!t||!t.__esModule?Fu(r,"default",{value:t,enumerable:!0}):r,t));function tt(...t){let e=t.reduce((i,{length:s})=>i+s,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function $u(t,e,r){if(e<0||e>=pc)throw new RangeError(`value must be >= 0 and <= ${pc-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function Wu(t){let e=Math.floor(t/pc),r=t%pc,n=new Uint8Array(8);return $u(n,e,0),$u(n,r,4),n}function fc(t){let e=new Uint8Array(4);return $u(e,t),e}function Xe(t){let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}var ci,li,An,pc,Ut=Q(()=>{ci=new TextEncoder,li=new TextDecoder,An=new TextDecoder("utf-8",{fatal:!0}),pc=2**32});function zu(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function hc(t,e){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}function Yr(t,e,r){let n=t.algorithm;if(n.name!==e.name)throw mc(e.name);if(e.hash&&n.hash?.name!==e.hash)throw mc(e.hash,"algorithm.hash");if(e.namedCurve&&n.namedCurve!==e.namedCurve)throw mc(e.namedCurve,"algorithm.namedCurve");if(e.length!==void 0&&n.length!==e.length)throw mc(e.length,"algorithm.length");zu(t,r)}var mc,Ec=Q(()=>{mc=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`)});function $m(t,e,...r){if(r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}var Dr,Ju,$i=Q(()=>{Dr=(t,...e)=>$m("Key must be ",t,...e),Ju=(t,e,...r)=>$m(`Key for the ${t} algorithm must be `,e,...r)});var Yu={};cc(Yu,{JOSEAlgNotAllowed:()=>Tn,JOSEError:()=>rt,JOSENotSupported:()=>Ee,JWEDecryptionFailed:()=>Pr,JWEInvalid:()=>G,JWKInvalid:()=>fo,JWKSInvalid:()=>zi,JWKSMultipleMatchingKeys:()=>mo,JWKSNoMatchingKey:()=>ui,JWKSTimeout:()=>ho,JWSInvalid:()=>fe,JWSSignatureVerificationFailed:()=>_n,JWTClaimValidationFailed:()=>Lt,JWTExpired:()=>Wi,JWTInvalid:()=>We});var rt,Lt,Wi,Tn,Ee,Pr,G,fe,We,fo,zi,ui,mo,ho,_n,Te=Q(()=>{rt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},Lt=class extends rt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Wi=class extends rt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Tn=class extends rt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},Ee=class extends rt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},Pr=class extends rt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},G=class extends rt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},fe=class extends rt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},We=class extends rt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},fo=class extends rt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},zi=class extends rt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},ui=class extends rt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},mo=class extends rt{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},ho=class extends rt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},_n=class extends rt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});function yc(t){if(!hr(t))throw new Error("CryptoKey instance expected")}var hr,Eo,gc,di=Q(()=>{hr=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},Eo=t=>t?.[Symbol.toStringTag]==="KeyObject",gc=t=>hr(t)||Eo(t)});function Wm(t,e){let r=t.byteLength<<3;if(r!==e)throw new G(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function zm(t,e){if(e.length<<3!==t.ivBits)throw new G("Invalid Initialization Vector length")}async function Jm(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(Dr(e,"Uint8Array"));let n=t.cekBits>>1,i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),s=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[i,s,n]}async function Ym(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function W_(t,e,r,n,i){let[s,o,a]=await Jm(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},s,e)),l=tt(i,n,c,Wu(i.length*8)),d=await Ym(o,l,a);return{ciphertext:c,tag:d,iv:n}}async function z_(t,e){let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),i=await crypto.subtle.sign(r,n,t);return crypto.subtle.verify(r,n,i,e)}async function J_(t,e,r,n,i,s){let[o,a,c]=await Jm(t,e,"decrypt"),l=tt(s,n,r,Wu(s.length*8)),d=await Ym(a,l,c),p;try{p=await z_(i,d)}catch{}if(!p)throw new Pr;let f;try{f=new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},o,r))}catch{}if(!f)throw new Pr;return f}async function Y_(t,e,r,n,i){let s=r instanceof Uint8Array?await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(Yr(r,t.subtle,"encrypt"),r),o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),a=o.slice(-16);return{ciphertext:o.slice(0,-16),tag:a,iv:n}}async function X_(t,e,r,n,i,s){let o=e instanceof Uint8Array?await crypto.subtle.importKey("raw",e,"AES-GCM",!1,["decrypt"]):(Yr(e,t.subtle,"decrypt"),e);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:s,iv:n,name:"AES-GCM",tagLength:128},o,tt(r,i)))}catch{throw new Pr}}async function vc(t,e,r,n,i){if(!hr(r)&&!(r instanceof Uint8Array))throw new TypeError(Dr(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));return n?zm(t,n):n=$_(t),r instanceof Uint8Array&&Wm(r,t.cekBits),t.cbc?W_(t,e,r,n,i):Y_(t,e,r,n,i)}async function Ac(t,e,r,n,i,s){if(!hr(e)&&!(e instanceof Uint8Array))throw new TypeError(Dr(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new G("JWE Initialization Vector missing");if(!i)throw new G("JWE Authentication Tag missing");return zm(t,n),e instanceof Uint8Array&&Wm(e,t.cekBits),t.cbc?J_(t,e,r,n,i,s):X_(t,e,r,n,i,s)}var Ur,$_,yo=Q(()=>{Ut();Ec();$i();Te();di();Ur=t=>crypto.getRandomValues(new Uint8Array(t.cekBits>>3));$_=t=>crypto.getRandomValues(new Uint8Array(t.ivBits>>3))});function Tc(t){if(Uint8Array.prototype.toBase64)return t.toBase64();let e=32768,r=[];for(let n=0;n<t.length;n+=e)r.push(String.fromCharCode.apply(null,t.subarray(n,n+e)));return btoa(r.join(""))}function _c(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t);let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}var Xu=Q(()=>{});var Ic={};cc(Ic,{decode:()=>tr,encode:()=>Ue});function tr(t){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof t=="string"?t:li.decode(t),{alphabet:"base64url"})}catch(r){throw new TypeError(Qu,{cause:r})}let e=t;if(e instanceof Uint8Array&&(e=li.decode(e)),e.includes("+")||e.includes("/"))throw new TypeError(Qu);e=e.replace(/-/g,"+").replace(/_/g,"/");try{return _c(e)}catch{throw new TypeError(Qu)}}function Ue(t){let e=t;return typeof e=="string"&&(e=ci.encode(e)),Uint8Array.prototype.toBase64?e.toBase64({alphabet:"base64url",omitPadding:!0}):Tc(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var Qu,qt=Q(()=>{Ut();Xu();Qu="The input to be decoded is not correctly encoded."});function _e(t){if(typeof t!="object"||t===null||Object.prototype.toString.call(t)!=="[object Object]")return!1;let e=Object.getPrototypeOf(t);if(e===null)return!0;let r=e;for(;Object.getPrototypeOf(r)!==null;)r=Object.getPrototypeOf(r);return e===r}function In(...t){let e=new Set;for(let r of t)if(r)for(let n of Object.keys(r)){if(e.has(n))return!1;e.add(n)}return!0}var xc,Xm,Qm,Zm,at=Q(()=>{xc=t=>_e(t)&&typeof t.kty=="string",Xm=t=>t.kty!=="oct"&&(t.kty==="AKP"&&typeof t.priv=="string"||typeof t.d=="string"),Qm=t=>t.kty!=="oct"&&t.d===void 0&&t.priv===void 0,Zm=t=>t.kty==="oct"&&typeof t.k=="string"});function qe(t,e){if(t)throw new TypeError(`${e} can only be called once`)}function ht(t,e,r){try{return tr(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}function bc(t,e,r){try{return Xe(t)}catch{throw new r(`The ${e} is not a valid base64url string`)}}async function Sc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}function Ji(t,e,r){let n;try{n=JSON.parse(An.decode(tr(t)))}catch{throw new e(r)}if(!_e(n))throw new e(r);return n}var eh,rr=Q(()=>{qt();Ut();at();eh=Symbol()});async function nr(t,e){if(e.kty==="RSA"&&"oth"in e&&e.oth!==void 0)throw new Ee('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!t.kty.includes(e.kty))throw new Ee('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let r=t.resolve?.({kty:e.kty,crv:e.crv})??t.subtle,n=!!(e.d||e.priv),i={...e};return i.kty!=="AKP"&&delete i.alg,delete i.use,crypto.subtle.importKey("jwk",i,r,e.ext??!n,e.key_ops??t.usages[n?1:0])}var Yi=Q(()=>{Te()});function eI(t,e,r){let{alg:n,secret:i}=t,s=r==="decrypt"||r==="sign";if(i&&e instanceof Uint8Array)return[rh,e];if(xc(e)){if(i?!Zm(e):!(s?Xm(e):Qm(e)))throw new TypeError(i?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${s?"private":"public"} JWK`);return Z_(t,e,r),[sh,e]}if(!gc(e))throw new TypeError(i?Ju(n,e,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):Ju(n,e,"CryptoKey","KeyObject","JSON Web Key"));if(i){if(e.type!=="secret")throw new TypeError(`${Zu(e)} instances for symmetric algorithms must be of type "secret"`)}else{if(e.type==="secret")throw new TypeError(`${Zu(e)} instances for asymmetric algorithms must not be of type "secret"`);let o=s?"private":"public";if((e.type==="public"||e.type==="private")&&e.type!==o){let a=r==="sign"?"signing":r==="verify"?"verifying":`${r.slice(0,-1)}tion`;throw new TypeError(`${Zu(e)} instances for asymmetric algorithm ${a} must be of type "${o}"`)}}return hr(e)?[nh,e]:[ih,e]}function wc(t,e,r){ed||=new WeakMap;let n=ed.get(t);return r&&(n?n[e]=r:ed.set(t,{__proto__:null,[e]:r})),r??n?.[e]}async function ir(t,e,r){let n=eI(t,e,r);switch(n[0]){case rh:case nh:return n[1];case sh:{let i=n[1];if(i.k)return tr(i.k);if(!Object.isFrozen(i)){let{key_ops:s}=i;Array.isArray(s)&&Object.freeze(s),Object.freeze(i)}return th(i,i,t)}case ih:{let i=n[1];return i.type==="secret"?i.export():"toCryptoKey"in i&&typeof i.toCryptoKey=="function"?rI(i,t):th(i,i.export({format:"jwk"}),t)}}}var Zu,Z_,rh,nh,ih,sh,ed,tI,th,rI,pi=Q(()=>{$i();di();at();qt();Yi();Zu=t=>t[Symbol.toStringTag],Z_=(t,e,r)=>{let{alg:n}=t;if(e.use!==void 0){let i=r==="sign"||r==="verify"?"sig":"enc";if(e.use!==i)throw new TypeError(`Invalid key for this operation, its "use" must be "${i}" when present`)}if(e.alg!==void 0&&e.alg!==n)throw new TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(e.key_ops)){let i=r==="encrypt"||r==="decrypt"?t.ops?.[r==="encrypt"?0:1]:r;if(i&&!e.key_ops.includes(i))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${i}" when present`)}};rh=0,nh=1,ih=2,sh=3,tI={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};th=async(t,e,r)=>wc(t,r.alg)??wc(t,r.alg,await nr(r,{...e,alg:r.alg})),rI=(t,e)=>{let r=wc(t,e.alg);if(r)return r;let n=t.type==="public",i=e.usages[n?0:1],{asymmetricKeyType:s}=t,o=tI[t.asymmetricKeyDetails?.namedCurve],a=e.resolve?.({crv:o,asymmetricKeyType:s})??e.subtle;return wc(t,e.alg,t.toCryptoKey(a,n,i))}});function go(t){let e={__proto__:null};for(let r in t)e[r]={...t[r],alg:r};return e}var td=Q(()=>{});function Nc(t){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:`SHA-${t}`},usages:nI,ops:["wrapKey","unwrapKey"]}}function Rc(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:({kty:t,crv:e,asymmetricKeyType:r})=>{if(e==="X25519"||r==="x25519")return{name:"X25519"};if(t==="OKP")throw new Ee('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:e}},usages:iI,ops:[void 0,"deriveBits"]}}function Xi(t,e=!1){return{kty:["oct"],secret:!0,subtle:{name:e?"AES-GCM":"AES-KW",length:t},usages:Oc,ops:e?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function rd(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:Oc,ops:["deriveBits","deriveBits"]}}function Qi(t,e=!1){return{kty:["oct"],secret:!0,subtle:{name:e?"AES-CBC":"AES-GCM",length:t},usages:Oc,ops:sI,cekBits:t,ivBits:e?128:96,cbc:e}}function oh(t,e){throw new Ee(`Invalid or unsupported "${t}" (JWE ${e}) header value`)}function sr(t){return(typeof t=="string"?nd[t]:void 0)??oh("alg","Algorithm")}function fi(t){return(typeof t=="string"?oI[t]:void 0)??oh("enc","Encryption Algorithm")}var nI,iI,Oc,nd,sI,oI,Zi=Q(()=>{Te();td();nI=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],iI=[[],["deriveBits"]],Oc=[[],[]];nd=go({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:Oc,ops:["encrypt","decrypt"]},"RSA-OAEP":Nc(1),"RSA-OAEP-256":Nc(256),"RSA-OAEP-384":Nc(384),"RSA-OAEP-512":Nc(512),"ECDH-ES":Rc(),"ECDH-ES+A128KW":Rc(),"ECDH-ES+A192KW":Rc(),"ECDH-ES+A256KW":Rc(),A128KW:Xi(128),A192KW:Xi(192),A256KW:Xi(256),A128GCMKW:Xi(128,!0),A192GCMKW:Xi(192,!0),A256GCMKW:Xi(256,!0),"PBES2-HS256+A128KW":rd(),"PBES2-HS384+A192KW":rd(),"PBES2-HS512+A256KW":rd()}),sI=["encrypt","decrypt"];oI=go({A128GCM:Qi(128),A192GCM:Qi(192),A256GCM:Qi(256),"A128CBC-HS256":Qi(256,!0),"A192CBC-HS384":Qi(384,!0),"A256CBC-HS512":Qi(512,!0)})});function ah(t,e){if(t.algorithm.name!=="ECDH"&&t.algorithm.name!=="X25519")throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");zu(t,e)}async function lh(t,e,r){let n=sr(e).subtle,i=t instanceof Uint8Array?await crypto.subtle.importKey("raw",t,"AES-KW",!0,[r]):t;return Yr(i,n,r),i}async function id(t,e,r){let n=await lh(e,t,"wrapKey"),i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function sd(t,e,r){let n=await lh(e,t,"unwrapKey"),i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}function uh(t,e,r){Yr(e,sr(t).subtle,r),hc(t,e)}function aI(t,e){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"PBKDF2",!1,["deriveBits"]):(Yr(t,sr(e).subtle,"deriveBits"),t)}async function dh(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new G("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new G("PBES2 Count Input must be a positive integer");let i=tt(Xe(e),Uint8Array.of(0),t),s=parseInt(e.slice(13,16),10),o={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await aI(n,e);return new Uint8Array(await crypto.subtle.deriveBits(o,a,s))}function od(t){return tt(fc(t.length),t)}async function cI(t,e,r){let n=e>>3,i=32,s=Math.ceil(n/i),o=new Uint8Array(s*i);for(let a=1;a<=s;a++){let c=await Sc("sha256",tt(fc(a),t,r));o.set(c,(a-1)*i)}return o.slice(0,n)}async function ph(t,e,r,n,i=new Uint8Array,s=new Uint8Array){ah(t),ah(e,"deriveBits");let o=tt(od(Xe(r)),od(i),od(s),fc(n)),a=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3));return cI(a,n,o)}function fh(t){yc(t);let e=t.algorithm.namedCurve;if(e!=="P-256"&&e!=="P-384"&&e!=="P-521"&&t.algorithm.name!=="X25519")throw new Ee("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function vo(t){if(t===void 0)throw new G("JWE Encrypted Key missing")}function ch(t){if(t!==void 0)throw new G("Encountered unexpected JWE Encrypted Key")}async function mh(t,e,r,n,i,s){let o=sr(t);if(t==="dir")return ch(n),r;switch(o.subtle.name){case"ECDH":{if(t==="ECDH-ES"&&ch(n),!_e(i.epk))throw new G('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');fh(r);let a=await nr(o,i.epk),c,l;if(i.apu!==void 0){if(typeof i.apu!="string")throw new G('JOSE Header "apu" (Agreement PartyUInfo) invalid');c=ht(i.apu,"apu",G)}if(i.apv!==void 0){if(typeof i.apv!="string")throw new G('JOSE Header "apv" (Agreement PartyVInfo) invalid');l=ht(i.apv,"apv",G)}let d=await ph(a,r,t==="ECDH-ES"?e.alg:t,t==="ECDH-ES"?e.cekBits:parseInt(t.slice(-5,-2),10),c,l);return t==="ECDH-ES"?d:(vo(n),sd(t.slice(-6),d,n))}case"RSA-OAEP":return vo(n),yc(r),uh(t,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(vo(n),typeof i.p2c!="number")throw new G('JOSE Header "p2c" (PBES2 Count) missing or invalid');let a=s?.maxPBES2Count||1e4;if(i.p2c>a)throw new G('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof i.p2s!="string")throw new G('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let c=ht(i.p2s,"p2s",G),l=await dh(c,t,i.p2c,r);return sd(t.slice(-6),l,n)}case"AES-KW":return vo(n),sd(t,r,n);case"AES-GCM":{if(vo(n),typeof i.iv!="string")throw new G('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof i.tag!="string")throw new G('JOSE Header "tag" (Authentication Tag) missing or invalid');let a;a=ht(i.iv,"iv",G);let c;return c=ht(i.tag,"tag",G),Ac(fi(t.slice(0,-2)),r,n,a,c,new Uint8Array)}}}async function kc(t,e,r,n,i={}){let s,o,a,c=sr(t);if(t==="dir")return[r,void 0,void 0];switch(c.subtle.name){case"ECDH":{fh(r);let{apu:l,apv:d}=i,p;i.epk?p=await ir(c,i.epk,"decrypt"):p=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;let f=crypto.subtle,h=p;if(!h.extractable){if(typeof f.getPublicKey!="function")throw new TypeError('CryptoKey for "epk" must be extractable');h=await f.getPublicKey(p,[])}let{x:g,y:_,crv:R,kty:C}=await f.exportKey("jwk",h),D=await ph(r,p,t==="ECDH-ES"?e.alg:t,t==="ECDH-ES"?e.cekBits:parseInt(t.slice(-5,-2),10),l,d);if(o={epk:{x:g,crv:R,kty:C}},C==="EC"&&(o.epk.y=_),l&&(o.apu=Ue(l)),d&&(o.apv=Ue(d)),t==="ECDH-ES"){a=D;break}a=n||Ur(e);let F=t.slice(-6);s=await id(F,D,a);break}case"RSA-OAEP":{a=n||Ur(e),yc(r),uh(t,r,"encrypt"),s=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",r,a));break}case"PBKDF2":{a=n||Ur(e);let{p2c:l=2048,p2s:d=crypto.getRandomValues(new Uint8Array(16))}=i,p=await dh(d,t,l,r);s=await id(t.slice(-6),p,a),o={p2c:l,p2s:Ue(d)};break}case"AES-KW":{a=n||Ur(e),s=await id(t,r,a);break}case"AES-GCM":{a=n||Ur(e);let{iv:l}=i,d=await vc(fi(t.slice(0,-2)),a,r,l,new Uint8Array);s=d.ciphertext,o={iv:Ue(d.iv),tag:Ue(d.tag)};break}}return[a,s,o]}var Cc=Q(()=>{qt();pi();Yi();Zi();Te();rr();yo();at();Ec();Ut();di()});function Ao(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);if(e)return new Set(e)}function es(t,e){let{crit:r}=e??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new t('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function xn(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(o=>typeof o!="string"||o.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s=r===void 0?e:{__proto__:null,...r,...e};for(let o of n.crit){if(!(o in s))throw new Ee(`Extension Header Parameter "${o}" is not recognized`);if(!Object.hasOwn(i,o)||i[o]===void 0)throw new t(`Extension Header Parameter "${o}" is missing`);if(s[o]&&(!Object.hasOwn(n,o)||n[o]===void 0))throw new t(`Extension Header Parameter "${o}" MUST be integrity protected`)}return n.crit}var Dc,Pc,mi=Q(()=>{Te();Dc={__proto__:null,b64:!0},Pc={__proto__:null}});function hh(t){if(typeof globalThis[t]>"u")throw new Ee(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Eh(t){hh("CompressionStream");let e=new CompressionStream("deflate-raw"),r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});let n=[],i=e.readable.getReader();for(;;){let{value:s,done:o}=await i.read();if(o)break;n.push(s)}return tt(...n)}async function yh(t,e){hh("DecompressionStream");let r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(t).catch(()=>{}),n.close().catch(()=>{});let i=[],s=0,o=r.readable.getReader();for(;;){let{value:a,done:c}=await o.read();if(c)break;if(i.push(a),s+=a.byteLength,e!==1/0&&s>e)throw new G("Decompressed plaintext exceeded the configured limit")}return tt(...i)}var ad=Q(()=>{Te();Ut()});function Uc(t){let{ciphertext:e,protected:r,unprotected:n}=t;if(t.iv!==void 0&&typeof t.iv!="string")throw new G("JWE Initialization Vector incorrect type");if(typeof e!="string")throw new G("JWE Ciphertext missing or incorrect type");if(t.tag!==void 0&&typeof t.tag!="string")throw new G("JWE Authentication Tag incorrect type");if(r!==void 0&&typeof r!="string")throw new G("JWE Protected Header incorrect type");if(t.aad!==void 0&&typeof t.aad!="string")throw new G("JWE AAD incorrect type");if(n!==void 0&&!_e(n))throw new G("JWE Shared Unprotected Header incorrect type")}function Lc(t){let{encrypted_key:e,header:r}=t;if(e!==void 0&&typeof e!="string")throw new G("JWE Encrypted Key incorrect type");if(r!==void 0&&!_e(r))throw new G("JWE Per-Recipient Unprotected Header incorrect type");if(t.protected===void 0&&r===void 0&&t.unprotected===void 0)throw new G("JOSE Header missing")}function cd(t){let{protected:e,ciphertext:r,iv:n,tag:i,aad:s}=t,o;e&&(o=Ji(e,G,"JWE Protected Header is invalid"));let a=e!==void 0?Xe(e):new Uint8Array;return[o,ht(r,"ciphertext",G),n!==void 0?ht(n,"iv",G):void 0,i!==void 0?ht(i,"tag",G):void 0,s!==void 0?tt(a,Xe("."),bc(s,"aad",G)):a]}function Mc(t,e){let[r,n,i,s]=e,{protected:o,aad:a,unprotected:c,header:l}=t,d={plaintext:r};return o!==void 0&&(d.protectedHeader=n),a!==void 0&&(d.additionalAuthenticatedData=ht(a,"aad",G)),c!==void 0&&(d.sharedUnprotectedHeader=c),l!==void 0&&(d.unprotectedHeader=l),s?{...d,key:i}:d}function bn(t){return[t&&Ao("keyManagementAlgorithms",t.keyManagementAlgorithms),t&&Ao("contentEncryptionAlgorithms",t.contentEncryptionAlgorithms),t]}async function ld(t,e,r,n){let[i,s,o]=r,[a,c,l,d,p]=e,{encrypted_key:f,header:h,unprotected:g}=t,_;if(h!==void 0||g!==void 0){if(!In(a,h,g))throw new G("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");_={...a,...h,...g}}else _=a??{};if(xn(G,Pc,o?.crit,a,_),_.zip!==void 0&&_.zip!=="DEF")throw new Ee('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(_.zip!==void 0&&!a?.zip)throw new G('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:R,enc:C}=_;if(typeof R!="string"||!R)throw new G("missing JWE Algorithm (alg) in JWE Header");if(typeof C!="string"||!C)throw new G("missing JWE Encryption Algorithm (enc) in JWE Header");if(i&&!i.has(R)||!i&&R.startsWith("PBES2"))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(s&&!s.has(C))throw new Tn('"enc" (Encryption Algorithm) Header Parameter value not allowed');let D=fi(C),F;f!==void 0&&(F=ht(f,"encrypted_key",G));let J=!1;typeof n=="function"&&(n=await n(a,t),J=!0);let q=sr(R),B=await ir(R==="dir"?D:q,n,"decrypt"),$;try{$=await mh(R,D,B,F,_,o)}catch(I){if(I instanceof TypeError||I instanceof G||I instanceof Ee)throw I;$=Ur(D)}let A=await Ac(D,$,c,l,d,p);if(_.zip==="DEF"){let I=o?.maxDecompressedLength??25e4;if(I===0)throw new Ee('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(I!==1/0&&(!Number.isSafeInteger(I)||I<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");A=await yh(A,I).catch(S=>{throw S instanceof G?S:new G("Failed to decompress plaintext",{cause:S})})}return[A,a,B,J]}async function ud(t,e,r){return ld(t,cd(t),e,r)}async function Kc(t,e,r){if(t instanceof Uint8Array&&(t=li.decode(t)),typeof t!="string")throw new G("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:s,3:o,4:a,length:c}=t.split(".");if(c!==5)throw new G("Invalid Compact JWE");return ud({ciphertext:o,iv:s||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r)}var To=Q(()=>{yo();rr();Te();at();Cc();Ut();mi();pi();Zi();ad()});async function gh(t,e,r){let n=await Kc(t,bn(r),e),i={plaintext:n[0],protectedHeader:n[1]};return typeof e=="function"?{...i,key:n[2]}:i}var vh=Q(()=>{To()});async function Ah(t,e,r){if(!_e(t))throw new G("Flattened JWE must be an object");return Uc(t),Lc(t),Mc(t,await ud(t,bn(r),e))}var Th=Q(()=>{Te();at();To()});async function _h(t,e,r){if(!_e(t))throw new G("General JWE must be an object");if(!Array.isArray(t.recipients)||!t.recipients.every(_e))throw new G("JWE Recipients missing or incorrect type");if(!t.recipients.length)throw new G("JWE Recipients has no members");let n,i;try{Uc(t),n=bn(r),i=cd(t)}catch{throw new Pr}if(t.recipients.length>1)for(let{header:s}of t.recipients){let o=i[0]?.alg??s?.alg??t.unprotected?.alg;if(o==="dir"||o==="ECDH-ES")throw new G(`"${o}" alg may only have a single recipient`)}for(let s of t.recipients)try{let o={aad:t.aad,ciphertext:t.ciphertext,encrypted_key:s.encrypted_key,header:s.header,iv:t.iv,protected:t.protected,tag:t.tag,unprotected:t.unprotected};return Lc(o),Mc(o,await ld(o,i,n,e))}catch{}throw new Pr}var Ih=Q(()=>{To();Te();at()});function dd(t){let[,e,r,n,,,,,i]=t;if(!In(e,r,n))throw new G("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let s={...e,...r,...n};if(xn(G,Pc,i,e,s),s.zip!==void 0&&s.zip!=="DEF")throw new Ee('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(s.zip!==void 0&&!e?.zip)throw new G('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:o,enc:a}=s;if(typeof o!="string"||!o)throw new G('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof a!="string"||!a)throw new G('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[s,o,a,fi(a)]}async function pd(t,e,r){let[n,i,,s]=e,[o,a,c,l,d,p,f,h,,g]=t,_=a,R=c;if(p&&(i==="dir"||i==="ECDH-ES"))throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${i}`);let C=sr(i),D=await ir(i==="dir"?s:C,r,"encrypt"),[F,J,q]=await kc(i,s,D,p,h);q&&(g?R=R?{...R,...q}:q:_=_?{..._,...q}:q);let B,$;_?(B=Ue(JSON.stringify(_)),$=Xe(B)):(B="",$=new Uint8Array);let A,I;d?.byteLength?(I=Ue(d),A=tt($,Xe("."),Xe(I))):A=$;let S=o;n.zip==="DEF"&&(S=await Eh(S).catch(w=>{throw new G("Failed to compress plaintext",{cause:w})}));let{ciphertext:y,tag:x,iv:N}=await vc(s,S,F,f,A),O={ciphertext:Ue(y)};return N&&(O.iv=Ue(N)),x&&(O.tag=Ue(x)),J&&(O.encrypted_key=Ue(J)),I&&(O.aad=I),_&&(O.protected=B),l&&(O.unprotected=l),R&&(O.header=R),O}async function xh(t,e){return pd(t,dd(t),e)}var fd=Q(()=>{qt();yo();Cc();Te();at();Ut();mi();pi();Zi();ad()});var Sn,Hc=Q(()=>{rr();Te();fd();mi();Sn=class{#e;#t;#r;#s;#i;#n;#a;#o;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this.#e=e}setKeyManagementParameters(e){return qe(this.#o,"setKeyManagementParameters"),this.#o=e,this}setProtectedHeader(e){return qe(this.#t,"setProtectedHeader"),this.#t=e,this}setSharedUnprotectedHeader(e){return qe(this.#r,"setSharedUnprotectedHeader"),this.#r=e,this}setUnprotectedHeader(e){return qe(this.#s,"setUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#i=e,this}setContentEncryptionKey(e){return qe(this.#n,"setContentEncryptionKey"),this.#n=e,this}setInitializationVector(e){return qe(this.#a,"setInitializationVector"),this.#a=e,this}async encrypt(e,r){if(!this.#t&&!this.#s&&!this.#r)throw new G("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");return es(G,this.#t),xh([this.#e,this.#t,this.#s,this.#r,this.#i,this.#n,this.#a,this.#o,r?.crit,r?eh in r:!1],e)}}});function bh(t,e,r){let{aad:n,protected:i,unprotected:s,header:o}=t;n&&(e.aad=n),i&&(e.protected=i),s&&(e.unprotected=s),o&&(r.header=o)}var md,Fc,Sh=Q(()=>{Hc();rr();Te();yo();Cc();qt();mi();fd();pi();Zi();md=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n]}setUnprotectedHeader(e){return qe(this.state[0],"setUnprotectedHeader"),this.state[0]=e,this}setKeyManagementParameters(e){return qe(this.state[1],"setKeyManagementParameters"),this.state[1]=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}};Fc=class{#e;#t=[];#r;#s;#i;constructor(e){this.#e=e}addRecipient(e,r){let n=new md(this,e,r?.crit);return this.#t.push(n),n}setProtectedHeader(e){return qe(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return qe(this.#s,"setSharedUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#i=e,this}async encrypt(){if(!this.#t.length)throw new G("at least one recipient must be added");if(!(this.#e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");if(this.#t.length===1){let[o]=this.#t,[a,c,l,d]=o.state,p=await new Sn(this.#e).setAdditionalAuthenticatedData(this.#i).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(a).setKeyManagementParameters(c).encrypt(l,{crit:d}),f={ciphertext:p.ciphertext,iv:p.iv,recipients:[{}],tag:p.tag};return p.encrypted_key&&(f.recipients[0].encrypted_key=p.encrypted_key),bh(p,f,f.recipients[0]),f}es(G,this.#r);let e,r=[],n=[];for(let o=0;o<this.#t.length;o++){let a=this.#t[o],[c,l,,d]=a.state,p=[this.#e,this.#r,c,this.#s,this.#i,void 0,void 0,l,d,!0],f=dd(p);if(r.push(p),n.push(f),f[1]==="dir"||f[1]==="ECDH-ES")throw new G(`"${f[1]}" alg may only have a single recipient`);if(!e)e=f[2];else if(e!==f[2])throw new G('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}let i=Ur(n[0][3]),s={ciphertext:"",recipients:[]};for(let o=0;o<this.#t.length;o++){let a=this.#t[o],[c,l,d]=a.state,p={};if(s.recipients.push(p),o===0){r[0][5]=i;let C=await pd(r[0],n[0],d);s.ciphertext=C.ciphertext,s.iv=C.iv,s.tag=C.tag,p.encrypted_key=C.encrypted_key,bh(C,s,p);continue}let[,f,,h]=n[o],g=await ir(sr(f),d,"encrypt"),[,_,R]=await kc(f,h,g,i,l);p.encrypted_key=Ue(_),(c||R)&&(p.header={...c,...R})}return s}}});async function wh(t,e,r){return e instanceof Uint8Array?crypto.subtle.importKey("raw",e,t.subtle,!1,[r]):(Yr(e,t.subtle,r),t.minRsaBits&&hc(t.alg,e),e)}async function Nh(t,e,r){let n=await wh(t,e,"sign"),i=await crypto.subtle.sign(t.signing,n,r);return new Uint8Array(i)}async function Rh(t,e,r,n){let i=await wh(t,e,"verify");try{return await crypto.subtle.verify(t.signing,i,r,n)}catch{return!1}}var hd=Q(()=>{Ec()});function Ed(t){let e={name:"HMAC",hash:`SHA-${t}`};return{kty:["oct"],secret:!0,subtle:e,signing:e,usages:_o}}function ts(t,e){let n={name:e?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${t}`};return{kty:["RSA"],subtle:n,signing:e?{...n,saltLength:e}:n,usages:_o,minRsaBits:2048}}function yd(t,e){return{kty:["EC"],crv:t,subtle:{name:"ECDSA",namedCurve:t},signing:{name:"ECDSA",hash:`SHA-${e}`},usages:_o}}function Oh(){let t={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:t,signing:t,usages:_o}}function gd(t){let r={name:`ML-DSA-${t}`};return{kty:["AKP"],subtle:r,signing:r,usages:_o}}function rs(t){let e=typeof t=="string"?Io[t]:void 0;if(!e)throw new Ee(`alg ${t} is not supported either by JOSE or your javascript runtime`);return e}var _o,Io,ns=Q(()=>{Te();td();_o=[["verify"],["sign"]];Io=go({HS256:Ed(256),HS384:Ed(384),HS512:Ed(512),RS256:ts(256),RS384:ts(384),RS512:ts(512),PS256:ts(256,32),PS384:ts(384,48),PS512:ts(512,64),ES256:yd("P-256",256),ES384:yd("P-384",384),ES512:yd("P-521",512),EdDSA:Oh(),Ed25519:Oh(),"ML-DSA-44":gd(44),"ML-DSA-65":gd(65),"ML-DSA-87":gd(87)})});function Vc(t,e){let[r,n,,i,s]=e,o={payload:r};return t.protected!==void 0&&(o.protectedHeader=n),t.header!==void 0&&(o.unprotectedHeader=t.header),s?{...o,key:i}:o}function wn(t){return[t&&Ao("algorithms",t.algorithms),t?.crit]}async function xo(t,e,r){let{protected:n,header:i,payload:s}=t,o={};n&&(o=Ji(n,fe,"JWS Protected Header is invalid"));let a;if(i!==void 0){if(!In(o,i))throw new fe("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");a={...o,...i}}else a=o;let c=xn(fe,Dc,e[1],o,a),l=!0;if(c.includes("b64")&&(l=o.b64,typeof l!="boolean"))throw new fe('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:d}=a;if(typeof d!="string"||!d)throw new fe('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(e[0]&&!e[0].has(d))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(l){if(typeof s!="string")throw new fe("JWS Payload must be a string")}else if(typeof s!="string"&&!(s instanceof Uint8Array))throw new fe("JWS Payload must be a string or an Uint8Array instance");let p=!1;typeof r=="function"&&(r=await r(o,t),p=!0);let f=rs(d),h=tt(n!==void 0?Xe(n):new Uint8Array,Xe("."),typeof s=="string"?l?e[2]??=bc(s,"payload",fe):ci.encode(s):s),g=ht(t.signature,"signature",fe),_=await ir(f,r,"verify");if(!await Rh(f,_,g,h))throw new _n;let C;return l?C=ht(s,"payload",fe):typeof s=="string"?C=ci.encode(s):C=s,[C,o,l,_,p]}async function Bc(t,e,r){if(t instanceof Uint8Array&&(t=li.decode(t)),typeof t!="string")throw new fe("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:s,length:o}=t.split(".");if(o!==3)throw new fe("Invalid Compact JWS");return xo({payload:i,protected:n,signature:s},e,r)}var bo=Q(()=>{hd();ns();Te();Ut();rr();at();mi();pi()});async function kh(t,e,r){let n=await Bc(t,wn(r),e),i={payload:n[0],protectedHeader:n[1]};return typeof e=="function"?{...i,key:n[3]}:i}var Ch=Q(()=>{bo()});async function Dh(t,e,r){if(!_e(t))throw new fe("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new fe('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new fe("JWS Protected Header incorrect type");if(t.payload===void 0)throw new fe("JWS Payload missing");if(typeof t.signature!="string")throw new fe("JWS Signature missing or incorrect type");if(t.header!==void 0&&!_e(t.header))throw new fe("JWS Unprotected Header incorrect type");return Vc(t,await xo(t,wn(r),e))}var Ph=Q(()=>{Te();at();bo()});async function Uh(t,e,r){if(!_e(t))throw new fe("General JWS must be an object");let{signatures:n,payload:i}=t;if(!Array.isArray(n)||!n.every(_e))throw new fe("JWS Signatures missing or incorrect type");let s;try{if(i===void 0)throw new Error;s=wn(r)}catch{throw new _n}for(let o of n)try{let{protected:a,header:c,signature:l}=o;if(a===void 0&&c===void 0)throw new Error;if(a!==void 0&&typeof a!="string")throw new Error;if(typeof l!="string")throw new Error;if(c!==void 0&&!_e(c))throw new Error;return Vc(o,await xo({header:c,payload:i,protected:a,signature:l},s,e))}catch{}throw new _n}var Lh=Q(()=>{bo();Te();at()});function jc(t){let e=uI.exec(t);if(!e||e[4]&&e[1])throw new TypeError("Invalid time period format");let r=parseFloat(e[2]),n=Math.round(r*lI[e[3][0].toLowerCase()]);return e[1]==="-"||e[4]==="ago"?-n:n}function wo(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function vd(t,e){return typeof t=="number"?wo(e,t):t instanceof Date?wo(e,So(t)):So(new Date)+jc(t)}function Ad(t,e,r=!1){let n=t[e];if(!(n===void 0&&!r)){if(typeof n!="number")throw new Lt(`"${e}" claim must be a number`,t,e,"invalid");return n}}function Td(t,e){throw new Lt(`unexpected "${e}" claim value`,t,e,is)}function ss(t,e,r={}){let n;try{n=JSON.parse(An.decode(e))}catch{}if(!_e(n))throw new We("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i&&(typeof t.typ!="string"||Mh(t.typ)!==Mh(i)))throw new Lt('unexpected "typ" JWT header value',n,"typ",is);let{requiredClaims:s=[],issuer:o,subject:a,audience:c,maxTokenAge:l}=r,d=[...s];l!==void 0&&d.push("iat"),c!==void 0&&d.push("aud"),a!==void 0&&d.push("sub"),o!==void 0&&d.push("iss");for(let D of new Set(d.reverse()))if(!Object.hasOwn(n,D))throw new Lt(`missing required "${D}" claim`,n,D,"missing");o!==void 0&&!(Array.isArray(o)?o:[o]).includes(n.iss)&&Td(n,"iss"),a!==void 0&&n.sub!==a&&Td(n,"sub"),c!==void 0&&!dI(n.aud,typeof c=="string"?[c]:c)&&Td(n,"aud");let{clockTolerance:p}=r,f=0;if(typeof p=="string")f=jc(p);else if(p!==void 0){if(typeof p!="number")throw new TypeError("Invalid clockTolerance option type");f=p}wo("clockTolerance option",f);let{currentDate:h}=r,g=wo("currentDate option",So(h||new Date)),_=Ad(n,"iat",l!==void 0),R=Ad(n,"nbf");if(R!==void 0&&R>g+f)throw new Lt('"nbf" claim timestamp check failed',n,"nbf",is);let C=Ad(n,"exp");if(C!==void 0&&C<=g-f)throw new Wi('"exp" claim timestamp check failed',n,"exp",is);if(l!==void 0){let D=g-_,F=typeof l=="number"?l:jc(l);if(D-f>F)throw new Wi('"iat" claim timestamp check failed (too far in the past)',n,"iat",is);if(D<0-f)throw new Lt('"iat" claim timestamp check failed (it should be in the past)',n,"iat",is)}return n}var So,lI,uI,is,Mh,dI,Nn,os=Q(()=>{Te();Ut();at();So=t=>Math.floor(t.getTime()/1e3),lI={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},uI=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,is="check_failed";Mh=t=>t.includes("/")?t.toLowerCase():`application/${t.toLowerCase()}`,dI=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(r=>t.includes(r)):!1;Nn=class{#e;constructor(e){if(!_e(e))throw new TypeError("JWT Claims Set MUST be an object");this.#e=structuredClone(e)}data(){return ci.encode(JSON.stringify(this.#e))}get iss(){return this.#e.iss}set iss(e){this.#e.iss=e}get sub(){return this.#e.sub}set sub(e){this.#e.sub=e}get aud(){return this.#e.aud}set aud(e){this.#e.aud=e}set jti(e){this.#e.jti=e}set nbf(e){this.#e.nbf=vd(e,"setNotBefore")}set exp(e){this.#e.exp=vd(e,"setExpirationTime")}set iat(e){e===void 0?this.#e.iat=So(new Date):typeof e=="string"?this.#e.iat=wo("setIssuedAt",So(new Date)+jc(e)):this.#e.iat=vd(e,"setIssuedAt")}}});async function Rn(t,e,r){let n=await Bc(t,wn(r),e);if(!n[2])throw new We("JWTs MUST NOT use unencoded payload");let s={payload:ss(n[1],n[0],r),protectedHeader:n[1]};return typeof e=="function"?{...s,key:n[3]}:s}var Kh=Q(()=>{bo();os();Te()});async function Hh(t,e,r){let n=await Kc(t,bn(r),e),i=n[1],s=ss(i,n[0],r);if(i.iss!==void 0&&i.iss!==s.iss)throw new Lt('replicated "iss" claim header parameter mismatch',s,"iss","mismatch");if(i.sub!==void 0&&i.sub!==s.sub)throw new Lt('replicated "sub" claim header parameter mismatch',s,"sub","mismatch");if(i.aud!==void 0&&JSON.stringify(i.aud)!==JSON.stringify(s.aud))throw new Lt('replicated "aud" claim header parameter mismatch',s,"aud","mismatch");let o={payload:s,protectedHeader:i};return typeof e=="function"?{...o,key:n[2]}:o}var Fh=Q(()=>{To();os();Te()});var as,_d=Q(()=>{Hc();as=class{#e;constructor(e){this.#e=new Sn(e)}setContentEncryptionKey(e){return this.#e.setContentEncryptionKey(e),this}setInitializationVector(e){return this.#e.setInitializationVector(e),this}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}setKeyManagementParameters(e){return this.#e.setKeyManagementParameters(e),this}async encrypt(e,r){let n=await this.#e.encrypt(e,r);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}});function qc(t){return t?.b64===!1&&Array.isArray(t.crit)&&t.crit.includes("b64")}async function Gc(t,e){let{protectedHeader:r,unprotectedHeader:n}=t;if(!r&&!n)throw new fe("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!In(r,n))throw new fe("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let i={...r,...n};es(fe,r);let s=xn(fe,Dc,t.crit,r,i),o=!0;if(s.includes("b64")&&(o=r.b64,typeof o!="boolean"))throw new fe('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:a}=i;if(typeof a!="string"||!a)throw new fe('JWS "alg" (Algorithm) Header Parameter missing or invalid');let c=rs(a),l,d;if(o){let C=t.encoded??=[];C[0]??=Ue(t.payload),C[1]??=Xe(C[0]),l=C[0],d=C[1]}else d=t.payload,l="";let p,f;r?(p=Ue(JSON.stringify(r)),f=Xe(p)):(p="",f=new Uint8Array);let h=tt(f,Xe("."),d),g=await ir(c,e,"sign"),_=await Nh(c,g,h),R={signature:Ue(_),payload:l};return r&&(R.protected=p),n&&(R.header=n),R}var No=Q(()=>{qt();hd();ns();at();Te();Ut();mi();pi()});var cs,Id=Q(()=>{No();rr();cs=class{#e;#t;#r;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this.#e=e}setProtectedHeader(e){return qe(this.#t,"setProtectedHeader"),this.#t=e,this}setUnprotectedHeader(e){return qe(this.#r,"setUnprotectedHeader"),this.#r=e,this}async sign(e,r){return Gc({payload:this.#e,protectedHeader:this.#t,unprotectedHeader:this.#r,crit:r?.crit},e)}}});var ls,xd=Q(()=>{Id();No();ls=class{#e;#t;constructor(e){this.#e=new cs(e)}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this.#t=e,this}async sign(e,r){if(qc(this.#t))throw new TypeError("use the flattened module for creating JWS with b64: false");let n=await this.#e.sign(e,r);return`${n.protected}.${n.payload}.${n.signature}`}}});var bd,$c,Vh=Q(()=>{No();Te();rr();bd=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n?.crit]}setProtectedHeader(e){return qe(this.state[0],"setProtectedHeader"),this.state[0]=e,this}setUnprotectedHeader(e){return qe(this.state[1],"setUnprotectedHeader"),this.state[1]=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},$c=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new bd(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new fe("at least one signature must be added");if(!(this.#e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");let e={signatures:[],payload:""},r=[];for(let n=0;n<this.#t.length;n++){let i=this.#t[n],[s,o,a,c]=i.state,{payload:l,...d}=await Gc({payload:this.#e,protectedHeader:s,unprotectedHeader:o,crit:c,encoded:r},a);if(n===0)e.payload=l;else if(e.payload!==l)throw new fe("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(d)}return e}}});var us,Bh=Q(()=>{xd();No();Te();os();us=class{#e;#t;constructor(e={}){this.#t=new Nn(e)}setIssuer(e){return this.#t.iss=e,this}setSubject(e){return this.#t.sub=e,this}setAudience(e){return this.#t.aud=e,this}setJti(e){return this.#t.jti=e,this}setNotBefore(e){return this.#t.nbf=e,this}setExpirationTime(e){return this.#t.exp=e,this}setIssuedAt(e){return this.#t.iat=e,this}setProtectedHeader(e){return this.#e=e,this}async sign(e,r){let n=new ls(this.#t.data());if(n.setProtectedHeader(this.#e),qc(this.#e))throw new We("JWTs MUST NOT use unencoded payload");return n.sign(e,r)}}});var Wc,jh=Q(()=>{_d();os();rr();Wc=class{#e;#t;#r;#s;#i;#n;#a;#o;constructor(e={}){this.#o=new Nn(e)}setIssuer(e){return this.#o.iss=e,this}setSubject(e){return this.#o.sub=e,this}setAudience(e){return this.#o.aud=e,this}setJti(e){return this.#o.jti=e,this}setNotBefore(e){return this.#o.nbf=e,this}setExpirationTime(e){return this.#o.exp=e,this}setIssuedAt(e){return this.#o.iat=e,this}setProtectedHeader(e){return qe(this.#s,"setProtectedHeader"),this.#s=e,this}setKeyManagementParameters(e){return qe(this.#r,"setKeyManagementParameters"),this.#r=e,this}setContentEncryptionKey(e){return qe(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return qe(this.#t,"setInitializationVector"),this.#t=e,this}replicateIssuerAsHeader(){return this.#i=!0,this}replicateSubjectAsHeader(){return this.#n=!0,this}replicateAudienceAsHeader(){return this.#a=!0,this}async encrypt(e,r){let n=new as(this.#o.data());return this.#s&&(this.#i||this.#n||this.#a)&&(this.#s={...this.#s,iss:this.#i?this.#o.iss:void 0,sub:this.#n?this.#o.sub:void 0,aud:this.#a?this.#o.aud:void 0}),n.setProtectedHeader(this.#s),this.#t&&n.setInitializationVector(this.#t),this.#e&&n.setContentEncryptionKey(this.#e),this.#r&&n.setKeyManagementParameters(this.#r),n.encrypt(e,r)}}});function hi(t='JWK "alg" (Algorithm) Parameter'){throw new Ee(`Invalid or unsupported ${t} value`)}function kn(t,e){return(typeof t=="string"?Io[t]??nd[t]:void 0)??hi(e)}var On,Ro=Q(()=>{Te();ns();Zi();On='"alg" (Algorithm)'});function mI(t,e){if(Cn(t,48,`Invalid ${e==="spki"?"SPKI":"PKCS#8"} structure`),Xr(t),e==="pkcs8"){Cn(t,2,"Expected version field");let r=Xr(t);t.pos+=r}Cn(t,48,"Expected algorithm identifier"),Xr(t)}function EI(t){let e=zh(t);Cn(e,48,"Invalid certificate structure"),Xr(e),Cn(e,48,"Invalid tbsCertificate structure"),Xr(e),t[e.pos]===160?qh(e,6):qh(e,5);let r=e.pos;Cn(e,48,"Invalid SPKI structure");let n=Xr(e);return t.subarray(r,r+n+(e.pos-r))}var pI,Gh,$h,Wh,Oo,zh,Sd,Xr,qh,Cn,Jh,fI,hI,wd,Nd,Yh,Xh,Qh,Rd=Q(()=>{$i();Xu();Te();Ro();di();pI=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
+var C_=Object.create;var Rd=Object.defineProperty;var D_=Object.getOwnPropertyDescriptor;var P_=Object.getOwnPropertyNames;var U_=Object.getPrototypeOf,L_=Object.prototype.hasOwnProperty;var ne=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var M_=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},Cc=(t,e)=>{for(var r in e)Rd(t,r,{get:e[r],enumerable:!0})},K_=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of P_(e))!L_.call(t,i)&&i!==r&&Rd(t,i,{get:()=>e[i],enumerable:!(n=D_(e,i))||n.enumerable});return t};var H_=(t,e,r)=>(r=t!=null?C_(U_(t)):{},K_(e||!t||!t.__esModule?Rd(r,"default",{value:t,enumerable:!0}):r,t));function kt(...t){let e=t.reduce((i,{length:o})=>i+o,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function Ud(t,e,r){if(e<0||e>=Lc)throw new RangeError(`value must be >= 0 and <= ${Lc-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function Ld(t){let e=Math.floor(t/Lc),r=t%Lc,n=new Uint8Array(8);return Ud(n,e,0),Ud(n,r,4),n}function Mc(t){let e=new Uint8Array(4);return Ud(e,t),e}function Et(t){if(typeof t=="string"&&t.length>=128){if(j_.test(t))throw new TypeError("non-ASCII string encountered in encode()");return on.encode(t)}let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}function Kc(t,e=!1){if(Uint8Array.prototype.toBase64)return t.toBase64({alphabet:e?"base64url":"base64",omitPadding:e});let r=32768,n=[];for(let o=0;o<t.length;o+=r)n.push(String.fromCharCode.apply(null,t.subarray(o,o+r)));let i=btoa(n.join(""));return e?i.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"):i}function Hc(t,e=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t,{alphabet:e?"base64url":"base64"});if(e){if(t.includes("+")||t.includes("/"))throw new TypeError("Invalid base64url");t=t.replace(/-/g,"+").replace(/_/g,"/")}let r=atob(t),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}async function Fc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var on,ao,co,Lc,j_,Ft=ne(()=>{on=new TextEncoder,ao=new TextDecoder,co=new TextDecoder("utf-8",{fatal:!0}),Lc=2**32;j_=/[^\x00-\x7f]/});var Md={};Cc(Md,{JOSEAlgNotAllowed:()=>Un,JOSEError:()=>nt,JOSENotSupported:()=>Te,JWEDecryptionFailed:()=>sn,JWEInvalid:()=>W,JWKInvalid:()=>uo,JWKSInvalid:()=>po,JWKSMultipleMatchingKeys:()=>Ps,JWKSNoMatchingKey:()=>_i,JWKSTimeout:()=>Us,JWSInvalid:()=>ee,JWSSignatureVerificationFailed:()=>Ln,JWTClaimValidationFailed:()=>ir,JWTExpired:()=>lo,JWTInvalid:()=>je});var nt,ir,lo,Un,Te,sn,W,ee,je,uo,po,_i,Ps,Us,Ln,Ie=ne(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ir=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},lo=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Un=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},Te=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},sn=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},W=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},je=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},uo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},po=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},_i=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},Ps=class extends nt{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},Us=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},Ln=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});var Vc={};Cc(Vc,{decode:()=>Fr,encode:()=>De});function Fr(t){try{return Hc(typeof t=="string"?t:ao.decode(t),!0)}catch(e){throw new TypeError(G_,{cause:e})}}function De(t){return Kc(typeof t=="string"?on.encode(t):t,!0)}var G_,zt=ne(()=>{Ft();G_="The input to be decoded is not correctly encoded."});function at(t,e){if(!(t instanceof Uint8Array))throw new TypeError(`${e} must be an instance of Uint8Array`)}function he(t){if(typeof t!="object"||t===null||Object.prototype.toString.call(t)!=="[object Object]")return!1;let e=Object.getPrototypeOf(t);return e===null||Object.getPrototypeOf(e)===null}function Bc(t){return he(t)&&Array.isArray(t.keys)&&Array.from(t.keys).every(he)}function Mn(...t){let e=new Set;for(let r of t)if(r)for(let n of Object.keys(r)){if(e.has(n))return!1;e.add(n)}return!0}function Se(t,e){if(t!==void 0)throw new TypeError(`${e} can only be called once`)}function xt(t,e,r){try{return Fr(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}function jc(t,e,r){try{return Et(t)}catch{throw new r(`The ${e} is not a valid base64url string`)}}function Kn(t,e,r){let n;try{n=JSON.parse(co.decode(Fr(t)))}catch{throw new e(r)}if(!he(n))throw new e(r);return n}function Ls(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);return e===void 0?void 0:new Set(e)}function $c(t,e){let{crit:r}=e??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new t('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function Vr(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(s=>typeof s!="string"||s.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let o=r===void 0?e:{__proto__:null,...r,...e};for(let s of n.crit){if(!(s in o))throw new Te(`Extension Header Parameter "${s}" is not recognized`);if(!Object.hasOwn(i,s)||i[s]===void 0)throw new t(`Extension Header Parameter "${s}" is missing`);if(o[s]&&(!Object.hasOwn(n,s)||n[s]===void 0))throw new t(`Extension Header Parameter "${s}" MUST be integrity protected`)}return n.crit}function mo(t,e){if(e.includes("b64")){let r=t.b64;if(typeof r!="boolean")throw new ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}function Ii(t,e){let r,n;try{r=JSON.stringify(e),n=JSON.parse(r)}catch(i){throw new t("JOSE Header is not valid JSON",{cause:i})}if(!he(n))throw new t("JOSE Header is not a JSON object");return[n,r]}var fo,Gc,Pe=ne(()=>{Ie();zt();Ft();fo={__proto__:null,b64:!0},Gc={__proto__:null}});async function hr(t,e,r){let{alg:n,secret:i}=t,o=r==="decrypt"||r==="sign";if(i&&e instanceof Uint8Array)return e;let s,a;if(he(e)){if(s=Ks(e),typeof s.kty!="string")throw xh(n,e,i);if(!(i?s.kty==="oct"&&typeof s.k=="string":s.kty!=="oct"&&(o?s.kty==="AKP"&&typeof s.priv=="string"||typeof s.d=="string":s.d===void 0&&s.priv===void 0)))throw new TypeError(i?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${o?"private":"public"} JWK`);if(q_(t,s,r),s.kty==="oct")return Fr(s.k);if(!Object.isFrozen(e)){let{key_ops:u}=e;Array.isArray(u)&&Object.freeze(u),Object.freeze(e)}}else{if(!Hd(e))throw xh(n,e,i);let u=i?"secret":o?"private":"public";if(e.type!==u&&(i||["secret","public","private"].includes(e.type)))throw new TypeError(`${$_(e)} instances must be of type "${u}" for the ${n} algorithm`);if(Br(e))return e;if(a=e,a.type==="secret")return a.export()}Kd||=new WeakMap;let c=e,l=Kd.get(c);if(l?.[n])return l[n];if(l||Kd.set(c,l={}),a&&typeof a.toCryptoKey=="function"){let u=a.type==="public",p=W_[a.asymmetricKeyDetails?.namedCurve],f=t.resolve?.({crv:p,asymmetricKeyType:a.asymmetricKeyType})??t.subtle;return l[n]=a.toCryptoKey(f,u,t.usages[u?0:1])}return s??=a.export({format:"jwk"}),s.alg=n,l[n]=await jr(t,s)}function Wc(t){if(!Br(t))throw new Error("CryptoKey instance expected")}function bh(t,e,...r){if(r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}function xh(t,e,r){let n=["CryptoKey","KeyObject","JSON Web Key"];return r&&n.push("Uint8Array"),new TypeError(bh(`Key for the ${t} algorithm must be `,e,...n))}function Fd(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function ho(t,e){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}function Vd(t,e,r){let n=t.algorithm;if(n.name!==e.name)throw qc(e.name);if(e.hash&&n.hash?.name!==e.hash)throw qc(e.hash,"algorithm.hash");if(e.namedCurve&&n.namedCurve!==e.namedCurve)throw qc(e.namedCurve,"algorithm.namedCurve");if(e.length!==void 0&&n.length!==e.length)throw qc(e.length,"algorithm.length");Fd(t,r)}function Eo(t){return{__proto__:null,...t}}function Ks(t){let e=Eo(t);if(e.ext!==void 0&&typeof e.ext!="boolean")throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(e.key_ops!==void 0){let r=e.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some(i=>typeof i!="string")||new Set(n).size!==n.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');e.key_ops=n}return e}function Hn(t){if(t!==void 0&&typeof t!="boolean")throw new TypeError('"extractable" option must be a boolean');return t}async function jr(t,e,r){if(!t.kty.includes(e.kty))throw new Te('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let n=t.resolve?.({kty:e.kty,crv:e.crv})??t.subtle,i=!!(e.d||e.priv),o={...e,ext:r??e.ext};return o.kty!=="AKP"&&delete o.alg,delete o.use,crypto.subtle.importKey("jwk",o,n,o.ext??!i,e.key_ops??t.usages[i?1:0])}async function yr(t,e,r,n=!1){return t instanceof Uint8Array&&(t=await crypto.subtle.importKey("raw",t,e,n,[r])),Vd(t,e,r),t}var $_,q_,Kd,W_,Br,Ms,Hd,Er,qc,Ct=ne(()=>{Pe();zt();Ie();$_=t=>t[Symbol.toStringTag],q_=(t,e,r)=>{let{alg:n}=t;if(e.use!==void 0){let i=r==="sign"||r==="verify"?"sig":"enc";if(e.use!==i)throw new TypeError(`Invalid key for this operation, its "use" must be "${i}" when present`)}if(e.alg!==void 0&&e.alg!==n)throw new TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(e.key_ops)){let i=r==="encrypt"||r==="decrypt"?t.ops?.[r==="encrypt"?0:1]:r;if(i&&!e.key_ops.includes(i))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${i}" when present`)}};W_={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};Br=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},Ms=t=>t?.[Symbol.toStringTag]==="KeyObject",Hd=t=>Br(t)||Ms(t);Er=(t,...e)=>bh("Key must be ",t,...e);qc=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`)});function zc(t,e){let r=t.byteLength<<3;if(r!==e)throw new W(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Sh(t,e){if(e.length<<3!==t.ivBits)throw new W("Invalid Initialization Vector length")}async function wh(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(Er(e,"Uint8Array"));let n=t.cekBits>>1,i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),o=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[i,o,n]}async function Nh(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function J_(t,e,r,n,i){let[o,s,a]=await wh(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},o,e)),l=kt(i,n,c,Ld(i.length*8)),u=await Nh(s,l,a);return{ciphertext:c,tag:u,iv:n}}async function Y_(t,e){let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),i=await crypto.subtle.sign(r,n,t);return crypto.subtle.verify(r,n,i,e)}async function X_(t,e,r,n,i,o){let[s,a,c]=await wh(t,e,"decrypt"),l=kt(o,n,r,Ld(o.length*8)),u=await Nh(a,l,c);try{if(await Y_(i,u))return new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},s,r))}catch{}throw new sn}async function Jc(t,e,r,n,i){if(!Br(r)&&!(r instanceof Uint8Array))throw new TypeError(Er(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(n?Sh(t,n):n=z_(t),r instanceof Uint8Array&&zc(r,t.cekBits),t.cbc)return J_(t,e,r,n,i);let o=await yr(r,t.subtle,"encrypt"),s=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},o,e));return{ciphertext:s.subarray(0,-16),tag:s.subarray(-16),iv:n}}async function Yc(t,e,r,n,i,o){if(!Br(e)&&!(e instanceof Uint8Array))throw new TypeError(Er(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new W("JWE Initialization Vector missing");if(!i)throw new W("JWE Authentication Tag missing");if(!t.cbc&&i.length!==16)throw new W("Invalid Authentication Tag length");if(Sh(t,n),e instanceof Uint8Array&&zc(e,t.cekBits),t.cbc)return X_(t,e,r,n,i,o);let s=await yr(e,t.subtle,"decrypt");try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:o,iv:n,name:"AES-GCM",tagLength:128},s,kt(r,i)))}catch{throw new sn}}var xi,z_,Hs=ne(()=>{Ft();Ct();Ie();xi=t=>crypto.getRandomValues(new Uint8Array(t.cekBits>>3));z_=t=>crypto.getRandomValues(new Uint8Array(t.ivBits>>3))});function Fs(t){let e={__proto__:null};for(let r in t)e[r]={...t[r],alg:r};return e}var Bd=ne(()=>{});function Xc(t){return{kty:["RSA"],mode:"key-encryption",subtle:{name:"RSA-OAEP",hash:`SHA-${t}`},usages:Q_,ops:["wrapKey","unwrapKey"]}}function Qc(t){return{kty:["EC","OKP"],mode:t,subtle:{name:"ECDH"},resolve:({kty:e,crv:r,asymmetricKeyType:n})=>{if(r==="X25519"||n==="x25519")return{name:"X25519"};if(e==="OKP")throw new Te('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:r}},usages:Z_,ops:[void 0,"deriveBits"]}}function yo(t,e=!1){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:e?"AES-GCM":"AES-KW",length:t},usages:Zc,ops:e?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function jd(){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:"PBKDF2"},usages:Zc,ops:["deriveBits","deriveBits"]}}function go(t,e=!1){return{kty:["oct"],secret:!0,subtle:{name:e?"AES-CBC":"AES-GCM",length:t},usages:Zc,ops:eI,cekBits:t,ivBits:e?128:96,cbc:e}}function Rh(t,e){throw new Te(`Invalid or unsupported "${t}" (JWE ${e}) header value`)}function gr(t){return(typeof t=="string"?an[t]:void 0)??Rh("alg","Algorithm")}function vr(t){return t.mode==="key-wrapping"||t.mode==="key-encryption"||t.mode==="key-agreement-with-key-wrapping"}function bi(t){return(typeof t=="string"?tI[t]:void 0)??Rh("enc","Encryption Algorithm")}var Q_,Z_,Zc,an,eI,tI,Si=ne(()=>{Ie();Bd();Q_=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],Z_=[[],["deriveBits"]],Zc=[[],[]];an=Fs({dir:{kty:["oct"],mode:"direct-encryption",secret:!0,subtle:{name:"AES-GCM"},usages:Zc,ops:["encrypt","decrypt"]},"RSA-OAEP":Xc(1),"RSA-OAEP-256":Xc(256),"RSA-OAEP-384":Xc(384),"RSA-OAEP-512":Xc(512),"ECDH-ES":Qc("direct-key-agreement"),"ECDH-ES+A128KW":Qc("key-agreement-with-key-wrapping"),"ECDH-ES+A192KW":Qc("key-agreement-with-key-wrapping"),"ECDH-ES+A256KW":Qc("key-agreement-with-key-wrapping"),A128KW:yo(128),A192KW:yo(192),A256KW:yo(256),A128GCMKW:yo(128,!0),A192GCMKW:yo(192,!0),A256GCMKW:yo(256,!0),"PBES2-HS256+A128KW":jd(),"PBES2-HS384+A192KW":jd(),"PBES2-HS512+A256KW":jd()}),eI=["encrypt","decrypt"];tI=Fs({A128GCM:go(128),A192GCM:go(192),A256GCM:go(256),"A128CBC-HS256":go(256,!0),"A192CBC-HS384":go(384,!0),"A256CBC-HS512":go(512,!0)})});function Oh(t,e){if(t.algorithm.name!=="ECDH"&&t.algorithm.name!=="X25519")throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");Fd(t,e)}async function rI(t,e,r){let n=await yr(e,gr(t).subtle,"wrapKey",!0),i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function nI(t,e,r){let n=await yr(e,gr(t).subtle,"unwrapKey",!0),i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}function Ch(t,e,r){Vd(e,gr(t).subtle,r),ho(t,e)}async function Dh(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new W("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new W("PBES2 Count Input must be a positive integer");let i=kt(Et(e),Uint8Array.of(0),t),o=parseInt(e.slice(13,16),10),s={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await yr(n,gr(e).subtle,"deriveBits");return new Uint8Array(await crypto.subtle.deriveBits(s,a,o))}function Gd(t){return kt(Mc(t.length),t)}async function iI(t,e,r){let n=e>>3,i=32,o=Math.ceil(n/i),s=new Uint8Array(o*i);for(let a=1;a<=o;a++){let c=await Fc("sha256",kt(Mc(a),t,r));s.set(c,(a-1)*i)}return s.slice(0,n)}async function Ph(t,e,r,n,i=new Uint8Array,o=new Uint8Array){Oh(t),Oh(e,"deriveBits");let s=kt(Gd(Et(r)),Gd(i),Gd(o),Mc(n)),a=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3));return iI(a,n,s)}function Uh(t){Wc(t);let e=t.algorithm.namedCurve;if(e!=="P-256"&&e!=="P-384"&&e!=="P-521"&&t.algorithm.name!=="X25519")throw new Te("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function el(t,e){let r=t[e];if(r!==void 0){if(typeof r!="string")throw new W(`JOSE Header "${e}" (Agreement Party${e==="apu"?"U":"V"}Info) invalid`);return xt(r,e,W)}}function Lh(t,e){if(!(t===void 0||e===void 0||t.byteLength!==e.byteLength)){for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return;throw new W('JOSE Header "apu" and "apv" values must be distinct')}}function oI(t){if(t===void 0)throw new W("JWE Encrypted Key missing")}function kh(t){if(t!==void 0)throw new W("Encountered unexpected JWE Encrypted Key")}function sI(t){if(t!==void 0&&t!==1/0&&(!Number.isSafeInteger(t)||t<1))throw new TypeError("maxPBES2Count must be a positive safe integer or Infinity")}async function Mh(t,e,r,n,i,o){let{alg:s}=t,a=t.mode;if(a==="direct-encryption")return kh(n),r;let c=a==="direct-key-agreement";switch(c?kh(n):oI(n),t.subtle.name){case"ECDH":{let{epk:l}=i;if(!he(l)||["d","k","p","q","dp","dq","qi","oth","priv"].some(E=>Object.hasOwn(l,E)))throw new W('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');Uh(r);let u=await jr(t,l),p=el(i,"apu"),f=el(i,"apv");Lh(p,f);let m=await Ph(u,r,c?e.alg:s,c?e.cekBits:parseInt(s.slice(-5,-2),10),p,f);if(c)return m;r=m;break}case"RSA-OAEP":return Wc(r),Ch(s,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(typeof i.p2c!="number")throw new W('JOSE Header "p2c" (PBES2 Count) missing or invalid');sI(o);let l=o??1e4;if(i.p2c>l)throw new W('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof i.p2s!="string")throw new W('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let u=xt(i.p2s,"p2s",W);r=await Dh(u,s,i.p2c,r);break}case"AES-GCM":{if(typeof i.iv!="string")throw new W('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof i.tag!="string")throw new W('JOSE Header "tag" (Authentication Tag) missing or invalid');let l=xt(i.iv,"iv",W),u=xt(i.tag,"tag",W);if(l.byteLength!==12)throw new W("Invalid Initialization Vector length");if(u.byteLength!==16)throw new W("Invalid Authentication Tag length");return Yc(bi(s.slice(0,-2)),r,n,l,u,new Uint8Array)}}return nI(s.slice(-6),r,n)}async function tl(t,e,r,n,i,o={}){let{alg:s,mode:a}=t,c=vr(t);if(i!==void 0&&!c)throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${s}`);let l=await hr(a==="direct-encryption"?e:t,r,"encrypt");if(a==="direct-encryption")return[l,void 0,void 0];let u=c?i??xi(e):void 0;u&&zc(u,e.cekBits);let p,f;switch(t.subtle.name){case"ECDH":{Uh(l);let{apu:m,apv:E}=o;m!==void 0&&at(m,'"apu"'),E!==void 0&&at(E,'"apv"');let v=m??el(n,"apu"),N=E??el(n,"apv");Lh(v,N);let S;o.epk!==void 0?S=await hr(t,o.epk,"decrypt"):S=(await crypto.subtle.generateKey(l.algorithm,!0,["deriveBits"])).privateKey;let R=crypto.subtle,M=S;if(!M.extractable){if(typeof R.getPublicKey!="function")throw new TypeError('CryptoKey for "epk" must be extractable');M=await R.getPublicKey(S,[])}let{x:K,y:B,crv:V,kty:$}=await R.exportKey("jwk",M),A=a==="direct-key-agreement",x=await Ph(l,S,A?e.alg:s,A?e.cekBits:parseInt(s.slice(-5,-2),10),v,N),b={x:K,crv:V,kty:$};if($==="EC"&&(b.y=B),f={epk:b},m!==void 0&&(f.apu=De(m)),E!==void 0&&(f.apv=De(E)),A)return[x,void 0,f];l=x;break}case"RSA-OAEP":{Wc(l),Ch(s,l,"encrypt"),p=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",l,u));break}case"PBKDF2":{let{p2c:m=2048,p2s:E=crypto.getRandomValues(new Uint8Array(16))}=o;l=await Dh(E,s,m,l),f={p2c:m,p2s:De(E)};break}case"AES-GCM":{let m=o.iv===void 0?crypto.getRandomValues(new Uint8Array(12)):o.iv;if(!(m instanceof Uint8Array))throw new TypeError('"iv" must be an instance of Uint8Array');let E=await Jc(bi(s.slice(0,-2)),u,l,m,new Uint8Array);p=E.ciphertext,f={iv:De(E.iv),tag:De(E.tag)}}}if(p??=await rI(s.slice(-6),l,u),!(p instanceof Uint8Array)||!p.byteLength)throw new TypeError("JWE key management algorithm did not produce an Encrypted Key");return[u,p,f]}var rl=ne(()=>{zt();Ct();Si();Ie();Pe();Ft();Hs()});function nl(t,e){if(t.zip!==void 0&&t.zip!=="DEF")throw new Te('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(t.zip!==void 0&&!e?.zip)throw new W('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}function Kh(t){if(typeof globalThis[t]>"u")throw new Te(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Hh(t,e,r=1/0){let n=t.writable.getWriter();n.write(e).catch(()=>{}),n.close().catch(()=>{});let i=[],o=0,s=t.readable.getReader();for(;;){let{value:a,done:c}=await s.read();if(c)break;if(i.push(a),o+=a.byteLength,r!==1/0&&o>r)throw new W("Decompressed plaintext exceeded the configured limit")}return kt(...i)}async function Fh(t){return Kh("CompressionStream"),Hh(new CompressionStream("deflate-raw"),t)}async function Vh(t,e){return Kh("DecompressionStream"),Hh(new DecompressionStream("deflate-raw"),t,e)}var $d=ne(()=>{Ie();Ft()});function il(t){let{aad:e,ciphertext:r,iv:n,protected:i,tag:o,unprotected:s}=t;if(n!==void 0&&(typeof n!="string"||!n))throw new W("JWE Initialization Vector incorrect type");if(typeof r!="string")throw new W("JWE Ciphertext missing or incorrect type");if(o!==void 0&&(typeof o!="string"||!o))throw new W("JWE Authentication Tag incorrect type");if(i!==void 0&&typeof i!="string")throw new W("JWE Protected Header incorrect type");if(e!==void 0&&(typeof e!="string"||!e))throw new W("JWE AAD incorrect type");if(s!==void 0&&!he(s))throw new W("JWE Shared Unprotected Header incorrect type");return{aad:e,ciphertext:r,iv:n,protected:i,tag:o,unprotected:s===void 0?void 0:{...s}}}function ol(t){let e,r;try{let{header:n}=t;if(he(n)){r=n.alg;let o=Object.keys(n);o.includes("alg")||(r=void 0),e=Object.fromEntries(o.map(s=>[s,s==="alg"?r:n[s]]))}else e=n;let{encrypted_key:i}=t;return[{encrypted_key:i,header:e},r]}catch(n){return[void 0,r,n]}}function sl(t){let{encrypted_key:e,header:r}=t;if(e!==void 0&&typeof e!="string")throw new W("JWE Encrypted Key incorrect type");if(r!==void 0&&!he(r))throw new W("JWE Per-Recipient Unprotected Header incorrect type");if(t.protected===void 0&&r===void 0&&t.unprotected===void 0)throw new W("JOSE Header missing")}function qd(t){let{protected:e,ciphertext:r,iv:n,tag:i,aad:o}=t,s;return e!==void 0&&(s=Kn(e,W,"JWE Protected Header is invalid")),[s,xt(r,"ciphertext",W),n!==void 0?xt(n,"iv",W):void 0,i!==void 0?xt(i,"tag",W):void 0,jc((e??"")+(o!==void 0?`.${o}`:""),"aad",W)]}function Fn(t){return[t&&Ls("keyManagementAlgorithms",t.keyManagementAlgorithms),t&&Ls("contentEncryptionAlgorithms",t.contentEncryptionAlgorithms),t?.crit,t?.maxPBES2Count,t?.maxDecompressedLength]}async function Vs(t,e,r,n=qd(t)){let[i,o,s,a,c]=n,{header:l,unprotected:u,aad:p}=t,f;if(l!==void 0||u!==void 0){if(!Mn(i,l,u))throw new W("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");f={...i,...l,...u}}else f=i??{};let[m,E,v,N,S]=e,{encrypted_key:R}=t;Vr(W,Gc,v,i,f),nl(f,i);let{alg:M,enc:K}=f;if(typeof M!="string"||!M)throw new W("missing JWE Algorithm (alg) in JWE Header");let B=an[M];if(R===""&&(!B||!vr(B)))throw new W("JWE Encrypted Key incorrect type");let V=B?.mode==="integrated-encryption";if(!V&&(typeof K!="string"||!K))throw new W("missing JWE Encryption Algorithm (enc) in JWE Header");if(m&&!m.has(M)||!m&&M.startsWith("PBES2"))throw new Un('"alg" (Algorithm) Header Parameter value not allowed');let $;if(V){if(K!==void 0)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');if(s?.byteLength)throw new W("JWE Initialization Vector must be empty for integrated encryption");if(a?.byteLength)throw new W("JWE Authentication Tag must be empty for integrated encryption")}else{if(E&&!E.has(K))throw new Un('"enc" (Encryption Algorithm) Header Parameter value not allowed');$=bi(K)}let A;if(R!==void 0)try{A=xt(R,"encrypted_key",W)}catch(O){if(!B||!vr(B))throw O;A=new Uint8Array}let x=!1;typeof r=="function"&&(r=await r(i,t),x=!0);let b=B??gr(M);vr(b)&&A===void 0&&(A=new Uint8Array);let g=await hr(b.mode==="direct-encryption"?$:b,r,"decrypt"),I;if(b.mode==="integrated-encryption")I=await b.decrypt(g,A,o,c,i,f);else{let O=$,D;try{D=await Mh(b,O,g,A,f,N),vr(b)&&D instanceof Uint8Array&&D.byteLength<<3!==O.cekBits&&(D=xi(O))}catch(k){if(k instanceof TypeError||k instanceof W||k instanceof Te)throw k;D=xi(O)}I=await Yc(O,D,o,s,a,c)}if(f.zip==="DEF"){let O=S??25e4;if(O===0)throw new Te('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(O!==1/0&&(!Number.isSafeInteger(O)||O<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");I=await Vh(I,O).catch(D=>{throw D instanceof W?D:new W("Failed to decompress plaintext",{cause:D})})}return{plaintext:I,...i&&{protectedHeader:i},...p!==void 0&&{additionalAuthenticatedData:xt(p,"aad",W)},...u&&{sharedUnprotectedHeader:u},...l&&{unprotectedHeader:l},...x&&{key:g}}}async function al(t,e,r){if(t instanceof Uint8Array&&(t=ao.decode(t)),typeof t!="string")throw new W("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:o,3:s,4:a,length:c}=t.split(".");if(c!==5)throw new W("Invalid Compact JWE");return Vs({ciphertext:s,iv:o||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r)}var Bs=ne(()=>{Hs();Pe();Ie();rl();Ft();Ct();Si();$d()});async function Bh(t,e,r){return al(t,Fn(r),e)}var jh=ne(()=>{Bs()});async function Gh(t,e,r){if(!he(t))throw new W("Flattened JWE must be an object");let n=il(t),[i,,o]=ol(t);if(!i)throw o;let s={...n,...i};return sl(s),Vs(s,Fn(r),e)}var $h=ne(()=>{Ie();Pe();Bs()});async function qh(t,e,r){if(!he(t))throw new W("General JWE must be an object");let n=t.recipients;if(!Array.isArray(n))throw new W("JWE Recipients missing or incorrect type");let i=Array.from(n);if(!i.every(he))throw new W("JWE Recipients missing or incorrect type");if(!i.length)throw new W("JWE Recipients has no members");let o,s,a;try{o=Fn(r),s=il(t),a=qd(s)}catch{throw new sn}let c=i.map(l=>ol(l));if(i.length>1)for(let[,l]of c){let u=a[0]?.alg??l??s.unprotected?.alg,p=typeof u=="string"?an[u]:void 0;if(p&&!vr(p))throw new W(`"${u}" alg may only have a single recipient`)}for(let[l]of c)if(l)try{let u={...s,...l};return sl(u),await Vs(u,o,e,a)}catch{}throw new sn}var Wh=ne(()=>{Bs();Ie();Pe();Si()});function cl(t,e,r){if(!Mn(t,e,r))throw new W("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}function Wd(t,e,r=!1){if(!t[1]&&!t[2]&&!t[3])throw new W("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");e!==void 0&&(t[8]=e?.crit);let[,n,i,o,s,a,c,l,u]=t;if(s!==void 0&&at(s,"JWE Additional Authenticated Data"),a!==void 0&&at(a,"JWE Content Encryption Key"),c!==void 0&&at(c,"JWE Initialization Vector"),!r&&n!==void 0&&(n=Ii(W,n)[0],t[1]=n),i!==void 0&&(i=Ii(W,i)[0],t[2]=i),!r&&o!==void 0&&(o=Ii(W,o)[0],t[3]=o),l!==void 0&&!he(l))throw new TypeError("JWE Key Management Parameters must be an object");cl(n,i,o);let p={...n,...i,...o};$c(W,n),Vr(W,Gc,u,n,p),nl(p,n);let{alg:f,enc:m}=p;if(typeof f!="string"||!f)throw new W('JWE "alg" (Algorithm) Header Parameter missing or invalid');let E=an[f];if(E?.mode==="integrated-encryption"){if(m!==void 0)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');if(a!==void 0)throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${f}`);if(c!==void 0)throw new TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${f}`);return[p,void 0,E]}if(typeof m!="string"||!m)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[p,bi(m),E]}async function zd(t,e,r){let[n,i,o]=e,[s,a,c,l,u,p,f,m,,E]=t,v=a,N=c,S=o??gr(n.alg),R,M,K;S.mode==="integrated-encryption"?K=await hr(S,r,"encrypt"):[K,R,M]=await tl(S,i,r,n,p,m),M&&(E?N=N?{...N,...M}:M:v=v?{...v,...M}:M,cl(v,N,l));let B=v?De(JSON.stringify(v)):"",V=u?.byteLength?De(u):void 0,$=Et(V?`${B}.${V}`:B),A=s;n.zip==="DEF"&&(A=await Fh(A).catch(O=>{throw new W("Failed to compress plaintext",{cause:O})}));let x,b,g;S.mode==="integrated-encryption"?[R,x]=await S.encrypt(K,A,$,v,n,m):{ciphertext:x,tag:b,iv:g}=await Jc(i,A,K,f,$);let I={ciphertext:De(x)};return g&&(I.iv=De(g)),b&&(I.tag=De(b)),R?.byteLength&&(I.encrypted_key=De(R)),V&&(I.aad=V),v&&(I.protected=B),l&&(I.unprotected=l),N&&(I.header=N),I}async function vo(t,e,r){return zd(t,Wd(t,r),e)}function ll(t){return[t.protected,t.encrypted_key,t.iv,t.ciphertext,t.tag].join(".")}var js=ne(()=>{zt();Hs();rl();Ie();Pe();Ft();Ct();Si();$d()});var Jd,ul,zh=ne(()=>{Pe();Ie();Hs();zt();js();rl();Si();Jd=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n]}setUnprotectedHeader(e){return Se(this.state[0],"setUnprotectedHeader"),this.state[0]=e,this}setKeyManagementParameters(e){return Se(this.state[1],"setKeyManagementParameters"),this.state[1]=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}},ul=class{#e;#t=[];#r;#o;#i;constructor(e){this.#e=e}addRecipient(e,r){let n=new Jd(this,e,r?.crit);return this.#t.push(n),n}setProtectedHeader(e){return Se(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return Se(this.#o,"setSharedUnprotectedHeader"),this.#o=e,this}setAdditionalAuthenticatedData(e){return this.#i=e,this}async encrypt(){if(!this.#t.length)throw new W("at least one recipient must be added");at(this.#e,"plaintext");let e=this.#t.length>1,r,n=this.#r,i=this.#o,o=[];for(let E of this.#t){let[v,N,S,R]=E.state,M=[this.#e,n,v,i,this.#i,void 0,void 0,N,R,e],K=Wd(M,void 0,o.length>0);o.length||(n=M[1],i=M[3]),o.push([M,K,S]);let[{alg:B,enc:V},,$]=K;if(e&&$&&!vr($))throw new W(`"${B}" alg may only have a single recipient`);if(!r)r=V;else if(r!==V)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}for(let[,E]of o)E[2]??=gr(E[0].alg);let[s,a,c]=o[0],l=e?xi(a[1]):void 0;s[5]=l;let{encrypted_key:u,header:p,...f}=await zd(s,a,c),m={...f,recipients:[{}]};u&&(m.recipients[0].encrypted_key=u),p&&(m.recipients[0].header=p);for(let E=1;E<o.length;E++){let[v,[N,S,R],M]=o[E],K=v[2],[,B,V]=await tl(R,S,M,N,l,v[7]),$={encrypted_key:De(B)};if(K||V){let A={...K,...V};V&&cl(v[1],A,v[3]),$.header=A}m.recipients.push($)}return m}}});function Yd(t){let e={name:"HMAC",hash:`SHA-${t}`};return{kty:["oct"],secret:!0,subtle:e,signing:e,usages:Gs}}function Ao(t,e){let r={name:e?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${t}`};return{kty:["RSA"],subtle:r,signing:e?{...r,saltLength:e}:r,usages:Gs,minRsaBits:2048}}function Xd(t,e){return{kty:["EC"],crv:t,subtle:{name:"ECDSA",namedCurve:t},signing:{name:"ECDSA",hash:`SHA-${e}`},usages:Gs}}function Jh(){let t={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:t,signing:t,usages:Gs}}function Qd(t){let e={name:`ML-DSA-${t}`};return{kty:["AKP"],subtle:e,signing:e,usages:Gs}}function To(t){let e=typeof t=="string"?$s[t]:void 0;if(!e)throw new Te(`alg ${t} is not supported either by JOSE or your javascript runtime`);return e}var Gs,$s,_o=ne(()=>{Ie();Bd();Gs=[["verify"],["sign"]];$s=Fs({HS256:Yd(256),HS384:Yd(384),HS512:Yd(512),RS256:Ao(256),RS384:Ao(384),RS512:Ao(512),PS256:Ao(256,32),PS384:Ao(384,48),PS512:Ao(512,64),ES256:Xd("P-256",256),ES384:Xd("P-384",384),ES512:Xd("P-521",512),EdDSA:Jh(),Ed25519:Jh(),"ML-DSA-44":Qd(44),"ML-DSA-65":Qd(65),"ML-DSA-87":Qd(87)})});function dl(t,e){let r=t.protected,n=t.header,i=he(n)?{...n}:n,o=e?e[0]:t.payload;!e&&o instanceof Uint8Array&&(o=new Uint8Array(o));let s=t.signature,a={payload:o,signature:s};if(r!==void 0&&(a.protected=r),n!==void 0&&(a.header=i),r===void 0&&i===void 0)throw new ee('Flattened JWS must have either of the "protected" or "header" members');if(r!==void 0&&typeof r!="string")throw new ee("JWS Protected Header incorrect type");if(o===void 0)throw new ee("JWS Payload missing");if(typeof s!="string")throw new ee("JWS Signature missing or incorrect type");if(i!==void 0&&!he(i))throw new ee("JWS Unprotected Header incorrect type");return a}function Vn(t){return[t&&Ls("algorithms",t.algorithms),t?.crit]}function Zd(t){return t===void 0?{}:Kn(t,ee,"JWS Protected Header is invalid")}function pl(t){let e=/[\p{Cs}\p{Cn}]/u.exec(t)?.[0];if(e!==void 0)throw new ee(/\p{Cs}/u.test(e)?"JWS Payload must be a well-formed Unicode string":"JWS Payload must not contain unassigned Unicode code points");return on.encode(t)}function aI(t){try{return Et(t)}catch{throw new ee("JWS Compact Serialization payload must use only ASCII characters")}}async function qs(t,e,r,n,i){let{protected:o,header:s,payload:a}=t,c=i??Zd(o);if(!Mn(c,s))throw new ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let l={...c,...s},u=mo(c,Vr(ee,fo,e[1],c,l)),{alg:p}=l;if(typeof p!="string"||!p)throw new ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(e[0]&&!e[0].has(p))throw new Un('"alg" (Algorithm) Header Parameter value not allowed');if(u){if(typeof a!="string")throw new ee("JWS Payload must be a string")}else if(typeof a!="string"&&!(a instanceof Uint8Array))throw new ee("JWS Payload must be a string or an Uint8Array instance");let f=u||typeof a!="string"?a:n(a),m=!1;typeof r=="function"&&(r=await r(c,t),m=!0);let E=To(p),v=kt(o!==void 0?Et(o):new Uint8Array,Et("."),typeof f=="string"?e[2]??=jc(f,"payload",ee):f),N=xt(t.signature,"signature",ee),S=await hr(E,r,"verify"),R=await yr(S,E.subtle,"verify");E.minRsaBits&&ho(E.alg,R);let M=!1;try{M=await crypto.subtle.verify(E.signing,R,N,v)}catch{}if(!M)throw new Ln;let K={payload:typeof f=="string"?xt(f,"payload",ee):f};return o!==void 0&&(K.protectedHeader=c),s!==void 0&&(K.unprotectedHeader=s),m?[{...K,key:S},u]:[K,u]}async function fl(t,e,r){if(t instanceof Uint8Array&&(t=ao.decode(t)),typeof t!="string")throw new ee("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:o,length:s}=t.split(".");if(s!==3)throw new ee("Invalid Compact JWS");return qs({payload:i,protected:n,signature:o},e,r,aI)}var Ws=ne(()=>{_o();Ie();Ft();Pe();Ct()});async function Yh(t,e,r){let[n]=await fl(t,Vn(r),e);return n}var Xh=ne(()=>{Ws()});async function Qh(t,e,r){if(!he(t))throw new ee("Flattened JWS must be an object");let n=dl(t),[i]=await qs(n,Vn(r),e,pl);return i}var Zh=ne(()=>{Ie();Pe();Ws()});function cI(t,e){try{let r=dl(t,[e]),n=Zd(r.protected),{b64:i,crit:o}=n;return[r,n,Array.isArray(o)&&o.includes("b64")?typeof i=="boolean"?i?1:2:0:1]}catch{return}}async function eE(t,e,r){if(!he(t))throw new ee("General JWS must be an object");let{signatures:n,payload:i}=t;if(!Array.isArray(n))throw new ee("JWS Signatures missing or incorrect type");let o=Array.from(n);if(!o.every(he))throw new ee("JWS Signatures missing or incorrect type");let s;try{if(i===void 0)throw new Error;s=Vn(r)}catch{throw new Ln}let a=i instanceof Uint8Array?new Uint8Array(i):i,c=o.map(u=>cI(u,a)).filter(u=>u!==void 0),l=0;for(let[,,u]of c)if(l|=u,l===3)throw new ee("inconsistent use of JWS Unencoded Payload (RFC7797)");for(let u of c)try{let[p]=await qs(u[0],s,e,pl,u[1]);return p}catch{}throw new Ln}var tE=ne(()=>{Ws();Ie();Pe()});function ep(){throw new TypeError("Invalid time period format")}function ml(t){typeof t!="string"&&ep();let e=uI.exec(t);(!e||e[4]&&e[1])&&ep();let r=parseFloat(e[2]),n=Math.round(r*lI[e[3][0].toLowerCase()]);return Number.isFinite(n)||ep(),e[1]==="-"||e[4]==="ago"?-n:n}function xo(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function tp(t,e){if(typeof e!="string")throw new TypeError(`"${t}" claim must be a string`)}function dI(t){if(typeof t!="string"&&(!Array.isArray(t)||Array.from(t).some(e=>typeof e!="string")))throw new TypeError('"aud" claim must be a string or an array of strings')}function rp(t,e){return typeof t=="number"?xo(e,t):t instanceof Date?xo(e,zs(t)):zs(new Date)+ml(t)}function np(t,e,r=!1){let n=t[e];if(!(n===void 0&&!r)){if(typeof n!="number")throw new ir(`"${e}" claim must be a number`,t,e,"invalid");return n}}function ip(t,e){throw new ir(`unexpected "${e}" claim value`,t,e,Io)}function bo(t,e,r={}){let n;try{n=JSON.parse(co.decode(e))}catch{}if(!he(n))throw new je("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i!==void 0&&(typeof t.typ!="string"||rE(t.typ)!==rE(i)))throw new ir('unexpected "typ" JWT header value',n,"typ",Io);let{requiredClaims:o=[],issuer:s,subject:a,audience:c,maxTokenAge:l}=r,u=[...o];l!==void 0&&u.push("iat"),c!==void 0&&u.push("aud"),a!==void 0&&u.push("sub"),s!==void 0&&u.push("iss");for(let R of new Set(u.reverse()))if(!Object.hasOwn(n,R))throw new ir(`missing required "${R}" claim`,n,R,"missing");s!==void 0&&!(Array.isArray(s)?s:[s]).includes(n.iss)&&ip(n,"iss"),a!==void 0&&n.sub!==a&&ip(n,"sub"),c!==void 0&&!pI(n.aud,typeof c=="string"?[c]:c)&&ip(n,"aud");let{clockTolerance:p}=r,f=0;if(typeof p=="string")f=ml(p);else if(p!==void 0){if(typeof p!="number")throw new TypeError("Invalid clockTolerance option type");f=p}xo("clockTolerance option",f);let{currentDate:m}=r,E=xo("currentDate option",zs(m===void 0?new Date:m)),v=np(n,"iat",l!==void 0),N=np(n,"nbf");if(N!==void 0&&N>E+f)throw new ir('"nbf" claim timestamp check failed',n,"nbf",Io);let S=np(n,"exp");if(S!==void 0&&S<=E-f)throw new lo('"exp" claim timestamp check failed',n,"exp",Io);if(l!==void 0){let R=E-v,M=xo("maxTokenAge option",typeof l=="number"?l:ml(l));if(R-f>M)throw new lo('"iat" claim timestamp check failed (too far in the past)',n,"iat",Io);if(R<-f)throw new ir('"iat" claim timestamp check failed (it should be in the past)',n,"iat",Io)}return n}function cn(t){return nE.get(t)}function So(t){let e=cn(t);for(let r of["iat","nbf","exp"]){let n=e[r];if(typeof n=="number"&&!Number.isFinite(n))throw new TypeError(`"${r}" claim must be a finite number`)}return on.encode(JSON.stringify(e))}function hl(t,e){return cn(t)[e]}var zs,lI,uI,Io,rE,pI,nE,Bn,wo=ne(()=>{Ie();Ft();Pe();zs=t=>Math.floor(t.getTime()/1e3),lI={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},uI=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Io="check_failed";rE=t=>{let e=t.toLowerCase();return t.includes("/")?e:`application/${e}`},pI=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(r=>t.includes(r)):!1;Bn=class{constructor(e={}){if(!he(e))throw new TypeError("JWT Claims Set MUST be an object");(nE||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return tp("iss",e),cn(this).iss=e,this}setSubject(e){return tp("sub",e),cn(this).sub=e,this}setAudience(e){return dI(e),cn(this).aud=e,this}setJti(e){return tp("jti",e),cn(this).jti=e,this}setNotBefore(e){return cn(this).nbf=rp(e,"setNotBefore"),this}setExpirationTime(e){return cn(this).exp=rp(e,"setExpirationTime"),this}setIssuedAt(e){let r=cn(this);return e===void 0?r.iat=zs(new Date):typeof e=="string"?r.iat=xo("setIssuedAt",zs(new Date)+ml(e)):r.iat=rp(e,"setIssuedAt"),this}}});async function jn(t,e,r){let[n,i]=await fl(t,Vn(r),e);if(!i)throw new je("JWTs MUST NOT use unencoded payload");let o=bo(n.protectedHeader,n.payload,r);return{...n,payload:o}}var iE=ne(()=>{Ws();wo();Ie()});async function oE(t,e,r){let{plaintext:n,...i}=await al(t,Fn(r),e),{protectedHeader:o}=i,s=bo(o,n,r);for(let a of["iss","sub","aud"])if(o[a]!==void 0&&(a==="aud"?JSON.stringify(o.aud)!==JSON.stringify(s.aud):o[a]!==s[a]))throw new ir(`replicated "${a}" claim header parameter mismatch`,s,a,"mismatch");return{payload:s,...i}}var sE=ne(()=>{Bs();wo();Ie()});var El,aE=ne(()=>{Pe();js();El=class{#e;constructor(e){at(e,"plaintext"),this.#e=[e]}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}async encrypt(e,r){return ll(await vo([...this.#e],e,r))}}});var yl,cE=ne(()=>{Pe();js();yl=class{#e;constructor(e){at(e,"plaintext"),this.#e=[e]}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setSharedUnprotectedHeader(e){return Se(this.#e[3],"setSharedUnprotectedHeader"),this.#e[3]=e,this}setUnprotectedHeader(e){return Se(this.#e[2],"setUnprotectedHeader"),this.#e[2]=e,this}setAdditionalAuthenticatedData(e){return this.#e[4]=e,this}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}async encrypt(e,r){return vo([...this.#e],e,r)}}});async function Js(t,e,r){let[n,i,o,s]=t,a="";if(i!==void 0){let S=Ii(ee,i);i=S[0],a=De(S[1])}if(o!==void 0&&(o=Ii(ee,o)[0]),!i&&!o)throw new ee("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Mn(i,o))throw new ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let c={...i,...o};$c(ee,i);let l=mo(i,Vr(ee,fo,s,i,c));l||r?.();let{alg:u}=c;if(typeof u!="string"||!u)throw new ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');let p=To(u),f="",m=n,E;if(l){let S=t[4];S?(f=S[0]??=De(n),m=S[1]??=Et(f)):(f=De(n),E=on.encode(`${a}.${f}`))}E??=kt(Et(a),Et("."),m);let v=await yr(await hr(p,e,"sign"),p.subtle,"sign");p.minRsaBits&&ho(p.alg,v);let N={signature:De(new Uint8Array(await crypto.subtle.sign(p.signing,v,E))),payload:f};return i&&(N.protected=a),o&&(N.header=o),[N,l]}async function gl(t,e,r,n,i){let[o]=await Js([t,e,void 0,r],n,i);return`${o.protected}.${o.payload}.${o.signature}`}var Ys=ne(()=>{zt();_o();Pe();Ie();Ft();Ct()});var vl,lE=ne(()=>{Ys();Pe();vl=class{#e;#t;constructor(e){at(e,"payload"),this.#e=e}setProtectedHeader(e){return Se(this.#t,"setProtectedHeader"),this.#t=e,this}async sign(e,r){return gl(this.#e,this.#t,r?.crit,e,()=>{throw new TypeError("use the flattened module for creating JWS with b64: false")})}}});var Al,uE=ne(()=>{Ys();Pe();Al=class{#e;constructor(e){at(e,"payload"),this.#e=[e]}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setUnprotectedHeader(e){return Se(this.#e[2],"setUnprotectedHeader"),this.#e[2]=e,this}async sign(e,r){let n=[...this.#e];n[3]=r?.crit;let[i]=await Js(n,e);return i}}});var op,Tl,dE=ne(()=>{Ys();Ie();Pe();op=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n?.crit]}setProtectedHeader(e){return Se(this.state[0],"setProtectedHeader"),this.state[0]=e,this}setUnprotectedHeader(e){return Se(this.state[1],"setUnprotectedHeader"),this.state[1]=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},Tl=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new op(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new ee("at least one signature must be added");at(this.#e,"payload");let e={signatures:[],payload:""},r=[],n;for(let i of this.#t){let[o,s,a,c]=i.state,[{payload:l,...u},p]=await Js([this.#e,o,s,c,r],a);if(n===void 0)n=p,e.payload=l;else if(n!==p)throw new ee("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(u)}return e}}});var fI,No,pE=ne(()=>{Ys();Ie();wo();Pe();fI=Bn,No=class extends fI{#e;setProtectedHeader(e){return Se(this.#e,"setProtectedHeader"),this.#e=e,this}async sign(e,r){return gl(So(this),this.#e,r?.crit,e,()=>{throw new je("JWTs MUST NOT use unencoded payload")})}}});var mI,_l,fE=ne(()=>{js();wo();Pe();mI=Bn,_l=class extends mI{#e=[void 0];#t;#r;#o;setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#r=!0,this}replicateAudienceAsHeader(){return this.#o=!0,this}async encrypt(e,r){let n=So(this);this.#e[1]&&(this.#t||this.#r||this.#o)&&(this.#e[1]={...this.#e[1],iss:this.#t?hl(this,"iss"):void 0,sub:this.#r?hl(this,"sub"):void 0,aud:this.#o?hl(this,"aud"):void 0});let i=[...this.#e];return i[0]=n,ll(await vo(i,e,r))}}});function wi(t='JWK "alg" (Algorithm) Parameter'){throw new Te(`Invalid or unsupported ${t} value`)}function Ni(t,e){return(typeof t=="string"?$s[t]??an[t]:void 0)??wi(e)}var Gn,Xs=ne(()=>{Ie();_o();Si();Gn='"alg" (Algorithm)'});function yI(t,e){if($n(t,48,`Invalid ${e==="spki"?"SPKI":"PKCS#8"} structure`),ln(t),e==="pkcs8"){$n(t,2,"Expected version field");let r=ln(t);t.pos+=r}$n(t,48,"Expected algorithm identifier"),ln(t)}function vI(t){let e=gE(t);$n(e,48,"Invalid certificate structure");let r=ln(e);if(r<0||e.pos+r>e.data.length)throw new Error("Unexpected end of ASN.1 input");$n(e,48,"Invalid tbsCertificate structure"),ln(e),t[e.pos]===160?mE(e,6):mE(e,5);let n=e.pos;$n(e,48,"Invalid SPKI structure");let i=ln(e);return t.subarray(n,n+i+(e.pos-n))}var hI,hE,EE,yE,Qs,gE,sp,ln,mE,$n,vE,EI,gI,ap,cp,AE,TE,_E,lp=ne(()=>{Ct();Ft();Ie();Xs();hI=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
 `);return`-----BEGIN ${e}-----
 ${r}
------END ${e}-----`},Gh=async(t,e,r)=>{if(Eo(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!hr(r))throw new TypeError(Dr(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return pI(Tc(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},$h=t=>Gh("public","spki",t),Wh=t=>Gh("private","pkcs8",t),Oo=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},zh=t=>({data:t,pos:0}),Sd=t=>{let e=t.data[t.pos++];if(e===void 0)throw new Error("Unexpected end of ASN.1 input");return e},Xr=t=>{let e=Sd(t);if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|Sd(t);return n}return e},qh=(t,e=1)=>{for(;e-- >0;){t.pos++;let r=Xr(t);t.pos+=r}},Cn=(t,e,r)=>{if(Sd(t)!==e)throw new Error(r)},Jh=(t,e)=>{if(e<0||t.pos+e>t.data.length)throw new Error("Unexpected end of ASN.1 input");let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},fI=t=>{Cn(t,6,"Expected algorithm OID");let e=Xr(t);return Jh(t,e)};hI=t=>{let e=fI(t);if(Oo(e,[43,101,110]))return"X25519";if(!Oo(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Cn(t,6,"Expected curve OID");let r=Xr(t),n=Jh(t,r);if(Oo(n,[42,134,72,206,61,3,1,7]))return"P-256";if(Oo(n,[43,129,4,0,34]))return"P-384";if(Oo(n,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},wd=async(t,e,r,n)=>{let i=kn(r,On);i.secret&&hi(On);let s=t==="spki",o;if(i.resolve)try{let a=zh(e);mI(a,t),o=i.resolve({crv:hI(a)})}catch{throw new Ee("Invalid or unsupported key format")}else o=i.subtle;return crypto.subtle.importKey(t,e,o,n?.extractable??s,i.usages[s?0:1])},Nd=(t,e)=>_c(t.replace(e,"")),Yh=(t,e,r)=>{let n=Nd(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return wd("pkcs8",n,e,r)},Xh=(t,e,r)=>{let n=Nd(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);return wd("spki",n,e,r)};Qh=(t,e,r)=>{let n;try{let i=Nd(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);n=EI(i)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return wd("spki",n,e,r)}});function yI(t){return Object.fromEntries(Object.entries(t).filter(([,e])=>e!==void 0))}async function gI(t){if(Eo(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:Ue(t)};if(!hr(t))throw new TypeError(Dr(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:e,key_ops:r,alg:n,use:i,...s}=yI(await crypto.subtle.exportKey("jwk",t));return s.kty==="AKP"&&(s.alg=n),s}function Zh(t){return $h(t)}function eE(t){return Wh(t)}function zc(t){return gI(t)}var Od=Q(()=>{Rd();$i();qt();di()});async function kd(t,e){let r;if(xc(t))r=t;else if(gc(t))r=await zc(t);else throw new TypeError(Dr(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":Lr(r.alg,'"alg" (Algorithm) Parameter'),Lr(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":Lr(r.crv,'"crv" (Curve) Parameter'),Lr(r.x,'"x" (X Coordinate) Parameter'),Lr(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":Lr(r.crv,'"crv" (Subtype of Key Pair) Parameter'),Lr(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":Lr(r.e,'"e" (Exponent) Parameter'),Lr(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":Lr(r.k,'"k" (Key Value) Parameter'),n={k:r.k,kty:r.kty};break;default:throw new Ee('"kty" (Key Type) Parameter missing or unsupported')}let i=Xe(JSON.stringify(n));return Ue(await Sc(e,i))}async function tE(t,e){e??="sha256";let r=await kd(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var Lr,rE=Q(()=>{rr();qt();Te();Ut();di();at();Od();$i();Lr=(t,e)=>{if(typeof t!="string"||!t)throw new fo(`${e} missing or invalid`)}});async function nE(t,e){let r={...t,...e?.header};if(!_e(r.jwk))throw new fe('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n=rs(r.alg),i=await nr(n,{...r.jwk,ext:!0});if(i.type!=="public")throw new fe('"jwk" (JSON Web Key) Header Parameter must be a public key');return i}var iE=Q(()=>{Yi();ns();at();Te()});function vI(t){let e=typeof t=="string"?Io[t]:void 0;if(!e||e.secret)throw new Ee('Unsupported "alg" value for a JSON Web Key Set');return e}function AI(t){if(!t||typeof t!="object")return!1;let{keys:e}=t;return Array.isArray(e)&&e.every(_e)}async function sE(t,e,r){let n=t.get(e)||t.set(e,{__proto__:null}).get(e);if(n[r.alg]===void 0){let i=await nr(r,{...e,alg:r.alg,ext:!0});if(i.type!=="public")throw new zi("JSON Web Key Set members must be public keys");n[r.alg]=i}return n[r.alg]}function ko(t){let e=new Cd(t),r=async(n,i)=>e.getKey(n,i);return Object.defineProperty(r,"jwks",{value:()=>structuredClone(e.jwks())}),r}var Cd,Dd=Q(()=>{Yi();ns();Te();at();Cd=class{#e;#t=new WeakMap;constructor(e){if(!AI(e))throw new zi("JSON Web Key Set malformed");this.#e=structuredClone(e)}jwks(){return this.#e}async getKey(e,r){let{alg:n,kid:i}={...e,...r?.header},s=vI(n),o=this.#e.keys.filter(l=>s.kty.includes(l.kty)&&(typeof i!="string"||i===l.kid)&&(!(typeof l.alg=="string"||l.kty==="AKP")||n===l.alg)&&(typeof l.use!="string"||l.use==="sig")&&(!Array.isArray(l.key_ops)||l.key_ops.includes("verify"))&&(!s.crv||l.crv===s.crv)),{0:a,length:c}=o;if(c===0)throw new ui;if(c!==1){let l=new mo,d=this.#t;throw l[Symbol.asyncIterator]=async function*(){for(let p of o)try{yield await sE(d,p,s)}catch{}},l}return sE(this.#t,a,s)}}});function TI(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function _I(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(s=>{throw s.name==="TimeoutError"?new ho:s});if(i.status!==200)throw new rt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new rt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function II(t,e){return!(typeof t!="object"||t===null||!("uat"in t)||typeof t.uat!="number"||Date.now()-t.uat>=e||!("jwks"in t)||!_e(t.jwks)||!Array.isArray(t.jwks.keys)||!Array.prototype.every.call(t.jwks.keys,_e))}function oE(t,e){let r=new Ud(t,e),n=async(i,s)=>r.getKey(i,s);return Object.defineProperties(n,{coolingDown:{get:()=>r.coolingDown(),enumerable:!0},fresh:{get:()=>r.fresh(),enumerable:!0},reload:{value:()=>r.reload(),enumerable:!0},reloading:{get:()=>r.pendingFetch(),enumerable:!0},jwks:{value:()=>r.jwks(),enumerable:!0}}),n}var Pd,Ld,Md,Ud,aE=Q(()=>{Te();Dd();at();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(Pd="jose/v6.2.8");Ld=Symbol();Md=Symbol();Ud=class{#e;#t;#r;#s;#i;#n;#a;#o;#c;#l;constructor(e,r){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");this.#e=new URL(e.href);let n=r??{};this.#t=typeof n.timeoutDuration=="number"?n.timeoutDuration:5e3,this.#r=typeof n.cooldownDuration=="number"?n.cooldownDuration:3e4,this.#s=typeof n.cacheMaxAge=="number"?n.cacheMaxAge:6e5,this.#a=new Headers(n.headers),Pd&&!this.#a.has("User-Agent")&&this.#a.set("User-Agent",Pd),this.#a.has("accept")||(this.#a.set("accept","application/json"),this.#a.append("accept","application/jwk-set+json")),this.#o=n[Ld];let i=n[Md];i!==void 0&&(this.#l=i,II(i,this.#s)&&(this.#i=this.#l.uat,this.#c=ko(this.#l.jwks)))}pendingFetch(){return!!this.#n}#u(e){return typeof this.#i=="number"&&Date.now()<this.#i+e}coolingDown(){return this.#u(this.#r)}fresh(){return this.#u(this.#s)}jwks(){return this.#c?.jwks()}async getKey(e,r){(!this.#c||!this.fresh())&&await this.reload();try{return await this.#c(e,r)}catch(n){if(n instanceof ui&&this.coolingDown()===!1)return await this.reload(),this.#c(e,r);throw n}}async reload(){this.#n&&TI()&&(this.#n=void 0),this.#n||=_I(this.#e.href,this.#a,AbortSignal.timeout(this.#t),this.#o).then(e=>{this.#c=ko(e),this.#l&&(this.#l.uat=Date.now(),this.#l.jwks=e),this.#i=Date.now()}).finally(()=>{this.#n=void 0}),await this.#n}}});var Jc,cE=Q(()=>{qt();Ut();rr();Te();os();Jc=class{#e;constructor(e={}){this.#e=new Nn(e)}encode(){let e=Ue(JSON.stringify({alg:"none"})),r=Ue(this.#e.data());return`${e}.${r}.`}setIssuer(e){return this.#e.iss=e,this}setSubject(e){return this.#e.sub=e,this}setAudience(e){return this.#e.aud=e,this}setJti(e){return this.#e.jti=e,this}setNotBefore(e){return this.#e.nbf=e,this}setExpirationTime(e){return this.#e.exp=e,this}setIssuedAt(e){return this.#e.iat=e,this}static decode(e,r){if(typeof e!="string")throw new We("Unsecured JWT must be a string");let{0:n,1:i,2:s,length:o}=e.split(".");if(o!==3||s!=="")throw new We("Invalid Unsecured JWT");let a;try{if(a=JSON.parse(An.decode(tr(n))),a.alg!=="none")throw new Error}catch{throw new We("Invalid Unsecured JWT")}return{payload:ss(a,ht(i,"payload",We),r),header:a}}}});async function Yc(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return Xh(t,e,r)}async function lE(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return Qh(t,e,r)}async function Co(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return Yh(t,e,r)}async function Mt(t,e,r){if(!_e(t))throw new TypeError("JWK must be an object");e??=t.alg;let n=r?.extractable??t.ext;if(t.kty!=="oct"&&!e)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');switch(t.kty){case"oct":if(typeof t.k!="string"||!t.k)throw new TypeError('missing "k" (Key Value) Parameter value');return tr(t.k);case"RSA":return nr(kn(e),{...t,alg:e,ext:n});case"AKP":{if(typeof t.alg!="string"||!t.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==void 0&&e!==t.alg)throw new TypeError("JWK alg and alg option value mismatch");return nr(kn(t.alg),{...t,ext:n})}case"EC":case"OKP":return nr(kn(e),{...t,alg:e,ext:n});default:throw new Ee('Unsupported "kty" (Key Type) Parameter value')}}var uE=Q(()=>{qt();Rd();Yi();Ro();Te();at()});function dE(t){let e;if(typeof t=="string"){let n=t.split(".");(n.length===3||n.length===5)&&([e]=n)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");let r="Invalid Token or Protected Header formatting";if(typeof e!="string"||!e)throw new TypeError(r);return Ji(e,TypeError,r)}var pE=Q(()=>{rr()});function fE(t){if(typeof t!="string")throw new We("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new We("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new We("Invalid JWT");if(!e)throw new We("JWTs must contain a payload");let n;try{n=tr(e)}catch{throw new We("Failed to base64url decode the payload")}let i;try{i=JSON.parse(An.decode(n))}catch{throw new We("Failed to parse the decoded payload as JSON")}if(!_e(i))throw new We("Invalid JWT Claims Set");return i}var mE=Q(()=>{qt();Ut();at();Te()});function xI(t){let e=t?.modulusLength??2048;if(typeof e!="number"||e<2048)throw new Ee("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function hE(t,e){let r=kn(t,On);r.secret&&hi(On);let n;if(r.resolve){let i=e?.crv??"P-256";switch(i){case"P-256":case"P-384":case"P-521":n={name:"ECDH",namedCurve:i};break;case"X25519":n={name:"X25519"};break;default:throw new Ee("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519")}}else{if(r.crv!==void 0&&e?.crv!==void 0&&e.crv!==r.crv)throw new Ee(`Invalid or unsupported crv option provided, the only supported value for ${t} is ${r.crv}`);n=r.kty[0]==="RSA"?{...r.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:xI(e)}:r.subtle}return crypto.subtle.generateKey(n,e?.extractable??!1,[...r.usages[1],...r.usages[0]])}var EE=Q(()=>{Te();Ro()});async function yE(t,e){let r,n,i;switch(t){case"HS256":case"HS384":case"HS512":r=parseInt(t.slice(-3),10),n={name:"HMAC",hash:`SHA-${r}`,length:r},i=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r=parseInt(t.slice(-3),10),crypto.getRandomValues(new Uint8Array(r>>3));case"A128KW":case"A192KW":case"A256KW":r=parseInt(t.slice(1,4),10),n={name:"AES-KW",length:r},i=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":r=parseInt(t.slice(1,4),10),n={name:"AES-GCM",length:r},i=["encrypt","decrypt"];break;default:hi(On)}return crypto.subtle.generateKey(n,e?.extractable??!1,i)}var gE=Q(()=>{Ro()});var vE={};cc(vE,{CompactEncrypt:()=>as,CompactSign:()=>ls,EmbeddedJWK:()=>nE,EncryptJWT:()=>Wc,FlattenedEncrypt:()=>Sn,FlattenedSign:()=>cs,GeneralEncrypt:()=>Fc,GeneralSign:()=>$c,SignJWT:()=>us,UnsecuredJWT:()=>Jc,base64url:()=>Ic,calculateJwkThumbprint:()=>kd,calculateJwkThumbprintUri:()=>tE,compactDecrypt:()=>gh,compactVerify:()=>kh,createLocalJWKSet:()=>ko,createRemoteJWKSet:()=>oE,cryptoRuntime:()=>bI,customFetch:()=>Ld,decodeJwt:()=>fE,decodeProtectedHeader:()=>dE,errors:()=>Yu,exportJWK:()=>zc,exportPKCS8:()=>eE,exportSPKI:()=>Zh,flattenedDecrypt:()=>Ah,flattenedVerify:()=>Dh,generalDecrypt:()=>_h,generalVerify:()=>Uh,generateKeyPair:()=>hE,generateSecret:()=>yE,importJWK:()=>Mt,importPKCS8:()=>Co,importSPKI:()=>Yc,importX509:()=>lE,jwksCache:()=>Md,jwtDecrypt:()=>Hh,jwtVerify:()=>Rn});var bI,Do=Q(()=>{vh();Th();Ih();Sh();Ch();Ph();Lh();Kh();Fh();_d();Hc();xd();Id();Vh();Bh();jh();rE();iE();Dd();aE();cE();Od();uE();pE();mE();Te();EE();gE();qt();bI="WebCryptoAPI"});var mv=me((_a,cu)=>{(function(t,e){"use strict";var r="",n="?",i="function",s="undefined",o="object",a="string",c="major",l="model",d="name",p="type",f="vendor",h="version",g="architecture",_="console",R="mobile",C="tablet",D="smarttv",F="wearable",J="embedded",q=500,B="Amazon",$="Apple",A="ASUS",I="BlackBerry",S="Browser",y="Chrome",x="Edge",N="Firefox",O="Google",w="Huawei",k="LG",P="Microsoft",L="Motorola",K="Opera",W="Samsung",Y="Sharp",ue="Sony",Oe="Xiaomi",He="Zebra",pe="Facebook",we="Chromium OS",ot="Mac OS",Ki=function(ve,ke){var de={};for(var Ke in ve)ke[Ke]&&ke[Ke].length%2===0?de[Ke]=ke[Ke].concat(ve[Ke]):de[Ke]=ve[Ke];return de},yn=function(ve){for(var ke={},de=0;de<ve.length;de++)ke[ve[de].toUpperCase()]=ve[de];return ke},Hi=function(ve,ke){return typeof ve===a?Tt(ke).indexOf(Tt(ve))!==-1:!1},Tt=function(ve){return ve.toLowerCase()},ni=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},_t=function(ve,ke){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof ke===s?ve:ve.substring(0,q)},Ye=function(ve,ke){for(var de=0,Ke,zr,Or,Re,ne,kr;de<ke.length&&!ne;){var Hu=ke[de],jm=ke[de+1];for(Ke=zr=0;Ke<Hu.length&&!ne&&Hu[Ke];)if(ne=Hu[Ke++].exec(ve),ne)for(Or=0;Or<jm.length;Or++)kr=ne[++zr],Re=jm[Or],typeof Re===o&&Re.length>0?Re.length===2?typeof Re[1]==i?this[Re[0]]=Re[1].call(this,kr):this[Re[0]]=Re[1]:Re.length===3?typeof Re[1]===i&&!(Re[1].exec&&Re[1].test)?this[Re[0]]=kr?Re[1].call(this,kr,Re[2]):e:this[Re[0]]=kr?kr.replace(Re[1],Re[2]):e:Re.length===4&&(this[Re[0]]=kr?Re[3].call(this,kr.replace(Re[1],Re[2])):e):this[Re]=kr||e;de+=2}},Me=function(ve,ke){for(var de in ke)if(typeof ke[de]===o&&ke[de].length>0){for(var Ke=0;Ke<ke[de].length;Ke++)if(Hi(ke[de][Ke],ve))return de===n?e:de}else if(Hi(ke[de],ve))return de===n?e:de;return ve},L_={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},Vm={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Bm={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[h,[d,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[h,[d,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[d,h],[/opios[\/ ]+([\w\.]+)/i],[h,[d,K+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[h,[d,K+" GX"]],[/\bopr\/([\w\.]+)/i],[h,[d,K]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[h,[d,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[d,h],[/\bddg\/([\w\.]+)/i],[h,[d,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[h,[d,"UC"+S]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[h,[d,"WeChat"]],[/konqueror\/([\w\.]+)/i],[h,[d,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[h,[d,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[h,[d,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[h,[d,"Smart Lenovo "+S]],[/(avast|avg)\/([\w\.]+)/i],[[d,/(.+)/,"$1 Secure "+S],h],[/\bfocus\/([\w\.]+)/i],[h,[d,N+" Focus"]],[/\bopt\/([\w\.]+)/i],[h,[d,K+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[h,[d,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[h,[d,"Dolphin"]],[/coast\/([\w\.]+)/i],[h,[d,K+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[h,[d,"MIUI "+S]],[/fxios\/([-\w\.]+)/i],[h,[d,N]],[/\bqihu|(qi?ho?o?|360)browser/i],[[d,"360 "+S]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[d,/(.+)/,"$1 "+S],h],[/samsungbrowser\/([\w\.]+)/i],[h,[d,W+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[d,/_/g," "],h],[/metasr[\/ ]?([\d\.]+)/i],[h,[d,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[d,"Sogou Mobile"],h],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[d,h],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[d],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[d,pe],h],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[d,h],[/\bgsa\/([\w\.]+) .*safari\//i],[h,[d,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[h,[d,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[h,[d,y+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[d,y+" WebView"],h],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[h,[d,"Android "+S]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[d,h],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[h,[d,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[h,d],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[d,[h,Me,L_]],[/(webkit|khtml)\/([\w\.]+)/i],[d,h],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[d,"Netscape"],h],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[h,[d,N+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[d,h],[/(cobalt)\/([\w\.]+)/i],[d,[h,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[g,"amd64"]],[/(ia32(?=;))/i],[[g,Tt]],[/((?:i[346]|x)86)[;\)]/i],[[g,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[g,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[g,"armhf"]],[/windows (ce|mobile); ppc;/i],[[g,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[g,/ower/,r,Tt]],[/(sun4\w)[;\)]/i],[[g,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[g,Tt]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[f,W],[p,C]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[f,W],[p,R]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[f,$],[p,R]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[f,$],[p,C]],[/(macintosh);/i],[l,[f,$]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[f,Y],[p,R]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[f,w],[p,C]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[f,w],[p,R]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,R]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,C]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[f,"OPPO"],[p,R]],[/\b(opd2\d{3}a?) bui/i],[l,[f,"OPPO"],[p,C]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[f,"Vivo"],[p,R]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[f,"Realme"],[p,R]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[f,L],[p,R]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[f,L],[p,C]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[f,k],[p,C]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[f,k],[p,R]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[f,"Lenovo"],[p,C]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[f,"Nokia"],[p,R]],[/(pixel c)\b/i],[l,[f,O],[p,C]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[f,O],[p,R]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[f,ue],[p,R]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[f,ue],[p,C]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[f,"OnePlus"],[p,R]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[f,B],[p,C]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[f,B],[p,R]],[/(playbook);[-\w\),; ]+(rim)/i],[l,f,[p,C]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[f,I],[p,R]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[f,A],[p,C]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[f,A],[p,R]],[/(nexus 9)/i],[l,[f,"HTC"],[p,C]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[f,[l,/_/g," "],[p,R]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[f,"Acer"],[p,C]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[f,"Meizu"],[p,R]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[f,"Ulefone"],[p,R]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[f,l,[p,R]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[f,l,[p,C]],[/(surface duo)/i],[l,[f,P],[p,C]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[f,"Fairphone"],[p,R]],[/(u304aa)/i],[l,[f,"AT&T"],[p,R]],[/\bsie-(\w*)/i],[l,[f,"Siemens"],[p,R]],[/\b(rct\w+) b/i],[l,[f,"RCA"],[p,C]],[/\b(venue[\d ]{2,7}) b/i],[l,[f,"Dell"],[p,C]],[/\b(q(?:mv|ta)\w+) b/i],[l,[f,"Verizon"],[p,C]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[f,"Barnes & Noble"],[p,C]],[/\b(tm\d{3}\w+) b/i],[l,[f,"NuVision"],[p,C]],[/\b(k88) b/i],[l,[f,"ZTE"],[p,C]],[/\b(nx\d{3}j) b/i],[l,[f,"ZTE"],[p,R]],[/\b(gen\d{3}) b.+49h/i],[l,[f,"Swiss"],[p,R]],[/\b(zur\d{3}) b/i],[l,[f,"Swiss"],[p,C]],[/\b((zeki)?tb.*\b) b/i],[l,[f,"Zeki"],[p,C]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[f,"Dragon Touch"],l,[p,C]],[/\b(ns-?\w{0,9}) b/i],[l,[f,"Insignia"],[p,C]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[f,"NextBook"],[p,C]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[f,"Voice"],l,[p,R]],[/\b(lvtel\-)?(v1[12]) b/i],[[f,"LvTel"],l,[p,R]],[/\b(ph-1) /i],[l,[f,"Essential"],[p,R]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[f,"Envizen"],[p,C]],[/\b(trio[-\w\. ]+) b/i],[l,[f,"MachSpeed"],[p,C]],[/\btu_(1491) b/i],[l,[f,"Rotor"],[p,C]],[/(shield[\w ]+) b/i],[l,[f,"Nvidia"],[p,C]],[/(sprint) (\w+)/i],[f,l,[p,R]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[f,P],[p,R]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[f,He],[p,C]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[f,He],[p,R]],[/smart-tv.+(samsung)/i],[f,[p,D]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[f,W],[p,D]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[f,k],[p,D]],[/(apple) ?tv/i],[f,[l,$+" TV"],[p,D]],[/crkey/i],[[l,y+"cast"],[f,O],[p,D]],[/droid.+aft(\w+)( bui|\))/i],[l,[f,B],[p,D]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[f,Y],[p,D]],[/(bravia[\w ]+)( bui|\))/i],[l,[f,ue],[p,D]],[/(mitv-\w{5}) bui/i],[l,[f,Oe],[p,D]],[/Hbbtv.*(technisat) (.*);/i],[f,l,[p,D]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[f,_t],[l,_t],[p,D]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,D]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[f,l,[p,_]],[/droid.+; (shield) bui/i],[l,[f,"Nvidia"],[p,_]],[/(playstation [345portablevi]+)/i],[l,[f,ue],[p,_]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[f,P],[p,_]],[/((pebble))app/i],[f,l,[p,F]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[f,$],[p,F]],[/droid.+; (glass) \d/i],[l,[f,O],[p,F]],[/droid.+; (wt63?0{2,3})\)/i],[l,[f,He],[p,F]],[/(quest( \d| pro)?)/i],[l,[f,pe],[p,F]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[f,[p,J]],[/(aeobc)\b/i],[l,[f,B],[p,J]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,R]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,C]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,C]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,R]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[f,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[h,[d,x+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[h,[d,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[d,h],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[h,d]],os:[[/microsoft (windows) (vista|xp)/i],[d,h],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[d,[h,Me,Vm]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[h,Me,Vm],[d,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[h,/_/g,"."],[d,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[d,ot],[h,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[h,d],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[d,h],[/\(bb(10);/i],[h,[d,I]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[h,[d,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[h,[d,N+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[h,[d,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[h,[d,"watchOS"]],[/crkey\/([\d\.]+)/i],[h,[d,y+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[d,we],h],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[d,h],[/(sunos) ?([\w\.\d]*)/i],[[d,"Solaris"],h],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[d,h]]},Qt=function(ve,ke){if(typeof ve===o&&(ke=ve,ve=e),!(this instanceof Qt))return new Qt(ve,ke).getResult();var de=typeof t!==s&&t.navigator?t.navigator:e,Ke=ve||(de&&de.userAgent?de.userAgent:r),zr=de&&de.userAgentData?de.userAgentData:e,Or=ke?Ki(Bm,ke):Bm,Re=de&&de.userAgent==Ke;return this.getBrowser=function(){var ne={};return ne[d]=e,ne[h]=e,Ye.call(ne,Ke,Or.browser),ne[c]=ni(ne[h]),Re&&de&&de.brave&&typeof de.brave.isBrave==i&&(ne[d]="Brave"),ne},this.getCPU=function(){var ne={};return ne[g]=e,Ye.call(ne,Ke,Or.cpu),ne},this.getDevice=function(){var ne={};return ne[f]=e,ne[l]=e,ne[p]=e,Ye.call(ne,Ke,Or.device),Re&&!ne[p]&&zr&&zr.mobile&&(ne[p]=R),Re&&ne[l]=="Macintosh"&&de&&typeof de.standalone!==s&&de.maxTouchPoints&&de.maxTouchPoints>2&&(ne[l]="iPad",ne[p]=C),ne},this.getEngine=function(){var ne={};return ne[d]=e,ne[h]=e,Ye.call(ne,Ke,Or.engine),ne},this.getOS=function(){var ne={};return ne[d]=e,ne[h]=e,Ye.call(ne,Ke,Or.os),Re&&!ne[d]&&zr&&zr.platform&&zr.platform!="Unknown"&&(ne[d]=zr.platform.replace(/chrome os/i,we).replace(/macos/i,ot)),ne},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return Ke},this.setUA=function(ne){return Ke=typeof ne===a&&ne.length>q?_t(ne,q):ne,this},this.setUA(Ke),this};Qt.BROWSER=yn([d,h,c]),Qt.CPU=yn([g]),Qt.DEVICE=yn([l,f,p,_,R,D,C,F,J]),Qt.ENGINE=Qt.OS=yn([d,h]),typeof _a!==s?(typeof cu!==s&&cu.exports&&(_a=cu.exports=Qt),_a.UAParser=Qt):typeof define===i&&define.amd?define(function(){return Qt}):typeof t!==s&&(t.UAParser=Qt);var Fi=typeof t!==s&&(t.jQuery||t.Zepto);if(Fi&&!Fi.ua){var ac=new Qt;Fi.ua=ac.getResult(),Fi.ua.get=function(){return ac.getUA()},Fi.ua.set=function(ve){ac.setUA(ve);var ke=ac.getResult();for(var de in ke)Fi.ua[de]=ke[de]}}})(typeof window=="object"?window:_a)});var uu=me((iZ,Iv)=>{"use strict";var Gw=/^xn--/,$w=/[^\0-\x7F]/,Ww=/[\x2E\u3002\uFF0E\uFF61]/g,zw={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},cf=35,Br=Math.floor,lf=String.fromCharCode;function Jn(t){throw new RangeError(zw[t])}function Jw(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function gv(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(Ww,".");let i=t.split("."),s=Jw(i,e).join(".");return n+s}function vv(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let s=t.charCodeAt(r++);(s&64512)==56320?e.push(((i&1023)<<10)+(s&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var Yw=t=>String.fromCodePoint(...t),Xw=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},yv=function(t,e){return t+22+75*(t<26)-((e!=0)<<5)},Av=function(t,e,r){let n=0;for(t=r?Br(t/700):t>>1,t+=Br(t/e);t>cf*26>>1;n+=36)t=Br(t/cf);return Br(n+(cf+1)*t/(t+38))},Tv=function(t){let e=[],r=t.length,n=0,i=128,s=72,o=t.lastIndexOf("-");o<0&&(o=0);for(let a=0;a<o;++a)t.charCodeAt(a)>=128&&Jn("not-basic"),e.push(t.charCodeAt(a));for(let a=o>0?o+1:0;a<r;){let c=n;for(let d=1,p=36;;p+=36){a>=r&&Jn("invalid-input");let f=Xw(t.charCodeAt(a++));f>=36&&Jn("invalid-input"),f>Br((2147483647-n)/d)&&Jn("overflow"),n+=f*d;let h=p<=s?1:p>=s+26?26:p-s;if(f<h)break;let g=36-h;d>Br(2147483647/g)&&Jn("overflow"),d*=g}let l=e.length+1;s=Av(n-c,l,c==0),Br(n/l)>2147483647-i&&Jn("overflow"),i+=Br(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},_v=function(t){let e=[];t=vv(t);let r=t.length,n=128,i=0,s=72;for(let c of t)c<128&&e.push(lf(c));let o=e.length,a=o;for(o&&e.push("-");a<r;){let c=2147483647;for(let d of t)d>=n&&d<c&&(c=d);let l=a+1;c-n>Br((2147483647-i)/l)&&Jn("overflow"),i+=(c-n)*l,n=c;for(let d of t)if(d<n&&++i>2147483647&&Jn("overflow"),d===n){let p=i;for(let f=36;;f+=36){let h=f<=s?1:f>=s+26?26:f-s;if(p<h)break;let g=p-h,_=36-h;e.push(lf(yv(h+g%_,0))),p=Br(g/_)}e.push(lf(yv(p,0))),s=Av(i,l,a===o),i=0,++a}++i,++n}return e.join("")},Qw=function(t){return gv(t,function(e){return Gw.test(e)?Tv(e.slice(4).toLowerCase()):e})},Zw=function(t){return gv(t,function(e){return $w.test(e)?"xn--"+_v(e):e})},eN={version:"2.3.1",ucs2:{decode:vv,encode:Yw},decode:Tv,encode:_v,toASCII:Zw,toUnicode:Qw};Iv.exports=eN});var Qs=me((sZ,df)=>{"use strict";var xa=re("url"),tN=uu(),du=typeof URL<"u"&&URL||xa.URL,rN=/^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)(.+)$/;function uf(t){try{return decodeURIComponent(t)}catch{return t}}function nN(t){let e=t||"";return e?e.charAt(0)==="["&&e.charAt(e.length-1)==="]"?e.slice(1,-1):tN.toASCII(uf(e)):""}df.exports.parse=(t,e)=>{if(t=t||"",!du)return xa.parse(t,e);let r=rN.exec(t),n=r?r[1]+"//"+r[2]:t,i;try{i=new du(n)}catch{return xa.parse(t,e)}let s=nN(i.hostname),o=i.port||null,a=i.pathname||null,c=i.search||null,l=null;(i.username||i.password)&&(l=uf(i.username)+(i.password?":"+uf(i.password):""));let d;return e?(d=Object.create(null),i.searchParams.forEach((p,f)=>{Object.prototype.hasOwnProperty.call(d,f)?Array.isArray(d[f])?d[f].push(p):d[f]=[d[f],p]:d[f]=p})):d=c?c.slice(1):null,{protocol:i.protocol||null,host:i.host||null,hostname:s,port:o,pathname:a,search:c,path:(a||"")+(c||"")||null,href:i.href,auth:l,query:d}};df.exports.resolve=(t,e)=>{if(!du)return xa.resolve(t,e);try{return new du(e,t).href}catch{return xa.resolve(t,e)}}});var wv=me((oZ,Sv)=>{"use strict";var xv=Qs(),bv=1800,pf=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=xv.parse(r||""),i=this.parse(e),s;return i.domain?(s=i.domain.replace(/^\./,""),(n.hostname.length<s.length||("."+n.hostname).substr(-s.length+1)!=="."+s)&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||bv)||bv)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={};return(e||"").toString().split(";").forEach(n=>{let i=n.split("="),s=i.shift().trim().toLowerCase(),o=i.join("=").trim(),a;if(s)switch(s){case"expires":o=new Date(o),o.toString()!=="Invalid Date"&&(r.expires=o);break;case"path":r.path=o;break;case"domain":a=o.toLowerCase(),a.length&&a.charAt(0)!=="."&&(a="."+a),r.domain=a;break;case"max-age":r.expires=new Date(Date.now()+(Number(o)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break;default:r.name||(r.name=s,r.value=o)}}),r}match(e,r){let n=xv.parse(r||"");return!(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain)||this.getPath(n.pathname).substr(0,e.path.length)!==e.path||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");return r.pop(),r=r.join("/").trim(),r.charAt(0)!=="/"&&(r="/"+r),r.substr(-1)!=="/"&&(r+="/"),r}};Sv.exports=pf});var xr=me((aZ,iN)=>{iN.exports={name:"nodemailer",version:"9.0.5",description:"Easy as cake e-mail sending from your Node.js applications",main:"lib/nodemailer.js",scripts:{test:"node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))","test:coverage":"c8 node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))",format:'prettier --write "**/*.{js,json,md}"',"format:check":'prettier --check "**/*.{js,json,md}"',lint:"eslint .","lint:fix":"eslint . --fix",update:"rm -rf node_modules/ package-lock.json && ncu -u && npm install","test:syntax":'docker run --rm -v "$PWD:/app:ro" -w /app node:6-alpine node test/syntax-compat.js'},repository:{type:"git",url:"https://github.com/nodemailer/nodemailer.git"},keywords:["Nodemailer"],author:"Andris Reinman",license:"MIT-0",bugs:{url:"https://github.com/nodemailer/nodemailer/issues"},homepage:"https://nodemailer.com/",devDependencies:{"@aws-sdk/client-sesv2":"3.1104.0",bunyan:"1.8.15",c8:"12.0.0",eslint:"10.8.0","eslint-config-prettier":"10.1.8",globals:"17.9.0",libbase64:"1.3.0",libmime:"5.4.1",libqp:"2.1.1",prettier:"3.9.6",proxy:"1.0.2","proxy-test-server":"1.0.0","smtp-server":"3.19.2"},engines:{node:">=6.0.0"}}});var Xt=me((cZ,ff)=>{"use strict";var Nv={ECONNECTION:"Connection closed unexpectedly",ETIMEDOUT:"Connection or operation timed out",ESOCKET:"Socket-level error",EDNS:"DNS resolution failed",ETLS:"TLS handshake or STARTTLS failed",EREQUIRETLS:"REQUIRETLS not supported by server (RFC 8689)",EPROTOCOL:"Invalid SMTP server response",EENVELOPE:"Invalid mail envelope (sender or recipients)",EMESSAGE:"Message delivery error",ESTREAM:"Stream processing error",EAUTH:"Authentication failed",ENOAUTH:"Authentication credentials not provided",EOAUTH2:"OAuth2 token generation or refresh error",EMAXLIMIT:"Pool resource limit reached (max messages per connection)",ESENDMAIL:"Sendmail command error",ESES:"AWS SES transport error",ECONFIG:"Invalid configuration",EPROXY:"Proxy connection error",EFILEACCESS:"File access rejected (disableFileAccess is set)",EURLACCESS:"URL access rejected (disableUrlAccess is set)",EFETCH:"HTTP fetch error"};ff.exports={ERROR_CODES:Nv};for(let t of Object.keys(Nv))ff.exports[t]=t});var ba=me((lZ,hf)=>{"use strict";var sN=re("http"),oN=re("https"),mf=Qs(),aN=re("zlib"),{PassThrough:cN}=re("stream"),Rv=wv(),lN=xr(),uN=re("net"),jr=Xt(),dN=5;hf.exports=function(t,e){return Ov(t,e)};hf.exports.Cookies=Rv;function Ov(t,e){e=e||{},e.fetchRes=e.fetchRes||new cN,e.cookies=e.cookies||new Rv,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?dN:e.maxRedirects,e.cookie&&([].concat(e.cookie||[]).forEach(f=>{e.cookies.set(f,t)}),e.cookie=!1);let r=e.fetchRes,n=mf.parse(t),i=(e.method||"").toString().trim().toUpperCase()||"GET",s=!1,o,a,c=n.protocol==="https:"?oN:sN,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+lN.version};if(Object.keys(e.headers||{}).forEach(f=>{l[f.toLowerCase().trim()]=e.headers[f]}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(o=e.cookies.get(t))&&(l.cookie=o),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",f=>{s||(s=!0,f.code=jr.EFETCH,f.sourceUrl=t,r.emit("error",f))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(f=>{let h=e.body[f].toString().trim();return encodeURIComponent(f)+"="+encodeURIComponent(h)}).join("&"))}catch(f){if(s)return;s=!0,f.code=jr.EFETCH,f.sourceUrl=t,r.emit("error",f);return}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let d,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!0,agent:!1};e.tls&&Object.assign(p,e.tls),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!uN.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{d=c.request(p)}catch(f){return s=!0,setImmediate(()=>{f.code=jr.EFETCH,f.sourceUrl=t,r.emit("error",f)}),r}return e.timeout&&d.setTimeout(e.timeout,()=>{if(s)return;s=!0,d.abort();let f=new Error("Request Timeout");f.code=jr.EFETCH,f.sourceUrl=t,r.emit("error",f)}),d.on("error",f=>{s||(s=!0,f.code=jr.EFETCH,f.sourceUrl=t,r.emit("error",f))}),d.on("response",f=>{let h;if(!s){switch(f.headers["content-encoding"]){case"gzip":case"deflate":h=aN.createUnzip();break}if(f.headers["set-cookie"]&&[].concat(f.headers["set-cookie"]||[]).forEach(g=>{e.cookies.set(g,t)}),[301,302,303,307,308].includes(f.statusCode)&&f.headers.location){if(e.redirects++,e.redirects>e.maxRedirects){s=!0;let D=new Error("Maximum redirect count exceeded");D.code=jr.EFETCH,D.sourceUrl=t,r.emit("error",D),d.abort();return}e.method="GET",e.body=!1;let g=mf.resolve(t,f.headers.location),_=mf.parse(g),R=_.hostname!==n.hostname,C=n.protocol==="https:"&&_.protocol==="http:";if(e.headers&&(R||C)){let D=["authorization","cookie","proxy-authorization"];Object.keys(e.headers).forEach(F=>{D.includes(F.toLowerCase())&&delete e.headers[F]})}return Ov(g,e)}if(r.statusCode=f.statusCode,r.headers=f.headers,f.statusCode>=300&&!e.allowErrorResponse){s=!0;let g=new Error("Invalid status code "+f.statusCode);g.code=jr.EFETCH,g.sourceUrl=t,r.emit("error",g),d.abort();return}f.on("error",g=>{s||(s=!0,g.code=jr.EFETCH,g.sourceUrl=t,r.emit("error",g),d.abort())}),h?(f.pipe(h).pipe(r),h.on("error",g=>{s||(s=!0,g.code=jr.EFETCH,g.sourceUrl=t,r.emit("error",g),d.abort())})):f.pipe(r)}}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(d);d.write(a)}catch(f){s=!0,f.code=jr.EFETCH,f.sourceUrl=t,r.emit("error",f);return}d.end()}),r}});var kt=me((uZ,pt)=>{"use strict";var pN=Qs(),fN=re("util"),mN=re("fs"),hN=ba(),kv=Xt(),qr=re("dns"),EN=re("net"),yN=re("os"),Sa=300*1e3,gN=30*1e3,Cv=1e3,pu=0;pt.exports._lastCacheCleanup=()=>pu;pt.exports._resetCacheCleanup=()=>{pu=0};var Pv;try{Pv=yN.networkInterfaces()}catch{}pt.exports.networkInterfaces=Pv;var Uv=(t,e)=>{let r=pt.exports.networkInterfaces;return r?Object.keys(r).map(n=>r[n]).reduce((n,i)=>n.concat(i),[]).filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},Dv=(t,e,r,n)=>{if(r=r||{},!Uv(t,r.allowInternalNetworkInterfaces))return n(null,[]);(qr.Resolver?new qr.Resolver(r):qr)["resolve"+t](e,(s,o)=>{if(s){switch(s.code){case qr.NODATA:case qr.NOTFOUND:case qr.NOTIMP:case qr.SERVFAIL:case qr.CONNREFUSED:case qr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(s)}return n(null,Array.isArray(o)?o:[].concat(o||[]))})},ur=pt.exports.dnsCache=new Map,Yn=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({servername:t.servername,host:n,_addresses:r},e||{})};pt.exports.resolveHostname=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||EN.isIP(t.host)){let a={addresses:[t.host],servername:t.servername||!1};return e(null,Yn(a,{cached:!1}))}let r;if(ur.has(t.host)){r=ur.get(t.host);let a=Date.now();if(a-pu>gN){pu=a;for(let[c,l]of ur.entries())l.expires&&l.expires<a&&ur.delete(c);if(ur.size>Cv){let c=Math.floor(Cv*.1);Array.from(ur.keys()).slice(0,c).forEach(d=>ur.delete(d))}}if(!r.expires||r.expires>=a)return e(null,Yn(r.value,{cached:!0}))}let n=[],i=[],s=null,o=null;Dv(4,t.host,t,(a,c)=>{a?s=a:n=c||[],Dv(6,t.host,t,(l,d)=>{l?o=l:i=d||[];let p=n.concat(i);if(p.length){let f={addresses:p,servername:t.servername||t.host};return ur.set(t.host,{value:f,expires:Date.now()+(t.dnsTtl||Sa)}),e(null,Yn(f,{cached:!1}))}if(s&&o&&r)return ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||Sa)}),e(null,Yn(r.value,{cached:!0,error:s}));try{qr.lookup(t.host,{all:!0},(f,h)=>{if(f)return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||Sa)}),e(null,Yn(r.value,{cached:!0,error:f}))):e(f);let g=h?h.filter(R=>Uv(R.family)).map(R=>R.address):[];if(h&&h.length&&!g.length&&console.warn(`Failed to resolve IPv${h[0].family} addresses with current network`),!g.length&&r)return e(null,Yn(r.value,{cached:!0}));let _={addresses:g.length?g:[t.host],servername:t.servername||t.host};return ur.set(t.host,{value:_,expires:Date.now()+(t.dnsTtl||Sa)}),e(null,Yn(_,{cached:!1}))})}catch(f){return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||Sa)}),e(null,Yn(r.value,{cached:!0,error:f}))):e(s||o||f)}})})};pt.exports.parseConnectionUrl=t=>{t=t||"";let e={},r=pN.parse(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}if(!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),r.auth){let n=r.auth.split(":");e.auth={user:n.shift(),pass:n.join(":")}}return Object.keys(r.query||{}).forEach(n=>{let i=e,s=n,o=r.query[n];switch(isNaN(o)||(o=Number(o)),o){case"true":o=!0;break;case"false":o=!1;break}if(n.indexOf("tls.")===0)s=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;s in i||(i[s]=o)}),e};pt.exports._logFunc=(t,e,r,n,i,...s)=>{let o=Object.assign({},r||{},n||{});delete o.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](o,i,...s)};pt.exports.getLogger=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(s=>{r[s]=()=>!1}),r;let i=t.logger===!0?AN(n):t.logger;return n.forEach(s=>{r[s]=(o,a,...c)=>{pt.exports._logFunc(i,s,e,o,a,...c)}}),r};pt.exports.callbackPromise=(t,e)=>function(){let r=Array.from(arguments),n=r.shift();n?e(n):t(...r)};pt.exports.parseDataURI=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,s=n.split(";");if(s.length>0){let l=s[s.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,s.pop())}let o=s.length>0?s.shift():"application/octet-stream",a={};for(let l=0;l<s.length;l++){let d=s[l],p=d.indexOf("=");if(p>0){let f=d.substring(0,p).trim(),h=d.substring(p+1).trim();f&&(a[f]=h)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:o||"application/octet-stream",params:a}};pt.exports.resolveContent=(t,e,r,n)=>{!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;return n||(i=new Promise((s,o)=>{n=pt.exports.callbackPromise(s,o)})),vN(t,e,r,n),i};function vN(t,e,r,n){let i=t&&t[e]&&t[e].content||t[e],s=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!i)return n(null,i);if(typeof i=="object"){if(typeof i.pipe=="function")return Ef(i,(o,a)=>{if(o)return n(o);t[e].content?t[e].content=a:t[e]=a,n(null,a)});if(/^https?:\/\//i.test(i.path||i.href))return r.disableUrlAccess?setImmediate(()=>{let o=new Error("Url access rejected for "+(i.path||i.href));o.code=kv.EURLACCESS,n(o)}):Ef(hN(i.path||i.href,{headers:i.httpHeaders,tls:i.tls}),n);if(/^data:/i.test(i.path||i.href)){let o=pt.exports.parseDataURI(i.path||i.href);return n(null,o&&o.data?o.data:Buffer.alloc(0))}else if(i.path)return r.disableFileAccess?setImmediate(()=>{let o=new Error("File access rejected for "+i.path);o.code=kv.EFILEACCESS,n(o)}):Ef(mN.createReadStream(i.path),n)}typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(s)&&(i=Buffer.from(t[e].content,s)),setImmediate(()=>n(null,i))}pt.exports.assign=function(){let t=Array.from(arguments),e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=Object.assign(e[n]||{},r[n]):e[n]=r[n]})}),e};pt.exports.encodeXText=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let s=e[n];s<33||s>126||s===43||s===61?r+="+"+(s<16?"0":"")+s.toString(16).toUpperCase():r+=String.fromCharCode(s)}return r};function Ef(t,e){let r=!1,n=[],i=0;t.on("error",s=>{r||(r=!0,e(s))}),t.on("readable",()=>{let s;for(;(s=t.read())!==null;)n.push(s),i+=s.length}),t.on("end",()=>{if(r)return;r=!0;let s;try{s=Buffer.concat(n,i)}catch(o){return e(o)}e(null,s)})}function AN(t){let e=t.reduce((s,o)=>Math.max(s,o.length),0),r=new Map;t.forEach(s=>{let o=s.toUpperCase();o.length<e&&(o+=" ".repeat(e-o.length)),r.set(s,o)});let n=(s,o,a,...c)=>{let l="";o&&(o.tnx==="server"?l="S: ":o.tnx==="client"&&(l="C: "),o.sid&&(l="["+o.sid+"] "+l),o.cid&&(l="[#"+o.cid+"] "+l)),a=fN.format(a,...c),a.split(/\r?\n/).forEach(d=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(s),l+d)})},i={};return t.forEach(s=>{i[s]=n.bind(null,s)}),i}});var yf=me((dZ,Hv)=>{"use strict";var TN=re("path"),Lv="application/octet-stream",_N="bin",Mv=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),Kv=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);Hv.exports={detectMimeType(t){if(!t)return Lv;let e=TN.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=Kv.has(r)?Kv.get(r):Lv;return Array.isArray(n)?n[0]:n},detectExtension(t){if(!t)return _N;let e=t.toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(Mv.has(r+"/"+n)){let i=Mv.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}}});var Tf=me((pZ,Fv)=>{"use strict";var{Transform:IN}=re("stream");function gf(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function vf(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=[],n=0,i=e*1024,s=new RegExp(".{"+e+"}","g");for(;n<t.length;){let o=t.substr(n,i).replace(s,`$&\r
-`).trim();r.push(o),n+=i}return r.join(`\r
-`).trim()}var Af=class extends IN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return setImmediate(n);this.inputBytes+=e.length,this._remainingBytes&&this._remainingBytes.length&&(e=Buffer.concat([this._remainingBytes,e],this._remainingBytes.length+e.length),this._remainingBytes=!1),e.length%3?(this._remainingBytes=e.slice(e.length-e.length%3),e=e.slice(0,e.length-e.length%3)):this._remainingBytes=!1;let i=this._curLine+gf(e);if(this.options.lineLength){i=vf(i,this.options.lineLength);let s=i.lastIndexOf(`
-`);s<0?(this._curLine=i,i=""):s===i.length-1?this._curLine="":(this._curLine=i.substring(s+1),i=i.substring(0,s+1))}i&&(this.outputBytes+=i.length,this.push(Buffer.from(i,"ascii"))),setImmediate(n)}_flush(e){this._remainingBytes&&this._remainingBytes.length&&(this._curLine+=gf(this._remainingBytes)),this._curLine&&(this._curLine=vf(this._curLine,this.options.lineLength),this.outputBytes+=this._curLine.length,this.push(Buffer.from(this._curLine,"ascii")),this._curLine=""),e()}};Fv.exports={encode:gf,wrap:vf,Encoder:Af}});var xf=me((fZ,Bv)=>{"use strict";var{Transform:xN}=re("stream"),bN=[[9],[10],[13],[32,60],[62,126]];function _f(t){typeof t=="string"&&(t=Buffer.from(t,"utf-8"));let e="",r;for(let n=0,i=t.length;n<i;n++){if(r=t[n],SN(r,bN)&&!((r===32||r===9)&&(n===i-1||t[n+1]===10||t[n+1]===13))){e+=String.fromCharCode(r);continue}e+="="+(r<16?"0":"")+r.toString(16).toUpperCase()}return e}function Vv(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=0,n=t.length,i,s,o,a=Math.floor(e/3),c="";for(;r<n;){if(o=t.substr(r,e),i=o.match(/\r\n/)){o=o.substr(0,i.index+i[0].length),c+=o,r+=o.length;continue}if(o.substr(-1)===`
-`){c+=o,r+=o.length;continue}if(i=o.substr(-a).match(/\n.*?$/)){o=o.substr(0,o.length-(i[0].length-1)),c+=o,r+=o.length;continue}if(o.length>e-a&&(i=o.substr(-a).match(/[ \t.,!?][^ \t.,!?]*$/)))o=o.substr(0,o.length-(i[0].length-1));else if(o.match(/[=][\da-f]{0,2}$/i))for((i=o.match(/[=][\da-f]{0,1}$/i))&&(o=o.substr(0,o.length-i[0].length));o.length>3&&o.length<n-r&&!o.match(/^(?:=[\da-f]{2}){1,4}$/i)&&(i=o.match(/[=][\da-f]{2}$/gi))&&(s=parseInt(i[0].substr(1,2),16),!(s<128||(o=o.substr(0,o.length-3),s>=192))););r+o.length<n&&o.substr(-1)!==`
-`?(o.length===e&&o.match(/[=][\da-f]{2}$/i)?o=o.substr(0,o.length-3):o.length===e&&(o=o.substr(0,o.length-1)),r+=o.length,o+=`=\r
-`):r+=o.length,c+=o}return c}function SN(t,e){for(let r=e.length-1;r>=0;r--){let n=e[r];if(n.length&&(n.length===1&&t===n[0]||n.length===2&&t>=n[0]&&t<=n[1]))return!0}return!1}var If=class extends xN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){let i;if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return n();this.inputBytes+=e.length,this.options.lineLength?(i=this._curLine+_f(e),i=Vv(i,this.options.lineLength),i=i.replace(/(^|\n)([^\n]*)$/,(s,o,a)=>(this._curLine=a,o)),i&&(this.outputBytes+=i.length,this.push(i))):(i=_f(e),this.outputBytes+=i.length,this.push(i,"ascii")),n()}_flush(e){this._curLine&&(this.outputBytes+=this._curLine.length,this.push(this._curLine,"ascii")),e()}};Bv.exports={encode:_f,wrap:Vv,Encoder:If}});var Na=me((mZ,qv)=>{"use strict";var wa=Tf(),wN=xf(),jv=yf();qv.exports={isPlainText(t,e){return typeof t=="string"&&!(e?/[\x00-\x1f\x7f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)},quoteString(t){return'"'+(t||"").toString().replace(/["\\]/g,"\\$&")+'"'},hasLongerLines(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)},encodeWord(t,e,r){e=(e||"Q").toString().toUpperCase().trim().charAt(0),r=r||0;let n,i="UTF-8";if(r&&r>7+i.length&&(r-=7+i.length),e==="Q"?n=wN.encode(t).replace(/[^a-z0-9!*+\-/=]/gi,s=>{let o=s.charCodeAt(0).toString(16).toUpperCase();return s===" "?"_":"="+(o.length===1?"0"+o:o)}):e==="B"&&(n=typeof t=="string"?t:wa.encode(t),r=r?Math.max(3,(r-r%4)/4*3):0),r&&(e!=="B"?n:wa.encode(t)).length>r)if(e==="Q")n=this.splitMimeEncodedString(n,r).join("?= =?"+i+"?"+e+"?");else{let s=[],o="";for(let a=0,c=n.length;a<c;a++){let l=n.charAt(a);/[\ud800-\udbff]/.test(l)&&/[\udc00-\udfff]/.test(n.charAt(a+1))&&(l+=n.charAt(++a)),Buffer.byteLength(o+l)<=r||a===0?o+=l:(s.push(wa.encode(o)),o=l)}o&&s.push(wa.encode(o)),s.length>1?n=s.join("?= =?"+i+"?"+e+"?"):n=s.join("")}else e==="B"&&(n=wa.encode(t));return"=?"+i+"?"+e+"?"+n+(n.substr(-2)==="?="?"":"?=")},encodeWords(t,e,r,n){r=r||0;let i=t.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);if(!i)return t;if(n)return this.encodeWord(t,e,r);let s=t.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);if(!s)return t;let o=i.index+(i[0].match(/[^\s]/)||{index:0}).index,a=s.index+(s[1]||"").length;return(o?t.substr(0,o):"")+this.encodeWord(t.substring(o,a),e||"Q",r)+(a<t.length?t.substr(a):"")},buildHeaderValue(t){let e=[];return Object.keys(t.params||{}).forEach(n=>{let i=t.params[n],s=n.replace(/[\x00-\x1f\x7f]/g,"");!this.isPlainText(i,!0)||i.length>=75?this.buildHeaderParam(s,i,50).forEach(o=>{!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(o.value)||o.key.substr(-1)==="*"?e.push(o.key+"="+o.value):e.push(o.key+"="+JSON.stringify(o.value))}):/[\s'"\\;:/=(),<>@[\]?]|^-/.test(i)?e.push(s+"="+JSON.stringify(i)):e.push(s+"="+i)}),(typeof t.value=="string"?t.value.replace(/[\x00-\x1f\x7f]/g,""):t.value)+(e.length?"; "+e.join("; "):"")},buildHeaderParam(t,e,r){let n=[],i=typeof e=="string"?e:(e||"").toString(),s,o,a=0,c,l;if(r=r||50,this.isPlainText(e,!0)){if(i.length<=r)return[{key:t,value:i}];i=i.replace(new RegExp(".{"+r+"}","g"),d=>(n.push({line:d}),"")),i&&n.push({line:i})}else{if(/[\uD800-\uDBFF]/.test(i)){let p=[];for(c=0,l=i.length;c<l;c++)s=i.charAt(c),/[\ud800-\udbff]/.test(s)&&/[\udc00-\udfff]/.test(i.charAt(c+1))?(s+=i.charAt(c+1),p.push(s),c++):p.push(s);i=p}o="utf-8''";let d=!0;for(a=0,c=0,l=i.length;c<l;c++){if(s=i[c],d)s=this.safeEncodeURIComponent(s);else if(s=s===" "?s:this.safeEncodeURIComponent(s),s!==i[c])if((this.safeEncodeURIComponent(o)+s).length>=r)n.push({line:o,encoded:d}),o="",d=!0;else{d=!0,c=a,o="";continue}(o+s).length>=r?(n.push({line:o,encoded:d}),o=s=i[c]===" "?" ":this.safeEncodeURIComponent(i[c]),s===i[c]?(d=!1,a=c-1):d=!0):o+=s}o&&n.push({line:o,encoded:d})}return n.map((d,p)=>({key:t+"*"+p+(d.encoded?"*":""),value:d.line}))},parseHeaderValue(t){let e={value:!1,params:{}},r=!1,n="",i="value",s=!1,o=!1,a;for(let c=0,l=t.length;c<l;c++)if(a=t.charAt(c),i==="key"){if(a==="="){r=n.trim().toLowerCase(),i="value",n="";continue}n+=a}else{if(o)n+=a;else if(a==="\\"){o=!0;continue}else s&&a===s?s=!1:!s&&a==='"'?s=a:!s&&a===";"?(r===!1?e.value=n.trim():e.params[r]=n.trim(),i="key",n=""):n+=a;o=!1}return i==="value"?r===!1?e.value=n.trim():e.params[r]=n.trim():n.trim()&&(e.params[n.trim().toLowerCase()]=""),Object.keys(e.params).forEach(c=>{let l,d,p,f;(p=c.match(/(\*(\d+)|\*(\d+)\*|\*)$/))&&(l=c.substr(0,p.index),d=Number(p[2]||p[3])||0,(!e.params[l]||typeof e.params[l]!="object")&&(e.params[l]={charset:!1,values:[]}),f=e.params[c],d===0&&p[0].substr(-1)==="*"&&(p=f.match(/^([^']*)'[^']*'(.*)$/))&&(e.params[l].charset=p[1]||"iso-8859-1",f=p[2]),e.params[l].values[d]=f,delete e.params[c])}),Object.keys(e.params).forEach(c=>{let l;e.params[c]&&Array.isArray(e.params[c].values)&&(l=e.params[c].values.map(d=>d||"").join(""),e.params[c].charset?e.params[c]="=?"+e.params[c].charset+"?Q?"+l.replace(/[=?_\s]/g,d=>{let p=d.charCodeAt(0).toString(16);return d===" "?"_":"%"+(p.length<2?"0":"")+p}).replace(/%/g,"=")+"?=":e.params[c]=l)}),e},detectExtension:t=>jv.detectExtension(t),detectMimeType:t=>jv.detectMimeType(t),foldLines(t,e,r){t=(t||"").toString(),e=e||76;let n=0,i=t.length,s="",o,a;for(;n<i;){if(o=t.substr(n,e),o.length<e){s+=o;break}if(a=o.match(/^[^\n\r]*(\r?\n|\r)/)){o=a[0],s+=o,n+=o.length;continue}else(a=o.match(/(\s+)[^\s]*$/))&&a[0].length-(r?(a[1]||"").length:0)<o.length?o=o.substr(0,o.length-(a[0].length-(r?(a[1]||"").length:0))):(a=t.substr(n+o.length).match(/^[^\s]+(\s*)/))&&(o=o+a[0].substr(0,a[0].length-(r?0:(a[1]||"").length)));s+=o,n+=o.length,n<i&&(s+=`\r
-`)}return s},splitMimeEncodedString:(t,e)=>{let r=[],n,i,s,o;for(e=Math.max(e||0,12);t.length;){for(n=t.substr(0,e),(i=n.match(/[=][0-9A-F]?$/i))&&(n=n.substr(0,i.index)),o=!1;!o;)o=!0,(i=t.substr(n.length).match(/^[=]([0-9A-F]{2})/i))&&(s=parseInt(i[1],16),s<194&&s>127&&(n=n.substr(0,n.length-3),o=!1));n.length&&r.push(n),t=t.substr(n.length)}return r},encodeURICharComponent:t=>{let e="",r=t.charCodeAt(0).toString(16).toUpperCase();if(r.length%2&&(r="0"+r),r.length>2)for(let n=0,i=r.length/2;n<i;n++)e+="%"+r.substr(n,2);else e+="%"+r;return e},safeEncodeURIComponent(t){t=(t||"").toString();try{t=encodeURIComponent(t)}catch{t=encodeURIComponent(Buffer.from(t,"utf-8").toString("utf-8"))}return t.replace(/[\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]/g,e=>this.encodeURICharComponent(e))}}});var Wv=me((hZ,$v)=>{"use strict";function NN(t){let e=t.lastIndexOf("@");if(e<0)return t;let r=t.substr(0,e);return/^[^\s"(),:;<>@[\\\]]+$/.test(r)||/^"(?:[^"\\]|\\[\s\S])*"$/.test(r)?t:'"'+r.replace(/["\\]/g,"\\$&")+'"@'+t.substr(e+1)}function RN(t,e){let r=!1,n="text",i=[],s={address:[],comment:[],group:[],text:[],textWasQuoted:[]},o=!1;for(let a=0,c=t.length;a<c;a++){let l=t[a],d=a?t[a-1]:null;if(l.type==="operator")switch(l.value){case"<":n="address",o=!1;break;case"(":n="comment",o=!1;break;case":":n="group",r=!0,o=!1;break;case'"':o=!o,n="text";break;default:n="text",o=!1;break}else l.value&&(n==="address"&&(l.value=l.value.replace(/^[^<]*<\s*/,"")),d&&d.noBreak&&s[n].length?(s[n][s[n].length-1]+=l.value,n==="text"&&o&&(s.textWasQuoted[s.textWasQuoted.length-1]=!0)):(s[n].push(l.value),n==="text"&&s.textWasQuoted.push(o)))}if(!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),r){s.text=s.text.join(" ");let a=[];s.group.length&&Gv(s.group.join(","),{_depth:e+1}).forEach(l=>{l.group?a=a.concat(l.group):a.push(l)}),i.push({name:s.text||"",group:a})}else{if(!s.address.length&&s.text.length){for(let l=s.text.length-1;l>=0;l--)if(!s.textWasQuoted[l]&&/^[^@\s]+@[^@\s]+$/.test(s.text[l])){s.address=s.text.splice(l,1),s.textWasQuoted.splice(l,1);break}if(!s.address.length){let l=!1;for(let d=s.text.length-1;d>=0&&!(!s.textWasQuoted[d]&&(s.text[d]=s.text[d].replace(/\s*\b[^@\s]+@[^\s]+\b\s*/,p=>l?p:(s.address=[p.trim()],l=!0," ")).trim(),l));d--);}}!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),s.address.length>1&&(s.text=s.text.concat(s.address.splice(1)));let a=!s.address.length&&s.textWasQuoted.some(l=>l);s.text=s.text.join(" "),s.address=s.address.join(" ");let c={address:s.address||s.text||"",name:s.text||s.address||""};c.address===c.name&&(/@/.test(c.address||"")?c.name="":c.address=""),a&&c.address&&(c.address=NN(c.address)),i.push(c)}return i}var bf=class{constructor(e){this.str=(e||"").toString(),this.operatorCurrent="",this.operatorExpecting="",this.node=null,this.escaped=!1,this.inDomainLiteral=!1,this.list=[],this.operators={'"':'"',"(":")","<":">",",":"",":":";",";":""}}tokenize(){let e=[];for(let r=0,n=this.str.length;r<n;r++){let i=this.str.charAt(r),s=r<n-1?this.str.charAt(r+1):null;this.checkChar(i,s)}return this.list.forEach(r=>{r.value=(r.value||"").toString().trim(),r.value&&e.push(r)}),e}checkChar(e,r){if(!this.escaped&&!this.operatorExpecting&&(!this.inDomainLiteral&&e==="["?this.inDomainLiteral=!0:this.inDomainLiteral&&(e==="]"||e===","||e===";")&&(this.inDomainLiteral=!1)),!this.escaped){if(e===this.operatorExpecting){this.node={type:"operator",value:e},r&&![" ","	","\r",`
-`,",",";"].includes(r)&&(this.node.noBreak=!0),this.list.push(this.node),this.node=null,this.operatorExpecting="",this.escaped=!1;return}else if(!this.operatorExpecting&&!this.inDomainLiteral&&e in this.operators){this.node={type:"operator",value:e},this.list.push(this.node),this.node=null,this.operatorExpecting=this.operators[e],this.escaped=!1;return}else if(['"',"'"].includes(this.operatorExpecting)&&e==="\\"){this.escaped=!0;return}}this.node||(this.node={type:"text",value:""},this.list.push(this.node)),e===`
-`&&(e=" "),(e.charCodeAt(0)>=33||[" ","	"].includes(e))&&(this.node.value+=e),this.escaped=!1}},ON=50;function Gv(t,e){e=e||{};let r=e._depth||0;if(r>ON)return[];let i=new bf(t).tokenize(),s=[],o=[],a=[];i.forEach(c=>{c.type==="operator"&&(c.value===","||c.value===";")?(o.length&&s.push(o),o=[]):o.push(c)}),o.length&&s.push(o),s.forEach(c=>{let l=RN(c,r);l.length&&(a=a.concat(l))});for(let c=a.length-2;c>=0;c--){let l=a[c],d=a[c+1];l.address===""&&l.name&&!l.group&&d.address&&d.name&&(d.name=l.name+", "+d.name,a.splice(c,1))}if(e.flatten){let c=[],l=d=>{d.forEach(p=>{if(p.group)return l(p.group);c.push(p)})};return l(a),c}return a}$v.exports=Gv});var Jv=me((EZ,zv)=>{"use strict";var{Transform:kN}=re("stream"),Sf=class extends kN{constructor(){super(),this.lastByte=!1}_transform(e,r,n){e.length&&(this.lastByte=e[e.length-1]),this.push(e),n()}_flush(e){return this.lastByte===10?e():this.lastByte===13?(this.push(Buffer.from(`
+-----END ${e}-----`},hE=async(t,e,r)=>{if(Ms(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!Br(r))throw new TypeError(Er(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return hI(Kc(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},EE=t=>hE("public","spki",t),yE=t=>hE("private","pkcs8",t),Qs=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},gE=t=>({data:t,pos:0}),sp=t=>{let e=t.data[t.pos++];if(e===void 0)throw new Error("Unexpected end of ASN.1 input");return e},ln=t=>{let e=sp(t);if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|sp(t);return n}return e},mE=(t,e=1)=>{for(;e-- >0;){t.pos++;let r=ln(t);t.pos+=r}},$n=(t,e,r)=>{if(sp(t)!==e)throw new Error(r)},vE=(t,e)=>{if(e<0||t.pos+e>t.data.length)throw new Error("Unexpected end of ASN.1 input");let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},EI=t=>{$n(t,6,"Expected algorithm OID");let e=ln(t);return vE(t,e)};gI=t=>{let e=EI(t);if(Qs(e,[43,101,110]))return"X25519";if(!Qs(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");$n(t,6,"Expected curve OID");let r=ln(t),n=vE(t,r);if(Qs(n,[42,134,72,206,61,3,1,7]))return"P-256";if(Qs(n,[43,129,4,0,34]))return"P-384";if(Qs(n,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},ap=async(t,e,r,n)=>{let i=Hn(n?.extractable),o=Ni(r,Gn);o.secret&&wi(Gn);let s=t==="spki",a;if(o.resolve)try{let c=gE(e);yI(c,t),a=o.resolve({crv:gI(c)})}catch{throw new Te("Invalid or unsupported key format")}else a=o.subtle;return crypto.subtle.importKey(t,e,a,i??s,o.usages[s?0:1])},cp=(t,e)=>Hc(t.replace(e,"")),AE=(t,e,r)=>{let n=cp(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return ap("pkcs8",n,e,r)},TE=(t,e,r)=>{let n=cp(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);return ap("spki",n,e,r)};_E=(t,e,r)=>{let n;try{let i=cp(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);n=vI(i)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return ap("spki",n,e,r)}});function IE(t){return EE(t)}function xE(t){return yE(t)}async function Il(t){if(Ms(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:De(t)};if(!Br(t))throw new TypeError(Er(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let e=await crypto.subtle.exportKey("jwk",t);delete e.ext,delete e.key_ops,delete e.use,e.kty!=="AKP"&&delete e.alg;for(let r of Object.keys(e))e[r]===void 0&&delete e[r];return e}var up=ne(()=>{lp();Ct();zt()});async function dp(t,e){let r;if(he(t)){if(r=Eo(t),typeof r.kty!="string")throw new TypeError(Er(t,"CryptoKey","KeyObject","JSON Web Key"))}else if(Hd(t))r=Eo(await Il(t));else throw new TypeError(Er(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":un(r.alg,'"alg" (Algorithm) Parameter'),un(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":un(r.crv,'"crv" (Curve) Parameter'),un(r.x,'"x" (X Coordinate) Parameter'),un(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":un(r.crv,'"crv" (Subtype of Key Pair) Parameter'),un(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":un(r.e,'"e" (Exponent) Parameter'),un(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":if(typeof r.k!="string")throw new uo('"k" (Key Value) Parameter missing or invalid');n={k:r.k,kty:r.kty};break;default:throw new Te('"kty" (Key Type) Parameter missing or unsupported')}let i=Et(JSON.stringify(n));return De(await Fc(e,i))}async function bE(t,e){e??="sha256";let r=await dp(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var un,SE=ne(()=>{Ft();zt();Ie();Ct();Pe();up();un=(t,e)=>{if(typeof t!="string"||!t)throw new uo(`${e} missing or invalid`)}});async function wE(t,e){let r={...t,...e?.header};if(!he(r.jwk))throw new ee('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n;try{n=Ks(r.jwk)}catch(s){throw new ee("Invalid Embedded JWK",{cause:s})}let i=To(r.alg);if(n.use!==void 0&&n.use!=="sig")throw new ee('Invalid Embedded JWK, its "use" must be "sig" when present');if(n.alg!==void 0&&n.alg!==i.alg)throw new ee(`Invalid Embedded JWK, its "alg" must be "${i.alg}" when present`);let o=await jr(i,n,!0);if(o.type!=="public")throw new ee('"jwk" (JSON Web Key) Header Parameter must be a public key');return o}var NE=ne(()=>{Ct();_o();Pe();Ie()});function AI(t,e,r,n){let{kty:i,key_ops:o,ext:s,kid:a,alg:c,use:l,crv:u}=t;return(s===void 0||typeof s=="boolean")&&(o===void 0||Array.isArray(o)&&o.every((p,f)=>typeof p=="string"&&o.indexOf(p)===f)&&o.includes("verify"))&&e.kty.includes(i)&&(n===void 0||typeof n=="string"&&n===a)&&(c===void 0?i!=="AKP":r===c)&&(l===void 0||l==="sig")&&(!e.crv||u===e.crv)}async function RE(t,e,r){let n=t.get(e)||t.set(e,{}).get(e),{alg:i}=r;if(n[i]===void 0){let o=jr(r,e,!0).then(s=>{if(s.type!=="public")throw new po("JSON Web Key Set members must be public keys");return n[i]=s,s}).catch(s=>{throw n[i]===o&&delete n[i],s});n[i]=o}return n[i]}function Zs(t){let e;try{e=structuredClone(t)}catch{}if(!Bc(e))throw new po("JSON Web Key Set malformed");let r=e.keys.map(i=>{let o=Eo(i);return Array.isArray(o.key_ops)&&(o.key_ops=[...o.key_ops]),o}),n=new WeakMap;return Object.defineProperty(async(i,o)=>{let{alg:s,kid:a}={...i,...o?.header},c=typeof s=="string"?$s[s]:void 0;if(!c||c.secret)throw new Te('Unsupported "alg" value for a JSON Web Key Set');let l=e.keys.filter((f,m)=>AI(r[m],c,s,a)),{0:u,length:p}=l;if(!p)throw new _i;if(p!==1){let f=new Ps;throw f[Symbol.asyncIterator]=async function*(){for(let m of l)try{yield await RE(n,m,c)}catch{}},f}return RE(n,u,c)},"jwks",{value:()=>structuredClone(e)})}var pp=ne(()=>{Ct();_o();Ie();Pe()});function TI(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function _I(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(o=>{throw o.name==="TimeoutError"?new Us:o});if(i.status!==200)throw new nt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new nt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function ea(t,e){return Number.isFinite(t)&&Date.now()<t+e}function OE(t,e,r){if(Number.isNaN(t))throw new TypeError(`"${r}" option must not be NaN`);return typeof t=="number"?t:e}function kE(t,e){if(!(t instanceof URL))throw new TypeError("url must be an instance of URL");let r=new URL(t.href).href,n=e??{},i=n.timeoutDuration;if(typeof i=="number"&&(!Number.isInteger(i)||i<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');let o=typeof i=="number"?i:5e3,s=OE(n.cooldownDuration,3e4,"cooldownDuration"),a=OE(n.cacheMaxAge,6e5,"cacheMaxAge"),c=new Headers(n.headers);fp&&!c.has("User-Agent")&&c.set("User-Agent",fp),c.has("accept")||c.set("accept","application/json, application/jwk-set+json");let l=n[mp],u=n[hp],p,f,m=0,E=0,v;if(u&&typeof u=="object"){let{uat:S,jwks:R}=u;ea(S,a)&&Bc(R)&&(p=S,v=Zs(R))}let N=async()=>{if(f&&TI()&&(f=void 0),!f){let S=++m,R=f=_I(r,c,AbortSignal.timeout(o),l).then(M=>{let K=Zs(M);if(S<=E)return;v=K;let B=Date.now();u&&(u.uat=B,u.jwks=M),p=B,E=S}).finally(()=>{f===R&&(f=void 0)})}await f};return Object.defineProperties(async(S,R)=>{(!v||!ea(p,a))&&await N();try{return await v(S,R)}catch(M){if(M instanceof _i&&!ea(p,s))return await N(),v(S,R);throw M}},{coolingDown:{get:()=>ea(p,s),enumerable:!0},fresh:{get:()=>ea(p,a),enumerable:!0},reload:{value:N,enumerable:!0},reloading:{get:()=>!!f,enumerable:!0},jwks:{value:()=>v?.jwks(),enumerable:!0}})}var fp,mp,hp,CE=ne(()=>{Ie();pp();Pe();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(fp="jose/v6.2.12");mp=Symbol();hp=Symbol()});var II,xl,DE=ne(()=>{zt();Pe();Ie();wo();II=Bn,xl=class extends II{encode(){let e=De(JSON.stringify({alg:"none"})),r=De(So(this));return`${e}.${r}.`}static decode(e,r){if(typeof e!="string")throw new je("Unsecured JWT must be a string");let{0:n,1:i,2:o,length:s}=e.split(".");if(s!==3||o!=="")throw new je("Invalid Unsecured JWT");let a,c;try{a=Kn(n,ee,"JWS Protected Header is invalid");let l=Vr(ee,fo,void 0,a,a);c=mo(a,l)}catch(l){throw l instanceof ee?new je("Invalid Unsecured JWT",{cause:l}):l}if(a.alg!=="none")throw new je("Invalid Unsecured JWT");if(!c)throw new je("JWTs MUST NOT use unencoded payload");return{payload:bo(a,xt(i,"payload",je),r),header:a}}}});async function bl(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return TE(t,e,r)}async function PE(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return _E(t,e,r)}async function ta(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return AE(t,e,r)}async function Vt(t,e,r){if(!he(t))throw new TypeError("JWK must be an object");let n=Ks(t),i=Hn(r?.extractable),{alg:o}=n;if(e??=o,n.kty!=="oct"&&!e)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');switch(n.kty){case"oct":if(typeof n.k!="string")throw new TypeError('missing "k" (Key Value) Parameter value');return Fr(n.k);case"AKP":{if(typeof o!="string"||!o)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==o)throw new TypeError("JWK alg and alg option value mismatch");return jr(Ni(e),n,i)}case"RSA":case"EC":case"OKP":return jr(Ni(e),n,i);default:throw new Te('Unsupported "kty" (Key Type) Parameter value')}}var UE=ne(()=>{zt();lp();Ct();Xs();Ie();Pe()});function LE(t){let e;if(typeof t=="string"){let n=t.split(".");(n.length===3||n.length===5)&&([e]=n)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");let r="Invalid Token or Protected Header formatting";if(typeof e!="string"||!e)throw new TypeError(r);return Kn(e,TypeError,r)}var ME=ne(()=>{Pe()});function KE(t){if(typeof t!="string")throw new je("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new je("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new je("Invalid JWT");if(!e)throw new je("JWTs must contain a payload");let n;try{n=Fr(e)}catch{throw new je("Failed to base64url decode the payload")}let i;try{i=JSON.parse(co.decode(n))}catch{throw new je("Failed to parse the decoded payload as JSON")}if(!he(i))throw new je("Invalid JWT Claims Set");return i}var HE=ne(()=>{zt();Ft();Pe();Ie()});function xI(t){let e=t?.modulusLength??2048;if(typeof e!="number"||!Number.isInteger(e)||e<2048)throw new Te("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function FE(t,e){let r=Hn(e?.extractable),n=Ni(t,Gn);n.secret&&wi(Gn);let i;if(n.resolve){let o=e?.crv??"P-256";if(!["P-256","P-384","P-521","X25519"].includes(o))throw new Te("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");i=n.resolve({crv:o})}else{if(n.crv!==void 0&&e?.crv!==void 0&&e.crv!==n.crv)throw new Te(`Invalid or unsupported crv option provided, the only supported value for ${t} is ${n.crv}`);i=n.kty[0]==="RSA"?{...n.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:xI(e)}:n.subtle}return crypto.subtle.generateKey(i,r??!1,[...n.usages[1],...n.usages[0]])}var VE=ne(()=>{Ie();Ct();Xs()});async function BE(t,e){let r=Hn(e?.extractable),n,i,o;switch(t){case"HS256":case"HS384":case"HS512":n=+t.slice(-3),i={name:"HMAC",hash:`SHA-${n}`,length:n},o=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return crypto.getRandomValues(new Uint8Array(+t.slice(-3)>>3));case"A128KW":case"A192KW":case"A256KW":n=+t.slice(1,4),i={name:"AES-KW",length:n},o=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":n=+t.slice(1,4),i={name:"AES-GCM",length:n},o=["encrypt","decrypt"];break;default:wi(Gn)}return crypto.subtle.generateKey(i,r??!1,o)}var jE=ne(()=>{Xs();Ct()});var GE={};Cc(GE,{CompactEncrypt:()=>El,CompactSign:()=>vl,EmbeddedJWK:()=>wE,EncryptJWT:()=>_l,FlattenedEncrypt:()=>yl,FlattenedSign:()=>Al,GeneralEncrypt:()=>ul,GeneralSign:()=>Tl,SignJWT:()=>No,UnsecuredJWT:()=>xl,base64url:()=>Vc,calculateJwkThumbprint:()=>dp,calculateJwkThumbprintUri:()=>bE,compactDecrypt:()=>Bh,compactVerify:()=>Yh,createLocalJWKSet:()=>Zs,createRemoteJWKSet:()=>kE,cryptoRuntime:()=>bI,customFetch:()=>mp,decodeJwt:()=>KE,decodeProtectedHeader:()=>LE,errors:()=>Md,exportJWK:()=>Il,exportPKCS8:()=>xE,exportSPKI:()=>IE,flattenedDecrypt:()=>Gh,flattenedVerify:()=>Qh,generalDecrypt:()=>qh,generalVerify:()=>eE,generateKeyPair:()=>FE,generateSecret:()=>BE,importJWK:()=>Vt,importPKCS8:()=>ta,importSPKI:()=>bl,importX509:()=>PE,jwksCache:()=>hp,jwtDecrypt:()=>oE,jwtVerify:()=>jn});var bI,ra=ne(()=>{jh();$h();Wh();zh();Xh();Zh();tE();iE();sE();aE();cE();lE();uE();dE();pE();fE();SE();NE();pp();CE();DE();up();UE();ME();HE();Ie();VE();jE();zt();bI="WebCryptoAPI"});var Hv=M_((Ga,Lu)=>{(function(t,e){"use strict";var r="",n="?",i="function",o="undefined",s="object",a="string",c="major",l="model",u="name",p="type",f="vendor",m="version",E="architecture",v="console",N="mobile",S="tablet",R="smarttv",M="wearable",K="embedded",B=500,V="Amazon",$="Apple",A="ASUS",x="BlackBerry",b="Browser",g="Chrome",I="Edge",O="Firefox",D="Google",k="Huawei",C="LG",P="Microsoft",L="Motorola",H="Opera",z="Samsung",Y="Sharp",pe="Sony",Oe="Xiaomi",Fe="Zebra",me="Facebook",we="Chromium OS",st="Mac OS",Zi=function(ve,ke){var fe={};for(var He in ve)ke[He]&&ke[He].length%2===0?fe[He]=ke[He].concat(ve[He]):fe[He]=ve[He];return fe},Cn=function(ve){for(var ke={},fe=0;fe<ve.length;fe++)ke[ve[fe].toUpperCase()]=ve[fe];return ke},eo=function(ve,ke){return typeof ve===a?_t(ke).indexOf(_t(ve))!==-1:!1},_t=function(ve){return ve.toLowerCase()},yi=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},It=function(ve,ke){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof ke===o?ve:ve.substring(0,B)},Qe=function(ve,ke){for(var fe=0,He,rn,Mr,Re,ie,Kr;fe<ke.length&&!ie;){var Nd=ke[fe],_h=ke[fe+1];for(He=rn=0;He<Nd.length&&!ie&&Nd[He];)if(ie=Nd[He++].exec(ve),ie)for(Mr=0;Mr<_h.length;Mr++)Kr=ie[++rn],Re=_h[Mr],typeof Re===s&&Re.length>0?Re.length===2?typeof Re[1]==i?this[Re[0]]=Re[1].call(this,Kr):this[Re[0]]=Re[1]:Re.length===3?typeof Re[1]===i&&!(Re[1].exec&&Re[1].test)?this[Re[0]]=Kr?Re[1].call(this,Kr,Re[2]):e:this[Re[0]]=Kr?Kr.replace(Re[1],Re[2]):e:Re.length===4&&(this[Re[0]]=Kr?Re[3].call(this,Kr.replace(Re[1],Re[2])):e):this[Re]=Kr||e;fe+=2}},Ke=function(ve,ke){for(var fe in ke)if(typeof ke[fe]===s&&ke[fe].length>0){for(var He=0;He<ke[fe].length;He++)if(eo(ke[fe][He],ve))return fe===n?e:fe}else if(eo(ke[fe],ve))return fe===n?e:fe;return ve},k_={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},Ah={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Th={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[m,[u,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[m,[u,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[u,m],[/opios[\/ ]+([\w\.]+)/i],[m,[u,H+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[m,[u,H+" GX"]],[/\bopr\/([\w\.]+)/i],[m,[u,H]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[m,[u,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[u,m],[/\bddg\/([\w\.]+)/i],[m,[u,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[m,[u,"UC"+b]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[m,[u,"WeChat"]],[/konqueror\/([\w\.]+)/i],[m,[u,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[m,[u,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[m,[u,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[m,[u,"Smart Lenovo "+b]],[/(avast|avg)\/([\w\.]+)/i],[[u,/(.+)/,"$1 Secure "+b],m],[/\bfocus\/([\w\.]+)/i],[m,[u,O+" Focus"]],[/\bopt\/([\w\.]+)/i],[m,[u,H+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[m,[u,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[m,[u,"Dolphin"]],[/coast\/([\w\.]+)/i],[m,[u,H+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[m,[u,"MIUI "+b]],[/fxios\/([-\w\.]+)/i],[m,[u,O]],[/\bqihu|(qi?ho?o?|360)browser/i],[[u,"360 "+b]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[u,/(.+)/,"$1 "+b],m],[/samsungbrowser\/([\w\.]+)/i],[m,[u,z+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[u,/_/g," "],m],[/metasr[\/ ]?([\d\.]+)/i],[m,[u,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[u,"Sogou Mobile"],m],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[u,m],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[u],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[u,me],m],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[u,m],[/\bgsa\/([\w\.]+) .*safari\//i],[m,[u,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[m,[u,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[m,[u,g+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[u,g+" WebView"],m],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[m,[u,"Android "+b]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[u,m],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[m,[u,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[m,u],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[u,[m,Ke,k_]],[/(webkit|khtml)\/([\w\.]+)/i],[u,m],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[u,"Netscape"],m],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[m,[u,O+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[u,m],[/(cobalt)\/([\w\.]+)/i],[u,[m,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[E,"amd64"]],[/(ia32(?=;))/i],[[E,_t]],[/((?:i[346]|x)86)[;\)]/i],[[E,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[E,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[E,"armhf"]],[/windows (ce|mobile); ppc;/i],[[E,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[E,/ower/,r,_t]],[/(sun4\w)[;\)]/i],[[E,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[E,_t]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[f,z],[p,S]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[f,z],[p,N]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[f,$],[p,N]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[f,$],[p,S]],[/(macintosh);/i],[l,[f,$]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[f,Y],[p,N]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[f,k],[p,S]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[f,k],[p,N]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,N]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,S]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[f,"OPPO"],[p,N]],[/\b(opd2\d{3}a?) bui/i],[l,[f,"OPPO"],[p,S]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[f,"Vivo"],[p,N]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[f,"Realme"],[p,N]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[f,L],[p,N]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[f,L],[p,S]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[f,C],[p,S]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[f,C],[p,N]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[f,"Lenovo"],[p,S]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[f,"Nokia"],[p,N]],[/(pixel c)\b/i],[l,[f,D],[p,S]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[f,D],[p,N]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[f,pe],[p,N]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[f,pe],[p,S]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[f,"OnePlus"],[p,N]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[f,V],[p,S]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[f,V],[p,N]],[/(playbook);[-\w\),; ]+(rim)/i],[l,f,[p,S]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[f,x],[p,N]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[f,A],[p,S]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[f,A],[p,N]],[/(nexus 9)/i],[l,[f,"HTC"],[p,S]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[f,[l,/_/g," "],[p,N]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[f,"Acer"],[p,S]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[f,"Meizu"],[p,N]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[f,"Ulefone"],[p,N]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[f,l,[p,N]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[f,l,[p,S]],[/(surface duo)/i],[l,[f,P],[p,S]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[f,"Fairphone"],[p,N]],[/(u304aa)/i],[l,[f,"AT&T"],[p,N]],[/\bsie-(\w*)/i],[l,[f,"Siemens"],[p,N]],[/\b(rct\w+) b/i],[l,[f,"RCA"],[p,S]],[/\b(venue[\d ]{2,7}) b/i],[l,[f,"Dell"],[p,S]],[/\b(q(?:mv|ta)\w+) b/i],[l,[f,"Verizon"],[p,S]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[f,"Barnes & Noble"],[p,S]],[/\b(tm\d{3}\w+) b/i],[l,[f,"NuVision"],[p,S]],[/\b(k88) b/i],[l,[f,"ZTE"],[p,S]],[/\b(nx\d{3}j) b/i],[l,[f,"ZTE"],[p,N]],[/\b(gen\d{3}) b.+49h/i],[l,[f,"Swiss"],[p,N]],[/\b(zur\d{3}) b/i],[l,[f,"Swiss"],[p,S]],[/\b((zeki)?tb.*\b) b/i],[l,[f,"Zeki"],[p,S]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[f,"Dragon Touch"],l,[p,S]],[/\b(ns-?\w{0,9}) b/i],[l,[f,"Insignia"],[p,S]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[f,"NextBook"],[p,S]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[f,"Voice"],l,[p,N]],[/\b(lvtel\-)?(v1[12]) b/i],[[f,"LvTel"],l,[p,N]],[/\b(ph-1) /i],[l,[f,"Essential"],[p,N]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[f,"Envizen"],[p,S]],[/\b(trio[-\w\. ]+) b/i],[l,[f,"MachSpeed"],[p,S]],[/\btu_(1491) b/i],[l,[f,"Rotor"],[p,S]],[/(shield[\w ]+) b/i],[l,[f,"Nvidia"],[p,S]],[/(sprint) (\w+)/i],[f,l,[p,N]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[f,P],[p,N]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[f,Fe],[p,S]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[f,Fe],[p,N]],[/smart-tv.+(samsung)/i],[f,[p,R]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[f,z],[p,R]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[f,C],[p,R]],[/(apple) ?tv/i],[f,[l,$+" TV"],[p,R]],[/crkey/i],[[l,g+"cast"],[f,D],[p,R]],[/droid.+aft(\w+)( bui|\))/i],[l,[f,V],[p,R]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[f,Y],[p,R]],[/(bravia[\w ]+)( bui|\))/i],[l,[f,pe],[p,R]],[/(mitv-\w{5}) bui/i],[l,[f,Oe],[p,R]],[/Hbbtv.*(technisat) (.*);/i],[f,l,[p,R]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[f,It],[l,It],[p,R]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,R]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[f,l,[p,v]],[/droid.+; (shield) bui/i],[l,[f,"Nvidia"],[p,v]],[/(playstation [345portablevi]+)/i],[l,[f,pe],[p,v]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[f,P],[p,v]],[/((pebble))app/i],[f,l,[p,M]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[f,$],[p,M]],[/droid.+; (glass) \d/i],[l,[f,D],[p,M]],[/droid.+; (wt63?0{2,3})\)/i],[l,[f,Fe],[p,M]],[/(quest( \d| pro)?)/i],[l,[f,me],[p,M]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[f,[p,K]],[/(aeobc)\b/i],[l,[f,V],[p,K]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,N]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,S]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,S]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,N]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[f,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[m,[u,I+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[m,[u,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[u,m],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[m,u]],os:[[/microsoft (windows) (vista|xp)/i],[u,m],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[u,[m,Ke,Ah]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[m,Ke,Ah],[u,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[m,/_/g,"."],[u,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[u,st],[m,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[m,u],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[u,m],[/\(bb(10);/i],[m,[u,x]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[m,[u,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[m,[u,O+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[m,[u,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[m,[u,"watchOS"]],[/crkey\/([\d\.]+)/i],[m,[u,g+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[u,we],m],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[u,m],[/(sunos) ?([\w\.\d]*)/i],[[u,"Solaris"],m],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[u,m]]},tr=function(ve,ke){if(typeof ve===s&&(ke=ve,ve=e),!(this instanceof tr))return new tr(ve,ke).getResult();var fe=typeof t!==o&&t.navigator?t.navigator:e,He=ve||(fe&&fe.userAgent?fe.userAgent:r),rn=fe&&fe.userAgentData?fe.userAgentData:e,Mr=ke?Zi(Th,ke):Th,Re=fe&&fe.userAgent==He;return this.getBrowser=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.browser),ie[c]=yi(ie[m]),Re&&fe&&fe.brave&&typeof fe.brave.isBrave==i&&(ie[u]="Brave"),ie},this.getCPU=function(){var ie={};return ie[E]=e,Qe.call(ie,He,Mr.cpu),ie},this.getDevice=function(){var ie={};return ie[f]=e,ie[l]=e,ie[p]=e,Qe.call(ie,He,Mr.device),Re&&!ie[p]&&rn&&rn.mobile&&(ie[p]=N),Re&&ie[l]=="Macintosh"&&fe&&typeof fe.standalone!==o&&fe.maxTouchPoints&&fe.maxTouchPoints>2&&(ie[l]="iPad",ie[p]=S),ie},this.getEngine=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.engine),ie},this.getOS=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.os),Re&&!ie[u]&&rn&&rn.platform&&rn.platform!="Unknown"&&(ie[u]=rn.platform.replace(/chrome os/i,we).replace(/macos/i,st)),ie},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return He},this.setUA=function(ie){return He=typeof ie===a&&ie.length>B?It(ie,B):ie,this},this.setUA(He),this};tr.BROWSER=Cn([u,m,c]),tr.CPU=Cn([E]),tr.DEVICE=Cn([l,f,p,v,N,R,S,M,K]),tr.ENGINE=tr.OS=Cn([u,m]),typeof Ga!==o?(typeof Lu!==o&&Lu.exports&&(Ga=Lu.exports=tr),Ga.UAParser=tr):typeof define===i&&define.amd?define(function(){return tr}):typeof t!==o&&(t.UAParser=tr);var to=typeof t!==o&&(t.jQuery||t.Zepto);if(to&&!to.ua){var kc=new tr;to.ua=kc.getResult(),to.ua.get=function(){return kc.getUA()},to.ua.set=function(ve){kc.setUA(ve);var ke=kc.getResult();for(var fe in ke)to.ua[fe]=ke[fe]}}})(typeof window=="object"?window:Ga)});var zT,JT=ne(()=>{zT="x-hono-already-sent"});var YT,XT=ne(()=>{YT=t=>((...e)=>{if(typeof e[0]=="function"){let[r,n]=e;return async function(o,s){let a=await t(o,await r(o),n);if(a)return a;await s()}}else{let[r,n,i]=e;return(async()=>{let o=await t(r,n,i);if(!o)throw new Error("Failed to upgrade WebSocket");return o})()}})});var S_={};Cc(S_,{RequestError:()=>Ur,createAdaptorServer:()=>b_,getRequestListener:()=>T_,serve:()=>Jk,upgradeWebSocket:()=>zk});import{STATUS_CODES as ak,ServerResponse as ck,createServer as lk}from"node:http";import{Http2ServerRequest as hi,constants as uk}from"node:http2";import{Readable as QT}from"node:stream";async function Uk(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function h_(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(s,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function o(){t.read().then(s,i)}function s({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",o);else return t.read().then(s,i)}catch(l){i(l)}}}function o_(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:h_(t.getReader(),e)}var Ur,dk,pk,Td,ZT,e_,hh,c_,Eh,l_,fk,mk,hk,Ek,yk,gk,Ns,u_,vk,Ak,ah,lh,d_,yh,t_,Id,r_,Tk,Ei,Rn,Rs,Rc,p_,f_,wc,uh,dh,mi,_d,kn,n_,Nc,xd,Oc,_k,Ik,xk,bk,Sk,wk,Nk,gh,Rk,i_,Ok,tn,kk,Xi,ph,ws,On,bd,en,Ck,Dk,Pk,fh,Sd,s_,Lk,Mk,E_,Kk,Hk,Fk,y_,wd,mh,g_,ch,v_,A_,Vk,T_,Bk,jk,Gk,__,I_,$k,x_,a_,qk,Wk,zk,b_,Jk,w_=ne(()=>{JT();XT();Ur=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},dk=new Set(["age","authorization","content-length","content-type","etag","expires","from","host","if-modified-since","if-unmodified-since","last-modified","location","max-forwards","proxy-authorization","referer","retry-after","server","user-agent"]),pk=/^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/,Td=t=>t===9||t===10||t===13||t===32,ZT=t=>{if(!Td(t.charCodeAt(0))&&!Td(t.charCodeAt(t.length-1)))return t;let e=0,r=t.length;for(;e<r&&Td(t.charCodeAt(e));)e++;for(;r>e&&Td(t.charCodeAt(r-1));)r--;return t.slice(e,r)},e_=/[\0\r\n]/,hh=globalThis.Headers,c_=(t,e=hh)=>{let r=new e;for(let n=0;n<t.length;n+=2){let i=t[n];i.startsWith(":")||r.append(i,t[n+1])}return r},Eh=class{#e;#t;#r;#o;constructor(t){this.#e=t,t instanceof hi&&(this.#t=t.rawHeaders.slice())}get#i(){return this.#t??=this.#e.rawHeaders.slice()}get#n(){return this.#r||(this.#r=c_(this.#i),this.#t=void 0),this.#r}#c(t){if(typeof t=="string"){if(!pk.test(t))throw new TypeError(`Invalid header name: ${t}`);return t.toLowerCase()}}#s(t){let e=this.#e instanceof hi?void 0:this.#e.headers;if(!e||dk.has(t)||t==="set-cookie"||t==="__proto__")return;if(!Object.hasOwn(e,t))return null;let r=e[t];if(typeof r=="string"){let n=ZT(r);return e_.test(n)?void 0:n}}#a(t,e){let r=e==="cookie"?"; ":", ",n=null;for(let i=0;i<t.length;i+=2){let o=t[i];if(o.length===e.length&&o.toLowerCase()===e){let s=ZT(t[i+1]);if(e_.test(s)){this.#o=!0;return}n=n===null?s:n+r+s}}return n}append(t,e){this.#n.append(t,e)}delete(t){this.#n.delete(t)}get(t){let e=this.#c(t);if(e&&!this.#r&&!this.#o){let r=this.#s(e);if(r!==void 0)return r;let n=this.#a(this.#i,e);if(n!==void 0)return n}return this.#n.get(t)}has(t){let e=this.#c(t);if(e&&!this.#r&&!this.#o){let r=this.#s(e);if(r!==void 0)return r!==null;let n=this.#a(this.#i,e);if(n!==void 0)return n!==null}return this.#n.has(t)}set(t,e){this.#n.set(t,e)}getSetCookie(){return this.#n.getSetCookie()}keys(){return this.#n.keys()}values(){return this.#n.values()}entries(){return this.#n.entries()}forEach(t,e){this.#n.forEach((r,n)=>{t.call(e,r,n,this)})}[Symbol.iterator](){return this.entries()}};Object.defineProperty(Eh.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Headers (lightweight) ${r(Object.fromEntries(this),{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(Eh.prototype,hh.prototype);l_=t=>globalThis.Headers===hh?new Eh(t):c_(t.rawHeaders,globalThis.Headers),fk=/^\/[!#$&-;=?-\[\]_a-z~]*$/,mk=/\/\.\.?(?:[/?#]|$)/,hk=/^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/,Ek=(t,e,r)=>{let n=`${t}://${e}${r}`;if(hk.test(e)){if(r.length===0)return n+"/";if(r.charCodeAt(0)!==47)throw new Ur("Invalid URL");return!fk.test(r)||mk.test(r)?new URL(n).href:n}else{let i=new URL(n);if(i.hostname.length!==e.length&&i.hostname!==(e.includes(":")?e.replace(/:\d+$/,""):e).toLowerCase())throw new Ur("Invalid host header");return i.href}},yk=t=>t instanceof Ur?t:new Ur(t.message,{cause:t}),gk=global.Request,Ns=class extends gk{constructor(t,e){if(typeof t=="object"&&Ei in t){let r=e!==void 0&&"body"in e&&e.body!=null;if(t[kn]&&!r)throw new TypeError("Cannot construct a Request with a Request object that has already been used.");t=t[Ei]()}typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},u_=Symbol("wrapBodyStream"),vk=new Set(["latin1","binary","hex","base64","base64url"]),Ak=t=>t===null||vk.has(t),ah=Symbol("bodyBufferedBeforeDisconnect"),lh=Symbol("bodyBufferedLengthBeforeDisconnect"),d_=(t,e)=>Buffer.isBuffer(t)?t:Buffer.from(t,e??"utf8"),yh=t=>!(t instanceof hi)&&!!t.complete&&!!t.readableAborted&&typeof t.read=="function"&&Ak(t.readableEncoding),t_=t=>{if(t.readableDidRead||!yh(t))return;let e=t;e[lh]??=t.readableLength},Id=(t,e)=>{if(t.readableDidRead&&!e||!yh(t))return;let r=t;if(r[ah]!==void 0)return r[ah];let n,i=t.errored;if(i&&i.code!=="ECONNRESET")n=i;else if(r[lh]!==void 0&&t.readableLength!==r[lh])n=xd();else{let o=e??[],s=t.read();s!==null&&o.push(d_(s,t.readableEncoding));let a=o.length===1?o[0]:Buffer.concat(o);n=a;let c=t.headers["content-length"];if(typeof c=="string"&&/^\d+$/.test(c)){let l=Number(c);Number.isSafeInteger(l)&&a.length!==l&&(n=xd())}}return r[ah]=n,n},r_=(t,e)=>{if(e instanceof Error){t.error(e);return}e.length>0&&t.enqueue(e),t.close()},Tk=(t,e,r,n,i)=>{let o={method:t,headers:r,signal:i.signal};if(t==="TRACE"){o.method="GET";let s=new Ns(e,o);return Object.defineProperty(s,"method",{get(){return"TRACE"}}),s}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)o.body=new ReadableStream({start(s){s.enqueue(n.rawBody),s.close()}});else if(n[u_]){let s;o.body=new ReadableStream({async pull(a){try{if(!s){let u=Id(n);if(u!==void 0){r_(a,u);return}}s||=QT.toWeb(n).getReader();let{done:c,value:l}=await s.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else{let s=Id(n);s!==void 0?o.body=new ReadableStream({start(a){r_(a,s)}}):o.body=QT.toWeb(n)}return new Ns(e,o)},Ei=Symbol("getRequestCache"),Rn=Symbol("requestCache"),Rs=Symbol("incomingKey"),Rc=Symbol("urlKey"),p_=Symbol("methodKey"),f_=Symbol("headersKey"),wc=Symbol("abortControllerKey"),uh=Symbol("getAbortController"),dh=Symbol("abortRequest"),mi=Symbol("bodyBuffer"),_d=Symbol("bodyReadPromise"),kn=Symbol("bodyConsumedDirectly"),n_=Symbol("bodyLockReader"),Nc=Symbol("abortReason"),xd=()=>new TypeError("Body is unusable"),Oc=()=>Promise.reject(xd()),_k=new TextDecoder,Ik=t=>{if(t[kn])return Oc();t[kn]=!0},xk=t=>t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength),bk=t=>(t[f_]||=l_(t[Rs])).get("content-type")||"",Sk=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,wk=t=>{if(typeof t!="string"||t.length===0)return"GET";switch(t){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"PATCH":case"POST":case"PUT":case"QUERY":return t}let e=t.toUpperCase();switch(e){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"POST":case"PUT":return e;default:return t}},Nk=t=>{if(!Sk.test(t))return new TypeError(`'${t}' is not a valid HTTP method.`);let e=t.toUpperCase();if(e==="CONNECT"||e==="TRACK"||e==="TRACE"&&t!=="TRACE")return new TypeError(`'${t}' HTTP method is unsupported.`)},gh=(t,e,r)=>{if(t[kn])return Oc();let n=t.method;if(n==="GET"||n==="HEAD")return t[Ei]()[e]();let i=Nk(n);if(i)return Promise.reject(i);if(t[Rn]&&n!=="TRACE")return t[Rn][e]();let o=Ik(t);if(o)return o;let s=Rk(t);if(s){let a=Promise.resolve(r(s,t));return t[mi]=void 0,a}return Ok(t).then(a=>{let c=r(a,t);return t[mi]=void 0,c})},Rk=t=>{let e=t[Rs];if("rawBody"in e&&e.rawBody instanceof Buffer)return e.rawBody},i_=(t,e)=>{if(e.errored)return e.errored;let r=t[Nc];return r!==void 0?r instanceof Error?r:new Error(String(r)):new Error("Client connection prematurely closed.")},Ok=t=>{if(t[mi])return Promise.resolve(t[mi]);if(t[_d])return t[_d];let e=t[Rs];if(e.readableDidRead)return Oc();let r=Id(e);if(r!==void 0)return r instanceof Error?Promise.reject(r):(t[mi]=r,Promise.resolve(r));let n=new Promise((i,o)=>{let s=[],a=!1,c=v=>{a||(a=!0,E(),v())},l=v=>{let N=e.errored??v;return!yh(e)||N&&N.code!=="ECONNRESET"?!1:(c(()=>{let S=Id(e,s);S instanceof Error?o(S):S===void 0?o(v??i_(t,e)):(t[mi]=S,i(S))}),!0)},u=v=>{s.push(d_(v,e.readableEncoding))},p=()=>{c(()=>{let v=s.length===1?s[0]:Buffer.concat(s);t[mi]=v,i(v)})},f=v=>{l(v)||c(()=>{o(v)})},m=()=>{if(e.readableEnded){p();return}l()||c(()=>{o(i_(t,e))})},E=()=>{e.off("data",u),e.off("end",p),e.off("error",f),e.off("close",m),t[_d]=void 0};e.on("data",u),e.on("end",p),e.on("error",f),e.on("close",m),queueMicrotask(()=>{a||(e.readableEnded?p():e.errored?f(e.errored):e.destroyed&&m())})});return t[_d]=n,n},tn={get method(){return this[p_]},get url(){return this[Rc]},get headers(){return this[f_]||=l_(this[Rs])},[dh](t){this[Nc]===void 0&&(this[Nc]=t);let e=this[wc];e&&!e.signal.aborted&&e.abort(t)},[uh](){return this[wc]||=new AbortController,this[Nc]!==void 0&&!this[wc].signal.aborted&&this[wc].abort(this[Nc]),this[wc]},[Ei](){let t=this[uh]();if(this[Rn])return this[Rn];let e=this.method;if(this[kn]&&!(e==="GET"||e==="HEAD")){this[mi]=void 0;let r={method:e==="TRACE"?"GET":e,headers:this.headers,signal:t.signal};e!=="TRACE"&&(r.body=new ReadableStream({start(i){i.close()}}),r.duplex="half");let n=new Ns(this[Rc],r);return e==="TRACE"&&Object.defineProperty(n,"method",{get(){return"TRACE"}}),this[Rn]=n}return this[Rn]=Tk(this.method,this[Rc],this.headers,this[Rs],t)},get body(){if(!this[kn])return this[Ei]().body;let t=this[Ei]();return!this[n_]&&t.body&&(this[n_]=t.body.getReader()),t.body},get bodyUsed(){return this[kn]?!0:this[Rn]?this[Rn].bodyUsed:!1}};Object.defineProperty(tn,"signal",{get(){return this[uh]().signal}});["cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","keepalive"].forEach(t=>{Object.defineProperty(tn,t,{get(){return this[Ei]()[t]}})});["clone","formData"].forEach(t=>{Object.defineProperty(tn,t,{value:function(){if(this[kn]){if(t==="clone")throw xd();return Oc()}return this[Ei]()[t]()}})});Object.defineProperty(tn,"text",{value:function(){return gh(this,"text",t=>_k.decode(t))}});Object.defineProperty(tn,"arrayBuffer",{value:function(){return gh(this,"arrayBuffer",t=>xk(t))}});Object.defineProperty(tn,"blob",{value:function(){return gh(this,"blob",(t,e)=>{let r=bk(e),n=r?{headers:{"content-type":r}}:void 0;return new Response(t,n).blob()})}});Object.defineProperty(tn,"json",{value:function(){return this[kn]?Oc():this.text().then(JSON.parse)}});Object.defineProperty(tn,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Request (lightweight) ${r({method:this.method,url:this.url,headers:this.headers,nativeRequest:this[Rn]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(tn,Ns.prototype);kk=(t,e)=>{let r=Object.create(tn);r[Rs]=t,r[p_]=wk(t.method);let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof hi)throw new Ur("Absolute URL for :path is not allowed in HTTP/2");try{r[Rc]=new URL(n).href}catch(s){throw new Ur("Invalid absolute URL",{cause:s})}return r}let i=(t instanceof hi?t.authority:t.headers.host)||e;if(!i)throw new Ur("Missing host header");let o;if(t instanceof hi){if(o=t.scheme,!(o==="http"||o==="https"))throw new Ur("Unsupported scheme")}else o=t.socket&&t.socket.encrypted?"https":"http";try{r[Rc]=Ek(o,i,n)}catch(s){throw s instanceof Ur?s:new Ur("Invalid URL",{cause:s})}return r},Xi="text/plain; charset=UTF-8",ph=Symbol("responseCache"),ws=Symbol("getResponseCache"),On=Symbol("cache"),bd=global.Response,en=class m_{#e;#t;[ws](){let e=this[On],r=e&&e[2]instanceof Headers?e[2]:void 0;return delete this[On],this[ph]||=new bd(this.#e,r?{status:this.#t?.status,statusText:this.#t?.statusText,headers:r}:this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof bd){let i=r[ph];if(i){this.#t=i,this[ws]();return}this.#t=r instanceof m_?r.#t:r,n=new Headers(r.headers)}else this.#t=r;(e==null||typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[On]=[r?.status||200,e??null,n||r?.headers])}get headers(){let e=this[On];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||(e[1]===null?void 0:{"content-type":Xi}))),e[2]):this[ws]().headers}get status(){return this[On]?.[0]??this[ws]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty(en.prototype,t,{get(){return this[ws]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(en.prototype,t,{value:function(){return this[ws]()[t]()}})});Object.defineProperty(en.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Response (lightweight) ${r({status:this.status,headers:this.headers,ok:this.ok,nativeResponse:this[ph]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(en,bd);Object.setPrototypeOf(en.prototype,bd.prototype);Ck=/^https?:\/\/[!#-;=?-[\]_a-z~A-Z]+$/,Dk=t=>t instanceof URL?t.href:Ck.test(t)?t:new URL(t).href,Pk=new Set([301,302,303,307,308]);Object.defineProperty(en,"redirect",{value:function(e,r=302){if(!Pk.has(r))throw new RangeError("Invalid status code");return new en(null,{status:r,headers:{location:Dk(e)}})},writable:!0,configurable:!0});Object.defineProperty(en,"json",{value:function(e,r){let n=JSON.stringify(e);if(n===void 0)throw new TypeError("The data is not JSON serializable");let i=r?.headers,o;return i?(o=new Headers(i),o.has("content-type")||o.set("content-type","application/json")):o={"content-type":"application/json"},new en(n,{status:r?.status??200,statusText:r?.statusText,headers:o})},writable:!0,configurable:!0});fh=(t,e)=>{let r={};if(t instanceof Headers||(t=new Headers(t??void 0)),t.has("set-cookie")){let n=[];for(let[i,o]of t)i==="set-cookie"?n.push(o):r[i]=o;n.length>0&&(r["set-cookie"]=n)}else for(let[n,i]of t)r[n]=i;return e&&(r["content-type"]??=e),r},Sd=Symbol("outgoingEnded"),s_=Symbol("incomingDraining"),Lk=500,Mk=64*1024*1024,E_=t=>{let e=t;if(t.destroyed||e[s_])return;if(e[s_]=!0,t instanceof hi){try{t.stream?.close?.(uk.NGHTTP2_NO_ERROR)}catch{}return}let r=0,n=()=>{clearTimeout(o),t.off("data",s),t.off("end",n),t.off("error",n)},i=()=>{n();let a=t.socket;a&&!a.destroyed&&(typeof a.destroySoon=="function"?a.destroySoon():typeof a.destroy=="function"&&a.destroy())},o=setTimeout(i,Lk);o.unref?.();let s=a=>{r+=a.length,r>Mk&&i()};t.on("data",s),t.on("end",n),t.on("error",n),t.resume()},Kk=(t,e,r,n)=>()=>{e.errored?(t_(e),t[dh](e.errored.toString())):r.writableFinished||(t_(e),t[dh]("Client connection prematurely closed.")),n&&!e.readableEnded&&setTimeout(()=>{e.readableEnded||setTimeout(()=>{E_(e)})})},Hk=t=>{if(!(On in t))return!1;let e=t[On][1];return e===null||typeof e=="string"||e instanceof Uint8Array},Fk=()=>new Response(null,{status:400}),y_=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),wd=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||(e instanceof ck&&(e._contentLength=null),e.writeHead(500,{"Content-Type":"text/plain"})),e.end(`Error: ${r.message}`),e.destroy(r))},mh=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},g_=(t,e,r)=>{let n=t;return n._contentLength===null&&n._hasBody&&n.useChunkedEncodingByDefault&&!n._removedContLen&&e>=200&&e!==204&&e!==304&&!t.hasHeader("content-length")&&!t.hasHeader("transfer-encoding")&&!t.hasHeader("trailer")?(n._contentLength=r,!0):!1},ch=(t,e,r)=>{g_(t,e,r)?t.writeHead(e,{"Content-Type":Xi}):t.writeHead(e,{"Content-Type":Xi,"Content-Length":r})},v_=async(t,e)=>{let[r,n,i]=t[On];if(!i){n===null?(e.writeHead(r),e.end()):typeof n=="string"?(ch(e,r,Buffer.byteLength(n)),e.end(n)):n instanceof Uint8Array?(ch(e,r,n.byteLength),e.end(n)):n instanceof Blob?(ch(e,r,n.size),e.end(new Uint8Array(await n.arrayBuffer()))):(e.writeHead(r,{"Content-Type":Xi}),mh(e),await o_(n,e)?.catch(c=>wd(c,e))),e[Sd]?.();return}let o=!1,s=!1,a=!0;if(i instanceof Headers)o=i.has("content-length"),i=fh(i,n===null?void 0:Xi);else if(Array.isArray(i)){let c=new Headers(i);o=c.has("content-length"),i=fh(c,n===null?void 0:Xi)}else{s=!0;for(let c in i){if(c.length===14&&c.toLowerCase()==="content-length"){o=!0;break}(c.length===17&&c.toLowerCase()==="transfer-encoding"||c.length===7&&c.toLowerCase()==="trailer")&&(a=!1)}}if(!o){let c;typeof n=="string"?c=Buffer.byteLength(n):n instanceof Uint8Array?c=n.byteLength:n instanceof Blob&&(c=n.size),c!==void 0&&(!s||!a||!g_(e,r,c))&&(s&&(i={...i}),i["Content-Length"]=c)}e.writeHead(r,i),n==null?e.end():typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):(mh(e),await o_(n,e)?.catch(c=>wd(c,e))),e[Sd]?.()},A_=t=>typeof t.then=="function",Vk=async(t,e,r={})=>{if(A_(t))if(r.errorHandler)try{t=await t}catch(i){let o=await r.errorHandler(i);if(!o)return;t=o}else t=await t.catch(y_);if(On in t)return v_(t,e);let n=fh(t.headers,t.body===null?void 0:Xi);if(t.body){let i=t.body.getReader(),o=[],s=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let u=await Uk(a).catch(p=>{console.error(p),s=!0});if(!u){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,u.value&&o.push(u.value),u.done){s=!0;break}}s&&!("content-length"in n)&&(n["content-length"]=o.reduce((l,u)=>l+u.length,0))}e.writeHead(t.status,n),o.forEach(c=>{e.write(c)}),s?e.end():(o.length===0&&mh(e),await h_(i,e,a))}else n[zT]||(e.writeHead(t.status,n),e.end());e[Sd]?.()},T_=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==Ns&&(Object.defineProperty(global,"Request",{value:Ns}),Object.defineProperty(global,"Response",{value:en})),async(n,i)=>{let o,s,a=!1,c=!1,l=()=>{!s||c||(c=!0,i.on("close",Kk(s,n,i,a)))};try{if(s=kk(n,e.hostname),a=r&&!(n.method==="GET"||n.method==="HEAD"),a&&(n[u_]=!0,n instanceof hi&&(i[Sd]=()=>{n.readableEnded||setTimeout(()=>{n.readableEnded||setTimeout(()=>{n.destroy(),i.destroy()})})})),o=t(s,{incoming:n,outgoing:i}),!A_(o)&&Hk(o))return a&&!n.readableEnded&&i.once("finish",()=>{n.readableEnded||E_(n)}),v_(o,i);l()}catch(u){if(o)return wd(u,i);if(e.errorHandler){if(l(),o=await e.errorHandler(s?u:yk(u)),!o)return}else s?o=y_(u):o=Fk()}try{return await Vk(o,i,e)}catch(u){return wd(u,i)}}},Bk=globalThis.CloseEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get wasClean(){return this.#e.wasClean??!1}get code(){return this.#e.code??0}get reason(){return this.#e.reason??""}},jk=globalThis.ErrorEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get message(){return this.#e.message??""}get filename(){return this.#e.filename??""}get lineno(){return this.#e.lineno??0}get colno(){return this.#e.colno??0}get error(){return this.#e.error??null}},Gk=()=>Symbol("connection"),__=Symbol("CONNECTION_SYMBOL_KEY"),I_=Symbol("WAIT_FOR_WEBSOCKET_SYMBOL"),$k=new Set(["connection","content-length","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","sec-websocket-accept","sec-websocket-extensions","sec-websocket-protocol"]),x_=(t,e)=>{e&&e.forEach((r,n)=>{$k.has(n.toLowerCase())||t.push(`${n}: ${r}`)})},a_=(t,e,r)=>{let n=["Connection: close","Content-Length: 0"];x_(n,r),t.end(`HTTP/1.1 ${e.toString()} ${ak[e]??""}\r
+${n.join(`\r
+`)}\r
+\r
+`)},qk=t=>{let e=t.socket.encrypted?"https":"http",r=new URL(t.url??"/",`${e}://${t.headers.host??"localhost"}`),n=new Headers;for(let i in t.headers){let o=t.headers[i];o&&n.append(i,Array.isArray(o)?o[0]:o)}return new Request(r,{headers:n})},Wk=t=>{let{server:e,fetchCallback:r,wss:n}=t,i=new Map;n.on("connection",(a,c)=>{let l=i.get(c);l&&(l.resolve(a),i.delete(c))});let o=a=>{let c=i.get(a);c&&(i.delete(a),c.reject(new Error("WebSocket handshake aborted")))},s=(a,c)=>new Promise((l,u)=>{i.set(a,{resolve:l,reject:u,connectionSymbol:c})});e.on("upgrade",async(a,c,l)=>{if(a.headers.upgrade?.toLowerCase()!=="websocket")return;let u={incoming:a,outgoing:void 0,wss:n,[I_]:s},p=400,f;try{let N=await r(qk(a),u);N instanceof Response&&(p=N.status,f=N.headers)}catch{e.listenerCount("upgrade")===1&&a_(c,500);return}let m=i.get(a);if(!m||m.connectionSymbol!==u[__]){o(a),e.listenerCount("upgrade")===1&&a_(c,p,f);return}let E=N=>{x_(N,f)},v=()=>o(a);c.once("close",v),n.on("headers",E);try{n.handleUpgrade(a,c,l,N=>{c.off("close",v),n.emit("connection",N,a)})}finally{n.off("headers",E)}}),e.on("close",()=>{n.close()})},zk=YT(async(t,e,r)=>{if(t.req.header("upgrade")?.toLowerCase()!=="websocket")return;let n=t.env,i=n[I_];if(!i||!n.incoming)return new Response(null,{status:500});let o=Gk();return n[__]=o,(async()=>{let s;try{s=await i(n.incoming,o)}catch{return}let a=[],c=(p,f)=>{a.push([p,f])};s.on("message",c);let l={binaryType:"arraybuffer",close(p,f){s.close(p,f)},protocol:s.protocol,raw:s,get readyState(){return s.readyState},send(p,f){s.send(p,{compress:f?.compress})},url:new URL(t.req.url)};try{e?.onOpen?.(new Event("open"),l)}catch(p){(r?.onError??console.error)(p)}let u=(p,f)=>{let m=Array.isArray(p)?p:[p];for(let E of m)try{e?.onMessage?.(new MessageEvent("message",{data:f?E instanceof ArrayBuffer?E:E.buffer.slice(E.byteOffset,E.byteOffset+E.byteLength):typeof E=="string"?E:Buffer.from(E).toString("utf-8")}),l)}catch(v){(r?.onError??console.error)(v)}};s.off("message",c);for(let p of a)u(...p);s.on("message",(p,f)=>{u(p,f)}),s.on("close",(p,f)=>{try{e?.onClose?.(new Bk("close",{code:p,reason:f.toString()}),l)}catch(m){(r?.onError??console.error)(m)}}),s.on("error",p=>{try{e?.onError?.(new jk("error",{error:p}),l)}catch(f){(r?.onError??console.error)(f)}})})(),new Response}),b_=t=>{let e=t.fetch,r=T_(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming}),n=(t.createServer||lk)(t.serverOptions||{},r);if(t.websocket&&t.websocket.server){if(t.websocket.server.options.noServer!==!0)throw new Error("WebSocket server must be created with { noServer: true } option");Wk({server:n,fetchCallback:e,wss:t.websocket.server})}return n},Jk=(t,e)=>{let r=b_(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var ro=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),F_=ro.READ|ro.WRITE|ro.DELETE|ro.APPROVE|ro.EXECUTE,rt={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},rr={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var V_=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function no(t){return V_?Object.freeze(t):t}function T(t,e){if(arguments.length===0)return no({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),no(r)}function d(t,e){let n={ok:!1,errors:no(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),no(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:o,prevCursor:s,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:s!=null,cursor:o,prevCursor:s,totalItems:a,estimatedTotal:c};return T(t,{...r,pagination:l})}function _(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function Q(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let o in r){if(o==="message"||o==="field")continue;let s=r[o];(typeof s=="string"||typeof s=="number")&&(n=n.replace(new RegExp(`\\{${o}\\}`,"g"),String(s)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function io(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var $t=_("AUTH_NOT_AUTHENTICATED","Not authenticated"),nr=_("AUTH_MISSING_CREDENTIALS","Missing credentials"),qt=_("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Hr=_("AUTH_TOKEN_EXPIRED","Token expired"),nn=_("AUTH_TOKEN_MALFORMED","Token malformed"),Wt=_("PERM_DENIED","Permission denied"),Od=Q("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),gi=_("VALIDATION_ERROR","Validation failed"),oo=Q("INVALID_INPUT","Invalid input: {reason}"),Os=_("FORBIDDEN","Access forbidden"),kd=_("NOT_FOUND","Resource not found"),Cd=Q("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),ks=Q("ALREADY_EXISTS","{resource} already exists"),Cs=_("CONFLICT","Resource conflict"),vi=_("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),so=_("INTERNAL_ERROR","Internal server error"),oe={NotAuthenticated:$t,MissingCredentials:nr,InvalidCredentials:qt,TokenExpired:Hr,TokenMalformed:nn,PermissionDenied:Wt,BoundaryViolation:Od,Forbidden:Os,ValidationError:gi,InvalidInput:oo,NotFound:kd,ResourceNotFound:Cd,AlreadyExists:ks,Conflict:Cs,RateLimitExceeded:vi,InternalError:so};var Ot={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var Dc=class{getMask(e,r){return Ih(e.perms,r)}check(e,r,n){if(r.roles?.length&&!(r.requireAllRoles?r.roles.every(a=>e.roles?.includes(a)):r.roles.some(a=>e.roles?.includes(a))))return d(Wt({message:"Role requirement not met"}));if(r.allowOwner&&n?.ownerId!==void 0&&n.ownerId===e.id)return T();let i=this.getMask(e,r.resource),o=this.checkCapability(i,r.action);return o.ok?this.checkBoundary(e,r.boundary,n):o}checkCapability(e,r){return(e&r)!==r?d(Wt()):T()}checkBoundary(e,r,n){if(r===rt.GLOBAL)return T();if(!n)return d(Wt({message:"Resource context required for boundary check"}));let i=n;switch(r){case rt.TENANT:if(!e.tenantId||i.tenantId!==e.tenantId)return d(Wt({message:"Tenant boundary violation"}));break;case rt.OWNER:case rt.SELF:if(i.ownerId!==e.id)return d(Wt({message:"Owner boundary violation"}));break;default:return d(Wt({message:`Unknown boundary type: ${r}`}))}return T()}can(e,r,n){return(this.getMask(e,r)&n)===n}compile(e){return(r,n)=>this.check(r,e,n).ok}checkCapabilityOnly(e,r,n){let i=this.getMask(e,r);return this.checkCapability(i,n)}hasAnyPermission(e,r,n){let i=this.getMask(e,r);return n.some(o=>(i&o)!==0)}hasAllPermissions(e,r,n){let i=this.getMask(e,r);return n.every(o=>(i&o)!==0)}explain(e,r,n){let i=["[Permission Check]"];if(i.push(`Resource: ${r.resource}`),r.roles?.length){let m=r.requireAllRoles?"ALL":"ANY",E=e.roles??[],v=r.requireAllRoles?r.roles.every(N=>E.includes(N)):r.roles.some(N=>E.includes(N));if(i.push(`Roles (${m}): ${r.roles.join(", ")} \u2014 user has: [${E.join(", ")}]`),!v)return i.push("Result: \u2717 DENIED (role requirement not met)"),i.join(`
+`);i.push("Roles: \u2713 OK")}if(r.allowOwner){let m=n?.ownerId!==void 0&&n.ownerId===e.id;if(i.push(`Owner bypass: resource.ownerId=${n?.ownerId??"undefined"}, user.id=${e.id}`),m)return i.push("Result: \u2713 ALLOWED (owner bypass)"),i.join(`
+`);i.push("Owner bypass: not owner, continuing to perm check")}let o=this.describeBits(r.action);i.push(`Required: ${o} (${r.action})`);let s=e.perms,a=s?.[r.resource],c=s?.["*"],l=a??c??0,u=a!==void 0?r.resource:c!==void 0?"*":"none",p=this.describeBits(l);if(i.push(`User Perms: ${p||"none"} (from: ${u})`),i.push(`User Mask: ${l}`),!((l&r.action)===r.action))return i.push(`Result: \u2717 DENIED (capability mismatch: ${l} & ${r.action} = ${l&r.action})`),i.join(`
+`);if(r.boundary!=="global"){if(!n)return i.push(`Boundary: ${r.boundary} - MISSING RESOURCE CONTEXT`),i.push("Result: \u2717 DENIED (no resource context for boundary check)"),i.join(`
+`);if(!this.checkBoundary(e,r.boundary,n).ok)return i.push(`Boundary: ${r.boundary} - VIOLATED`),r.boundary==="tenant"?(i.push(`  User tenantId: ${e.tenantId||"undefined"}`),i.push(`  Resource tenantId: ${n.tenantId||"undefined"}`)):(r.boundary==="owner"||r.boundary==="self")&&(i.push(`  User id: ${e.id}`),i.push(`  Resource ownerId: ${n.ownerId||"undefined"}`)),i.push("Result: \u2717 DENIED (boundary violation)"),i.join(`
+`);i.push(`Boundary: ${r.boundary} - OK`)}return i.push("Result: \u2713 ALLOWED"),i.join(`
+`)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function Ai(){return new Dc}function Ih(t,e){return t?.[e]??t?.["*"]??0}var B_="AUTH_INVALID_CREDENTIALS",Pc=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[rr.JWT,rr.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return d($t({message:"No auth methods configured"}));for(let i of n){let o=this.methods.get(i);if(!o)continue;let s=await o.authenticate(r);if(s.ok)return T({user:s.data,method:i});if(!s.errors||s.errors.length===0)continue;let a=s.errors[0];if(a?.code===B_)return d(a)}return d($t())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function Ti(t,e={}){return new Pc(t,e)}var Ds={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function Dn(t,e){return{name:rr.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return d(nr({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return d(nn({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return d(nr({message:"Bearer token is empty"}));let o=await e(i,t);if(!o.ok){let a=o.errors[0];return a?.code===Ds.TOKEN_EXPIRED?d(Hr()):a?.code===Ds.TOKEN_MALFORMED?d(nn()):d(qt())}let s=o.data;return s.exp&&s.exp<Date.now()/1e3?d(Hr()):T({id:s.sub,perms:s.perms,tenantId:s.tid,tenantType:s.tty,roles:s.roles??[]})}}}function Uc(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function Pn(t){return{name:rr.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return d(nr({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?T({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):d(qt({message:"Invalid API key"}))}}}ra();function Sl(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var SI="x-gateway-auth";function Ro(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??SI;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let o=Sl(e);n=Vt({kty:"OKP",crv:"Ed25519",x:o},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:rr.GATEWAY_JWT,async authenticate(o){if(e!==void 0){let l=o.headers[r];if(!l)return d(nr({message:`${r} header required`}));if(!l.startsWith("Bearer "))return d(qt({message:`${r} must use Bearer scheme`}));let u=l.slice(7);if(!u)return d(nr({message:"Gateway JWT is empty"}));let p;try{let f=await i(),{payload:m}=await jn(u,f,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=m}catch(f){return f.code==="ERR_JWT_EXPIRED"?d(Hr({message:"Gateway JWT expired"})):d(qt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let f=typeof p.jti=="string"?p.jti:void 0;if(!f)return d(qt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(f))return d(qt({message:"Gateway JWT jti already used (replay)"}))}}let s=Uc(o.headers);if(s===null)return o.headers.authorization??o.headers.Authorization?d(nn({message:"Authorization header must use Bearer scheme"})):d(nr({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(s,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===Ds.TOKEN_EXPIRED?d(Hr()):l?.code===Ds.TOKEN_MALFORMED?d(nn()):d(qt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?d(Hr()):T({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var bM=globalThis.performance;ra();var jI="TOKEN_EXPIRED",WE="TOKEN_MALFORMED";function GI(t){return"secret"in t}function $I(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function qI(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=Sl(t);return Vt({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function zE(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function WI(t){try{let e=atob(t);return zE(e)}catch{return null}}async function zI(t){if(GI(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=zE(e);if(n)return Vt(n,r);let i=WI(e);return i?Vt(i,r):r==="EdDSA"&&$I(e)?qI(e):bl(e,r)}function JI(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function Ar(t){let e=null;return async(r,n)=>{try{e||(e=zI(t));let i=await e,{payload:o}=await jn(r,i,JI(t));return T(o)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?d({code:jI,message:"Token has expired"}):d({code:WE,message:i.message}):d({code:WE,message:"JWT verification failed"})}}}function gp(t){let e=[];if(t.auth.jwt){let o=t.auth.jwt,s=o.verify??Ar(o);e.push(Dn(o,s))}t.auth.apiKey&&e.push(Pn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Ti(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=Ai(),i=t.errorHttpMap?{...Ot,...t.errorHttpMap}:{...Ot};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as YI}from"crypto";async function vp(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??YI();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function dn(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:io(t)}:{status:e?.error??400,body:io(t)}}var Oo=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function ko(t,e){let r=e?.name;return function(i){if(i.ok)return dn(i);let o=i.errors[0]?.code;if(!o||!(o in t))throw new Oo(o,i,r);let s=t[o];return dn(i,{error:s})}}function Co(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof Oo)return dn(n.result,{error:e});throw n}}}var XI={...Ot},j1=Co(ko(XI),400);var lK=_("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var QE=Symbol();var ZE=(t,e)=>new Response(t,{headers:{"Content-Type":e.replace(/^[^;]+/,r=>r.toLowerCase())}}).formData();var ix=1e4,Ol=t=>"headers"in t,ry=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,i=(Ol(t)?t.headers:t.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?ox(t,{all:r,dot:n}):{}};async function ox(t,e){if(!Ol(t)&&t.bodyCache.formData)return ey(await t.bodyCache.formData,e);let r=Ol(t)?t.headers:t.raw.headers,n=await t.arrayBuffer(),i=ZE(n,r.get("Content-Type")||"");Ol(t)||(t.bodyCache.formData=i);let o=await i;return o?ey(o,e):{}}function ey(t,e){let r=Object.create(null),n={count:0};return t.forEach((i,o)=>{e.all||o.endsWith("[]")?sx(r,o,i):r[o]=i}),e.dot&&Object.entries(r).forEach(([i,o])=>{i.includes(".")&&(ax(r,i,o,n),delete r[i])}),r}var sx=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},ax=(t,e,r,n)=>{if(/(?:^|\.)__proto__\./.test(e))return;let i=t,o=e.split(".",34);o.length>33&&ty(),o.forEach((s,a)=>{a===o.length-1?i[s]=r:((!i[s]||typeof i[s]!="object"||Array.isArray(i[s])||i[s]instanceof File)&&(n.count++>=ix&&ty(),i[s]=Object.create(null)),i=i[s])})},ty=()=>{throw new Error("Nesting limit exceeded")};var Tp=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},ny=t=>{let{groups:e,path:r}=cx(t),n=Tp(r);return lx(n,e)},cx=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},lx=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},kl={},iy=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return kl[n]||(r[2]?kl[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:kl[n]=[t,r[1],!0]),kl[n]}return null},oy=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},ux=t=>oy(t,decodeURI),_p=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let o=e.indexOf("?",n),s=e.indexOf("#",n),a=o===-1?s===-1?void 0:s:s===-1?o:Math.min(o,s),c=e.slice(r,a);return ux(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var sy=t=>{let e=_p(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},qn=(t,e,...r)=>(r.length&&(e=qn(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),Cl=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(i.charCodeAt(i.length-1)===63){r.length===0&&n===""?r.push("/"):r.push(n);let o=i.slice(0,-1);n+="/"+o,r.push(n)}else n+="/"+i}),r.filter((i,o,s)=>s.indexOf(i)===o)},Po=t=>t.indexOf("%")!==-1?oy(t,dx):t,Ap=t=>(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),Po(t)),ay=(t,e,r)=>{let n=t.indexOf("#",8);n!==-1&&(t=t.slice(0,n));let i;if(!r&&e&&e.indexOf("%")===-1&&e.indexOf("+")===-1){let a=t.indexOf("?",8);if(a===-1)return;for(t.startsWith(e,a+1)||(a=t.indexOf(`&${e}`,a+1));a!==-1;){let c=t.charCodeAt(a+e.length+1);if(c===61){let l=a+e.length+2,u=t.indexOf("&",l);return Ap(t.slice(l,u===-1?void 0:u))}else if(c==38||isNaN(c))return"";a=t.indexOf(`&${e}`,a+1)}if(i=/[%+]/.test(t),!i)return}let o=Object.create(null);i??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let a=t.indexOf("&",s+1),c=t.indexOf("=",s);c>a&&a!==-1&&(c=-1);let l=t.slice(s+1,c===-1?a===-1?void 0:a:c);if(i&&(l=Ap(l)),s=a,l==="")continue;let u;c===-1?u="":(u=t.slice(c+1,a===-1?void 0:a),i&&(u=Ap(u))),r?(o[l]&&Array.isArray(o[l])||(o[l]=[]),o[l].push(u)):o[l]??=u}return e?o[e]:o},cy=ay,ly=(t,e)=>ay(t,e,!0),dx=decodeURIComponent;var uy=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r}param(t){return t?this.#r(t):this.#o()}#r(t){let e=this.#t[0][this.routeIndex]?.[1][t],r=this.#i(e);return r&&Po(r)}#o(){let t={},e=Object.keys(this.#t[0][this.routeIndex]?.[1]??{});for(let r of e){let n=this.#i(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=Po(n))}return t}#i(t){return this.#t[1]?this.#t[1][t]:t}query(t){return cy(this.url,t)}queries(t){return ly(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e=Object.create(null);return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return ry(this,t)}#n=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;for(let i in e)return e[i].then(o=>{i==="json"&&(o=JSON.stringify(o));let s=i==="formData"?void 0:r.headers.get("content-type");return new Response(o,{headers:s?{"Content-Type":s}:void 0})[t]()});return e[t]=r[t]()};json(){return this.#n("text").then(t=>JSON.parse(t))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(t,e){(this.#e??={})[t]=e}valid(t){return this.#e?.[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[QE](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var dy={Stringify:1,BeforeStream:2,Stream:3},px=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var Ip=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let o=t.callbacks;if(!o?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let s=Promise.all(o.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>Ip(c,e,!1,n,i))).then(()=>i[0]));return r?px(await s,o):s};var fx="text/plain; charset=UTF-8",xp=(t,e)=>({"Content-Type":t,...e}),ia=(t,e)=>new Response(t,e),bp=class{#e;#t;env={};#r;finalized=!1;error;#o;#i;#n;#c;#s;#a;#u;#d;#p;constructor(t,e){this.#e=t,e&&(this.#i=e.executionCtx,this.env=e.env,this.#a=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#t??=new uy(this.#e,this.#p,this.#d),this.#t}get event(){if(this.#i&&"respondWith"in this.#i)return this.#i;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#i)return this.#i;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=ia(null,{headers:this.#u??=new Headers})}set res(t){if(this.#n&&t){t=ia(t.body,t);for(let[e,r]of this.#n.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#n.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#n=t,this.finalized=!0}render=(...t)=>(this.#s??=e=>this.html(e),this.#s(...t));setLayout=t=>this.#c=t;getLayout=()=>this.#c;setRenderer=t=>{this.#s=t};header=(t,e,r)=>{this.finalized&&(this.#n=ia(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#u??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#o=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#l(t,e,r){let n=this.#n?new Headers(this.#n.headers):this.#u;if(typeof e=="object"&&e.headers){n??=new Headers;for(let[o,s]of new Headers(e.headers))o==="set-cookie"?n.append(o,s):n.set(o,s)}if(r){if(!n){let o=0;for(let s in r)if(++o>1||typeof r[s]!="string"){n=new Headers;break}}if(n)for(let o in r){let s=r[o];if(typeof s=="string")n.set(o,s);else{n.delete(o);for(let a of s)n.append(o,a)}}}let i=typeof e=="number"?e:e?.status??this.#o;return ia(t,{status:i,headers:n??r})}newResponse=(...t)=>this.#l(...t);body=(t,e,r)=>this.#l(t,e,r);text=(t,e,r)=>!this.#u&&!this.#o&&!e&&!r&&!this.finalized?new Response(t):this.#l(t,e,xp(fx,r));json=(t,e,r)=>this.#l(JSON.stringify(t),e,xp("application/json",r));html=(t,e,r)=>{let n=i=>this.#l(i,e,xp("text/html; charset=UTF-8",r));return typeof t=="object"?Ip(t,dy.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#a??=()=>ia(),this.#a(this))};var Sp=(t,e,r)=>(n,i)=>{let o=-1;return s(0);async function s(a){if(a<=o)throw new Error("next() called multiple times");o=a;let c,l=!1,u;if(t[a]?(u=t[a][0][0],n.req.routeIndex=a):u=a===t.length&&i||void 0,u)try{c=await u(n,()=>s(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var py=["get","post","put","delete","options","patch","query"],Dl="Can not add a route since the matcher is already built.",Pl=class extends Error{};var fy="__COMPOSED_HANDLER";var mx=t=>t.text("404 Not Found",404),my=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},hy=class Ey{get;post;put;delete;options;patch;query;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[...py,"all"].forEach(i=>{this[i]=(o,...s)=>{let a=i.toUpperCase();return typeof o=="string"?this.#e=o:this.#o(a,this.#e,o),s.forEach(c=>{this.#o(a,this.#e,c)}),this}}),this.on=(i,o,...s)=>{for(let a of[o].flat()){this.#e=a;for(let c of[i].flat()){let l=c.toUpperCase();for(let u of s)this.#o(l,this.#e,u)}}return this},this.use=(i,...o)=>(typeof i=="string"?this.#e=i:(this.#e="*",o.unshift(i)),o.forEach(s=>{this.#o("ALL",this.#e,s)}),this);let{strict:r,...n}=e;Object.assign(this,n),this.getPath=r??!0?e.getPath??_p:sy}#t(){let e=new Ey({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=mx;errorHandler=my;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let o;r.errorHandler===my?o=i.handler:(o=async(s,a)=>(await Sp([],r.errorHandler)(s,()=>i.handler(s,a))).res,o[fy]=i.handler),n.#o(i.method,i.path,o,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=qn(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,o;n&&(typeof n=="function"?o=n:(o=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let s=o?c=>{let l=o(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=qn(this._basePath,e),l=c==="/"?0:c.length;return u=>{let p=new URL(u.url);return p.pathname=this.getPath(u).slice(l)||"/",new Request(p,u)}})();let a=async(c,l)=>{let u=await r(i(c.req.raw),...s(c));if(u)return u;await l()};return this.#o("ALL",qn(e,"*"),a),this}#o(e,r,n,i){r=qn(this._basePath,r);let o={basePath:i!==void 0?qn(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,o]),this.routes.push(o)}#i(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#n(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#n(e,r,n,"GET")))();let o=this.getPath(e,{env:n}),s=this.router.match(i,o),a=new bp(e,{path:o,matchResult:s,env:n,executionCtx:r,notFoundHandler:this.#r});if(s[0].length===1){let l;try{l=s[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#i(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#i(u,a)):l??this.#r(a)}let c=Sp(s[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#i(l,a)}})()}fetch=(e,...r)=>this.#n(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${qn("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#n(e.request,e,void 0,e.request.method))})}};var ut=()=>Object.create(null);var Ul=[];function wp(t,e){let r=this.buildAllMatchers(),n=((i,o)=>{let s=r[i]||r.ALL,a=s[2][o];if(a)return a;let c=o.match(s[0]);if(!c)return[[],Ul];let l=c.indexOf("",1);return[s[1][l],c]});return this.match=n,n(t,e)}var Rp="[^/]+";var Op="(?:|/.*)",Wn=Symbol(),yy=new Set(".\\+*[^]$()");function hx(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1?1:t===".*"||t==="(?:|/.*)"?e==="(?:|/.*)"?-1:1:e===".*"||e==="(?:|/.*)"?-1:t==="[^/]+"?1:e==="[^/]+"?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var gy=class Np{#e;#t;#r=ut();insert(e,r,n,i,o){let s=this;for(let a=0,c=e.length;a<c;a++){let l=e[a],u=l.length===1?l==="*"?a===c-1?["","",".*"]:["","",Rp]:null:l==="/*"?["","",Op]:l.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),p;if(u){let f=u[1],m=u[2]||"[^/]+";if(f&&u[2]&&(m===".*"||(m=m.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(m))||m.length===1&&yy.has(m)))throw Wn;if(p=s.#r[m],!p){if(m!==".*"&&m!=="(?:|/.*)"){for(let E in s.#r)if((m.length>1||E.length>1)&&E!==".*"&&E!=="(?:|/.*)")throw Wn}p=s.#r[m]=new Np}f!==""&&(p.#t??=i.varIndex++,n.push([f,p.#t]))}else if(p=s.#r[l],!p){for(let f in s.#r)if(f.length>1&&f!==".*"&&f!=="(?:|/.*)")throw Wn;p=s.#r[l]=new Np}s=p}if(s.#e!==void 0)throw Wn;s.#e=o?-1:r}buildRegExpStr(){let e=Object.keys(this.#r).sort(hx).map(r=>{let n=this.#r[r],i=n.buildRegExpStr();return i===""?"":(typeof n.#t=="number"?`(${r})@${n.#t}`:yy.has(r)?`\\${r}`:r)+i}).filter(Boolean);return typeof this.#e=="number"&&this.#e!==-1&&e.unshift(`#${this.#e}`),e.length===0?"":e.length===1?e[0]:"(?:"+e.join("|")+")"}};var kp=class{#e={varIndex:0};#t=new gy;#r=0;paths=ut();insert(t,e){if(e){this.#t.insert(t.split(""),0,[],this.#e,!0);return}let r=[],n=[],i=t;for(let s=0;;){let a=!1;if(i=i.replace(/\{[^}]+\}/g,c=>{let l=`@\\${s}`;return n[s]=[l,c],s++,a=!0,l}),!a)break}let o=i.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let s=n.length-1;s>=0;s--){let[a]=n[s];for(let c=o.length-1;c>=0;c--)if(o[c].indexOf(a)!==-1){o[c]=o[c].replace(a,n[s][1]);break}}this.#t.insert(o,this.#r,r,this.#e,!1),this.paths[t]=[this.#r++,r]}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,o,s)=>o!==void 0?(r[++e]=Number(o),"$()"):(s!==void 0&&(n[Number(s)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var vy=ut();function Ay(t){return vy[t]??=new RegExp(`^${t.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,(e,r)=>r?`\\${r}`:e==="/*"?Op:e==="*"?".*":`/:${Rp}`)}$`)}function Ll(t,e){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(Ay(r).test(e))return[...t[r]]}var Ml=class{name="RegExpRouter";#e;#t;#r;constructor(){this.#e={ALL:ut()},this.#t={ALL:ut()},this.#r={ALL:new kp}}#o(t,e){try{this.#r[t].insert(e,!/\*|\/:/.test(e))}catch(r){throw r===Wn?new Pl(e):r}}add(t,e,r){let n=this.#e,i=this.#t;if(!n)throw new Error(Dl);if(!n[t]){this.#r[t]=new kp;for(let a of[n,i]){a[t]=ut();for(let c in a.ALL)a[t][c]=[...a.ALL[c]],this.#o(t,c)}}e==="/*"&&(e="*");let o=t==="ALL"?Object.keys(n):[t];if(/\*$/.test(e)){let a=Ay(e);for(let c of o)n[c][e]||(this.#o(c,e),n[c][e]=Ll(n[c],e)||Ll(n.ALL,e)||[]);for(let c of[n,i])for(let l of o)for(let u in c[l])a.test(u)&&c[l][u].push([r,e]);return}let s=Cl(e)||[e];for(let a of s)for(let c of o)i[c][a]||(this.#o(c,a),i[c][a]=Ll(n[c],a)||Ll(n.ALL,a)||[]),i[c][a].push([r,a])}match=wp;buildAllMatchers(){let t=ut();for(let e of Object.keys(this.#t))t[e]=this.#i(e);return this.#e=this.#t=this.#r=void 0,vy=ut(),t}#i(t){let e=this.#e[t],r=this.#t[t],n=this.#r[t],i=ut(),o=[],[s,a,c]=n.buildRegExp();for(let l of[e,r])for(let u in l){let p=l[u],f=n.paths[u];if(!f){i[u]=[p.map(([m])=>[m,ut()]),Ul];continue}o[f[0]]=p.map(([m,E])=>[m,n.paths[E][1].reduceRight((v,[N],S)=>(v[N]=c[f[1][S][1]],v),ut())])}return[s,a.map(l=>o[l]),i]}};var Ty=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(Dl);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,o=0,s;for(;o<i;o++){let a=r[o];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);s=a.match(t,e)}catch(c){if(c instanceof Pl)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(o===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,s}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var Cp=ut(),Ex=0,_y=class Iy{#e=[];#t=ut();#r=[];#o;#i=Cp;insert(e,r,n){let i=this,o=ny(r),s=new Set,a=0;for(let c of o){let l=o[++a],u=iy(c,l)||(l===void 0&&c&&c.indexOf("*")===c.length-1?c:null),p=Array.isArray(u),f=p?u[0]:u||c,m=i.#t[f]||=new Iy;u&&!m.#o&&(m.#o=u,i.#r.push(m)),i=m,p&&s.add(u[1])}i.#e.push({[e]:{handler:n,possibleKeys:[...s],score:++Ex}})}#n(e,r,n,i,o){for(let s=0,a=r.#e.length;s<a;s++){let c=r.#e[s],l=c[n]||c.ALL;if(l){l.params=ut(),e.push(l);for(let u=0,p=l.possibleKeys.length;u<p;u++){let f=l.possibleKeys[u];l.params[f]=o?.[f]&&!u?o[f]:i[f]??o?.[f]}}}}search(e,r){let n=[];this.#i=Cp;let i=[this],o=Tp(r),s=[],a=o.length,c=null;for(let l=0;l<a;l++){let u=o[l],p=l===a-1,f=[];for(let E=0,v=i.length;E<v;E++){let N=i[E],S=N.#t[u];S&&(S.#i=N.#i,p?(S.#t["*"]&&this.#n(n,S.#t["*"],e,N.#i),this.#n(n,S,e,N.#i)):f.push(S));for(let R of N.#r){let M=R.#o,K=N.#i===Cp?{}:{...N.#i};if(typeof M=="string"){(M==="*"||u.startsWith(M.slice(0,-1)))&&(this.#n(n,R,e,N.#i),M==="*"&&(R.#i=K,f.push(R)));continue}let[,B,V]=M;if(!(!u&&V===!0)){if(V!==!0){if(!c){c=[];let x=r[0]==="/"?1:0;for(let b=0;b<a;b++)c[b]=x,x+=o[b].length+1}let $=r.slice(c[l]),A=V.exec($);if(A){K[B]=A[0],this.#n(n,R,e,N.#i,K),A[0].length===$.length&&R.#t["*"]&&this.#n(n,R.#t["*"],e,N.#i,K);for(let x in R.#t){R.#i=K;let b=A[0].match(/\//g)?.length??0;(s[b]||=[]).push(R);break}continue}}(V===!0||V.test(u))&&(K[B]=u,p?(this.#n(n,R,e,K,N.#i),R.#t["*"]&&this.#n(n,R.#t["*"],e,K,N.#i)):(R.#i=K,f.push(R)))}}}let m=s.shift();i=m?f.concat(m):f}return n[1]&&n.sort((l,u)=>l.score-u.score),[n.map(({handler:l,params:u})=>[l,u])]}};var Dp=class{name="TrieRouter";#e=new _y;add(t,e,r){for(let n of Cl(e)||[e])this.#e.insert(t,n,r)}match(t,e){return this.#e.search(t,e)}};var Gr=class extends hy{constructor(t={}){super(t),this.router=t.router??new Ty({routers:[new Ml,new Dp]})}};function Pp(t){let e=[];if(t.auth.jwt){let o=t.auth.jwt,s=o.verify??Ar(o);e.push(Dn(o,s))}t.auth.apiKey&&e.push(Pn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Ti(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=Ai(),i=t.errorHttpMap?{...Ot,...t.errorHttpMap}:{...Ot};return{auth:r,permission:n,errorHttpMap:i}}function or(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var Up={...Ot},xy=Co(ko(Up),400);function Lp(t){Up={...Ot,...t},xy=Co(ko(Up),400)}function by(){return xy}function Ge(t,e,r){let{traceId:n,successStatus:i,adapter:o=by()}=r??{},s=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:s}},l=o(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let u=e.ok?T(e.data,a):{...e,meta:a},p=io(u);return t.json(p,l)}async function yx(t){let e={};t.req.raw.headers.forEach((s,a)=>{e[a]=s});let r={},n=t.req.query();for(let[s,a]of Object.entries(n))r[s]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function oa(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,o)=>{let s=or(i);try{let a=await yx(i),c=await e.resolve(n,a);if(!c.ok){if(r){await o();return}return Ge(i,d($t()),{traceId:s})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await o()}catch{if(r){await o();return}return Ge(i,d($t()),{traceId:s})}}}function Mp(t){return async(e,r)=>{let n=or(e),i=e.get("authResult");if(!i)return Ge(e,d($t()),{traceId:n});let{user:o}=i,s;if(t.loadResource){let l=e.req.param(),u=await t.loadResource(l,o);if(u===null)return Ge(e,d(Wt({message:"Resource not found for boundary check"})),{traceId:n});s=u}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(o,a,s);if(!c.ok)return Ge(e,c,{traceId:n});await r()}}function sa(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?d(r.issues.map(n=>{let i=n.path?.map(o=>typeof o=="object"?o.key:o).join(".")??"";return gi({message:i?`${i}: ${n.message}`:n.message})})):T(r.value)}function aa(t){return async(e,r)=>{let n=or(e);try{let i={};if(t.body){let o;try{o=await e.req.json()}catch{return Ge(e,d(oo({reason:"Request body is not valid JSON"})),{traceId:n})}let s=sa(t.body,o);if(!s.ok)return Ge(e,s,{traceId:n});i.body=s.data}if(t.params){let o=sa(t.params,e.req.param());if(!o.ok)return Ge(e,o,{traceId:n});i.params=o.data}if(t.query){let o=sa(t.query,e.req.query());if(!o.ok)return Ge(e,o,{traceId:n});i.query=o.data}if(t.headers){let o={};e.req.raw.headers.forEach((a,c)=>{o[c]=a});let s=sa(t.headers,o);if(!s.ok)return Ge(e,s,{traceId:n});i.headers=s.data}e.set("validatedData",i),await r()}catch(i){let o={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return Ge(e,d(gi(),o),{traceId:n})}}}function ca(t){return t.get("validatedData")?.body}function la(t){return t.get("validatedData")?.params}function ua(t){return t.get("validatedData")?.query}var t2=_("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function gx(t,e){let r=[...t,e];return async(n,i)=>{let o,s=async a=>{if(o||a>=r.length){!o&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await s(a+1)});l instanceof Response&&(o=l)};return await s(0),o}}function X(t,e){let r=[];if(e.auth!==!1){let o=Array.isArray(e.auth)?e.auth:void 0;r.push(oa({engine:t.auth,methods:o}))}e.permission&&r.push(Mp({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(o,s)=>{let a={body:void 0,query:void 0,params:o,user:s};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(aa({body:e.input.body,query:e.input.query,params:e.input.params}));let i=gx(r,async o=>{let s=or(o);try{let a=o.get("authResult"),c={body:ca(o),query:ua(o),params:la(o),user:a?.user,tenantContext:o.get("tenantContext"),traceId:s},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},u=await e.handler(l),p=e.successStatus??200;return Ge(o,u,{traceId:s,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:s,route:`${e.method} ${e.path}`,error:{message:c}})),Ge(o,d(so()),{traceId:s})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function Kp(t,e){let r=new Gr;for(let n of e){let{method:i,path:o}=n.routeMeta,s=o==="/"?t:`${t}${o}`;switch(i){case"GET":r.get(s,n);break;case"POST":r.post(s,n);break;case"PUT":r.put(s,n);break;case"PATCH":r.patch(s,n);break;case"DELETE":r.delete(s,n);break}}return r}var Sy={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var Kl,vx={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function Ax(t){return!t&&!Kl?vx:{lang:t?.lang??Kl?.lang,message:t?.message,abortEarly:t?.abortEarly??Kl?.abortEarly,abortPipeEarly:t?.abortPipeEarly??Kl?.abortPipeEarly}}var Tx;function _x(t){return Tx?.get(t)}var Ix;function xx(t){return Ix?.get(t)}var bx;function Sx(t,e){return bx?.get(t)?.get(e)}function Ri(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function dt(t,e,r,n,i){let o=i&&"input"in i?i.input:r.value,s=i?.expected??t.expects??null,a=i?.received??Ri(o),c={kind:t.kind,type:t.type,input:o,expected:s,received:a,message:`Invalid ${e}: ${s?`Expected ${s} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",u=i?.message??t.message??Sx(t.reference,c.lang)??(l?xx(c.lang):null)??n.message??_x(c.lang);u!==void 0&&(c.message=typeof u=="function"?u(c):u),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}function wx(t,e){return t===e||Number.isNaN(t)&&Number.isNaN(e)}function Nx(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function Ny(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}function Jt(t){return t["~standard"]={version:1,vendor:"valibot",validate:e=>t["~run"]({value:e},Ax())},t}var Rx=/^[\w+-]+(?:\.[\w+-]+)*@[\da-zA-Z]+(?:[.-][\da-zA-Z]+)*\.[a-zA-Z]{2,}$/u;function Hl(t,e){return{kind:"validation",type:"check",reference:Hl,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&dt(this,"input",r,n),r}}}function pn(t){return{kind:"validation",type:"email",reference:pn,expects:null,async:!1,requirement:Rx,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&dt(this,"email",e,r),e}}}function zn(t){return{kind:"validation",type:"integer",reference:zn,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&dt(this,"integer",e,r),e}}}function Dt(t,e){return{kind:"validation",type:"max_length",reference:Dt,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&dt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function Uo(t,e){return{kind:"validation",type:"max_value",reference:Uo,async:!1,expects:`<=${t instanceof Date?t.toJSON():Ri(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&dt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():Ri(r.value)}),r}}}function Hp(t,e){return{kind:"validation",type:"min_length",reference:Hp,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&dt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function Lo(t,e){return{kind:"validation",type:"min_value",reference:Lo,async:!1,expects:`>=${t instanceof Date?t.toJSON():Ri(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&dt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():Ri(r.value)}),r}}}function Mo(t){return{kind:"transformation",type:"transform",reference:Mo,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function Ox(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function Fp(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function Z(t,e){return Jt({kind:"schema",type:"array",reference:Z,expects:"Array",async:!1,item:t,message:e,"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let o=0;o<i.length;o++){let s=i[o],a=this.item["~run"]({value:s},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:o,value:s};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else dt(this,"type",r,n);return r}})}function yt(t){return Jt({kind:"schema",type:"boolean",reference:yt,expects:"boolean",async:!1,message:t,"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:dt(this,"type",e,r),e}})}function Ko(t,e){return Jt({kind:"schema",type:"literal",reference:Ko,expects:Ri(t),async:!1,literal:t,message:e,"~run"(r,n){return wx(r.value,this.literal)?r.typed=!0:dt(this,"type",r,n),r}})}function Oi(t,e){return Jt({kind:"schema",type:"nullable",reference:Oi,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=Fp(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}})}function qe(t){return Jt({kind:"schema",type:"number",reference:qe,expects:"number",async:!1,message:t,"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:dt(this,"type",e,r),e}})}function F(t,e){return Jt({kind:"schema",type:"object",reference:F,expects:"Object",async:!1,entries:t,message:e,"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let o in this.entries){let s=this.entries[o];if(o in i||(s.type==="exact_optional"||s.type==="optional"||s.type==="nullish")&&s.default!==void 0){let a=o in i?i[o]:Fp(s),c=s["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:o,value:a};for(let u of c.issues)u.path?u.path.unshift(l):u.path=[l],r.issues?.push(u);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[o]=c.value}else if(s.fallback!==void 0)r.value[o]=Ox(s);else if(s.type!=="exact_optional"&&s.type!=="optional"&&s.type!=="nullish"&&(dt(this,"key",r,n,{input:void 0,expected:`"${o}"`,path:[{type:"object",origin:"key",input:i,key:o,value:i[o]}]}),n.abortEarly))break}}else dt(this,"type",r,n);return r}})}function w(t,e){return Jt({kind:"schema",type:"optional",reference:w,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=Fp(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}})}function Yt(t,e){return Jt({kind:"schema",type:"picklist",reference:Yt,expects:Ny(t.map(Ri),"|"),async:!1,options:t,message:e,"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:dt(this,"type",r,n),r}})}function Ee(t,e,r){return Jt({kind:"schema",type:"record",reference:Ee,expects:"Object",async:!1,key:t,value:e,message:r,"~run"(n,i){let o=n.value;if(o&&typeof o=="object"){n.typed=!0,n.value={};for(let s in o)if(Nx(o,s)){let a=o[s],c=this.key["~run"]({value:s},i);if(c.issues){let u={type:"object",origin:"key",input:o,key:s,value:a};for(let p of c.issues)p.path=[u],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let u={type:"object",origin:"value",input:o,key:s,value:a};for(let p of l.issues)p.path?p.path.unshift(u):p.path=[u],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else dt(this,"type",n,i);return n}})}function y(t){return Jt({kind:"schema",type:"string",reference:y,expects:"string",async:!1,message:t,"~run"(e,r){return typeof e.value=="string"?e.typed=!0:dt(this,"type",e,r),e}})}function wy(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function da(t,e){return Jt({kind:"schema",type:"union",reference:da,expects:Ny(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,"~run"(r,n){let i,o,s;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)o?o.push(c):o=[c];else{i=c;break}else s?s.push(c):s=[c]}if(i)return i;if(o){if(o.length===1)return o[0];dt(this,"type",r,n,{issues:wy(o)}),r.typed=!0}else{if(s?.length===1)return s[0];dt(this,"type",r,n,{issues:wy(s)})}return r}})}function ge(){return Jt({kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,"~run"(t){return t.typed=!0,t}})}function Ue(...t){return Jt({...t[0],pipe:t,"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}})}var Vp=F({maskedRecipient:w(y()),expiresAt:y()}),Bp=F({userId:y(),verification:w(F({channel:y(),challengeId:y(),expiresAt:y(),identityType:y(),identityValue:y()}))});var Pt=F({message:w(y())}),Ry=F({accessToken:y(),refreshToken:w(y()),expiresAt:qe()}),Oy=F({requiresChallenge:Ko(!0),challenge:F({type:w(y()),phase:w(y()),expiresAt:w(da([y(),qe()])),data:Ee(y(),ge())})}),ky=F({requiresMfa:Ko(!0),mfa:F({phase:w(y()),challengeId:y(),methods:Z(y()),method:w(y()),expiresAt:da([y(),qe()]),userId:y()})}),Cy=F({requiresVerification:Ko(!0),verification:F({channel:Ko("email"),challengeId:y(),expiresAt:y(),identityType:y(),identityValue:y(),userId:y()})}),ki=da([Oy,ky,Cy,Ry]),pa=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),username:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),metadata:w(Ee(y(),ge())),createdAt:y(),updatedAt:y()}),fa=F({challengeId:y(),expiresAt:y()});var Bt=(t=100)=>Ue(y(),Dt(t)),Fl=Ue(y(),Dt(320)),Jn=Ue(y(),Dt(4096)),ma=(t=256)=>Ue(y(),Dt(t)),jp=(t=8192)=>Ue(y(),Dt(t)),ha=Ue(ge(),Mo(Number),qe(),zn(),Lo(1),Uo(100));var kx={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:F({identityType:Bt(),identityValue:Fl,credentialType:Bt(),credentialValue:w(Jn),metadata:w(Ee(Bt(),ge())),country:w(Bt()),city:w(Bt())}),response:ki},Cx={method:"POST",path:"/auth/register",kind:"data",public:!0,body:F({identityType:Bt(),identityValue:Fl,credentialType:Bt(),credentialValue:Jn,displayName:w(ma()),givenName:w(ma()),familyName:w(ma()),avatarUrl:w(jp(2048)),locale:w(Bt()),metadata:w(Ee(Bt(),ge()))}),response:Bp},Dx={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:F({challengeId:y(),code:y()}),response:ki},Px={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:F({challengeId:y(),method:y(),code:y()}),response:ki},Ux={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:F({challengeId:y(),method:y(),userId:y()}),response:Vp},Lx={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},Mx={method:"POST",path:"/auth/logout",kind:"logout",public:!0},Kx={method:"GET",path:"/auth/me",kind:"data",response:pa},Hx={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:F({tenantId:y()})},Ut={authenticate:kx,register:Cx,completeChallenge:Dx,completeMfaChallenge:Px,issueMfaChallenge:Ux,refresh:Lx,logout:Mx,me:Kx,selectTenant:Hx};var Gp=F({method:y(),data:Ee(y(),ge())}),$p=F({method:y(),verified:yt(),data:Ee(y(),ge())}),Dy=F({method:y(),verifiedAt:Oi(y()),createdAt:y(),id:w(y()),label:w(y()),lastUsedAt:w(y())}),qp=F({authenticators:Z(Dy),total:qe()});var Fx={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:F({method:y(),data:w(Ee(y(),ge()))}),response:Gp},Vx={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:F({method:y(),data:w(Ee(y(),ge())),authenticatorId:w(y())}),response:$p},Bx={method:"GET",path:"/mfa/authenticators",kind:"data",query:F({method:w(y()),verifiedOnly:w(yt())}),response:qp},jx={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:F({method:y(),authenticatorId:w(y()),password:w(y())}),response:F({message:w(y())})},Gx={method:"PATCH",path:"/mfa/settings",kind:"data",body:F({mfaRequired:w(yt()),mfaMethods:w(Z(y())),password:w(y())}),response:F({mfaRequired:w(yt()),mfaMethods:w(Z(y()))})},Tr={setupAuthenticator:Fx,verifyAuthenticator:Vx,listAuthenticators:Bx,removeAuthenticator:jx,updateMfaSettings:Gx};var Wp=F({state:y()}),Py=F({provider:y(),providerId:w(y()),email:w(y()),linkedAt:w(y())}),zp=Z(Py);var $x={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:Wp},qx={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:F({provider:Ue(y(),Dt(100)),code:w(Ue(y(),Dt(8192))),credential:w(Ue(y(),Dt(8192))),state:w(Ue(y(),Dt(1024))),tenantId:w(Ue(y(),Dt(100)))}),response:ki},Wx={method:"POST",path:"/oauth/link",kind:"data",body:F({provider:y(),code:w(y())}),response:Pt},zx={method:"POST",path:"/oauth/unlink",kind:"data",body:F({provider:y()}),response:Pt},Jx={method:"GET",path:"/oauth/providers",kind:"data",response:zp},mn={oauthState:$x,oauthCallback:qx,linkProvider:Wx,unlinkProvider:zx,getProviders:Jx};var Yx={method:"PATCH",path:"/password/change",kind:"data",body:F({currentPassword:Jn,newPassword:Jn}),response:Pt},Xx={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:F({email:Ue(y(),Dt(320),pn())}),response:fa},Qx={method:"POST",path:"/password/reset",kind:"data",public:!0,body:F({challengeId:Bt(),code:Bt(),newPassword:Jn}),response:Pt},hn={changePassword:Yx,forgotPassword:Xx,resetPassword:Qx};var Uy=F({id:y(),tokenId:y(),tenantId:w(y()),deviceLabel:w(y()),country:w(y()),city:w(y()),createdAt:y(),expiresAt:y(),lastUsedAt:y(),revokedAt:w(Oi(y())),metadata:w(Ee(y(),ge())),isCurrent:w(yt())}),Jp=Z(Uy);var Ly=F({id:y(),tenantId:y(),inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),status:y(),roles:w(Z(y())),authPerms:Z(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y()),invitedBy:w(ge()),createdAt:y(),updatedAt:y(),expiresAt:y()}),Yp=Z(Ly),Xp=F({inviteId:y(),inviteToken:y(),expiresAt:y()}),My=F({userId:y(),tenantId:y(),status:y(),roles:w(Z(y())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),updatedAt:y()}),Qp=F({members:Z(My)}),Vl=F({userId:y(),tenantId:y(),status:y(),roles:w(Z(y())),authPerms:Z(y()),isOwner:yt(),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),jobTitle:w(y()),contactEmail:w(y()),contactPhone:w(y()),bio:w(y()),locale:w(y()),metadata:w(Ee(y(),ge())),createdAt:w(y()),memberUpdatedAt:w(y()),profileUpdatedAt:w(y())}),Zp=F({tenantId:y(),roles:w(Z(y())),authPerms:Z(y())});var ef=F({userId:y(),identityType:y(),identityValue:y(),verifiedAt:y()});var eb={method:"GET",path:"/sessions",kind:"data",query:F({includeRevoked:w(Yt(["true","false"])),limit:w(ha),cursor:w(y())}),response:Jp},tb={method:"DELETE",path:"/sessions",kind:"data",body:F({sessionId:y()}),response:Pt},rb={method:"POST",path:"/sessions/revoke",kind:"data",body:F({refreshToken:y()}),response:Pt},En={listSessions:eb,deleteSession:tb,revokeToken:rb};var nb={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:Vl},ib={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:F({contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))}),response:Vl},ob={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:F({inviteeEmail:w(Ue(y(),pn())),inviteeUserId:w(y()),inviteePhone:w(y()),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),response:Xp},sb={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:F({status:w(y()),limit:w(ha),cursor:w(y())}),response:Yp},ab={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:F({inviteId:w(y()),inviteToken:w(y())}),response:Zp},cb={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:F({inviteId:w(y()),inviteToken:w(y())}),response:Pt},lb={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:F({inviteId:y()}),response:Pt},ub={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:F({limit:w(ha),cursor:w(y())}),response:Qp},db={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:F({userId:y(),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y()))}),response:Pt},pb={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:F({userId:y()}),response:Pt},tf={getTenantProfile:nb,updateTenantProfile:ib,createInvite:ob,listInvites:sb,acceptInvite:ab,declineInvite:cb,revokeInvite:lb,listMembers:ub,updateMember:db,removeMember:pb};var fb={method:"PATCH",path:"/users/profile",kind:"data",body:F({email:w(Ue(y(),pn())),phone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),metadata:w(Ee(y(),ge()))}),response:pa},Ea={updateProfile:fb};var mb={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:F({challengeId:y(),code:y()}),response:ef},hb={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:F({channel:Yt(["sms","email"]),identityValue:y(),previousChallengeId:w(y())}),response:fa},Ci={verifyCode:mb,resendVerification:hb};var JV={...Ut,...hn,...Ci,...En,...Tr,...mn,...Ea,...tf};var q={VALIDATION_ERROR:_("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:_("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:_("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:_("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:_("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:_("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:_("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:_("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:_("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:_("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:_("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:_("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:_("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:_("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:_("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function Ho(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function Yn(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:o,device:s}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=s?.deviceLabel,u={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...s?.country&&{country:s.country},...s?.city&&{city:s.city},...o?.roles&&{roles:o.roles},...o?.perms!==void 0&&{perms:o.perms}},p=await e.plugins.database.sessions.create(u);if(p.ok===!1)return d(p.errors,p.meta);if(!p.ok)return d(q.DATABASE_ERROR());let f=p.data,m=Ho(n,e.security),E=await e.plugins.token.signAccessToken({sub:r,sid:f.id,jti:f.tokenId,...m&&{aud:m},...n&&{tid:n},...i&&{tty:i},...o?.roles&&{roles:o.roles},...o?.perms!==void 0&&{perms:o.perms}},e.security.accessTokenLifetimeMinutes),v=await e.plugins.token.signRefreshToken({sub:r,sid:f.id,jti:f.tokenId,...m&&{aud:m},...n&&{tid:n},...i&&{tty:i}},e.security.refreshTokenLifetimeMinutes);return T({accessToken:E.token,refreshToken:v.token,expiresAt:E.expiresAt,...n&&{tenantId:n}})}var ya={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};function Ky(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function ga(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?d(ya.USER_NOT_FOUND()):T(Ky(r.data))}var rf={SCOPE_MISMATCH:_("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:q.DATABASE_ERROR};async function Bl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return T();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return d(rf.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?T():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?d(rf.DATABASE_ERROR()):T():T()}var yn={INVALID_TOKEN:_("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:_("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR,ACCOUNT_SUSPENDED:q.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:q.ACCOUNT_DELETED};var gn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(gn||(gn={}));async function jl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return d(yn.INVALID_TOKEN());if(r.typ!==gn.Refresh)return d(yn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return d(q.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return d(yn.INVALID_TOKEN());let o=Date.now();if(i.expiresAt.getTime()<=o)return d(yn.INVALID_TOKEN());let s=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&o-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!s&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?d(q.DATABASE_ERROR()):d(yn.INVALID_TOKEN());if(a&&!s){let E=Ho(i.tenantId,e.security),v=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...E&&{aud:E},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}},e.security.accessTokenLifetimeMinutes),N=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...E&&{aud:E},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}},e.security.refreshTokenLifetimeMinutes);return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),T({accessToken:v.token,refreshToken:N.token,expiresAt:v.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:o,expiresAt:new Date(o+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return d(q.DATABASE_ERROR());let u=Ho(i.tenantId,e.security);if(l.data===!1){let E=await e.plugins.database.sessions.get(i.id);if(E.ok===!1)return d(q.DATABASE_ERROR());let v=E.data;if(!v||v.revokedAt)return d(yn.INVALID_TOKEN());let N=await e.plugins.token.signAccessToken({sub:v.userId,sid:v.id,jti:v.tokenId,...u&&{aud:u},...v.tenantId&&{tid:v.tenantId},...v.tenantType&&{tty:v.tenantType},...v.perms!==void 0&&{perms:v.perms},...v.roles&&{roles:v.roles}},e.security.accessTokenLifetimeMinutes),S=await e.plugins.token.signRefreshToken({sub:v.userId,sid:v.id,jti:v.tokenId,...u&&{aud:u},...v.tenantId&&{tid:v.tenantId},...v.tenantType&&{tty:v.tenantType}},e.security.refreshTokenLifetimeMinutes);return T({accessToken:N.token,refreshToken:S.token,expiresAt:N.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...u&&{aud:u},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}},e.security.accessTokenLifetimeMinutes),f=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...u&&{aud:u},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}},e.security.refreshTokenLifetimeMinutes),m={accessToken:p.token,refreshToken:f.token,expiresAt:p.expiresAt};return T(m)}var bt={IDENTITY_PLUGIN_NOT_FOUND:Q("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:Q("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:_("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:_("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:_("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:Q("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:_("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:_("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:Q("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:Q("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:_("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:_("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:_("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:Q("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR,ACCOUNT_DELETED:q.ACCOUNT_DELETED};var Ve={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},_r={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},xe={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var sr={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function nf(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function Gl(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let s=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(s)}var Ze={SMS:"sms",EMAIL:"email"},Di={PHONE:"phone",EMAIL:"email"},Pi={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Xn={type:Ze.EMAIL,purpose:xe.EMAIL_VERIFICATION,identityType:Di.EMAIL,template:Pi.EMAIL_CODE};var Qn={type:Ze.SMS,purpose:xe.PHONE_VERIFICATION,identityType:Di.PHONE,template:Pi.SMS_CODE};var Ne={CHANNEL_NOT_CONFIGURED:_("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:_("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:_("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:_("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:_("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:_("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:_("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:_("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:_("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:_("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function _e(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function vn(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function $r(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return Eb(n)}async function Fo(t,e){let r=await $r(t);return r.length!==e.length?!1:yb(r,e)}function Eb(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function yb(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function gb(t){switch(t){case Ze.SMS:return Qn;case Ze.EMAIL:return Xn}}async function Vo(t,e){let r=gb(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,o=await e.plugins.database.identities.get(r.identityType,i);if(!o.ok||!o.data)return d(Ne.IDENTITY_NOT_FOUND());let s=o.data;if(s.verifiedAt)return d(Ne.IDENTITY_ALREADY_VERIFIED());let a=s.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,u=t.previousChallengeId===void 0&&l===c;if(!l)return d(Ne.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return d(p.errors,p.meta);let f=p.data;if(f&&(f.status!==Ve.PENDING||f.userId!==s.userId||f.purpose!==r.purpose||f.method!==r.type||f.identityType!==r.identityType||f.identityValue!==i))return d(Ne.CHALLENGE_NOT_FOUND());if(!f&&!u)return d(Ne.CHALLENGE_NOT_FOUND());let m=e.security.verificationResendCooldownSeconds*1e3,E=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(f?.createdAt.getTime()??0)+m;if(m>0&&Date.now()<E)return d(Ne.RESEND_COOLDOWN_ACTIVE());let v=vn(6),N=await $r(v),S=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),R=e.plugins.database.challenges.generateChallengeId(),M=await e.plugins.database.challenges.create({id:R,userId:s.userId,purpose:r.purpose,status:Ve.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:N,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:S});if(M.ok===!1)return d(M.errors,M.meta);let K=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,B=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:R,purpose:r.purpose,channel:r.type,expiresAt:S,resendAvailableAt:K}});return B.ok===!1?(await e.plugins.database.challenges.remove(R),d(B.errors,B.meta)):(await vb(t.channel,i,v,r.template,R,S,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(R),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),d(Ne.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),_e(e,{event:`verification_code_resent_${t.channel}`,userId:s.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:R,previousChallengeId:l}})]),T({challengeId:R,expiresAt:S}))}async function vb(t,e,r,n,i,o,s,a,c){let l={code:r,challengeId:i,expiresAt:o.toISOString(),purpose:s,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):d(Ne.CHANNEL_NOT_CONFIGURED())}function Ab(t){switch(t){case Ze.SMS:return Qn;case Ze.EMAIL:return Xn}}async function Bo(t,e){let r=Ab(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return d(Ne.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return d(Ne.IDENTITY_ALREADY_VERIFIED());let o=i.guards.email_verification;if(o?.lockedUntil&&new Date(o.lockedUntil)>new Date)return d(Ne.VERIFICATION_COOLDOWN_ACTIVE());let s=i.pendingVerification,a=s&&s.purpose===r.purpose&&s.channel===r.type&&s.expiresAt>new Date?s.challengeId:null;if(s?.resendAvailableAt&&s.purpose===r.purpose&&s.channel===r.type&&s.resendAvailableAt>new Date)return d(Ne.VERIFICATION_COOLDOWN_ACTIVE());let c=vn(6),l=await $r(c),u=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),f=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Ve.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:u});if(f.ok===!1)return d(f.errors,f.meta);let m=Math.max(0,e.security.verificationResendCooldownSeconds),E=m>0?new Date(Date.now()+m*1e3):null,v=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:u,resendAvailableAt:E}});return v.ok===!1?(await e.plugins.database.challenges.remove(p),d(v.errors,v.meta)):(await Tb(t.channel,t.identityValue,c,r.template,p,u,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:s??null}),d(Ne.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),_e(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),T({challengeId:p,expiresAt:u}))}async function Tb(t,e,r,n,i,o,s,a,c){let l={code:r,challengeId:i,expiresAt:o.toISOString(),purpose:s,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):d(Ne.CHANNEL_NOT_CONFIGURED())}var _b=[xe.PHONE_VERIFICATION,xe.EMAIL_VERIFICATION];async function jo(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(Ne.CHALLENGE_NOT_FOUND());let n=r.data;if(!_b.includes(n.purpose))return d(Ne.CHALLENGE_NOT_FOUND());if(n.status!==Ve.PENDING)return d(Ne.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return d(Ne.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?d(Ne.TOO_MANY_ATTEMPTS()):d(i.errors,i.meta);if(!n.codeHash)return d(Ne.INVALID_CODE());if(!await Fo(t.code,n.codeHash))return d(Ne.INVALID_CODE());let s=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:s,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await _e(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),T({userId:n.userId,identityType:a,identityValue:c,verifiedAt:s})}async function Hy(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:o,codeHash:s,challengeId:a,expiresAt:c,...l}=t.nextStepData,u={id:r,userId:t.userId,purpose:xe.LOGIN,status:Ve.PENDING,phase:_r.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(u.tenantId=t.tenantId),t.deviceLabel!==void 0&&(u.deviceLabel=t.deviceLabel),t.country!==void 0&&(u.country=t.country),t.city!==void 0&&(u.city=t.city),i!==void 0&&(u.codeHash=i),(await e.plugins.database.challenges.create(u)).ok===!1?d([q.DATABASE_ERROR()]):T({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:u.phase})}async function $l(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,o=t.userHasMethods.length===1&&t.deliveryMethods.length===0,s=i?t.deliveryMethods[0]:o?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:xe.LOGIN,status:Ve.PENDING,phase:s?_r.VERIFY_MFA:_r.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),s!==void 0&&(a.method=s),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return d(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...s!==void 0&&{selectedMethod:s}};return T(l)}var it={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"},va={OWNER:"owner"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var of={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},ql={ACCOUNT_DELETED:q.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:_(of.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:_(of.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_(of.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function qr(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return d(ql.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return d(ql.ACCOUNT_SUSPENDED());let o,s,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return d(ql.NO_ACCESS_TO_TENANT());let u=l.data;if(u.status!==it.ACTIVE)return d(ql.SUSPENDED_IN_TENANT());if(s=u.roles,o=u.isOwner?{"*":-1}:u.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return o!==void 0&&(c.perms=o),s!==void 0&&(c.roles=s),a!==void 0&&(c.tenantType=a),T(c)}function Aa(t,e){return e[t]??null}function Fy(t,e){return e[t]??null}async function Vy(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function By(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,o=r.security.maxFailedAttempts||5,s=i>=o,a=null;if(s){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>o){let u=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*u**(i-o),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function jy(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Ta(t,e){let r=t.tid,n=Aa(t.identityType,e.plugins.identity);if(!n)return d(bt.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return d(bt.INVALID_IDENTITY_FORMAT());let o=n.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,o);if(s.ok===!1||!s.data)return d(bt.INVALID_CREDENTIALS());let a=s.data;if(!a.loginEnabled)return d(bt.LOGIN_DISABLED());let c=nf(a,t.credentialType);if(c.locked)return d(bt.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=Fy(t.credentialType,e.plugins.credential);if(!l)return d(bt.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let u=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=u.ok?u.data:null,f=await l.verify({userId:a.userId,identityValue:o,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(f.ok===!1)return await By(a,t.credentialType,e),d(bt.INVALID_CREDENTIALS());let{userId:m,nextStep:E,intents:v}=f.data;v&&v.length>0&&await Vy(v,e);let N;if(t.userAgent&&e.plugins.deviceParser){let O=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),D=O.browser||"Unknown Browser",k=O.os||"Unknown OS";N=`${D} - ${k}`}if(E){let O={userId:m,credentialType:t.credentialType,identityType:t.identityType,identityValue:o,nextStepData:E.data,nextStepType:E.type};t.tid!==void 0&&(O.tenantId=t.tid),N!==void 0&&(O.deviceLabel=N),t.country!==void 0&&(O.country=t.country),t.city!==void 0&&(O.city=t.city);let D=await Hy(O,e);if(D.ok===!1)return d(D.errors,D.meta);if(!D.ok)return d(bt.INTERNAL_ERROR());let{challengeId:k,expiresAt:C,displayData:P,challengeType:L,phase:H}=D.data;return T({requiresChallenge:!0,challenge:{type:L,phase:H,expiresAt:C,data:{challengeId:k,expiresAt:C,...P}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return d(bt.IDENTITY_NOT_VERIFIED());let O=a.pendingVerification;if(!!O&&O.purpose===xe.EMAIL_VERIFICATION&&O.channel==="email"&&O.expiresAt>new Date&&O)return T({requiresVerification:!0,verification:{channel:"email",challengeId:O.challengeId,expiresAt:O.expiresAt,identityType:t.identityType,identityValue:o,userId:m}});let k=await Bo({channel:"email",identityValue:o,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!k.ok){let C=await e.plugins.database.identities.get(t.identityType,o),P=C.ok&&C.data?C.data.pendingVerification:null;return P&&P.purpose===xe.EMAIL_VERIFICATION&&P.channel==="email"&&P.expiresAt>new Date?T({requiresVerification:!0,verification:{channel:"email",challengeId:P.challengeId,expiresAt:P.expiresAt,identityType:t.identityType,identityValue:o,userId:m}}):d(bt.IDENTITY_NOT_VERIFIED())}return T({requiresVerification:!0,verification:{channel:"email",challengeId:k.data.challengeId,expiresAt:k.data.expiresAt,identityType:t.identityType,identityValue:o,userId:m}})}let S=await e.plugins.database.userAuths.get(m);if(S.ok===!1||!S.data)return d(bt.USER_AUTH_NOT_FOUND());let R=S.data,M={userStatus:R.userStatus,userId:m,...r&&{tenantId:r}},K=await qr(M,e);if(K.ok===!1)return d(K.errors,K.meta);if(!K.ok)return d(q.DATABASE_ERROR());let{perms:B,roles:V,tenantType:$}=K.data;if(R.mfaRequired){let O=R.mfaMethods;if(!(!O||O.length===0)){let D=O.filter(k=>e.plugins.mfa?.[k]);if(D.length!==0){let k=D.filter(me=>e.plugins.mfa?.[me]?.requiresServerDelivery),C=D.filter(me=>!e.plugins.mfa?.[me]?.requiresServerDelivery),P={};N!==void 0&&(P.deviceLabel=N),t.country!==void 0&&(P.country=t.country),t.city!==void 0&&(P.city=t.city);let L={userId:m,availableMethods:D,deliveryMethods:k,userHasMethods:C,device:P};t.tid!==void 0&&(L.tenantId=t.tid);let H=await $l(L,e);if(H.ok===!1)return d(H.errors,H.meta);if(!H.ok)return d(bt.INTERNAL_ERROR());let{challengeId:z,expiresAt:Y,phase:pe,selectedMethod:Oe,availableMethods:Fe}=H.data;return T({requiresMfa:!0,mfa:{phase:pe,challengeId:z,methods:Fe,...Oe&&{method:Oe},expiresAt:Y,userId:m}})}}}let A={userId:m,...r&&{tenantId:r},...$&&{tenantType:$},...B!==void 0||V?{permissions:{...V&&{roles:V},...B!==void 0&&{perms:B}}}:{},...N||t.country||t.city?{device:{...N&&{deviceLabel:N},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},x=await Yn(A,e);if(x.ok===!1)return d(x.errors,x.meta);if(!x.ok)return d(q.DATABASE_ERROR());let{accessToken:b,refreshToken:g,expiresAt:I}=x.data;return await Gl(m,e),await jy(a,t.credentialType,e),T({accessToken:b,refreshToken:g,expiresAt:I})}var gt={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:_("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:_("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:_("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:_("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};var Ib={CHALLENGE_CREATE_FAILED:_("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function Wy(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:o,device:s}=t;if(!r)return T({requiresMfa:!1});if(!n||n.length===0)return T({requiresMfa:!1});let a=n.filter(S=>e.plugins.mfa?.[S]);if(a.length===0)return T({requiresMfa:!1});let c=a.filter(S=>e.plugins.mfa?.[S]?.requiresServerDelivery),l=a.filter(S=>!e.plugins.mfa?.[S]?.requiresServerDelivery),u={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};o!==void 0&&(u.tenantId=o),s!==void 0&&(u.device=s);let p=await $l(u,e);if(p.ok===!1)return d(p.errors,p.meta);if(!p.ok)return d([Ib.CHALLENGE_CREATE_FAILED()]);let{challengeId:f,expiresAt:m,phase:E,selectedMethod:v,availableMethods:N}=p.data;return T({requiresMfa:!0,mfa:{phase:E,challengeId:f,methods:N,...v&&{method:v},expiresAt:m,userId:i}})}async function _a(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return d(gt.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Ve.PENDING)return d(gt.INVALID_CHALLENGE_STATE());if(n.phase!==_r.VERIFY_CREDENTIAL)return d(gt.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return d(gt.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),d(gt.CHALLENGE_EXPIRED());let o=n.method;if(!o)return d(gt.INTERNAL_ERROR());let s=e.plugins.credential[o];if(!s)return d(gt.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(I=>I.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Ve.EXPIRED}),d(gt.MAX_ATTEMPTS_EXCEEDED())):d(a.errors,a.meta);if((await s.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return d(gt.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return d(gt.USER_AUTH_NOT_FOUND());let u=l.data,p={userStatus:u.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let f=await qr(p,e);if(f.ok===!1)return d(f.errors,f.meta);if(!f.ok)return d(gt.INTERNAL_ERROR());let{perms:m,roles:E,tenantType:v}=f.data,N=n.deviceLabel,S=n.country,R=n.city,M={};N!==void 0&&(M.deviceLabel=N),S!==void 0&&(M.country=S),R!==void 0&&(M.city=R);let K={mfaRequired:u.mfaRequired,...u.mfaMethods&&{mfaMethods:u.mfaMethods},userId:n.userId,device:M},B=await Wy(K,e);if(B.ok===!1)return d(B.errors,B.meta);if(!B.ok)return d(gt.INTERNAL_ERROR());if(B.data.requiresMfa){let I={requiresMfa:!0,mfa:B.data.mfa};return T(I)}let V={};m!==void 0&&(V.perms=m),E!==void 0&&(V.roles=E);let $={userId:n.userId,permissions:V,device:M};i!==void 0&&($.tenantId=i),v!==void 0&&($.tenantType=v);let A=await Yn($,e);if(A.ok===!1)return d(A.errors,A.meta);if(!A.ok)return d(gt.INTERNAL_ERROR());let{accessToken:x,refreshToken:b,expiresAt:g}=A.data;return T({accessToken:x,refreshToken:b,expiresAt:g})}var ot={MFA_CHALLENGE_NOT_FOUND:_("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:_("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:_("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:_("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:_("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:_("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function Ia(t,e){if(!e.plugins.mfa)return d(ot.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(ot.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,o=n.deviceLabel,s=n.country,a=n.city;if(n.status!==Ve.PENDING)return d(ot.INVALID_CHALLENGE_STATE());if(n.phase!==_r.VERIFY_MFA)return d(ot.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return d(ot.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),d(ot.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return d(ot.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return d(ot.MFA_METHOD_NOT_SUPPORTED());let u=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(u.ok===!1)return u.errors.some($=>$.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),d(ot.TOO_MANY_ATTEMPTS())):d(u.errors,u.meta);if(l.requiresServerDelivery){if(!n.codeHash)return d(ot.INVALID_CHALLENGE_STATE());if(!await Fo(t.code,n.codeHash))return d(ot.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return d(ot.MFA_METHOD_NOT_SUPPORTED());let $=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if($.ok===!1||!$.data)return d(ot.INVALID_MFA_CODE());let A=$.data;if(!A.verifiedAt)return d(ot.INVALID_MFA_CODE());let x=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(x.ok===!1||!x.data.verified)return d(ot.INVALID_MFA_CODE());let b=x.data.data?.usedBackupCodeHash;if(b){let I=(A.data.backupCodeHashes??[]).filter(O=>O!==b);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:I}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return d(ot.USER_AUTH_NOT_FOUND());let m={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},E=await qr(m,e);if(E.ok===!1)return d(E.errors,E.meta);if(!E.ok)return d(q.DATABASE_ERROR());let{perms:v,roles:N,tenantType:S}=E.data,R={userId:n.userId,...i&&{tenantId:i},...S&&{tenantType:S},...v!==void 0||N?{permissions:{...N&&{roles:N},...v!==void 0&&{perms:v}}}:{},...o||s||a?{device:{...o&&{deviceLabel:o},...s&&{country:s},...a&&{city:a}}}:{}},M=await Yn(R,e);if(M.ok===!1)return d(M.errors,M.meta);if(!M.ok)return d(q.DATABASE_ERROR());let{accessToken:K,refreshToken:B,expiresAt:V}=M.data;return T({accessToken:K,refreshToken:B,expiresAt:V})}var vt={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:Q("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:Q("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:Q("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:Q("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:_("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:_("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:_("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function xa(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(vt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Ve.PENDING)return d(vt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return d(vt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return d(vt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return d(vt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return d(vt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return d(vt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let o=await e.plugins.database.userAuths.get(t.userId);if(!o.ok)return d(vt.CHALLENGE_ISSUE_FAILED());let s=o.data;if(!s)return d(vt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(f=>f.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),d(vt.TOO_MANY_ISSUES())):d(a.errors,a.meta);if(!i.sendCode)return d(vt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:s},e);if(!c.ok)return d(vt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,u=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:_r.VERIFY_MFA,codeHash:l})).ok===!1?d(vt.CHALLENGE_UPDATE_FAILED()):T({maskedRecipient:u,expiresAt:n.expiresAt})}var $e={IDENTITY_PLUGIN_NOT_FOUND:Q("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:Q("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:Q("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:Q("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:_("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:_("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:_("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:_("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:_("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:_("INTERNAL_ERROR","Internal error occurred during registration")};function xb(t,e){return e[t]}function bb(t,e){return e[t]}async function ba(t,e){let r=xb(t.identityType,e.plugins.identity);if(!r)return d($e.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return d($e.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,i);if(o.ok===!1)return d($e.DATABASE_ERROR());if(o.data)return d($e.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let s=bb(t.credentialType,e.plugins.credential);if(!s)return d($e.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await s.create({value:t.credentialValue});if(a.ok===!1)return d($e.INVALID_CREDENTIAL());if(!a.ok)return d($e.INTERNAL_ERROR());let{value:c,data:l}=a.data,u=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let f={id:u,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===sr.EMAIL&&{contactEmail:t.identityValue},...t.identityType===sr.PHONE&&{contactPhone:t.identityValue},...t.identityType===sr.USERNAME&&{username:t.identityValue}},m={userId:u,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},E={type:t.identityType,value:i,userId:u,loginEnabled:!0,verifiedAt:null,guards:{}},v={userId:u,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===sr.EMAIL&&e.plugins.database.registration){let B=await Sb({profileData:{...f,id:u},userAuthData:m,identityData:E,credentialRepoData:v,identityValue:i},e);return B.ok===!1?B.errors.some(V=>V.code==="UNIQUE_CONSTRAINT_VIOLATION")?d($e.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):d(B.errors,B.meta):B.ok?T({userId:u,verification:{channel:"email",challengeId:B.data.challengeId,expiresAt:B.data.expiresAt,identityType:t.identityType,identityValue:i}}):d($e.INTERNAL_ERROR())}let N=await e.plugins.database.users.create(f);if(N.ok===!1||!N.data)return d($e.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(m)).ok===!1)return await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(E)).ok===!1)return await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());let M=await e.plugins.database.credentials.create(v);if(M.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());let K;if(t.identityType===sr.EMAIL){let B=await Rb({userId:u,identityType:t.identityType,identityValue:i},e);if(B.ok===!1)return await e.plugins.database.credentials.remove(M.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d(B.errors,B.meta);if(!B.ok)return await e.plugins.database.credentials.remove(M.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.INTERNAL_ERROR());K={channel:"email",challengeId:B.data.challengeId,expiresAt:B.data.expiresAt,identityType:t.identityType,identityValue:i}}return T({userId:u,...K&&{verification:K}})}async function Sb(t,e){if(!e.plugins.emailSystem)return d($e.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await wb(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?d($e.USER_CREATION_FAILED()):((await Nb({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),T({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function wb(t,e,r){let n=vn(6),i=await $r(n),o=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),s=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:s,userId:t,purpose:xe.EMAIL_VERIFICATION,status:Ve.PENDING,method:"email",identityType:sr.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:o},pendingVerification:{challengeId:s,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:o,resendAvailableAt:a}}}async function Nb(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?d($e.VERIFICATION_EMAIL_SEND_FAILED()):T(void 0):d($e.EMAIL_SYSTEM_NOT_AVAILABLE())}async function Rb(t,e){if(!e.plugins.emailSystem)return d($e.EMAIL_SYSTEM_NOT_AVAILABLE());let r=vn(6),n=await $r(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),o=e.plugins.database.challenges.generateChallengeId(),s=await e.plugins.database.challenges.create({id:o,userId:t.userId,purpose:xe.EMAIL_VERIFICATION,status:Ve.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(s.ok===!1)return d(s.errors,s.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:o,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(o),d(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:o,expiresAt:i.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(o),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),d($e.VERIFICATION_EMAIL_SEND_FAILED())):T({challengeId:o,expiresAt:i})}var Zn={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:_("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};async function Sa(t,e){let{sessionId:r,userId:n,tenantId:i}=t,o=await e.plugins.database.sessions.get(r);if(o.ok===!1)return d(o.errors,o.meta);if(!o.data)return d(Zn.SESSION_NOT_FOUND());let s=o.data;if(s.revokedAt)return d(Zn.SESSION_REVOKED());if(s.userId!==n)return d(Zn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return d(a.errors,a.meta);if(!a.data)return d(Zn.USER_NOT_FOUND());let c=a.data,l=await qr({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return d(l.errors,l.meta);if(!l.ok)return d(q.DATABASE_ERROR());let{perms:u,roles:p,tenantType:f}=l.data,m=e.plugins.database.sessions.generateTokenId(),E=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:m,...u!==void 0&&{perms:u},...p&&{roles:p},...f&&{tenantType:f}});if(E.ok===!1)return d(E.errors,E.meta);let v=Ho(i,e.security),N=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:m,...v&&{aud:v},tid:i,...f&&{tty:f},...u!==void 0&&{perms:u},...p&&{roles:p}},e.security.accessTokenLifetimeMinutes),S=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:m,...v&&{aud:v},tid:i,...f&&{tty:f}},e.security.refreshTokenLifetimeMinutes);return T({accessToken:N.token,refreshToken:S.token,expiresAt:N.expiresAt,tenantId:i})}var Ob=/^[\w!#$%&'*.^`|~+-]+$/,kb=/^[!#-:<>-[\]-~]+$/,Cb=/^[ !#-:<-[\]-~]*$/,zy=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},sf=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let o=i.indexOf("=");if(o===-1)continue;let s=zy(i.substring(0,o));if(e&&e!==s||!kb.test(s)||s in n)continue;let a=zy(i.substring(o+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),Cb.test(a)&&(n[s]=Po(a),e))break}return n};var Db=(t,e,r={})=>{if(!Ob.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},Wl=(t,e,r)=>(e=encodeURIComponent(e),Db(t,e,r));var af=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let i=e;return r==="secure"?i="__Secure-"+e:r==="host"&&(i="__Host-"+e),sf(n,i)[i]}return n?sf(n):{}};var Pb=(t,e,r)=>{let n;return r?.prefix==="secure"?n=Wl("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=Wl("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=Wl(t,e,{path:"/",...r}),n},wa=(t,e,r,n)=>{let i=Pb(e,r,n);t.header("Set-Cookie",i,{append:!0})};var Na=(t,e,r)=>{let n=af(t,e,r?.prefix);return wa(t,e,"",{...r,maxAge:0}),n};function cf(t,e){let r=t.tokenStrategy;return typeof r=="string"?r:r[e??"customer"]??"body"}function zl(t){return t==="cookie"||t==="both"}function Ub(t){let e=t.tokenStrategy;return typeof e=="string"?zl(e):Object.values(e).some(r=>r!==void 0&&zl(r))}function lf(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function Lb(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function Jy(t,e,r,n,i){let o=r.refreshTokenCookie??{},s=i??Lb(r,n),a=cf(r,s),c=e.refreshToken;if(typeof c!="string"||!c)return e;if(a==="cookie"||a==="both"){let l=lf(r,s);Mb(t,c,{...o,name:l})}if(a==="cookie"){let{refreshToken:l,...u}=e;return u}return e}function Yy(t,e,r){if(!(r?zl(cf(e,r)):Ub(e)))return;let i=e.refreshTokenCookie??{},o={path:i.path??"/",...i.domain?{domain:i.domain}:{}},s=e.audienceCookieNames?.cookieNames;if(s&&!r){let c=i.name??"refresh_token",l=new Set([s.customer??c,s.tenant??c,s.system??c]);for(let u of l)Na(t,u,o);return}let a=lf(e,r);Na(t,a,o)}function Jl(t,e,r){let n=cf(e,r);if(!zl(n)||!t)return;let i=lf(e,r);return Kb(t,i)}function Mb(t,e,r){wa(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function Kb(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var Xy=new Set(["customer","tenant","system"]);function Le(t,e){let r=[];if(e.auth!==!1&&r.push(oa({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(aa(a))}let n=async a=>{let c=or(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let u=a.get("authResult"),p={body:ca(a),query:ua(a),params:la(a),user:u?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},f=await e.handler(p),m=e.successStatus;if(f.ok&&f.data!==void 0&&e.tokenMode==="auth"){let E=f.data,v=typeof E.tenantId=="string"?E.tenantId:void 0,N=p.authContextHeader,S=v!==void 0?void 0:typeof N=="string"&&Xy.has(N)?N:void 0,R=Jy(a,E,t,v,S),M={...f,data:R};return Ge(a,M,{traceId:c,...m!==void 0?{successStatus:m}:{}})}if(f.ok&&e.tokenMode==="logout"){let E=p.authContextHeader,v=typeof E=="string"&&Xy.has(E)?E:void 0;Yy(a,t,v)}return Ge(a,f,{traceId:c,...m!==void 0?{successStatus:m}:{}})}catch(l){let u=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:u}})),Ge(a,d(oe.InternalError()),{traceId:c})}},i=[...r,n],s=async(a,c)=>{let l,u=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let f=i[p],m=await f(a,async()=>{await u(p+1)});m instanceof Response&&(l=m)};return await u(0),l};return s.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},s}function Wr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function Qy(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function Zy(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function eg(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{accessTokenLifetimeMinutes:t.security.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function tg(t){return{plugins:{database:t.plugins.database}}}function rg(t){return Le(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Ut.authenticate.body},handler:async e=>{let r=Wr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Ta(n,r)}})}function ng(t){return Le(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Ut.completeChallenge.body},handler:async e=>{let r=Wr(t.auth);return _a({challengeId:e.body.challengeId,code:e.body.code},r)}})}function ig(t){return Le(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Ut.completeMfaChallenge.body},handler:async e=>{let r=Wr(t.auth);return Ia({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function og(t){return Le(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Ut.issueMfaChallenge.body},handler:async e=>{let r=Wr(t.auth);return xa({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function Yl(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var Hb=new Set(["customer","tenant","system"]);function sg(t){return Le(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Hb.has(r)?r:void 0,i=Jl(e.cookieHeader,t,n),o=e.rawBody?.refreshToken,s=typeof o=="string"?o:void 0;if(!s&&i&&!Yl(e.originHeader,t.trustedOrigins))return d(oe.NotAuthenticated());let a=s??i;if(!a)return d(oe.ValidationError());let c=Zy(t.auth);return Bl({refreshToken:a},c)}})}function Fb(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function ei(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=Fb(e);return typeof r?.sid=="string"?r.sid:void 0}function ag(t){return Le(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=ei(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return d(oe.NotAuthenticated())}let n=tg(t.auth);return ga({userId:e.user.id},n)}})}var Vb=new Set(["customer","tenant","system"]);function cg(t){return Le(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Vb.has(r)?r:void 0,i=Jl(e.cookieHeader,t,n),o=e.rawBody?.refreshToken,s=typeof o=="string"?o:void 0;if(!s&&i&&!Yl(e.originHeader,t.trustedOrigins))return d(oe.NotAuthenticated());let a=s??i;if(!a)return d(oe.ValidationError());let c=eg(t.auth);return jl({refreshToken:a},c)}})}function lg(t){return Le(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Ut.register.body},handler:async e=>{let r=Qy(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),ba(n,r)}})}function ug(t){return Le(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Ut.selectTenant.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=ei(e.authorizationHeader);if(!r)return d(oe.NotAuthenticated());let n=Wr(t.auth);return Sa({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var Ra={USER_AUTH_NOT_FOUND:Q("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Q("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:Q("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function Xl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Ra.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return d(Ra.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return d(i.errors,i.meta);let o=i.data??[];t.verifiedOnly&&(o=o.filter(a=>a.verifiedAt!==null));let s=o.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return T({authenticators:s,total:s.length})}var An={USER_AUTH_NOT_FOUND:Q("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Q("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:Q("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:Q("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:Q("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:Q("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:Q("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:Q("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var Tn={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function Ql(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(An.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(An.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(An.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return d(i.errors,i.meta);if(!i.ok||!i.data)return d(An.AUTHENTICATOR_NOT_FOUND());let o=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(o.ok===!1)return d(o.errors,o.meta);let s=o.data??[],a=s.filter(v=>v.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return d(An.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let v=await e.plugins.database.credentials.getByUserIdAndType(t.userId,Tn.PASSWORD);if(v.ok===!1)return d(v.errors,v.meta);let N=v.data;if(N&&N.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:N.value,data:N.data??{}},credentialValue:t.password})).ok===!1)return d(An.INVALID_PASSWORD())}let u=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(u.ok===!1)return d(u.errors,u.meta);let f=s.filter(v=>v.method===t.method&&(v.id!==t.authenticatorId||v.method!==t.method)).length,m=a.length>1||a.length===1&&!l;await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:m,remainingCount:f}});let E={method:t.method,mfaStillEnabled:m,remainingCount:f};return t.authenticatorId!==void 0&&(E.authenticatorId=t.authenticatorId),T(E)}var _n={MFA_NOT_AVAILABLE:_("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Q("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function Zl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(_n.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(_n.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(_n.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return d(_n.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return d(_n.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let o=await i.setup({userId:t.userId,data:t.data||{}},e);if(o.ok===!1)return d(o.errors,o.meta);if(!o.ok)return d(_n.INTERNAL_ERROR());let s=o.data;if(s.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:s.credentialData});if(l.ok===!1)return d(l.errors,l.meta)}await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=s;return T({method:t.method,data:c})}var pt={USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:_("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:_("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:_("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:_("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:_("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:_("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:Q("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:Q("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:_("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:q.INTERNAL_ERROR};var dg=["totp","webauthn","passkey","hardware"],pg=["email","sms","phone"],Bb=new Set([...dg,...pg]);async function eu(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return d(pt.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!Bb.has(i))return d(pt.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return d(pt.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return d(pt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(pt.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(pt.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(pt.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return d(pt.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return d(pt.MFA_NOT_ENABLED());if(!t.password)return d(pt.PASSWORD_REQUIRED());let i=await jb(t.userId,t.password,e);if(i.ok===!1)return d(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await Gb(t.userId,t.mfaMethods,e);if(i.ok===!1)return d(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return d(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return d(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return d(i.errors,i.meta)}return await _e({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),T()}async function jb(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,Tn.PASSWORD);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(pt.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return d(pt.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return d(pt.PASSWORD_PLUGIN_NOT_CONFIGURED());let o=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return o.ok===!1?d(o.errors,o.meta):T()}async function Gb(t,e,r){let n=e.filter(o=>dg.includes(o)),i=e.filter(o=>pg.includes(o));if(n.length>0){let o=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(o.ok===!1)return d(o.errors,o.meta);let s=new Set((o.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!s.has(a))return d(pt.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let o=await r.plugins.database.identities.getByUserId(t);if(o.ok===!1)return d(o.errors,o.meta);let s=new Set((o.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!s.has(a))return d(pt.METHOD_NOT_VERIFIED({method:a}))}return T()}var Ir={MFA_NOT_AVAILABLE:_("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Q("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:_("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:_("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function tu(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Ir.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(Ir.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(Ir.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return d(i.errors,i.meta);if(!i.ok)return d(Ir.INTERNAL_ERROR());let o=i.data;if(!o)return d(Ir.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return d(Ir.MFA_NOT_AVAILABLE());let s=e.plugins.mfa[t.method];if(!s?.verifyWithCredentials)return d(Ir.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await s.verifyWithCredentials({credentialData:o.data,data:t.data||{}});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(Ir.INTERNAL_ERROR());let c=a.data;if(!c.verified)return T({method:t.method,verified:!1,data:c.data||{}});if(!o.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return d(l.errors,l.meta);let u=n.mfaMethods||[];if(!u.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...u,t.method]);if(p.ok===!1)return d(p.errors,p.meta)}}return await _e(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),T({method:t.method,verified:!0,data:c.data||{}})}function Oa(t){return{system:{systemId:t.system.system.systemId}}}function fg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function mg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function hg(t){return{plugins:{database:t.plugins.database},system:Oa(t)}}function Eg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function yg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function gg(t){return X(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=hg(t.auth);return Xl({userId:e.user.id},r)}})}function vg(t){return X(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:Tr.removeAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Eg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),Ql(n,r)}})}function Ag(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:Tr.setupAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=fg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),Zl(n,r)}})}function Tg(t){return X(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:Tr.updateMfaSettings.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=yg(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),eu(n,r)}})}function _g(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:Tr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=mg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),tu(n,r)}})}var ru={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};async function nu(t,e){if(!await e.plugins.database.users.getById(t.userId))return d(ru.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return d(n.errors,n.meta);let i=n.data;if(!i)return T([]);let o=i.map(s=>{let a={provider:s.provider,externalId:s.externalId,linkedAt:s.createdAt};return s.externalEmail&&(a.externalEmail=s.externalEmail),s.externalName&&(a.externalName=s.externalName),a});return T(o)}var At={PROVIDER_NOT_FOUND:_("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:_("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:_("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:_("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:_("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:_("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:_("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:_("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:_("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function $b(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return d(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return d(q.DATABASE_ERROR());let u=l.data;if(u.userStatus===ye.DELETED)return d(q.ACCOUNT_DELETED());if(u.userStatus===ye.SUSPENDED)return d(q.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let f=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(f.ok===!1)return d(f.errors,f.meta)}return T(c)}let o=null;if(t.email){let c=Aa(sr.EMAIL,e.plugins.identity);if(!c)return d(q.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),u=await e.plugins.database.identities.get(sr.EMAIL,l);if(u.ok===!1)return d(q.DATABASE_ERROR());if(u.data){if(t.emailVerified!==!0)return d(At.EMAIL_NOT_VERIFIED_BY_PROVIDER());o=u.data.userId;let p=await e.plugins.database.userAuths.get(o);if(!p.ok||!p.data)return d(q.DATABASE_ERROR());let f=p.data;if(f.userStatus===ye.DELETED)return d(q.ACCOUNT_DELETED());if(f.userStatus===ye.SUSPENDED)return d(q.ACCOUNT_SUSPENDED())}}if(!o){if(!t.email)return d(At.EMAIL_REQUIRED());o=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let N=t.name.trim().split(/\s+/);c=N[0]||"",l=N.slice(1).join(" ")||""}let u={id:o,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(u)).ok)return d(q.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:o,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(o),d(q.DATABASE_ERROR());let m=Aa(sr.EMAIL,e.plugins.identity);if(!m)return await e.plugins.database.userAuths.remove(o),await e.plugins.database.users.remove(o),d(q.PLUGIN_NOT_FOUND());let E=m.normalize(t.email),v=await e.plugins.database.identities.create({type:sr.EMAIL,value:E,userId:o,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(v.ok===!1)return await e.plugins.database.userAuths.remove(o),await e.plugins.database.users.remove(o),d(v.errors,v.meta)}let s={userId:o,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(s.externalEmail=t.email),t.name!==void 0&&(s.externalName=t.name),t.avatarUrl!==void 0&&(s.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(s);return a.ok===!1?d(a.errors,a.meta):T(o)}async function iu(t,e){if(!t.provider)return d(At.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return d(At.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return d(At.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return d(At.PROVIDER_NOT_FOUND());let v=await r.verifyCredential(t.credential);if(v.ok===!1)return d(At.CODE_EXCHANGE_FAILED());if(n=v.data,!n)return d(At.PROFILE_FETCH_FAILED())}else if(t.code){let v=await r.exchangeCodeForToken(t.code);if(v.ok===!1)return d(At.CODE_EXCHANGE_FAILED());let N=v.data;if(!N)return d(At.CODE_EXCHANGE_FAILED());i=N.accessToken}if(!n){if(!i)return d(At.INVALID_ACCESS_TOKEN());let v=await r.getUserProfile(i);if(v.ok===!1)return d(At.PROFILE_FETCH_FAILED());if(n=v.data,!n)return d(At.PROFILE_FETCH_FAILED())}let o=await $b(n,e,t);if(!o.ok)return d(o.errors,o.meta);let s=o.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(s);if(!c.ok||!c.data)return d(q.DATABASE_ERROR());let l=await qr({userStatus:c.data.userStatus,userId:s,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return d(l.errors,l.meta);let{perms:u,roles:p,tenantType:f}=l.data,m={userId:s,...t.tenantId&&{tenantId:t.tenantId},...f&&{tenantType:f},...u!==void 0||p?{permissions:{...p&&{roles:p},...u!==void 0&&{perms:u}}}:{}},E=await Yn(m,a);return E.ok===!1?d(E.errors,E.meta):(await _e(e,{event:"oauth_login_success",userId:s,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await Gl(s,e),T({accessToken:E.data.accessToken,refreshToken:E.data.refreshToken,expiresAt:E.data.expiresAt}))}catch(n){return await _e(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),d(At.PROFILE_FETCH_FAILED())}}var Lt={PROVIDER_NOT_FOUND:_("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:_("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:_("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:_("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:_("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:_("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:_("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function ou(t,e){if(!t.code)return d(Lt.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return d(Lt.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return d(Lt.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let f=await n.exchangeCodeForToken(t.code);if(f.ok===!1)return d(Lt.CODE_EXCHANGE_FAILED());let m=f.data;if(!m)return d(Lt.CODE_EXCHANGE_FAILED());i=m.accessToken}if(!i)return d(Lt.INVALID_ACCESS_TOKEN());let o=await n.getUserProfile(i);if(o.ok===!1)return d(Lt.PROFILE_FETCH_FAILED());let s=o.data;if(!s)return d(Lt.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,s.id);if(a.ok===!1)return d(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?d(Lt.PROVIDER_ALREADY_LINKED()):d(Lt.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:s.id,createdAt:new Date};s.email!==void 0&&(l.externalEmail=s.email),s.name!==void 0&&(l.externalName=s.name),s.avatarUrl!==void 0&&(l.externalAvatarUrl=s.avatarUrl);let u=await e.plugins.database.userProviders.create(l);if(u.ok===!1)return d(u.errors,u.meta);let p=u.data;return p?(await _e(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:s.id}}),T(p)):d(Lt.PROFILE_FETCH_FAILED())}catch(i){return await _e(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),d(Lt.PROFILE_FETCH_FAILED())}}var Go={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:_("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:_("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function su(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return d(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return d(Go.PROVIDER_NOT_LINKED());let i=n.find(s=>s.provider===t.provider);if(!i)return d(Go.PROVIDER_NOT_LINKED());if(n.length<=1){let s=await e.plugins.database.identities.getByUserId(t.userId);if(!(s.ok&&s.data&&s.data.length>0))return d(Go.CANNOT_UNLINK_LAST_PROVIDER())}let o=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return o.ok===!1?d(o.errors,o.meta):(await _e(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),T())}function Ig(t){return X(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth;return nu({userId:e.user.id},r)}})}function xg(t){return X(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:mn.linkProvider.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),ou(n,r)}})}function bg(t){return Le(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:mn.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),iu(n,r)}})}function Sg(t){return X(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:mn.unlinkProvider.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth;return su({userId:e.user.id,provider:e.body.provider},r)}})}var St={PASSWORD_PLUGIN_NOT_CONFIGURED:_("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:_("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:_("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:_("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:_("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:_("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:_("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:_("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},xr={PASSWORD_PLUGIN_NOT_CONFIGURED:St.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:St.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:St.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:St.SAME_PASSWORD},Ui={EMAIL_SYSTEM_NOT_AVAILABLE:St.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:St.SEND_EMAIL_ERROR},jt={PASSWORD_PLUGIN_NOT_CONFIGURED:St.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:St.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:St.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:St.CHALLENGE_ALREADY_USED,INVALID_CODE:St.INVALID_CODE,TOO_MANY_ATTEMPTS:St.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:St.AUTH_SCOPE_MISMATCH};async function $o(t,e){if(!e.plugins.credential?.password)return d(xr.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,Tn.PASSWORD);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(xr.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return d(xr.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return d(xr.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return d(xr.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(xr.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return d(l.errors,l.meta);let u=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return u.ok===!1&&console.error("Failed to revoke sessions after password change:",u.errors),await _e(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),T()}async function qo(t,e){if(!e.plugins.emailSystem)return d(Ui.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=vn(6),o=await $r(i),s=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return T({challengeId:`fake_challenge_${Date.now()}`,expiresAt:s});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===xe.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return T({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),u=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:xe.PASSWORD_RESET,status:Ve.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:o,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:s});if(u.ok===!1)return d(u.errors,u.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:s.toISOString(),purpose:xe.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),d(Ui.SEND_EMAIL_ERROR());let f=Math.max(0,e.security.verificationResendCooldownSeconds),m=f>0?new Date(Date.now()+f*1e3):null,E=!c||c.purpose===xe.PASSWORD_RESET;return await Promise.all([E?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:xe.PASSWORD_RESET,channel:"email",expiresAt:s,resendAvailableAt:m}}):Promise.resolve(),_e(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),T({challengeId:l,expiresAt:s})}async function Wo(t,e){if(!e.plugins.credential?.password)return d(jt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(jt.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==xe.PASSWORD_RESET)return d(jt.CHALLENGE_NOT_FOUND());if(i.status!==Ve.PENDING)return d(jt.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return d(jt.CHALLENGE_EXPIRED());let o=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(o.ok===!1)return o.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?d(jt.TOO_MANY_ATTEMPTS()):d(o.errors,o.meta);if(!i.codeHash)return d(jt.INVALID_CODE());if(!await Fo(t.code,i.codeHash))return d(jt.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(jt.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,Tn.PASSWORD);if(l.ok===!1)return d(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return d(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:Tn.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return d(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let u=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return u.ok===!1&&console.error("Failed to revoke sessions after password reset:",u.errors),await _e(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),T()}var au={NO_CHANGES_PROVIDED:_("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function cu(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return d(au.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return d(q.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return d(q.INTERNAL_ERROR());await _e(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let s=await e.plugins.database.users.getById(t.userId);return!s.ok||s.data===null?d(q.NOT_FOUND()):T(s.data)}function zo(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function wg(t){return Le(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:hn.changePassword.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=zo(t.auth),n=e.body,i=ei(e.authorizationHeader);return $o({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function Ng(t){return Le(t,{method:"POST",path:"/password/forgot",auth:!1,input:{body:hn.forgotPassword.body},handler:async e=>{let r=zo(t.auth),n={email:e.body.email};return e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),qo(n,r)}})}function Rg(t){return X(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:hn.resetPassword.body},handler:async e=>{let r=zo(t.auth);return Wo({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var ka={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:_("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:_("DATABASE_ERROR","Failed to delete session")};async function Ca(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?d(ka.DATABASE_ERROR()):(await _e(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),T())}var Da={DATABASE_ERROR:_("DATABASE_ERROR","Failed to retrieve sessions")};async function Pa(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return d(Da.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return T(a,i.meta)}var Jo={INVALID_TOKEN:_("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:_("DATABASE_ERROR","Failed to revoke token")};async function Ua(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?d(Jo.DATABASE_ERROR()):(await _e(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),T()):d(Jo.INVALID_TOKEN())}function Og(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function kg(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Cg(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Dg(t){return X(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:En.deleteSession.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=kg(t.auth);return Ca({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function Pg(t){return Le(t,{method:"GET",path:"/sessions",auth:!0,input:{query:En.listSessions.query},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Og(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await Pa(n,r);if(!i.ok)return i;let o=ei(e.authorizationHeader);if(o&&i.data){let s=i.data.map(a=>a.id===o?{...a,isCurrent:!0}:a);return T(s,i.meta)}return i}})}function Ug(t){return X(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:En.revokeToken.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Cg(t.auth);return Ua({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},La=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function Ma(t,e){return t===void 0?!1:(t&e)===e}var uf={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},Lg=Object.fromEntries(Object.entries(uf).map(([t,e])=>[e,Number(t)]));function Xt(t){return t?Object.entries(uf).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function ti(t){let e=0;for(let r of t){let n=Lg[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var Qt={SYSTEM:"system",DEFAULT:"org"};var ar={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var br={INVITE_IDENTIFIER_REQUIRED:_("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:_("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:_("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:_("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","This invite grants permissions the inviter is not entitled to confer"),DATABASE_ERROR:q.DATABASE_ERROR};var qb={IDENTITY_NOT_FOUND:_("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:_("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:_("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:_("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:_("IDENTITY_ALREADY_EXISTS","This identity is already registered")},Wb={GUARD_LOCKED:_("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},zb={INVALID_CREDENTIALS:_("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:_("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:_("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:_("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:_("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},Jb={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:_("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:_("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:_("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:_("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},Yb={USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:_("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:_("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},Xb={MFA_NOT_CONFIGURED:_("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:_("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:_("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:_("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:_("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:_("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:_("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:_("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},Qb={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:_("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:_("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:_("INVALID_SESSION","Invalid session")},Zb={TOKEN_NOT_FOUND:_("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:_("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:_("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:_("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:_("TOKEN_VERIFICATION_FAILED","Token verification failed")},wt={NOT_MEMBER_OF_TENANT:_("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:_("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:_("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:_("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:_("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:_("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},wW={...qb,...Wb,...zb,...Jb,...Yb,...Xb,...Qb,...Zb,...wt};async function lu(t,e,r,n={}){let{requireVerified:i=!0}=n;if(t.inviteeUserId)return T(t.inviteeUserId===e?null:"user-mismatch");if(t.inviteeEmail||t.inviteePhone){let o=await r.getByUserId(e);if(!o.ok)return d(o.errors,o.meta);let s=i?o.data.filter(p=>p.verifiedAt!==null):o.data,a=(p,f)=>p==="phone"?f.replace(/[\s()\-.]/g,""):f.trim().toLowerCase(),c=(p,f)=>{let m=a(p,f);return m?s.some(E=>E.type===p&&a(p,E.value)===m):!1},l=t.inviteeEmail?c("email",t.inviteeEmail):!1,u=t.inviteePhone?c("phone",t.inviteePhone):!1;return!l&&!u?T("identity-mismatch"):T(null)}return T("identity-mismatch")}function ri(t,e){let{authPerm:r,roles:n,perms:i}=e;if(t.isOwner)return!1;if(r!==void 0&&(r&~(t.authPerm??0))!==0||r!==void 0&&(r&se.CHANGE_MEMBER_PERMISSION)!==0||n?.some(o=>o.trim().toLowerCase()===va.OWNER))return!0;if(i!==void 0){let o=t.perms??{},s=(c,l)=>c[l]??c["*"]??0,a=new Set([...Object.keys(i),...Object.keys(o),"*"]);for(let c of a)if((s(i,c)&~s(o,c))!==0)return!0}return!1}async function Yo(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,o=e.plugins.database;if(!r&&!n)return d(br.INVITE_IDENTIFIER_REQUIRED());let s=null,a=!1;if(r){let M=await o.tenantInvites.getById(r);if(!M.ok)return d(M.errors,M.meta);s=M.data}else if(n){let M=await o.tenantInvites.getByToken(n);if(!M.ok)return d(M.errors,M.meta);s=M.data,a=!0}if(!s)return d(br.INVITE_NOT_FOUND());if(s.status!==ar.PENDING)return d(br.INVITE_NOT_PENDING());if(s.expiresAt<new Date)return d(br.INVITE_EXPIRED());let c=await lu(s,i,o.identities,{requireVerified:!a});if(!c.ok)return d(c.errors,c.meta);if(c.data==="user-mismatch")return d(br.INVITE_USER_MISMATCH());if(c.data==="identity-mismatch")return d(br.INVITE_IDENTITY_MISMATCH());let l=await o.tenantMembers.get(s.tenantId,i);if(!l.ok)return d(l.errors,l.meta);if(l.data&&l.data.status!==it.REMOVED)return d(br.ALREADY_MEMBER());let u=await o.tenants.get(s.tenantId);if(!u.ok)return d(u.errors,u.meta);if(s.authPerm!==void 0&&(s.authPerm&La)!==0){if(!u.data)return d(wt.TENANT_NOT_FOUND());if(u.data.type!==Qt.SYSTEM)return d(wt.ACCOUNT_PERMS_SYSTEM_ONLY())}let p={tenantId:s.tenantId,userId:i,status:it.ACTIVE,isOwner:!1,tenantType:s.tenantType};if(u.data?.parentTenantId!==void 0&&(p.parentTenantId=u.data.parentTenantId),s.authPerm!==void 0||s.roles!==void 0||s.perms!==void 0){let M=await o.tenantMembers.get(s.tenantId,s.invitedById);if(!M.ok)return d(M.errors,M.meta);let K=M.data,B=K&&K.status===it.ACTIVE?K:{isOwner:!1,authPerm:0,perms:{}};if(ri(B,{authPerm:s.authPerm,roles:s.roles,perms:s.perms}))return d(br.CANNOT_ESCALATE_PERMISSIONS())}s.roles!==void 0&&(p.roles=s.roles),s.perms!==void 0&&(p.perms=s.perms),s.authPerm!==void 0&&(p.authPerm=s.authPerm);let m=await o.tenantMembers.create(p);if(!m.ok)return d(m.errors,m.meta);let E={tenantId:s.tenantId,userId:i},v=await o.users.getById(i);v.ok&&v.data&&(v.data.contactEmail&&(E.contactEmail=v.data.contactEmail),v.data.contactPhone&&(E.contactPhone=v.data.contactPhone),v.data.displayName&&(E.displayName=v.data.displayName),v.data.givenName&&(E.givenName=v.data.givenName),v.data.familyName&&(E.familyName=v.data.familyName),v.data.avatarUrl&&(E.avatarUrl=v.data.avatarUrl),v.data.locale&&(E.locale=v.data.locale)),s.displayName&&(E.displayName=s.displayName),s.givenName&&(E.givenName=s.givenName),s.familyName&&(E.familyName=s.familyName),s.jobTitle&&(E.jobTitle=s.jobTitle);let N=await o.userTenantProfiles.create(E);if(!N.ok)return d(N.errors,N.meta);let S=await o.tenantInvites.updateStatus(s.id,{status:ar.ACCEPTED,acceptedAt:new Date});if(!S.ok)return d(S.errors,S.meta);let R={tenantId:s.tenantId};return s.roles!==void 0&&(R.roles=s.roles),s.perms!==void 0&&(R.perms=s.perms),s.authPerm!==void 0&&(R.authPerm=s.authPerm),T(R)}var Li={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:_("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function Mi(t,e,r){if(t===void 0||(t&La)===0)return T(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==Qt.SYSTEM?d(wt.ACCOUNT_PERMS_SYSTEM_ONLY()):T(void 0):d(wt.TENANT_NOT_FOUND()):d(n.errors,n.meta)}var uu={NOT_MEMBER:wt.NOT_MEMBER_OF_TENANT,SUSPENDED:wt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:wt.INSUFFICIENT_TENANT_PERMISSIONS};async function lt(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,o=await e.tenantMembers.get(r,n);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(uu.NOT_MEMBER());let s=o.data;return s.status!==it.ACTIVE?d(uu.SUSPENDED()):s.isOwner?T(s):Ma(s.authPerm,i)?T(s):d(uu.INSUFFICIENT_PERMISSIONS())}async function du(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(ri(s.data,{authPerm:t.authPerm,roles:t.roles,perms:t.perms}))return d(Li.CANNOT_ESCALATE_PERMISSIONS());let a=await Mi(t.authPerm,r,o.tenants);if(!a.ok)return d(a.errors,a.meta);let c=await o.users.getById(n);if(!c.ok)return d(c.errors,c.meta);if(!c.data)return d(Li.USER_NOT_FOUND());let l=c.data,u=await o.tenantMembers.get(r,n);if(!u.ok)return d(u.errors,u.meta);if(u.data&&u.data.status!==it.REMOVED)return d(Li.ALREADY_MEMBER());let p=await o.tenants.get(r);if(!p.ok)return d(p.errors,p.meta);if(!p.data)return d(Li.TENANT_NOT_FOUND());let f=p.data,m={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!1,tenantType:f.type};f.parentTenantId!==void 0&&(m.parentTenantId=f.parentTenantId),t.roles!==void 0&&(m.roles=t.roles),t.perms!==void 0&&(m.perms=t.perms),t.authPerm!==void 0&&(m.authPerm=t.authPerm);let E=await o.tenantMembers.create(m);if(!E.ok)return d(E.errors,E.meta);let v={tenantId:r,userId:n};l.contactEmail&&(v.contactEmail=l.contactEmail),l.contactPhone&&(v.contactPhone=l.contactPhone),l.displayName&&(v.displayName=l.displayName),l.givenName&&(v.givenName=l.givenName),l.familyName&&(v.familyName=l.familyName),l.avatarUrl&&(v.avatarUrl=l.avatarUrl),l.locale&&(v.locale=l.locale),t.contactEmail!==void 0&&(v.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(v.contactPhone=t.contactPhone),t.displayName!==void 0&&(v.displayName=t.displayName),t.givenName!==void 0&&(v.givenName=t.givenName),t.familyName!==void 0&&(v.familyName=t.familyName),t.avatarUrl!==void 0&&(v.avatarUrl=t.avatarUrl),t.locale!==void 0&&(v.locale=t.locale),t.jobTitle!==void 0&&(v.jobTitle=t.jobTitle),t.bio!==void 0&&(v.bio=t.bio),t.metadata!==void 0&&(v.metadata=t.metadata);let N=await o.userTenantProfiles.create(v);return N.ok?T({tenantId:r,userId:n}):d(N.errors,N.meta)}var Xo={TENANT_ALREADY_HAS_OWNER:_("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:_("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:q.DATABASE_ERROR};async function pu(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:o,contactEmail:s,contactPhone:a,displayName:c,displayNameSource:l,givenName:u,familyName:p,avatarUrl:f,locale:m,jobTitle:E,bio:v,metadata:N}=t,S=e.plugins.database,R=i??"org";if(R===Qt.SYSTEM)return d(Xo.SYSTEM_TYPE_FORBIDDEN());let M=await S.users.getById(n);if(!M.ok)return d(M.errors,M.meta);if(!M.data)return d(Xo.USER_NOT_FOUND());let K=await S.tenants.get(r);if(!K.ok)return d(K.errors,K.meta);if(!K.data){let b={id:r,type:R,ownerId:n};o!==void 0&&(b.parentTenantId=o);let g=await S.tenants.create(b);if(!g.ok)return d(g.errors,g.meta)}let B=await S.tenantMembers.hasOwner(r);if(!B.ok)return d(B.errors,B.meta);if(B.data)return d(Xo.TENANT_ALREADY_HAS_OWNER());let V=K.data?.parentTenantId??o,$={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!0,tenantType:R};V!==void 0&&($.parentTenantId=V);let A=await S.tenantMembers.create($);if(!A.ok)return d(A.errors,A.meta);let x=await S.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:s,contactPhone:a,displayName:c,displayNameSource:l,givenName:u,familyName:p,avatarUrl:f,locale:m,jobTitle:E,bio:v,metadata:N});return x.ok?T({tenantId:r,userId:n}):d(x.errors,x.meta)}async function fu(t,e){let{email:r,phone:n}=t,i=e.plugins.database,o=[],s=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return d(a.errors,a.meta);for(let c of a.data)if(!s.has(c.id)){s.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),o.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return d(a.errors,a.meta);for(let c of a.data)if(!s.has(c.id)){s.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),o.push(l)}}return T({pendingInvites:o})}var ni={INVITE_IDENTIFIER_REQUIRED:_("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:_("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:_("INVITE_IDENTITY_MISMATCH","This invite was sent to an identity you do not own"),DATABASE_ERROR:q.DATABASE_ERROR};async function Qo(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,o=e.plugins.database;if(!r&&!n)return d(ni.INVITE_IDENTIFIER_REQUIRED());let s=null;if(r){let l=await o.tenantInvites.getById(r);if(!l.ok)return d(l.errors,l.meta);s=l.data}else if(n){let l=await o.tenantInvites.getByToken(n);if(!l.ok)return d(l.errors,l.meta);s=l.data}if(!s)return d(ni.INVITE_NOT_FOUND());if(s.status!==ar.PENDING)return d(ni.INVITE_NOT_PENDING());let a=await lu(s,i,o.identities,{requireVerified:!1});if(!a.ok)return d(a.errors,a.meta);if(a.data==="user-mismatch")return d(ni.INVITE_USER_MISMATCH());if(a.data==="identity-mismatch")return d(ni.INVITE_IDENTITY_MISMATCH());let c=await o.tenantInvites.updateStatus(s.id,{status:ar.DECLINED,declinedAt:new Date});return c.ok?T(void 0):d(c.errors,c.meta)}async function Ki(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[o,s]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(wt.NOT_MEMBER_OF_TENANT());if(!s.ok)return d(s.errors,s.meta);let a=o.data,c=s.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),T(l)}var Zt={INVITEE_REQUIRED:_("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:Q("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:_("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:Q("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:q.DATABASE_ERROR};function eS(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function Zo(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:o,inviteePhone:s,role:a,perms:c,authPerm:l,displayName:u,givenName:p,familyName:f,jobTitle:m}=t,E=t.roles??(a!==void 0?[a]:void 0),v=e.plugins.database,N=await lt({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:v.tenantMembers});if(!N.ok)return d(N.errors,N.meta);if(ri(N.data,{authPerm:l,roles:E,perms:c}))return d(Zt.CANNOT_ESCALATE_PERMISSIONS());let S=await Mi(l,r,v.tenants);if(!S.ok)return d(S.errors,S.meta);if(!i&&!o&&!s)return d(Zt.INVITEE_REQUIRED());if(i){let k=await v.users.getById(i);if(!k.ok)return d(k.errors,k.meta);if(!k.data)return d(Zt.INVITEE_USER_NOT_FOUND({userId:i}));let C=await v.tenantMembers.get(r,i);if(!C.ok)return d(C.errors,C.meta);if(C.data&&C.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER());let P=await v.tenantInvites.findByTenantAndUserId(r,i);if(!P.ok)return d(P.errors,P.meta);if(P.data)return d(Zt.INVITE_ALREADY_EXISTS())}if(o){let k=await v.identities.get("email",o);if(!k.ok)return d(k.errors,k.meta);if(k.data){let P=await v.tenantMembers.get(r,k.data.userId);if(!P.ok)return d(P.errors,P.meta);if(P.data&&P.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER())}let C=await v.tenantInvites.findByTenantAndEmail(r,o);if(!C.ok)return d(C.errors,C.meta);if(C.data)return d(Zt.INVITE_ALREADY_EXISTS())}if(s){let k=await v.identities.get("phone",s);if(!k.ok)return d(k.errors,k.meta);if(k.data){let P=await v.tenantMembers.get(r,k.data.userId);if(!P.ok)return d(P.errors,P.meta);if(P.data&&P.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER())}let C=await v.tenantInvites.findByTenantAndPhone(r,s);if(!C.ok)return d(C.errors,C.meta);if(C.data)return d(Zt.INVITE_ALREADY_EXISTS())}let R=await v.tenantInvites.countPendingByTenant(r);if(!R.ok)return d(R.errors,R.meta);if(R.data>=e.security.maxPendingInvitesPerTenant)return d(Zt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let M,K,B,V=await v.users.getById(n);V.ok&&V.data&&(V.data.displayName!==void 0&&(M=V.data.displayName),V.data.contactEmail!==void 0&&(K=V.data.contactEmail));let $=await v.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(M=$.data.displayName),$.data.jobTitle!==void 0&&(B=$.data.jobTitle));let A=Qt.DEFAULT,x=await v.tenants.get(r);x.ok&&x.data&&(A=x.data.type);let b=v.tenantInvites.generateInviteId(),g=eS(),I=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),O={id:b,tenantId:r,tenantType:A,invitedById:n,status:ar.PENDING,inviteToken:g,expiresAt:I};M!==void 0&&(O.invitedByName=M),K!==void 0&&(O.invitedByEmail=K),B!==void 0&&(O.invitedByJobTitle=B),i!==void 0&&(O.inviteeUserId=i),o!==void 0&&(O.inviteeEmail=o),s!==void 0&&(O.inviteePhone=s),E!==void 0&&(O.roles=E),c!==void 0&&(O.perms=c),l!==void 0&&(O.authPerm=l),u!==void 0&&(O.displayName=u),p!==void 0&&(O.givenName=p),f!==void 0&&(O.familyName=f),m!==void 0&&(O.jobTitle=m);let D=await v.tenantInvites.create(O);return D.ok?T({inviteId:b,inviteToken:g,expiresAt:I}):d(D.errors,D.meta)}async function es(t,e){let{tenantId:r,actorUserId:n,status:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await o.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?T(c.data,c.meta):d(c.errors,c.meta)}async function ts(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,o=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return d(o.errors,o.meta);let s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(s).length>0?s:void 0);return a.ok?T(a.data,a.meta):d(a.errors,a.meta)}async function mu(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let o=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return o.ok?T(o.data,o.meta):d(o.errors,o.meta)}var Hi={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:_("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:_("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:q.DATABASE_ERROR};async function rs(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(i===n)return d(Hi.CANNOT_REMOVE_SELF());let a=await o.tenantMembers.get(r,n);if(!a.ok)return d(a.errors,a.meta);if(!a.data)return d(Hi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!s.data.isOwner)return d(Hi.CANNOT_MODIFY_OWNER());if(c.isOwner){let u=await o.tenantMembers.listByTenant(r);if(!u.ok)return d(u.errors,u.meta);if(u.data.filter(f=>f.isOwner&&f.status===it.ACTIVE).length<=1)return d(Hi.CANNOT_REMOVE_LAST_OWNER())}let l=await o.tenantMembers.remove(r,n);return l.ok?(await o.userTenantProfiles.remove(r,n),T(void 0)):d(l.errors,l.meta)}var Ka={INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:q.DATABASE_ERROR};async function ns(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,o=await i.tenantInvites.getById(r);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(Ka.INVITE_NOT_FOUND());let s=await lt({tenantId:o.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(o.data.status!==ar.PENDING)return d(Ka.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:ar.REVOKED,revokedAt:new Date});return a.ok?T(void 0):d(a.errors,a.meta)}var ii={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:_("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:q.DATABASE_ERROR};async function is(t,e){let{tenantId:r,userId:n,actorUserId:i,role:o,perms:s,authPerm:a}=t,c=t.roles??(o!==void 0?[o]:void 0),l=e.plugins.database,u=await lt({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!u.ok)return d(u.errors,u.meta);let p=u.data;if(i===n)return d(ii.CANNOT_MODIFY_SELF());let f=await l.tenantMembers.get(r,n);if(!f.ok)return d(f.errors,f.meta);if(!f.data)return d(ii.MEMBER_NOT_FOUND());if(f.data.isOwner)return d(ii.CANNOT_MODIFY_OWNER());let m=f.data,E=a===void 0?void 0:a&~(m.authPerm??0),v=V=>V.trim().toLowerCase(),N=new Set(m.roles?.map(v)),S=c?.filter(V=>v(V)===va.OWNER||!N.has(v(V))),R=(V,$)=>V?.[$]??V?.["*"]??0,M=s===void 0?void 0:Object.fromEntries([...new Set([...Object.keys(s),...Object.keys(m.perms??{}),"*"])].map(V=>{let $=R(s,V);return[V,$&~R(m.perms,V)]}));if(ri(p,{authPerm:E,roles:S,perms:M}))return d(ii.CANNOT_ESCALATE_PERMISSIONS());if(!p.isOwner){let V=a===void 0?0:(m.authPerm??0)&~a,$=s===void 0?[]:[...new Set([...Object.keys(s),...Object.keys(m.perms??{}),"*"])].filter(O=>(R(m.perms,O)&~R(s,O))!==0),A=new Set(p.roles?.map(v)),x=c===void 0?[]:(m.roles??[]).filter(O=>!c.some(D=>v(D)===v(O))),b=(V&~(p.authPerm??0))!==0,g=$.some(O=>(R(m.perms,O)&~R(s,O)&~R(p.perms,O))!==0),I=x.some(O=>!A.has(v(O)));if(b||g||I)return d(ii.CANNOT_ESCALATE_PERMISSIONS())}let K=await Mi(a,r,l.tenants);if(!K.ok)return d(K.errors,K.meta);let B={};if(c!==void 0&&(B.roles=c),s!==void 0&&(B.perms=s),a!==void 0&&(B.authPerm=a),Object.keys(B).length>0){let V=await l.tenantMembers.updatePermissions(r,n,B);if(!V.ok)return d(V.errors,V.meta)}return T(void 0)}var Ha={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:_("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:q.DATABASE_ERROR};async function df(t,e){let{tenantId:r,userId:n,actorUserId:i,status:o}=t,s=e.plugins.database,a=await lt({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:s.tenantMembers});if(!a.ok)return d(a.errors,a.meta);if(i===n)return d(Ha.CANNOT_MODIFY_SELF());let c=await s.tenantMembers.get(r,n);if(!c.ok)return d(c.errors,c.meta);if(!c.data)return d(Ha.MEMBER_NOT_FOUND());if(c.data.isOwner)return d(Ha.CANNOT_MODIFY_OWNER());let l=await s.tenantMembers.updateStatus(r,n,o);return l.ok?T(void 0):d(l.errors,l.meta)}var hu={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:_("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:q.DATABASE_ERROR};async function os(t,e){let{tenantId:r,userId:n,...i}=t,o=e.plugins.database,s=await o.tenantMembers.get(r,n);if(!s.ok)return d(s.errors,s.meta);if(!s.data)return d(hu.MEMBER_NOT_FOUND());let a=s.data,c=a.isOwner||Ma(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let u=await o.userTenantProfiles.get(r,n);if(!u.ok)return d(u.errors,u.meta);if(!u.data){let f=await o.userTenantProfiles.create({tenantId:r,userId:n,...l});return f.ok?T(void 0):d(f.errors,f.meta)}let p=await o.userTenantProfiles.update(r,n,l);return p.ok?T(void 0):d(p.errors,p.meta)}var tS=10080,rS=100;function nS(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??tS,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??rS}}}var zr=F({tenantId:Ue(y(),Hp(1))}),iS=F({limit:w(Ue(ge(),Mo(Number),qe(),zn(),Lo(1),Uo(100))),cursor:w(y())}),oS=Ue(F({inviteeEmail:w(Ue(y(),pn())),inviteeUserId:w(y()),inviteePhone:w(y()),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),Hl(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),Mg=Ue(F({inviteId:w(y()),inviteToken:w(y())}),Hl(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),sS=F({inviteId:y()}),aS=F({status:w(y()),limit:w(Ue(ge(),Mo(Number),qe(),zn(),Lo(1),Uo(100))),cursor:w(y())}),cS=F({userId:y(),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y()))}),lS=F({userId:y()}),uS=F({contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))});function Kg(t){let{auth:e,policy:r}=t,n=X(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr},handler:async m=>{let E=await Ki({tenantId:m.params.tenantId,userId:m.user.id},e);if(!E.ok)return E;let v=E.data;if(!v)return T({});let{authPerm:N,...S}=v;return T({...S,authPerms:Xt(N)})}}),i=X(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:uS},handler:async m=>{let E=m.params.tenantId,v=m.user.id,N={tenantId:E,userId:v},S=m.body;S.contactEmail!==void 0&&(N.contactEmail=S.contactEmail),S.contactPhone!==void 0&&(N.contactPhone=S.contactPhone),S.displayName!==void 0&&(N.displayName=S.displayName),S.givenName!==void 0&&(N.givenName=S.givenName),S.familyName!==void 0&&(N.familyName=S.familyName),S.avatarUrl!==void 0&&(N.avatarUrl=S.avatarUrl),S.locale!==void 0&&(N.locale=S.locale),S.bio!==void 0&&(N.bio=S.bio),S.jobTitle!==void 0&&(N.jobTitle=S.jobTitle),S.metadata!==void 0&&(N.metadata=S.metadata);let R=await os(N,e);if(!R.ok)return R;let M=await Ki({tenantId:E,userId:v},e);if(!M.ok)return M;let K=M.data;if(!K)return T({});let{authPerm:B,...V}=K;return T({...V,authPerms:Xt(B)})}}),o=X(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:oS},handler:async m=>{let{inviteeEmail:E,inviteeUserId:v,inviteePhone:N,role:S,roles:R,authPerms:M,displayName:K,givenName:B,familyName:V,jobTitle:$}=m.body,A={tenantId:m.params.tenantId,invitedBy:m.user.id};return E!==void 0&&(A.inviteeEmail=E),v!==void 0&&(A.inviteeUserId=v),N!==void 0&&(A.inviteePhone=N),S!==void 0&&(A.role=S),R!==void 0&&(A.roles=R),M!==void 0&&(A.authPerm=ti(M)),K!==void 0&&(A.displayName=K),B!==void 0&&(A.givenName=B),V!==void 0&&(A.familyName=V),$!==void 0&&(A.jobTitle=$),Zo(A,nS(t))}}),s=X(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,query:aS},handler:async m=>{let E={tenantId:m.params.tenantId,actorUserId:m.user.id};m.query.status!==void 0&&(E.status=m.query.status),m.query.limit!==void 0&&(E.limit=m.query.limit),m.query.cursor!==void 0&&(E.cursor=m.query.cursor);let v=await es(E,e);if(!v.ok)return v;let N=v.data.map(({authPerm:S,...R})=>({...R,authPerms:Xt(S)}));return T(N,v.meta)}}),a=X(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.GLOBAL},input:{params:zr,body:Mg},handler:async m=>{let E={userId:m.user.id};m.body.inviteId!==void 0&&(E.inviteId=m.body.inviteId),m.body.inviteToken!==void 0&&(E.inviteToken=m.body.inviteToken);let v=await Yo(E,e);if(!v.ok)return v;let N=v.data;if(!N)return v;let{authPerm:S,...R}=N;return T({...R,authPerms:Xt(S)})}}),c=X(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.GLOBAL},input:{params:zr,body:Mg},handler:async m=>{let E={userId:m.user.id};return m.body.inviteId!==void 0&&(E.inviteId=m.body.inviteId),m.body.inviteToken!==void 0&&(E.inviteToken=m.body.inviteToken),Qo(E,e)}}),l=X(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:sS},handler:async m=>ns({inviteId:m.body.inviteId,revokedBy:m.user.id},e)}),u=X(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,query:iS},handler:async m=>{let E={tenantId:m.params.tenantId,actorUserId:m.user.id};m.query.limit!==void 0&&(E.limit=m.query.limit),m.query.cursor!==void 0&&(E.cursor=m.query.cursor);let v=await ts(E,e);if(!v.ok)return v;let N=v.data.map(({authPerm:S,...R})=>({...R,authPerms:Xt(S)}));return T({members:N},v.meta)}}),p=X(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:cS},handler:async m=>{let E={tenantId:m.params.tenantId,userId:m.body.userId,actorUserId:m.user.id};return m.body.role!==void 0&&(E.role=m.body.role),m.body.roles!==void 0&&(E.roles=m.body.roles),m.body.authPerms!==void 0&&(E.authPerm=ti(m.body.authPerms)),is(E,e)}}),f=X(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:lS},handler:async m=>rs({tenantId:m.params.tenantId,userId:m.body.userId,actorUserId:m.user.id},e)});return Kp("/tenants",[n,i,o,s,a,c,l,u,p,f])}function Hg(t){return X(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:Ea.updateProfile.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),cu(n,r)}})}function Eu(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function Fg(t){return Le(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:Ci.resendVerification.body},handler:async e=>{let r=Eu(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),Vo(n,r)}})}function Vg(t){return X(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:Ci.verifyCode.body},handler:async e=>{let r=Eu(t.auth);return jo({challengeId:e.body.challengeId,code:e.body.code},r)}})}var pf="oauth_state",dS=600;function Bg(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function jg(t,e,r){wa(t,pf,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:dS})}function pS(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function Gg(t,e){let r=af(t,pf);return Na(t,pf,{path:"/"}),!r||!e?!1:pS(r,e)}function fS(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function mS(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function $g(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:o=[]}=e;return async(s,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=fS(s),u=await mS(s,o),p=[`${i}:ip:${l}`];u&&p.push(`${i}:id:${u}`);for(let f of p){let m=await c.consume(f,{limit:r,windowMs:n});if(!m.allowed){let E=Math.ceil(m.retryAfterMs/1e3);return s.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(E)})}}return a()}}function Me(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function qg(t,e,r={}){let n=Object.keys(r).length===0,i=s=>n||r[s]!==!1;t.get("/health",s=>s.json({ok:!0},200));let o=(s,a)=>t.use(s,$g(e.auth,a));if(o("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),o("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),o("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),o("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),o("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),o("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),o("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),o("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),o("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),o("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),o("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Me(t,rg(e)),Me(t,lg(e)),Me(t,sg(e)),Me(t,cg(e)),Me(t,ag(e)),Me(t,ug(e)),Me(t,ng(e)),Me(t,ig(e)),Me(t,og(e))),i("password")&&(Me(t,wg(e)),Me(t,Ng(e)),Me(t,Rg(e))),i("verification")&&(Me(t,Vg(e)),Me(t,Fg(e))),i("sessions")&&(Me(t,Pg(e)),Me(t,Dg(e)),Me(t,Ug(e))),i("mfa")&&(Me(t,Ag(e)),Me(t,_g(e)),Me(t,gg(e)),Me(t,vg(e)),Me(t,Tg(e))),i("oauth")){let s=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=Bg();return jg(a,c,s),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let u=await a.req.raw.clone().json();typeof u.state=="string"&&(l=u.state)}catch{l=void 0}return l!==void 0&&!Gg(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Me(t,bg(e)),Me(t,xg(e)),Me(t,Sg(e)),Me(t,Ig(e))}i("users")&&Me(t,Hg(e)),i("tenants")&&t.route("",Kg(e))}function ff(t){Lp(Sy);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:o,features:s}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),o&&o.length>0&&(a.trustedOrigins=o);let c=e.security.tokenAudiences?.cookieNames;if(c){let u={cookieNames:c};e.security.systemTenantId&&(u.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=u}let l=new Gr;return qg(l,a,s),l}var Sr=F({message:w(y())}),Wg=F({message:w(y()),tenantId:y(),userId:y()}),mf={tenantId:y(),userId:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),displayNameSource:w(Yt(["user","admin","system"])),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))},zg=F({...mf,status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),memberUpdatedAt:y(),profileUpdatedAt:w(y())}),hS=F({...mf,createdAt:y(),updatedAt:y()}),ES=F({tenantId:y(),userId:y(),status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),updatedAt:y(),tenantProfile:w(hS)}),Jg=Z(ES),Yg=F({tenantId:y(),userId:y()}),yS=F({...mf,status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerm:w(qe()),isOwner:yt(),createdAt:y(),updatedAt:y()}),Xg=Z(yS),gS=F({id:y(),name:w(y()),email:w(y()),jobTitle:w(y())}),Qg=F({id:y(),tenantId:y(),invitedBy:gS,inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y()),status:y(),expiresAt:y(),createdAt:y(),updatedAt:y()}),Zg=Z(Qg),ev=F({inviteId:y(),inviteToken:y(),expiresAt:y()}),tv=F({tenantId:y(),userId:y()}),rv=F({invites:Z(Qg)}),vS=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),status:y(),createdAt:y(),updatedAt:y()}),nv=Z(vS),iv=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),status:y(),createdAt:y(),updatedAt:y(),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),username:w(y()),metadata:w(Ee(y(),ge())),mfaRequired:yt(),mfaMethods:Oi(Z(y()))});var yu={limit:w(Ue(qe(),zn())),cursor:w(y())},AS={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:F({tenantId:y(),userId:y(),tenantType:w(y()),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),displayNameSource:w(Yt(["user","admin","system"])),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))}),response:Wg},TS={method:"POST",path:"/tenant/profile",kind:"data",body:F({tenantId:y(),userId:y()}),response:zg},_S={method:"POST",path:"/tenant/profile/update",kind:"data",body:F({tenantId:y(),userId:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))}),response:Sr},IS={method:"POST",path:"/tenant/members/list",kind:"data",body:F({tenantId:y(),actorUserId:y(),...yu}),response:Jg},xS={method:"POST",path:"/tenant/members/update-status",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),status:Yt(["invited","active","suspended","removed"])}),response:Sr},bS={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y()))}),response:Sr},SS={method:"POST",path:"/tenant/members/remove",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y()}),response:Sr},wS={method:"POST",path:"/tenant/members/add",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y())),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))}),response:Yg},NS={method:"POST",path:"/tenant/invites/list",kind:"data",body:F({tenantId:y(),actorUserId:y(),status:w(Yt(["pending","accepted","declined","revoked","expired"])),...yu}),response:Zg},RS={method:"POST",path:"/tenant/invites/create",kind:"data",body:F({tenantId:y(),invitedBy:y(),inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),response:ev},sv=F({userId:y(),inviteId:w(y()),inviteToken:w(y())}),OS={method:"POST",path:"/tenant/invites/accept",kind:"data",body:sv,response:tv},kS={method:"POST",path:"/tenant/invites/decline",kind:"data",body:sv,response:Sr},CS={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:F({inviteId:y(),revokedBy:y()}),response:Sr},DS={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:F({email:w(y()),phone:w(y())}),response:rv},PS={method:"POST",path:"/user/tenants/list",kind:"data",body:F({userId:y(),tenantType:w(y()),parentTenantId:w(y()),...yu}),response:Xg},ss={actorUserId:y(),systemTenantId:y()},US={method:"POST",path:"/accounts/list",kind:"data",body:F({...ss,status:w(Yt(["active","inactive"])),...yu}),response:nv},LS={method:"POST",path:"/accounts/get",kind:"data",body:F({...ss,userId:y()}),response:iv},MS={method:"POST",path:"/accounts/update-profile",kind:"data",body:F({...ss,userId:y(),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),contactEmail:w(y()),contactPhone:w(y()),metadata:w(Ee(y(),ge()))}),response:Sr},KS={method:"POST",path:"/accounts/update-status",kind:"data",body:F({...ss,userId:y(),status:Yt(["active","suspended","deleted"])}),response:Sr},HS={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:F({...ss,userId:y(),credentialType:w(y())}),response:Sr},FS={method:"POST",path:"/accounts/remove",kind:"data",body:F({...ss,userId:y()}),response:Sr},Je={bootstrapTenantOwner:AS,getTenantProfile:TS,updateTenantProfile:_S,listTenantMembers:IS,updateTenantMemberStatus:xS,updateTenantMemberPermission:bS,removeTenantMember:SS,addMemberToTenant:wS,listTenantInvites:NS,inviteToTenant:RS,acceptInvite:OS,declineInvite:kS,revokeInvite:CS,checkPendingInvites:DS,listUserTenants:PS,listAccounts:US,getAccount:LS,updateAccountProfile:MS,updateAccountStatus:KS,resetAccountCredentials:HS,removeAccount:FS};async function oi(t,e,r,n){let i=await lt({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return d(i.errors,i.meta);let o=await n.tenants.get(e);return o.ok?o.data?o.data.type!==Qt.SYSTEM?d(wt.ACCOUNT_PERMS_SYSTEM_ONLY()):T({actor:i.data}):d(wt.TENANT_NOT_FOUND()):d(o.errors,o.meta)}var In={CANNOT_REMOVE_ACTIVE_ACCOUNT:_("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:_("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:_("NO_CHANGES","At least one field must be provided")};var VS=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function hf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=t.status??"active",o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let s=await r.users.getByStatus(i,o);if(!s.ok)return d(s.errors,s.meta);let a=[];for(let c of s.data){let l=await r.users.getById(c);if(l.ok&&l.data){let u=l.data,p={id:u.id,status:u.status,createdAt:u.createdAt,updatedAt:u.updatedAt};u.contactEmail!==void 0&&(p.contactEmail=u.contactEmail),u.contactPhone!==void 0&&(p.contactPhone=u.contactPhone),u.displayName!==void 0&&(p.displayName=u.displayName),a.push(p)}}return T(a,s.meta)}async function Ef(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return d(i.errors,i.meta);if(!i.data)return d(q.NOT_FOUND());let o=i.data,s=await r.userAuths.get(t.userId),a={id:o.id,status:o.status,createdAt:o.createdAt,updatedAt:o.updatedAt,mfaRequired:s.ok&&s.data?s.data.mfaRequired:!1,mfaMethods:s.ok&&s.data?s.data.mfaMethods:null};return o.contactEmail!==void 0&&(a.contactEmail=o.contactEmail),o.contactPhone!==void 0&&(a.contactPhone=o.contactPhone),o.displayName!==void 0&&(a.displayName=o.displayName),o.givenName!==void 0&&(a.givenName=o.givenName),o.familyName!==void 0&&(a.familyName=o.familyName),o.avatarUrl!==void 0&&(a.avatarUrl=o.avatarUrl),o.locale!==void 0&&(a.locale=o.locale),o.username!==void 0&&(a.username=o.username),o.metadata!==void 0&&(a.metadata=o.metadata),T(a)}async function yf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(In.CANNOT_MODIFY_OWNER());let o=await r.users.getById(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return d(In.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?T(void 0):d(c.errors,c.meta)}async function gf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);if(!VS.has(t.status))return d(In.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(In.CANNOT_MODIFY_OWNER());let o=await r.userAuths.get(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());let s=await r.userAuths.updateStatus(t.userId,t.status);if(!s.ok)return d(s.errors,s.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?T(void 0):d(a.errors,a.meta)}async function vf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(In.CANNOT_MODIFY_OWNER());let o=await r.userAuths.get(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());let s=await r.credentials.getByUserId(t.userId);if(!s.ok)return d(s.errors,s.meta);for(let a of s.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return d(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return d(a.errors,a.meta)}return T(void 0)}async function Af(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(In.CANNOT_MODIFY_OWNER());let o=await r.users.getById(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());if(o.data.status===ye.ACTIVE)return d(In.CANNOT_REMOVE_ACTIVE_ACCOUNT());let s=await r.credentials.getByUserId(t.userId);if(s.ok)for(let l of s.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?T(void 0):d(c.errors,c.meta)}var BS=3,jS=10080,GS=100;function $S(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??jS,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??GS}}}function as(t){return{plugins:{database:t.plugins.database}}}function qS(t){return Pp({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Tf(t){let{auth:e,internal:r}=t,n=qS(r),i=new Gr;i.use("/*",async(g,I)=>{let O=g.req.header("Authorization");if(!O){await I();return}let D=O.match(/^Bearer\s+(.+)$/i);if(!D){await I();return}let C=D[1].split(".");if(C.length!==3||!C[1]){await I();return}let P;try{let L=C[1].replace(/-/g,"+").replace(/_/g,"/");P=JSON.parse(atob(L))}catch{await I();return}if(P.typ!==BS)return g.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let L=P.roles,H=Array.isArray(L)?L:[];if(!r.requiredRoles.some(Y=>H.includes(Y)))return g.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await I()});let o=X(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:Je.bootstrapTenantOwner.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId};return g.body.tenantType!==void 0&&(I.tenantType=g.body.tenantType),g.body.contactEmail!==void 0&&(I.contactEmail=g.body.contactEmail),g.body.contactPhone!==void 0&&(I.contactPhone=g.body.contactPhone),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.displayNameSource!==void 0&&(I.displayNameSource=g.body.displayNameSource),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.avatarUrl!==void 0&&(I.avatarUrl=g.body.avatarUrl),g.body.locale!==void 0&&(I.locale=g.body.locale),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),g.body.bio!==void 0&&(I.bio=g.body.bio),g.body.metadata!==void 0&&(I.metadata=g.body.metadata),pu(I,e)}}),s=X(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:Je.getTenantProfile.body},handler:async g=>{let I=await Ki({tenantId:g.body.tenantId,userId:g.body.userId},e);if(!I.ok)return I;let O=I.data;if(!O)return I;let{authPerm:D,...k}=O;return T({...k,authPerms:Xt(D)})}}),a=X(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:Je.updateTenantProfile.body},handler:async g=>{let{tenantId:I,userId:O,...D}=g.body,k={tenantId:I,userId:O};return D.contactEmail!==void 0&&(k.contactEmail=D.contactEmail),D.contactPhone!==void 0&&(k.contactPhone=D.contactPhone),D.displayName!==void 0&&(k.displayName=D.displayName),D.givenName!==void 0&&(k.givenName=D.givenName),D.familyName!==void 0&&(k.familyName=D.familyName),D.avatarUrl!==void 0&&(k.avatarUrl=D.avatarUrl),D.locale!==void 0&&(k.locale=D.locale),D.bio!==void 0&&(k.bio=D.bio),D.jobTitle!==void 0&&(k.jobTitle=D.jobTitle),D.metadata!==void 0&&(k.metadata=D.metadata),os(k,e)}}),c=X(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:Je.listTenantMembers.body},handler:async g=>{let I={tenantId:g.body.tenantId,actorUserId:g.body.actorUserId};g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await ts(I,e);if(!O.ok)return O;let D=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(D,O.meta)}}),l=X(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:Je.updateTenantMemberStatus.body},handler:async g=>df({tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId,status:g.body.status},e)}),u=X(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:Je.updateTenantMemberPermission.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId};return g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),is(I,e)}}),p=X(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:Je.removeTenantMember.body},handler:async g=>rs({tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId},e)}),f=X(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:Je.addMemberToTenant.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId};return g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),g.body.contactEmail!==void 0&&(I.contactEmail=g.body.contactEmail),g.body.contactPhone!==void 0&&(I.contactPhone=g.body.contactPhone),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.avatarUrl!==void 0&&(I.avatarUrl=g.body.avatarUrl),g.body.locale!==void 0&&(I.locale=g.body.locale),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),g.body.bio!==void 0&&(I.bio=g.body.bio),g.body.metadata!==void 0&&(I.metadata=g.body.metadata),du(I,e)}}),m=X(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:Je.listTenantInvites.body},handler:async g=>{let I={tenantId:g.body.tenantId,actorUserId:g.body.actorUserId};g.body.status!==void 0&&(I.status=g.body.status),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await es(I,e);if(!O.ok)return O;let D=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(D,O.meta)}}),E=X(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:Je.inviteToTenant.body},handler:async g=>{let I={tenantId:g.body.tenantId,invitedBy:g.body.invitedBy};return g.body.inviteeUserId!==void 0&&(I.inviteeUserId=g.body.inviteeUserId),g.body.inviteeEmail!==void 0&&(I.inviteeEmail=g.body.inviteeEmail),g.body.inviteePhone!==void 0&&(I.inviteePhone=g.body.inviteePhone),g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),Zo(I,$S(e))}}),v=X(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:Je.acceptInvite.body},handler:async g=>{let I={userId:g.body.userId};g.body.inviteId!==void 0&&(I.inviteId=g.body.inviteId),g.body.inviteToken!==void 0&&(I.inviteToken=g.body.inviteToken);let O=await Yo(I,e);if(!O.ok)return O;let D=O.data;if(!D)return O;let{authPerm:k,...C}=D;return T({...C,authPerms:Xt(k)})}}),N=X(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:Je.declineInvite.body},handler:async g=>{let I={userId:g.body.userId};return g.body.inviteId!==void 0&&(I.inviteId=g.body.inviteId),g.body.inviteToken!==void 0&&(I.inviteToken=g.body.inviteToken),Qo(I,e)}}),S=X(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:Je.revokeInvite.body},handler:async g=>ns({inviteId:g.body.inviteId,revokedBy:g.body.revokedBy},e)}),R=X(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:Je.checkPendingInvites.body},handler:async g=>{let I={};return g.body.email!==void 0&&(I.email=g.body.email),g.body.phone!==void 0&&(I.phone=g.body.phone),fu(I,e)}}),M=X(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:Je.listUserTenants.body},handler:async g=>{let I={userId:g.body.userId};g.body.tenantType!==void 0&&(I.tenantType=g.body.tenantType),g.body.parentTenantId!==void 0&&(I.parentTenantId=g.body.parentTenantId),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await mu(I,e);if(!O.ok)return O;let D=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(D,O.meta)}}),K=X(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:Je.listAccounts.body},handler:async g=>{let I={actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId};return g.body.status!==void 0&&(I.status=g.body.status),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor),hf(I,as(e))}}),B=X(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:Je.getAccount.body},handler:async g=>Ef({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId},as(e))}),V=X(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:Je.updateAccountProfile.body},handler:async g=>{let{actorUserId:I,systemTenantId:O,userId:D,...k}=g.body,C={actorUserId:I,systemTenantId:O,userId:D};return k.displayName!==void 0&&(C.displayName=k.displayName),k.givenName!==void 0&&(C.givenName=k.givenName),k.familyName!==void 0&&(C.familyName=k.familyName),k.avatarUrl!==void 0&&(C.avatarUrl=k.avatarUrl),k.locale!==void 0&&(C.locale=k.locale),k.contactEmail!==void 0&&(C.contactEmail=k.contactEmail),k.contactPhone!==void 0&&(C.contactPhone=k.contactPhone),k.metadata!==void 0&&(C.metadata=k.metadata),yf(C,as(e))}}),$=X(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:Je.updateAccountStatus.body},handler:async g=>gf({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId,status:g.body.status},as(e))}),A=X(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:Je.resetAccountCredentials.body},handler:async g=>{let I={actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId};return g.body.credentialType!==void 0&&(I.credentialType=g.body.credentialType),vf(I,as(e))}}),x=X(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:Je.removeAccount.body},handler:async g=>Af({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId},as(e))});function b(g){let{method:I,path:O}=g.routeMeta,D=I.toLowerCase();i[D](O,g)}return b(o),b(s),b(a),b(c),b(l),b(u),b(p),b(f),b(m),b(E),b(v),b(N),b(S),b(R),b(M),b(K),b(B),b(V),b($),b(A),b(x),i}var av=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},cv=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,o=e.length-1;i<=n;i++,o--)r[i]=e.charCodeAt(i),r[o]=e.charCodeAt(o);return r};function Fa(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var WS=t=>t.requestContext;var _f=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=rw(r),o,s;try{o=i.createRequest(r),s=WS(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(o,{event:r,requestContext:s,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},gu=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=`https://${this.getDomainName(t)}${this.getPath(t)}`,n=e?`${r}?${e}`:r,i=this.getHeaders(t),o={headers:i,method:this.getMethod(t)};if(t.body){let s=t.isBase64Encoded?cv(t.body):new TextEncoder().encode(t.body);o.body=s,i.set("content-length",s.length.toString())}return new Request(n,o)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??lv,o=!!(n&&i(n));if(!o){let a=e.headers.get("content-encoding");o=sw(a)}let s={body:o?av(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:o,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,s),s.multiValueHeaders?e.headers.forEach((a,c)=>{s.multiValueHeaders[c]=[a]}):e.headers.forEach((a,c)=>{s.headers[c]=a}),s}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},zS=class extends gu{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},JS=new zS,YS=class extends gu{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e!==void 0).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.multiValueHeaders)for(let[r,n]of Object.entries(t.multiValueHeaders))n&&n.forEach(i=>e.append(r,Fa(i)));if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&!e.has(r)&&e.set(r,Fa(n));return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},XS=new YS,QS=class extends gu{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=Fa(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,Fa(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e!==void 0).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},ZS=new QS,ew=class extends gu{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&n.forEach(i=>e.append(r,Fa(i)));return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},tw=new ew,rw=t=>nw(t)?ZS:iw(t)?JS:ow(t)?tw:XS,nw=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,iw=t=>Object.hasOwn(t,"rawPath")&&Object.hasOwn(t.requestContext??{},"http"),ow=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,lv=t=>/^application\/vnd\.(?:apple\.installer|mozilla\.xul)\+xml\s*(?:;|$)/i.test(t)?!0:!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/i.test(t),sw=t=>!!t&&!/^identity$/i.test(t);var uv=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH","QUERY"],allowHeaders:[],exposeHeaders:[],...t},r=e.exposeHeaders?.length?e.exposeHeaders.join(","):void 0,n=e.allowHeaders?.length?e.allowHeaders.join(","):void 0,i=(s=>typeof s=="string"?s==="*"?()=>s:a=>s===a?a:null:typeof s=="function"?s:a=>s.includes(a)?a:null)(e.origin),o=(s=>{if(typeof s=="function")return async(a,c)=>(await s(a,c)).join(",");if(Array.isArray(s)){let a=s.join(",");return()=>a}else return()=>""})(e.allowMethods);return async function(a,c){function l(p,f){a.res.headers.set(p,f)}let u=await i(a.req.header("origin")||"",a);if(u&&l("Access-Control-Allow-Origin",u),e.credentials&&l("Access-Control-Allow-Credentials","true"),r&&l("Access-Control-Expose-Headers",r),a.req.method==="OPTIONS"){e.origin!=="*"&&a.res.headers.append("Vary","Origin"),e.maxAge!=null&&l("Access-Control-Max-Age",e.maxAge.toString());let p=await o(a.req.header("origin")||"",a);p&&l("Access-Control-Allow-Methods",p);let f=n;if(!f){let m=a.req.header("Access-Control-Request-Headers");m&&(f=m.split(",").map(E=>E.trim()).join(","))}return f&&(l("Access-Control-Allow-Headers",f),a.res.headers.append("Vary","Access-Control-Request-Headers")),a.res.headers.delete("Content-Length"),a.res.headers.delete("Content-Type"),new Response(null,{headers:a.res.headers,status:204,statusText:"No Content"})}await c(),e.origin!=="*"&&a.header("Vary","Origin",{append:!0})}};var aw={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function Fi(t={}){let e={...aw,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var If={LOW:Fi({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:Fi({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:Fi({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:Fi({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var dv={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function xf(t,e={}){return{system:t,policy:{...dv.policy,...e.policy??{}},version:e.version??dv.version,...e.email&&{email:e.email}}}var pv=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],fv=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],bf=[...pv,...fv];var cr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function mv(t,e){if(!t||typeof t!="object")throw new cr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new cr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new cr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new cr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new cr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new cr(e,'"health" must be a function if provided')}function hv(t,e,r){for(let n of r){if(!(n in t))throw new cr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new cr(e,`"${n}" must be a function`)}}var Ev={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function yv(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",o=typeof r.parseUserAgent=="function";if(!i&&!o)throw new cr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Ev[e];n&&hv(t,String(e),n)}function Sf(t,e){mv(t,String(e)),yv(t,e)}var gv={debug:0,info:1,warn:2,error:3},vu=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=gv[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&gv[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),o=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${o} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function vv(t){return new vu(t)}var Au=new vu({enabled:!1});function cs(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Vi(t,e){let r=cs(t),n=cs(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Av(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Vi(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=cs(r),i=cs(t);return!n||!i?!1:i.major===n.major&&Vi(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=cs(r),i=cs(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Vi(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Vi(t,e.slice(2))>=0:e.startsWith(">")?Vi(t,e.slice(1))>0:e.startsWith("<=")?Vi(t,e.slice(2))<=0:e.startsWith("<")?Vi(t,e.slice(1))<0:!1}function cw(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function lw(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function ls(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())wf(n,i);return t}let e=[];if(cw(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,o]=n;wf(i,o),r.set(i,o)}return r}function wf(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");lw(t,e)}function Nf(t,e){wf(t,e)}function Tu(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function _u(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function Rf(t,e={},r,n=Au,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let o=new Map;for(let E of t)o.set(E.name,E);let s=new Map,a=new Map;for(let E of o.keys())s.set(E,0),a.set(E,[]);for(let E of o.values()){let v=E.dependencies??[];for(let N of v){let S=typeof N=="string"?N:N.name,R=typeof N=="string"?void 0:N.version;if(!o.has(S))throw new Error(`Plugin '${String(E.name)}' depends on '${String(S)}' which is not defined`);if(R){let M=o.get(S);if(M.version&&!Av(M.version,R))throw new Error(`Plugin '${String(E.name)}' requires '${String(S)}' ${R}, but version ${M.version} is provided`)}a.get(S).push(E.name),s.set(E.name,(s.get(E.name)??0)+1)}}let c=[];for(let[E,v]of s.entries())v===0&&c.push(E);let l=[];for(;c.length>0;){let E=c.shift();l.push(E);for(let v of a.get(E)??[]){let N=(s.get(v)??0)-1;s.set(v,N),N===0&&c.push(v)}}if(l.length!==o.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let u={},p={get(E){if(!u[E])throw new Error(`Plugin '${String(E)}' not found or not yet initialized`);return u[E]},has(E){return E in u},getRegistry(){return u}};for(let E of l){n.group(`Initializing plugin: ${String(E)}`),n.time(`Plugin: ${String(E)}`);let v=o.get(E),N=e[E],S=null;if(N!==void 0?(n.debug("Using override"),Tu(N)?(n.debug("Creating from factory wrapper"),S=await N.create(p)):_u(N)?(n.debug("Lazy loading plugin"),S=await N.load()):(n.debug("Using direct instance"),S=N)):v.factory?(n.debug("Creating from descriptor factory"),S=await v.factory(p)):v.instance&&(n.debug("Using descriptor instance"),S=v.instance),!S&&v.required)throw new Error(`Required plugin '${String(E)}' is missing`);if(S){if(E==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{Sf(S,E),n.debug("Validation passed")}catch(K){throw n.error("Validation failed:",K),new Error(`Plugin '${String(E)}' validation failed: ${K instanceof Error?K.message:String(K)}`)}}u[E]=S;let M=S;M.initialize&&(n.debug("Calling plugin initialize()"),await M.initialize()),n.info(`Plugin '${String(E)}' initialized successfully`)}else n.warn(`Plugin '${String(E)}' is null/undefined`);n.timeEnd(`Plugin: ${String(E)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),u.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),u.credential=e.credential),i.extraEntries&&Object.assign(u,i.extraEntries),!uw(u))throw new Error("Plugin registry is incomplete - missing required plugins");let f=u,m=ls(f.oauthProviders);if(!m){let E=e.oauthProviders;E!==void 0&&!Tu(E)&&!_u(E)?m=ls(E)??new Map:m=new Map}return f.oauthProviders=m,await r?.afterInit?.(f),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),f}function uw(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function Of(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function Va(t){let e=t.debug?vv({enabled:!0,prefix:"[auth-core SDK]"}):Au;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=ls(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await Rf(bf,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let o=Fi(t.security??{});e.debug("Security level:",o.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let s=xf({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",s.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:o,system:s,async healthCheck(){let a=[];for(let[l,u]of Object.entries(i)){if(!u||typeof u!="object")continue;let p=u,f={name:String(l),healthy:!0};if(p.health)try{let m=await p.health();f.healthy=m,m||(f.error=`Plugin '${l}' health check failed`)}catch(m){f.healthy=!1,f.error=m instanceof Error?m.message:"Health check threw error"}a.push(f)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await Of(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");Nf(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var xu=[];function Ba(t){let e=process.env[t];return e||(xu.push(t),"")}function kf(t,e){return e?Ba(t):process.env[t]??""}function Tv(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function mw(t){let e=Tv(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var hw=process.env.SMTP_MODE==="smtp"?"smtp":"console",Bi=process.env.EMAIL_MODE;if(Bi&&Bi!=="queue"&&Bi!=="smtp"&&Bi!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Bi}`);var us=Bi||hw,Ew=us==="console"?"console":"smtp",Cf=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",bu=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(us==="queue"&&Cf!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${Cf}`);if(bu!=="generic"&&bu!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${bu}`);function Iu(t,e){if(t){if(t==="body"||t==="cookie"||t==="both")return t;throw new Error(`${e} must be one of body|cookie|both, got: ${t}`)}}function yw(){let t=Iu(process.env.REFRESH_TOKEN_STRATEGY,"REFRESH_TOKEN_STRATEGY"),e=Iu(process.env.REFRESH_TOKEN_STRATEGY_CUSTOMER,"REFRESH_TOKEN_STRATEGY_CUSTOMER"),r=Iu(process.env.REFRESH_TOKEN_STRATEGY_TENANT,"REFRESH_TOKEN_STRATEGY_TENANT"),n=Iu(process.env.REFRESH_TOKEN_STRATEGY_SYSTEM,"REFRESH_TOKEN_STRATEGY_SYSTEM");if(e||r||n){let i=t??"body";return{customer:e??i,tenant:r??i,system:n??i}}return t??"cookie"}var ja=yw(),gw=typeof ja=="string"?ja==="cookie"||ja==="both":Object.values(ja).some(t=>t==="cookie"||t==="both"),j={dynamodbTableName:Ba("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:Ba("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:Ba("JWT_PRIVATE_KEY"),jwtPublicKey:Ba("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:kf("SMTP_USER",us==="smtp"),pass:kf("SMTP_PASS",us==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:Ew},email:{mode:us,queue:{provider:Cf,url:kf("EMAIL_QUEUE_URL",us==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:bu,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:mw("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:Tv("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:ja,...gw?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__",tokenAudiences:{customer:process.env.TOKEN_AUD_CUSTOMER||"customer",tenant:process.env.TOKEN_AUD_TENANT||"tenant",system:process.env.TOKEN_AUD_SYSTEM||"system",cookieNames:{customer:process.env.REFRESH_COOKIE_CUSTOMER||"refresh_token",tenant:process.env.REFRESH_COOKIE_TENANT||"refresh_token_tenant",system:process.env.REFRESH_COOKIE_SYSTEM||"refresh_token_system"}}},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function _v(){if(xu.length>0){let t=xu.map(e=>`  - ${e}`).join(`
+`);throw new Error(`Missing required environment variables (${xu.length}):
+${t}`)}if(j.nodeEnv==="production"&&!j.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Df(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function vw(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Su(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return vw(r)}async function Pf(t,e){let r=await Su(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var Aw="otp",Iv={INVALID_CODE:_("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:_("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function Tw(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function xv(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:Aw,challengeType:"verification-code",async create(){return T({value:"",data:null})},async update(){return T({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let s=Df(e),a=await Su(s),c=new Date(Date.now()+r*60*1e3);return T({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:s,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:Tw(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await Pf(n.credentialValue,i)?T({userId:n.userId,intents:[]}):d(Iv.INVALID_CODE()):d(Iv.MISSING_CHALLENGE_CONTEXT())}}}function bv(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}var wu=t=>t?`"${t}" `:"";function Ye(t,e=""){if(typeof t!="number")throw new TypeError(wu(e)+"expected number, got "+typeof t);if(!Number.isSafeInteger(t)||t<0)throw new RangeError(wu(e)+"expected integer >= 0, got "+t);return t}function wv(t,e=""){if(typeof t!="boolean")throw new TypeError(wu(e)+"expected boolean, got type="+typeof t);return t}function xn(t,e,r=""){if(bv(t)&&(e===void 0||t.length===e))return t;e!==void 0&&Ye(e,"length");let n=bv(t),i=e!==void 0?` of length ${e}`:"",o=n?`length=${t.length}`:`type=${typeof t}`,s=wu(r)+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)}function Nu(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("expected hash wrapped by utils.createHasher");if(Ye(t.outputLen),Ye(t.blockLen),t.outputLen<1||t.blockLen<1)throw new Error("hash blockLen / outputLen must be >= 1")}var _w=(t,e)=>{if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError((e==="object"?"":`"${e}" `)+"expected object, got type="+typeof t)},Sv=(t,e)=>{_w(t,e);let r=Object.getPrototypeOf(t);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${e}" expected plain object`);if(Object.hasOwn(t,"__proto__"))throw new TypeError(`"${e}.__proto__" is not allowed`)};function bn(t,e=!0){if(t.destroyed)throw new Error("hash was destroyed");if(e&&t.finished)throw new Error("digest() was already called")}function ds(t,e){xn(t,void 0,"output");let r=e.outputLen;if(!(t.length>=r))throw new RangeError('"output" expected length >= '+r)}function ji(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function Nt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function ps(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function wr(t,e){return t<<32-e|t>>>e}function be(t,e){return t<<e|t>>>32-e>>>0}var Iw=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function xw(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function bw(t){for(let e=0;e<t.length;e++)t[e]=xw(t[e]);return t}var fs=Iw?t=>t:bw;function Sw(t){if(typeof t!="string")throw new TypeError("string expected");let e=new TextEncoder().encode(t);try{return new Uint8Array(e)}finally{Nt(e)}}function Uf(t,e=""){return typeof t=="string"?Sw(t):xn(t,void 0,e)}function ms(t,e,r="opts"){return Sv(t,"defaults"),e!==void 0&&Sv(e,r),Object.assign(Object.create(null),t,e)}function Ru(t,e={}){if(typeof t!="function")throw new TypeError('"hashCons" expected function, got type='+typeof t);e=ms({},e,"info");let r=(i,o)=>t(o).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function Lf(t=32){Ye(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var Ou=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var ku=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(Nu(e),xn(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("expected Hash instance");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let o=0;o<i.length;o++)i[o]^=54;this.iHash.update(i),this.oHash=e.create();for(let o=0;o<i.length;o++)i[o]^=106;this.oHash.update(i),Nt(i)}update(e){return bn(this),this.iHash.update(e),this}digestInto(e){bn(this),ds(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:o,blockLen:s,outputLen:a,canXOF:c}=this;return e=e,e.finished=i,e.destroyed=o,e.blockLen=s,e.outputLen=a,e.canXOF=c,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Nv=(()=>{let t=((e,r,n)=>new ku(e,r).update(n).digest());return t.create=(e,r)=>new ku(e,r),t})();function Nw(t,e,r,n){Nu(t);let i=ms({dkLen:32,asyncTick:10},n),{c:o,dkLen:s,asyncTick:a}=i;if(Ye(o,"c"),Ye(s,"dkLen"),Ye(a,"asyncTick"),o<1)throw new Error('"c" (iterations) must be >= 1');if(s<1)throw new Error('"dkLen" must be >= 1');if(s>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=Uf(e,"password");try{let l=Uf(r,"salt");try{let u=new Uint8Array(s),{iHash:p,oHash:f,outputLen:m}=Nv.create(t,c),E=new Uint8Array(m),v=Rw(p,f,l,E);return{c:o,dkLen:s,asyncTick:a,DK:u,outputLen:m,eng:v}}finally{typeof r=="string"&&Nt(l)}}finally{typeof e=="string"&&Nt(c)}}function Rw(t,e,r,n){let i=new Uint8Array(4),o=ps(i),s=t._cloneInto().update(r),a=e._cloneInto(),c=t._cloneInto,l=e._cloneInto;return{u1:(u,p)=>{o.setInt32(0,u,!1),s._cloneInto(a).update(i).digestInto(n),e._cloneInto(a).update(n).digestInto(n),p.set(n.subarray(0,p.length))},rounds:(u,p)=>{for(let f=1;f<u;f++){c.call(t,a).update(n).digestInto(n),l.call(e,a).update(n).digestInto(n);for(let m=0;m<p.length;m++)p[m]^=n[m]}},output:u=>(t.destroy(),e.destroy(),s.destroy(),a.destroy(),Nt(n),u)}}function Mf(t,e,r,n){let{c:i,dkLen:o,DK:s,outputLen:a,eng:c}=Nw(t,e,r,n);for(let l=1,u=0;u<o;l++,u+=a){let p=s.subarray(u,u+a);c.u1(l,p),c.rounds(i,p)}return c.output(s)}var Cu=BigInt(4294967295),Rv=BigInt(32);function Ow(t,e=!1){return e?{h:Number(t&Cu),l:Number(t>>Rv&Cu)}:{h:Number(t>>Rv&Cu)|0,l:Number(t&Cu)|0}}function Ov(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let o=0;o<r;o++){let{h:s,l:a}=Ow(t[o],e);[n[o],i[o]]=[s,a]}return[n,i]}var kw=t=>t/2**32|0,Cw=t=>t>>>0;function kv(t,e,r,n){let i=kw(r),o=Cw(r);t.setUint32(e,n?o:i,n),t.setUint32(e+4,n?i:o,n)}function Cv(t,e,r){return t&e^~t&r}function Dv(t,e,r){return t&e^t&r^e&r}var Du=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=ps(this.buffer)}update(e){bn(this),xn(e);let{view:r,buffer:n,blockLen:i}=this,o=e.length,s=!1;for(let a=0;a<o;){let c=Math.min(i-this.pos,o-a);if(c===i){let l=ps(e);for(;i<=o-a;a+=i)this.process(l,a);s=!0;continue}n.set(a===0&&c===o?e:e.subarray(a,a+c),this.pos),this.pos+=c,a+=c,this.pos===i&&(this.process(r,0),this.pos=0,s=!0)}return this.length+=e.length,s&&this.roundClean(),this}digestInto(e){bn(this),ds(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:o}=this,{pos:s}=this;r[s++]=128,r.fill(0,s),this.padOffset>i-s&&(this.process(n,0),r.fill(0)),kv(n,i-8,this.length*8,o),this.process(n,0),this.roundClean();let a=e===r?n:ps(e),c=this.outputLen,l=c/4,u=this.get();if(c%4||l>u.length)throw new Error("invalid outputLen");for(let p=0;p<l;p++)a.setUint32(4*p,u[p],o)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:r,length:n,finished:i,destroyed:o,pos:s}=this;return e.destroyed=o,e.finished=i,e.length=n,e.pos=s,s&&e.buffer.set(r),e}clone(){return this._cloneInto()}},Pv=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var Dw=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),si=new Uint32Array(64),Kf=class extends Du{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,r){super(64,e,8,!1),this.A=r[0]|0,this.B=r[1]|0,this.C=r[2]|0,this.D=r[3]|0,this.E=r[4]|0,this.F=r[5]|0,this.G=r[6]|0,this.H=r[7]|0}get(){let{A:e,B:r,C:n,D:i,E:o,F:s,G:a,H:c}=this;return[e,r,n,i,o,s,a,c]}set(e,r,n,i,o,s,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=o|0,this.F=s|0,this.G=a|0,this.H=c|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,r){for(let p=0;p<16;p++,r+=4)si[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let f=si[p-15],m=si[p-2],E=wr(f,7)^wr(f,18)^f>>>3,v=wr(m,17)^wr(m,19)^m>>>10;si[p]=v+si[p-7]+E+si[p-16]|0}let{A:n,B:i,C:o,D:s,E:a,F:c,G:l,H:u}=this;for(let p=0;p<64;p++){let f=wr(a,6)^wr(a,11)^wr(a,25),m=u+f+Cv(a,c,l)+Dw[p]+si[p]|0,v=(wr(n,2)^wr(n,13)^wr(n,22))+Dv(n,i,o)|0;u=l,l=c,c=a,a=s+m|0,s=o,o=i,i=n,n=m+v|0}n=n+this.A|0,i=i+this.B|0,o=o+this.C|0,s=s+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,u=u+this.H|0,this.set(n,i,o,s,a,c,l,u)}roundClean(){Nt(si)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),Nt(this.buffer)}},Hf=class extends Kf{constructor(){super(32,Pv)}};var Ff=Ru(()=>new Hf,Ou(1));function Uv(t,e,r,n,i,o){let s=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],u=t[e++]^r[n++],p=t[e++]^r[n++],f=t[e++]^r[n++],m=t[e++]^r[n++],E=t[e++]^r[n++],v=t[e++]^r[n++],N=t[e++]^r[n++],S=t[e++]^r[n++],R=t[e++]^r[n++],M=t[e++]^r[n++],K=t[e++]^r[n++],B=t[e++]^r[n++],V=s,$=a,A=c,x=l,b=u,g=p,I=f,O=m,D=E,k=v,C=N,P=S,L=R,H=M,z=K,Y=B;for(let pe=0;pe<8;pe+=2)b^=be(V+L|0,7),D^=be(b+V|0,9),L^=be(D+b|0,13),V^=be(L+D|0,18),k^=be(g+$|0,7),H^=be(k+g|0,9),$^=be(H+k|0,13),g^=be($+H|0,18),z^=be(C+I|0,7),A^=be(z+C|0,9),I^=be(A+z|0,13),C^=be(I+A|0,18),x^=be(Y+P|0,7),O^=be(x+Y|0,9),P^=be(O+x|0,13),Y^=be(P+O|0,18),$^=be(V+x|0,7),A^=be($+V|0,9),x^=be(A+$|0,13),V^=be(x+A|0,18),I^=be(g+b|0,7),O^=be(I+g|0,9),b^=be(O+I|0,13),g^=be(b+O|0,18),P^=be(C+k|0,7),D^=be(P+C|0,9),k^=be(D+P|0,13),C^=be(k+D|0,18),L^=be(Y+z|0,7),H^=be(L+Y|0,9),z^=be(H+L|0,13),Y^=be(z+H|0,18);i[o++]=s+V|0,i[o++]=a+$|0,i[o++]=c+A|0,i[o++]=l+x|0,i[o++]=u+b|0,i[o++]=p+g|0,i[o++]=f+I|0,i[o++]=m+O|0,i[o++]=E+D|0,i[o++]=v+k|0,i[o++]=N+C|0,i[o++]=S+P|0,i[o++]=R+L|0,i[o++]=M+H|0,i[o++]=K+z|0,i[o++]=B+Y|0}function Vf(t,e,r,n,i){let o=n+0,s=n+16*i;for(let a=0;a<16;a++)r[s+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,o+=16,e+=16)Uv(r,s,t,e,r,o),a>0&&(s+=16),Uv(r,o,t,e+=16,r,s)}var Pw=1024*(2**20+1+1);function Uw(t,e,r){let n=ms({dkLen:32,asyncTick:10,maxmem:Pw},r),{N:i,r:o,p:s,dkLen:a,asyncTick:c,maxmem:l,onProgress:u}=n;if(Ye(i,"N"),Ye(o,"r"),Ye(s,"p"),Ye(a,"dkLen"),Ye(c,"asyncTick"),Ye(l,"maxmem"),u!==void 0&&typeof u!="function")throw new Error('"onProgress" must be a function');if(o<1)throw new Error('"r" expected integer >= 1');let p=128*o,f=p/4,m=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>m)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(s<1||s>(m-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(m-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let E=p*(i+s+1);if(E>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+E+", maxmem="+l);let v=Mf(Ff,t,e,{c:1,dkLen:p*s}),N=ji(v),S=ji(new Uint8Array(p*i)),R=ji(new Uint8Array(p)),M=()=>{};if(u){let K=2*i*s,B=Math.max(Math.floor(K/1e4),1),V=0;M=()=>{if(V++,u&&(!(V%B)||V===K))try{u(V/K)}catch($){throw Nt(v,S,R),$}}}return{N:i,r:o,p:s,dkLen:a,blockSize32:f,V:S,B32:N,B:v,tmp:R,blockMixCb:M,asyncTick:c}}function Lw(t,e,r,n,i){let o=Mf(Ff,t,r,{c:1,dkLen:e});return Nt(r,n,i),o}function Pu(t,e,r){let{N:n,r:i,p:o,dkLen:s,blockSize32:a,V:c,B32:l,B:u,tmp:p,blockMixCb:f}=Uw(t,e,r);fs(l);for(let m=0;m<o;m++){let E=a*m;for(let v=0;v<a;v++)c[v]=l[E+v];for(let v=0,N=0;v<n-1;v++)Vf(c,N,c,N+=a,i),f();Vf(c,(n-1)*a,l,E,i),f();for(let v=0;v<n;v++){let N=(l[E+a-16]&n-1)>>>0;for(let S=0;S<a;S++)p[S]=l[E+S]^c[N*a+S];Vf(p,0,l,E,i),f()}}return fs(l),Lw(t,s,u,c,p)}var Mw={N:2**15,r:8,p:1,dkLen:32,saltLength:32},Kw={N:2**14,r:8,p:1};function Lv(t,e,r){return`${t.N}.${t.r}.${t.p}.${Mv(e)}.${Mv(r)}`}function Hw(t){let e=t.split(".");if(e.length===5){let[r,n,i,o,s]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:Uu(o),expected:Uu(s)}}if(e.length===2){let[r,n]=e;return{params:Kw,salt:Uu(r),expected:Uu(n)}}return null}function Mv(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Uu(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function Kv(t={}){let e={...Mw,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return d([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=Lf(e.saltLength),o=await Pu(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),s=Lv({N:e.N,r:e.r,p:e.p},i,o);return T({value:s,data:n.metadata??null})}catch(i){let o=i instanceof Error?i.message:"Unknown error";return d([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async update(n,i){if(!n.value)return T({});try{if(typeof n.value!="string"||n.value.length===0)return d([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let o=Lf(e.saltLength),s=await Pu(r.encode(n.value),o,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=Lv({N:e.N,r:e.r,p:e.p},o,s);return T({value:a,...n.data&&{data:n.data}})}catch(o){let s=o instanceof Error?o.message:"Unknown error";return d([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async verify(n){try{if(!n.credential?.value)return d([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return d([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=Hw(n.credential.value);if(!i)return d([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:o,salt:s,expected:a}=i;if(s.length!==e.saltLength||a.length!==e.dkLen)return d([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await Pu(r.encode(n.credentialValue),s,{N:o.N,r:o.r,p:o.p,dkLen:e.dkLen});if(c.length!==a.length)return d([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?T({userId:n.userId,credentialId:"password"}):d([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),d([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var Fv=H_(Hv(),1);function Vv(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new Fv.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let o=r.browser.name??"",s=r.os.name??"";return{deviceName:i,browser:o,os:s,browserName:o,osName:s}}}}import{createHash as Fw}from"node:crypto";import{SendMessageCommand as Vw,SQSClient as Bw}from"@aws-sdk/client-sqs";var jw={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var Mu=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new Bw(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new Vw({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:Gw(n)})}return T(void 0)}catch(r){return d({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},o=this.config.eventTypeMap?.[e.template]??jw[e.template]??e.template,s=Gi(i.eventId)??Gi(i.challengeId)??crypto.randomUUID(),a=n?`${s}:${$w(r)}`:s,c=Gi(i.locale),l=Gi(i.traceId)??a,u=qw(this.config.defaultMetadata,i),p=Ww(i);if(this.config.envelope==="snapshot-auth-v1"){let f=Gi(u?.tenantId),m=Gi(u?.tenantType),E=Gi(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:o,to:r,...E?{userId:E}:{},...f?{tenantId:f}:{},...m?{tenantType:m}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:o,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...u?{metadata:u}:{},data:p}}};function Gi(t){return typeof t=="string"&&t.length>0?t:void 0}function Gw(t){return t.split("@")[1]||"(unknown)"}function $w(t){return Fw("sha256").update(t).digest("hex").slice(0,16)}function qw(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function Ww(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var $a=class t{static createAwsSqs(e){return new Mu(e)}static create(e){return t.createAwsSqs(e.sqs)}};import{EventEmitter as SR}from"node:events";import nN from"node:net";import Wf from"node:url";var zw=/^xn--/,Jw=/[^\0-\x7F]/,Yw=/[\x2E\u3002\uFF0E\uFF61]/g,Xw={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},Bf=35,Jr=Math.floor,jf=String.fromCharCode;function ai(t){throw new RangeError(Xw[t])}function Qw(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function jv(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(Yw,".");let i=t.split("."),o=Qw(i,e).join(".");return n+o}function Zw(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let o=t.charCodeAt(r++);(o&64512)==56320?e.push(((i&1023)<<10)+(o&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var eN=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},Bv=function(t,e){return t+22+75*+(t<26)-(+(e!=0)<<5)},Gv=function(t,e,r){let n=0;for(t=r?Jr(t/700):t>>1,t+=Jr(t/e);t>Bf*26>>1;n+=36)t=Jr(t/Bf);return Jr(n+(Bf+1)*t/(t+38))},tN=function(t){let e=[],r=t.length,n=0,i=128,o=72,s=t.lastIndexOf("-");s<0&&(s=0);for(let a=0;a<s;++a)t.charCodeAt(a)>=128&&ai("not-basic"),e.push(t.charCodeAt(a));for(let a=s>0?s+1:0;a<r;){let c=n;for(let u=1,p=36;;p+=36){a>=r&&ai("invalid-input");let f=eN(t.charCodeAt(a++));f>=36&&ai("invalid-input"),f>Jr((2147483647-n)/u)&&ai("overflow"),n+=f*u;let m=p<=o?1:p>=o+26?26:p-o;if(f<m)break;let E=36-m;u>Jr(2147483647/E)&&ai("overflow"),u*=E}let l=e.length+1;o=Gv(n-c,l,c==0),Jr(n/l)>2147483647-i&&ai("overflow"),i+=Jr(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},rN=function(t){let e=[],r=Zw(t),n=r.length,i=128,o=0,s=72;for(let l of r)l<128&&e.push(jf(l));let a=e.length,c=a;for(a&&e.push("-");c<n;){let l=2147483647;for(let p of r)p>=i&&p<l&&(l=p);let u=c+1;l-i>Jr((2147483647-o)/u)&&ai("overflow"),o+=(l-i)*u,i=l;for(let p of r)if(p<i&&++o>2147483647&&ai("overflow"),p===i){let f=o;for(let m=36;;m+=36){let E=m<=s?1:m>=s+26?26:m-s;if(f<E)break;let v=f-E,N=36-E;e.push(jf(Bv(E+v%N,0))),f=Jr(v/N)}e.push(jf(Bv(f,0))),s=Gv(o,u,c===a),o=0,++c}++o,++i}return e.join("")},$v=function(t){return jv(t,function(e){return zw.test(e)?tN(e.slice(4).toLowerCase()):e})},hs=function(t){return jv(t,function(e){return Jw.test(e)?"xn--"+rN(e):e})};var iN=/^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/,oN=/^[\x00-\x20]+|[\x00-\x20]+$/g,sN=/^[\x00-\x20\u00a0\ufeff]+/,aN=/^([a-zA-Z0-9+.-]+:)?[\\/]{2}([^\\/?#]*)/,cN=/[\x00-\x20#/:<>?@[\\\]^|\x7f]/,lN=/[\x00-\x1f\x7f]/;function uN(t){let e=new TypeError("Invalid URL");return e.code="ERR_INVALID_URL",e.input=t,e}function $f(t,e,r,n){let i=Wf.parse(t,e,n),o=aN.exec(t.replace(sN,""));if(o&&(o[1]||i.hostname!==null)){let c=o[2].slice(o[2].lastIndexOf("@")+1);if(!c||lN.test(c)||(i.host||"").toLowerCase()!==hs(c.toLowerCase())||c.charAt(0)==="["&&!nN.isIPv6(c.slice(1,c.indexOf("]"))))throw r}else if(i.hostname!==null)throw r;let s=i.auth===null||i.auth===void 0?null:i.auth.split(":"),a=i;return a.username=s?s.shift():null,a.password=s&&s.length?s.join(":"):null,a}function qf(t){try{return decodeURIComponent(t)}catch{return t}}function dN(t,e){let r=t||"";if(!r)return"";if(r.charAt(0)==="["&&r.charAt(r.length-1)==="]")return r.slice(1,-1);let n=qf(r),i=cN.test(n)?"":Wf.domainToASCII(n);if(!i)throw uN(e);return i}var Nr=(t,e)=>{t=(t||"").replace(oN,"");let r=iN.exec(t),n=r?r[1]+"//"+r[2]:t,i;try{i=new URL(n)}catch(m){return $f(n,e,m)}let o=dN(i.hostname,i.href),s=i.port||null,a=i.pathname||null,c=i.search||null,l=null,u=null,p=null;(i.username||i.password)&&(u=qf(i.username),p=i.password?qf(i.password):null,l=u+(p!==null?":"+p:""));let f;if(e){let m=Object.create(null);i.searchParams.forEach((E,v)=>{if(Object.prototype.hasOwnProperty.call(m,v)){let N=m[v];Array.isArray(N)?N.push(E):m[v]=[N,E]}else m[v]=E}),f=m}else f=c?c.slice(1):null;return{protocol:i.protocol||null,host:i.host||null,hostname:o,port:s,pathname:a,search:c,path:(a||"")+(c||"")||null,href:i.href,auth:l,username:u,password:p,query:f}},qv=(t,e)=>{try{return new URL(e,t).href}catch(r){return $f(t,!1,r,!0),$f(e,!1,r,!0),Wf.resolve(t,e)}};import _N from"node:util";import IN from"node:fs";import mN from"node:http";import hN from"node:https";import EN from"node:zlib";import{PassThrough as yN}from"node:stream";import pN from"node:net";var Wv=1800,zf=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=Nr(r||""),i=this.parse(e),o;return i.domain?(o=i.domain.replace(/^\./,""),(n.hostname.length<o.length||o.indexOf(".")<0||o.endsWith(".")||pN.isIP(n.hostname)||!("."+n.hostname).endsWith("."+o))&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||Wv)||Wv)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={},n=!1;return(e||"").toString().split(";").forEach(i=>{if(!i.trim())return;let o=i.split("="),s=o.shift().trim(),a=o.join("=").trim(),c;if(!n){n=!0,s&&(r.name=s,r.value=a);return}switch(s.toLowerCase()){case"expires":{let l=new Date(a);l.toString()!=="Invalid Date"&&(r.expires=l);break}case"path":r.path=a;break;case"domain":c=a.toLowerCase(),c.length&&c.charAt(0)!=="."&&(c="."+c),r.domain=c;break;case"max-age":r.expires=new Date(Date.now()+(Number(a)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break}}),r}match(e,r){let n=Nr(r||"");if(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain))return!1;let i=n.pathname||"/",o=e.path;return!(!(i===o||i.startsWith(o)&&(o.endsWith("/")||i.charAt(o.length)==="/"))||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");r.pop();let n=r.join("/").trim();return n.charAt(0)!=="/"?"/":n}},Jf=zf;var Ku="nodemailer",Xe="10.1.0",zv="https://nodemailer.com/";import gN from"node:net";var Hu="ECONNECTION",Yf="ETIMEDOUT",fN="ESOCKET";var Jv="EENVELOPE",Yv="EMESSAGE",Fu="ESTREAM";var Vu="ENOAUTH",ci="EOAUTH2",Bu="EMAXLIMIT",Xv="EMAXRECIPIENTS",ju="ESENDMAIL",Qv="ESES",Es="ECONFIG",li="EPROXY",Gu="EFILEACCESS",$u="EURLACCESS",qu="EFETCH",Wa=t=>t.responseCode===421||t.code===Hu||t.code===fN||t.code===Yf,Wu="ERR_ACCESS_DENIED";var Rr=t=>t==="__proto__",et=(t,e,r)=>(Object.keys(e||{}).forEach(n=>{Rr(n)||r&&r(n)||(t[n]=e[n])}),t);var vN=5,eA=60*1e3,AN=64*1024*1024,TN=["ALPNProtocols","ca","cert","checkServerIdentity","ciphers","crl","dhparam","ecdhCurve","honorCipherOrder","key","maxVersion","minVersion","passphrase","pfx","rejectUnauthorized","secureContext","secureOptions","secureProtocol","servername","sessionIdContext","sigalgs"];function Xf(t){t.code!==Wu&&(t.code=qu)}function Zv(t){let e;try{e=Nr(t)}catch{return!1}return e.protocol!=="http:"&&e.protocol!=="https:"?!1:e}function zu(t,e){e=e||{},e.fetchRes=e.fetchRes||new yN,e.cookies=e.cookies||new Jf,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?vN:e.maxRedirects;let r=e.fetchRes,n=Zv(t);if(!n)return e.body&&typeof e.body.destroy=="function"&&(e.body.on("error",()=>!1),e.body.destroy()),setImmediate(()=>{let E=new Error("Unsupported protocol for URL "+t);E.code=qu,E.sourceUrl=t,r.emit("error",E)}),r;e.cookie&&([].concat(e.cookie||[]).forEach(E=>{e.cookies.set(E,t)}),e.cookie=!1);let i=(e.method||"").toString().trim().toUpperCase()||"GET",o=!1,s,a,c=n.protocol==="https:"?hN:mN,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+Xe};if(Object.keys(e.headers||{}).forEach(E=>{Rr(E.toLowerCase().trim())||(l[E.toLowerCase().trim()]=e.headers[E])}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(s=e.cookies.get(t))&&(l.cookie=s),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",E=>{o||(o=!0,Xf(E),E.sourceUrl=t,r.emit("error",E))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(E=>{let v=e.body[E].toString().trim();return encodeURIComponent(E)+"="+encodeURIComponent(v)}).join("&"))}catch(E){return o=!0,E.code=qu,E.sourceUrl=t,setImmediate(()=>r.emit("error",E)),r}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let u,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!0,agent:!1};e.tls&&Object.keys(e.tls).forEach(E=>{TN.includes(E)&&(p[E]=e.tls[E])}),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!gN.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{u=c.request(p)}catch(E){return o=!0,setImmediate(()=>{Xf(E),E.sourceUrl=t,r.emit("error",E)}),r}let f=(E,v=t)=>{o||(o=!0,Xf(E),E.sourceUrl=v,r.emit("error",E),u.abort())},m=typeof e.timeout=="number"&&e.timeout>=0?e.timeout:eA;return m&&u.setTimeout(m,()=>f(new Error("Request Timeout"))),u.on("error",E=>f(E)),r.once("close",()=>{o||r.readableEnded||(o=!0,u.destroy())}),u.on("response",E=>{let v;if(o)return;switch(E.headers["content-encoding"]){case"gzip":case"deflate":v=EN.createUnzip();break}if(E.headers["set-cookie"]&&[].concat(E.headers["set-cookie"]||[]).forEach(M=>{e.cookies.set(M,t)}),[301,302,303,307,308].includes(E.statusCode)&&E.headers.location){if(e.redirects++,e.redirects>e.maxRedirects)return f(new Error("Maximum redirect count exceeded"));e.method="GET",e.body=!1;let M;try{M=qv(t,E.headers.location)}catch{M=E.headers.location}let K=Zv(M);if(!K)return f(new Error("Unsupported protocol for URL "+M),M);let B=K.hostname!==n.hostname,V=n.protocol==="https:"&&K.protocol==="http:";if(e.headers&&(B||V)){let $=["authorization","cookie","proxy-authorization"];Object.keys(e.headers).forEach(A=>{$.includes(A.toLowerCase())&&delete e.headers[A]})}return o=!0,E.resume(),u.abort(),zu(M,e)}if(r.statusCode=E.statusCode,r.headers=E.headers,E.statusCode>=300&&!e.allowErrorResponse)return f(new Error("Invalid status code "+E.statusCode));E.on("error",M=>f(M));let N=typeof e.maxBytes=="number"&&e.maxBytes>0?e.maxBytes:AN,S=v||E,R=0;S.on("data",M=>{R+=M.length,!(R<=N||o)&&(S.unpipe(r),f(new Error("Response size exceeds the allowed "+N+" bytes")))}),v?(E.pipe(v).pipe(r),v.on("error",M=>f(M))):E.pipe(r)}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(u);u.write(a)}catch(E){return f(E)}u.end()}),r}zu.Cookies=Jf;zu.DEFAULT_TIMEOUT=eA;var ui=zu;import lr from"node:dns";import xN from"node:net";import bN from"node:os";import{finished as SN}from"node:stream";var Qf=300*1e3,wN=30*1e3,tA=1e3,rA=0;var nA,iA=!1,NN=()=>{if(!iA){iA=!0;try{nA=bN.networkInterfaces()}catch{}}return nA},oA=(t,e)=>{let r=Object.values(NN()||{}).flat();return r.length?r.filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},RN=(t,e,r,n)=>{if(r=r||{},!oA(t,r.allowInternalNetworkInterfaces))return n(null,[]),null;let i=lr.Resolver?new lr.Resolver(r):lr;return i["resolve"+t](e,(o,s)=>{if(o){switch(o.code){case lr.NODATA:case lr.NOTFOUND:case lr.NOTIMP:case lr.SERVFAIL:case lr.CONNREFUSED:case lr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(o)}return n(null,Array.isArray(s)?s:[].concat(s||[]))}),lr.Resolver?i:null},Xr=new Map,ys=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({host:n,_addresses:r},e||{})},sA=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||xN.isIP(t.host)){let S={addresses:[t.host]};return e(null,ys(S,{servername:t.servername||!1,cached:!1}))}let r=t.host,n=t.servername||r,i;if(Xr.has(t.host)){i=Xr.get(t.host);let S=Date.now();if(S-rA>wN){rA=S;for(let[R,M]of Xr.entries())M.expires&&M.expires<S&&Xr.delete(R);if(Xr.size>tA){let R=Math.floor(tA*.1);Array.from(Xr.keys()).slice(0,R).forEach(K=>Xr.delete(K))}}if(!i.expires||i.expires>=S)return e(null,ys(i.value,{servername:n,cached:!0}))}let o=!1,s,a=(S,R)=>{o||(o=!0,clearTimeout(s),e(S,R))},c=S=>i?(Xr.set(r,{value:i.value,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(i.value,{servername:n,cached:!0,error:S})),!0):!1,l=[],u=Number(t.timeout)||0;u>0&&(s=setTimeout(()=>{for(let R of l)typeof R.cancel=="function"&&R.cancel();let S=new Error("DNS lookup for "+r+" timed out");S.code=lr.TIMEOUT,c(S)||a(S)},u));let p=[],f=[],m=null,E=null,v=2,N=()=>{if(--v||o)return;let S=p.concat(f);if(S.length){let R={addresses:S};return Xr.set(r,{value:R,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(R,{servername:n,cached:!1}))}if(!(m&&E&&c(m)))try{lr.lookup(r,{all:!0},(R,M)=>{if(R)return c(R)?void 0:a(R);let K=M?M.filter(V=>oA(V.family)).map(V=>V.address):[];if(M&&M.length&&!K.length&&console.warn(`Failed to resolve IPv${M[0].family} addresses with current network`),!K.length&&i)return a(null,ys(i.value,{servername:n,cached:!0}));let B={addresses:K.length?K:[r]};return Xr.set(r,{value:B,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(B,{servername:n,cached:!1}))})}catch(R){return c(R)?void 0:a(m||E||R)}};for(let S of[4,6]){let R=RN(S,r,t,(M,K)=>{S===4?(m=M,p=K||[]):(E=M,f=K||[]),N()});R&&l.push(R)}},gs=t=>{t=t||"";let e={},r=Nr(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}return!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),(r.username||r.password)&&(e.auth={user:r.username||"",pass:r.password||""}),Object.keys(r.query||{}).forEach(n=>{let i=e,o=n,s=r.query[n];switch(isNaN(s)||(s=Number(s)),s){case"true":s=!0;break;case"false":s=!1;break}if(n.indexOf("tls.")===0)o=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;!Rr(o)&&!(o in i)&&(i[o]=s)}),e},ON=(t,e,r,n,i,...o)=>{let s=Object.assign({},r||{},n||{});delete s.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](s,i,...o)},ft=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(o=>{r[o]=()=>!1}),r;let i=t.logger===!0?CN(n):t.logger;return n.forEach(o=>{r[o]=(...s)=>{let a=typeof s[0]=="string"?void 0:s.shift();ON(i,o,e,a,...s)}}),r},Mt=(t,e)=>function(...r){let n=r.shift();n?e(n):t(...r)},em=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,o=n.split(";");if(o.length>0){let l=o[o.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,o.pop())}let s=o.length>0?o.shift():"application/octet-stream",a={};for(let l=0;l<o.length;l++){let u=o[l],p=u.indexOf("=");if(p>0){let f=u.substring(0,p).trim(),m=u.substring(p+1).trim();f&&!Rr(f)&&(a[f]=m)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:s||"application/octet-stream",params:a}};function tm(t,e,r,n){!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;return n||(i=new Promise((o,s)=>{n=Mt(o,s)})),kN(t,e,r,n),i}function kN(t,e,r,n){let i=t&&t[e]&&t[e].content||t[e],o=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!i)return n(null,i);if(typeof i=="object"){if(typeof i.pipe=="function")return za(i,(s,a)=>{if(s)return n(s);t[e].content?t[e].content=a:t[e]=a,n(null,a)});if(/^data:/i.test(i.path||i.href)){let s=em(i.path||i.href);return n(null,s&&s.data?s.data:Buffer.alloc(0))}else if(i.href||/^https?:\/\//i.test(i.path)){let s=i.href||i.path;if(r.disableUrlAccess){setImmediate(()=>{let a=new Error("Url access rejected for "+s);a.code=$u,n(a)});return}return za(ui(s,{headers:i.httpHeaders,tls:i.tls}),n)}else if(i.path){if(r.disableFileAccess){setImmediate(()=>{let s=new Error("File access rejected for "+i.path);s.code=Gu,n(s)});return}return za(IN.createReadStream(i.path),n)}}typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(o)&&(i=Buffer.from(t[e].content,o)),setImmediate(()=>n(null,i))}var Or=function(...t){let e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{Rr(n)||(["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=et(e[n]||{},r[n]):e[n]=r[n])})}),e},Ja=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let o=e[n];o<33||o>126||o===43||o===61?r+="+"+(o<16?"0":"")+o.toString(16).toUpperCase():r+=String.fromCharCode(o)}return r},Zf=new WeakMap;function rm(t){t.on("error",e=>{Zf.has(t)||Zf.set(t,e)})}function $i(t){let e=t;e&&typeof e.pipe=="function"&&typeof e.destroy=="function"&&!e.destroyed&&e.destroy()}function nm(t){let e=Zf.get(t)||t.errored;if(e)return e;if(t.readableEnded||t.destroyed){let r=new Error("Content stream was already read or destroyed");return r.code=Fu,r}return null}function za(t,e){let r=!1,n=(a,c)=>{r||(r=!0,e(a,c))},i=nm(t);if(i){t.on("error",()=>!1),setImmediate(()=>n(i));return}let o=[],s=0;t.on("data",a=>{typeof a=="string"&&(a=Buffer.from(a)),o.push(a),s+=a.length}),SN(t,{writable:!1},a=>{if(a)return n(a);let c;try{c=Buffer.concat(o,s)}catch(l){return n(l)}n(null,c)})}function CN(t){let e=t.reduce((o,s)=>Math.max(o,s.length),0),r=new Map;t.forEach(o=>{let s=o.toUpperCase();s.length<e&&(s+=" ".repeat(e-s.length)),r.set(o,s)});let n=(o,s,a,...c)=>{let l="";s&&(s.tnx==="server"?l="S: ":s.tnx==="client"&&(l="C: "),s.sid&&(l="["+s.sid+"] "+l),s.cid&&(l="[#"+s.cid+"] "+l)),a=_N.format(a,...c),a.split(/\r?\n/).forEach(u=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(o),l+u)})},i={};return t.forEach(o=>{i[o]=n.bind(null,o)}),i}import DN from"node:path";var aA="application/octet-stream",PN="bin",cA=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),lA=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);function uA(t){if(!t)return aA;let e=DN.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=lA.has(r)?lA.get(r):aA;return Array.isArray(n)?n[0]:n}function Ju(t){if(!t)return PN;let e=t.toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(cA.has(r+"/"+n)){let i=cA.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}import um from"node:crypto";import aR from"node:fs";import{PassThrough as Za,finished as td,pipeline as dm}from"node:stream";import rd from"node:url";import{Transform as UN}from"node:stream";function qi(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function LN(t){let e=Math.floor(Number(t));return Number.isFinite(e)&&e>=1?e:76}function MN(t,e,r){let n=Math.ceil(t.length/e),i=Math.max(n-1,0),o=t.length-i*e,s=Buffer.allocUnsafe(i*(e+2)+(r?o:0)),a=0;for(let c=0;c<i*e;c+=e)t.copy(s,a,c,c+e),a+=e,s[a++]=13,s[a++]=10;if(r&&(a+=t.copy(s,a,i*e),o=0),a!==s.length)throw new Error("Unexpected wrapped length");return{output:s,rest:o}}var Yu=class extends UN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=LN(this.options.lineLength)),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_emit(e,r){let n=Buffer.from(this._curLine+e,"latin1");if(!n.length)return;let i=n;if(this.options.lineLength){let o=MN(n,this.options.lineLength,r);i=o.output,this._curLine=o.rest?n.toString("latin1",n.length-o.rest):""}else this._curLine="";i.length&&(this.outputBytes+=i.length,this.push(i))}_transform(e,r,n){let i=r!=="buffer"?Buffer.from(e,r):e;if(!i||!i.length)return n();this.inputBytes+=i.length,this._remainingBytes&&(i=Buffer.concat([this._remainingBytes,i],this._remainingBytes.length+i.length),this._remainingBytes=!1);let o=i.length%3;o&&(this._remainingBytes=i.subarray(i.length-o),i=i.subarray(0,i.length-o)),this._emit(qi(i),!1),n()}_flush(e){this._emit(this._remainingBytes?qi(this._remainingBytes):"",!0),this._remainingBytes=!1,e()}};import{Transform as KN}from"node:stream";var HN=4,FN=[[9],[10],[13],[32,60],[62,126]],mA=new Uint8Array(256);for(let t=0;t<256;t++)mA[t]=BN(t,FN)?1:0;var fA=Buffer.from("0123456789ABCDEF","latin1"),hA=t=>t===32||t===9;function EA(t){return om(typeof t=="string"?Buffer.from(t,"utf-8"):t)}function om(t,e,r,n){let i=t.length,o=Buffer.allocUnsafe(i*3),s=0;for(let a=0;a<i;a++){let c=t[a],l=a+1<i?t[a+1]:e,u=r&&(c===13||c===10)?c===13?l===10:(a>0?t[a-1]:n)===13:!0;if(mA[c]&&u&&!(hA(c)&&(l===void 0||l===10||l===13))){o[s++]=c;continue}o[s++]=61,o[s++]=fA[Math.floor(c/16)],o[s++]=fA[c%16]}return o.toString("latin1",0,s)}function VN(t,e){if(t=(t||"").toString(),e=Math.max(Number(e)||76,HN),t.length<=e)return t;let r=0,n=t.length,i,o,s,a=Math.floor(e/3),c="";for(;r<n;){if(s=t.substr(r,e),i=s.match(/\r\n/)){s=s.substr(0,i.index+i[0].length),c+=s,r+=s.length;continue}if(s.substr(-1)===`
+`){c+=s,r+=s.length;continue}if(i=s.substr(-a).match(/\n.*?$/)){s=s.substr(0,s.length-(i[0].length-1)),c+=s,r+=s.length;continue}if(s.length>e-a&&(i=s.substr(-a).match(/[ \t.,!?][^ \t.,!?]*$/)))s=s.substr(0,s.length-(i[0].length-1));else if(s.match(/[=][\da-f]{0,2}$/i))for((i=s.match(/[=][\da-f]{0,1}$/i))&&(s=s.substr(0,s.length-i[0].length));s.length>3&&s.length<n-r&&!s.match(/^(?:=[\da-f]{2}){1,4}$/i)&&(i=s.match(/[=][\da-f]{2}$/gi))&&(o=parseInt(i[0].substr(1,2),16),!(o<128||(s=s.substr(0,s.length-3),o>=192))););s.length||(s=t.substr(r,e)),r+s.length<n&&s.substr(-1)!==`
+`?(s.length===e&&s.match(/[=][\da-f]{2}$/i)?s=s.substr(0,s.length-3):s.length===e&&(s=s.substr(0,s.length-1)),r+=s.length,s+=`=\r
+`):r+=s.length,c+=s}return c}function BN(t,e){for(let r=e.length-1;r>=0;r--){let n=e[r];if(n.length&&(n.length===1&&t===n[0]||n.length===2&&t>=n[0]&&t<=n[1]))return!0}return!1}var im=64*1024,Xu=class extends KN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this._remainingBytes=!1,this._lastByte=void 0,this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){let i=r!=="buffer"?Buffer.from(e,r):e;if(!i||!i.length)return n();this.inputBytes+=i.length,this._remainingBytes&&(i=Buffer.concat([this._remainingBytes,i],this._remainingBytes.length+i.length),this._remainingBytes=!1);let o=i.length;for(;o>0&&(hA(i[o-1])||this.options.binary&&i[o-1]===13);)o--;i.length-o<=im&&(this._remainingBytes=o<i.length?Buffer.from(i.subarray(o)):!1,i=i.subarray(0,o)),this._encodeSlices(i),n()}_flush(e){this._remainingBytes&&(this._encodeSlices(this._remainingBytes),this._remainingBytes=!1),this._curLine&&(this.outputBytes+=this._curLine.length,this.push(this._curLine,"ascii"),this._curLine=""),e()}_encodeSlices(e){for(let r=0;r<e.length;r+=im){let n=Math.min(r+im,e.length);this._encodeSlice(e.subarray(r,n),n<e.length?e[n]:void 0),this._lastByte=e[n-1]}}_encodeSlice(e,r){let n;if(this.options.lineLength){n=VN(this._curLine+om(e,r,this.options.binary,this._lastByte),this.options.lineLength);let i=n.lastIndexOf(`
+`);this._curLine=n.substring(i+1),n=n.substring(0,i+1),n&&(this.outputBytes+=n.length,this.push(n,"ascii"))}else n=om(e,r,this.options.binary,this._lastByte),this.outputBytes+=n.length,this.push(n,"ascii")}};function vs(t,e){return typeof t=="string"&&!(e?/[\x00-\x1f\x7f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)}function Ya(t){return'"'+(t||"").toString().replace(/["\\]/g,"\\$&")+'"'}function vA(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)}function Sn(t,e,r){e=(e||"Q").toString().toUpperCase().trim().charAt(0),r=r||0;let n,i="UTF-8";if(r&&r>7+i.length&&(r-=7+i.length),e==="Q"?n=EA(t).replace(/[^a-z0-9!*+\-/=]/gi,o=>{let s=o.charCodeAt(0).toString(16).toUpperCase();return o===" "?"_":"="+(s.length===1?"0"+s:s)}):e==="B"&&(n=typeof t=="string"?t:t.toString("utf-8"),r=r?Math.max(3,(r-r%4)/4*3):0),r&&(e!=="B"?n:qi(t)).length>r)if(e==="Q")n=qN(n,r).join("?= =?"+i+"?"+e+"?");else{let o=[],s="";for(let a=0,c=n.length;a<c;a++){let l=n.charAt(a);/[\ud800-\udbff]/.test(l)&&/[\udc00-\udfff]/.test(n.charAt(a+1))&&(l+=n.charAt(++a)),Buffer.byteLength(s+l)<=r||a===0?s+=l:(o.push(qi(s)),s=l)}s&&o.push(qi(s)),o.length>1?n=o.join("?= =?"+i+"?"+e+"?"):n=o.join("")}else e==="B"&&(n=qi(t));return"=?"+i+"?"+e+"?"+n+(n.substr(-2)==="?="?"":"?=")}function AA(t,e,r,n){r=r||0;let i=t.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);if(!i)return t;if(n)return Sn(t,e,r);let o=t.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);if(!o)return t;let s=i.index+(i[0].match(/[^\s]/)||{index:0}).index,a=o.index+(o[1]||"").length;return(s?t.substr(0,s):"")+Sn(t.substring(s,a),e||"Q",r)+(a<t.length?t.substr(a):"")}function sm(t){let e=[];return Object.keys(t.params||{}).forEach(n=>{let i=t.params[n],o=n.replace(/[\x00-\x1f\x7f]/g,"");!vs(i,!0)||i.length>=75?jN(o,i,50).forEach(s=>{!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(s.value)||s.key.substr(-1)==="*"?e.push(s.key+"="+s.value):e.push(s.key+"="+JSON.stringify(s.value))}):!i.length||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(i)?e.push(o+"="+JSON.stringify(i)):e.push(o+"="+i)}),(typeof t.value=="string"?t.value.replace(/[\x00-\x1f\x7f]/g,""):t.value)+(e.length?"; "+e.join("; "):"")}function jN(t,e,r){let n=[],i=typeof e=="string"?e:(e||"").toString(),o,s,a=0,c,l;if(r=r||50,vs(e,!0)){if(i.length<=r)return[{key:t,value:i}];i=i.replace(new RegExp(".{"+r+"}","g"),u=>(n.push({line:u}),"")),i&&n.push({line:i})}else{if(/[\uD800-\uDBFF]/.test(i)){let p=[];for(c=0,l=i.length;c<l;c++)o=i.charAt(c),/[\ud800-\udbff]/.test(o)&&/[\udc00-\udfff]/.test(i.charAt(c+1))?(o+=i.charAt(c+1),p.push(o),c++):p.push(o);i=p}s="utf-8''";let u=!0;for(a=0,c=0,l=i.length;c<l;c++){if(o=i[c],u)o=Qu(o);else if(o=o===" "?o:Qu(o),o!==i[c])if((Qu(s)+o).length>=r)n.push({line:s,encoded:u}),s="",u=!0;else{u=!0,c=a,s="";continue}(s+o).length>=r?(n.push({line:s,encoded:u}),s=o=i[c]===" "?" ":Qu(i[c]),o===i[c]?(u=!1,a=c-1):u=!0):s+=o}s&&n.push({line:s,encoded:u})}return n.map((u,p)=>({key:t+"*"+p+(u.encoded?"*":""),value:u.line}))}var GN=/^[^\x00-\x20\x7f()<>@,;:\\"/[\]?=]+$/;function gA(t){return!!t&&!Rr(t)}function am(t){let e={value:"",params:{}},r=(S,R)=>{S=S.toLowerCase(),gA(S)&&!Object.prototype.hasOwnProperty.call(e.params,S)&&(e.params[S]=R)},n=!1,i="",o="value",s=!1,a=!1,c,l="",u=!1,p=()=>{i.length&&(i+=l),l=""},f=S=>{p(),i+=S},m=()=>{let S=i;return i="",l="",u=!1,S},E=()=>{let S=m();n===!1?e.value=S:r(n,S)},v=()=>{r(m().trim(),"")};for(let S=0,R=t.length;S<R;S++)if(c=t.charAt(S),o==="key"){if(c==="="){n=m().trim(),o="value";continue}if(c===";"){v();continue}i+=c}else{if(u&&c!==";"){a=!1;continue}if(a)f(c);else if(s&&c==="\\"){a=!0;continue}else s&&c===s?(s=!1,u=!0):!s&&c==='"'?(s=c,p()):!s&&c===";"?(E(),o="key"):!s&&(c===" "||c==="	")?l+=c:f(c);a=!1}o==="value"?E():v();let N=new Map;return Object.keys(e.params).forEach(S=>{let R=S.match(/(\*(\d+)|\*(\d+)\*|\*)$/);if(!R)return;let M=S.substr(0,R.index),K=Number(R[2]||R[3])||0,B=R[0].substr(-1)==="*",V=e.params[S];if(delete e.params[S],!gA(M))return;let $=N.get(M);$||($={charset:!1,sections:[]},N.set(M,$));let A=K===0&&B?V.match(/^([^']*)'[^']*'(.*)$/):null;A&&($.charset=GN.test(A[1])?A[1]:"iso-8859-1",V=A[2]),$.sections.push({nr:K,value:V,encoded:B})}),N.forEach((S,R)=>{if(!Object.prototype.hasOwnProperty.call(e.params,R)){if(S.sections.sort((M,K)=>M.nr-K.nr),!S.charset){e.params[R]=S.sections.map(M=>M.value).join("");return}e.params[R]="=?"+S.charset+"?Q?"+S.sections.map($N).join("")+"?="}}),e}function $N(t){let e=t.encoded?/[=?_\s]/g:/[=?_\s%]/g;return t.value.replace(e,r=>{let n=r.charCodeAt(0).toString(16);return r===" "?"_":"%"+(n.length<2?"0":"")+n}).replace(/%/g,"=")}function Zu(t){return Ju(t)}function Wi(t){return uA(t)}function Xa(t,e,r){t=(t||"").toString(),e=e||76;let n=0,i=t.length,o="",s,a;for(;n<i;){if(s=t.substr(n,e),s.length<e){o+=s;break}if(a=s.match(/^[^\n\r]*(\r?\n|\r)/)){s=a[0],o+=s,n+=s.length;continue}else(a=s.match(/(\s+)[^\s]*$/))&&a[0].length-(r?(a[1]||"").length:0)<s.length?s=s.substr(0,s.length-(a[0].length-(r?(a[1]||"").length:0))):(a=t.substr(n+s.length).match(/^[^\s]+(\s*)/))&&(s=s+a[0].substr(0,a[0].length-(r?0:(a[1]||"").length)));o+=s,n+=s.length,n<i&&(o+=`\r
+`)}return o}function qN(t,e){let r=[],n,i,o,s,a;for(e=Math.max(e||0,12);t.length;){for(n=t.substr(0,e),(o=n.match(/[=][0-9A-F]?$/i))&&(n=n.substr(0,o.index)),i=n.length?n:t.substr(0,e),a=!1;!a&&n.length;)a=!0,(o=t.substr(n.length).match(/^[=]([0-9A-F]{2})/i))&&(s=parseInt(o[1],16),s<194&&s>127&&(n=n.substr(0,n.length-3),a=!1));n.length||(n=i),r.push(n),t=t.substr(n.length)}return r}function WN(t){let e="",r=t.charCodeAt(0).toString(16).toUpperCase();if(r.length%2&&(r="0"+r),r.length>2)for(let n=0,i=r.length/2;n<i;n++)e+="%"+r.substr(n,2);else e+="%"+r;return e}function Qu(t){t=(t||"").toString();try{t=encodeURIComponent(t)}catch{t=encodeURIComponent(Buffer.from(t,"utf-8").toString("utf-8"))}return t.replace(/[\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]/g,e=>WN(e))}function zN(t){let e=t.lastIndexOf("@");if(e<0)return t;let r=t.substr(0,e);return/^[^\s"(),:;<>@[\\\]]+$/.test(r)||/^"(?:[^"\\]|\\[\s\S])*"$/.test(r)?t:'"'+r.replace(/["\\]/g,"\\$&")+'"@'+t.substr(e+1)}var JN=/\s/,YN=/^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/,bA=/^[^@\s]+@[^@\s]+$/,XN=/^[^@\s]+@\S+$/,TA=/\s*\b[^@\s]+@[^\s]+\b\s*/y;function cm(t){return t===32||t>=9&&t<=13||t===160||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288||t===65279}function _A(t){return t>=48&&t<=57||t>=65&&t<=90||t>=97&&t<=122||t===95}function IA(t,e){return _A(t.charCodeAt(e-1))!==_A(t.charCodeAt(e))}function xA(t,e,r){for(let n=e;n<r;n++)if(t.charCodeAt(n)===64)return n;return-1}function QN(t){let e=t.length,r=0;for(;r<e;){for(;r<e&&cm(t.charCodeAt(r));)r++;if(r>=e)break;let n=r,i=r;for(;i<e&&!cm(t.charCodeAt(i));)i++;let o=xA(t,n,i);if(o>=0){let s=-1;for(let c=i;c>n;c--)if(IA(t,c)){s=c;break}let a=n;for(;s>=0&&o>=0;){if(o>a&&i>o+1&&s>o+1){for(let c=a;c<o;c++)if(IA(t,c)){if(c>n)return c;let l=n;for(;l>0&&cm(t.charCodeAt(l-1));)l--;return l}}a=o+1,o=xA(t,a,i)}}r=i}return-1}function ZN(t){if(!JN.test(t.address))return;let e,r,n=t.address.match(YN);if(n){if(!n[2])return;e=n[1],r=[n[2]]}else{if(t.address.indexOf('"')>=0)return;let i=t.address.split(/\s+/),o=i.findIndex(s=>bA.test(s));if(o<0&&(o=i.findIndex(s=>XN.test(s))),o<0)return;e=i.splice(o,1)[0],r=i}t.address=e,t.text=[t.text].concat(r).filter(i=>i).join(" ")}function eR(t){let e=[],r="",n="",i=0,o="",s="";for(let a=0,c=t.length;a<c;a++){let l=t.charAt(a);if(i){l==="\\"&&a<c-1?n+=t.charAt(++a):l==="("?(i++,n+=l):l===")"&&!--i?(e.push(n.trim()),n="",s!=="@"&&t.charAt(a+1)!=="@"&&(r+=" ",s=" ")):n+=l;continue}if(o){if(l==="\\"&&o==='"'&&a<c-1){r+=l+t.charAt(++a),s=t.charAt(a);continue}l===o&&(o="")}else if(l==='"')o='"';else if(l==="[")o="]";else if(l==="("){i=1;continue}r+=l,s=l}return i&&e.push(n.trim()),{address:r.trim(),comments:e.filter(a=>a)}}function tR(t,e){let r=!1,n="text",i=[],o={address:[],comment:[],group:[],text:[],textWasQuoted:[]},s=!1,a={address:"",comment:"",group:"",text:""};for(let c=0,l=t.length;c<l;c++){let u=t[c],p=c?t[c-1]:null;if(u.type==="operator")switch(u.value){case"<":n="address",s=!1;break;case"(":n="comment",s=!1;break;case":":n="group",r=!0,s=!1;break;case'"':s=!s,n="text";break;default:n="text",s=!1;break}else if(u.value){let f=c>1?t[c-2]:null,m=p?.type==="operator"&&p.value==='"'&&!!p.noBreak&&f?.type==="operator"&&f.value==='"';n==="address"&&(u.value=u.value.replace(/^[^<]*<\s*/,""));let E=o[n];p&&p.noBreak&&E.length&&(p.value!==")"||a[n]==="@"||u.value.charAt(0)==="@")?(o[n][o[n].length-1]+=u.value,u.value&&(a[n]=u.value.charAt(u.value.length-1)),n==="text"&&s&&(o.textWasQuoted[o.textWasQuoted.length-1]=!0)):(o[n].push(u.value),a[n]=u.value.charAt(u.value.length-1),n==="text"&&o.textWasQuoted.push(s||m))}}if(!o.text.length&&o.comment.length&&(o.text=o.comment,o.comment=[]),r){o.text=o.text.join(" ");let c=[];o.group.length&&SA(o.group.join(","),e+1).forEach(u=>{u.group?c=c.concat(u.group):c.push(u)}),i.push({name:o.text||"",group:c})}else{let c=[],l=[];for(let f of o.address){if(f.indexOf("(")<0){l.push(f);continue}let m=eR(f);for(let E of m.comments)c.push(E);m.address&&l.push(m.address)}if(o.address=l,!o.address.length&&o.text.length){for(let f=o.text.length-1;f>=0;f--)if(!o.textWasQuoted[f]&&bA.test(o.text[f])){o.address=o.text.splice(f,1),o.textWasQuoted.splice(f,1);break}if(!o.address.length){let f=!1;for(let m=o.text.length-1;m>=0;m--)if(!o.textWasQuoted[m]){let E=o.text[m],v=E,N=QN(E);if(N>=0){TA.lastIndex=N;let S=TA.exec(E);S&&(o.address=[S[0].trim()],f=!0,v=E.slice(0,N)+" "+E.slice(N+S[0].length))}if(o.text[m]=v.trim(),f)break}}}!o.text.length&&o.comment.length&&(o.text=o.comment,o.comment=[]),o.address.length>1&&(o.text=o.text.concat(o.address.splice(1)));let u=!o.address.length&&o.textWasQuoted.some(f=>f);o.text=o.text.join(" "),o.address=o.address.join(" "),u&&o.text.indexOf("@")>=0&&(o.address=zN(o.text),o.text=""),ZN(o),!o.text&&c.length&&(o.text=c.join(" "));let p={address:o.address||o.text||"",name:o.text||o.address||""};p.address===p.name&&(/@/.test(p.address||"")?p.name="":p.address=""),i.push(p)}return i}var lm=class{constructor(e){this.str=(e||"").toString(),this.operatorCurrent="",this.operatorExpecting="",this.node=null,this.escaped=!1,this.inDomainLiteral=!1,this.afterAt=!1,this.list=[],this.operators={'"':'"',"(":")","<":">",",":"",":":";",";":""}}tokenize(){let e=[];for(let r=0,n=this.str.length;r<n;r++){let i=this.str.charAt(r),o=r<n-1?this.str.charAt(r+1):null;this.checkChar(i,o)}return this.list.forEach(r=>{r.value=(r.value||"").toString().trim(),r.value&&e.push(r)}),e}checkChar(e,r){if(!this.escaped&&!this.operatorExpecting&&(!this.inDomainLiteral&&e==="["&&this.afterAt?this.inDomainLiteral=!0:this.inDomainLiteral&&(e==="]"||e===","||e===";")&&(this.inDomainLiteral=!1)),!this.escaped){if(e===this.operatorExpecting){this.node={type:"operator",value:e},r&&![" ","	","\r",`
+`,",",";"].includes(r)&&(this.node.noBreak=!0),this.list.push(this.node),this.node=null,e!==")"&&(this.afterAt=!1),this.operatorExpecting="",this.escaped=!1;return}else if(!this.operatorExpecting&&!(this.inDomainLiteral&&e===":")&&e in this.operators){this.node={type:"operator",value:e},this.list.push(this.node),this.node=null,e!=="("&&(this.afterAt=!1),this.operatorExpecting=this.operators[e],this.escaped=!1;return}else if(['"',"'",")"].includes(this.operatorExpecting)&&e==="\\"){this.escaped=!0;return}}this.node||(this.node={type:"text",value:""},this.list.push(this.node)),e===`
+`&&(e=" "),(e.charCodeAt(0)>=33||[" ","	"].includes(e))&&(this.node.value+=e,!this.operatorExpecting&&e!==" "&&e!=="	"&&(this.afterAt=e==="@")),this.escaped=!1}},rR=50;function SA(t,e){if(e>rR)return[];let n=new lm(t).tokenize(),i=[],o=[],s=[];n.forEach(c=>{c.type==="operator"&&(c.value===","||c.value===";")?(o.length&&i.push(o),o=[]):o.push(c)}),o.length&&i.push(o),i.forEach(c=>{let l=tR(c,e);for(let u=0;u<l.length;u++)s.push(l[u])});let a=[];for(let c=s.length-1;c>=0;c--){let l=s[c],u=a.length?a[a.length-1]:null;u&&l.address===""&&l.name&&!l.group&&u.address&&u.name?u.name=l.name+", "+u.name:a.push(l)}return a.reverse(),a}function nR(t,e){let r=SA(t,0);if(e?.flatten){let n=[],i=o=>{o.forEach(s=>{if(s.group)return i(s.group);n.push(s)})};return i(r),n}return r}var wA=nR;import{Transform as iR}from"node:stream";var Qa=class extends iR{constructor(){super(),this.lastByte=!1}_transform(e,r,n){e.length&&(this.lastByte=e[e.length-1]),this.push(e),n()}_flush(e){return this.lastByte===10?e():this.lastByte===13?(this.push(Buffer.from(`
 `)),e()):(this.push(Buffer.from(`\r
-`)),e())}};zv.exports=Sf});var Ra=me((yZ,Yv)=>{"use strict";var{Transform:CN}=re("stream"),wf=class extends CN{constructor(e){super(e),this.lastByte=!1}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>s&&(i=e.slice(s,o),this.push(i)),this.push(Buffer.from(`\r
-`)),s=o+1);s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),this.lastByte=e[e.length-1],n()}};Yv.exports=wf});var fu=me((gZ,Xv)=>{"use strict";var{Transform:DN}=re("stream"),Nf=class extends DN{constructor(e){super(e)}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===13&&(i=e.slice(s,o),s=o+1,this.push(i));s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),n()}};Xv.exports=Nf});var mu=me((vZ,tA)=>{"use strict";var Rf=re("crypto"),PN=re("fs"),Qv=uu(),{PassThrough:Oa}=re("stream"),UN=kt(),Ct=Na(),LN=xf(),MN=Tf(),KN=Wv(),HN=ba(),Zv=Xt(),FN=Jv(),VN=Ra(),BN=fu(),jN=["From","Sender","To","Cc","Bcc","Reply-To","Date","References"],eA="[A-Za-z0-9!#$%&'*+\\-/=?^_`{|}~\\x80-\\uFFFF]",qN=new RegExp("^"+eA+"+(?:\\."+eA+"+)*$"),GN=/^"(?:[^"\\]|\\[\s\S])*"$/,$N=/^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/,Of=class t{constructor(e,r){this.nodeCounter=0,r=r||{},this.baseBoundary=r.baseBoundary||Rf.randomBytes(8).toString("hex"),this.boundaryPrefix=r.boundaryPrefix||"--_NmP",this.disableFileAccess=!!r.disableFileAccess,this.disableUrlAccess=!!r.disableUrlAccess,this.normalizeHeaderKey=r.normalizeHeaderKey,this.date=r.parentNode?null:new Date,this.rootNode=r.rootNode||this,this.keepBcc=!!r.keepBcc,r.filename&&(this.filename=r.filename,e||(e=Ct.detectMimeType(this.filename.split(".").pop()))),this.textEncoding=(r.textEncoding||"").toString().trim().charAt(0).toUpperCase(),this.parentNode=r.parentNode,this.hostname=r.hostname,this.newline=r.newline,this.childNodes=[],this._nodeId=++this.rootNode.nodeCounter,this._headers=[],this._isPlainText=!1,this._hasLongLines=!1,this._envelope=!1,this._raw=!1,this._transforms=[],this._processFuncs=[],e&&this.setHeader("Content-Type",e)}createChild(e,r){!r&&typeof e=="object"&&(r=e,e=void 0);let n=new t(e,r);return this.appendChild(n),n}appendChild(e){return e.rootNode!==this.rootNode&&(e.rootNode=this.rootNode,e._nodeId=++this.rootNode.nodeCounter),e.parentNode=this,this.childNodes.push(e),e}replace(e){return e===this?this:(this.parentNode.childNodes.forEach((r,n)=>{r===this&&(e.rootNode=this.rootNode,e.parentNode=this.parentNode,e._nodeId=this._nodeId,this.rootNode=this,this.parentNode=void 0,e.parentNode.childNodes[n]=e)}),e)}remove(){if(!this.parentNode)return this;for(let e=this.parentNode.childNodes.length-1;e>=0;e--)if(this.parentNode.childNodes[e]===this)return this.parentNode.childNodes.splice(e,1),this.parentNode=void 0,this.rootNode=this,this}setHeader(e,r){let n=!1;if(!r&&e&&typeof e=="object")return e.key&&"value"in e?this.setHeader(e.key,e.value):Array.isArray(e)?e.forEach(s=>{this.setHeader(s.key,s.value)}):Object.keys(e).forEach(s=>{this.setHeader(s,e[s])}),this;e=this._normalizeHeaderKey(e);let i={key:e,value:r};for(let s=0,o=this._headers.length;s<o;s++)this._headers[s].key===e&&(n?(this._headers.splice(s,1),s--,o--):(this._headers[s]=i,n=!0));return n||this._headers.push(i),this}addHeader(e,r){return!r&&e&&typeof e=="object"?(e.key&&e.value?this.addHeader(e.key,e.value):Array.isArray(e)?e.forEach(n=>{this.addHeader(n.key,n.value)}):Object.keys(e).forEach(n=>{this.addHeader(n,e[n])}),this):Array.isArray(r)?(r.forEach(n=>{this.addHeader(e,n)}),this):(this._headers.push({key:this._normalizeHeaderKey(e),value:r}),this)}getHeader(e){e=this._normalizeHeaderKey(e);for(let r=0,n=this._headers.length;r<n;r++)if(this._headers[r].key===e)return this._headers[r].value}setContent(e){return this.content=e,typeof this.content.pipe=="function"?(this._contentErrorHandler=r=>{this.content.removeListener("error",this._contentErrorHandler),this.content=r},this.content.once("error",this._contentErrorHandler)):typeof this.content=="string"&&(this._isPlainText=Ct.isPlainText(this.content),this._isPlainText&&Ct.hasLongerLines(this.content,76)&&(this._hasLongLines=!0)),this}build(e){let r;e||(r=new Promise((a,c)=>{e=UN.callbackPromise(a,c)}));let n=this.createReadStream(),i=[],s=0,o=!1;return n.on("readable",()=>{let a;for(;(a=n.read())!==null;)i.push(a),s+=a.length}),n.once("error",a=>{if(!o)return o=!0,e(a)}),n.once("end",a=>{if(!o)return o=!0,a&&a.length&&(i.push(a),s+=a.length),e(null,Buffer.concat(i,s))}),r}getTransferEncoding(){let e=!1,r=(this.getHeader("Content-Type")||"").toString().toLowerCase().trim();return this.content&&(e=(this.getHeader("Content-Transfer-Encoding")||"").toString().toLowerCase().trim(),(!e||!["base64","quoted-printable"].includes(e))&&(/^text\//i.test(r)?this._isPlainText&&!this._hasLongLines?e="7bit":typeof this.content=="string"||this.content instanceof Buffer?e=this._getTextEncoding(this.content)==="Q"?"quoted-printable":"base64":e=this.textEncoding==="B"?"base64":"quoted-printable":/^(multipart|message)\//i.test(r)||(e=e||"base64"))),e}buildHeaders(){let e=this.getTransferEncoding(),r=[];if(e&&this.setHeader("Content-Transfer-Encoding",e),this.filename&&!this.getHeader("Content-Disposition")&&this.setHeader("Content-Disposition","attachment"),this.rootNode===this){this.getHeader("Date")||this.setHeader("Date",this.date.toUTCString().replace(/GMT/,"+0000")),this.messageId(),this.getHeader("MIME-Version")||this.setHeader("MIME-Version","1.0");for(let n=this._headers.length-2;n>=0;n--){let i=this._headers[n];i.key==="Content-Type"&&(this._headers.splice(n,1),this._headers.push(i))}}return this._headers.forEach(n=>{let i=n.key,s=n.value,o,a,c={};if(!(s&&typeof s=="object"&&!jN.includes(i)&&(Object.keys(s).forEach(d=>{d!=="value"&&(c[d]=s[d])}),s=(s.value||"").toString(),!s.trim()))){if(c.prepared){c.foldLines?r.push(Ct.foldLines(i+": "+s)):r.push(i+": "+s);return}switch(n.key){case"Content-Disposition":o=Ct.parseHeaderValue(s),this.filename&&(o.params.filename=this.filename),s=Ct.buildHeaderValue(o);break;case"Content-Type":o=Ct.parseHeaderValue(s),o.value=(o.value||"").toString().replace(/[\x00-\x1f\x7f]/g,""),this._handleContentType(o),o.value.match(/^text\/plain\b/)&&typeof this.content=="string"&&/[\u0080-\uFFFF]/.test(this.content)&&(o.params.charset="utf-8"),s=Ct.buildHeaderValue(o),this.filename&&(a=/[\x00-\x1f\x7f]/.test(this.filename)?Ct.encodeWord(this.filename,this._getTextEncoding(this.filename),52):this._encodeWords(this.filename),(a!==this.filename||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(a))&&(a=JSON.stringify(a)),s+="; name="+a);break;case"Bcc":if(!this.keepBcc)return;break}if(s=this._encodeHeaderValue(i,s),!!(s||"").toString().trim()){if(typeof this.normalizeHeaderKey=="function"){let d=this.normalizeHeaderKey(i,s),p=typeof d=="string"?d.replace(/[\x00-\x1f\x7f]/g,""):"";p&&(i=p)}r.push(Ct.foldLines(i+": "+s,76))}}}),r.join(`\r
-`)}createReadStream(e){e=e||{};let r=new Oa(e),n=r,i;this.stream(r,e,s=>{if(s){n.emit("error",s);return}r.end()});for(let s=0,o=this._transforms.length;s<o;s++)i=typeof this._transforms[s]=="function"?this._transforms[s]():this._transforms[s],n.once("error",a=>{i.emit("error",a)}),n=n.pipe(i);i=new FN,n.once("error",s=>{i.emit("error",s)}),n=n.pipe(i);for(let s=0,o=this._processFuncs.length;s<o;s++)i=this._processFuncs[s],n=i(n);if(this.newline){let o=["win","windows","dos",`\r
-`].includes(this.newline.toString().toLowerCase())?new VN:new BN,a=n.pipe(o);return n.on("error",c=>a.emit("error",c)),a}return n}transform(e){this._transforms.push(e)}processFunc(e){this._processFuncs.push(e)}stream(e,r,n){let i=this.getTransferEncoding(),s,o,a=!1,c=p=>{a||(a=!0,n(p))},l=()=>{let p=0,f=()=>{if(p>=this.childNodes.length)return e.write(`\r
+`)),e())}};import{Transform as oR}from"node:stream";var kr=class extends oR{constructor(e){super(e),this.lastByte=!1}_transform(e,r,n){let i,o=0;for(let s=0,a=e.length;s<a;s++)e[s]===10&&(s&&e[s-1]!==13||!s&&this.lastByte!==13)&&(s>o&&(i=e.slice(o,s),this.push(i)),this.push(Buffer.from(`\r
+`)),o=s+1);o&&o<e.length?(i=e.slice(o),this.push(i)):o||this.push(e),this.lastByte=e[e.length-1],n()}};import{Transform as sR}from"node:stream";var wn=class extends sR{constructor(e){super(e)}_transform(e,r,n){let i,o=0;for(let s=0,a=e.length;s<a;s++)e[s]===13&&(i=e.slice(o,s),o=s+1,this.push(i));o&&o<e.length?(i=e.slice(o),this.push(i)):o||this.push(e),n()}};var cR=["From","Sender","To","Cc","Bcc","Reply-To","Date","References"],NA="[A-Za-z0-9!#$%&'*+\\-/=?^_`{|}~\\x80-\\uFFFF]",lR=new RegExp("^"+NA+"+(?:\\."+NA+"+)*$"),uR=/^"(?:[^"\\]|\\[\s\S])*"$/,dR=/^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/,pR=/[/\\?#%\x00-\x20\x7F]/,RA=()=>!1;function OA(){let t=new Error("Message stream was closed before the message was generated");return t.code=Fu,t}function fR(t,e){if(typeof rd.domainToASCII=="function"&&typeof rd.domainToUnicode=="function"&&!pR.test(t)){let r=rd.domainToASCII(t),n=r&&e?rd.domainToUnicode(r):r;if(n)return n}return e?$v(t):hs(t)}function ec(t){return t.replace(/[\x00-\x1f\x7f]+/g,"")}var pm=class t{constructor(e,r){this.nodeCounter=0,r=r||{},this.baseBoundary=ec(r.baseBoundary||um.randomBytes(8).toString("hex")),this.boundaryPrefix=ec(r.boundaryPrefix||"--_NmP"),this.disableFileAccess=!!r.disableFileAccess,this.disableUrlAccess=!!r.disableUrlAccess,this.normalizeHeaderKey=r.normalizeHeaderKey,this.date=r.parentNode?null:new Date,this.rootNode=r.rootNode||this,this.keepBcc=!!r.keepBcc,r.filename&&(this.filename=r.filename,e||(e=Wi(this.filename.split(".").pop()))),this.textEncoding=(r.textEncoding||"").toString().trim().charAt(0).toUpperCase(),this.parentNode=r.parentNode,this.hostname=r.hostname,this.newline=r.newline,this.childNodes=[],this._nodeId=++this.rootNode.nodeCounter,this._headers=[],this._isPlainText=!1,this._hasLongLines=!1,this._envelope=!1,this._raw=!1,this._transforms=[],this._processFuncs=[],e&&this.setHeader("Content-Type",e)}createChild(e,r){!r&&typeof e=="object"&&(r=e,e=void 0);let n=new t(e,r);return this.appendChild(n),n}appendChild(e){return e.parentNode&&e.parentNode!==this&&e.remove(),e.rootNode!==this.rootNode&&(e.rootNode=this.rootNode,e._nodeId=++this.rootNode.nodeCounter),e.parentNode=this,this.childNodes.push(e),e}replace(e){return e===this?this:(this.parentNode.childNodes.forEach((r,n)=>{r===this&&(e.rootNode=this.rootNode,e.parentNode=this.parentNode,e._nodeId=this._nodeId,this.rootNode=this,this.parentNode=void 0,e.parentNode.childNodes[n]=e)}),e)}remove(){if(!this.parentNode)return this;for(let e=this.parentNode.childNodes.length-1;e>=0;e--)if(this.parentNode.childNodes[e]===this)return this.parentNode.childNodes.splice(e,1),this.parentNode=void 0,this.rootNode=this,this}setHeader(e,r){let n=!1;if(!r&&e&&typeof e=="object")return e.key&&"value"in e?this.setHeader(e.key,e.value):Array.isArray(e)?e.forEach(o=>{this.setHeader(o.key,o.value)}):Object.keys(e).forEach(o=>{this.setHeader(o,e[o])}),this;e=this._normalizeHeaderKey(e);let i={key:e,value:r};for(let o=0,s=this._headers.length;o<s;o++)this._headers[o].key===e&&(n?(this._headers.splice(o,1),o--,s--):(this._headers[o]=i,n=!0));return n||this._headers.push(i),this}addHeader(e,r){return!r&&e&&typeof e=="object"?(e.key&&e.value?this.addHeader(e.key,e.value):Array.isArray(e)?e.forEach(n=>{this.addHeader(n.key,n.value)}):Object.keys(e).forEach(n=>{this.addHeader(n,e[n])}),this):Array.isArray(r)?(r.forEach(n=>{this.addHeader(e,n)}),this):(this._headers.push({key:this._normalizeHeaderKey(e),value:r}),this)}getHeader(e){e=this._normalizeHeaderKey(e);for(let r=0,n=this._headers.length;r<n;r++)if(this._headers[r].key===e)return this._headers[r].value}setContent(e){return this.content=e,typeof this.content.pipe=="function"?rm(this.content):typeof this.content=="string"&&(this._isPlainText=vs(this.content),this._isPlainText&&vA(this.content,76)&&(this._hasLongLines=!0)),this}build(e){let r;e||(r=new Promise((c,l)=>{e=Mt(c,l)}));let n=e,i=this.createReadStream(),o=[],s=0,a=!1;return i.on("readable",()=>{let c;for(;(c=i.read())!==null;)o.push(c),s+=c.length}),i.once("error",c=>{if(!a)return a=!0,n(c)}),i.once("end",c=>{if(!a)return a=!0,c&&c.length&&(o.push(c),s+=c.length),n(null,Buffer.concat(o,s))}),r}getTransferEncoding(){let e=!1,r=(this.getHeader("Content-Type")||"").toString().toLowerCase().trim();return this.content&&(e=(this.getHeader("Content-Transfer-Encoding")||"").toString().toLowerCase().trim(),(!e||!["base64","quoted-printable"].includes(e))&&(/^text\//i.test(r)?this._isPlainText&&!this._hasLongLines?e="7bit":typeof this.content=="string"||this.content instanceof Buffer?e=this._getTextEncoding(this.content)==="Q"?"quoted-printable":"base64":e=this.textEncoding==="B"?"base64":"quoted-printable":/^(multipart|message)\//i.test(r)||(e=e||"base64"))),e}buildHeaders(){let e=this.getTransferEncoding(),r=[];if(e&&this.setHeader("Content-Transfer-Encoding",e),this.filename&&!this.getHeader("Content-Disposition")&&this.setHeader("Content-Disposition","attachment"),this.rootNode===this){this.getHeader("Date")||this.setHeader("Date",this.date.toUTCString().replace(/GMT/,"+0000")),this.messageId(),this.getHeader("MIME-Version")||this.setHeader("MIME-Version","1.0");for(let n=this._headers.length-2;n>=0;n--){let i=this._headers[n];i.key==="Content-Type"&&(this._headers.splice(n,1),this._headers.push(i))}}return this._headers.forEach(n=>{let i=n.key,o=n.value,s,a,c={};if(!(o&&typeof o=="object"&&!cR.includes(i)&&(et(c,o,u=>u==="value"),o=(o.value||"").toString(),!o.trim()))){if(c.prepared){c.foldLines?r.push(Xa(i+": "+o)):r.push(i+": "+o);return}switch(n.key){case"Content-Disposition":s=am(o),this.filename&&(s.params.filename=this.filename),o=sm(s);break;case"Content-Type":s=am(o),s.value=(s.value||"").toString().replace(/[\x00-\x1f\x7f]/g,""),this._handleContentType(s),s.value.match(/^text\/plain\b/)&&typeof this.content=="string"&&/[\u0080-\uFFFF]/.test(this.content)&&(s.params.charset="utf-8"),o=sm(s),this.filename&&(a=/[\x00-\x1f\x7f]/.test(this.filename)?Sn(this.filename,this._getTextEncoding(this.filename),52):this._encodeWords(this.filename),(a!==this.filename||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(a))&&(a=JSON.stringify(a)),o+="; name="+a);break;case"Bcc":if(!this.keepBcc)return;break}if(o=this._encodeHeaderValue(i,o),!!(o||"").toString().trim()){if(typeof this.normalizeHeaderKey=="function"){let u=this.normalizeHeaderKey(i,o),p=typeof u=="string"?u.replace(/[\x00-\x1f\x7f]/g,""):"";p&&(i=p)}r.push(Xa(i+": "+o,76))}}}),r.join(`\r
+`)}createReadStream(e){e=e||{};let r=new Za(e);this.stream(r,e,o=>{if(o){r.destroy(o);return}r.end()}),r.once("close",()=>{r.writableFinished||this._destroyContentStreams()});let n=[r];for(let o of this._transforms)n.push(typeof o=="function"?o():o);n.push(new Qa);let i=dm(n,RA);for(let o of this._processFuncs){let s=i;i=o(s),i!==s&&td(i,a=>{a&&s.destroy()})}if(this.newline){let o=["win","windows","dos",`\r
+`].includes(this.newline.toString().toLowerCase());i=dm(i,o?new kr:new wn,RA)}return i}transform(e){this._transforms.push(e)}processFunc(e){this._processFuncs.push(e)}stream(e,r,n){let i=this.getTransferEncoding(),o=[],s=!1,a=m=>{s||(s=!0,e.removeListener("close",c),n(m))};function c(){for(let m of o)m.destroy();return a(OA())}let l=(...m)=>{o.length||e.once("close",c),o=m},u=()=>e.destroyed?(a(OA()),!0):!1,p=()=>{let m=0,E=()=>{if(u())return;if(m>=this.childNodes.length)return e.write(`\r
 --`+this.boundary+`--\r
-`),c();let h=this.childNodes[p++];e.write((p>1?`\r
+`),a();let v=this.childNodes[m++];e.write((m>1?`\r
 `:"")+"--"+this.boundary+`\r
-`),h.stream(e,r,g=>{if(g)return c(g);setImmediate(f)})};if(this.multipart)setImmediate(f);else return c()},d=()=>{if(this.content){if(Object.prototype.toString.call(this.content)==="[object Error]")return c(this.content);typeof this.content.pipe=="function"&&(this.content.removeListener("error",this._contentErrorHandler),this._contentErrorHandler=f=>c(f),this.content.once("error",this._contentErrorHandler));let p=()=>{["quoted-printable","base64"].includes(i)?(s=new(i==="base64"?MN:LN).Encoder(r),s.pipe(e,{end:!1}),s.once("end",l),s.once("error",f=>c(f)),o=this._getStream(this.content),o.pipe(s)):(o=this._getStream(this.content),o.pipe(e,{end:!1}),o.once("end",l)),o.once("error",f=>c(f))};if(this.content._resolve){let f=[],h=0,g=!1,_=this._getStream(this.content);_.on("error",R=>{g||(g=!0,c(R))}),_.on("readable",()=>{let R;for(;(R=_.read())!==null;)f.push(R),h+=R.length}),_.on("end",()=>{g||(g=!0,this.content._resolve=!1,this.content._resolvedValue=Buffer.concat(f,h),setImmediate(p))})}else setImmediate(p);return}return setImmediate(l)};this._raw?setImmediate(()=>{if(Object.prototype.toString.call(this._raw)==="[object Error]")return c(this._raw);typeof this._raw.pipe=="function"&&this._raw.removeListener("error",this._contentErrorHandler);let p=this._getStream(this._raw);p.pipe(e,{end:!1}),p.on("error",f=>e.emit("error",f)),p.on("end",l)}):(e.write(this.buildHeaders()+`\r
+`),v.stream(e,r,N=>{if(N)return a(N);setImmediate(E)})};if(this.multipart)setImmediate(E);else return a()},f=()=>{if(u())return;if(!this.content)return setImmediate(p);let m=()=>{if(u())return;let E=this._takeStreamContent(this.content);if(E)return a(E);let v=this._getStream(this.content);if(["quoted-printable","base64"].includes(i)){let N=i==="base64"?new Yu(r):new Xu(Object.assign({},r,{binary:!/^text\//i.test(this.contentType||"")}));l(v,N),N.pipe(e,{end:!1}),dm(v,N,S=>S&&a(S)),td(N,{writable:!1},S=>S?a(S):p())}else l(v),v.pipe(e,{end:!1}),td(v,{writable:!1},N=>N?a(N):p())};if(this.content._resolve){let E=this._getStream(this.content);l(E),za(E,(v,N)=>{if(v)return a(v);s||(this.content._resolve=!1,this.content._resolvedValue=N,setImmediate(m))})}else setImmediate(m)};this._raw?setImmediate(()=>{if(u())return;let m=this._takeStreamContent(this._raw);if(m)return a(m);let E=this._getStream(this._raw);l(E),E.pipe(e,{end:!1}),td(E,{writable:!1},v=>v?a(v):p())}):(e.write(this.buildHeaders()+`\r
 \r
-`),setImmediate(d))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseEnvelopeAddresses(e.from),r),r=r.filter(i=>i&&i.address),r.length&&r[0]&&(this._envelope.from=r[0].address)),["to","cc","bcc"].forEach(i=>{e[i]&&this._convertAddresses(this._parseEnvelopeAddresses(e[i]),this._envelope.to)}),this._envelope.to=this._envelope.to.map(i=>i.address).filter(i=>i);let n=["to","cc","bcc","from"];return Object.keys(e).forEach(i=>{n.includes(i)||(this._envelope[i]=e[i])}),this}getAddresses(){let e={};return this._headers.forEach(r=>{let n=r.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(n)&&(Array.isArray(e[n])||(e[n]=[]),this._convertAddresses(this._parseAddresses(r.value),e[n]))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]};return this._headers.forEach(r=>{let n=[];r.key==="From"||!e.from&&["Reply-To","Sender"].includes(r.key)?(this._convertAddresses(this._parseAddresses(r.value),n),n.length&&n[0]&&(e.from=n[0].address)):["To","Cc","Bcc"].includes(r.key)&&this._convertAddresses(this._parseAddresses(r.value),e.to)}),e.to=e.to.map(r=>r.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&(this._contentErrorHandler=r=>{this._raw.removeListener("error",this._contentErrorHandler),this._raw=r},this._raw.once("error",this._contentErrorHandler)),this}_getStream(e){let r;return e._resolvedValue?(r=new Oa,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this.disableFileAccess?(r=new Oa,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Zv.EFILEACCESS,r.emit("error",n)}),r):PN.createReadStream(e.path):e&&typeof e.href=="string"?this.disableUrlAccess?(r=new Oa,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=Zv.EURLACCESS,r.emit("error",n)}),r):HN(e.href,{headers:e.httpHeaders,tls:e.tls}):(r=new Oa,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){return[].concat.apply([],[].concat(e).map(r=>{if(r&&r.address){let n=this._normalizeAddress(r.address);if(n===r.address&&typeof r.name=="string")return[r];let i=Object.assign({},r);return i.address=n,i.name=r.name||"",[i]}return this._normalizeParsedAddresses(KN(r))}))}_normalizeParsedAddresses(e){return e.forEach(r=>{r.address?r.address=this._normalizeAddress(r.address):r.group&&this._normalizeParsedAddresses(r.group)}),e}_parseEnvelopeAddresses(e){return this._parseAddresses(e).map(r=>r.address||r.group||!r.name||/[\s@]/.test(r.name)?r:{address:this._normalizeAddress(r.name),name:""})}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x1f\x7f]/g,"").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart?this.boundary=e.params.boundary=e.params.boundary||this.boundary||this._generateBoundary():this.boundary=!1}_generateBoundary(){return this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,""),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r)}}_convertAddresses(e,r){let n=[];return r=r||[],[].concat(e||[]).forEach(i=>{if(i.address)i.address=this._normalizeAddress(i.address),i.name?n.push(`${this._encodeAddressName(i.name)} <${i.address}>`):n.push($N.test(i.address)?i.address:`<${i.address}>`),r.some(s=>s.address===i.address)||r.push(i);else if(i.group){let s=(i.group.length?this._convertAddresses(i.group,r):"").trim();n.push(`${this._encodeAddressName(i.name)}:${s};`)}}),n.join(", ")}_normalizeAddress(e){if(e=(e||"").toString().replace(/[\x00-\x1F\x7F<>]+/g," ").trim(),!e)return e;let r=e.lastIndexOf("@");if(r<0)return this._normalizeLocalPart(e);let n=e.substr(0,r),i=e.substr(r+1),s=i;try{/[\x80-\uFFFF]/.test(n)?s=Qv.toUnicode(i.toLowerCase()):s=Qv.toASCII(i.toLowerCase())}catch{}return`${this._normalizeLocalPart(n)}@${s}`}_normalizeLocalPart(e){return qN.test(e)||GN.test(e)?e:Ct.quoteString(e)}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?Ct.quoteString(e):Ct.encodeWord(e,this._getTextEncoding(e),52)}_encodeHeaderText(e){return/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(e)?Ct.encodeWord(e,this._getTextEncoding(e),52):this._encodeWords(e)}_encodeWords(e){return Ct.encodeWords(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,s=e.length;i<s;i++){let o=e.charCodeAt(i);o>=0&&o<=8||o===11||o===12||o>=14&&o<=31||o>=128?r++:(o>=65&&o<=90||o>=97&&o<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+Rf.randomBytes(r).toString("hex"),Rf.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}};tA.exports=Of});var nA=me((AZ,rA)=>{"use strict";var ka=mu(),kf=Na(),{parseDataURI:WN}=kt(),Cf=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new ka("message/rfc822",{newline:this.mail.newline,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n=[].concat(this.mail.attachments||[]).map((i,s)=>{/^data:/i.test(i.path||i.href)&&(i=this._processDataUrl(i));let o=i.contentType||kf.detectMimeType(i.filename||i.path||i.href||"bin"),a=/^image\//i.test(o),c=/^message\//i.test(o),l=i.contentDisposition||(c||a&&i.cid?"inline":"attachment"),d;"contentTransferEncoding"in i?d=i.contentTransferEncoding:c?d="8bit":d="base64";let p={contentType:o,contentDisposition:l,contentTransferEncoding:d};return i.filename?p.filename=i.filename:!c&&i.filename!==!1&&(p.filename=(i.path||i.href||"").split("/").pop().split("?").shift()||"attachment-"+(s+1),p.filename.indexOf(".")<0&&(p.filename+="."+kf.detectExtension(p.contentType))),/^https?:\/\//i.test(i.path)&&(i.href=i.path,i.path=void 0),i.cid&&(p.cid=i.cid),i.raw?p.raw=i.raw:i.path?p.content={path:i.path}:i.href?p.content={href:i.href,httpHeaders:i.httpHeaders,tls:i.tls}:p.content=i.content||"",i.encoding&&(p.encoding=i.encoding),i.headers&&(p.headers=i.headers),p});return this.mail.icalEvent&&(r=Object.assign({},this._getIcalEvent()),r.contentType="application/ics",r.headers||(r.headers={}),r.filename=r.filename||"invite.ics",r.headers["Content-Disposition"]="attachment",r.headers["Content-Transfer-Encoding"]="base64"),e?{attached:n.filter(i=>!i.cid).concat(r||[]),related:n.filter(i=>!!i.cid)}:{attached:n.concat(r||[]),related:[]}}_getIcalEvent(){if(!this._icalEvent){let e;typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?e=Object.assign({},this.mail.icalEvent):e={content:this.mail.icalEvent},/^data:/i.test(e.path||e.href)&&(e=this._processDataUrl(e)),/^https?:\/\//i.test(e.path)&&(e.href=e.path,e.path=void 0),e.raw||(e.path?(e.content={path:e.path},e.path=void 0):e.href&&(e.content={href:e.href,httpHeaders:e.httpHeaders},e.href=void 0)),e.content&&typeof e.content=="object"&&(e.content._resolve=!0),this._icalEvent=e}return this._icalEvent}getAlternatives(){let e=[],r,n,i,s,o;return this.mail.text&&(typeof this.mail.text=="object"&&(this.mail.text.content||this.mail.text.path||this.mail.text.href||this.mail.text.raw)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(typeof this.mail.watchHtml=="object"&&(this.mail.watchHtml.content||this.mail.watchHtml.path||this.mail.watchHtml.href||this.mail.watchHtml.raw)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(typeof this.mail.amp=="object"&&(this.mail.amp.content||this.mail.amp.path||this.mail.amp.href||this.mail.amp.raw)?s=this.mail.amp:s={content:this.mail.amp},s.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(o=Object.assign({},this._getIcalEvent()),o.filename=!1,o.contentType="text/calendar; charset=utf-8; method="+(o.method||"PUBLISH").toString().trim().toUpperCase(),o.headers||(o.headers={})),this.mail.html&&(typeof this.mail.html=="object"&&(this.mail.html.content||this.mail.html.path||this.mail.html.href||this.mail.html.raw)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(s||[]).concat(n||[]).concat(o||[]).concat(this.mail.alternatives||[]).forEach(a=>{/^data:/i.test(a.path||a.href)&&(a=this._processDataUrl(a));let c={contentType:a.contentType||kf.detectMimeType(a.filename||a.path||a.href||"txt"),contentTransferEncoding:a.contentTransferEncoding};a.filename&&(c.filename=a.filename),/^https?:\/\//i.test(a.path)&&(a.href=a.path,a.path=void 0),a.raw?c.raw=a.raw:a.path?c.content={path:a.path}:a.href?c.content={href:a.href}:c.content=a.content||"",a.encoding&&(c.encoding=a.encoding),a.headers&&(c.headers=a.headers),e.push(c)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new ka("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new ka("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new ka('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new ka(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",s=r.indexOf(",");if(s>0&&s<200){let a=r.substring(5,s).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign({},e,{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=WN(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}};rA.exports=Cf});var sA=me((TZ,iA)=>{"use strict";var{Transform:zN}=re("stream"),Df=class extends zN{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,s=r-n;i<s;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,s=this.lastBytes.length+e.length;i<s;i++){let o;if(i<r?o=this.lastBytes[i]:o=e[i-r],o===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length-1>n){let i=e.slice(n);this.bodySize+=i.length,setImmediate(()=>this.push(i))}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(s){return n(s)}i&&(this.bodySize+=e.length,this.push(e)),setImmediate(n)}_flush(e){if(this.headerChunks){let r=Buffer.concat(this.headerChunks,this.headerBytes);this.bodySize+=r.length,this.push(r),this.headerChunks=null}e()}parseHeaders(){let e=(this.rawHeaders||"").toString().split(/\r?\n/);for(let r=e.length-1;r>0;r--)/^\s/.test(e[r])&&(e[r-1]+=`
-`+e[r],e.splice(r,1));return e.filter(r=>r.trim()).map(r=>({key:r.substr(0,r.indexOf(":")).trim().toLowerCase(),line:r}))}};iA.exports=Df});var aA=me((_Z,oA)=>{"use strict";var{Transform:JN}=re("stream"),YN=re("crypto"),Pf=class extends JN{constructor(e){super(),e=e||{},this.chunkBuffer=[],this.chunkBufferLen=0,this.bodyHash=YN.createHash(e.hashAlgo||"sha256"),this.remainder="",this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1}updateHash(e){let r,n="",i="file";for(let o=e.length-1;o>=0;o--){let a=e[o];if(!(i==="file"&&(a===10||a===13))){if(i==="file"&&(a===9||a===32))i="line";else if(!(i==="line"&&(a===9||a===32))){if((i==="file"||i==="line")&&(i="body",o===e.length-1))break}}if(o===0){if(i==="file"&&(!this.remainder||/[\r\n]$/.test(this.remainder))||i==="line"&&(!this.remainder||/[ \t]$/.test(this.remainder))){this.remainder+=e.toString("binary");return}else if(i==="line"||i==="file"){n=e.toString("binary"),e=!1;break}}if(i==="body"){n=e.slice(o+1).toString("binary"),e=e.slice(0,o+1);break}}let s=!!this.remainder;if(e&&!s){for(let o=0,a=e.length;o<a;o++)if(o&&e[o]===10&&e[o-1]!==13){s=!0;break}else if(o&&e[o]===13&&e[o-1]===32){s=!0;break}else if(o&&e[o]===32&&e[o-1]===32){s=!0;break}else if(e[o]===9){s=!0;break}}s?(r=this.remainder+(e?e.toString("binary"):""),this.remainder=n,r=r.replace(/\r?\n/g,`
-`).replace(/[ \t]*$/gm,"").replace(/[ \t]+/gm," ").replace(/\n/g,`\r
-`),e=Buffer.from(r,"binary")):n&&(this.remainder=n),this.debug&&this._debugBody.push(e),this.bodyHash.update(e)}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r)),this.updateHash(e),this.byteLength+=e.length,this.push(e),n()}_flush(e){/[\r\n]$/.test(this.remainder)&&this.byteLength>2&&this.bodyHash.update(Buffer.from(`\r
-`)),this.byteLength||this.push(Buffer.from(`\r
-`)),this.emit("hash",this.bodyHash.digest("base64"),this.debug?Buffer.concat(this._debugBody):!1),e()}};oA.exports=Pf});var uA=me((IZ,Uf)=>{"use strict";var XN=uu(),QN=Na(),ZN=re("crypto");Uf.exports=(t,e,r,n)=>{n=n||{};let s=n.headerFieldNames||"From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive",o=cA(t,s,n.skipFields),a=eR(n.domainName,n.keySelector,o.fieldNames,e,r);o.headers+="dkim-signature:"+lA(a);let c=ZN.createSign(("rsa-"+e).toUpperCase());c.update(o.headers);let l;try{l=c.sign(n.privateKey,"base64")}catch{return!1}return a+l.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g,`$&\r
- `).trim()};Uf.exports.relaxedHeaders=cA;function eR(t,e,r,n,i){let s=a=>(a||"").toString().replace(/[\x00-\x1f\x7f;=]/g,""),o=["v=1","a=rsa-"+n,"c=relaxed/relaxed","d="+XN.toASCII(s(t)),"q=dns/txt","s="+s(e),"bh="+i,"h="+s(r)].join("; ");return QN.foldLines("DKIM-Signature: "+o,76)+`;\r
- b=`}function cA(t,e,r){let n=new Set,i=new Set,s=new Map;(r||"").toLowerCase().split(":").forEach(c=>{i.add(c.trim())}),(e||"").toLowerCase().split(":").filter(c=>!i.has(c.trim())).forEach(c=>{n.add(c.trim())});for(let c=t.length-1;c>=0;c--){let l=t[c];n.has(l.key)&&!s.has(l.key)&&s.set(l.key,lA(l.line))}let o=[],a=[];return n.forEach(c=>{s.has(c)&&(a.push(c),o.push(c+":"+s.get(c)))}),{headers:o.join(`\r
+`),setImmediate(f))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseEnvelopeAddresses(e.from),r),r=r.filter(s=>s&&s.address),r.length&&r[0]&&(this._envelope.from=r[0].address));let n=new Set,i=[];["to","cc","bcc"].forEach(s=>{e[s]&&this._convertAddresses(this._parseEnvelopeAddresses(e[s]),i,n)}),this._envelope.to=i.map(s=>s.address).filter(s=>s);let o=["to","cc","bcc","from"];return et(this._envelope,e,s=>o.includes(s)),this}getAddresses(){let e={},r=new Map;return this._headers.forEach(n=>{let i=n.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(i)&&(Array.isArray(e[i])||(e[i]=[],r.set(i,new Set)),this._convertAddresses(this._parseAddresses(n.value),e[i],r.get(i)))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]},r=new Set,n=[];return this._headers.forEach(i=>{let o=[];i.key==="From"||!e.from&&["Reply-To","Sender"].includes(i.key)?(this._convertAddresses(this._parseAddresses(i.value),o),o.length&&o[0]&&(e.from=o[0].address)):["To","Cc","Bcc"].includes(i.key)&&this._convertAddresses(this._parseAddresses(i.value),n,r)}),e.to=n.map(i=>i.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&rm(this._raw),this}_accessDisabled(e){let r=this;for(;r;){if(r[e])return!0;r=r.parentNode}return!1}_destroyContentStreams(){$i(this.content),$i(this._raw);for(let e of this.childNodes)e._destroyContentStreams()}_takeStreamContent(e){return Object.prototype.toString.call(e)==="[object Error]"?e:!e||typeof e.pipe!="function"||e._resolvedValue?null:nm(e)}_getStream(e){let r;return e._resolvedValue?(r=new Za,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this._accessDisabled("disableFileAccess")?(r=new Za,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Gu,r.emit("error",n)}),r):aR.createReadStream(e.path):e&&typeof e.href=="string"?this._accessDisabled("disableUrlAccess")?(r=new Za,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=$u,r.emit("error",n)}),r):ui(e.href,{headers:e.httpHeaders,tls:e.tls}):(r=new Za,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){let r=[],n=new WeakSet,i=[],o=s=>{n.has(s)||(n.add(s),i.push({list:s,pos:0}))};for(o(Array.isArray(e)?e:[e]);i.length;){let s=i[i.length-1];if(s.pos>=s.list.length){i.pop();continue}let a=s.list[s.pos++];if(Array.isArray(a)){o(a);continue}if(a&&a.address){let l=this._normalizeAddress(a.address);if(l===a.address&&typeof a.name=="string"){r.push(a);continue}let u=et({},a);u.address=l,u.name=a.name||"",r.push(u);continue}let c=this._normalizeParsedAddresses(wA(a));for(let l=0;l<c.length;l++)r.push(c[l])}return r}_normalizeParsedAddresses(e){return e.forEach(r=>{r.address?r.address=this._normalizeAddress(r.address):r.group&&this._normalizeParsedAddresses(r.group)}),e}_parseEnvelopeAddresses(e){return this._parseAddresses(e).map(r=>r.address||r.group||!r.name||/[\s@]/.test(r.name)?r:{address:this._normalizeAddress(r.name),name:""})}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x1f\x7f]/g,"").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){if(this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart){let r=ec(e.params.boundary||this.boundary||"");this.boundary=e.params.boundary=r||ec(this._generateBoundary())}else this.boundary=!1}_generateBoundary(){return ec(this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary)+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,""),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r)}}_convertAddresses(e,r,n){let i=[];if(r=r||[],!n){n=new Set;for(let o=0;o<r.length;o++)n.add(r[o].address)}return[].concat(e||[]).forEach(o=>{if(o.address)o.address=this._normalizeAddress(o.address),o.name?i.push(`${this._encodeAddressName(o.name)} <${o.address}>`):i.push(dR.test(o.address)?o.address:`<${o.address}>`),n.has(o.address)||(n.add(o.address),r.push(o));else if(o.group){let s=(o.group.length?this._convertAddresses(o.group,r,n):"").trim();i.push(`${this._encodeAddressName(o.name)}:${s};`)}}),i.join(", ")}_normalizeAddress(e){if(e=(e||"").toString().replace(/[\x00-\x1F\x7F<>]+/g," ").trim(),!e)return e;let r=e.lastIndexOf("@");if(r<0)return this._normalizeLocalPart(e);let n=e.substr(0,r),i=e.substr(r+1),o=i,s=/[\x80-\uFFFF]/.test(n);try{o=fR(i.toLowerCase(),s)}catch{}return`${this._normalizeLocalPart(n)}@${o}`}_normalizeLocalPart(e){return lR.test(e)||uR.test(e)?e:Ya(e)}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?Ya(e):Sn(e,this._getTextEncoding(e),52)}_encodeHeaderText(e){return/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(e)?Sn(e,this._getTextEncoding(e),52):this._encodeWords(e)}_encodeWords(e){return AA(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,o=e.length;i<o;i++){let s=e.charCodeAt(i);s>=0&&s<=8||s===11||s===12||s>=14&&s<=31||s>=128?r++:(s>=65&&s<=90||s>=97&&s<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+um.randomBytes(r).toString("hex"),um.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}},Qr=pm;function tc(t){let e=t;return typeof t=="object"&&!!(e.content||e.path||e.href||e.raw)}var fm=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new Qr("message/rfc822",{newline:this.mail.newline,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n=[].concat(this.mail.attachments||[]).map((i,o)=>{/^data:/i.test(i.path||i.href)&&(i=this._processDataUrl(i));let s=i.contentType||Wi(i.filename||i.path||i.href||"bin"),a=/^image\//i.test(s),c=/^message\//i.test(s),l=i.contentDisposition||(c||a&&i.cid?"inline":"attachment"),u;"contentTransferEncoding"in i?u=i.contentTransferEncoding:c?u="8bit":u="base64";let p={contentType:s,contentDisposition:l,contentTransferEncoding:u};return i.filename?p.filename=i.filename:!c&&i.filename!==!1&&(p.filename=(i.path||i.href||"").split(/[/\\]/).pop().split("?").shift()||"attachment-"+(o+1),p.filename.indexOf(".")<0&&(p.filename+="."+Zu(p.contentType))),/^https?:\/\//i.test(i.path)&&(i.href=i.path,i.path=void 0),i.cid&&(p.cid=i.cid),i.raw?p.raw=i.raw:i.path?p.content={path:i.path}:i.href?p.content={href:i.href,httpHeaders:i.httpHeaders,tls:i.tls}:p.content=i.content||"",i.encoding&&(p.encoding=i.encoding),i.headers&&(p.headers=i.headers),p});return this.mail.icalEvent&&(r=Object.assign({},this._getIcalEvent()),r.contentType="application/ics",r.headers||(r.headers={}),r.filename=r.filename||"invite.ics",r.headers["Content-Disposition"]="attachment",r.headers["Content-Transfer-Encoding"]="base64"),e?{attached:n.filter(i=>!i.cid).concat(r||[]),related:n.filter(i=>!!i.cid)}:{attached:n.concat(r||[]),related:[]}}_getIcalEvent(){if(!this._icalEvent){let e;tc(this.mail.icalEvent)?e=et({},this.mail.icalEvent):e={content:this.mail.icalEvent},/^data:/i.test(e.path||e.href)&&(e=this._processDataUrl(e)),/^https?:\/\//i.test(e.path)&&(e.href=e.path,e.path=void 0),e.raw||(e.path?(e.content={path:e.path},e.path=void 0):e.href&&(e.content={href:e.href,httpHeaders:e.httpHeaders,tls:e.tls},e.href=void 0)),e.content&&typeof e.content=="object"&&(e.content._resolve=!0),this._icalEvent=e}return this._icalEvent}getAlternatives(){let e=[],r,n,i,o,s;return this.mail.text&&(tc(this.mail.text)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(tc(this.mail.watchHtml)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(tc(this.mail.amp)?o=this.mail.amp:o={content:this.mail.amp},o.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(s=Object.assign({},this._getIcalEvent()),s.filename=!1,s.contentType="text/calendar; charset=utf-8; method="+(s.method||"PUBLISH").toString().trim().toUpperCase(),s.headers||(s.headers={})),this.mail.html&&(tc(this.mail.html)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(o||[]).concat(n||[]).concat(s||[]).concat(this.mail.alternatives||[]).forEach(a=>{/^data:/i.test(a.path||a.href)&&(a=this._processDataUrl(a));let c={contentType:a.contentType||Wi(a.filename||a.path||a.href||"txt"),contentTransferEncoding:a.contentTransferEncoding};a.filename&&(c.filename=a.filename),/^https?:\/\//i.test(a.path)&&(a.href=a.path,a.path=void 0),a.raw?c.raw=a.raw:a.path?c.content={path:a.path}:a.href?c.content={href:a.href,httpHeaders:a.httpHeaders,tls:a.tls}:c.content=a.content||"",a.encoding&&(c.encoding=a.encoding),a.headers&&(c.headers=a.headers),e.push(c)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",o=r.indexOf(",");if(o>0&&o<200){let a=r.substring(5,o).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign(et({},e),{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=em(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}},kA=fm;import{Transform as mR}from"node:stream";function hR(t){let e=0,r=t.length;for(;e<r&&(t.charCodeAt(e)===32||t.charCodeAt(e)===9);)e++;for(;r>e&&(t.charCodeAt(r-1)===32||t.charCodeAt(r-1)===9);)r--;return t.slice(e,r)}var mm=class extends mR{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,o=r-n;i<o;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,o=this.lastBytes.length+e.length;i<o;i++){let s;if(i<r?s=this.lastBytes[i]:s=e[i-r],s===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length>n){let i=e.slice(n);this.bodySize+=i.length,this.push(i)}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(o){return n(o)}i&&(this.bodySize+=e.length,this.push(e)),n()}_flush(e){this.headerChunks&&(this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders())),e()}parseHeaders(){let e=(this.rawHeaders||Buffer.alloc(0)).toString("binary").split(/\r?\n/),r=[];for(let n of e)r.length&&/^[ \t]/.test(n)?r[r.length-1]+=`
+`+n:r.push(n);return r.filter(n=>/[^ \t\r]/.test(n)).map(n=>({key:hR(n.substr(0,n.indexOf(":"))).toLowerCase(),line:n}))}},CA=mm;import{Transform as ER}from"node:stream";import yR from"node:crypto";var nd=13,DA=10,PA=32,gR=9,LA=Buffer.from(`\r
+`),UA=Buffer.alloc(4096,LA),hm=class extends ER{constructor(e){super(),e=e||{},this.bodyHash=yR.createHash(e.hashAlgo||"sha256"),this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1,this._lineHasContent=!1,this._pendingWsp=!1,this._pendingCr=!1,this._pendingEmptyLines=0}_hashCanonical(e){e.length&&(this.bodyHash.update(e),this._debugBody&&this._debugBody.push(Buffer.from(e)))}_hashEmptyLines(){for(;this._pendingEmptyLines>0;){let e=Math.min(this._pendingEmptyLines,UA.length/2);this._hashCanonical(UA.subarray(0,e*2)),this._pendingEmptyLines-=e}}_emitContent(e,r,n){return this._lineHasContent||(this._pendingEmptyLines&&(this._hashCanonical(e.subarray(0,r)),r=0,this._hashEmptyLines()),this._lineHasContent=!0),this._pendingWsp&&(e[r++]=PA,this._pendingWsp=!1),e[r++]=n,r}updateHash(e,r){let n=Buffer.allocUnsafe(e.length*2+2),i=0;for(let o=0;o<e.length;o++){let s=e[o];if(s===DA){this._lineHasContent?(n[i++]=nd,n[i++]=DA,this._lineHasContent=!1):this._pendingEmptyLines++,this._pendingWsp=!1,this._pendingCr=!1;continue}this._pendingCr&&(i=this._emitContent(n,i,nd),this._pendingCr=!1),s===nd?this._pendingCr=!0:s===PA||s===gR?this._pendingWsp=!0:i=this._emitContent(n,i,s)}r&&this._pendingCr&&(i=this._emitContent(n,i,nd),this._pendingCr=!1),this._hashCanonical(n.subarray(0,i))}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r)),this.updateHash(e),this.byteLength+=e.length,this.push(e),n()}_flush(e){this.updateHash(Buffer.alloc(0),!0),this._lineHasContent&&this._hashCanonical(LA),this.emit("hash",this.bodyHash.digest("base64"),this.debug?Buffer.concat(this._debugBody):!1),e()}},MA=hm;import vR from"node:crypto";function KA(t){let e=new Error('Unsupported DKIM hash algorithm "'+t+'"');return e.code=Es,e}function Em(t,e,r,n){n=n||{};let o=n.headerFieldNames||"From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive",s=HA(t,o,n.skipFields),a=AR(n.domainName,n.keySelector,s.fieldNames,e,r);s.headers+="dkim-signature:"+FA(a);let c;try{c=vR.createSign(("rsa-"+e).toUpperCase())}catch{throw KA(e)}c.update(s.headers,"latin1");let l;try{l=c.sign(n.privateKey,"base64")}catch{return!1}return a+l.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g,`$&\r
+ `).trim()}Em.relaxedHeaders=HA;Em.unsupportedHashAlgoError=KA;var ym=Em;function AR(t,e,r,n,i){let o=a=>(a||"").toString().replace(/[\x00-\x1f\x7f;=]/g,""),s=["v=1","a=rsa-"+n,"c=relaxed/relaxed","d="+hs(o(t)),"q=dns/txt","s="+o(e),"bh="+i,"h="+o(r)].join("; ");return Xa("DKIM-Signature: "+s,76)+`;\r
+ b=`}function HA(t,e,r){let n=new Set,i=new Set,o=new Map;(r||"").toLowerCase().split(":").forEach(c=>{i.add(c.trim())}),(e||"").toLowerCase().split(":").filter(c=>!i.has(c.trim())).forEach(c=>{n.add(c.trim())});for(let c=t.length-1;c>=0;c--){let l=t[c];n.has(l.key)&&!o.has(l.key)&&o.set(l.key,FA(l.line))}let s=[],a=[];return n.forEach(c=>{o.has(c)&&(a.push(c),s.push(c+":"+o.get(c)))}),{headers:s.join(`\r
 `)+`\r
-`,fieldNames:a.join(":")}}function lA(t){return t.substr(t.indexOf(":")+1).replace(/\r?\n/g,"").replace(/\s+/g," ").trim()}});var pA=me((xZ,dA)=>{"use strict";var tR=sA(),rR=aA(),nR=uA(),{PassThrough:Lf}=re("stream"),Mf=re("fs"),iR=re("path"),sR=re("crypto"),oR="sha256",aR=2*1024*1024,Kf=class{constructor(e,r,n,i){this.options=e||{},this.keys=r,this.cacheTreshold=Number(this.options.cacheTreshold)||aR,this.hashAlgo=this.options.hashAlgo||oR,this.cacheDir=this.options.cacheDir||!1,this.chunks=[],this.chunklen=0,this.readPos=0,this.cachePath=this.cacheDir?iR.join(this.cacheDir,"message."+Date.now()+"-"+sR.randomBytes(14).toString("hex")):!1,this.cache=!1,this.headers=!1,this.bodyHash=!1,this.parser=!1,this.relaxedBody=!1,this.input=n,this.output=i,this.output.usingCache=!1,this.hasErrored=!1,this.input.on("error",s=>{this.hasErrored=!0,this.cleanup(),i.emit("error",s)})}cleanup(){!this.cache||!this.cachePath||Mf.unlink(this.cachePath,()=>!1)}createReadCache(){this.cache=Mf.createReadStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.output.emit("error",e)}),this.cache.once("close",()=>{this.cleanup()}),this.cache.pipe(this.output)}sendNextChunk(){if(this.hasErrored)return;if(this.readPos>=this.chunks.length)return this.cache?this.createReadCache():this.output.end();let e=this.chunks[this.readPos++];if(this.output.write(e)===!1)return this.output.once("drain",()=>{this.sendNextChunk()});setImmediate(()=>this.sendNextChunk())}sendSignedOutput(){let e=0,r=()=>{if(e>=this.keys.length)return this.output.write(this.parser.rawHeaders),setImmediate(()=>this.sendNextChunk());let n=this.keys[e++],i=nR(this.headers,this.hashAlgo,this.bodyHash,{domainName:n.domainName,keySelector:n.keySelector,privateKey:n.privateKey,headerFieldNames:this.options.headerFieldNames,skipFields:this.options.skipFields});return i&&this.output.write(Buffer.from(i+`\r
-`)),setImmediate(r)};if(this.bodyHash&&this.headers)return r();this.output.write(this.parser.rawHeaders),this.sendNextChunk()}createWriteCache(){this.output.usingCache=!0,this.cache=Mf.createWriteStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.relaxedBody.unpipe(this.cache),this.relaxedBody.on("readable",()=>{for(;this.relaxedBody.read()!==null;);}),this.hasErrored=!0,this.output.emit("error",e)}),this.cache.once("close",()=>{this.sendSignedOutput()}),this.relaxedBody.removeAllListeners("readable"),this.relaxedBody.pipe(this.cache)}signStream(){this.parser=new tR,this.relaxedBody=new rR({hashAlgo:this.hashAlgo}),this.parser.on("headers",e=>{this.headers=e}),this.relaxedBody.on("hash",e=>{this.bodyHash=e}),this.relaxedBody.on("readable",()=>{let e;if(!this.cache){for(;(e=this.relaxedBody.read())!==null;)if(this.chunks.push(e),this.chunklen+=e.length,this.chunklen>=this.cacheTreshold&&this.cachePath)return this.createWriteCache()}}),this.relaxedBody.on("end",()=>{this.cache||this.sendSignedOutput()}),this.parser.pipe(this.relaxedBody),setImmediate(()=>this.input.pipe(this.parser))}},Hf=class{constructor(e){this.options=e||{},this.keys=[].concat(this.options.keys||{domainName:e.domainName,keySelector:e.keySelector,privateKey:e.privateKey})}sign(e,r){let n=new Lf,i=e,s=!1;Buffer.isBuffer(e)?(s=e,i=new Lf):typeof e=="string"&&(s=Buffer.from(e),i=new Lf);let o=this.options;r&&Object.keys(r).length&&(o=Object.assign({},r,this.options));let a=new Kf(o,this.keys,i,n);return setImmediate(()=>{a.signStream(),s&&setImmediate(()=>{i.end(s)})}),n}};dA.exports=Hf});var yA=me((bZ,EA)=>{"use strict";var fA=re("net"),mA=re("tls"),cR=Qs(),Ff=Xt(),lR=64*1024;function hA(t,e,r,n,i){if(typeof n=="function"&&(i=n,n={}),n=n||{},e=Number(e)||0,!e||/[\r\n]/.test(r)){let f=new Error("Invalid proxy destination");return f.code=Ff.EPROXY,setImmediate(()=>i(f))}let s=cR.parse(t),o={host:s.hostname,port:Number(s.port)?Number(s.port):s.protocol==="https:"?443:80},a;s.protocol==="https:"?(o.rejectUnauthorized=n.rejectUnauthorized!==!1,a=mA.connect.bind(mA)):a=fA.connect.bind(fA);let c,l=!1,d=f=>{if(!l){l=!0;try{c.destroy()}catch{}i(f)}},p=()=>{let f=new Error("Proxy socket timed out");f.code="ETIMEDOUT",d(f)};c=a(o,()=>{if(l)return;let f={Host:r+":"+e,Connection:"close"};s.auth&&(f["Proxy-Authorization"]="Basic "+Buffer.from(s.auth).toString("base64")),c.write("CONNECT "+r+":"+e+` HTTP/1.1\r
-`+Object.keys(f).map(_=>_+": "+f[_]).join(`\r
+`,fieldNames:a.join(":")}}function FA(t){return t.substr(t.indexOf(":")+1).replace(/\r?\n/g,"").replace(/[ \t]+/g," ").replace(/^ | $/g,"")}import{PassThrough as gm}from"node:stream";import vm from"node:fs";import TR from"node:path";import _R from"node:crypto";var IR="sha256",xR=10*1024*1024,Am=class{constructor(e,r,n,i){this.options=e||{},this.keys=r,this.cacheTreshold=Number(this.options.cacheTreshold)||xR,this.hashAlgo=this.options.hashAlgo||IR,this.cacheDir=this.options.cacheDir||!1,this.chunks=[],this.chunklen=0,this.readPos=0,this.cachePath=this.cacheDir?TR.join(this.cacheDir,"message."+Date.now()+"-"+_R.randomBytes(14).toString("hex")):!1,this.cache=!1,this.headers=!1,this.bodyHash=!1,this.parser=!1,this.relaxedBody=!1,this.input=n,this.output=i,this.output.usingCache=!1,this.hasErrored=!1,this.input.on("error",o=>this.fail(o)),this.output.once("close",()=>{this.output.writableFinished||(this.hasErrored=!0,this.input.unpipe(),this.input.destroy(),this.cleanup())})}fail(e){this.hasErrored=!0,this.cleanup(),this.output.destroy(e)}cleanup(){if(!this.cache||!this.cachePath)return;let e=this.cache;this.cache=!1,e.destroy(),vm.unlink(this.cachePath,()=>!1)}createReadCache(){this.cache=vm.createReadStream(this.cachePath),this.cache.once("error",e=>this.fail(e)),this.cache.once("close",()=>{this.cleanup()}),this.cache.pipe(this.output)}sendNextChunk(){for(;!this.hasErrored;){if(this.readPos>=this.chunks.length){if(!this.cache){this.output.end();return}return this.createReadCache()}let e=this.chunks[this.readPos++];if(this.output.write(e)===!1){this.output.once("drain",()=>{this.sendNextChunk()});return}}}sendSignedOutput(){if(this.hasErrored)return;let e=0,r=()=>{if(e>=this.keys.length){this.output.write(this.parser.rawHeaders),setImmediate(()=>this.sendNextChunk());return}let n=this.keys[e++],i;try{i=ym(this.headers,this.hashAlgo,this.bodyHash,{domainName:n.domainName,keySelector:n.keySelector,privateKey:n.privateKey,headerFieldNames:this.options.headerFieldNames,skipFields:this.options.skipFields})}catch(o){this.fail(o);return}i&&this.output.write(Buffer.from(i+`\r
+`)),setImmediate(r)};if(this.bodyHash&&this.headers)return r();this.output.write(this.parser.rawHeaders),this.sendNextChunk()}createWriteCache(){this.output.usingCache=!0,this.cache=vm.createWriteStream(this.cachePath),this.cache.once("error",e=>{this.relaxedBody.unpipe(this.cache),this.relaxedBody.on("readable",()=>{for(;this.relaxedBody.read()!==null;);}),this.fail(e)}),this.cache.once("close",()=>{this.hasErrored||this.sendSignedOutput()}),this.relaxedBody.removeAllListeners("readable"),this.relaxedBody.pipe(this.cache)}signStream(){this.parser=new CA,this.relaxedBody=new MA({hashAlgo:this.hashAlgo}),this.parser.on("headers",e=>{this.headers=e}),this.relaxedBody.on("hash",e=>{this.bodyHash=e}),this.relaxedBody.on("readable",()=>{let e;if(!this.cache){for(;(e=this.relaxedBody.read())!==null;)if(this.chunks.push(e),this.chunklen+=e.length,this.chunklen>=this.cacheTreshold&&this.cachePath)return this.createWriteCache()}}),this.relaxedBody.on("end",()=>{this.cache||this.sendSignedOutput()}),this.parser.pipe(this.relaxedBody),setImmediate(()=>this.input.pipe(this.parser))}},Tm=class{constructor(e){this.options=e||{},this.keys=[].concat(this.options.keys||{domainName:e.domainName,keySelector:e.keySelector,privateKey:e.privateKey})}sign(e,r){let n=new gm,i=e,o=!1;Buffer.isBuffer(e)?(o=e,i=new gm):typeof e=="string"&&(o=Buffer.from(e),i=new gm);let s=this.options;r&&Object.keys(r).length&&(s=et({},r),et(s,this.options));let a=new Am(s,this.keys,i,n);return setImmediate(()=>{try{a.signStream()}catch{a.fail(ym.unsupportedHashAlgoError(a.hashAlgo));return}o&&setImmediate(()=>{i.end(o)})}),n}},_m=Tm;import Im from"node:net";import VA from"node:tls";var bR=64*1024,BA=t=>typeof t=="string"&&t.startsWith("[")&&t.endsWith("]")?t.slice(1,-1):t;function jA(t,e,r,n,i){typeof n=="function"&&(i=n,n={}),n=n||{};let o=i;if(e=Number(e)||0,!e||/[\r\n]/.test(r)){let B=new Error("Invalid proxy destination");B.code=li,setImmediate(()=>o(B));return}let s=Nr(t),a=(Im.isIPv6(BA(r))?"["+BA(r)+"]":r)+":"+e,c={host:s.hostname,port:Number(s.port)?Number(s.port):s.protocol==="https:"?443:80},l;s.protocol==="https:"?(c.rejectUnauthorized=n.rejectUnauthorized!==!1,l=VA.connect.bind(VA)):l=Im.connect.bind(Im);let u=Number(n.timeout)||jA.timeout||30*1e3,p,f=!1,m,E=()=>{clearTimeout(m),p.removeListener("data",K),p.removeListener("error",v),p.removeListener("close",N)};function v(B){if(!f){f=!0,E();try{p.destroy()}catch{}o(B)}}function N(){let B=new Error("Proxy closed the connection before the tunnel was established");B.code=li,v(B)}let S=[],R=0,M="";function K(B){if(f)return;let V=M+B.toString("binary"),$=V.indexOf(`\r
+\r
+`);if(S.push(B),R+=B.length,M=V.slice(-3),$<0){if(R>bR){let I=new Error("Proxy response headers too large");I.code=li,v(I)}return}p.removeListener("data",K),p.pause();let A=R-V.length+$,x=Buffer.concat(S,R);x.length>A+4&&p.unshift(x.subarray(A+4));let b=x.toString("binary",0,A).match(/^HTTP\/\d+\.\d+ (\d+)/i);if(!b||(b[1]||"").charAt(0)!=="2"){let I=new Error("Invalid response from proxy"+(b&&": "+b[1]||""));return I.code=li,v(I)}f=!0,E();let g=I=>{I==="data"&&(p.removeListener("newListener",g),p.resume())};return p.on("newListener",g),o(null,p)}p=l(c,()=>{if(f)return;let B={Host:a,Connection:"close"};s.auth&&(B["Proxy-Authorization"]="Basic "+Buffer.from(s.auth).toString("base64")),p.write("CONNECT "+a+` HTTP/1.1\r
+`+Object.keys(B).map(V=>V+": "+B[V]).join(`\r
 `)+`\r
 \r
-`);let h="",g=_=>{let R,C;if(!l){if(h+=_.toString("binary"),R=h.match(/\r\n\r\n/)){if(c.removeListener("data",g),C=h.substr(R.index+R[0].length),h=h.substr(0,R.index),C&&c.unshift(Buffer.from(C,"binary")),l=!0,R=h.match(/^HTTP\/\d+\.\d+ (\d+)/i),!R||(R[1]||"").charAt(0)!=="2"){try{c.destroy()}catch{}let D=new Error("Invalid response from proxy"+(R&&": "+R[1]||""));return D.code=Ff.EPROXY,i(D)}return c.removeListener("error",d),c.removeListener("timeout",p),c.setTimeout(0),i(null,c)}if(h.length>lR){c.removeListener("data",g);let D=new Error("Proxy response headers too large");return D.code=Ff.EPROXY,d(D)}}};c.on("data",g)}),c.setTimeout(hA.timeout||30*1e3),c.on("timeout",p),c.once("error",d)}EA.exports=hA});var AA=me((SZ,vA)=>{"use strict";var gA=kt(),uR=mu(),Zs=Na(),Vf=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};Object.assign(this.data,r),this.data.headers=this.data.headers||{},Object.keys(i).forEach(s=>{s in this.data?s==="headers"&&Object.keys(i.headers).forEach(o=>{o in this.data.headers||(this.data.headers[o]=i.headers[o])}):this.data[s]=i[s]}),["disableFileAccess","disableUrlAccess","normalizeHeaderKey"].forEach(s=>{s in n&&(this.data[s]=n[s])})}resolveContent(...e){return gA.resolveContent(...e)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split("/").pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Zs.detectExtension(c.contentType))),c.contentType||(c.contentType=Zs.detectMimeType(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new uR;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let o=0,a=()=>{if(o>=r.length)return e(null,this.data);let c=r[o++];if(!c[0]||!c[0][c[1]])return a();gA.resolveContent(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,d)=>{if(l)return e(l);let p={content:d};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&Object.keys(c[0][c[1]]).forEach(f=>{!(f in p)&&!["content","path","href","raw"].includes(f)&&(p[f]=c[0][c[1]][f])}),c[0][c[1]]=p,a()})};setImmediate(()=>a())}normalize(e){let r=this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,s)=>i?e(i):(s.envelope=r,s.messageId=n,["html","text","watchHtml","amp"].forEach(o=>{s[o]&&s[o].content&&(typeof s[o].content=="string"?s[o]=s[o].content:Buffer.isBuffer(s[o].content)&&(s[o]=s[o].content.toString()))}),s.icalEvent&&Buffer.isBuffer(s.icalEvent.content)&&(s.icalEvent.content=s.icalEvent.content.toString("base64"),s.icalEvent.encoding="base64"),s.alternatives&&s.alternatives.length&&s.alternatives.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.attachments&&s.attachments.length&&s.attachments.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.normalizedHeaders={},Object.keys(s.headers||{}).forEach(o=>{let a=[].concat(s.headers[o]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(o)&&(a=this.message._encodeHeaderValue(o,a)),s.normalizedHeaders[o]=a)}),s.list&&typeof s.list=="object"&&this._getListHeaders(s.list).forEach(a=>{s.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),s.references&&(s.normalizedHeaders.references=this.message._encodeHeaderValue("references",s.references)),s.inReplyTo&&(s.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",s.inReplyTo)),e(null,s)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){let s=(i.comment||"").toString().replace(/\r?\n|\r/g," "),o=!Zs.isPlainText(s)||/\x7f/.test(s);return r.toLowerCase().trim()==="id"?(s=o?Zs.encodeWord(s):Zs.quoteString(s),(i.comment?s+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+:\/{0,2}/,"<")):(s=o?Zs.encodeWord(s):s.replace(/[()\\]/g,"\\$&"),this._formatListUrl(i.url)+(i.comment?" ("+s+")":""))}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};vA.exports=Vf});var bA=me((wZ,xA)=>{"use strict";var dR=re("events"),TA=kt(),pR=yf(),fR=nA(),_A=pA(),mR=yA(),IA=Xt(),hR=re("util"),ER=Qs(),Bf=xr(),yR=AA(),gR=re("net"),vR=re("dns"),AR=re("crypto"),jf=class extends dR{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new _A(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=TA.getLogger(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...s)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...s)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((s,o)=>{r=TA.callbackPromise(s,o)})),typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let i=new yR(this,e);return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",i,s=>{if(s)return this.logger.error({err:s,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",s.message),r(s);i.message=new fR(i.data).compile(),i.setMailerHeader(),i.setPriorityHeaders(),i.setListHeaders(),this._processPlugins("stream",i,o=>{if(o)return this.logger.error({err:o,tnx:"plugin",action:"stream"},"PluginStream Error: %s",o.message),r(o);(i.data.dkim||this.dkim)&&i.message.processFunc(a=>{let c=i.data.dkim?new _A(i.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:i.message.messageId(),dkimDomains:c.keys.map(l=>l.keySelector+"."+l.domainName).join(", ")},"Signing outgoing message with %s keys",c.keys.length),c.sign(a,i.data._dkim)}),this.transporter.send(i,(...a)=>{a[0]&&this.logger.error({err:a[0],tnx:"transport",action:"send"},"Send Error: %s",a[0].message),r(...a)})})}),n}getVersionString(){return hR.format("%s (%s; +%s; %s/%s)",Bf.name,Bf.version,Bf.homepage,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],s=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+s.length===0)return n();let o=0,a="default",c=()=>{let l=a==="default"?s:i;if(o>=l.length)if(a==="default"&&i.length)a="user",o=0,l=i;else return n();let d=l[o++];d(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=ER.parse(e);this.getSocket=(n,i)=>{let s=r.protocol.replace(/:$/,"").toLowerCase();if(this.meta.has("proxy_handler_"+s))return this.meta.get("proxy_handler_"+s)(r,n,i);switch(s){case"http":case"https":mR(r.href,n.port,n.host,this.options.tls||{},(a,c)=>a?i(a):i(null,{connection:c}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let c=new Error("Socks module not loaded");return c.code=IA.EPROXY,i(c)}let a=c=>{let l=!!this.meta.get("proxy_socks_module").SocksClient,d=l?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),p=Number(r.protocol.replace(/\D/g,""))||5,f={proxy:{ipaddress:c,port:Number(r.port),type:p},[l?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(r.auth){let h=decodeURIComponent(r.auth.split(":").shift()),g=decodeURIComponent(r.auth.split(":").pop());l?(f.proxy.userId=h,f.proxy.password=g):p===4?f.userid=h:f.authentication={username:h,password:g}}d.createConnection(f,(h,g)=>h?i(h):i(null,{connection:g.socket||g}))};return gR.isIP(r.hostname)?a(r.hostname):vR.resolve(r.hostname,(c,l)=>{if(c)return i(c);a(Array.isArray(l)?l[0]:l)})}}let o=new Error("Unknown proxy configuration");o.code=IA.EPROXY,i(o)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let s=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(o,a,c,l)=>{let d=AR.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:d,filename:"image-"+ ++s+"."+pR.detectExtension(l)}),a+"cid:"+d}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}};xA.exports=jf});var wA=me((NZ,SA)=>{"use strict";var{Transform:TR}=re("stream"),qf=class extends TR{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],s=0,o,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,o=0,a=e.length;o<a;o++)e[o]===46?(o&&e[o-1]===10||!o&&(!this.lastByte||this.lastByte===10))&&(l=e.slice(c,o+1),i.push(l),i.push(Buffer.from(".")),s+=l.length+1,c=o+1):e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>c?(l=e.slice(c,o),i.push(l),s+=l.length+2):s+=2,i.push(Buffer.from(`\r
-`)),c=o+1);s?(c<e.length&&(l=e.slice(c),i.push(l),s+=l.length),this.outByteCount+=s,this.push(Buffer.concat(i,s))):(this.outByteCount+=e.length,this.push(e)),this.lastByte=e[e.length-1],n()}_flush(e){let r;this.lastByte===10?r=Buffer.from(`.\r
+`),p.on("data",K)}),m=setTimeout(()=>{let B=new Error("Proxy socket timed out");B.code=Yf,v(B)},u),p.once("error",v),p.once("close",N)}var GA=jA;import wR from"node:util";var xm=(t,e)=>Object.prototype.hasOwnProperty.call(t,e),rc=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};et(this.data,r),this.data.headers=this.data.headers||{},et(this.data,i,o=>xm(this.data,o)),et(this.data.headers,i.headers,o=>xm(this.data.headers,o)),["disableFileAccess","disableUrlAccess","normalizeHeaderKey","maxRecipients"].forEach(o=>{o in n&&(this.data[o]=n[o])}),["disableFileAccess","disableUrlAccess"].forEach(o=>{!(o in n)&&xm(i,o)&&(this.data[o]=this.data[o]||i[o])})}resolveContent(e,r,n,i){!i&&typeof n=="function"&&(i=n,n=!1),n=n||{};let o={disableFileAccess:this.data.disableFileAccess||n.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess||n.disableUrlAccess};return tm(e,r,o,i)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split(/[/\\]/).pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Zu(c.contentType))),c.contentType||(c.contentType=Wi(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new Qr;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let s=0,a=()=>{if(s>=r.length)return e(null,this.data);let c=r[s++];if(!c[0]||!c[0][c[1]])return a();tm(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,u)=>{if(l)return e(l);let p={content:u};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&et(p,c[0][c[1]],f=>f in p||["content","path","href","raw"].includes(f)),c[0][c[1]]=p,a()})};setImmediate(()=>a())}releaseStreams(){let e=this.data,r=[e.html,e.text,e.watchHtml,e.amp,e.raw,e.icalEvent];for(let n of["attachments","alternatives"])Array.isArray(e[n])&&r.push(...e[n]);for(let n of r)n&&typeof n=="object"&&($i(n),$i(n.content),$i(n.raw))}normalize(e){let r=this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,o)=>i?e(i):(o.envelope=r,o.messageId=n,["html","text","watchHtml","amp"].forEach(s=>{o[s]&&o[s].content&&(typeof o[s].content=="string"?o[s]=o[s].content:Buffer.isBuffer(o[s].content)&&(o[s]=o[s].content.toString()))}),o.icalEvent&&Buffer.isBuffer(o.icalEvent.content)&&(o.icalEvent.content=o.icalEvent.content.toString("base64"),o.icalEvent.encoding="base64"),o.alternatives&&o.alternatives.length&&o.alternatives.forEach(s=>{s&&s.content&&Buffer.isBuffer(s.content)&&(s.content=s.content.toString("base64"),s.encoding="base64")}),o.attachments&&o.attachments.length&&o.attachments.forEach(s=>{s&&s.content&&Buffer.isBuffer(s.content)&&(s.content=s.content.toString("base64"),s.encoding="base64")}),o.normalizedHeaders={},Object.keys(o.headers||{}).forEach(s=>{if(Rr(s))return;let a=[].concat(o.headers[s]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(s)&&(a=this.message._encodeHeaderValue(s,a)),o.normalizedHeaders[s]=a)}),o.list&&typeof o.list=="object"&&this._getListHeaders(o.list).forEach(a=>{o.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),o.references&&(o.normalizedHeaders.references=this.message._encodeHeaderValue("references",o.references)),o.inReplyTo&&(o.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",o.inReplyTo)),e(null,o)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){let o=(i.comment||"").toString().replace(/\r?\n|\r/g," "),s=!vs(o)||/\x7f/.test(o);return r.toLowerCase().trim()==="id"?(o=s?Sn(o):Ya(o),(i.comment?o+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+:\/{0,2}/,"<")):(o=s?Sn(o):o.replace(/[()\\]/g,"\\$&"),this._formatListUrl(i.url)+(i.comment?" ("+o+")":""))}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};import NR from"node:net";import RR from"node:dns";import OR from"node:crypto";var kR=1e5,bm=class extends SR{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new _m(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=ft(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...o)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...o)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((a,c)=>{r=Mt(a,c)}));let i=r;typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let o=new rc(this,e),s=a=>{o.releaseStreams(),i(a)};return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",o,a=>{if(a)return this.logger.error({err:a,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",a.message),s(a);let c;try{o.message=new kA(o.data).compile(),o.setMailerHeader(),o.setPriorityHeaders(),o.setListHeaders(),c=o.message.getEnvelope().to.length}catch(u){return this.logger.error({err:u,tnx:"transport",action:"send"},"Compile Error: %s",u.message),s(u)}let l=o.data.maxRecipients===void 0?kR:o.data.maxRecipients;if(l&&c>l){let u=new Error(`Message has ${c} recipients, which is over the ${l} allowed by maxRecipients`);return u.code=Xv,this.logger.error({err:u,tnx:"transport",action:"send"},"Send Error: %s",u.message),s(u)}this._processPlugins("stream",o,u=>{if(u)return this.logger.error({err:u,tnx:"plugin",action:"stream"},"PluginStream Error: %s",u.message),s(u);(o.data.dkim||this.dkim)&&o.message.processFunc(p=>{let f=o.data.dkim?new _m(o.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:o.message.messageId(),dkimDomains:f.keys.map(m=>m.keySelector+"."+m.domainName).join(", ")},"Signing outgoing message with %s keys",f.keys.length),f.sign(p,o.data._dkim)}),this.transporter.send(o,(...p)=>{p[0]&&(o.releaseStreams(),this.logger.error({err:p[0],tnx:"transport",action:"send"},"Send Error: %s",p[0].message)),i(...p)})})}),n}getVersionString(){return wR.format("%s (%s; +%s; %s/%s)",Ku,Xe,zv,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],o=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+o.length===0)return n();let s=0,a="default",c=()=>{let l=a==="default"?o:i;if(s>=l.length)if(a==="default"&&i.length)a="user",s=0,l=i;else return n();let u=l[s++];u(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=Nr(e);this.getSocket=(n,i)=>{let o=r.protocol.replace(/:$/,"").toLowerCase(),s=Number(this.options.connectionTimeout)||0,a=Number(n.connectStartedAt)||Date.now(),c=s?Math.max(a+s-Date.now(),1):void 0;if(this.meta.has("proxy_handler_"+o))return this.meta.get("proxy_handler_"+o)(r,n,i);switch(o){case"http":case"https":GA(r.href,n.port,n.host,c?Object.assign({},this.options.tls,{timeout:c}):this.options.tls||{},(u,p)=>u?i(u):i(null,{connection:p}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let p=new Error("Socks module not loaded");return p.code=li,i(p)}let u=p=>{let f=!!this.meta.get("proxy_socks_module").SocksClient,m=f?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),E=Number(r.protocol.replace(/\D/g,""))||5,v={proxy:{ipaddress:p,port:Number(r.port),type:E},[f?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(c&&(v.timeout=c),r.username||r.password){let N=r.username||"",S=r.password||"";f?(v.proxy.userId=N,v.proxy.password=S):E===4?v.userid=N:v.authentication={username:N,password:S}}m.createConnection(v,(N,S)=>N?i(N):i(null,{connection:S.socket||S}))};return NR.isIP(r.hostname)?u(r.hostname):RR.lookup(r.hostname,(p,f)=>{if(p)return i(p);u(f)})}}let l=new Error("Unknown proxy configuration");l.code=li,i(l)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let o=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(s,a,c,l)=>{let u=OR.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:u,filename:"image-"+ ++o+"."+Ju(l)}),a+"cid:"+u}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}},$A=bm;import{EventEmitter as XR}from"node:events";import{EventEmitter as MR}from"node:events";import di from"node:net";import qA from"node:tls";import KR from"node:os";import WA from"node:crypto";import{Transform as CR}from"node:stream";var DR=Buffer.from(`
+`),PR=Buffer.from(`
+.`),UR=Buffer.from("\r"),LR=Buffer.from("."),nc=class extends CR{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],o=0,s,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,s=0,a=e.length;s<a;s++){let u=e[s],p=s?e[s-1]:this.lastByte,f=!1;p===13&&u!==10?f=u===46?PR:DR:u===10&&p!==13?f=UR:u===46&&(p===10||p===!1)&&(f=LR),f&&(s>c&&(l=e.slice(c,s),i.push(l),o+=l.length),i.push(f),o+=f.length,c=s)}i.length?(c<e.length&&(l=e.slice(c),i.push(l),o+=l.length),this.outByteCount+=o,this.push(Buffer.concat(i,o))):(this.outByteCount+=e.length,this.push(e)),this.lastByte=e[e.length-1],n()}_flush(e){let r;this.lastByte===10?r=Buffer.from(`.\r
 `):this.lastByte===13?r=Buffer.from(`
 .\r
 `):r=Buffer.from(`\r
 .\r
-`),this.outByteCount+=r.length,this.push(r),e()}};SA.exports=qf});var hu=me((RZ,UA)=>{"use strict";var _R=xr(),{EventEmitter:IR}=re("events"),NA=re("net"),RA=re("tls"),xR=re("os"),OA=re("crypto"),bR=wA(),{PassThrough:kA}=re("stream"),Di=kt(),SR=120*1e3,CA=600*1e3,wR=30*1e3,NR=30*1e3,DA=()=>{};function PA(t){if(!t)return t;let e=Buffer.from(t,"binary").toString("utf8");return e.includes("\uFFFD")?t:e}var Gf=class extends IR{constructor(e){super(e),this.id=OA.randomBytes(8).toString("base64").replace(/\W/g,""),this.stage="init",this.options=e||{},this.secureConnection=!!this.options.secure,this.alreadySecured=!!this.options.secured,this.port=Number(this.options.port)||(this.secureConnection?465:587),this.host=this.options.host||"localhost",this.servername=this.options.servername?this.options.servername:NA.isIP(this.host)?!1:this.host,this.allowInternalNetworkInterfaces=this.options.allowInternalNetworkInterfaces||!1,typeof this.options.secure>"u"&&this.port===465&&(this.secureConnection=!0),this.name=(this.options.name||this._getHostname()).toString().replace(/[\r\n]+/g,""),this.logger=Di.getLogger(this.options,{component:this.options.component||"smtp-connection",sid:this.id}),this.customAuth=new Map;for(let r of Object.keys(this.options.customAuth||{})){let n=(r||"").toString().trim().toUpperCase();n&&this.customAuth.set(n,this.options.customAuth[r])}this.version=_R.version,this.authenticated=!1,this.destroyed=!1,this.secure=!!this.secureConnection,this._remainder="",this._responseQueue=[],this.lastServerResponse=!1,this._socket=!1,this._supportedAuth=[],this.allowsAuth=!1,this._envelope=!1,this._supportedExtensions=[],this._maxAllowedSize=0,this._responseActions=[],this._recipientQueue=[],this._greetingTimeout=!1,this._connectionTimeout=!1,this._destroyed=!1,this._closing=!1,this._currentDataStream=!1,this._onSocketData=r=>this._onData(r),this._onSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN"),this._onSocketClose=()=>this._onClose(),this._onSocketEnd=()=>this._onEnd(),this._onSocketTimeout=()=>this._onTimeout(),this._onConnectionSocketError=r=>this._onConnectionError(r,"ESOCKET"),this._connectionAttemptId=0}connect(e){if(typeof e=="function"){this.once("connect",()=>{this.logger.debug({tnx:"smtp"},"SMTP handshake finished"),e()});let n=this._isDestroyedMessage("connect");if(n)return e(this._formatError(n,"ECONNECTION",!1,"CONN"))}let r={port:this.port,host:this.host,allowInternalNetworkInterfaces:this.allowInternalNetworkInterfaces,timeout:this.options.dnsTimeout||NR};if(this.options.localAddress&&(r.localAddress=this.options.localAddress),this.options.connection){this._socket=this.options.connection,this._setupConnectionHandlers(),this.secureConnection&&!this.alreadySecured?setImmediate(()=>this._upgradeConnection(n=>{if(n){this._onError(new Error("Error initiating TLS - "+(n.message||n)),"ETLS",!1,"CONN");return}this._onConnect()})):setImmediate(()=>this._onConnect());return}else return this.options.socket?(this._socket=this.options.socket,this._resolveAndConnect(r,n=>{try{this._socket.connect(this.port,this.host,()=>{if(this._socket.setKeepAlive(!0),this.secureConnection&&!this.alreadySecured)return this._upgradeConnection(i=>{if(i){this._onError(new Error("Error initiating TLS - "+(i.message||i)),"ETLS",!1,"CONN");return}this._onConnect()});this._onConnect()}),this._setupConnectionHandlers()}catch(i){return setImmediate(()=>this._onError(i,"ECONNECTION",!1,"CONN"))}})):(this.secureConnection&&(Object.assign(r,this.options.tls||{}),this.servername&&!r.servername&&(r.servername=this.servername)),this._resolveAndConnect(r,n=>{this._fallbackAddresses=(n._addresses||[]).filter(i=>i!==r.host),this._connectOpts=Object.assign({},r),this._connectToHost(r,this.secureConnection)}))}_resolveAndConnect(e,r){return Di.resolveHostname(e,(n,i)=>{if(n)return setImmediate(()=>this._onError(n,"EDNS",!1,"CONN"));this.logger.debug({tnx:"dns",source:e.host,resolved:i.host,cached:!!i.cached},"Resolved %s as %s [cache %s]",e.host,i.host,i.cached?"hit":"miss");for(let s of Object.keys(i))s.charAt(0)!=="_"&&i[s]&&(e[s]=i[s]);r(i)})}_connectToHost(e,r){if(this._destroyed||this._closing)return;this._connectionAttemptId++;let n=this._connectionAttemptId,i=r?RA.connect:NA.connect;try{this._socket=i(e,()=>{this._connectionAttemptId===n&&(this._socket.setKeepAlive(!0),this._onConnect())}),this._setupConnectionHandlers()}catch(s){return setImmediate(()=>this._onError(s,"ECONNECTION",!1,"CONN"))}}_setupConnectionHandlers(){this._connectionTimeout=setTimeout(()=>{this._onConnectionError("Connection timeout","ETIMEDOUT")},this.options.connectionTimeout||SR),this._socket.on("error",this._onConnectionSocketError)}_onConnectionError(e,r){if(clearTimeout(this._connectionTimeout),!(this._fallbackAddresses&&this._fallbackAddresses.length&&this.stage==="init"&&!this._destroyed)){this._onError(e,r,!1,"CONN");return}let i=this._fallbackAddresses.shift();if(this.logger.info({tnx:"network",failedHost:this._connectOpts.host,nextHost:i,error:e.message||e},"Connection to %s failed, trying %s",this._connectOpts.host,i),this._socket){try{this._socket.removeListener("error",this._onConnectionSocketError),this._socket.on("error",DA),this._socket.destroy()}catch{}this._socket=null}this._connectOpts.host=i,this._connectToHost(this._connectOpts,this.secureConnection)}quit(){this._sendCommand("QUIT"),this._responseActions.push(this.close)}close(){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._responseActions=[],this._closing)return;this._closing=!0;let e=this.stage==="init"?"destroy":"end";this.logger.debug({tnx:"smtp"},'Closing connection to the server using "%s"',e);let r=this._socket&&this._socket.socket||this._socket;if(this._currentDataStream){try{this._currentDataStream.unpipe(this._socket)}catch{}this._currentDataStream=!1}if(r&&!r.destroyed)try{r.setTimeout(0),r.removeListener("data",this._onSocketData),r.removeListener("timeout",this._onSocketTimeout),r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError),r.removeListener("error",this._onConnectionSocketError),r.on("error",DA),r[e]()}catch{}this._destroy()}login(e,r){let n=this._isDestroyedMessage("login");if(n)return r(this._formatError(n,"ECONNECTION",!1,"API"));if(this._auth=e||{},this._authMethod=(this._auth.method||"").toString().trim().toUpperCase()||!1,!this._authMethod&&this._auth.oauth2&&!this._auth.credentials?this._authMethod="XOAUTH2":(!this._authMethod||this._authMethod==="XOAUTH2"&&!this._auth.oauth2)&&(this._authMethod=(this._supportedAuth[0]||"PLAIN").toUpperCase().trim()),this._authMethod!=="XOAUTH2"&&(!this._auth.credentials||!this._auth.credentials.user||!this._auth.credentials.pass))if(this._auth.user&&this._auth.pass||this.customAuth.has(this._authMethod))this._auth.credentials={user:this._auth.user,pass:this._auth.pass,options:this._auth.options};else return r(this._formatError('Missing credentials for "'+this._authMethod+'"',"EAUTH",!1,"API"));if(this.customAuth.has(this._authMethod)){let i=this.customAuth.get(this._authMethod),s,o=!1,a=()=>{o||(o=!0,this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0))},c=d=>{o||(o=!0,r(this._formatError(d,"EAUTH",s,"AUTH "+this._authMethod)))},l=i({auth:this._auth,method:this._authMethod,extensions:[].concat(this._supportedExtensions),authMethods:[].concat(this._supportedAuth),maxAllowedSize:this._maxAllowedSize||!1,sendCommand:(d,p)=>{let f;return p||(f=new Promise((h,g)=>{p=Di.callbackPromise(h,g)})),this._responseActions.push(h=>{s=h;let g=h.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/),_={command:d,response:h};g?(_.status=Number(g[1])||0,g[2]&&(_.code=g[2]),_.text=h.substr(g[0].length)):(_.text=h,_.status=0),p(null,_)}),setImmediate(()=>this._sendCommand(d)),f},resolve:a,reject:c});l&&typeof l.catch=="function"&&l.then(a).catch(c);return}switch(this._authMethod){case"XOAUTH2":this._handleXOauth2Token(!1,r);return;case"LOGIN":this._responseActions.push(i=>{this._actionAUTH_LOGIN_USER(i,r)}),this._sendCommand("AUTH LOGIN");return;case"PLAIN":this._responseActions.push(i=>{this._actionAUTHComplete(i,r)}),this._sendCommand("AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0"+this._auth.credentials.pass,"utf-8").toString("base64"),"AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0/* secret */","utf-8").toString("base64"));return;case"CRAM-MD5":this._responseActions.push(i=>{this._actionAUTH_CRAM_MD5(i,r)}),this._sendCommand("AUTH CRAM-MD5");return}return r(this._formatError('Unknown authentication method "'+this._authMethod+'"',"EAUTH",!1,"API"))}send(e,r,n){if(!r)return n(this._formatError("Empty message","EMESSAGE",!1,"API"));let i=this._isDestroyedMessage("send message");if(i)return n(this._formatError(i,"ECONNECTION",!1,"API"));if(this._maxAllowedSize&&e.size>this._maxAllowedSize)return setImmediate(()=>{n(this._formatError("Message size larger than allowed "+this._maxAllowedSize,"EMESSAGE",!1,"MAIL FROM"))});let s=!1,o=function(){s||(s=!0,n(...arguments))};typeof r.on=="function"&&r.on("error",c=>o(this._formatError(c,"ESTREAM",!1,"API")));let a=Date.now();this._setEnvelope(e,(c,l)=>{if(c){let f=new kA;return typeof r.pipe=="function"?r.pipe(f):(f.write(r),f.end()),o(c)}let d=Date.now(),p=this._createSendStream((f,h)=>f?o(f):(l.envelopeTime=d-a,l.messageTime=Date.now()-d,l.messageSize=p.outByteCount,l.response=h,o(null,l)));typeof r.pipe=="function"?r.pipe(p):(p.write(r),p.end())})}reset(e){let r=this._isDestroyedMessage("reset");if(r)return e(this._formatError(r,"ECONNECTION",!1,"API"));this._sendCommand("RSET"),this._responseActions.push(n=>n.charAt(0)!=="2"?e(this._formatError("Could not reset session state. response="+n,"EPROTOCOL",n,"RSET")):(this._envelope=!1,e(null,!0)))}_onConnect(){if(clearTimeout(this._connectionTimeout),this.logger.info({tnx:"network",localAddress:this._socket.localAddress,localPort:this._socket.localPort,remoteAddress:this._socket.remoteAddress,remotePort:this._socket.remotePort},"%s established to %s:%s",this.secure?"Secure connection":"Connection",this._socket.remoteAddress,this._socket.remotePort),this._destroyed){this.close();return}this.stage="connected",this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout),this._socket.removeListener("close",this._onSocketClose),this._socket.removeListener("end",this._onSocketEnd),this._socket.removeListener("error",this._onConnectionSocketError),this._socket.removeListener("error",this._onSocketError),this._socket.on("error",this._onSocketError),this._socket.on("data",this._onSocketData),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||CA),this._socket.on("timeout",this._onSocketTimeout),this._greetingTimeout=setTimeout(()=>{this._socket&&!this._destroyed&&this._responseActions[0]===this._actionGreeting&&this._onError("Greeting never received","ETIMEDOUT",!1,"CONN")},this.options.greetingTimeout||wR),this._responseActions.push(this._actionGreeting),this._socket.resume()}_onData(e){if(this._destroyed||!e||!e.length)return;let r=e.toString("binary"),n=(this._remainder+r).split(/\r?\n/),i;this._remainder=n.pop();for(let s=0,o=n.length;s<o;s++){if(this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
-`).pop()))){this._responseQueue[this._responseQueue.length-1]+=`
-`+n[s];continue}this._responseQueue.push(n[s])}this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
-`).pop()))||this._processResponse()}_onError(e,r,n,i){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._destroyed)return;e=this._formatError(e,r,n,i),["ETIMEDOUT","ESOCKET","ECONNECTION"].includes(e.code)?this.logger.warn(n,e.message):this.logger.error(n,e.message),this.emit("error",e),this.close()}_formatError(e,r,n,i){let s;/Error\]$/i.test(Object.prototype.toString.call(e))?s=e:s=new Error(e),r&&r!=="Error"&&(s.code=r),n&&(s.response=n,s.message+=": "+n);let o=typeof n=="string"&&Number((n.match(/^\d+/)||[])[0])||!1;return o&&(s.responseCode=o),i&&(s.command=i),s}_onClose(){let e=!1;if(this._remainder&&this._remainder.trim()&&(this.lastServerResponse=e=PA(this._remainder.trim()),(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e)),this.logger.info({tnx:"network"},"Connection closed"),this.upgrading&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ETLS",e,"CONN");if(![this._actionGreeting,this.close].includes(this._responseActions[0])&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");if(/^[45]\d{2}\b/.test(e))return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");this._destroy()}_onEnd(){this._socket&&!this._socket.destroyed&&this._socket.end()}_onTimeout(){return this._onError(new Error("Timeout"),"ETIMEDOUT",!1,"CONN")}_destroy(){this._destroyed||(this._destroyed=!0,this.destroyed=!0,this.emit("end"))}_upgradeConnection(e){this._remainder="",this._responseQueue=[],this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout);let r=this._socket,n=Object.assign({socket:this._socket,host:this.host},this.options.tls||{});this.servername&&!n.servername&&(n.servername=this.servername);let i=()=>{r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError),r.removeListener("error",this._onConnectionSocketError)};this.upgrading=!0;try{this._socket=RA.connect(n,()=>(this.secure=!0,this.upgrading=!1,this._socket.on("data",this._onSocketData),i(),e(null,!0)))}catch(s){return i(),e(s)}this._socket.on("error",this._onSocketError),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||CA),this._socket.on("timeout",this._onSocketTimeout),r.resume()}_processResponse(){if(!this._responseQueue.length)return!1;let e=(this._responseQueue.shift()||"").toString();if(!e.trim()){setImmediate(()=>this._processResponse());return}let r=this.lastServerResponse=PA(e);if(/^\d+-/.test(r.split(`
-`).pop())){this._responseQueue.unshift(e);return}(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},r.replace(/\r?\n$/,""));let n=this._responseActions.shift();if(typeof n=="function")n.call(this,r),setImmediate(()=>this._processResponse());else return this._onError(new Error("Unexpected Response"),"EPROTOCOL",r,"CONN")}_sendCommand(e,r){if(!this._destroyed){if(this._socket.destroyed)return this.close();(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"client"},(r||e||"").toString().replace(/\r?\n$/,"")),this._socket.write(Buffer.from(e+`\r
-`,"utf-8"))}}_setEnvelope(e,r){let n=[],i=!1;if(this._envelope=e||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(),this._envelope.to=[].concat(this._envelope.to||[]).map(s=>(s&&s.address||s||"").toString().trim()),!this._envelope.to.length)return r(this._formatError("No recipients defined","EENVELOPE",!1,"API"));if(this._envelope.from&&/[\r\n<>]/.test(this._envelope.from))return r(this._formatError("Invalid sender "+JSON.stringify(this._envelope.from),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.from)&&(i=!0);for(let s=0,o=this._envelope.to.length;s<o;s++){if(!this._envelope.to[s]||/[\r\n<>]/.test(this._envelope.to[s]))return r(this._formatError("Invalid recipient "+JSON.stringify(this._envelope.to[s]),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.to[s])&&(i=!0)}if(this._envelope.rcptQueue=[].concat(this._envelope.to||[]),this._envelope.rejected=[],this._envelope.rejectedErrors=[],this._envelope.accepted=[],this._envelope.dsn)try{this._envelope.dsn=this._setDsnEnvelope(this._envelope.dsn)}catch(s){return r(this._formatError("Invalid DSN "+s.message,"EENVELOPE",!1,"API"))}if(this._envelope.requireTLSExtensionEnabled){if(!this.secure)return r(this._formatError("REQUIRETLS can only be used over TLS connections (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));if(!this._supportedExtensions.includes("REQUIRETLS"))return r(this._formatError("Server does not support REQUIRETLS extension (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"))}if(this._responseActions.push(s=>{this._actionMAIL(s,r)}),i&&this._supportedExtensions.includes("SMTPUTF8")&&(n.push("SMTPUTF8"),this._usingSmtpUtf8=!0),this._envelope.use8BitMime&&this._supportedExtensions.includes("8BITMIME")&&(n.push("BODY=8BITMIME"),this._using8BitMime=!0),this._envelope.size&&this._supportedExtensions.includes("SIZE")){let s=Number(this._envelope.size)||0;s>0&&n.push("SIZE="+s)}this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.ret&&n.push("RET="+Di.encodeXText(this._envelope.dsn.ret)),this._envelope.dsn.envid&&n.push("ENVID="+Di.encodeXText(this._envelope.dsn.envid))),this._envelope.requireTLSExtensionEnabled&&n.push("REQUIRETLS"),this._sendCommand("MAIL FROM:<"+this._envelope.from+">"+(n.length?" "+n.join(" "):""))}_setDsnEnvelope(e){let r=(e.ret||e.return||"").toString().toUpperCase()||null;if(r)switch(r){case"HDRS":case"HEADERS":r="HDRS";break;case"FULL":case"BODY":r="FULL";break}if(r&&!["FULL","HDRS"].includes(r))throw new Error("ret: "+JSON.stringify(r));let n=(e.envid||e.id||"").toString()||null,i=e.notify||null;if(i){typeof i=="string"&&(i=i.split(",")),i=i.map(c=>c.trim().toUpperCase());let o=["NEVER","SUCCESS","FAILURE","DELAY"];if(i.filter(c=>!o.includes(c)).length||i.length>1&&i.includes("NEVER"))throw new Error("notify: "+JSON.stringify(i.join(",")));i=i.join(",")}let s=(e.recipient||e.orcpt||"").toString()||null;return s&&s.indexOf(";")<0&&(s="rfc822;"+s),{ret:r,envid:n,notify:i,orcpt:s}}_getDsnRcptToArgs(){let e=[];return this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.notify&&e.push("NOTIFY="+Di.encodeXText(this._envelope.dsn.notify)),this._envelope.dsn.orcpt&&e.push("ORCPT="+Di.encodeXText(this._envelope.dsn.orcpt))),e.length?" "+e.join(" "):""}_createSendStream(e){let r=new bR;if(this.options.lmtp?this._envelope.accepted.forEach((n,i)=>{let s=i===this._envelope.accepted.length-1;this._responseActions.push(o=>{this._actionLMTPStream(n,s,o,e)})}):this._responseActions.push(n=>{this._actionSMTPStream(n,e)}),this._currentDataStream=r,r.pipe(this._socket,{end:!1}),this.options.debug){let n=new kA;n.on("readable",()=>{let i;for(;i=n.read();)this.logger.debug({tnx:"message"},i.toString("binary").replace(/\r?\n$/,""))}),r.pipe(n)}return r.once("end",()=>{this._currentDataStream===r&&(this._currentDataStream=!1),this.logger.info({tnx:"message",inByteCount:r.inByteCount,outByteCount:r.outByteCount},"<%s bytes encoded mime message (source size %s bytes)>",r.outByteCount,r.inByteCount)}),r}_actionGreeting(e){if(clearTimeout(this._greetingTimeout),e.substr(0,3)!=="220"){this._onError(new Error("Invalid greeting. response="+e),"EPROTOCOL",e,"CONN");return}this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name))}_actionLHLO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid LHLO. response="+e),"EPROTOCOL",e,"LHLO");return}this._actionEHLO(e)}_actionEHLO(e){let r;if(e.substr(0,3)==="421"){this._onError(new Error("Server terminates connection. response="+e),"ECONNECTION",e,"EHLO");return}if(e.charAt(0)!=="2"){if(this.options.requireTLS){this._onError(new Error("EHLO failed but HELO does not support required STARTTLS. response="+e),"ECONNECTION",e,"EHLO");return}this._responseActions.push(this._actionHELO),this._sendCommand("HELO "+this.name);return}if(this._ehloLines=e.split(/\r?\n/).map(n=>n.replace(/^\d+[ -]/,"").trim()).filter(n=>n).slice(1),!this.secure&&!this.options.ignoreTLS&&(/[ -]STARTTLS\b/im.test(e)||this.options.requireTLS)){this._sendCommand("STARTTLS"),this._responseActions.push(this._actionSTARTTLS);return}/[ -]SMTPUTF8\b/im.test(e)&&this._supportedExtensions.push("SMTPUTF8"),/[ -]DSN\b/im.test(e)&&this._supportedExtensions.push("DSN"),/[ -]8BITMIME\b/im.test(e)&&this._supportedExtensions.push("8BITMIME"),/[ -]REQUIRETLS\b/im.test(e)&&this._supportedExtensions.push("REQUIRETLS"),/[ -]PIPELINING\b/im.test(e)&&this._supportedExtensions.push("PIPELINING"),/[ -]AUTH\b/i.test(e)&&(this.allowsAuth=!0),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)PLAIN/i.test(e)&&this._supportedAuth.push("PLAIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)LOGIN/i.test(e)&&this._supportedAuth.push("LOGIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)CRAM-MD5/i.test(e)&&this._supportedAuth.push("CRAM-MD5"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)XOAUTH2/i.test(e)&&this._supportedAuth.push("XOAUTH2"),(r=e.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))&&(this._supportedExtensions.push("SIZE"),this._maxAllowedSize=Number(r[1])||0),this.emit("connect")}_actionHELO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid HELO. response="+e),"EPROTOCOL",e,"HELO");return}this.allowsAuth=!0,this.emit("connect")}_actionSTARTTLS(e){if(e.charAt(0)!=="2"){if(this.options.opportunisticTLS)return this.logger.info({tnx:"smtp"},"Failed STARTTLS upgrade, continuing unencrypted"),this.emit("connect");this._onError(new Error("Error upgrading connection with STARTTLS"),"ETLS",e,"STARTTLS");return}this._upgradeConnection((r,n)=>{if(r){this._onError(new Error("Error initiating TLS - "+(r.message||r)),"ETLS",!1,"STARTTLS");return}this.logger.info({tnx:"smtp"},"Connection upgraded with STARTTLS"),n?this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name)):this.emit("connect")})}_actionAUTH_LOGIN_USER(e,r){if(!/^334[ -]/.test(e)){r(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"',"EAUTH",e,"AUTH LOGIN"));return}this._responseActions.push(n=>{this._actionAUTH_LOGIN_PASS(n,r)}),this._sendCommand(Buffer.from(this._auth.credentials.user+"","utf-8").toString("base64"))}_actionAUTH_CRAM_MD5(e,r){let n=e.match(/^334\s+(.+)$/);if(!n)return r(this._formatError("Invalid login sequence while waiting for server challenge string","EAUTH",e,"AUTH CRAM-MD5"));let i=Buffer.from(n[1],"base64").toString("ascii"),s=OA.createHmac("md5",this._auth.credentials.pass);s.update(i);let o=this._auth.credentials.user+" "+s.digest("hex");this._responseActions.push(a=>{this._actionAUTH_CRAM_MD5_PASS(a,r)}),this._sendCommand(Buffer.from(o).toString("base64"),Buffer.from(this._auth.credentials.user+" /* secret */").toString("base64"))}_actionAUTH_CRAM_MD5_PASS(e,r){if(!e.match(/^235\s+/))return r(this._formatError('Invalid login sequence while waiting for "235"',"EAUTH",e,"AUTH CRAM-MD5"));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0)}_actionAUTH_LOGIN_PASS(e,r){if(!/^334[ -]/.test(e))return r(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"',"EAUTH",e,"AUTH LOGIN"));this._responseActions.push(n=>{this._actionAUTHComplete(n,r)}),this._sendCommand(Buffer.from((this._auth.credentials.pass||"").toString(),"utf-8").toString("base64"),Buffer.from("/* secret */","utf-8").toString("base64"))}_actionAUTHComplete(e,r,n){if(!n&&typeof r=="function"&&(n=r,r=!1),e.substr(0,3)==="334"){this._responseActions.push(i=>{r||this._authMethod!=="XOAUTH2"?this._actionAUTHComplete(i,!0,n):setImmediate(()=>this._handleXOauth2Token(!0,n))}),this._sendCommand("");return}if(e.charAt(0)!=="2")return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),n(this._formatError("Invalid login","EAUTH",e,"AUTH "+this._authMethod));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,n(null,!0)}_actionMAIL(e,r){if(Number(e.charAt(0))!==2){let i=this._usingSmtpUtf8&&/^550 /.test(e)&&/[\x80-\uFFFF]/.test(this._envelope.from)?"Internationalized mailbox name not allowed":"Mail command failed";return r(this._formatError(i,"EENVELOPE",e,"MAIL FROM"))}if(!this._envelope.rcptQueue.length)return r(this._formatError("Can't send mail - no recipients defined","EENVELOPE",!1,"API"));this._recipientQueue=[];let n=this._supportedExtensions.includes("PIPELINING");do{let i=this._envelope.rcptQueue.shift();this._recipientQueue.push(i),this._responseActions.push(s=>{this._actionRCPT(s,r)}),this._sendCommand("RCPT TO:<"+i+">"+this._getDsnRcptToArgs())}while(n&&this._envelope.rcptQueue.length)}_actionRCPT(e,r){let n,i=this._recipientQueue.shift();if(Number(e.charAt(0))!==2){let s=this._usingSmtpUtf8&&/^553 /.test(e)&&/[\x80-\uFFFF]/.test(i)?"Internationalized mailbox name not allowed":"Recipient command failed";this._envelope.rejected.push(i),n=this._formatError(s,"EENVELOPE",e,"RCPT TO"),n.recipient=i,this._envelope.rejectedErrors.push(n)}else this._envelope.accepted.push(i);if(!this._envelope.rcptQueue.length&&!this._recipientQueue.length)if(this._envelope.rejected.length<this._envelope.to.length)this._responseActions.push(s=>{this._actionDATA(s,r)}),this._sendCommand("DATA");else return n=this._formatError("Can't send mail - all recipients were rejected","EENVELOPE",e,"RCPT TO"),n.rejected=this._envelope.rejected,n.rejectedErrors=this._envelope.rejectedErrors,r(n);else if(this._envelope.rcptQueue.length){let s=this._envelope.rcptQueue.shift();this._recipientQueue.push(s),this._responseActions.push(o=>{this._actionRCPT(o,r)}),this._sendCommand("RCPT TO:<"+s+">"+this._getDsnRcptToArgs())}}_actionDATA(e,r){if(!/^[23]/.test(e))return r(this._formatError("Data command failed","EENVELOPE",e,"DATA"));let n={accepted:this._envelope.accepted,rejected:this._envelope.rejected};this._ehloLines&&this._ehloLines.length&&(n.ehlo=this._ehloLines),this._envelope.rejectedErrors.length&&(n.rejectedErrors=this._envelope.rejectedErrors),r(null,n)}_actionSMTPStream(e,r){return Number(e.charAt(0))!==2?r(this._formatError("Message failed","EMESSAGE",e,"DATA")):r(null,e)}_actionLMTPStream(e,r,n,i){let s;if(Number(n.charAt(0))!==2){s=this._formatError("Message failed for recipient "+e,"EMESSAGE",n,"DATA"),s.recipient=e,this._envelope.rejected.push(e),this._envelope.rejectedErrors.push(s);for(let o=0,a=this._envelope.accepted.length;o<a;o++)this._envelope.accepted[o]===e&&this._envelope.accepted.splice(o,1)}if(r)return i(null,n)}_handleXOauth2Token(e,r){this._auth.oauth2.getToken(e,(n,i)=>{if(n)return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),r(this._formatError(n,"EAUTH",!1,"AUTH XOAUTH2"));this._responseActions.push(s=>{this._actionAUTHComplete(s,e,r)}),this._sendCommand("AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token(i),"AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token("/* secret */"))})}_isDestroyedMessage(e){if(this._destroyed)return"Cannot "+e+" - smtp connection is already destroyed.";if(this._socket){if(this._socket.destroyed)return"Cannot "+e+" - smtp connection socket is already destroyed.";if(!this._socket.writable)return"Cannot "+e+" - smtp connection socket is already half-closed."}}_getHostname(){let e;try{e=xR.hostname()||""}catch{e="localhost"}return(!e||e.indexOf(".")<0)&&(e="[127.0.0.1]"),e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)&&(e="["+e+"]"),e}};UA.exports=Gf});var Wf=me((OZ,LA)=>{"use strict";var{Stream:RR}=re("stream"),OR=ba(),kR=re("crypto"),CR=kt(),Pi=Xt(),$f=class extends RR{constructor(e,r){if(super(),this.options=e||{},e&&e.serviceClient){if(!e.privateKey||!e.user){let i=new Error('Options "privateKey" and "user" are required for service account!');i.code=Pi.EOAUTH2,setImmediate(()=>this.emit("error",i));return}let n=Math.min(Math.max(Number(this.options.serviceRequestTimeout)||0,0),3600);this.options.serviceRequestTimeout=n||300}if(this.logger=CR.getLogger({logger:r},{component:this.options.component||"OAuth2"}),this.provisionCallback=typeof this.options.provisionCallback=="function"?this.options.provisionCallback:!1,this.options.accessUrl=this.options.accessUrl||"https://accounts.google.com/o/oauth2/token",this.options.customHeaders=this.options.customHeaders||{},this.options.customParams=this.options.customParams||{},this.accessToken=this.options.accessToken||!1,this.options.expires&&Number(this.options.expires))this.expires=this.options.expires;else{let n=Math.max(Number(this.options.timeout)||0,0);this.expires=n&&Date.now()+n*1e3||0}this.renewing=!1,this.renewalQueue=[]}getToken(e,r){if(!e&&this.accessToken&&(!this.expires||this.expires>Date.now()))return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token for %s",this.options.user),r(null,this.accessToken);if(!this.provisionCallback&&!this.options.refreshToken&&!this.options.serviceClient){if(this.accessToken)return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token (no refresh capability) for %s",this.options.user),r(null,this.accessToken);this.logger.error({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Cannot renew access token for %s: No refresh mechanism available",this.options.user);let i=new Error("Can't create new access token for user");return i.code=Pi.EOAUTH2,r(i)}if(this.renewing)return this.renewalQueue.push({renew:e,callback:r});this.renewing=!0;let n=(i,s)=>{this.renewalQueue.forEach(o=>o.callback(i,s)),this.renewalQueue=[],this.renewing=!1,i?this.logger.error({err:i,tnx:"OAUTH2",user:this.options.user,action:"renew"},"Failed generating new Access Token for %s",this.options.user):this.logger.info({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Generated new Access Token for %s",this.options.user),r(i,s)};this.provisionCallback?this.provisionCallback(this.options.user,!!e,(i,s,o)=>{!i&&s&&(this.accessToken=s,this.expires=o||0),n(i,s)}):this.generateToken(n)}updateToken(e,r){this.accessToken=e,r=Math.max(Number(r)||0,0),this.expires=r&&Date.now()+r*1e3||0,this.emit("token",{user:this.options.user,accessToken:e||"",expires:this.expires})}generateToken(e){let r,n;if(this.options.serviceClient){let i=Math.floor(Date.now()/1e3),s={iss:this.options.serviceClient,scope:this.options.scope||"https://mail.google.com/",sub:this.options.user,aud:this.options.accessUrl,iat:i,exp:i+this.options.serviceRequestTimeout},o;try{o=this.jwtSignRS256(s)}catch{let c=new Error("Can't generate token. Check your auth options");return c.code=Pi.EOAUTH2,e(c)}r={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:o},n={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:s}}else{if(!this.options.refreshToken){let i=new Error("Can't create new access token for user");return i.code=Pi.EOAUTH2,e(i)}r={client_id:this.options.clientId||"",client_secret:this.options.clientSecret||"",refresh_token:this.options.refreshToken,grant_type:"refresh_token"},n={client_id:this.options.clientId||"",client_secret:(this.options.clientSecret||"").substr(0,6)+"...",refresh_token:(this.options.refreshToken||"").substr(0,6)+"...",grant_type:"refresh_token"}}Object.assign(r,this.options.customParams),Object.assign(n,this.options.customParams),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"generate"},"Requesting token using: %s",JSON.stringify(n)),this.postRequest(this.options.accessUrl,r,this.options,(i,s)=>{let o;if(i)return e(i);try{o=JSON.parse(s.toString())}catch(l){return e(l)}if(!o||typeof o!="object"){this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",(s||"").toString());let l=new Error("Invalid authentication response");return l.code=Pi.EOAUTH2,e(l)}let a=Object.assign({},o);if(a.access_token&&(a.access_token=(a.access_token||"").toString().substr(0,6)+"..."),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",JSON.stringify(a)),o.error){let l=o.error;o.error_description&&(l+=": "+o.error_description),o.error_uri&&(l+=" ("+o.error_uri+")");let d=new Error(l);return d.code=Pi.EOAUTH2,e(d)}if(o.access_token)return this.updateToken(o.access_token,o.expires_in),e(null,this.accessToken);let c=new Error("No access token");return c.code=Pi.EOAUTH2,e(c)})}buildXOAuth2Token(e){let r=["user="+(this.options.user||""),"auth=Bearer "+(e||this.accessToken),"",""];return Buffer.from(r.join("
"),"utf-8").toString("base64")}postRequest(e,r,n,i){let s=!1,o=[],a=0,c={method:"post",headers:n.customHeaders,body:r,allowErrorResponse:!0};/^https:/i.test(e)&&(c.tls=Object.assign({rejectUnauthorized:!0},n.tls||{}));let l=OR(e,c);l.on("readable",()=>{let d;for(;(d=l.read())!==null;)o.push(d),a+=d.length}),l.once("error",d=>{if(!s)return s=!0,i(d)}),l.once("end",()=>{if(!s)return s=!0,i(null,Buffer.concat(o,a))})}toBase64URL(e){return typeof e=="string"&&(e=Buffer.from(e)),e.toString("base64").replace(/[=]+/g,"").replace(/\+/g,"-").replace(/\//g,"_")}jwtSignRS256(e){e=['{"alg":"RS256","typ":"JWT"}',JSON.stringify(e)].map(n=>this.toBase64URL(n)).join(".");let r=kR.createSign("RSA-SHA256").update(e).sign(this.options.privateKey);return e+"."+this.toBase64URL(r)}};LA.exports=$f});var HA=me((kZ,KA)=>{"use strict";var DR=hu(),PR=kt().assign,UR=Wf(),MA=Xt(),LR=re("events"),zf=class extends LR{constructor(e){if(super(),this.pool=e,this.options=e.options,this.logger=this.pool.logger,this.options.auth)switch((this.options.auth.type||"").toString().toUpperCase()){case"OAUTH2":{let r=new UR(this.options.auth,this.logger);r.provisionCallback=this.pool.mailer&&this.pool.mailer.get("oauth2_provision_cb")||r.provisionCallback,this.auth={type:"OAUTH2",user:this.options.auth.user,oauth2:r,method:"XOAUTH2"},r.on("token",n=>this.pool.mailer.emit("token",n)),r.on("error",n=>this.emit("error",n));break}default:if(!this.options.auth.user&&!this.options.auth.pass)break;this.auth={type:(this.options.auth.type||"").toString().toUpperCase()||"LOGIN",user:this.options.auth.user,credentials:{user:this.options.auth.user||"",pass:this.options.auth.pass,options:this.options.auth.options},method:(this.options.auth.method||"").trim().toUpperCase()||this.options.authMethod||!1}}this._connection=!1,this._connected=!1,this.messages=0,this.available=!0}connect(e){this.pool.getSocket(this.options,(r,n)=>{if(r)return e(r);let i=!1,s=this.options;n&&n.connection&&(this.logger.info({tnx:"proxy",remoteAddress:n.connection.remoteAddress,remotePort:n.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",n.connection.remoteAddress,n.connection.remotePort,s.host||"",s.port||""),s=Object.assign(PR(!1,s),n)),this.connection=new DR(s),this.connection.once("error",o=>{if(this.emit("error",o),!i)return i=!0,e(o)}),this.connection.once("end",()=>{if(this.close(),i)return;i=!0;let o=setTimeout(()=>{if(i)return;let a=new Error("Unexpected socket close");this.connection&&this.connection._socket&&this.connection._socket.upgrading&&(a.code=MA.ETLS),e(a)},1e3);try{o.unref()}catch{}}),this.connection.connect(()=>{if(!i)if(this.auth&&(this.connection.allowsAuth||s.forceAuth))this.connection.login(this.auth,o=>{if(!i){if(i=!0,o)return this.connection.close(),this.emit("error",o),e(o);this._connected=!0,e(null,!0)}});else return i=!0,this._connected=!0,e(null,!0)})})}send(e,r){if(!this._connected)return this.connect(o=>o?r(o):this.send(e,r));let n=e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i,cid:this.id},"Sending message %s using #%s to <%s>",i,this.id,s.join(", ")),e.data.dsn&&(n.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(n.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.connection.send(n,e.message.createReadStream(),(o,a)=>{if(this.messages++,o)return this.connection.close(),this.emit("error",o),r(o);a.envelope={from:n.from,to:n.to},a.messageId=i,setImmediate(()=>{if(this.messages>=this.options.maxMessages){let c=new Error("Resource exhausted");c.code=MA.EMAXLIMIT,this.connection.close(),this.emit("error",c)}else this.pool._checkRateLimit(()=>{this.available=!0,this.emit("available")})}),r(null,a)})}close(){this._connected=!1,this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.connection&&this.connection.close(),this.emit("close")}};KA.exports=zf});var FA=me((CZ,MR)=>{MR.exports={"1und1":{description:"1&1 Mail (German hosting provider)",host:"smtp.1und1.de",port:465,secure:!0,authMethod:"LOGIN"},"126":{description:"126 Mail (NetEase)",host:"smtp.126.com",port:465,secure:!0},"163":{description:"163 Mail (NetEase)",host:"smtp.163.com",port:465,secure:!0},Aliyun:{description:"Alibaba Cloud Mail",domains:["aliyun.com"],host:"smtp.aliyun.com",port:465,secure:!0},AliyunQiye:{description:"Alibaba Cloud Enterprise Mail",host:"smtp.qiye.aliyun.com",port:465,secure:!0},AOL:{description:"AOL Mail",domains:["aol.com"],host:"smtp.aol.com",port:587},Aruba:{description:"Aruba PEC (Italian email provider)",domains:["aruba.it","pec.aruba.it"],aliases:["Aruba PEC"],host:"smtps.aruba.it",port:465,secure:!0,authMethod:"LOGIN"},Bluewin:{description:"Bluewin (Swiss email provider)",host:"smtpauths.bluewin.ch",domains:["bluewin.ch"],port:465},BOL:{description:"BOL Mail (Brazilian provider)",domains:["bol.com.br"],host:"smtp.bol.com.br",port:587,requireTLS:!0},DebugMail:{description:"DebugMail (email testing service)",host:"debugmail.io",port:25},Disroot:{description:"Disroot (privacy-focused provider)",domains:["disroot.org"],host:"disroot.org",port:587,secure:!1,authMethod:"LOGIN"},DynectEmail:{description:"Dyn Email Delivery",aliases:["Dynect"],host:"smtp.dynect.net",port:25},ElasticEmail:{description:"Elastic Email",aliases:["Elastic Email"],host:"smtp.elasticemail.com",port:465,secure:!0},Ethereal:{description:"Ethereal Email (email testing service)",aliases:["ethereal.email"],host:"smtp.ethereal.email",port:587},FastMail:{description:"FastMail",domains:["fastmail.fm"],host:"smtp.fastmail.com",port:465,secure:!0},"Feishu Mail":{description:"Feishu Mail (Lark)",aliases:["Feishu","FeishuMail"],domains:["www.feishu.cn"],host:"smtp.feishu.cn",port:465,secure:!0},"Forward Email":{description:"Forward Email (email forwarding service)",aliases:["FE","ForwardEmail"],domains:["forwardemail.net"],host:"smtp.forwardemail.net",port:465,secure:!0},GandiMail:{description:"Gandi Mail",aliases:["Gandi","Gandi Mail"],host:"mail.gandi.net",port:587},Gmail:{description:"Gmail",aliases:["Google Mail"],domains:["gmail.com","googlemail.com"],host:"smtp.gmail.com",port:465,secure:!0},GmailWorkspace:{description:"Gmail Workspace",aliases:["Google Workspace Mail"],host:"smtp-relay.gmail.com",port:465,secure:!0},GMX:{description:"GMX Mail",domains:["gmx.com","gmx.net","gmx.de"],host:"mail.gmx.com",port:587},Godaddy:{description:"GoDaddy Email (US)",host:"smtpout.secureserver.net",port:25},GodaddyAsia:{description:"GoDaddy Email (Asia)",host:"smtp.asia.secureserver.net",port:25},GodaddyEurope:{description:"GoDaddy Email (Europe)",host:"smtp.europe.secureserver.net",port:25},"hot.ee":{description:"Hot.ee (Estonian email provider)",host:"mail.hot.ee"},Hotmail:{description:"Outlook.com / Hotmail",aliases:["Outlook","Outlook.com","Hotmail.com"],domains:["hotmail.com","outlook.com"],host:"smtp-mail.outlook.com",port:587},iCloud:{description:"iCloud Mail",aliases:["Me","Mac"],domains:["me.com","mac.com"],host:"smtp.mail.me.com",port:587},Infomaniak:{description:"Infomaniak Mail (Swiss hosting provider)",host:"mail.infomaniak.com",domains:["ik.me","ikmail.com","etik.com"],port:587},KolabNow:{description:"KolabNow (secure email service)",domains:["kolabnow.com"],aliases:["Kolab"],host:"smtp.kolabnow.com",port:465,secure:!0,authMethod:"LOGIN"},Loopia:{description:"Loopia (Swedish hosting provider)",host:"mailcluster.loopia.se",port:465},Loops:{description:"Loops",host:"smtp.loops.so",port:587},"mail.ee":{description:"Mail.ee (Estonian email provider)",host:"smtp.mail.ee"},"Mail.ru":{description:"Mail.ru",host:"smtp.mail.ru",port:465,secure:!0},"Mailcatch.app":{description:"Mailcatch (email testing service)",host:"sandbox-smtp.mailcatch.app",port:2525},Maildev:{description:"MailDev (local email testing)",port:1025,ignoreTLS:!0},MailerSend:{description:"MailerSend",host:"smtp.mailersend.net",port:587},Mailgun:{description:"Mailgun",host:"smtp.mailgun.org",port:465,secure:!0},Mailjet:{description:"Mailjet",host:"in.mailjet.com",port:587},Mailosaur:{description:"Mailosaur (email testing service)",host:"mailosaur.io",port:25},Mailtrap:{description:"Mailtrap",host:"live.smtp.mailtrap.io",port:587},Mandrill:{description:"Mandrill (by Mailchimp)",host:"smtp.mandrillapp.com",port:587},Naver:{description:"Naver Mail (Korean email provider)",host:"smtp.naver.com",port:587},OhMySMTP:{description:"OhMySMTP (email delivery service)",host:"smtp.ohmysmtp.com",port:587,secure:!1},One:{description:"One.com Email",host:"send.one.com",port:465,secure:!0},OpenMailBox:{description:"OpenMailBox",aliases:["OMB","openmailbox.org"],host:"smtp.openmailbox.org",port:465,secure:!0},Outlook365:{description:"Microsoft 365 / Office 365",host:"smtp.office365.com",port:587,secure:!1},Postmark:{description:"Postmark",aliases:["PostmarkApp"],host:"smtp.postmarkapp.com",port:2525},Proton:{description:"Proton Mail",aliases:["ProtonMail","Proton.me","Protonmail.com","Protonmail.ch"],domains:["proton.me","protonmail.com","pm.me","protonmail.ch"],host:"smtp.protonmail.ch",port:587,requireTLS:!0},"qiye.aliyun":{description:"Alibaba Mail Enterprise Edition",host:"smtp.mxhichina.com",port:"465",secure:!0},QQ:{description:"QQ Mail",domains:["qq.com"],host:"smtp.qq.com",port:465,secure:!0},QQex:{description:"QQ Enterprise Mail",aliases:["QQ Enterprise"],domains:["exmail.qq.com"],host:"smtp.exmail.qq.com",port:465,secure:!0},Resend:{description:"Resend",host:"smtp.resend.com",port:465,secure:!0},Runbox:{description:"Runbox (Norwegian email provider)",domains:["runbox.com"],host:"smtp.runbox.com",port:465,secure:!0},SendCloud:{description:"SendCloud (Chinese email delivery)",host:"smtp.sendcloud.net",port:2525},SendGrid:{description:"SendGrid",host:"smtp.sendgrid.net",port:587},SendinBlue:{description:"Brevo (formerly Sendinblue)",aliases:["Brevo"],host:"smtp-relay.brevo.com",port:587},SendPulse:{description:"SendPulse",host:"smtp-pulse.com",port:465,secure:!0},SES:{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-1":{description:"AWS SES Asia Pacific (Tokyo)",host:"email-smtp.ap-northeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-2":{description:"AWS SES Asia Pacific (Seoul)",host:"email-smtp.ap-northeast-2.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-3":{description:"AWS SES Asia Pacific (Osaka)",host:"email-smtp.ap-northeast-3.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTH-1":{description:"AWS SES Asia Pacific (Mumbai)",host:"email-smtp.ap-south-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-1":{description:"AWS SES Asia Pacific (Singapore)",host:"email-smtp.ap-southeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-2":{description:"AWS SES Asia Pacific (Sydney)",host:"email-smtp.ap-southeast-2.amazonaws.com",port:465,secure:!0},"SES-CA-CENTRAL-1":{description:"AWS SES Canada (Central)",host:"email-smtp.ca-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-CENTRAL-1":{description:"AWS SES Europe (Frankfurt)",host:"email-smtp.eu-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-NORTH-1":{description:"AWS SES Europe (Stockholm)",host:"email-smtp.eu-north-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-1":{description:"AWS SES Europe (Ireland)",host:"email-smtp.eu-west-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-2":{description:"AWS SES Europe (London)",host:"email-smtp.eu-west-2.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-3":{description:"AWS SES Europe (Paris)",host:"email-smtp.eu-west-3.amazonaws.com",port:465,secure:!0},"SES-SA-EAST-1":{description:"AWS SES South America (S\xE3o Paulo)",host:"email-smtp.sa-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-1":{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-2":{description:"AWS SES US East (Ohio)",host:"email-smtp.us-east-2.amazonaws.com",port:465,secure:!0},"SES-US-GOV-EAST-1":{description:"AWS SES GovCloud (US-East)",host:"email-smtp.us-gov-east-1.amazonaws.com",port:465,secure:!0},"SES-US-GOV-WEST-1":{description:"AWS SES GovCloud (US-West)",host:"email-smtp.us-gov-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-1":{description:"AWS SES US West (N. California)",host:"email-smtp.us-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-2":{description:"AWS SES US West (Oregon)",host:"email-smtp.us-west-2.amazonaws.com",port:465,secure:!0},Seznam:{description:"Seznam Email (Czech email provider)",aliases:["Seznam Email"],domains:["seznam.cz","email.cz","post.cz","spoluzaci.cz"],host:"smtp.seznam.cz",port:465,secure:!0},SMTP2GO:{description:"SMTP2GO",host:"mail.smtp2go.com",port:2525},Sparkpost:{description:"SparkPost",aliases:["SparkPost","SparkPost Mail"],domains:["sparkpost.com"],host:"smtp.sparkpostmail.com",port:587,secure:!1},Tipimail:{description:"Tipimail (email delivery service)",host:"smtp.tipimail.com",port:587},TurboSMTP:{description:"TurboSMTP",host:"pro.turbo-smtp.com",port:465,secure:!0},"TurboSMTP-EU":{description:"TurboSMTP (EU region)",host:"pro.eu.turbo-smtp.com",port:465,secure:!0},Tutanota:{description:"Tutanota (Tuta Mail)",domains:["tutanota.com","tuta.com","tutanota.de","tuta.io"],host:"smtp.tutanota.com",port:465,secure:!0},Yahoo:{description:"Yahoo Mail",domains:["yahoo.com"],host:"smtp.mail.yahoo.com",port:465,secure:!0},Yandex:{description:"Yandex Mail",domains:["yandex.ru"],host:"smtp.yandex.ru",port:465,secure:!0},Zimbra:{description:"Zimbra Mail Server",aliases:["Zimbra Collaboration"],host:"smtp.zimbra.com",port:587,requireTLS:!0},Zoho:{description:"Zoho Mail",host:"smtp.zoho.com",port:465,secure:!0,authMethod:"LOGIN"}}});var Jf=me((DZ,BA)=>{"use strict";var VA=FA(),Eu={};Object.keys(VA).forEach(t=>{let e=VA[t],r=KR(e);Eu[yu(t)]=r,[].concat(e.aliases||[]).forEach(n=>{Eu[yu(n)]=r}),[].concat(e.domains||[]).forEach(n=>{Eu[yu(n)]=r})});function yu(t){return t.replace(/[^a-zA-Z0-9.-]/g,"").toLowerCase()}function KR(t){let e={};return Object.keys(t).forEach(r=>{["domains","aliases"].includes(r)||(e[r]=t[r])}),e}BA.exports=function(t){return t=yu(t.split("@").pop()),Eu[t]||!1}});var WA=me((PZ,$A)=>{"use strict";var HR=re("events"),jA=HA(),FR=hu(),VR=Jf(),Ca=kt(),qA=Xt(),GA=xr(),Yf=class extends HR{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=Ca.parseConnectionUrl(e.url),n=n||r.service),this.options=Ca.assign(!1,e,r,n&&VR(n)),this.options.maxConnections=this.options.maxConnections||5,this.options.maxMessages=this.options.maxMessages||100,this.logger=Ca.getLogger(this.options,{component:this.options.component||"smtp-pool"}),this.name="SMTP (pool)",this.version=GA.version+"[client:"+GA.version+"]",this._rateLimit={counter:0,timeout:null,waiting:[],checkpoint:!1,delta:Number(this.options.rateDelta)||1e3,limit:Number(this.options.rateLimit)||0},this._closed=!1,this._queue=[],this._connections=[],this._connectionCounter=0,this.idling=!0,setImmediate(()=>{this.idling&&this.emit("idle")})}getSocket(e,r){return setImmediate(()=>r(null,!1))}send(e,r){return this._closed?!1:(this._queue.push({mail:e,requeueAttempts:0,callback:r}),this.idling&&this._queue.length>=this.options.maxConnections&&(this.idling=!1),setImmediate(()=>this._processMessages()),!0)}close(){let e,r=this._connections.length;if(this._closed=!0,clearTimeout(this._rateLimit.timeout),!r&&!this._queue.length)return;for(let i=r-1;i>=0;i--)this._connections[i]&&this._connections[i].available&&(e=this._connections[i],e.close(),this.logger.info({tnx:"connection",cid:e.id,action:"removed"},"Connection #%s removed",e.id));if(r&&!this._connections.length&&this.logger.debug({tnx:"connection"},"All connections removed"),!this._queue.length)return;let n=()=>{if(!this._queue.length){this.logger.debug({tnx:"connection"},"Pending queue entries cleared");return}let i=this._queue.shift();if(i&&typeof i.callback=="function")try{i.callback(new Error("Connection pool was closed"))}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}setImmediate(n)};setImmediate(n)}_processMessages(){if(this._closed)return;if(!this._queue.length){this.idling||(this.idling=!0,this.emit("idle"));return}let e=this._connections.find(n=>n.available);if(!e&&this._connections.length<this.options.maxConnections&&(e=this._createConnection()),!e){this.idling=!1;return}!this.idling&&this._queue.length<this.options.maxConnections&&(this.idling=!0,this.emit("idle"));let r=e.queueEntry=this._queue.shift();r.messageId=(e.queueEntry.mail.message.getHeader("message-id")||"").replace(/[<>\s]/g,""),e.available=!1,this.logger.debug({tnx:"pool",cid:e.id,messageId:r.messageId,action:"assign"},"Assigned message <%s> to #%s (%s)",r.messageId,e.id,e.messages+1),this._rateLimit.limit&&(this._rateLimit.counter++,this._rateLimit.checkpoint||(this._rateLimit.checkpoint=Date.now())),e.send(r.mail,(n,i)=>{if(r===e.queueEntry){try{r.callback(n,i)}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}e.queueEntry=!1}})}_createConnection(){let e=new jA(this);return e.id=++this._connectionCounter,this.logger.info({tnx:"pool",cid:e.id,action:"conection"},"Created new pool resource #%s",e.id),e.on("available",()=>{this.logger.debug({tnx:"connection",cid:e.id,action:"available"},"Connection #%s became available",e.id),this._closed?this.close():this._processMessages()}),e.once("error",r=>{if(r.code!==qA.EMAXLIMIT?this.logger.warn({err:r,tnx:"pool",cid:e.id},"Pool Error for #%s: %s",e.id,r.message):this.logger.debug({tnx:"pool",cid:e.id,action:"maxlimit"},"Max messages limit exchausted for #%s",e.id),e.queueEntry){try{e.queueEntry.callback(r)}catch(n){this.logger.error({err:n,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,n.message)}e.queueEntry=!1}this._removeConnection(e),this._continueProcessing()}),e.once("close",()=>{this.logger.info({tnx:"connection",cid:e.id,action:"closed"},"Connection #%s was closed",e.id),this._removeConnection(e),e.queueEntry?setTimeout(()=>{e.queueEntry&&(this._shouldRequeuOnConnectionClose(e.queueEntry)?this._requeueEntryOnConnectionClose(e):this._failDeliveryOnConnectionClose(e)),this._continueProcessing()},50):(!this._closed&&this.idling&&!this._connections.length&&this.emit("clear"),this._continueProcessing())}),this._connections.push(e),e}_shouldRequeuOnConnectionClose(e){return this.options.maxRequeues===void 0||this.options.maxRequeues<0?!0:e.requeueAttempts<this.options.maxRequeues}_failDeliveryOnConnectionClose(e){if(e.queueEntry&&e.queueEntry.callback){try{e.queueEntry.callback(new Error("Reached maximum number of retries after connection was closed"))}catch(r){this.logger.error({err:r,tnx:"callback",messageId:e.queueEntry.messageId,cid:e.id},"Callback error for #%s: %s",e.id,r.message)}e.queueEntry=!1}}_requeueEntryOnConnectionClose(e){e.queueEntry.requeueAttempts+=1,this.logger.debug({tnx:"pool",cid:e.id,messageId:e.queueEntry.messageId,action:"requeue"},"Re-queued message <%s> for #%s. Attempt: #%s",e.queueEntry.messageId,e.id,e.queueEntry.requeueAttempts),this._queue.unshift(e.queueEntry),e.queueEntry=!1}_continueProcessing(){this._closed?this.close():setTimeout(()=>this._processMessages(),100)}_removeConnection(e){let r=this._connections.indexOf(e);r!==-1&&this._connections.splice(r,1)}_checkRateLimit(e){if(!this._rateLimit.limit)return e();let r=Date.now();if(this._rateLimit.counter<this._rateLimit.limit)return e();if(this._rateLimit.waiting.push(e),this._rateLimit.checkpoint<=r-this._rateLimit.delta)return this._clearRateLimit();this._rateLimit.timeout||(this._rateLimit.timeout=setTimeout(()=>this._clearRateLimit(),this._rateLimit.delta-(r-this._rateLimit.checkpoint)),this._rateLimit.checkpoint=r)}_clearRateLimit(){for(clearTimeout(this._rateLimit.timeout),this._rateLimit.timeout=null,this._rateLimit.counter=0,this._rateLimit.checkpoint=!1;this._rateLimit.waiting.length;){let e=this._rateLimit.waiting.shift();setImmediate(e)}}isIdle(){return this.idling}verify(e){let r;e||(r=new Promise((i,s)=>{e=Ca.callbackPromise(i,s)}));let n=new jA(this).auth;return this.getSocket(this.options,(i,s)=>{if(i)return e(i);let o=this.options;s&&s.connection&&(this.logger.info({tnx:"proxy",remoteAddress:s.connection.remoteAddress,remotePort:s.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",s.connection.remoteAddress,s.connection.remotePort,o.host||"",o.port||""),o=Object.assign(Ca.assign(!1,o),s));let a=new FR(o),c=!1;a.once("error",d=>{if(!c)return c=!0,a.close(),e(d)}),a.once("end",()=>{if(!c)return c=!0,e(new Error("Connection closed"))});let l=()=>{if(!c)return c=!0,a.quit(),e(null,!0)};a.connect(()=>{if(!c)if(n&&(a.allowsAuth||o.forceAuth))a.login(n,d=>{if(!c){if(d)return c=!0,a.close(),e(d);l()}});else if(!n&&a.allowsAuth&&o.forceAuth){let d=new Error("Authentication info was not provided");return d.code=qA.ENOAUTH,c=!0,a.close(),e(d)}else l()})}),r}};$A.exports=Yf});var QA=me((UZ,XA)=>{"use strict";var BR=re("events"),zA=hu(),jR=Jf(),eo=kt(),qR=Wf(),JA=Xt(),YA=xr(),Xf=class extends BR{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=eo.parseConnectionUrl(e.url),n=n||r.service),this.options=eo.assign(!1,e,r,n&&jR(n)),this.logger=eo.getLogger(this.options,{component:this.options.component||"smtp-transport"}),this.name="SMTP",this.version=YA.version+"[client:"+YA.version+"]",this.options.auth&&(this.auth=this.getAuth({}))}getSocket(e,r){return setImmediate(()=>r(null,!1))}getAuth(e){if(!e)return this.auth&&this.auth.oauth2&&this.mailer&&(this.auth.oauth2.provisionCallback=this.mailer.get("oauth2_provision_cb")||this.auth.oauth2.provisionCallback),this.auth;let r=Object.assign({},this.options.auth&&typeof this.options.auth=="object"?this.options.auth:{},typeof e=="object"?e:{});if(Object.keys(r).length===0)return!1;switch((r.type||"").toString().toUpperCase()){case"OAUTH2":{if(!r.service&&!r.user)return!1;let n=new qR(r,this.logger);return n.provisionCallback=this.mailer&&this.mailer.get("oauth2_provision_cb")||n.provisionCallback,n.on("token",i=>this.mailer.emit("token",i)),n.on("error",i=>this.emit("error",i)),{type:"OAUTH2",user:r.user,oauth2:n,method:"XOAUTH2"}}default:return{type:(r.type||"").toString().toUpperCase()||"LOGIN",user:r.user,credentials:{user:r.user||"",pass:r.pass,options:r.options},method:(r.method||"").trim().toUpperCase()||this.options.authMethod||!1}}}send(e,r){this.getSocket(this.options,(n,i)=>{if(n)return r(n);let s=!1,o=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,o.host||"",o.port||""),o=Object.assign(eo.assign(!1,o),i));let a=new zA(o),c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};a.once("error",p=>{if(!s)return s=!0,l(),a.close(),r(p)}),a.once("end",()=>{if(s)return;let p=setTimeout(()=>{if(s)return;s=!0,l();let f=new Error("Unexpected socket close");a&&a._socket&&a._socket.upgrading&&(f.code=JA.ETLS),r(f)},1e3);try{p.unref()}catch{}});let d=()=>{let p=e.message.getEnvelope(),f=e.message.messageId(),h=[].concat(p.to||[]);h.length>3&&h.push("...and "+h.splice(2).length+" more"),e.data.dsn&&(p.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(p.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.logger.info({tnx:"send",messageId:f},"Sending message %s to <%s>",f,h.join(", ")),a.send(p,e.message.createReadStream(),(g,_)=>{if(s=!0,l(),a.close(),g)return this.logger.error({err:g,tnx:"send"},"Send error for %s: %s",f,g.message),r(g);_.envelope={from:p.from,to:p.to},_.messageId=f;try{return r(null,_)}catch(R){this.logger.error({err:R,tnx:"callback"},"Callback error for %s: %s",f,R.message)}})};a.connect(()=>{s||(c=this.getAuth(e.data.auth),c&&(a.allowsAuth||o.forceAuth)?a.login(c,p=>{if(l(),!s){if(p)return s=!0,a.close(),r(p);d()}}):d())})})}verify(e){let r;return e||(r=new Promise((n,i)=>{e=eo.callbackPromise(n,i)})),this.getSocket(this.options,(n,i)=>{if(n)return e(n);let s=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,s.host||"",s.port||""),s=Object.assign(eo.assign(!1,s),i));let o=new zA(s),a=!1,c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};o.once("error",p=>{if(!a)return a=!0,l(),o.close(),e(p)}),o.once("end",()=>{if(!a)return a=!0,l(),e(new Error("Connection closed"))});let d=()=>{if(!a)return a=!0,l(),o.quit(),e(null,!0)};o.connect(()=>{if(!a)if(c=this.getAuth({}),c&&(o.allowsAuth||s.forceAuth))o.login(c,p=>{if(l(),!a){if(p)return a=!0,o.close(),e(p);d()}});else if(!c&&o.allowsAuth&&s.forceAuth){let p=new Error("Authentication info was not provided");return p.code=JA.ENOAUTH,a=!0,l(),o.close(),e(p)}else d()})}),r}close(){this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.emit("close")}};XA.exports=Xf});var eT=me((LZ,ZA)=>{"use strict";var{spawn:GR}=re("child_process"),$R=xr(),WR=kt(),Qf=Xt(),zR=Ra(),JR=fu(),Zf=class{constructor(e){e=e||{},this._spawn=GR,this.options=e,this.name="Sendmail",this.version=$R.version,this.path="sendmail",this.args=!1,this.logger=WR.getLogger(this.options,{component:this.options.component||"sendmail"}),typeof e=="string"?this.path=e:typeof e=="object"&&(e.path&&(this.path=e.path),Array.isArray(e.args)&&(this.args=e.args)),this.winbreak=["win","windows","dos",`\r
-`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),s;if([].concat(n.from||[]).concat(n.to||[]).some(d=>/^"?-/.test(d))){let d=new Error("Can not send mail. Invalid envelope addresses.");return d.code=Qf.ESENDMAIL,r(d)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=d=>{if(!s&&(s=!0,typeof r=="function"))return d?r(d):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(d){return this.logger.error({err:d,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",d.message),c(d)}if(l){l.on("error",h=>{this.logger.error({err:h,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,h.message),c(h)}),l.once("exit",h=>{if(!h)return c();let g=new Error(h===127?"Sendmail command not found, process exited with code "+h:"Sendmail exited with code "+h);g.code=Qf.ESENDMAIL,this.logger.error({err:g,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,g.message),c(g)}),l.once("close",c),l.stdin.on("error",h=>{this.logger.error({err:h,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,h.message),c(h)});let d=[].concat(n.to||[]);d.length>3&&d.push("...and "+d.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,d.join(", "));let p=e.message.createReadStream(),f=p;this.options.newline&&(f=p.pipe(this.winbreak?new zR:new JR),p.once("error",h=>f.emit("error",h))),f.once("error",h=>{this.logger.error({err:h,tnx:"stdin",messageId:i},"Error occurred when generating message %s. %s",i,h.message),l.kill("SIGINT"),c(h)}),f.pipe(l.stdin)}else{let d=new Error("sendmail was not found");return d.code=Qf.ESENDMAIL,c(d)}}};ZA.exports=Zf});var rT=me((MZ,tT)=>{"use strict";var YR=xr(),XR=kt(),QR=Ra(),ZR=fu(),em=class{constructor(e){e=e||{},this.options=e,this.name="StreamTransport",this.version=YR.version,this.logger=XR.getLogger(this.options,{component:this.options.component||"stream-transport"}),this.winbreak=["win","windows","dos",`\r
-`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,s.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let o;try{if(o=e.message.createReadStream(),this.options.newline){let l=o;o=l.pipe(this.winbreak?new QR:new ZR),l.once("error",d=>o.emit("error",d))}}catch(l){return this.logger.error({err:l,tnx:"send",messageId:i},"Creating send stream failed for %s. %s",i,l.message),r(l)}if(!this.options.buffer)return o.once("error",l=>{this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message)}),r(null,{envelope:n,messageId:i,message:o});let a=[],c=0;o.on("readable",()=>{let l;for(;(l=o.read())!==null;)a.push(l),c+=l.length}),o.once("error",l=>(this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message),r(l))),o.on("end",()=>r(null,{envelope:n,messageId:i,message:Buffer.concat(a,c)}))})}};tT.exports=em});var iT=me((KZ,nT)=>{"use strict";var e0=xr(),t0=kt(),tm=class{constructor(e){e=e||{},this.options=e,this.name="JSONTransport",this.version=e0.version,this.logger=t0.getLogger(this.options,{component:this.options.component||"json-transport"})}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Composing JSON structure of %s to <%s>",i,s.join(", ")),setImmediate(()=>{e.normalize((o,a)=>o?(this.logger.error({err:o,tnx:"send",messageId:i},"Failed building JSON structure for %s. %s",i,o.message),r(o)):(delete a.envelope,delete a.normalizedHeaders,r(null,{envelope:n,messageId:i,message:this.options.skipEncoding?a:JSON.stringify(a)})))})}};nT.exports=tm});var aT=me((HZ,oT)=>{"use strict";var r0=re("events"),n0=xr(),sT=kt(),i0=Xt(),s0=Ra(),o0=mu();function rm(t){return t&&typeof t=="object"&&!t.code&&(t.code=i0.ESES),t}var nm=class extends r0{constructor(e){super(),e=e||{},this.options=e,this.ses=this.options.SES,this.name="SESTransport",this.version=n0.version,this.logger=sT.getLogger(this.options,{component:this.options.component||"ses-transport"})}getRegion(e){return this.ses.sesClient.config&&typeof this.ses.sesClient.config.region=="function"?this.ses.sesClient.config.region().then(r=>e(null,r),r=>e(r)):e(null,!1)}send(e,r){let n=e.message._headers.find(c=>/^from$/i.test(c.key));if(n){let c=new o0("text/plain");n=c._convertAddresses(c._parseAddresses(n.value))}let i=e.message.getEnvelope(),s=e.message.messageId(),o=[].concat(i.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:s},"Sending message %s to <%s>",s,o.join(", "));let a=c=>{e.data._dkim||(e.data._dkim={}),e.data._dkim.skipFields&&typeof e.data._dkim.skipFields=="string"?e.data._dkim.skipFields+=":date:message-id":e.data._dkim.skipFields="date:message-id";let l=e.message.createReadStream(),d=l.pipe(new s0),p=[],f=0;d.on("readable",()=>{let h;for(;(h=d.read())!==null;)p.push(h),f+=h.length}),l.once("error",h=>d.emit("error",h)),d.once("error",h=>c(h)),d.once("end",()=>c(null,Buffer.concat(p,f)))};setImmediate(()=>a((c,l)=>{if(c)return this.logger.error({err:c,tnx:"send",messageId:s},"Failed creating message for %s. %s",s,c.message),r(c);let d=Object.assign({Content:{Raw:{Data:l}},FromEmailAddress:n||i.from,Destination:{ToAddresses:i.to}},e.data.ses||{});this.getRegion((p,f)=>{(p||!f)&&(f="us-east-1");let h;try{let g=new this.ses.SendEmailCommand(d);h=this.ses.sesClient.send(g)}catch(g){rm(g),this.logger.error({err:g,tnx:"send"},"Send error for %s: %s",s,g.message),setImmediate(()=>r(g));return}h.then(g=>{f==="us-east-1"&&(f="email");let _={envelope:{from:i.from,to:i.to},messageId:"<"+g.MessageId+(/@/.test(g.MessageId)?"":"@"+f+".amazonses.com")+">",response:g.MessageId,raw:l};setImmediate(()=>r(null,_))}).catch(g=>{rm(g),this.logger.error({err:g,tnx:"send"},"Send error for %s: %s",s,g.message),setImmediate(()=>r(g))})})}))}verify(e){let r;e||(r=new Promise((s,o)=>{e=sT.callbackPromise(s,o)}));let n=s=>s&&!["InvalidParameterValue","MessageRejected"].includes(s.code||s.Code||s.name)?e(rm(s)):e(null,!0),i={Content:{Raw:{Data:Buffer.from(`From: <invalid@invalid>\r
+`),this.outByteCount+=r.length,this.push(r),e()}};import{PassThrough as HR}from"node:stream";var FR=120*1e3,zA=600*1e3,VR=30*1e3,BR=30*1e3,jR=5*1e3,GR=30*1e3,JA=()=>{};function YA(t){let e=t.slice();for(let r=e.length-1;r>0;r--){let n=Math.floor(Math.random()*(r+1));[e[r],e[n]]=[e[n],e[r]]}return e}function id(t,e){let r=new Error(t);return r.timeoutType=e,r}var $R=1024*1024;function XA(t){if(!t)return t;let e=Buffer.from(t,"binary").toString("utf8");return e.includes("\uFFFD")?t:e}function qR(t){return QA(t.slice(t.lastIndexOf(`
+`)+1))}function QA(t){return/^\d+-/.test(t)}var Sm=class extends MR{constructor(e){super(e),this.id=WA.randomBytes(8).toString("base64").replace(/\W/g,""),this.stage="init",this.options=e||{},this.options.requireTLS&&(this.options.ignoreTLS||this.options.opportunisticTLS)&&(this.options=Object.assign({},this.options,{ignoreTLS:!1,opportunisticTLS:!1})),this.secureConnection=!!this.options.secure,this.alreadySecured=!!this.options.secured,this.port=Number(this.options.port)||(this.secureConnection?465:587),this.host=this.options.host||"localhost",this.servername=this.options.servername?this.options.servername:di.isIP(this.host)?!1:this.host,this.allowInternalNetworkInterfaces=this.options.allowInternalNetworkInterfaces||!1,typeof this.options.secure>"u"&&this.port===465&&(this.secureConnection=!0),this.name=(this.options.name||this._getHostname()).toString().replace(/[\r\n]+/g,""),this.logger=ft(this.options,{component:this.options.component||"smtp-connection",sid:this.id}),this.customAuth=new Map;for(let r of Object.keys(this.options.customAuth||{})){let n=(r||"").toString().trim().toUpperCase();n&&this.customAuth.set(n,this.options.customAuth[r])}this.version=Xe,this.authenticated=!1,this.destroyed=!1,this.secure=!!this.secureConnection,this._remainder="",this._responseQueue=[],this._responsePartial=!1,this.lastServerResponse=!1,this._socket=!1,this._supportedAuth=[],this.allowsAuth=!1,this._envelope=!1,this._supportedExtensions=[],this._maxAllowedSize=0,this._responseActions=[],this._recipientQueue=[],this._phaseTimer=!1,this._plaintextEhlo=!1,this._destroyed=!1,this._closing=!1,this._currentDataStream=!1,this._pendingSend=!1,this._connectCallback=!1,this._onSocketData=r=>this._onData(r),this._onSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN"),this._onSocketClose=()=>this._onClose(),this._onSocketEnd=()=>this._onEnd(),this._onSocketTimeout=()=>this._onTimeout(),this._onConnectionSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN")}connect(e){if(this._connectCalled&&!this._destroyed){let i=this._formatError("Cannot connect - connect() was already called for this connection","ECONNECTION",!1,"API");if(typeof e=="function"){setImmediate(()=>e(i));return}this.logger.warn({tnx:"smtp"},"%s",i.message);return}if(this._connectCalled=!0,typeof e=="function"){this._connectCallback=e,this.once("connect",()=>{this._connectCallback=!1,this.logger.debug({tnx:"smtp"},"SMTP handshake finished"),e()});let i=this._isDestroyedMessage("connect");if(i)return e(this._formatError(i,"ECONNECTION",!1,"CONN"))}let r=this.options.connectionTimeout||FR;this._connectionDeadline=(this._connectStartedAt||Date.now())+r;let n={port:this.port,host:this.host,allowInternalNetworkInterfaces:this.allowInternalNetworkInterfaces,timeout:Math.min(this.options.dnsTimeout||BR,r)};if(this.options.localAddress&&(n.localAddress=this.options.localAddress),this.options.connection){this._socket=this.options.connection,this._setupConnectionHandlers(),this.secureConnection&&!this.alreadySecured?setImmediate(()=>this._upgradeConnection(i=>{if(i){this._onError(new Error("Error initiating TLS - "+(i.message||i)),"ETLS",!1,"CONN");return}this._onConnect()})):setImmediate(()=>this._onConnect());return}else return this.options.socket?(this._socket=this.options.socket,this._resolveAndConnect(n,i=>{try{this._socket.connect(this.port,this.host,()=>{if(this.secureConnection&&!this.alreadySecured)return this._upgradeConnection(o=>{if(o){this._onError(new Error("Error initiating TLS - "+(o.message||o)),"ETLS",!1,"CONN");return}this._onConnect()});this._onConnect()}),this._setupConnectionHandlers()}catch(o){setImmediate(()=>this._onError(o,"ECONNECTION",!1,"CONN"));return}})):(this.secureConnection&&(Object.assign(n,this.options.tls||{}),this.servername&&!n.servername&&(n.servername=this.servername)),this._resolveAndConnect(n,i=>{let o=i._addresses||[];if(n.localAddress){let s=di.isIPv6(n.localAddress)?6:4,a=o.filter(c=>di.isIP(c)===s);o=a.length?a:o}if(o.length>1){let s=o.filter(l=>di.isIPv6(l)),a=o.filter(l=>!di.isIPv6(l)),c=YA(s).concat(YA(a));if(n.host=this.host,n.autoSelectFamily=!0,!s.length||!a.length){let l=this._connectionDeadline-Date.now();n.autoSelectFamilyAttemptTimeout=Math.max(Math.floor(l/c.length),10)}n.lookup=((l,u,p)=>{if(u&&u.all){let f=c.map(m=>({address:m,family:di.isIPv6(m)?6:4}));return setImmediate(()=>p(null,f))}setImmediate(()=>p(null,c[0],di.isIPv6(c[0])?6:4))})}else o.length&&(n.host=o[0]);this._connectToHost(n,this.secureConnection)}))}_resolveAndConnect(e,r){return sA(e,(n,i)=>{if(n)return setImmediate(()=>this._onError(n,"EDNS",!1,"CONN"));this.logger.debug({tnx:"dns",source:e.host,resolved:i.host,cached:!!i.cached},"Resolved %s as %s [cache %s]",e.host,i.host,i.cached?"hit":"miss");for(let o of Object.keys(i))o.charAt(0)!=="_"&&i[o]&&(e[o]=i[o]);r(i)})}_connectToHost(e,r){if(this._destroyed||this._closing)return;let n=r?qA.connect:di.connect;try{this._socket=n(e,()=>this._onConnect()),this._setupConnectionHandlers()}catch(i){setImmediate(()=>this._onError(i,"ECONNECTION",!1,"CONN"));return}}_setupConnectionHandlers(){this._startPhase(Math.max((this._connectionDeadline||Date.now())-Date.now(),0),id("Connection timeout","CONNECT_TIMEOUT")),this._socket.on("error",this._onConnectionSocketError)}_startPhase(e,r){this._clearPhase(),this._phaseTimer=setTimeout(()=>{this._phaseTimer=!1,this._onError(r,"ETIMEDOUT",!1,"CONN")},e)}_remainingSetupTime(){return Math.min(this.options.greetingTimeout||VR,Math.max((this._connectionDeadline||1/0)-Date.now(),1))}_clearPhase(){clearTimeout(this._phaseTimer),this._phaseTimer=!1}quit(){this._sendCommand("QUIT"),this._responseActions.push(this.close)}close(){if(this._clearPhase(),this._responseActions=[],this._closing)return;this._closing=!0;let e=this.stage==="init"?"destroy":"end";this.logger.debug({tnx:"smtp"},'Closing connection to the server using "%s"',e);let r=this._socket&&this._socket.socket||this._socket;if(this._currentDataStream){try{this._currentDataStream.unpipe(this._socket)}catch{}this._currentDataStream=!1}if(this._pendingSend){let{stream:n,onStreamError:i}=this._pendingSend;n&&(n.removeListener("error",i),n.on("error",JA),n.destroy()),this._pendingSend=!1}if(r&&!r.destroyed)try{if(r.setTimeout(0),r.removeListener("data",this._onSocketData),r.removeListener("timeout",this._onSocketTimeout),r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError),r.removeListener("error",this._onConnectionSocketError),r.on("error",JA),r[e](),e==="end"){let n=setTimeout(()=>r.destroy(),jR);typeof n.unref=="function"&&n.unref(),r.once("close",()=>clearTimeout(n))}}catch{}this._destroy()}login(e,r){let n=this._isDestroyedMessage("login");if(n)return r(this._formatError(n,"ECONNECTION",!1,"API"));this._auth=e||{},this._authMethod=(this._auth.method||"").toString().trim().toUpperCase()||!1;let i=!!this._auth.oauth2||this.customAuth.has("XOAUTH2");if(!this._authMethod&&this._auth.oauth2&&!this._auth.credentials)this._authMethod="XOAUTH2";else if(!this._authMethod||this._authMethod==="XOAUTH2"&&!this._auth.oauth2){let o=this._supportedAuth.find(s=>s!=="XOAUTH2"||i);this._authMethod=(o||"PLAIN").toUpperCase().trim()}if((this._authMethod!=="XOAUTH2"||this.customAuth.has("XOAUTH2"))&&(!this._auth.credentials||!this._auth.credentials.user||!this._auth.credentials.pass))if(this._auth.user&&this._auth.pass||this.customAuth.has(this._authMethod))this._auth.credentials={user:this._auth.user,pass:this._auth.pass,options:this._auth.options};else return r(this._formatError('Missing credentials for "'+this._authMethod+'"',"EAUTH",!1,"API"));if(this.customAuth.has(this._authMethod)){let o=this.customAuth.get(this._authMethod),s,a=!1,c=()=>{a||(a=!0,this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0))},l=f=>{a||(a=!0,r(this._formatError(f,"EAUTH",s,"AUTH "+this._authMethod)))},u=(f,m)=>{let E;return m||(E=new Promise((v,N)=>{m=Mt(v,N)})),this._responseActions.push(v=>{s=v;let N=v.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/),S={command:f,response:v};N?(S.status=Number(N[1])||0,N[2]&&(S.code=N[2]),S.text=v.substr(N[0].length)):(S.text=v,S.status=0),m(null,S)}),setImmediate(()=>this._sendCommand(f)),E},p=o({auth:this._auth,method:this._authMethod,extensions:[].concat(this._supportedExtensions),authMethods:[].concat(this._supportedAuth),maxAllowedSize:this._maxAllowedSize||!1,sendCommand:u,resolve:c,reject:l});p&&typeof p.catch=="function"&&p.then(c).catch(l);return}switch(this._authMethod){case"XOAUTH2":this._handleXOauth2Token(!1,r);return;case"LOGIN":this._responseActions.push(o=>{this._actionAUTH_LOGIN_USER(o,r)}),this._sendCommand("AUTH LOGIN");return;case"PLAIN":this._responseActions.push(o=>{this._actionAUTHComplete(o,r)}),this._sendCommand("AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0"+this._auth.credentials.pass,"utf-8").toString("base64"),"AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0/* secret */","utf-8").toString("base64"));return;case"CRAM-MD5":this._responseActions.push(o=>{this._actionAUTH_CRAM_MD5(o,r)}),this._sendCommand("AUTH CRAM-MD5");return}return r(this._formatError('Unknown authentication method "'+this._authMethod+'"',"EAUTH",!1,"API"))}send(e,r,n){let i=!1,o=(l,u)=>{i||(i=!0,this._pendingSend&&this._pendingSend.callback===o&&(this._pendingSend=!1),n(l,u))};if(!r)return o(this._formatError("Empty message","EMESSAGE",!1,"API"));let s=this._isDestroyedMessage("send message");if(s)return o(this._formatError(s,"ECONNECTION",!1,"API"));if(this._maxAllowedSize&&e.size>this._maxAllowedSize){setImmediate(()=>{o(this._formatError("Message size larger than allowed "+this._maxAllowedSize,"EMESSAGE",!1,"MAIL FROM"))});return}let a={callback:o,stream:!1,onStreamError:l=>o(this._formatError(l,"ESTREAM",!1,"API"))};typeof r.on=="function"&&(a.stream=r,a.stream.on("error",a.onStreamError)),this._pendingSend=a;let c=Date.now();this._setEnvelope(e,(l,u)=>{if(l)return typeof r.destroy=="function"&&r.destroy(),o(l);let p=Date.now(),f=this._createSendStream((m,E)=>{if(m)return o(m);let v=u;return v.envelopeTime=p-c,v.messageTime=Date.now()-p,v.messageSize=f.outByteCount,v.response=E,o(null,v)});typeof r.pipe=="function"?r.pipe(f):(f.write(r),f.end())})}reset(e){let r=this._isDestroyedMessage("reset");if(r)return e(this._formatError(r,"ECONNECTION",!1,"API"));this._sendCommand("RSET"),this._responseActions.push(n=>n.charAt(0)!=="2"?e(this._formatError("Could not reset session state. response="+n,"EPROTOCOL",n,"RSET")):(this._envelope=!1,e(null,!0)))}_onConnect(){let e=this._socket;if(this._clearPhase(),this.logger.info({tnx:"network",localAddress:e.localAddress,localPort:e.localPort,remoteAddress:e.remoteAddress,remotePort:e.remotePort},"%s established to %s:%s",this.secure?"Secure connection":"Connection",e.remoteAddress,e.remotePort),this._destroyed){this.close();return}this.stage="connected",e.removeListener("data",this._onSocketData),e.removeListener("timeout",this._onSocketTimeout),e.removeListener("close",this._onSocketClose),e.removeListener("end",this._onSocketEnd),e.removeListener("error",this._onConnectionSocketError),e.removeListener("error",this._onSocketError),e.on("error",this._onSocketError),e.on("data",this._onSocketData),e.once("close",this._onSocketClose),e.once("end",this._onSocketEnd),e.setTimeout(this.options.socketTimeout||zA),e.on("timeout",this._onSocketTimeout),typeof e.setKeepAlive=="function"&&e.setKeepAlive(!0,GR),typeof e.setNoDelay=="function"&&e.setNoDelay(!0),this._startPhase(this._remainingSetupTime(),id("Greeting never received","GREETING_TIMEOUT")),this._responseActions.push(this._actionGreeting),e.resume()}_onServerClosing(e){if(this._destroyed)return;let r=this._pendingSend,n=this._envelope;this._responseActions=[],this.close(),r&&r.callback(n&&n.mailError||this._formatError("Server closed the connection","ECONNECTION",e,"CONN"))}_onData(e){if(this._destroyed||!e||!e.length)return;let r=this.options.maxResponseSize||$R,n=e.toString("binary");if(!n.includes(`
+`))return this._remainder+=n,this._remainder.length>r?this._onResponseTooLarge():void 0;let i=(this._remainder+n).split(/\r?\n/);this._remainder=i.pop();for(let o=0,s=i.length;o<s;o++)if(this._responsePartial?this._responseQueue[this._responseQueue.length-1]+=`
+`+i[o]:this._responseQueue.push(i[o]),this._responsePartial=QA(i[o]),this._responsePartial&&this._responseQueue[this._responseQueue.length-1].length>r)return this._onResponseTooLarge();if(this._remainder.length>r)return this._onResponseTooLarge();this._responsePartial||this._processResponse()}_onResponseTooLarge(){this._remainder="",this._responseQueue=[],this._responsePartial=!1,this._onError(new Error("Server response exceeds maximum allowed size"),"EPROTOCOL",!1,"CONN")}_onError(e,r,n,i){if(this._clearPhase(),this._destroyed)return;e=this._formatError(e,r,n,i),Wa(e)?this.logger.warn({tnx:"smtp",err:e},"%s",e.message):this.logger.error({tnx:"smtp",err:e},"%s",e.message);let o=this._pendingSend;this.emit("error",e),this.close(),o&&o.callback(e)}_formatError(e,r,n,i){let o;/Error\]$/i.test(Object.prototype.toString.call(e))?o=e:o=new Error(e),r&&r!=="Error"&&o.code!==Wu&&(o.code&&o.code!==r&&!o.originalCode&&(o.originalCode=o.code),o.code=r),n&&(o.response=n,o.message+=": "+n);let s=typeof n=="string"&&Number((n.match(/^\d+/)||[])[0])||!1;return s&&(o.responseCode=s),i&&(o.command=i),o}_onClose(){let e=!1;this._remainder&&this._remainder.trim()&&(this.lastServerResponse=e=XA(this._remainder.trim()),(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e)),this.logger.info({tnx:"network"},"Connection closed");let r=typeof e=="string"&&/^[45]\d{2}[ -]/.test(e)?e:!1;if(this.upgrading&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ETLS",r,"CONN");if(!r&&this._responseActions[0]===this._actionGreeting&&this._connectCallback&&!this._destroyed){let n=this._connectCallback;this._connectCallback=!1;let i=this._formatError(new Error("Connection closed unexpectedly"),"ECONNECTION",!1,"CONN");this.logger.warn({tnx:"network"},i.message),n(i),this.close();return}if(!r&&this.stage==="connected"&&!this._responseActions.length&&!this._pendingSend&&!this._destroyed&&!this._closing)return this.logger.info({tnx:"network"},"Server closed the idle connection"),this._destroy();if(r||this._responseActions[0]!==this.close&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",r,"CONN");this._destroy()}_onEnd(){this._socket&&!this._socket.destroyed&&this._socket.end()}_onTimeout(){return this._onError(id("Timeout","SOCKET_TIMEOUT"),"ETIMEDOUT",!1,"CONN")}_destroy(){this._destroyed||(this._destroyed=!0,this.destroyed=!0,this._clearPhase(),this.emit("end"))}_upgradeConnection(e){let r=this._remainder.length+this._responseQueue.reduce((s,a)=>s+a.length,0);r&&this.logger.warn({tnx:"smtp",discarded:r},"Discarded %s bytes received in plaintext after the STARTTLS response",r),this._plaintextEhlo=!1,this._remainder="",this._responseQueue=[],this._responsePartial=!1;let n=this._socket;n.removeListener("data",this._onSocketData),n.removeListener("timeout",this._onSocketTimeout),n.setTimeout(0);let i=Object.assign({socket:n,host:this.host},this.options.tls||{});this.servername&&!i.servername&&(i.servername=this.servername);let o=()=>{n.removeListener("close",this._onSocketClose),n.removeListener("end",this._onSocketEnd),n.removeListener("error",this._onSocketError),n.removeListener("error",this._onConnectionSocketError)};this.upgrading=!0,this._startPhase(this._remainingSetupTime(),id("TLS handshake timed out","UPGRADE_TIMEOUT"));try{this._socket=qA.connect(i,()=>(this._clearPhase(),this.secure=!0,this.upgrading=!1,this._socket.on("data",this._onSocketData),o(),e(null,!0)))}catch(s){return this._clearPhase(),o(),e(s)}this._socket.on("error",this._onSocketError),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||zA),this._socket.on("timeout",this._onSocketTimeout),n.resume()}_processResponse(){if(!this._responseQueue.length)return!1;let e=(this._responseQueue.shift()||"").toString();if(!e.trim()){setImmediate(()=>this._processResponse());return}if(qR(e)){this._responseQueue.unshift(e);return}let r=this.lastServerResponse=XA(e);(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},r.replace(/\r?\n$/,""));let n=this._responseActions.shift(),i=/^421[ -]/.test(r);if(typeof n=="function"){if(n.call(this,r),i)return this._onServerClosing(r);setImmediate(()=>this._processResponse())}else if(i&&!this._pendingSend&&this.stage==="connected")this.logger.info({tnx:"smtp"},"Server closed the idle connection: %s",r),this.close();else return this._onError(new Error("Unexpected Response"),"EPROTOCOL",r,"CONN")}_sendCommand(e,r){if(this._destroyed)return;let n=this._socket;if(n.destroyed)return this.close();(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"client"},(r||e||"").toString().replace(/\r?\n$/,"")),n.write(Buffer.from(e+`\r
+`,"utf-8"))}_setEnvelope(e,r){let n=[],i=!1;if(this._envelope=e||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(),this._envelope.to=[].concat(this._envelope.to||[]).map(a=>(a&&a.address||a||"").toString().trim()),!this._envelope.to.length)return r(this._formatError("No recipients defined","EENVELOPE",!1,"API"));if(this._envelope.from&&/[\r\n<>]/.test(this._envelope.from))return r(this._formatError("Invalid sender "+JSON.stringify(this._envelope.from),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.from)&&(i=!0);for(let a=0,c=this._envelope.to.length;a<c;a++){if(!this._envelope.to[a]||/[\r\n<>]/.test(this._envelope.to[a]))return r(this._formatError("Invalid recipient "+JSON.stringify(this._envelope.to[a]),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.to[a])&&(i=!0)}if(this._envelope.rcptQueue=[].concat(this._envelope.to||[]),this._envelope.rejected=[],this._envelope.rejectedErrors=[],this._envelope.accepted=[],this._envelope.dsn)try{this._envelope.dsn=this._setDsnEnvelope(this._envelope.dsn)}catch(a){return r(this._formatError("Invalid DSN "+a.message,"EENVELOPE",!1,"API"))}if(this._envelope.requireTLSExtensionEnabled){if(!this.secure)return r(this._formatError("REQUIRETLS can only be used over TLS connections (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));if(!this._supportedExtensions.includes("REQUIRETLS"))return r(this._formatError("Server does not support REQUIRETLS extension (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"))}if(this._envelope.pipelined=this._supportedExtensions.includes("PIPELINING"),this._responseActions.push(a=>{this._actionMAIL(a,r)}),i&&this._supportedExtensions.includes("SMTPUTF8")&&(n.push("SMTPUTF8"),this._usingSmtpUtf8=!0),this._envelope.use8BitMime&&this._supportedExtensions.includes("8BITMIME")&&(n.push("BODY=8BITMIME"),this._using8BitMime=!0),this._envelope.size&&this._supportedExtensions.includes("SIZE")){let a=Number(this._envelope.size)||0;a>0&&n.push("SIZE="+a)}this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.ret&&n.push("RET="+Ja(this._envelope.dsn.ret)),this._envelope.dsn.envid&&n.push("ENVID="+Ja(this._envelope.dsn.envid))),this._envelope.requireTLSExtensionEnabled&&n.push("REQUIRETLS");let o="MAIL FROM:<"+this._envelope.from+">"+(n.length?" "+n.join(" "):"");if(this._recipientQueue=[],!this._envelope.pipelined){this._sendCommand(o);return}let s=this._socket;for(s.cork(),this._sendCommand(o);this._envelope.rcptQueue.length;)this._sendRcpt(this._envelope.rcptQueue.shift(),r);this._responseActions.push(a=>{this._actionDATA(a,r)}),this._sendCommand("DATA"),s.uncork()}_sendRcpt(e,r){this._recipientQueue.push(e),this._responseActions.push(n=>{this._actionRCPT(n,r)}),this._sendCommand("RCPT TO:<"+e+">"+this._getDsnRcptToArgs())}_setDsnEnvelope(e){let r=(e.ret||e.return||"").toString().toUpperCase()||null;if(r)switch(r){case"HDRS":case"HEADERS":r="HDRS";break;case"FULL":case"BODY":r="FULL";break}if(r&&!["FULL","HDRS"].includes(r))throw new Error("ret: "+JSON.stringify(r));let n=(e.envid||e.id||"").toString()||null,i=e.notify||null;if(i){typeof i=="string"&&(i=i.split(",")),i=i.map(c=>c.trim().toUpperCase());let s=["NEVER","SUCCESS","FAILURE","DELAY"];if(i.filter(c=>!s.includes(c)).length||i.length>1&&i.includes("NEVER"))throw new Error("notify: "+JSON.stringify(i.join(",")));i=i.join(",")}let o=(e.recipient||e.orcpt||"").toString()||null;return o&&o.indexOf(";")<0&&(o="rfc822;"+o),{ret:r,envid:n,notify:i,orcpt:o}}_getDsnRcptToArgs(){let e=this._envelope,r=[];return e.dsn&&this._supportedExtensions.includes("DSN")&&(e.dsn.notify&&r.push("NOTIFY="+Ja(e.dsn.notify)),e.dsn.orcpt&&r.push("ORCPT="+Ja(e.dsn.orcpt))),r.length?" "+r.join(" "):""}_createSendStream(e){let r=this._envelope,n=new nc;if(this.options.lmtp?r.accepted.forEach((i,o)=>{let s=o===r.accepted.length-1;this._responseActions.push(a=>{this._actionLMTPStream(i,s,a,e)})}):this._responseActions.push(i=>{this._actionSMTPStream(i,e)}),this._currentDataStream=n,n.pipe(this._socket,{end:!1}),this.options.debug){let i=new HR;i.on("readable",()=>{let o;for(;o=i.read();)this.logger.debug({tnx:"message"},o.toString("binary").replace(/\r?\n$/,""))}),n.pipe(i)}return n.once("end",()=>{this._currentDataStream===n&&(this._currentDataStream=!1),this.logger.info({tnx:"message",inByteCount:n.inByteCount,outByteCount:n.outByteCount},"<%s bytes encoded mime message (source size %s bytes)>",n.outByteCount,n.inByteCount)}),n}_actionGreeting(e){if(this._clearPhase(),e.substr(0,3)!=="220"){this._onError(new Error("Invalid greeting. response="+e),"EPROTOCOL",e,"CONN");return}this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name))}_actionLHLO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid LHLO. response="+e),"EPROTOCOL",e,"LHLO");return}this._actionEHLO(e)}_actionEHLO(e){if(e.substr(0,3)==="421"){this._onError(new Error("Server terminates connection. response="+e),"ECONNECTION",e,"EHLO");return}if(e.charAt(0)!=="2"){if(this.options.requireTLS){this._onError(new Error("EHLO failed but HELO does not support required STARTTLS. response="+e),"ECONNECTION",e,"EHLO");return}this._responseActions.push(this._actionHELO),this._sendCommand("HELO "+this.name);return}if(!this.secure&&!this.options.ignoreTLS&&(/[ -]STARTTLS\b/im.test(e)||this.options.requireTLS)){this._plaintextEhlo=e,this._sendCommand("STARTTLS"),this._responseActions.push(this._actionSTARTTLS);return}this._parseEhloExtensions(e),this.emit("connect")}_parseEhloExtensions(e){let r;this._ehloLines=e.split(/\r?\n/).map(i=>i.replace(/^\d+[ -]/,"").trim()).filter(i=>i).slice(1),/[ -]SMTPUTF8\b/im.test(e)&&this._supportedExtensions.push("SMTPUTF8"),/[ -]DSN\b/im.test(e)&&this._supportedExtensions.push("DSN"),/[ -]8BITMIME\b/im.test(e)&&this._supportedExtensions.push("8BITMIME"),/[ -]REQUIRETLS\b/im.test(e)&&this._supportedExtensions.push("REQUIRETLS"),/[ -]PIPELINING\b/im.test(e)&&this._supportedExtensions.push("PIPELINING"),/[ -]AUTH\b/i.test(e)&&(this.allowsAuth=!0);let n=new Set;for(let i of this._ehloLines){let o=/^AUTH[\s=](.*)/i.exec(i);if(o)for(let s of o[1].split(/[\s=]+/))n.add(s.toUpperCase())}for(let i of["PLAIN","LOGIN","CRAM-MD5","XOAUTH2"])n.has(i)&&this._supportedAuth.push(i);(r=e.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))&&(this._supportedExtensions.push("SIZE"),this._maxAllowedSize=Number(r[1])||0)}_actionHELO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid HELO. response="+e),"EPROTOCOL",e,"HELO");return}this.allowsAuth=!0,this.emit("connect")}_actionSTARTTLS(e){if(e.charAt(0)!=="2"){if(this.options.opportunisticTLS){this.logger.info({tnx:"smtp"},"Failed STARTTLS upgrade, continuing unencrypted"),this._plaintextEhlo&&(this._parseEhloExtensions(this._plaintextEhlo),this._plaintextEhlo=!1,this.allowsAuth=!1,this._supportedAuth=[]),this.emit("connect");return}this._onError(new Error("Error upgrading connection with STARTTLS"),"ETLS",e,"STARTTLS");return}this._upgradeConnection((r,n)=>{if(r){this._onError(new Error("Error initiating TLS - "+(r.message||r)),"ETLS",!1,"STARTTLS");return}this.logger.info({tnx:"smtp"},"Connection upgraded with STARTTLS"),n?this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name)):this.emit("connect")})}_actionAUTH_LOGIN_USER(e,r){if(!/^334[ -]/.test(e)){r(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"',"EAUTH",e,"AUTH LOGIN"));return}this._responseActions.push(n=>{this._actionAUTH_LOGIN_PASS(n,r)}),this._sendCommand(Buffer.from(this._auth.credentials.user+"","utf-8").toString("base64"))}_actionAUTH_CRAM_MD5(e,r){let n=e.match(/^334\s+(.+)$/);if(!n)return r(this._formatError("Invalid login sequence while waiting for server challenge string","EAUTH",e,"AUTH CRAM-MD5"));let i=Buffer.from(n[1],"base64").toString("ascii"),o=WA.createHmac("md5",this._auth.credentials.pass);o.update(i);let s=this._auth.credentials.user+" "+o.digest("hex");this._responseActions.push(a=>{this._actionAUTH_CRAM_MD5_PASS(a,r)}),this._sendCommand(Buffer.from(s).toString("base64"),Buffer.from(this._auth.credentials.user+" /* secret */").toString("base64"))}_actionAUTH_CRAM_MD5_PASS(e,r){if(!e.match(/^235\s+/))return r(this._formatError('Invalid login sequence while waiting for "235"',"EAUTH",e,"AUTH CRAM-MD5"));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0)}_actionAUTH_LOGIN_PASS(e,r){if(!/^334[ -]/.test(e))return r(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"',"EAUTH",e,"AUTH LOGIN"));this._responseActions.push(n=>{this._actionAUTHComplete(n,r)}),this._sendCommand(Buffer.from((this._auth.credentials.pass||"").toString(),"utf-8").toString("base64"),Buffer.from("/* secret */","utf-8").toString("base64"))}_actionAUTHComplete(e,r,n){if(!n&&typeof r=="function"&&(n=r,r=!1),e.substr(0,3)==="334"){this._responseActions.push(i=>{r||this._authMethod!=="XOAUTH2"?this._actionAUTHComplete(i,!0,n):setImmediate(()=>this._handleXOauth2Token(!0,n))}),this._sendCommand("");return}if(e.charAt(0)!=="2")return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),n(this._formatError("Invalid login","EAUTH",e,"AUTH "+this._authMethod));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,n(null,!0)}_actionMAIL(e,r){let n=this._envelope;if(Number(e.charAt(0))!==2){let i=this._usingSmtpUtf8&&/^550 /.test(e)&&/[\x80-\uFFFF]/.test(n.from)?"Internationalized mailbox name not allowed":"Mail command failed";n.mailError=this._formatError(i,"EENVELOPE",e,"MAIL FROM")}this._advanceEnvelope(e,r)}_actionRCPT(e,r){let n=this._envelope,i,o=this._recipientQueue.shift();if(Number(e.charAt(0))!==2){let s=this._usingSmtpUtf8&&/^553 /.test(e)&&/[\x80-\uFFFF]/.test(o)?"Internationalized mailbox name not allowed":"Recipient command failed";n.rejected.push(o),i=this._formatError(s,"EENVELOPE",e,"RCPT TO"),i.recipient=o,n.rejectedErrors.push(i)}else n.accepted.push(o);this._advanceEnvelope(e,r)}_advanceEnvelope(e,r){let n=this._envelope;if(n.pipelined)return;if(n.mailError)return r(n.mailError);if(n.rcptQueue.length)return this._sendRcpt(n.rcptQueue.shift(),r);if(this._recipientQueue.length)return;let i=this._envelopeError(e);if(i)return r(i);this._responseActions.push(o=>{this._actionDATA(o,r)}),this._sendCommand("DATA")}_envelopeError(e){let r=this._envelope;if(r.mailError)return r.mailError;if(r.accepted.length)return null;let n=r.rejectedErrors.find(a=>a.responseCode&&a.responseCode<500),i=r.rejectedErrors[r.rejectedErrors.length-1],o=n?.response??(r.pipelined&&i?i.response:e),s=this._formatError("Can't send mail - all recipients were rejected","EENVELOPE",o,"RCPT TO");return s.rejected=r.rejected,s.rejectedErrors=r.rejectedErrors,s}_actionDATA(e,r){let n=this._envelope;if(n.pipelined){let o=this._envelopeError(e);if(o){if(/^3/.test(e)){if(n.mailError)return this.close(),r(o);this._responseActions.push(()=>r(o)),this._sendCommand(".");return}return r(o)}}if(!/^[23]/.test(e))return r(this._formatError("Data command failed","EENVELOPE",e,"DATA"));let i={accepted:n.accepted,rejected:n.rejected};this._ehloLines&&this._ehloLines.length&&(i.ehlo=this._ehloLines),n.rejectedErrors.length&&(i.rejectedErrors=n.rejectedErrors),r(null,i)}_actionSMTPStream(e,r){return Number(e.charAt(0))!==2?r(this._formatError("Message failed","EMESSAGE",e,"DATA")):r(null,e)}_actionLMTPStream(e,r,n,i){let o=this._envelope,s;if(Number(n.charAt(0))!==2){s=this._formatError("Message failed for recipient "+e,"EMESSAGE",n,"DATA"),s.recipient=e,o.rejected.push(e),o.rejectedErrors.push(s);for(let a=0,c=o.accepted.length;a<c;a++)o.accepted[a]===e&&o.accepted.splice(a,1)}if(r)return i(null,n)}_handleXOauth2Token(e,r){this._auth.oauth2.getToken(e,(n,i)=>{if(n)return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),r(this._formatError(n,"EAUTH",!1,"AUTH XOAUTH2"));this._responseActions.push(o=>{this._actionAUTHComplete(o,e,r)}),this._sendCommand("AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token(i),"AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token("/* secret */"))})}_isDestroyedMessage(e){if(this._destroyed)return"Cannot "+e+" - smtp connection is already destroyed.";if(this._socket){if(this._socket.destroyed)return"Cannot "+e+" - smtp connection socket is already destroyed.";if(!this._socket.writable)return"Cannot "+e+" - smtp connection socket is already half-closed."}}_getHostname(){let e;try{e=KR.hostname()||""}catch{e="localhost"}return(!e||e.indexOf(".")<0)&&(e="[127.0.0.1]"),e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)&&(e="["+e+"]"),e}},zi=Sm;import{Stream as WR}from"node:stream";import zR from"node:crypto";var wm=class extends WR{constructor(e,r){if(super(),this.options=e||{},this.configError=!1,e&&e.serviceClient){if(!e.privateKey||!e.user){let i=new Error('Options "privateKey" and "user" are required for service account!');i.code=ci,this.configError=i}let n=Math.min(Math.max(Number(this.options.serviceRequestTimeout)||0,0),3600);this.options.serviceRequestTimeout=n||300}if(this.logger=ft({logger:r},{component:this.options.component||"OAuth2"}),this.provisionCallback=typeof this.options.provisionCallback=="function"?this.options.provisionCallback:!1,this.options.accessUrl=this.options.accessUrl||"https://accounts.google.com/o/oauth2/token",this.options.customHeaders=this.options.customHeaders||{},this.options.customParams=this.options.customParams||{},this.accessToken=this.options.accessToken||!1,this.options.expires&&Number(this.options.expires))this.expires=this.options.expires;else{let n=Math.max(Number(this.options.timeout)||0,0);this.expires=n&&Date.now()+n*1e3||0}this.renewing=!1,this.renewalQueue=[]}getToken(e,r){let n=r;if(this.configError)return n(this.configError);if(!e&&this.accessToken&&(!this.expires||this.expires>Date.now()))return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token for %s",this.options.user),r(null,this.accessToken);if(!this.provisionCallback&&!this.options.refreshToken&&!this.options.serviceClient){if(this.accessToken)return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token (no refresh capability) for %s",this.options.user),r(null,this.accessToken);this.logger.error({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Cannot renew access token for %s: No refresh mechanism available",this.options.user);let o=new Error("Can't create new access token for user");return o.code=ci,n(o)}if(this.renewing){this.renewalQueue.push({renew:e,callback:n});return}this.renewing=!0;let i=(o,s)=>{this.renewalQueue.forEach(a=>a.callback(o,s)),this.renewalQueue=[],this.renewing=!1,o?this.logger.error({err:o,tnx:"OAUTH2",user:this.options.user,action:"renew"},"Failed generating new Access Token for %s",this.options.user):this.logger.info({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Generated new Access Token for %s",this.options.user),n(o,s)};this.provisionCallback?this.provisionCallback(this.options.user,!!e,(o,s,a)=>{!o&&s&&(this.accessToken=s,this.expires=a||0),i(o,s)}):this.generateToken(i)}updateToken(e,r){this.accessToken=e,r=Math.max(Number(r)||0,0),this.expires=r&&Date.now()+r*1e3||0,this.emit("token",{user:this.options.user,accessToken:e||"",expires:this.expires})}generateToken(e){let r=e,n,i;if(this.options.serviceClient){let o=Math.floor(Date.now()/1e3),s={iss:this.options.serviceClient,scope:this.options.scope||"https://mail.google.com/",sub:this.options.user,aud:this.options.accessUrl,iat:o,exp:o+this.options.serviceRequestTimeout},a;try{a=this.jwtSignRS256(s)}catch{let l=new Error("Can't generate token. Check your auth options");return l.code=ci,r(l)}n={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:a},i={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:s}}else{if(!this.options.refreshToken){let o=new Error("Can't create new access token for user");return o.code=ci,r(o)}n={client_id:this.options.clientId||"",client_secret:this.options.clientSecret||"",refresh_token:this.options.refreshToken,grant_type:"refresh_token"},i={client_id:this.options.clientId||"",client_secret:(this.options.clientSecret||"").substr(0,6)+"...",refresh_token:(this.options.refreshToken||"").substr(0,6)+"...",grant_type:"refresh_token"}}Object.assign(n,this.options.customParams),Object.assign(i,this.options.customParams),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"generate"},"Requesting token using: %s",JSON.stringify(i)),this.postRequest(this.options.accessUrl,n,this.options,(o,s)=>{let a;if(o)return r(o);try{a=JSON.parse(s.toString())}catch(u){return r(u)}if(!a||typeof a!="object"){this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",(s||"").toString());let u=new Error("Invalid authentication response");return u.code=ci,r(u)}let c=Object.assign({},a);if(c.access_token&&(c.access_token=(c.access_token||"").toString().substr(0,6)+"..."),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",JSON.stringify(c)),a.error){let u=a.error;a.error_description&&(u+=": "+a.error_description),a.error_uri&&(u+=" ("+a.error_uri+")");let p=new Error(u);return p.code=ci,r(p)}if(a.access_token)return this.updateToken(a.access_token,a.expires_in),e(null,this.accessToken);let l=new Error("No access token");return l.code=ci,r(l)})}buildXOAuth2Token(e){let r=["user="+(this.options.user||""),"auth=Bearer "+(e||this.accessToken),"",""];return Buffer.from(r.join("
"),"utf-8").toString("base64")}postRequest(e,r,n,i){let o=!1,s=[],a=0,c={method:"post",headers:n.customHeaders,body:r,allowErrorResponse:!0,timeout:n.requestTimeout};/^https:/i.test(e)&&(c.tls=Object.assign({rejectUnauthorized:!0},n.tls||{}));let l=ui(e,c);l.on("readable",()=>{let u;for(;(u=l.read())!==null;)s.push(u),a+=u.length}),l.once("error",u=>{if(!o)return o=!0,i(u)}),l.once("end",()=>{if(!o)return o=!0,i(null,Buffer.concat(s,a))})}toBase64URL(e){return typeof e=="string"&&(e=Buffer.from(e)),e.toString("base64").replace(/[=]+/g,"").replace(/\+/g,"-").replace(/\//g,"_")}jwtSignRS256(e){let r=['{"alg":"RS256","typ":"JWT"}',JSON.stringify(e)].map(i=>this.toBase64URL(i)).join("."),n=zR.createSign("RSA-SHA256").update(r).sign(this.options.privateKey);return r+"."+this.toBase64URL(n)}},od=wm;import{EventEmitter as JR}from"node:events";var As=class extends JR{constructor(e){if(super(),this.pool=e,this.options=e.options,this.logger=this.pool.logger,this.options.auth)switch((this.options.auth.type||"").toString().toUpperCase()){case"OAUTH2":{let r=new od(this.options.auth,this.logger);r.provisionCallback=this.pool.mailer&&this.pool.mailer.get("oauth2_provision_cb")||r.provisionCallback,this.auth={type:"OAUTH2",user:this.options.auth.user,oauth2:r,method:"XOAUTH2"},r.on("token",n=>this.pool.mailer.emit("token",n)),r.on("error",n=>this._fail(n));break}default:if(!this.options.auth.user&&!this.options.auth.pass)break;this.auth={type:(this.options.auth.type||"").toString().toUpperCase()||"LOGIN",user:this.options.auth.user,credentials:{user:this.options.auth.user||"",pass:this.options.auth.pass,options:this.options.auth.options},method:(this.options.auth.method||"").trim().toUpperCase()||this.options.authMethod||!1}}this._connection=!1,this._connected=!1,this.messages=0,this.available=!0,this._failed=!1,this._sending=!1,this._idleTimer=!1}_fail(e){this._failed||(this._failed=!0,this.emit("error",e))}connect(e){let r=Date.now();this.pool.getSocket(Object.assign({},this.options,{connectStartedAt:r}),(n,i)=>{if(n)return this._fail(n),e(n);let o=!1,s=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,s.host||"",s.port||""),s=Object.assign(Or(!1,s),i)),this.connection=new zi(s),this.connection._connectStartedAt=r,this.connection.on("error",a=>{if(!this._sending){if(this._connected&&Wa(a)){this.logger.info({tnx:"pool",cid:this.id},"Connection #%s was closed by the server: %s",this.id,a.message);return}if(this._fail(a),!o)return o=!0,e(a)}}),this.connection.once("end",()=>{this.close(),o=!0}),this.connection.connect(a=>{if(!o){if(a){o=!0;return}if(this.auth&&(this.connection.allowsAuth||s.forceAuth))this.connection.login(this.auth,c=>{if(!o){if(o=!0,c)return this.connection.close(),this._fail(c),e(c);this._connected=!0,e(null,!0)}});else return o=!0,this._connected=!0,e(null,!0)}})})}send(e,r){if(!this._connected)return this.connect(c=>c?r(c):this.send(e,r));let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i,cid:this.id},"Sending message %s using #%s to <%s>",i,this.id,o.join(", ")),e.data.dsn&&(n.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(n.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this._sending=!0;let s=this.messages>0,a=e.message.createReadStream();this.connection.send(n,a,(c,l)=>{if(this._sending=!1,this.messages++,c){if(s&&a.readableDidRead===!1&&Wa(c)){this.logger.info({tnx:"pool",cid:this.id,messageId:i},"Connection #%s was closed by the server before message %s was sent: %s",this.id,i,c.message),this.connection.close();return}return(c.code===Jv||c.code===Yv)&&c.responseCode!==421&&!this.connection._destroyed?(this.connection.reset(u=>{if(u){this.connection.close();return}this._release()}),r(c)):(this.connection.close(),this._fail(c),r(c))}l.envelope={from:n.from,to:n.to},l.messageId=i,setImmediate(()=>this._release()),r(null,l)})}_release(){if(this.messages>=this.options.maxMessages){let e=new Error("Resource exhausted");e.code=Bu,this.connection.close(),this._fail(e);return}this.pool._checkRateLimit(()=>{this.available=!0,this._startIdleTimer(),this.emit("available")})}_startIdleTimer(){if(!(!this.options.idleTimeout||this.options.idleTimeout<0)){if(this._idleTimer&&typeof this._idleTimer.refresh=="function"){this._idleTimer.refresh();return}clearTimeout(this._idleTimer),this._idleTimer=setTimeout(()=>{this.available&&(this.logger.debug({tnx:"pool",cid:this.id},"Closing connection #%s after it was idle for %sms",this.id,this.options.idleTimeout),this.available=!1,this.connection.quit())},this.options.idleTimeout),typeof this._idleTimer.unref=="function"&&this._idleTimer.unref()}}_stopIdleTimer(){clearTimeout(this._idleTimer),this._idleTimer=!1}close(){this._connected=!1,this._stopIdleTimer(),this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.connection&&this.connection.close(),this.emit("close")}};var Nm={126:{description:"126 Mail (NetEase)",host:"smtp.126.com",port:465,secure:!0},163:{description:"163 Mail (NetEase)",host:"smtp.163.com",port:465,secure:!0},"1und1":{description:"1&1 Mail (German hosting provider)",host:"smtp.1und1.de",port:465,secure:!0,authMethod:"LOGIN"},Aliyun:{description:"Alibaba Cloud Mail",domains:["aliyun.com"],host:"smtp.aliyun.com",port:465,secure:!0},AliyunQiye:{description:"Alibaba Cloud Enterprise Mail",host:"smtp.qiye.aliyun.com",port:465,secure:!0},AOL:{description:"AOL Mail",domains:["aol.com"],host:"smtp.aol.com",port:587},Aruba:{description:"Aruba PEC (Italian email provider)",domains:["aruba.it","pec.aruba.it"],aliases:["Aruba PEC"],host:"smtps.aruba.it",port:465,secure:!0,authMethod:"LOGIN"},Bluewin:{description:"Bluewin (Swiss email provider)",host:"smtpauths.bluewin.ch",domains:["bluewin.ch"],port:465},BOL:{description:"BOL Mail (Brazilian provider)",domains:["bol.com.br"],host:"smtp.bol.com.br",port:587,requireTLS:!0},DebugMail:{description:"DebugMail (email testing service)",host:"debugmail.io",port:25},Disroot:{description:"Disroot (privacy-focused provider)",domains:["disroot.org"],host:"disroot.org",port:587,secure:!1,authMethod:"LOGIN"},DynectEmail:{description:"Dyn Email Delivery",aliases:["Dynect"],host:"smtp.dynect.net",port:25},ElasticEmail:{description:"Elastic Email",aliases:["Elastic Email"],host:"smtp.elasticemail.com",port:465,secure:!0},Ethereal:{description:"Ethereal Email (email testing service)",aliases:["ethereal.email"],host:"smtp.ethereal.email",port:587},FastMail:{description:"FastMail",domains:["fastmail.com","fastmail.fm"],host:"smtp.fastmail.com",port:465,secure:!0},"Feishu Mail":{description:"Feishu Mail (Lark)",aliases:["Feishu","FeishuMail"],domains:["www.feishu.cn"],host:"smtp.feishu.cn",port:465,secure:!0},"Forward Email":{description:"Forward Email (email forwarding service)",aliases:["FE","ForwardEmail"],domains:["forwardemail.net"],host:"smtp.forwardemail.net",port:465,secure:!0},GandiMail:{description:"Gandi Mail",aliases:["Gandi","Gandi Mail"],host:"mail.gandi.net",port:587},Gmail:{description:"Gmail",aliases:["Google Mail"],domains:["gmail.com","googlemail.com"],host:"smtp.gmail.com",port:465,secure:!0},GmailWorkspace:{description:"Gmail Workspace",aliases:["Google Workspace Mail"],host:"smtp-relay.gmail.com",port:465,secure:!0},GMX:{description:"GMX Mail",domains:["gmx.com","gmx.net","gmx.de"],host:"mail.gmx.com",port:587},Godaddy:{description:"GoDaddy Email (US)",host:"smtpout.secureserver.net",port:25},GodaddyAsia:{description:"GoDaddy Email (Asia)",host:"smtp.asia.secureserver.net",port:25},GodaddyEurope:{description:"GoDaddy Email (Europe)",host:"smtp.europe.secureserver.net",port:25},"hot.ee":{description:"Hot.ee (Estonian email provider)",host:"mail.hot.ee"},Hotmail:{description:"Outlook.com / Hotmail",aliases:["Outlook","Outlook.com","Hotmail.com"],domains:["hotmail.com","outlook.com"],host:"smtp-mail.outlook.com",port:587},iCloud:{description:"iCloud Mail",aliases:["Me","Mac"],domains:["icloud.com","me.com","mac.com"],host:"smtp.mail.me.com",port:587},Infomaniak:{description:"Infomaniak Mail (Swiss hosting provider)",host:"mail.infomaniak.com",domains:["ik.me","ikmail.com","etik.com"],port:587},KolabNow:{description:"KolabNow (secure email service)",domains:["kolabnow.com"],aliases:["Kolab"],host:"smtp.kolabnow.com",port:465,secure:!0,authMethod:"LOGIN"},Loopia:{description:"Loopia (Swedish hosting provider)",host:"mailcluster.loopia.se",port:465},Loops:{description:"Loops",host:"smtp.loops.so",port:587},"mail.ee":{description:"Mail.ee (Estonian email provider)",host:"smtp.mail.ee"},"Mail.ru":{description:"Mail.ru",host:"smtp.mail.ru",port:465,secure:!0},"Mailcatch.app":{description:"Mailcatch (email testing service)",host:"sandbox-smtp.mailcatch.app",port:2525},Maildev:{description:"MailDev (local email testing)",port:1025,ignoreTLS:!0},MailerSend:{description:"MailerSend",host:"smtp.mailersend.net",port:587},Mailgun:{description:"Mailgun",host:"smtp.mailgun.org",port:465,secure:!0},Mailjet:{description:"Mailjet",host:"in.mailjet.com",port:587},Mailosaur:{description:"Mailosaur (email testing service)",host:"mailosaur.io",port:25},MailSenpai:{description:"MailSenpai (SMTP Senpai, EU)",host:"relay.mailsenpai.com",port:2525,secure:!1},Mailtrap:{description:"Mailtrap",host:"live.smtp.mailtrap.io",port:587},Mandrill:{description:"Mandrill (by Mailchimp)",host:"smtp.mandrillapp.com",port:587},Naver:{description:"Naver Mail (Korean email provider)",host:"smtp.naver.com",port:587},OhMySMTP:{description:"OhMySMTP (email delivery service)",host:"smtp.ohmysmtp.com",port:587,secure:!1},One:{description:"One.com Email",host:"send.one.com",port:465,secure:!0},OpenMailBox:{description:"OpenMailBox",aliases:["OMB","openmailbox.org"],host:"smtp.openmailbox.org",port:465,secure:!0},Outlook365:{description:"Microsoft 365 / Office 365",host:"smtp.office365.com",port:587,secure:!1},Postmark:{description:"Postmark",aliases:["PostmarkApp"],host:"smtp.postmarkapp.com",port:2525},Proton:{description:"Proton Mail",aliases:["ProtonMail","Proton.me","Protonmail.com","Protonmail.ch"],domains:["proton.me","protonmail.com","pm.me","protonmail.ch"],host:"smtp.protonmail.ch",port:587,requireTLS:!0},"qiye.aliyun":{description:"Alibaba Mail Enterprise Edition",host:"smtp.mxhichina.com",port:"465",secure:!0},QQ:{description:"QQ Mail",domains:["qq.com"],host:"smtp.qq.com",port:465,secure:!0},QQex:{description:"QQ Enterprise Mail",aliases:["QQ Enterprise"],domains:["exmail.qq.com"],host:"smtp.exmail.qq.com",port:465,secure:!0},Resend:{description:"Resend",host:"smtp.resend.com",port:465,secure:!0},Runbox:{description:"Runbox (Norwegian email provider)",domains:["runbox.com"],host:"smtp.runbox.com",port:465,secure:!0},SendCloud:{description:"SendCloud (Chinese email delivery)",host:"smtp.sendcloud.net",port:2525},SendGrid:{description:"SendGrid",host:"smtp.sendgrid.net",port:587},SendinBlue:{description:"Brevo (formerly Sendinblue)",aliases:["Brevo"],host:"smtp-relay.brevo.com",port:587},SendPulse:{description:"SendPulse",host:"smtp-pulse.com",port:465,secure:!0},SES:{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-1":{description:"AWS SES Asia Pacific (Tokyo)",host:"email-smtp.ap-northeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-2":{description:"AWS SES Asia Pacific (Seoul)",host:"email-smtp.ap-northeast-2.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-3":{description:"AWS SES Asia Pacific (Osaka)",host:"email-smtp.ap-northeast-3.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTH-1":{description:"AWS SES Asia Pacific (Mumbai)",host:"email-smtp.ap-south-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-1":{description:"AWS SES Asia Pacific (Singapore)",host:"email-smtp.ap-southeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-2":{description:"AWS SES Asia Pacific (Sydney)",host:"email-smtp.ap-southeast-2.amazonaws.com",port:465,secure:!0},"SES-CA-CENTRAL-1":{description:"AWS SES Canada (Central)",host:"email-smtp.ca-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-CENTRAL-1":{description:"AWS SES Europe (Frankfurt)",host:"email-smtp.eu-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-NORTH-1":{description:"AWS SES Europe (Stockholm)",host:"email-smtp.eu-north-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-1":{description:"AWS SES Europe (Ireland)",host:"email-smtp.eu-west-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-2":{description:"AWS SES Europe (London)",host:"email-smtp.eu-west-2.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-3":{description:"AWS SES Europe (Paris)",host:"email-smtp.eu-west-3.amazonaws.com",port:465,secure:!0},"SES-SA-EAST-1":{description:"AWS SES South America (S\xE3o Paulo)",host:"email-smtp.sa-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-1":{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-2":{description:"AWS SES US East (Ohio)",host:"email-smtp.us-east-2.amazonaws.com",port:465,secure:!0},"SES-US-GOV-EAST-1":{description:"AWS SES GovCloud (US-East)",host:"email-smtp.us-gov-east-1.amazonaws.com",port:465,secure:!0},"SES-US-GOV-WEST-1":{description:"AWS SES GovCloud (US-West)",host:"email-smtp.us-gov-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-1":{description:"AWS SES US West (N. California)",host:"email-smtp.us-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-2":{description:"AWS SES US West (Oregon)",host:"email-smtp.us-west-2.amazonaws.com",port:465,secure:!0},Seznam:{description:"Seznam Email (Czech email provider)",aliases:["Seznam Email"],domains:["seznam.cz","email.cz","post.cz","spoluzaci.cz"],host:"smtp.seznam.cz",port:465,secure:!0},SMTP2GO:{description:"SMTP2GO",host:"mail.smtp2go.com",port:2525},Sparkpost:{description:"SparkPost",aliases:["SparkPost","SparkPost Mail"],domains:["sparkpost.com"],host:"smtp.sparkpostmail.com",port:587,secure:!1},Tipimail:{description:"Tipimail (email delivery service)",host:"smtp.tipimail.com",port:587},TurboSMTP:{description:"TurboSMTP",host:"pro.turbo-smtp.com",port:465,secure:!0},"TurboSMTP-EU":{description:"TurboSMTP (EU region)",host:"pro.eu.turbo-smtp.com",port:465,secure:!0},Tutanota:{description:"Tutanota (Tuta Mail)",domains:["tutanota.com","tuta.com","tutanota.de","tuta.io"],host:"smtp.tutanota.com",port:465,secure:!0},Yahoo:{description:"Yahoo Mail",domains:["yahoo.com"],host:"smtp.mail.yahoo.com",port:465,secure:!0},Yandex:{description:"Yandex Mail",domains:["yandex.ru"],host:"smtp.yandex.ru",port:465,secure:!0},Zimbra:{description:"Zimbra Mail Server",aliases:["Zimbra Collaboration"],host:"smtp.zimbra.com",port:587,requireTLS:!0},Zoho:{description:"Zoho Mail",host:"smtp.zoho.com",port:465,secure:!0,authMethod:"LOGIN"}};var sd={};Object.keys(Nm).forEach(t=>{let e=Nm[t],r=YR(e);sd[ad(t)]=r,[].concat(e.aliases||[]).forEach(n=>{sd[ad(n)]=r}),[].concat(e.domains||[]).forEach(n=>{sd[ad(n)]=r})});function ad(t){return t.replace(/[^a-zA-Z0-9.-]/g,"").toLowerCase()}function YR(t){let e={};return Object.keys(t).forEach(r=>{["domains","aliases"].includes(r)||(e[r]=t[r])}),e}function ic(t){return t=ad(t.split("@").pop()),sd[t]||!1}var QR=50,ZR=2e3,Rm=class extends XR{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=gs(e.url),n=n||r.service),this.options=Or(!1,e,r,n&&ic(n)),this.options.maxConnections=this.options.maxConnections||5,this.options.maxMessages=this.options.maxMessages||100,this.options.maxRequeues=typeof this.options.maxRequeues=="number"?this.options.maxRequeues:5,this.options.idleTimeout=typeof this.options.idleTimeout=="number"?this.options.idleTimeout:240*1e3,this.logger=ft(this.options,{component:this.options.component||"smtp-pool"}),this.name="SMTP (pool)",this.version=Xe+"[client:"+Xe+"]",this._rateLimit={counter:0,timeout:null,waiting:[],checkpoint:!1,delta:Number(this.options.rateDelta)||1e3,limit:Number(this.options.rateLimit)||0},this._closed=!1,this._queue=[],this._connections=[],this._connectionCounter=0,this.idling=!0,setImmediate(()=>{this.idling&&this.emit("idle")})}getSocket(e,r){setImmediate(()=>r(null,!1))}send(e,r){if(this._closed){let n=new Error("Connection pool was closed");return n.code=Hu,setImmediate(()=>r(n)),!1}return this._queue.push({mail:e,requeueAttempts:0,callback:r}),this.idling&&this._queue.length>=this.options.maxConnections&&(this.idling=!1),setImmediate(()=>this._processMessages()),!0}close(){let e,r=this._connections.length;if(this._closed=!0,this._clearRateLimit(),!r&&!this._queue.length)return;for(let i=r-1;i>=0;i--)this._connections[i]&&this._connections[i].available&&(e=this._connections[i],e.close(),this.logger.info({tnx:"connection",cid:e.id,action:"removed"},"Connection #%s removed",e.id));if(r&&!this._connections.length&&this.logger.debug({tnx:"connection"},"All connections removed"),!this._queue.length)return;let n=()=>{if(!this._queue.length){this.logger.debug({tnx:"connection"},"Pending queue entries cleared");return}let i=this._queue.shift();if(i&&typeof i.callback=="function")try{i.callback(new Error("Connection pool was closed"))}catch(o){this.logger.error({err:o,tnx:"callback"},"Callback error: %s",o.message)}setImmediate(n)};setImmediate(n)}_processMessages(){if(this._closed)return;if(!this._queue.length){this.idling||(this.idling=!0,this.emit("idle"));return}let e=this._connections.find(n=>n.available);if(!e&&this._connections.length<this.options.maxConnections&&(e=this._createConnection()),!e){this.idling=!1;return}!this.idling&&this._queue.length<this.options.maxConnections&&(this.idling=!0,this.emit("idle"));let r=e.queueEntry=this._queue.shift();r.messageId=(e.queueEntry.mail.message.getHeader("message-id")||"").replace(/[<>\s]/g,""),e.available=!1,this.logger.debug({tnx:"pool",cid:e.id,messageId:r.messageId,action:"assign"},"Assigned message <%s> to #%s (%s)",r.messageId,e.id,e.messages+1),this._rateLimit.limit&&(this._rateLimit.counter++,this._rateLimit.checkpoint||(this._rateLimit.checkpoint=Date.now())),e.send(r.mail,(n,i)=>{if(r===e.queueEntry){try{r.callback(n,i)}catch(o){this.logger.error({err:o,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,o.message)}e.queueEntry=!1}})}_createConnection(){let e=new As(this);return e.id=++this._connectionCounter,this.logger.info({tnx:"pool",cid:e.id,action:"conection"},"Created new pool resource #%s",e.id),e.on("available",()=>{this.logger.debug({tnx:"connection",cid:e.id,action:"available"},"Connection #%s became available",e.id),this._closed?this.close():this._processMessages()}),e.once("error",r=>{if(r.code!==Bu?this.logger.warn({err:r,tnx:"pool",cid:e.id},"Pool Error for #%s: %s",e.id,r.message):this.logger.debug({tnx:"pool",cid:e.id,action:"maxlimit"},"Max messages limit exchausted for #%s",e.id),e.queueEntry){try{e.queueEntry.callback(r)}catch(n){this.logger.error({err:n,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,n.message)}e.queueEntry=!1}this._removeConnection(e),this._continueProcessing()}),e.once("close",()=>{this.logger.info({tnx:"connection",cid:e.id,action:"closed"},"Connection #%s was closed",e.id),this._removeConnection(e),e.queueEntry?setTimeout(()=>{let r=0;e.queueEntry&&(this._shouldRequeuOnConnectionClose(e.queueEntry)?r=this._requeueEntryOnConnectionClose(e):this._failDeliveryOnConnectionClose(e)),r?setTimeout(()=>this._continueProcessing(),r):this._continueProcessing()},50):(!this._closed&&this.idling&&!this._connections.length&&this.emit("clear"),this._continueProcessing())}),this._connections.push(e),e}_shouldRequeuOnConnectionClose(e){return this.options.maxRequeues<0?!0:e.requeueAttempts<this.options.maxRequeues}_failDeliveryOnConnectionClose(e){if(e.queueEntry&&e.queueEntry.callback){try{let r=new Error("Reached maximum number of retries after connection was closed");r.code=Hu,e.queueEntry.callback(r)}catch(r){this.logger.error({err:r,tnx:"callback",messageId:e.queueEntry.messageId,cid:e.id},"Callback error for #%s: %s",e.id,r.message)}e.queueEntry=!1}}_requeueEntryOnConnectionClose(e){let r=Math.min(QR*2**e.queueEntry.requeueAttempts,ZR);return e.queueEntry.requeueAttempts+=1,this.logger.debug({tnx:"pool",cid:e.id,messageId:e.queueEntry.messageId,action:"requeue"},"Re-queued message <%s> for #%s. Attempt: #%s",e.queueEntry.messageId,e.id,e.queueEntry.requeueAttempts),this._queue.unshift(e.queueEntry),e.queueEntry=!1,r}_continueProcessing(){this._closed?this.close():setTimeout(()=>this._processMessages(),100)}_removeConnection(e){let r=this._connections.indexOf(e);r!==-1&&this._connections.splice(r,1)}_checkRateLimit(e){if(!this._rateLimit.limit)return e();let r=Date.now();if(this._rateLimit.counter<this._rateLimit.limit)return e();if(this._rateLimit.waiting.push(e),this._rateLimit.checkpoint<=r-this._rateLimit.delta)return this._clearRateLimit();this._rateLimit.timeout||(this._rateLimit.timeout=setTimeout(()=>this._clearRateLimit(),this._rateLimit.delta-(r-this._rateLimit.checkpoint)),this._rateLimit.checkpoint=r)}_clearRateLimit(){for(clearTimeout(this._rateLimit.timeout),this._rateLimit.timeout=null,this._rateLimit.counter=0,this._rateLimit.checkpoint=!1;this._rateLimit.waiting.length;){let e=this._rateLimit.waiting.shift();setImmediate(e)}}isIdle(){return this.idling}verify(e){let r;e||(r=new Promise((s,a)=>{e=Mt(s,a)}));let n=e,i=new As(this).auth,o=Date.now();return this.getSocket(Object.assign({},this.options,{connectStartedAt:o}),(s,a)=>{if(s)return n(s);let c=this.options;a&&a.connection&&(this.logger.info({tnx:"proxy",remoteAddress:a.connection.remoteAddress,remotePort:a.connection.remotePort,destHost:c.host||"",destPort:c.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",a.connection.remoteAddress,a.connection.remotePort,c.host||"",c.port||""),c=Object.assign(Or(!1,c),a));let l=new zi(c);l._connectStartedAt=o;let u=!1;l.once("error",f=>{if(!u)return u=!0,l.close(),n(f)}),l.once("end",()=>{if(!u)return u=!0,n(new Error("Connection closed"))});let p=()=>{if(!u)return u=!0,l.quit(),n(null,!0)};l.connect(f=>{if(!u){if(f)return u=!0,l.close(),n(f);if(i&&(l.allowsAuth||c.forceAuth))l.login(i,m=>{if(!u){if(m)return u=!0,l.close(),n(m);p()}});else if(!i&&l.allowsAuth&&c.forceAuth){let m=new Error("Authentication info was not provided");return m.code=Vu,u=!0,l.close(),n(m)}else p()}})}),r}},ZA=Rm;import{EventEmitter as e0}from"node:events";var Om=class extends e0{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=gs(e.url),n=n||r.service),this.options=Or(!1,e,r,n&&ic(n)),this.logger=ft(this.options,{component:this.options.component||"smtp-transport"}),this.name="SMTP",this.version=Xe+"[client:"+Xe+"]",this.options.auth&&(this.auth=this.getAuth({}))}getSocket(e,r){setImmediate(()=>r(null,!1))}getAuth(e){if(!e)return this.auth&&this.auth.oauth2&&this.mailer&&(this.auth.oauth2.provisionCallback=this.mailer.get("oauth2_provision_cb")||this.auth.oauth2.provisionCallback),this.auth;let r=Object.assign({},this.options.auth&&typeof this.options.auth=="object"?this.options.auth:{},typeof e=="object"?e:{});if(Object.keys(r).length===0)return!1;switch((r.type||"").toString().toUpperCase()){case"OAUTH2":{if(!r.service&&!r.user)return!1;let n=new od(r,this.logger);return n.provisionCallback=this.mailer&&this.mailer.get("oauth2_provision_cb")||n.provisionCallback,n.on("token",i=>this.mailer.emit("token",i)),n.on("error",i=>this.emit("error",i)),{type:"OAUTH2",user:r.user,oauth2:n,method:"XOAUTH2"}}default:return{type:(r.type||"").toString().toUpperCase()||"LOGIN",user:r.user,credentials:{user:r.user||"",pass:r.pass,options:r.options},method:(r.method||"").trim().toUpperCase()||this.options.authMethod||!1}}}send(e,r){let n=Date.now();this.getSocket(Object.assign({},this.options,{connectStartedAt:n}),(i,o)=>{if(i)return r(i);let s=!1,a=this.options;o&&o.connection&&(this.logger.info({tnx:"proxy",remoteAddress:o.connection.remoteAddress,remotePort:o.connection.remotePort,destHost:a.host||"",destPort:a.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",o.connection.remoteAddress,o.connection.remotePort,a.host||"",a.port||""),a=Object.assign(Or(!1,a),o));let c=new zi(a);c._connectStartedAt=n;let l,u=()=>{l&&l!==this.auth&&l.oauth2&&l.oauth2.removeAllListeners(),l=null};c.once("error",f=>{if(!s)return s=!0,u(),c.close(),r(f)});let p=()=>{let f=e.message.getEnvelope(),m=e.message.messageId(),E=[].concat(f.to||[]);E.length>3&&E.push("...and "+E.splice(2).length+" more"),e.data.dsn&&(f.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(f.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.logger.info({tnx:"send",messageId:m},"Sending message %s to <%s>",m,E.join(", ")),c.send(f,e.message.createReadStream(),(v,N)=>{if(!s){if(s=!0,u(),c.close(),v)return this.logger.error({err:v,tnx:"send"},"Send error for %s: %s",m,v.message),r(v);N.envelope={from:f.from,to:f.to},N.messageId=m;try{return r(null,N)}catch(S){this.logger.error({err:S,tnx:"callback"},"Callback error for %s: %s",m,S.message)}}})};c.connect(f=>{if(!s){if(f)return s=!0,c.close(),r(f);l=this.getAuth(e.data.auth),l&&(c.allowsAuth||a.forceAuth)?c.login(l,m=>{if(u(),!s){if(m)return s=!0,c.close(),r(m);p()}}):p()}})})}verify(e){let r;e||(r=new Promise((o,s)=>{e=Mt(o,s)}));let n=e,i=Date.now();return this.getSocket(Object.assign({},this.options,{connectStartedAt:i}),(o,s)=>{if(o)return n(o);let a=this.options;s&&s.connection&&(this.logger.info({tnx:"proxy",remoteAddress:s.connection.remoteAddress,remotePort:s.connection.remotePort,destHost:a.host||"",destPort:a.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",s.connection.remoteAddress,s.connection.remotePort,a.host||"",a.port||""),a=Object.assign(Or(!1,a),s));let c=new zi(a);c._connectStartedAt=i;let l=!1,u,p=()=>{u&&u!==this.auth&&u.oauth2&&u.oauth2.removeAllListeners(),u=null};c.once("error",m=>{if(!l)return l=!0,p(),c.close(),n(m)}),c.once("end",()=>{if(!l)return l=!0,p(),n(new Error("Connection closed"))});let f=()=>{if(!l)return l=!0,p(),c.quit(),n(null,!0)};c.connect(m=>{if(!l){if(m)return l=!0,c.close(),n(m);if(u=this.getAuth({}),u&&(c.allowsAuth||a.forceAuth))c.login(u,E=>{if(p(),!l){if(E)return l=!0,c.close(),n(E);f()}});else if(!u&&c.allowsAuth&&a.forceAuth){let E=new Error("Authentication info was not provided");return E.code=Vu,l=!0,p(),c.close(),n(E)}else f()}})}),r}close(){this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.emit("close")}},eT=Om;import{spawn as t0}from"node:child_process";import{pipeline as r0}from"node:stream";var n0=1e3,km=class{constructor(e){e=e||{},this._spawn=t0,this.options=e,this.name="Sendmail",this.version=Xe,this.path="sendmail",this.args=!1,this.logger=ft(this.options,{component:this.options.component||"sendmail"}),typeof e=="string"?this.path=e:typeof e=="object"&&(e.path&&(this.path=e.path),Array.isArray(e.args)&&(this.args=e.args)),this.winbreak=["win","windows","dos",`\r
+`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o;if([].concat(n.from||[]).concat(n.to||[]).some(u=>/^"?-/.test(u))){let u=new Error("Can not send mail. Invalid envelope addresses.");return u.code=ju,r(u)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=u=>{if(!o&&(o=!0,typeof r=="function"))return u?r(u):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(u){return this.logger.error({err:u,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",u.message),c(u)}if(l){let u,p=()=>!!u&&u.readableEnded,f=null,m=()=>{u&&!p()&&u.destroy()},E=R=>{m(),c(R)};l.on("error",R=>{this.logger.error({err:R,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,R.message),E(R)});let v=(R,M)=>{let K=null;if(R?K=new Error(R===127?"Sendmail command not found, process exited with code "+R:"Sendmail exited with code "+R):M?K=new Error("Sendmail was terminated by "+M):p()?f&&(K=f):K=new Error("Sendmail exited before the message was written"),!K)return c();K.code=K.code||ju,this.logger.error({err:K,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,K.message),E(K)};l.once("exit",v),l.once("close",v),l.stdin.on("error",R=>{if(this.logger.error({err:R,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,R.message),f)return;f=R,m();let M=setTimeout(()=>E(R),n0);l.once("exit",()=>clearTimeout(M))});let N=[].concat(n.to||[]);N.length>3&&N.push("...and "+N.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,N.join(", "));let S=e.message.createReadStream();u=S,this.options.newline&&(u=r0(S,this.winbreak?new kr:new wn,()=>!1)),u.once("error",R=>{this.logger.error({err:R,tnx:"stdin",messageId:i},"Error occurred when generating message %s. %s",i,R.message),l.kill("SIGINT"),c(R)}),u.pipe(l.stdin)}else{let u=new Error("sendmail was not found");return u.code=ju,c(u)}}},tT=km;var Cm=class{constructor(e){e=e||{},this.options=e,this.name="StreamTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"stream-transport"}),this.winbreak=["win","windows","dos",`\r
+`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,o.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let s;try{if(s=e.message.createReadStream(),this.options.newline){let l=s;s=l.pipe(this.winbreak?new kr:new wn),l.once("error",u=>s.emit("error",u))}}catch(l){return this.logger.error({err:l,tnx:"send",messageId:i},"Creating send stream failed for %s. %s",i,l.message),r(l)}if(!this.options.buffer)return s.once("error",l=>{this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message)}),r(null,{envelope:n,messageId:i,message:s});let a=[],c=0;s.on("readable",()=>{let l;for(;(l=s.read())!==null;)a.push(l),c+=l.length}),s.once("error",l=>(this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message),r(l))),s.on("end",()=>r(null,{envelope:n,messageId:i,message:Buffer.concat(a,c)}))})}},rT=Cm;var Dm=class{constructor(e){e=e||{},this.options=e,this.name="JSONTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"json-transport"})}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Composing JSON structure of %s to <%s>",i,o.join(", ")),setImmediate(()=>{e.normalize((s,a)=>s?(this.logger.error({err:s,tnx:"send",messageId:i},"Failed building JSON structure for %s. %s",i,s.message),r(s)):(delete a.envelope,delete a.normalizedHeaders,r(null,{envelope:n,messageId:i,message:this.options.skipEncoding?a:JSON.stringify(a)})))})}},nT=Dm;import i0 from"node:events";function Pm(t){return t&&typeof t=="object"&&!t.code&&(t.code=Qv),t}var Um=class extends i0{constructor(e){if(super(),!e||!e.SES||!e.SES.sesClient){let r=new Error("Missing SES configuration, expecting { sesClient, SendEmailCommand } from @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw r.code=Es,r}this.options=e,this.ses=this.options.SES,this.name="SESTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"ses-transport"})}getRegion(e){if(this.ses.sesClient.config&&typeof this.ses.sesClient.config.region=="function"){this.ses.sesClient.config.region().then(r=>e(null,r),r=>e(r));return}return e(null,!1)}send(e,r){let n=e.message._headers.find(c=>/^from$/i.test(c.key));if(n){let c=new Qr("text/plain");n=c._convertAddresses(c._parseAddresses(n.value))}let i=e.message.getEnvelope(),o=e.message.messageId(),s=[].concat(i.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:o},"Sending message %s to <%s>",o,s.join(", "));let a=c=>{e.data._dkim||(e.data._dkim={}),e.data._dkim.skipFields&&typeof e.data._dkim.skipFields=="string"?e.data._dkim.skipFields+=":date:message-id":e.data._dkim.skipFields="date:message-id";let l=e.message.createReadStream(),u=l.pipe(new kr),p=[],f=0;u.on("readable",()=>{let m;for(;(m=u.read())!==null;)p.push(m),f+=m.length}),l.once("error",m=>u.emit("error",m)),u.once("error",m=>c(m)),u.once("end",()=>c(null,Buffer.concat(p,f)))};setImmediate(()=>a((c,l)=>{if(c)return this.logger.error({err:c,tnx:"send",messageId:o},"Failed creating message for %s. %s",o,c.message),r(c);let u=et({Content:{Raw:{Data:l}},FromEmailAddress:n||i.from,Destination:{ToAddresses:i.to}},e.data.ses);this.getRegion((p,f)=>{(p||!f)&&(f="us-east-1");let m;try{let E=new this.ses.SendEmailCommand(u);m=this.ses.sesClient.send(E)}catch(E){Pm(E),this.logger.error({err:E,tnx:"send"},"Send error for %s: %s",o,E.message),setImmediate(()=>r(E));return}m.then(E=>{f==="us-east-1"&&(f="email");let v={envelope:{from:i.from,to:i.to},messageId:"<"+E.MessageId+(/@/.test(E.MessageId)?"":"@"+f+".amazonses.com")+">",response:E.MessageId,raw:l};setImmediate(()=>r(null,v))}).catch(E=>{Pm(E),this.logger.error({err:E,tnx:"send"},"Send error for %s: %s",o,E.message),setImmediate(()=>r(E))})})}))}verify(e){let r;e||(r=new Promise((s,a)=>{e=Mt(s,a)}));let n=e,i=s=>s&&!["InvalidParameterValue","MessageRejected"].includes(s.code||s.Code||s.name)?n(Pm(s)):n(null,!0),o={Content:{Raw:{Data:Buffer.from(`From: <invalid@invalid>\r
 To: <invalid@invalid>\r
  Subject: Invalid\r
 \r
-Invalid`)}},FromEmailAddress:"invalid@invalid",Destination:{ToAddresses:["invalid@invalid"]}};return this.getRegion(()=>{let s;try{let o=new this.ses.SendEmailCommand(i);s=this.ses.sesClient.send(o)}catch(o){setImmediate(()=>n(o));return}s.then(()=>setImmediate(()=>n(null))).catch(o=>setImmediate(()=>n(o)))}),r}};oT.exports=nm});var dT=me((FZ,gu)=>{"use strict";var a0=bA(),uT=kt(),c0=WA(),l0=QA(),u0=eT(),d0=rT(),p0=iT(),f0=aT(),m0=Xt(),h0=ba(),cT=xr(),E0=(process.env.ETHEREAL_API||"https://api.nodemailer.com").replace(/\/+$/,""),y0=(process.env.ETHEREAL_WEB||"https://ethereal.email").replace(/\/+$/,""),lT=(process.env.ETHEREAL_API_KEY||"").replace(/\s*/g,"")||null,g0=["true","yes","y","1"].includes((process.env.ETHEREAL_CACHE||"yes").toString().trim().toLowerCase()),Da=!1;gu.exports.createTransport=function(t,e){let r;if(typeof t=="object"&&typeof t.send!="function"||typeof t=="string"&&/^(smtps?|direct):/i.test(t)){let n=typeof t=="string"?t:t.url;if(n?r=uT.parseConnectionUrl(n):r=t,r.pool)t=new c0(r);else if(r.sendmail)t=new u0(r);else if(r.streamTransport)t=new d0(r);else if(r.jsonTransport)t=new p0(r);else if(r.SES){if(r.SES.ses&&r.SES.aws){let i=new Error("Using legacy SES configuration, expecting @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw i.code=m0.ECONFIG,i}t=new f0(r)}else t=new l0(r)}return new a0(t,r,e)};gu.exports.createTestAccount=function(t,e){let r;if(!e&&typeof t=="function"&&(e=t,t=!1),e||(r=new Promise((l,d)=>{e=uT.callbackPromise(l,d)})),g0&&Da)return setImmediate(()=>e(null,Da)),r;t=t||E0;let n=[],i=0,s={},o={requestor:cT.name,version:cT.version};lT&&(s.Authorization="Bearer "+lT);let a={contentType:"application/json",method:"POST",headers:s,body:Buffer.from(JSON.stringify(o))};/^https:/i.test(t)&&(a.tls={rejectUnauthorized:!0});let c=h0(t+"/user",a);return c.on("readable",()=>{let l;for(;(l=c.read())!==null;)n.push(l),i+=l.length}),c.once("error",l=>e(l)),c.once("end",()=>{let l=Buffer.concat(n,i),d;try{d=JSON.parse(l.toString())}catch(p){return e(p)}if(d.status!=="success"||d.error)return e(new Error(d.error||"Request failed"));delete d.status,Da=d,e(null,Da)}),r};gu.exports.getTestMessageUrl=function(t){if(!t||!t.response)return!1;let e=new Map,r=t.response.toString();if(r.length>2&&r.charAt(r.length-1)==="]"){let n=r.indexOf("[",r.lastIndexOf("]",r.length-2)+1);n>=0&&n<r.length-2&&r.substring(n+1,r.length-1).replace(/\b([A-Z0-9]+)=([^\s]+)/g,(s,o,a)=>{e.set(o,a)})}return e.has("STATUS")&&e.has("MSGID")?(Da.web||y0)+"/message/"+e.get("MSGID"):!1}});var e_,t_=Q(()=>{e_="x-hono-already-sent"});var r_,n_=Q(()=>{r_=t=>((...e)=>{if(typeof e[0]=="function"){let[r,n]=e;return async function(s,o){let a=await r(s),c=await t(s,a,n);if(c)return c;await o()}}else{let[r,n,i]=e;return(async()=>{let s=await t(r,n,i);if(!s)throw new Error("Failed to upgrade WebSocket");return s})()}})});var k_={};cc(k_,{RequestError:()=>Nr,createAdaptorServer:()=>O_,getRequestListener:()=>S_,serve:()=>Qk,upgradeWebSocket:()=>Xk});import{STATUS_CODES as dk,createServer as pk}from"node:http";import{Http2ServerRequest as ti,constants as fk}from"node:http2";import{Readable as i_}from"node:stream";async function Kk(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function T_(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(o,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function s(){t.read().then(o,i)}function o({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",s);else return t.read().then(o,i)}catch(l){i(l)}}}function d_(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:T_(t.getReader(),e)}var Nr,mk,hk,Cu,s_,o_,Lm,m_,Mm,h_,Ek,yk,gk,vk,Ak,Tk,oo,E_,_k,Ik,Rm,Om,y_,Km,a_,Pu,c_,xk,ri,mn,ao,sc,g_,v_,nc,km,Cm,ei,Du,En,l_,ic,Uu,oc,bk,Sk,wk,Nk,Rk,Ok,kk,Hm,Ck,u_,Dk,Wr,Pk,Zn,Dm,so,hn,Lu,$r,Uk,Lk,Mk,Pm,Mu,p_,Hk,Fk,__,Vk,Bk,jk,I_,Ku,Um,x_,b_,qk,S_,Gk,$k,Wk,w_,N_,zk,R_,f_,Jk,Yk,Xk,O_,Qk,C_=Q(()=>{t_();n_();Nr=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},mk=new Set(["age","authorization","content-length","content-type","etag","expires","from","host","if-modified-since","if-unmodified-since","last-modified","location","max-forwards","proxy-authorization","referer","retry-after","server","user-agent"]),hk=/^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/,Cu=t=>t===9||t===10||t===13||t===32,s_=t=>{if(!Cu(t.charCodeAt(0))&&!Cu(t.charCodeAt(t.length-1)))return t;let e=0,r=t.length;for(;e<r&&Cu(t.charCodeAt(e));)e++;for(;r>e&&Cu(t.charCodeAt(r-1));)r--;return t.slice(e,r)},o_=/[\0\r\n]/,Lm=globalThis.Headers,m_=(t,e=Lm)=>{let r=new e;for(let n=0;n<t.length;n+=2){let i=t[n];i.startsWith(":")||r.append(i,t[n+1])}return r},Mm=class{#e;#t;#r;#s;constructor(t){this.#e=t,t instanceof ti&&(this.#t=t.rawHeaders.slice())}get#i(){return this.#t??=this.#e.rawHeaders.slice()}get#n(){return this.#r||(this.#r=m_(this.#i),this.#t=void 0),this.#r}#a(t){if(typeof t=="string"){if(!hk.test(t))throw new TypeError(`Invalid header name: ${t}`);return t.toLowerCase()}}#o(t){let e=this.#e instanceof ti?void 0:this.#e.headers;if(!e||mk.has(t)||t==="set-cookie"||t==="__proto__")return;if(!Object.hasOwn(e,t))return null;let r=e[t];if(typeof r=="string"){let n=s_(r);return o_.test(n)?void 0:n}}#c(t,e){let r=e==="cookie"?"; ":", ",n=null;for(let i=0;i<t.length;i+=2){let s=t[i];if(s.length===e.length&&s.toLowerCase()===e){let o=s_(t[i+1]);if(o_.test(o)){this.#s=!0;return}n=n===null?o:n+r+o}}return n}append(t,e){this.#n.append(t,e)}delete(t){this.#n.delete(t)}get(t){let e=this.#a(t);if(e&&!this.#r&&!this.#s){let r=this.#o(e);if(r!==void 0)return r;let n=this.#c(this.#i,e);if(n!==void 0)return n}return this.#n.get(t)}has(t){let e=this.#a(t);if(e&&!this.#r&&!this.#s){let r=this.#o(e);if(r!==void 0)return r!==null;let n=this.#c(this.#i,e);if(n!==void 0)return n!==null}return this.#n.has(t)}set(t,e){this.#n.set(t,e)}getSetCookie(){return this.#n.getSetCookie()}keys(){return this.#n.keys()}values(){return this.#n.values()}entries(){return this.#n.entries()}forEach(t,e){this.#n.forEach((r,n)=>{t.call(e,r,n,this)})}[Symbol.iterator](){return this.entries()}};Object.defineProperty(Mm.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Headers (lightweight) ${r(Object.fromEntries(this),{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(Mm.prototype,Lm.prototype);h_=t=>globalThis.Headers===Lm?new Mm(t):m_(t.rawHeaders,globalThis.Headers),Ek=/^\/[!#$&-;=?-\[\]_a-z~]*$/,yk=/\/\.\.?(?:[/?#]|$)/,gk=/^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/,vk=(t,e,r)=>{let n=`${t}://${e}${r}`;if(gk.test(e)){if(r.length===0)return n+"/";if(r.charCodeAt(0)!==47)throw new Nr("Invalid URL");return!Ek.test(r)||yk.test(r)?new URL(n).href:n}else{let i=new URL(n);if(i.hostname.length!==e.length&&i.hostname!==(e.includes(":")?e.replace(/:\d+$/,""):e).toLowerCase())throw new Nr("Invalid host header");return i.href}},Ak=t=>t instanceof Nr?t:new Nr(t.message,{cause:t}),Tk=global.Request,oo=class extends Tk{constructor(t,e){if(typeof t=="object"&&ri in t){let r=e!==void 0&&"body"in e&&e.body!=null;if(t[En]&&!r)throw new TypeError("Cannot construct a Request with a Request object that has already been used.");t=t[ri]()}typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},E_=Symbol("wrapBodyStream"),_k=new Set(["latin1","binary","hex","base64","base64url"]),Ik=t=>t===null||_k.has(t),Rm=Symbol("bodyBufferedBeforeDisconnect"),Om=Symbol("bodyBufferedLengthBeforeDisconnect"),y_=(t,e)=>Buffer.isBuffer(t)?t:Buffer.from(t,e??"utf8"),Km=t=>!(t instanceof ti)&&!!t.complete&&!!t.readableAborted&&typeof t.read=="function"&&Ik(t.readableEncoding),a_=t=>{if(t.readableDidRead||!Km(t))return;let e=t;e[Om]??=t.readableLength},Pu=(t,e)=>{if(t.readableDidRead&&!e||!Km(t))return;let r=t;if(r[Rm]!==void 0)return r[Rm];let n,i=t.errored;if(i&&i.code!=="ECONNRESET")n=i;else if(r[Om]!==void 0&&t.readableLength!==r[Om])n=Uu();else{let s=e??[],o=t.read();o!==null&&s.push(y_(o,t.readableEncoding));let a=s.length===1?s[0]:Buffer.concat(s);n=a;let c=t.headers["content-length"];if(typeof c=="string"&&/^\d+$/.test(c)){let l=Number(c);Number.isSafeInteger(l)&&a.length!==l&&(n=Uu())}}return r[Rm]=n,n},c_=(t,e)=>{if(e instanceof Error){t.error(e);return}e.length>0&&t.enqueue(e),t.close()},xk=(t,e,r,n,i)=>{let s={method:t,headers:r,signal:i.signal};if(t==="TRACE"){s.method="GET";let o=new oo(e,s);return Object.defineProperty(o,"method",{get(){return"TRACE"}}),o}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)s.body=new ReadableStream({start(o){o.enqueue(n.rawBody),o.close()}});else if(n[E_]){let o;s.body=new ReadableStream({async pull(a){try{if(!o){let d=Pu(n);if(d!==void 0){c_(a,d);return}}o||=i_.toWeb(n).getReader();let{done:c,value:l}=await o.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else{let o=Pu(n);o!==void 0?s.body=new ReadableStream({start(a){c_(a,o)}}):s.body=i_.toWeb(n)}return new oo(e,s)},ri=Symbol("getRequestCache"),mn=Symbol("requestCache"),ao=Symbol("incomingKey"),sc=Symbol("urlKey"),g_=Symbol("methodKey"),v_=Symbol("headersKey"),nc=Symbol("abortControllerKey"),km=Symbol("getAbortController"),Cm=Symbol("abortRequest"),ei=Symbol("bodyBuffer"),Du=Symbol("bodyReadPromise"),En=Symbol("bodyConsumedDirectly"),l_=Symbol("bodyLockReader"),ic=Symbol("abortReason"),Uu=()=>new TypeError("Body is unusable"),oc=()=>Promise.reject(Uu()),bk=new TextDecoder,Sk=t=>{if(t[En])return oc();t[En]=!0},wk=t=>t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength),Nk=t=>(t[v_]||=h_(t[ao])).get("content-type")||"",Rk=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,Ok=t=>{if(typeof t!="string"||t.length===0)return"GET";switch(t){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"PATCH":case"POST":case"PUT":case"QUERY":return t}let e=t.toUpperCase();switch(e){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"POST":case"PUT":return e;default:return t}},kk=t=>{if(!Rk.test(t))return new TypeError(`'${t}' is not a valid HTTP method.`);let e=t.toUpperCase();if(e==="CONNECT"||e==="TRACK"||e==="TRACE"&&t!=="TRACE")return new TypeError(`'${t}' HTTP method is unsupported.`)},Hm=(t,e,r)=>{if(t[En])return oc();let n=t.method;if(n==="GET"||n==="HEAD")return t[ri]()[e]();let i=kk(n);if(i)return Promise.reject(i);if(t[mn]&&n!=="TRACE")return t[mn][e]();let s=Sk(t);if(s)return s;let o=Ck(t);if(o){let a=Promise.resolve(r(o,t));return t[ei]=void 0,a}return Dk(t).then(a=>{let c=r(a,t);return t[ei]=void 0,c})},Ck=t=>{let e=t[ao];if("rawBody"in e&&e.rawBody instanceof Buffer)return e.rawBody},u_=(t,e)=>{if(e.errored)return e.errored;let r=t[ic];return r!==void 0?r instanceof Error?r:new Error(String(r)):new Error("Client connection prematurely closed.")},Dk=t=>{if(t[ei])return Promise.resolve(t[ei]);if(t[Du])return t[Du];let e=t[ao];if(e.readableDidRead)return oc();let r=Pu(e);if(r!==void 0)return r instanceof Error?Promise.reject(r):(t[ei]=r,Promise.resolve(r));let n=new Promise((i,s)=>{let o=[],a=!1,c=_=>{a||(a=!0,g(),_())},l=_=>{let R=e.errored??_;return!Km(e)||R&&R.code!=="ECONNRESET"?!1:(c(()=>{let C=Pu(e,o);C instanceof Error?s(C):C===void 0?s(_??u_(t,e)):(t[ei]=C,i(C))}),!0)},d=_=>{o.push(y_(_,e.readableEncoding))},p=()=>{c(()=>{let _=o.length===1?o[0]:Buffer.concat(o);t[ei]=_,i(_)})},f=_=>{l(_)||c(()=>{s(_)})},h=()=>{if(e.readableEnded){p();return}l()||c(()=>{s(u_(t,e))})},g=()=>{e.off("data",d),e.off("end",p),e.off("error",f),e.off("close",h),t[Du]=void 0};e.on("data",d),e.on("end",p),e.on("error",f),e.on("close",h),queueMicrotask(()=>{a||(e.readableEnded?p():e.errored?f(e.errored):e.destroyed&&h())})});return t[Du]=n,n},Wr={get method(){return this[g_]},get url(){return this[sc]},get headers(){return this[v_]||=h_(this[ao])},[Cm](t){this[ic]===void 0&&(this[ic]=t);let e=this[nc];e&&!e.signal.aborted&&e.abort(t)},[km](){return this[nc]||=new AbortController,this[ic]!==void 0&&!this[nc].signal.aborted&&this[nc].abort(this[ic]),this[nc]},[ri](){let t=this[km]();if(this[mn])return this[mn];let e=this.method;if(this[En]&&!(e==="GET"||e==="HEAD")){this[ei]=void 0;let r={method:e==="TRACE"?"GET":e,headers:this.headers,signal:t.signal};e!=="TRACE"&&(r.body=new ReadableStream({start(i){i.close()}}),r.duplex="half");let n=new oo(this[sc],r);return e==="TRACE"&&Object.defineProperty(n,"method",{get(){return"TRACE"}}),this[mn]=n}return this[mn]=xk(this.method,this[sc],this.headers,this[ao],t)},get body(){if(!this[En])return this[ri]().body;let t=this[ri]();return!this[l_]&&t.body&&(this[l_]=t.body.getReader()),t.body},get bodyUsed(){return this[En]?!0:this[mn]?this[mn].bodyUsed:!1}};Object.defineProperty(Wr,"signal",{get(){return this[km]().signal}});["cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","keepalive"].forEach(t=>{Object.defineProperty(Wr,t,{get(){return this[ri]()[t]}})});["clone","formData"].forEach(t=>{Object.defineProperty(Wr,t,{value:function(){if(this[En]){if(t==="clone")throw Uu();return oc()}return this[ri]()[t]()}})});Object.defineProperty(Wr,"text",{value:function(){return Hm(this,"text",t=>bk.decode(t))}});Object.defineProperty(Wr,"arrayBuffer",{value:function(){return Hm(this,"arrayBuffer",t=>wk(t))}});Object.defineProperty(Wr,"blob",{value:function(){return Hm(this,"blob",(t,e)=>{let r=Nk(e),n=r?{headers:{"content-type":r}}:void 0;return new Response(t,n).blob()})}});Object.defineProperty(Wr,"json",{value:function(){return this[En]?oc():this.text().then(JSON.parse)}});Object.defineProperty(Wr,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Request (lightweight) ${r({method:this.method,url:this.url,headers:this.headers,nativeRequest:this[mn]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(Wr,oo.prototype);Pk=(t,e)=>{let r=Object.create(Wr);r[ao]=t,r[g_]=Ok(t.method);let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof ti)throw new Nr("Absolute URL for :path is not allowed in HTTP/2");try{r[sc]=new URL(n).href}catch(o){throw new Nr("Invalid absolute URL",{cause:o})}return r}let i=(t instanceof ti?t.authority:t.headers.host)||e;if(!i)throw new Nr("Missing host header");let s;if(t instanceof ti){if(s=t.scheme,!(s==="http"||s==="https"))throw new Nr("Unsupported scheme")}else s=t.socket&&t.socket.encrypted?"https":"http";try{r[sc]=vk(s,i,n)}catch(o){throw o instanceof Nr?o:new Nr("Invalid URL",{cause:o})}return r},Zn="text/plain; charset=UTF-8",Dm=Symbol("responseCache"),so=Symbol("getResponseCache"),hn=Symbol("cache"),Lu=global.Response,$r=class A_{#e;#t;[so](){let e=this[hn],r=e&&e[2]instanceof Headers?e[2]:void 0;return delete this[hn],this[Dm]||=new Lu(this.#e,r?{status:this.#t?.status,statusText:this.#t?.statusText,headers:r}:this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof Lu){let i=r[Dm];if(i){this.#t=i,this[so]();return}this.#t=r instanceof A_?r.#t:r,n=new Headers(r.headers)}else this.#t=r;(e==null||typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[hn]=[r?.status||200,e??null,n||r?.headers])}get headers(){let e=this[hn];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||(e[1]===null?void 0:{"content-type":Zn}))),e[2]):this[so]().headers}get status(){return this[hn]?.[0]??this[so]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty($r.prototype,t,{get(){return this[so]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty($r.prototype,t,{value:function(){return this[so]()[t]()}})});Object.defineProperty($r.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Response (lightweight) ${r({status:this.status,headers:this.headers,ok:this.ok,nativeResponse:this[Dm]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf($r,Lu);Object.setPrototypeOf($r.prototype,Lu.prototype);Uk=/^https?:\/\/[!#-;=?-[\]_a-z~A-Z]+$/,Lk=t=>t instanceof URL?t.href:Uk.test(t)?t:new URL(t).href,Mk=new Set([301,302,303,307,308]);Object.defineProperty($r,"redirect",{value:function(e,r=302){if(!Mk.has(r))throw new RangeError("Invalid status code");return new $r(null,{status:r,headers:{location:Lk(e)}})},writable:!0,configurable:!0});Object.defineProperty($r,"json",{value:function(e,r){let n=JSON.stringify(e);if(n===void 0)throw new TypeError("The data is not JSON serializable");let i=r?.headers,s;return i?(s=new Headers(i),s.has("content-type")||s.set("content-type","application/json")):s={"content-type":"application/json"},new $r(n,{status:r?.status??200,statusText:r?.statusText,headers:s})},writable:!0,configurable:!0});Pm=(t,e)=>{let r={};if(t instanceof Headers||(t=new Headers(t??void 0)),t.has("set-cookie")){let n=[];for(let[i,s]of t)i==="set-cookie"?n.push(s):r[i]=s;n.length>0&&(r["set-cookie"]=n)}else for(let[n,i]of t)r[n]=i;return e&&(r["content-type"]??=e),r},Mu=Symbol("outgoingEnded"),p_=Symbol("incomingDraining"),Hk=500,Fk=64*1024*1024,__=t=>{let e=t;if(t.destroyed||e[p_])return;if(e[p_]=!0,t instanceof ti){try{t.stream?.close?.(fk.NGHTTP2_NO_ERROR)}catch{}return}let r=0,n=()=>{clearTimeout(s),t.off("data",o),t.off("end",n),t.off("error",n)},i=()=>{n();let a=t.socket;a&&!a.destroyed&&(typeof a.destroySoon=="function"?a.destroySoon():typeof a.destroy=="function"&&a.destroy())},s=setTimeout(i,Hk);s.unref?.();let o=a=>{r+=a.length,r>Fk&&i()};t.on("data",o),t.on("end",n),t.on("error",n),t.resume()},Vk=(t,e,r,n)=>()=>{e.errored?(a_(e),t[Cm](e.errored.toString())):r.writableFinished||(a_(e),t[Cm]("Client connection prematurely closed.")),n&&!e.readableEnded&&setTimeout(()=>{e.readableEnded||setTimeout(()=>{__(e)})})},Bk=t=>{if(!(hn in t))return!1;let e=t[hn][1];return e===null||typeof e=="string"||e instanceof Uint8Array},jk=()=>new Response(null,{status:400}),I_=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),Ku=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||e.writeHead(500,{"Content-Type":"text/plain"}),e.end(`Error: ${r.message}`),e.destroy(r))},Um=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},x_=async(t,e)=>{let[r,n,i]=t[hn];if(!i){n===null?(e.writeHead(r),e.end()):typeof n=="string"?(e.writeHead(r,{"Content-Type":Zn,"Content-Length":Buffer.byteLength(n)}),e.end(n)):n instanceof Uint8Array?(e.writeHead(r,{"Content-Type":Zn,"Content-Length":n.byteLength}),e.end(n)):n instanceof Blob?(e.writeHead(r,{"Content-Type":Zn,"Content-Length":n.size}),e.end(new Uint8Array(await n.arrayBuffer()))):(e.writeHead(r,{"Content-Type":Zn}),Um(e),await d_(n,e)?.catch(o=>Ku(o,e))),e[Mu]?.();return}let s=!1;if(i instanceof Headers)s=i.has("content-length"),i=Pm(i,n===null?void 0:Zn);else if(Array.isArray(i)){let o=new Headers(i);s=o.has("content-length"),i=Pm(o,n===null?void 0:Zn)}else for(let o in i)if(o.length===14&&o.toLowerCase()==="content-length"){s=!0;break}s||(typeof n=="string"?i["Content-Length"]=Buffer.byteLength(n):n instanceof Uint8Array?i["Content-Length"]=n.byteLength:n instanceof Blob&&(i["Content-Length"]=n.size)),e.writeHead(r,i),n==null?e.end():typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):(Um(e),await d_(n,e)?.catch(o=>Ku(o,e))),e[Mu]?.()},b_=t=>typeof t.then=="function",qk=async(t,e,r={})=>{if(b_(t))if(r.errorHandler)try{t=await t}catch(i){let s=await r.errorHandler(i);if(!s)return;t=s}else t=await t.catch(I_);if(hn in t)return x_(t,e);let n=Pm(t.headers,t.body===null?void 0:Zn);if(t.body){let i=t.body.getReader(),s=[],o=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let d=await Kk(a).catch(p=>{console.error(p),o=!0});if(!d){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,d.value&&s.push(d.value),d.done){o=!0;break}}o&&!("content-length"in n)&&(n["content-length"]=s.reduce((l,d)=>l+d.length,0))}e.writeHead(t.status,n),s.forEach(c=>{e.write(c)}),o?e.end():(s.length===0&&Um(e),await T_(i,e,a))}else n[e_]||(e.writeHead(t.status,n),e.end());e[Mu]?.()},S_=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==oo&&(Object.defineProperty(global,"Request",{value:oo}),Object.defineProperty(global,"Response",{value:$r})),async(n,i)=>{let s,o,a=!1,c=!1,l=()=>{!o||c||(c=!0,i.on("close",Vk(o,n,i,a)))};try{if(o=Pk(n,e.hostname),a=r&&!(n.method==="GET"||n.method==="HEAD"),a&&(n[E_]=!0,n instanceof ti&&(i[Mu]=()=>{n.readableEnded||setTimeout(()=>{n.readableEnded||setTimeout(()=>{n.destroy(),i.destroy()})})})),s=t(o,{incoming:n,outgoing:i}),!b_(s)&&Bk(s))return a&&!n.readableEnded&&i.once("finish",()=>{n.readableEnded||__(n)}),x_(s,i);l()}catch(d){if(s)return Ku(d,i);if(e.errorHandler){if(l(),s=await e.errorHandler(o?d:Ak(d)),!s)return}else o?s=I_(d):s=jk()}try{return await qk(s,i,e)}catch(d){return Ku(d,i)}}},Gk=globalThis.CloseEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get wasClean(){return this.#e.wasClean??!1}get code(){return this.#e.code??0}get reason(){return this.#e.reason??""}},$k=globalThis.ErrorEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get message(){return this.#e.message??""}get filename(){return this.#e.filename??""}get lineno(){return this.#e.lineno??0}get colno(){return this.#e.colno??0}get error(){return this.#e.error??null}},Wk=()=>Symbol("connection"),w_=Symbol("CONNECTION_SYMBOL_KEY"),N_=Symbol("WAIT_FOR_WEBSOCKET_SYMBOL"),zk=new Set(["connection","content-length","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","sec-websocket-accept","sec-websocket-extensions","sec-websocket-protocol"]),R_=(t,e)=>{e&&e.forEach((r,n)=>{zk.has(n.toLowerCase())||t.push(`${n}: ${r}`)})},f_=(t,e,r)=>{let n=["Connection: close","Content-Length: 0"];R_(n,r),t.end(`HTTP/1.1 ${e.toString()} ${dk[e]??""}\r
-${n.join(`\r
-`)}\r
-\r
-`)},Jk=t=>{let e=t.socket.encrypted?"https":"http",r=new URL(t.url??"/",`${e}://${t.headers.host??"localhost"}`),n=new Headers;for(let i in t.headers){let s=t.headers[i];s&&n.append(i,Array.isArray(s)?s[0]:s)}return new Request(r,{headers:n})},Yk=t=>{let{server:e,fetchCallback:r,wss:n}=t,i=new Map;n.on("connection",(a,c)=>{let l=i.get(c);l&&(l.resolve(a),i.delete(c))});let s=a=>{let c=i.get(a);c&&(i.delete(a),c.reject(new Error("WebSocket handshake aborted")))},o=(a,c)=>new Promise((l,d)=>{i.set(a,{resolve:l,reject:d,connectionSymbol:c})});e.on("upgrade",async(a,c,l)=>{if(a.headers.upgrade?.toLowerCase()!=="websocket")return;let d={incoming:a,outgoing:void 0,wss:n,[N_]:o},p=400,f;try{let R=await r(Jk(a),d);R instanceof Response&&(p=R.status,f=R.headers)}catch{e.listenerCount("upgrade")===1&&f_(c,500);return}let h=i.get(a);if(!h||h.connectionSymbol!==d[w_]){s(a),e.listenerCount("upgrade")===1&&f_(c,p,f);return}let g=R=>{R_(R,f)},_=()=>s(a);c.once("close",_),n.on("headers",g);try{n.handleUpgrade(a,c,l,R=>{c.off("close",_),n.emit("connection",R,a)})}finally{n.off("headers",g)}}),e.on("close",()=>{n.close()})},Xk=r_(async(t,e,r)=>{if(t.req.header("upgrade")?.toLowerCase()!=="websocket")return;let n=t.env,i=n[N_];if(!i||!n.incoming)return new Response(null,{status:500});let s=Wk();return n[w_]=s,(async()=>{let o;try{o=await i(n.incoming,s)}catch{return}let a=[],c=(p,f)=>{a.push([p,f])};o.on("message",c);let l={binaryType:"arraybuffer",close(p,f){o.close(p,f)},protocol:o.protocol,raw:o,get readyState(){return o.readyState},send(p,f){o.send(p,{compress:f?.compress})},url:new URL(t.req.url)};try{e?.onOpen?.(new Event("open"),l)}catch(p){(r?.onError??console.error)(p)}let d=(p,f)=>{let h=Array.isArray(p)?p:[p];for(let g of h)try{e?.onMessage?.(new MessageEvent("message",{data:f?g instanceof ArrayBuffer?g:g.buffer.slice(g.byteOffset,g.byteOffset+g.byteLength):typeof g=="string"?g:Buffer.from(g).toString("utf-8")}),l)}catch(_){(r?.onError??console.error)(_)}};o.off("message",c);for(let p of a)d(...p);o.on("message",(p,f)=>{d(p,f)}),o.on("close",(p,f)=>{try{e?.onClose?.(new Gk("close",{code:p,reason:f.toString()}),l)}catch(h){(r?.onError??console.error)(h)}}),o.on("error",p=>{try{e?.onError?.(new $k("error",{error:p}),l)}catch(f){(r?.onError??console.error)(f)}})})(),new Response}),O_=t=>{let e=t.fetch,r=S_(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming}),n=(t.createServer||pk)(t.serverOptions||{},r);if(t.websocket&&t.websocket.server){if(t.websocket.server.options.noServer!==!0)throw new Error("WebSocket server must be created with { noServer: true } option");Yk({server:n,fetchCallback:e,wss:t.websocket.server})}return n},Qk=(t,e)=>{let r=O_(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var Vi=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),j_=Vi.READ|Vi.WRITE|Vi.DELETE|Vi.APPROVE|Vi.EXECUTE,et={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},Zt={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var q_=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function Bi(t){return q_?Object.freeze(t):t}function v(t,e){if(arguments.length===0)return Bi({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),Bi(r)}function u(t,e){let n={ok:!1,errors:Bi(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),Bi(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:o!=null,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c};return v(t,{...r,pagination:l})}function T(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function Z(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let s in r){if(s==="message"||s==="field")continue;let o=r[s];(typeof o=="string"||typeof o=="number")&&(n=n.replace(new RegExp(`\\{${s}\\}`,"g"),String(o)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function ji(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var Vt=T("AUTH_NOT_AUTHENTICATED","Not authenticated"),er=T("AUTH_MISSING_CREDENTIALS","Missing credentials"),Bt=T("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Cr=T("AUTH_TOKEN_EXPIRED","Token expired"),Jr=T("AUTH_TOKEN_MALFORMED","Token malformed"),jt=T("PERM_DENIED","Permission denied"),Vu=Z("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),ii=T("VALIDATION_ERROR","Validation failed"),qi=Z("INVALID_INPUT","Invalid input: {reason}"),co=T("FORBIDDEN","Access forbidden"),Bu=T("NOT_FOUND","Resource not found"),ju=Z("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),lo=Z("ALREADY_EXISTS","{resource} already exists"),uo=T("CONFLICT","Resource conflict"),si=T("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),Gi=T("INTERNAL_ERROR","Internal server error"),ie={NotAuthenticated:Vt,MissingCredentials:er,InvalidCredentials:Bt,TokenExpired:Cr,TokenMalformed:Jr,PermissionDenied:jt,BoundaryViolation:Vu,Forbidden:co,ValidationError:ii,InvalidInput:qi,NotFound:Bu,ResourceNotFound:ju,AlreadyExists:lo,Conflict:uo,RateLimitExceeded:si,InternalError:Gi};var St={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var lc=class{getMask(e,r){return Gm(e.perms,r)}check(e,r,n){if(r.roles?.length&&!(r.requireAllRoles?r.roles.every(a=>e.roles?.includes(a)):r.roles.some(a=>e.roles?.includes(a))))return u(jt({message:"Role requirement not met"}));if(r.allowOwner&&n?.ownerId!==void 0&&n.ownerId===e.id)return v();let i=this.getMask(e,r.resource),s=this.checkCapability(i,r.action);return s.ok?this.checkBoundary(e,r.boundary,n):s}checkCapability(e,r){return(e&r)!==r?u(jt()):v()}checkBoundary(e,r,n){if(r===et.GLOBAL)return v();if(!n)return u(jt({message:"Resource context required for boundary check"}));let i=n;switch(r){case et.TENANT:if(!e.tenantId||i.tenantId!==e.tenantId)return u(jt({message:"Tenant boundary violation"}));break;case et.OWNER:case et.SELF:if(i.ownerId!==e.id)return u(jt({message:"Owner boundary violation"}));break;default:return u(jt({message:`Unknown boundary type: ${r}`}))}return v()}can(e,r,n){return(this.getMask(e,r)&n)===n}compile(e){return(r,n)=>this.check(r,e,n).ok}checkCapabilityOnly(e,r,n){let i=this.getMask(e,r);return this.checkCapability(i,n)}hasAnyPermission(e,r,n){let i=this.getMask(e,r);return n.some(s=>(i&s)!==0)}hasAllPermissions(e,r,n){let i=this.getMask(e,r);return n.every(s=>(i&s)!==0)}explain(e,r,n){let i=["[Permission Check]"];if(i.push(`Resource: ${r.resource}`),r.roles?.length){let h=r.requireAllRoles?"ALL":"ANY",g=e.roles??[],_=r.requireAllRoles?r.roles.every(R=>g.includes(R)):r.roles.some(R=>g.includes(R));if(i.push(`Roles (${h}): ${r.roles.join(", ")} \u2014 user has: [${g.join(", ")}]`),!_)return i.push("Result: \u2717 DENIED (role requirement not met)"),i.join(`
-`);i.push("Roles: \u2713 OK")}if(r.allowOwner){let h=n?.ownerId!==void 0&&n.ownerId===e.id;if(i.push(`Owner bypass: resource.ownerId=${n?.ownerId??"undefined"}, user.id=${e.id}`),h)return i.push("Result: \u2713 ALLOWED (owner bypass)"),i.join(`
-`);i.push("Owner bypass: not owner, continuing to perm check")}let s=this.describeBits(r.action);i.push(`Required: ${s} (${r.action})`);let o=e.perms,a=o?.[r.resource],c=o?.["*"],l=a??c??0,d=a!==void 0?r.resource:c!==void 0?"*":"none",p=this.describeBits(l);if(i.push(`User Perms: ${p||"none"} (from: ${d})`),i.push(`User Mask: ${l}`),!((l&r.action)===r.action))return i.push(`Result: \u2717 DENIED (capability mismatch: ${l} & ${r.action} = ${l&r.action})`),i.join(`
-`);if(r.boundary!=="global"){if(!n)return i.push(`Boundary: ${r.boundary} - MISSING RESOURCE CONTEXT`),i.push("Result: \u2717 DENIED (no resource context for boundary check)"),i.join(`
-`);if(!this.checkBoundary(e,r.boundary,n).ok)return i.push(`Boundary: ${r.boundary} - VIOLATED`),r.boundary==="tenant"?(i.push(`  User tenantId: ${e.tenantId||"undefined"}`),i.push(`  Resource tenantId: ${n.tenantId||"undefined"}`)):(r.boundary==="owner"||r.boundary==="self")&&(i.push(`  User id: ${e.id}`),i.push(`  Resource ownerId: ${n.ownerId||"undefined"}`)),i.push("Result: \u2717 DENIED (boundary violation)"),i.join(`
-`);i.push(`Boundary: ${r.boundary} - OK`)}return i.push("Result: \u2713 ALLOWED"),i.join(`
-`)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function oi(){return new lc}function Gm(t,e){return t?.[e]??t?.["*"]??0}var G_="AUTH_INVALID_CREDENTIALS",uc=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[Zt.JWT,Zt.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return u(Vt({message:"No auth methods configured"}));for(let i of n){let s=this.methods.get(i);if(!s)continue;let o=await s.authenticate(r);if(o.ok)return v({user:o.data,method:i});if(!o.errors||o.errors.length===0)continue;let a=o.errors[0];if(a?.code===G_)return u(a)}return u(Vt())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function ai(t,e={}){return new uc(t,e)}var po={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function gn(t,e){return{name:Zt.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return u(er({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return u(Jr({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return u(er({message:"Bearer token is empty"}));let s=await e(i,t);if(!s.ok){let a=s.errors[0];return a?.code===po.TOKEN_EXPIRED?u(Cr()):a?.code===po.TOKEN_MALFORMED?u(Jr()):u(Bt())}let o=s.data;return o.exp&&o.exp<Date.now()/1e3?u(Cr()):v({id:o.sub,perms:o.perms,tenantId:o.tid,tenantType:o.tty,roles:o.roles??[]})}}}function dc(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function vn(t){return{name:Zt.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return u(er({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?v({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):u(Bt({message:"Invalid API key"}))}}}Do();function Xc(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var SI="x-gateway-auth";function ds(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??SI;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let s=Xc(e);n=Mt({kty:"OKP",crv:"Ed25519",x:s},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:Zt.GATEWAY_JWT,async authenticate(s){if(e!==void 0){let l=s.headers[r];if(!l)return u(er({message:`${r} header required`}));if(!l.startsWith("Bearer "))return u(Bt({message:`${r} must use Bearer scheme`}));let d=l.slice(7);if(!d)return u(er({message:"Gateway JWT is empty"}));let p;try{let f=await i(),{payload:h}=await Rn(d,f,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=h}catch(f){return f.code==="ERR_JWT_EXPIRED"?u(Cr({message:"Gateway JWT expired"})):u(Bt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let f=typeof p.jti=="string"?p.jti:void 0;if(!f)return u(Bt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(f))return u(Bt({message:"Gateway JWT jti already used (replay)"}))}}let o=dc(s.headers);if(o===null)return s.headers.authorization??s.headers.Authorization?u(Jr({message:"Authorization header must use Bearer scheme"})):u(er({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(o,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===po.TOKEN_EXPIRED?u(Cr()):l?.code===po.TOKEN_MALFORMED?u(Jr()):u(Bt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?u(Cr()):v({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var c1=globalThis.performance;Do();var jI="TOKEN_EXPIRED",_E="TOKEN_MALFORMED";function qI(t){return"secret"in t}function GI(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function $I(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=Xc(t);return Mt({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function IE(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function WI(t){try{let e=atob(t);return IE(e)}catch{return null}}async function zI(t){if(qI(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=IE(e);if(n)return Mt(n,r);let i=WI(e);return i?Mt(i,r):r==="EdDSA"&&GI(e)?$I(e):Yc(e,r)}function JI(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function Er(t){let e=null;return async(r,n)=>{try{e||(e=zI(t));let i=await e,{payload:s}=await Rn(r,i,JI(t));return v(s)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?u({code:jI,message:"Token has expired"}):u({code:_E,message:i.message}):u({code:_E,message:"JWT verification failed"})}}}function Fd(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??Er(s);e.push(gn(s,o))}t.auth.apiKey&&e.push(vn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=ai(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=oi(),i=t.errorHttpMap?{...St,...t.errorHttpMap}:{...St};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as YI}from"crypto";async function Vd(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??YI();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function Qr(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:ji(t)}:{status:e?.error??400,body:ji(t)}}var ps=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function fs(t,e){let r=e?.name;return function(i){if(i.ok)return Qr(i);let s=i.errors[0]?.code;if(!s||!(s in t))throw new ps(s,i,r);let o=t[s];return Qr(i,{error:o})}}function ms(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof ps)return Qr(n.result,{error:e});throw n}}}var XI={...St},SK=ms(fs(XI),400);var $K=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var Bd=(t,e,r)=>(n,i)=>{let s=-1;return o(0);async function o(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,d;if(t[a]?(d=t[a][0][0],n.req.routeIndex=a):d=a===t.length&&i||void 0,d)try{c=await d(n,()=>o(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var wE=Symbol();var NE=(t,e)=>new Response(t,{headers:{"Content-Type":e.replace(/^[^;]+/,n=>n.toLowerCase())}}).formData();var tl=t=>"headers"in t,OE=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,o=(tl(t)?t.headers:t.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return o==="multipart/form-data"||o==="application/x-www-form-urlencoded"?ix(t,{all:r,dot:n}):{}};async function ix(t,e){if(!tl(t)&&t.bodyCache.formData)return RE(await t.bodyCache.formData,e);let r=tl(t)?t.headers:t.raw.headers,n=await t.arrayBuffer(),i=NE(n,r.get("Content-Type")||"");tl(t)||(t.bodyCache.formData=i);let s=await i;return s?RE(s,e):{}}function RE(t,e){let r=Object.create(null);return t.forEach((n,i)=>{e.all||i.endsWith("[]")?sx(r,i,n):r[i]=n}),e.dot&&Object.entries(r).forEach(([n,i])=>{n.includes(".")&&(ox(r,n,i),delete r[n])}),r}var sx=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},ox=(t,e,r)=>{if(/(?:^|\.)__proto__\./.test(e))return;let n=t,i=e.split(".");i.forEach((s,o)=>{o===i.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var qd=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},kE=t=>{let{groups:e,path:r}=ax(t),n=qd(r);return cx(n,e)},ax=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},cx=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},rl={},CE=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return rl[n]||(r[2]?rl[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:rl[n]=[t,r[1],!0]),rl[n]}return null},DE=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},lx=t=>DE(t,decodeURI),Gd=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let s=e.indexOf("?",n),o=e.indexOf("#",n),a=s===-1?o===-1?void 0:o:o===-1?s:Math.min(s,o),c=e.slice(r,a);return lx(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var PE=t=>{let e=Gd(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},Dn=(t,e,...r)=>(r.length&&(e=Dn(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),nl=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(i.charCodeAt(i.length-1)===63){r.length===0&&n===""?r.push("/"):r.push(n);let s=i.slice(0,-1);n+="/"+s,r.push(n)}else n+="/"+i}),r.filter((i,s,o)=>o.indexOf(i)===s)},Es=t=>t.indexOf("%")!==-1?DE(t,ux):t,jd=t=>(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),Es(t)),UE=(t,e,r)=>{let n;if(!r&&e&&e.indexOf("%")===-1&&e.indexOf("+")===-1){let o=t.indexOf("?",8);if(o===-1)return;for(t.startsWith(e,o+1)||(o=t.indexOf(`&${e}`,o+1));o!==-1;){let a=t.charCodeAt(o+e.length+1);if(a===61){let c=o+e.length+2,l=t.indexOf("&",c);return jd(t.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";o=t.indexOf(`&${e}`,o+1)}if(n=/[%+]/.test(t),!n)return}let i=Object.create(null);n??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let o=t.indexOf("&",s+1),a=t.indexOf("=",s);a>o&&o!==-1&&(a=-1);let c=t.slice(s+1,a===-1?o===-1?void 0:o:a);if(n&&(c=jd(c)),s=o,c==="")continue;let l;a===-1?l="":(l=t.slice(a+1,o===-1?void 0:o),n&&(l=jd(l))),r?(i[c]&&Array.isArray(i[c])||(i[c]=[]),i[c].push(l)):i[c]??=l}return e?i[e]:i},LE=UE,ME=(t,e)=>UE(t,e,!0),ux=decodeURIComponent;var KE=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r}param(t){return t?this.#r(t):this.#s()}#r(t){let e=this.#t[0][this.routeIndex][1][t],r=this.#i(e);return r&&Es(r)}#s(){let t={},e=Object.keys(this.#t[0][this.routeIndex][1]);for(let r of e){let n=this.#i(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=Es(n))}return t}#i(t){return this.#t[1]?this.#t[1][t]:t}query(t){return LE(this.url,t)}queries(t){return ME(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e=Object.create(null);return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return OE(this,t)}#n=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;for(let i in e)return e[i].then(s=>(i==="json"&&(s=JSON.stringify(s)),new Response(s)[t]()));return e[t]=r[t]()};json(){return this.#n("text").then(t=>JSON.parse(t))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(t,e){(this.#e??={})[t]=e}valid(t){return this.#e?.[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[wE](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var HE={Stringify:1,BeforeStream:2,Stream:3},dx=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var $d=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let s=t.callbacks;if(!s?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let o=Promise.all(s.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>$d(c,e,!1,n,i))).then(()=>i[0]));return r?dx(await o,s):o};var px="text/plain; charset=UTF-8",Wd=(t,e)=>({"Content-Type":t,...e}),Uo=(t,e)=>new Response(t,e),zd=class{#e;#t;env={};#r;finalized=!1;error;#s;#i;#n;#a;#o;#c;#l;#u;#p;constructor(t,e){this.#e=t,e&&(this.#i=e.executionCtx,this.env=e.env,this.#c=e.notFoundHandler,this.#p=e.path,this.#u=e.matchResult)}get req(){return this.#t??=new KE(this.#e,this.#p,this.#u),this.#t}get event(){if(this.#i&&"respondWith"in this.#i)return this.#i;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#i)return this.#i;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=Uo(null,{headers:this.#l??=new Headers})}set res(t){if(this.#n&&t){t=Uo(t.body,t);for(let[e,r]of this.#n.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#n.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#n=t,this.finalized=!0}render=(...t)=>(this.#o??=e=>this.html(e),this.#o(...t));setLayout=t=>this.#a=t;getLayout=()=>this.#a;setRenderer=t=>{this.#o=t};header=(t,e,r)=>{this.finalized&&(this.#n=Uo(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#l??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#s=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#d(t,e,r){let n=this.#n?new Headers(this.#n.headers):this.#l;if(typeof e=="object"&&e.headers){n??=new Headers;for(let[s,o]of new Headers(e.headers))s==="set-cookie"?n.append(s,o):n.set(s,o)}if(r){if(!n){let s=0;for(let o in r)if(++s>1||typeof r[o]!="string"){n=new Headers;break}}if(n)for(let s in r){let o=r[s];if(typeof o=="string")n.set(s,o);else{n.delete(s);for(let a of o)n.append(s,a)}}}let i=typeof e=="number"?e:e?.status??this.#s;return Uo(t,{status:i,headers:n??r})}newResponse=(...t)=>this.#d(...t);body=(t,e,r)=>this.#d(t,e,r);text=(t,e,r)=>!this.#l&&!this.#s&&!e&&!r&&!this.finalized?new Response(t):this.#d(t,e,Wd(px,r));json=(t,e,r)=>this.#d(JSON.stringify(t),e,Wd("application/json",r));html=(t,e,r)=>{let n=i=>this.#d(i,e,Wd("text/html; charset=UTF-8",r));return typeof t=="object"?$d(t,HE.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#c??=()=>Uo(),this.#c(this))};var nt="ALL",FE="all",VE=["get","post","put","delete","options","patch","query"],il="Can not add a route since the matcher is already built.",sl=class extends Error{};var BE="__COMPOSED_HANDLER";var fx=t=>t.text("404 Not Found",404),jE=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},qE=class GE{get;post;put;delete;options;patch;query;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[...VE,FE].forEach(s=>{this[s]=(o,...a)=>(typeof o=="string"?this.#e=o:this.#s(s,this.#e,o),a.forEach(c=>{this.#s(s,this.#e,c)}),this)}),this.on=(s,o,...a)=>{for(let c of[o].flat()){this.#e=c;for(let l of[s].flat())a.map(d=>{this.#s(l.toUpperCase(),this.#e,d)})}return this},this.use=(s,...o)=>(typeof s=="string"?this.#e=s:(this.#e="*",o.unshift(s)),o.forEach(a=>{this.#s(nt,this.#e,a)}),this);let{strict:n,...i}=e;Object.assign(this,i),this.getPath=n??!0?e.getPath??Gd:PE}#t(){let e=new GE({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=fx;errorHandler=jE;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let s;r.errorHandler===jE?s=i.handler:(s=async(o,a)=>(await Bd([],r.errorHandler)(o,()=>i.handler(o,a))).res,s[BE]=i.handler),n.#s(i.method,i.path,s,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=Dn(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let o=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=Dn(this._basePath,e),l=c==="/"?0:c.length;return d=>{let p=new URL(d.url);return p.pathname=this.getPath(d).slice(l)||"/",new Request(p,d)}})();let a=async(c,l)=>{let d=await r(i(c.req.raw),...o(c));if(d)return d;await l()};return this.#s(nt,Dn(e,"*"),a),this}#s(e,r,n,i){e=e.toUpperCase(),r=Dn(this._basePath,r);let s={basePath:i!==void 0?Dn(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,s]),this.routes.push(s)}#i(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#n(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#n(e,r,n,"GET")))();let s=this.getPath(e,{env:n}),o=this.router.match(i,s),a=new zd(e,{path:s,matchResult:o,env:n,executionCtx:r,notFoundHandler:this.#r});if(o[0].length===1){let l;try{l=o[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(d){return this.#i(d,a)}return l instanceof Promise?l.then(d=>d||(a.finalized?a.res:this.#r(a))).catch(d=>this.#i(d,a)):l??this.#r(a)}let c=Bd(o[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#i(l,a)}})()}fetch=(e,...r)=>this.#n(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${Dn("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#n(e.request,e,void 0,e.request.method))})}};var ol=[];function Jd(t,e){let r=this.buildAllMatchers(),n=((i,s)=>{let o=r[i]||r[nt],a=o[2][s];if(a)return a;let c=s.match(o[0]);if(!c)return[[],ol];let l=c.indexOf("",1);return[o[1][l],c]});return this.match=n,n(t,e)}var al="[^/]+",ys=".*",Ei="(?:|/.*)",Pn=Symbol(),$E=new Set(".\\+*[^]$()");function mx(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1?1:t===ys||t===Ei?e===Ei?-1:1:e===ys||e===Ei?-1:t===al?1:e===al?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var WE=class Yd{#e;#t;#r=Object.create(null);insert(e,r,n,i,s){let o=this;for(let a=0,c=e.length;a<c;a++){let l=e[a],d=l.length===1?l==="*"?a===c-1?["","",ys]:["","",al]:null:l==="/*"?["","",Ei]:l.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),p;if(d){let f=d[1],h=d[2]||al;if(f&&d[2]&&(h===".*"||(h=h.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(h))||h.length===1&&$E.has(h)))throw Pn;if(p=o.#r[h],!p){if(h!==ys&&h!==Ei){for(let g in o.#r)if((h.length>1||g.length>1)&&g!==ys&&g!==Ei)throw Pn}p=o.#r[h]=new Yd}f!==""&&(p.#t??=i.varIndex++,n.push([f,p.#t]))}else if(p=o.#r[l],!p){for(let f in o.#r)if(f.length>1&&f!==ys&&f!==Ei)throw Pn;p=o.#r[l]=new Yd}o=p}if(o.#e!==void 0)throw Pn;o.#e=s?-1:r}buildRegExpStr(){let r=Object.keys(this.#r).sort(mx).map(n=>{let i=this.#r[n],s=i.buildRegExpStr();return s===""?"":(typeof i.#t=="number"?`(${n})@${i.#t}`:$E.has(n)?`\\${n}`:n)+s}).filter(Boolean);return typeof this.#e=="number"&&this.#e!==-1&&r.unshift(`#${this.#e}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var Xd=class{#e={varIndex:0};#t=new WE;#r=0;paths=Object.create(null);insert(t,e){if(e){this.#t.insert(t.split(""),0,[],this.#e,!0);return}let r=[],n=[],i=t;for(let o=0;;){let a=!1;if(i=i.replace(/\{[^}]+\}/g,c=>{let l=`@\\${o}`;return n[o]=[l,c],o++,a=!0,l}),!a)break}let s=i.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let o=n.length-1;o>=0;o--){let[a]=n[o];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,n[o][1]);break}}this.#t.insert(s,this.#r,r,this.#e,!1),this.paths[t]=[this.#r++,r]}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,s,o)=>s!==void 0?(r[++e]=Number(s),"$()"):(o!==void 0&&(n[Number(o)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var zE=Object.create(null);function JE(t){return zE[t]??=new RegExp(t==="*"?"":`^${t.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function hx(){zE=Object.create(null)}function cl(t,e){if(t){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(JE(r).test(e))return[...t[r]]}}var ll=class{name="RegExpRouter";#e;#t;#r;constructor(){this.#e={[nt]:Object.create(null)},this.#t={[nt]:Object.create(null)},this.#r={[nt]:new Xd}}#s(t,e){try{this.#r[t].insert(e,!/\*|\/:/.test(e))}catch(r){throw r===Pn?new sl(e):r}}add(t,e,r){let n=this.#e,i=this.#t;if(!n||!i)throw new Error(il);n[t]||(this.#r[t]=new Xd,[n,i].forEach(a=>{a[t]=Object.create(null),Object.keys(a[nt]).forEach(c=>{a[t][c]=[...a[nt][c]],this.#s(t,c)})})),e==="/*"&&(e="*");let s=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let a=JE(e);Object.keys(n).forEach(c=>{(t===nt||t===c)&&!n[c][e]&&(this.#s(c,e),n[c][e]=cl(n[c],e)||cl(n[nt],e)||[])}),Object.keys(n).forEach(c=>{(t===nt||t===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(i).forEach(c=>{(t===nt||t===c)&&Object.keys(i[c]).forEach(l=>a.test(l)&&i[c][l].push([r,s]))});return}let o=nl(e)||[e];for(let a=0,c=o.length;a<c;a++){let l=o[a];Object.keys(i).forEach(d=>{(t===nt||t===d)&&(i[d][l]||(this.#s(d,l),i[d][l]=[...cl(n[d],l)||cl(n[nt],l)||[]]),i[d][l].push([r,s-c+a+1]))})}}match=Jd;buildAllMatchers(){let t=Object.create(null);return Object.keys(this.#t).concat(Object.keys(this.#e)).forEach(e=>{t[e]||=this.#i(e)}),this.#e=this.#t=this.#r=void 0,hx(),t}#i(t){let e=this.#e[t],r=this.#t[t],n=this.#r[t],i=Object.create(null),s=[];[e,r].forEach(d=>{for(let p in d){let f=d[p],h=n.paths[p];if(!h){i[p]=[f.map(([_])=>[_,Object.create(null)]),ol];continue}let g=h[1];s[h[0]]=f.map(([_,R])=>{let C=Object.create(null);for(R-=1;R>=0;R--){let[D,F]=g[R];C[D]=F}return[_,C]})}});let[o,a,c]=n.buildRegExp();for(let d=0,p=s.length;d<p;d++)for(let f=0,h=s[d].length;f<h;f++){let g=s[d][f]?.[1];if(!g)continue;let _=Object.keys(g);for(let R=0,C=_.length;R<C;R++)g[_[R]]=c[g[_[R]]]}let l=[];for(let d in a)l[d]=s[a[d]];return[o,l,i]}};var Qd=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(il);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,s=0,o;for(;s<i;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);o=a.match(t,e)}catch(c){if(c instanceof sl)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(s===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,o}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var Lo=Object.create(null),Ex=t=>{for(let e in t)return!0;return!1},YE=class XE{#e;#t;#r;#s=0;#i=Lo;constructor(e,r,n){if(this.#t=n||Object.create(null),this.#e=[],e&&r){let i=Object.create(null);i[e]={handler:r,possibleKeys:[],score:0},this.#e=[i]}this.#r=[]}insert(e,r,n){this.#s=++this.#s;let i=this,s=kE(r),o=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],d=s[a+1],p=CE(l,d),f=Array.isArray(p)?p[0]:l;if(f in i.#t){i=i.#t[f],p&&o.push(p[1]);continue}i.#t[f]=new XE,p&&(i.#r.push(p),o.push(p[1])),i=i.#t[f]}return i.#e.push({[e]:{handler:n,possibleKeys:o.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),i}#n(e,r,n,i,s){for(let o=0,a=r.#e.length;o<a;o++){let c=r.#e[o],l=c[n]||c[nt],d={};if(l!==void 0&&(l.params=Object.create(null),e.push(l),i!==Lo||s&&s!==Lo))for(let p=0,f=l.possibleKeys.length;p<f;p++){let h=l.possibleKeys[p],g=d[l.score];l.params[h]=s?.[h]&&!g?s[h]:i[h]??s?.[h],d[l.score]=!0}}}search(e,r){let n=[];this.#i=Lo;let s=[this],o=qd(r),a=[],c=o.length,l=null;for(let d=0;d<c;d++){let p=o[d],f=d===c-1,h=[];for(let _=0,R=s.length;_<R;_++){let C=s[_],D=C.#t[p];D&&(D.#i=C.#i,f?(D.#t["*"]&&this.#n(n,D.#t["*"],e,C.#i),this.#n(n,D,e,C.#i)):h.push(D));for(let F=0,J=C.#r.length;F<J;F++){let q=C.#r[F],B=C.#i===Lo?{}:{...C.#i};if(q==="*"){let y=C.#t["*"];y&&(this.#n(n,y,e,C.#i),y.#i=B,h.push(y));continue}let[$,A,I]=q;if(!p&&!(I instanceof RegExp))continue;let S=C.#t[$];if(I instanceof RegExp){if(l===null){l=new Array(c);let N=r[0]==="/"?1:0;for(let O=0;O<c;O++)l[O]=N,N+=o[O].length+1}let y=r.substring(l[d]),x=I.exec(y);if(x){if(B[A]=x[0],this.#n(n,S,e,C.#i,B),x[0].length===y.length&&S.#t["*"]&&this.#n(n,S.#t["*"],e,C.#i,B),Ex(S.#t)){S.#i=B;let N=x[0].match(/\//g)?.length??0;(a[N]||=[]).push(S)}continue}}(I===!0||I.test(p))&&(B[A]=p,f?(this.#n(n,S,e,B,C.#i),S.#t["*"]&&this.#n(n,S.#t["*"],e,B,C.#i)):(S.#i=B,h.push(S)))}}let g=a.shift();s=g?h.concat(g):h}return n.length>1&&n.sort((d,p)=>d.score-p.score),[n.map(({handler:d,params:p})=>[d,p])]}};var Zd=class{name="TrieRouter";#e;constructor(){this.#e=new YE}add(t,e,r){let n=nl(e);if(n){for(let i=0,s=n.length;i<s;i++)this.#e.insert(t,n[i],r);return}this.#e.insert(t,e,r)}match(t,e){return this.#e.search(t,e)}};var Mr=class extends qE{constructor(t={}){super(t),this.router=t.router??new Qd({routers:[new ll,new Zd]})}};function ep(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??Er(s);e.push(gn(s,o))}t.auth.apiKey&&e.push(vn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=ai(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=oi(),i=t.errorHttpMap?{...St,...t.errorHttpMap}:{...St};return{auth:r,permission:n,errorHttpMap:i}}function or(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var tp={...St},QE=ms(fs(tp),400);function rp(t){tp={...St,...t},QE=ms(fs(tp),400)}function ZE(){return QE}function Be(t,e,r){let{traceId:n,successStatus:i,adapter:s=ZE()}=r??{},o=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:o}},l=s(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let d=e.ok?v(e.data,a):{...e,meta:a},p=ji(d);return t.json(p,l)}async function yx(t){let e={};t.req.raw.headers.forEach((o,a)=>{e[a]=o});let r={},n=t.req.query();for(let[o,a]of Object.entries(n))r[o]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function Mo(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,s)=>{let o=or(i);try{let a=await yx(i),c=await e.resolve(n,a);if(!c.ok){if(r){await s();return}return Be(i,u(Vt()),{traceId:o})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await s()}catch{if(r){await s();return}return Be(i,u(Vt()),{traceId:o})}}}function np(t){return async(e,r)=>{let n=or(e),i=e.get("authResult");if(!i)return Be(e,u(Vt()),{traceId:n});let{user:s}=i,o;if(t.loadResource){let l=e.req.param(),d=await t.loadResource(l,s);if(d===null)return Be(e,u(jt({message:"Resource not found for boundary check"})),{traceId:n});o=d}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(s,a,o);if(!c.ok)return Be(e,c,{traceId:n});await r()}}function Ko(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?u(r.issues.map(n=>{let i=n.path?.map(s=>typeof s=="object"?s.key:s).join(".")??"";return ii({message:i?`${i}: ${n.message}`:n.message})})):v(r.value)}function Ho(t){return async(e,r)=>{let n=or(e);try{let i={};if(t.body){let s;try{s=await e.req.json()}catch{return Be(e,u(qi({reason:"Request body is not valid JSON"})),{traceId:n})}let o=Ko(t.body,s);if(!o.ok)return Be(e,o,{traceId:n});i.body=o.data}if(t.params){let s=Ko(t.params,e.req.param());if(!s.ok)return Be(e,s,{traceId:n});i.params=s.data}if(t.query){let s=Ko(t.query,e.req.query());if(!s.ok)return Be(e,s,{traceId:n});i.query=s.data}if(t.headers){let s={};e.req.raw.headers.forEach((a,c)=>{s[c]=a});let o=Ko(t.headers,s);if(!o.ok)return Be(e,o,{traceId:n});i.headers=o.data}e.set("validatedData",i),await r()}catch(i){let s={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return Be(e,u(ii(),s),{traceId:n})}}}function Fo(t){return t.get("validatedData")?.body}function Vo(t){return t.get("validatedData")?.params}function Bo(t){return t.get("validatedData")?.query}var D2=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function gx(t,e){let r=[...t,e];return async(n,i)=>{let s,o=async a=>{if(s||a>=r.length){!s&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await o(a+1)});l instanceof Response&&(s=l)};return await o(0),s}}function X(t,e){let r=[];if(e.auth!==!1){let s=Array.isArray(e.auth)?e.auth:void 0;r.push(Mo({engine:t.auth,methods:s}))}e.permission&&r.push(np({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(s,o)=>{let a={body:void 0,query:void 0,params:s,user:o};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(Ho({body:e.input.body,query:e.input.query,params:e.input.params}));let i=gx(r,async s=>{let o=or(s);try{let a=s.get("authResult"),c={body:Fo(s),query:Bo(s),params:Vo(s),user:a?.user,tenantContext:s.get("tenantContext"),traceId:o},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},d=await e.handler(l),p=e.successStatus??200;return Be(s,d,{traceId:o,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:o,route:`${e.method} ${e.path}`,error:{message:c}})),Be(s,u(Gi()),{traceId:o})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function ip(t,e){let r=new Mr;for(let n of e){let{method:i,path:s}=n.routeMeta,o=s==="/"?t:`${t}${s}`;switch(i){case"GET":r.get(o,n);break;case"POST":r.post(o,n);break;case"PUT":r.put(o,n);break;case"PATCH":r.patch(o,n);break;case"DELETE":r.delete(o,n);break}}return r}var ey={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var ul,vx={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function Ax(t){return!t&&!ul?vx:{lang:t?.lang??ul?.lang,message:t?.message,abortEarly:t?.abortEarly??ul?.abortEarly,abortPipeEarly:t?.abortPipeEarly??ul?.abortPipeEarly}}var Tx;function _x(t){return Tx?.get(t)}var Ix;function xx(t){return Ix?.get(t)}var bx;function Sx(t,e){return bx?.get(t)?.get(e)}function yi(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function ut(t,e,r,n,i){let s=i&&"input"in i?i.input:r.value,o=i?.expected??t.expects??null,a=i?.received??yi(s),c={kind:t.kind,type:t.type,input:s,expected:o,received:a,message:`Invalid ${e}: ${o?`Expected ${o} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",d=i?.message??t.message??Sx(t.reference,c.lang)??(l?xx(c.lang):null)??n.message??_x(c.lang);d!==void 0&&(c.message=typeof d=="function"?d(c):d),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}var ty=new WeakMap;function Gt(t){let e=ty.get(t);return e||(e={version:1,vendor:"valibot",validate(r){return t["~run"]({value:r},Ax())}},ty.set(t,e)),e}function wx(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function ny(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}var Nx=/^[\w+-]+(?:\.[\w+-]+)*@[\da-z]+(?:[.-][\da-z]+)*\.[a-z]{2,}$/iu;function dl(t,e){return{kind:"validation",type:"check",reference:dl,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&ut(this,"input",r,n),r}}}function Zr(t){return{kind:"validation",type:"email",reference:Zr,expects:null,async:!1,requirement:Nx,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&ut(this,"email",e,r),e}}}function Un(t){return{kind:"validation",type:"integer",reference:Un,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&ut(this,"integer",e,r),e}}}function wt(t,e){return{kind:"validation",type:"max_length",reference:wt,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&ut(this,"length",r,n,{received:`${r.value.length}`}),r}}}function gs(t,e){return{kind:"validation",type:"max_value",reference:gs,async:!1,expects:`<=${t instanceof Date?t.toJSON():yi(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&ut(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():yi(r.value)}),r}}}function sp(t,e){return{kind:"validation",type:"min_length",reference:sp,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&ut(this,"length",r,n,{received:`${r.value.length}`}),r}}}function vs(t,e){return{kind:"validation",type:"min_value",reference:vs,async:!1,expects:`>=${t instanceof Date?t.toJSON():yi(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&ut(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():yi(r.value)}),r}}}function As(t){return{kind:"transformation",type:"transform",reference:As,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function Rx(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function op(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function ee(t,e){return{kind:"schema",type:"array",reference:ee,expects:"Array",async:!1,item:t,message:e,get"~standard"(){return Gt(this)},"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let s=0;s<i.length;s++){let o=i[s],a=this.item["~run"]({value:o},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:s,value:o};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else ut(this,"type",r,n);return r}}}function Et(t){return{kind:"schema",type:"boolean",reference:Et,expects:"boolean",async:!1,message:t,get"~standard"(){return Gt(this)},"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:ut(this,"type",e,r),e}}}function Ts(t,e){return{kind:"schema",type:"literal",reference:Ts,expects:yi(t),async:!1,literal:t,message:e,get"~standard"(){return Gt(this)},"~run"(r,n){return r.value===this.literal?r.typed=!0:ut(this,"type",r,n),r}}}function gi(t,e){return{kind:"schema",type:"nullable",reference:gi,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,get"~standard"(){return Gt(this)},"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=op(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function Ge(t){return{kind:"schema",type:"number",reference:Ge,expects:"number",async:!1,message:t,get"~standard"(){return Gt(this)},"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:ut(this,"type",e,r),e}}}function H(t,e){return{kind:"schema",type:"object",reference:H,expects:"Object",async:!1,entries:t,message:e,get"~standard"(){return Gt(this)},"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let s in this.entries){let o=this.entries[s];if(s in i||(o.type==="exact_optional"||o.type==="optional"||o.type==="nullish")&&o.default!==void 0){let a=s in i?i[s]:op(o),c=o["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:s,value:a};for(let d of c.issues)d.path?d.path.unshift(l):d.path=[l],r.issues?.push(d);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[s]=c.value}else if(o.fallback!==void 0)r.value[s]=Rx(o);else if(o.type!=="exact_optional"&&o.type!=="optional"&&o.type!=="nullish"&&(ut(this,"key",r,n,{input:void 0,expected:`"${s}"`,path:[{type:"object",origin:"key",input:i,key:s,value:i[s]}]}),n.abortEarly))break}}else ut(this,"type",r,n);return r}}}function b(t,e){return{kind:"schema",type:"optional",reference:b,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,get"~standard"(){return Gt(this)},"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=op(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function $t(t,e){return{kind:"schema",type:"picklist",reference:$t,expects:ny(t.map(yi),"|"),async:!1,options:t,message:e,get"~standard"(){return Gt(this)},"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:ut(this,"type",r,n),r}}}function he(t,e,r){return{kind:"schema",type:"record",reference:he,expects:"Object",async:!1,key:t,value:e,message:r,get"~standard"(){return Gt(this)},"~run"(n,i){let s=n.value;if(s&&typeof s=="object"){n.typed=!0,n.value={};for(let o in s)if(wx(s,o)){let a=s[o],c=this.key["~run"]({value:o},i);if(c.issues){let d={type:"object",origin:"key",input:s,key:o,value:a};for(let p of c.issues)p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let d={type:"object",origin:"value",input:s,key:o,value:a};for(let p of l.issues)p.path?p.path.unshift(d):p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else ut(this,"type",n,i);return n}}}function E(t){return{kind:"schema",type:"string",reference:E,expects:"string",async:!1,message:t,get"~standard"(){return Gt(this)},"~run"(e,r){return typeof e.value=="string"?e.typed=!0:ut(this,"type",e,r),e}}}function ry(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function jo(t,e){return{kind:"schema",type:"union",reference:jo,expects:ny(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,get"~standard"(){return Gt(this)},"~run"(r,n){let i,s,o;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)s?s.push(c):s=[c];else{i=c;break}else o?o.push(c):o=[c]}if(i)return i;if(s){if(s.length===1)return s[0];ut(this,"type",r,n,{issues:ry(s)}),r.typed=!0}else{if(o?.length===1)return o[0];ut(this,"type",r,n,{issues:ry(o)})}return r}}}function ge(){return{kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,get"~standard"(){return Gt(this)},"~run"(t){return t.typed=!0,t}}}function De(...t){return{...t[0],pipe:t,get"~standard"(){return Gt(this)},"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}}}var ap=H({maskedRecipient:b(E()),expiresAt:E()}),cp=H({userId:E(),verification:b(H({channel:E(),challengeId:E(),expiresAt:E(),identityType:E(),identityValue:E()}))});var Nt=H({message:b(E())}),iy=H({accessToken:E(),refreshToken:b(E()),expiresAt:Ge()}),sy=H({requiresChallenge:Ts(!0),challenge:H({type:b(E()),phase:b(E()),expiresAt:b(jo([E(),Ge()])),data:he(E(),ge())})}),oy=H({requiresMfa:Ts(!0),mfa:H({phase:b(E()),challengeId:E(),methods:ee(E()),method:b(E()),expiresAt:jo([E(),Ge()]),userId:E()})}),ay=H({requiresVerification:Ts(!0),verification:H({channel:Ts("email"),challengeId:E(),expiresAt:E(),identityType:E(),identityValue:E(),userId:E()})}),vi=jo([sy,oy,ay,iy]),qo=H({id:E(),contactEmail:b(E()),contactPhone:b(E()),username:b(E()),displayName:b(E()),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),metadata:b(he(E(),ge())),createdAt:E(),updatedAt:E()}),Go=H({challengeId:E(),expiresAt:E()});var Kt=(t=100)=>De(E(),wt(t)),pl=De(E(),wt(320)),Ln=De(E(),wt(4096)),$o=(t=256)=>De(E(),wt(t)),lp=(t=8192)=>De(E(),wt(t)),Wo=De(ge(),As(Number),Ge(),Un(),vs(1),gs(100));var Ox={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:H({identityType:Kt(),identityValue:pl,credentialType:Kt(),credentialValue:b(Ln),metadata:b(he(Kt(),ge())),country:b(Kt()),city:b(Kt())}),response:vi},kx={method:"POST",path:"/auth/register",kind:"data",public:!0,body:H({identityType:Kt(),identityValue:pl,credentialType:Kt(),credentialValue:Ln,displayName:b($o()),givenName:b($o()),familyName:b($o()),avatarUrl:b(lp(2048)),locale:b(Kt()),metadata:b(he(Kt(),ge()))}),response:cp},Cx={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:H({challengeId:E(),code:E()}),response:vi},Dx={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:H({challengeId:E(),method:E(),code:E()}),response:vi},Px={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:H({challengeId:E(),method:E(),userId:E()}),response:ap},Ux={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},Lx={method:"POST",path:"/auth/logout",kind:"logout",public:!0},Mx={method:"GET",path:"/auth/me",kind:"data",response:qo},Kx={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:H({tenantId:E()})},Rt={authenticate:Ox,register:kx,completeChallenge:Cx,completeMfaChallenge:Dx,issueMfaChallenge:Px,refresh:Ux,logout:Lx,me:Mx,selectTenant:Kx};var up=H({method:E(),data:he(E(),ge())}),dp=H({method:E(),verified:Et(),data:he(E(),ge())}),cy=H({method:E(),verifiedAt:gi(E()),createdAt:E(),id:b(E()),label:b(E()),lastUsedAt:b(E())}),pp=H({authenticators:ee(cy),total:Ge()});var Hx={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:H({method:E(),data:b(he(E(),ge()))}),response:up},Fx={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:H({method:E(),data:b(he(E(),ge())),authenticatorId:b(E())}),response:dp},Vx={method:"GET",path:"/mfa/authenticators",kind:"data",query:H({method:b(E()),verifiedOnly:b(Et())}),response:pp},Bx={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:H({method:E(),authenticatorId:b(E()),password:b(E())}),response:H({message:b(E())})},jx={method:"PATCH",path:"/mfa/settings",kind:"data",body:H({mfaRequired:b(Et()),mfaMethods:b(ee(E())),password:b(E())}),response:H({mfaRequired:b(Et()),mfaMethods:b(ee(E()))})},yr={setupAuthenticator:Hx,verifyAuthenticator:Fx,listAuthenticators:Vx,removeAuthenticator:Bx,updateMfaSettings:jx};var fp=H({state:E()}),ly=H({provider:E(),providerId:b(E()),email:b(E()),linkedAt:b(E())}),mp=ee(ly);var qx={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:fp},Gx={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:H({provider:De(E(),wt(100)),code:b(De(E(),wt(8192))),credential:b(De(E(),wt(8192))),state:b(De(E(),wt(1024))),tenantId:b(De(E(),wt(100)))}),response:vi},$x={method:"POST",path:"/oauth/link",kind:"data",body:H({provider:E(),code:b(E())}),response:Nt},Wx={method:"POST",path:"/oauth/unlink",kind:"data",body:H({provider:E()}),response:Nt},zx={method:"GET",path:"/oauth/providers",kind:"data",response:mp},tn={oauthState:qx,oauthCallback:Gx,linkProvider:$x,unlinkProvider:Wx,getProviders:zx};var Jx={method:"PATCH",path:"/password/change",kind:"data",body:H({currentPassword:Ln,newPassword:Ln}),response:Nt},Yx={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:H({email:De(E(),wt(320),Zr())}),response:Go},Xx={method:"POST",path:"/password/reset",kind:"data",public:!0,body:H({challengeId:Kt(),code:Kt(),newPassword:Ln}),response:Nt},rn={changePassword:Jx,forgotPassword:Yx,resetPassword:Xx};var uy=H({id:E(),tokenId:E(),tenantId:b(E()),deviceLabel:b(E()),country:b(E()),city:b(E()),createdAt:E(),expiresAt:E(),lastUsedAt:E(),revokedAt:b(gi(E())),metadata:b(he(E(),ge())),isCurrent:b(Et())}),hp=ee(uy);var dy=H({id:E(),tenantId:E(),inviteeUserId:b(E()),inviteeEmail:b(E()),inviteePhone:b(E()),status:E(),roles:b(ee(E())),authPerms:ee(E()),displayName:b(E()),givenName:b(E()),familyName:b(E()),jobTitle:b(E()),invitedBy:b(ge()),createdAt:E(),updatedAt:E(),expiresAt:E()}),Ep=ee(dy),yp=H({inviteId:E(),inviteToken:E(),expiresAt:E()}),py=H({userId:E(),tenantId:E(),status:E(),roles:b(ee(E())),authPerms:ee(E()),isOwner:Et(),createdAt:E(),updatedAt:E()}),gp=H({members:ee(py)}),fl=H({userId:E(),tenantId:E(),status:E(),roles:b(ee(E())),authPerms:ee(E()),isOwner:Et(),displayName:b(E()),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),jobTitle:b(E()),contactEmail:b(E()),contactPhone:b(E()),bio:b(E()),locale:b(E()),metadata:b(he(E(),ge())),createdAt:b(E()),memberUpdatedAt:b(E()),profileUpdatedAt:b(E())}),vp=H({tenantId:E(),roles:b(ee(E())),authPerms:ee(E())});var Ap=H({userId:E(),identityType:E(),identityValue:E(),verifiedAt:E()});var Zx={method:"GET",path:"/sessions",kind:"data",query:H({includeRevoked:b($t(["true","false"])),limit:b(Wo),cursor:b(E())}),response:hp},eb={method:"DELETE",path:"/sessions",kind:"data",body:H({sessionId:E()}),response:Nt},tb={method:"POST",path:"/sessions/revoke",kind:"data",body:H({refreshToken:E()}),response:Nt},nn={listSessions:Zx,deleteSession:eb,revokeToken:tb};var rb={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:fl},nb={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:H({contactEmail:b(E()),contactPhone:b(E()),displayName:b(E()),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),bio:b(E()),jobTitle:b(E()),metadata:b(he(E(),ge()))}),response:fl},ib={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:H({inviteeEmail:b(De(E(),Zr())),inviteeUserId:b(E()),inviteePhone:b(E()),role:b(E()),roles:b(ee(E())),authPerms:b(ee(E())),displayName:b(E()),givenName:b(E()),familyName:b(E()),jobTitle:b(E())}),response:yp},sb={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:H({status:b(E()),limit:b(Wo),cursor:b(E())}),response:Ep},ob={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:H({inviteId:b(E()),inviteToken:b(E())}),response:vp},ab={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:H({inviteId:b(E()),inviteToken:b(E())}),response:Nt},cb={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:H({inviteId:E()}),response:Nt},lb={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:H({limit:b(Wo),cursor:b(E())}),response:gp},ub={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:E(),role:b(E()),roles:b(ee(E())),authPerms:b(ee(E()))}),response:Nt},db={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:E()}),response:Nt},Tp={getTenantProfile:rb,updateTenantProfile:nb,createInvite:ib,listInvites:sb,acceptInvite:ob,declineInvite:ab,revokeInvite:cb,listMembers:lb,updateMember:ub,removeMember:db};var pb={method:"PATCH",path:"/users/profile",kind:"data",body:H({email:b(De(E(),Zr())),phone:b(E()),displayName:b(E()),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),metadata:b(he(E(),ge()))}),response:qo},zo={updateProfile:pb};var fb={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:H({challengeId:E(),code:E()}),response:Ap},mb={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:H({channel:$t(["sms","email"]),identityValue:E(),previousChallengeId:b(E())}),response:Go},Ai={verifyCode:fb,resendVerification:mb};var wB={...Rt,...rn,...Ai,...nn,...yr,...tn,...zo,...Tp};var j={VALIDATION_ERROR:T("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:T("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:T("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:T("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:T("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:T("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:T("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:T("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:T("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:T("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:T("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:T("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:T("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:T("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:T("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function _s(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function Mn(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:s,device:o}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=o?.deviceLabel,d={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...o?.country&&{country:o.country},...o?.city&&{city:o.city},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}},p=await e.plugins.database.sessions.create(d);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u(j.DATABASE_ERROR());let f=p.data,h=_s(n,e.security),g=await e.plugins.token.signAccessToken({sub:r,sid:f.id,jti:f.tokenId,...h&&{aud:h},...n&&{tid:n},...i&&{tty:i},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}}),_=await e.plugins.token.signRefreshToken({sub:r,sid:f.id,jti:f.tokenId,...h&&{aud:h},...n&&{tid:n},...i&&{tty:i}});return v({accessToken:g.token,refreshToken:_.token,expiresAt:g.expiresAt,...n&&{tenantId:n}})}var Jo={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};function fy(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function Yo(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?u(Jo.USER_NOT_FOUND()):v(fy(r.data))}var _p={SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:j.DATABASE_ERROR};async function ml(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return v();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(_p.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?v():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(_p.DATABASE_ERROR()):v():v()}var Kn={INVALID_TOKEN:T("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:T("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:j.VALIDATION_ERROR,DATABASE_ERROR:j.DATABASE_ERROR,INTERNAL_ERROR:j.INTERNAL_ERROR,ACCOUNT_SUSPENDED:j.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:j.ACCOUNT_DELETED};var sn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(sn||(sn={}));async function hl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return u(Kn.INVALID_TOKEN());if(r.typ!==sn.Refresh)return u(Kn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(j.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return u(Kn.INVALID_TOKEN());let s=Date.now(),o=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&s-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!o&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(j.DATABASE_ERROR()):u(Kn.INVALID_TOKEN());if(a&&!o){let g=_s(i.tenantId,e.security),_=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...g&&{aud:g},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),R=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...g&&{aud:g},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}});return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),v({accessToken:_.token,refreshToken:R.token,expiresAt:_.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:s,expiresAt:new Date(s+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return u(j.DATABASE_ERROR());let d=_s(i.tenantId,e.security);if(l.data===!1){let g=await e.plugins.database.sessions.get(i.id);if(g.ok===!1)return u(j.DATABASE_ERROR());let _=g.data;if(!_||_.revokedAt)return u(Kn.INVALID_TOKEN());let R=await e.plugins.token.signAccessToken({sub:_.userId,sid:_.id,jti:_.tokenId,...d&&{aud:d},..._.tenantId&&{tid:_.tenantId},..._.tenantType&&{tty:_.tenantType},..._.perms!==void 0&&{perms:_.perms},..._.roles&&{roles:_.roles}}),C=await e.plugins.token.signRefreshToken({sub:_.userId,sid:_.id,jti:_.tokenId,...d&&{aud:d},..._.tenantId&&{tid:_.tenantId},..._.tenantType&&{tty:_.tenantType}});return v({accessToken:R.token,refreshToken:C.token,expiresAt:R.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),f=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}}),h={accessToken:p.token,refreshToken:f.token,expiresAt:p.expiresAt};return v(h)}var It={IDENTITY_PLUGIN_NOT_FOUND:Z("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:Z("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:T("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:Z("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:Z("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:Z("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:T("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:Z("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:j.VALIDATION_ERROR,DATABASE_ERROR:j.DATABASE_ERROR,INTERNAL_ERROR:j.INTERNAL_ERROR,ACCOUNT_DELETED:j.ACCOUNT_DELETED};var Fe={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},gr={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},xe={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var ar={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function Ip(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function El(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let o=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(o)}var Qe={SMS:"sms",EMAIL:"email"},Ti={PHONE:"phone",EMAIL:"email"},_i={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Hn={type:Qe.EMAIL,purpose:xe.EMAIL_VERIFICATION,identityType:Ti.EMAIL,template:_i.EMAIL_CODE};var Fn={type:Qe.SMS,purpose:xe.PHONE_VERIFICATION,identityType:Ti.PHONE,template:_i.SMS_CODE};var Ne={CHANNEL_NOT_CONFIGURED:T("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:T("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:T("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:T("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:T("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:T("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:T("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function Ie(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function on(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function Kr(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return hb(n)}async function Is(t,e){let r=await Kr(t);return r.length!==e.length?!1:Eb(r,e)}function hb(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function Eb(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function yb(t){switch(t){case Qe.SMS:return Fn;case Qe.EMAIL:return Hn}}async function xs(t,e){let r=yb(t.channel);if(t.channel===Qe.SMS&&!e.plugins.smsSystem)return u(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Qe.EMAIL&&!e.plugins.emailSystem)return u(Ne.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,s=await e.plugins.database.identities.get(r.identityType,i);if(!s.ok||!s.data)return u(Ne.IDENTITY_NOT_FOUND());let o=s.data;if(o.verifiedAt)return u(Ne.IDENTITY_ALREADY_VERIFIED());let a=o.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,d=t.previousChallengeId===void 0&&l===c;if(!l)return u(Ne.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return u(p.errors,p.meta);let f=p.data;if(f&&(f.status!==Fe.PENDING||f.userId!==o.userId||f.purpose!==r.purpose||f.method!==r.type||f.identityType!==r.identityType||f.identityValue!==i))return u(Ne.CHALLENGE_NOT_FOUND());if(!f&&!d)return u(Ne.CHALLENGE_NOT_FOUND());let h=e.security.verificationResendCooldownSeconds*1e3,g=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(f?.createdAt.getTime()??0)+h;if(h>0&&Date.now()<g)return u(Ne.RESEND_COOLDOWN_ACTIVE());let _=on(6),R=await Kr(_),C=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),D=e.plugins.database.challenges.generateChallengeId(),F=await e.plugins.database.challenges.create({id:D,userId:o.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:R,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:C});if(F.ok===!1)return u(F.errors,F.meta);let J=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,q=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:D,purpose:r.purpose,channel:r.type,expiresAt:C,resendAvailableAt:J}});return q.ok===!1?(await e.plugins.database.challenges.remove(D),u(q.errors,q.meta)):(await gb(t.channel,i,_,r.template,D,C,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(D),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),u(Ne.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),Ie(e,{event:`verification_code_resent_${t.channel}`,userId:o.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:D,previousChallengeId:l}})]),v({challengeId:D,expiresAt:C}))}async function gb(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Qe.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Qe.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Ne.CHANNEL_NOT_CONFIGURED())}function vb(t){switch(t){case Qe.SMS:return Fn;case Qe.EMAIL:return Hn}}async function bs(t,e){let r=vb(t.channel);if(t.channel===Qe.SMS&&!e.plugins.smsSystem)return u(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Qe.EMAIL&&!e.plugins.emailSystem)return u(Ne.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return u(Ne.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return u(Ne.IDENTITY_ALREADY_VERIFIED());let s=i.guards.email_verification;if(s?.lockedUntil&&new Date(s.lockedUntil)>new Date)return u(Ne.VERIFICATION_COOLDOWN_ACTIVE());let o=i.pendingVerification,a=o&&o.purpose===r.purpose&&o.channel===r.type&&o.expiresAt>new Date?o.challengeId:null;if(o?.resendAvailableAt&&o.purpose===r.purpose&&o.channel===r.type&&o.resendAvailableAt>new Date)return u(Ne.VERIFICATION_COOLDOWN_ACTIVE());let c=on(6),l=await Kr(c),d=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),f=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:d});if(f.ok===!1)return u(f.errors,f.meta);let h=Math.max(0,e.security.verificationResendCooldownSeconds),g=h>0?new Date(Date.now()+h*1e3):null,_=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:d,resendAvailableAt:g}});return _.ok===!1?(await e.plugins.database.challenges.remove(p),u(_.errors,_.meta)):(await Ab(t.channel,t.identityValue,c,r.template,p,d,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:o??null}),u(Ne.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),Ie(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),v({challengeId:p,expiresAt:d}))}async function Ab(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Qe.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Qe.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Ne.CHANNEL_NOT_CONFIGURED())}var Tb=[xe.PHONE_VERIFICATION,xe.EMAIL_VERIFICATION];async function Ss(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(Ne.CHALLENGE_NOT_FOUND());let n=r.data;if(!Tb.includes(n.purpose))return u(Ne.CHALLENGE_NOT_FOUND());if(n.status!==Fe.PENDING)return u(Ne.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return u(Ne.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?u(Ne.TOO_MANY_ATTEMPTS()):u(i.errors,i.meta);if(!n.codeHash)return u(Ne.INVALID_CODE());if(!await Is(t.code,n.codeHash))return u(Ne.INVALID_CODE());let o=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:o,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await Ie(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),v({userId:n.userId,identityType:a,identityValue:c,verifiedAt:o})}async function my(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:s,codeHash:o,challengeId:a,expiresAt:c,...l}=t.nextStepData,d={id:r,userId:t.userId,purpose:xe.LOGIN,status:Fe.PENDING,phase:gr.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(d.tenantId=t.tenantId),t.deviceLabel!==void 0&&(d.deviceLabel=t.deviceLabel),t.country!==void 0&&(d.country=t.country),t.city!==void 0&&(d.city=t.city),i!==void 0&&(d.codeHash=i),(await e.plugins.database.challenges.create(d)).ok===!1?u([j.DATABASE_ERROR()]):v({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:d.phase})}async function yl(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,s=t.userHasMethods.length===1&&t.deliveryMethods.length===0,o=i?t.deliveryMethods[0]:s?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:xe.LOGIN,status:Fe.PENDING,phase:o?gr.VERIFY_MFA:gr.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),o!==void 0&&(a.method=o),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return u(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...o!==void 0&&{selectedMethod:o}};return v(l)}var it={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"},Xo={OWNER:"owner"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var xp={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},gl={ACCOUNT_DELETED:j.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:T(xp.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:T(xp.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T(xp.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function Hr(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return u(gl.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return u(gl.ACCOUNT_SUSPENDED());let s,o,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return u(gl.NO_ACCESS_TO_TENANT());let d=l.data;if(d.status!==it.ACTIVE)return u(gl.SUSPENDED_IN_TENANT());if(o=d.roles,s=d.isOwner?{"*":-1}:d.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return s!==void 0&&(c.perms=s),o!==void 0&&(c.roles=o),a!==void 0&&(c.tenantType=a),v(c)}function Qo(t,e){return e[t]??null}function hy(t,e){return e[t]??null}async function Ey(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function yy(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,s=r.security.maxFailedAttempts||5,o=i>=s,a=null;if(o){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>s){let d=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*d**(i-s),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function gy(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Zo(t,e){let r=t.tid,n=Qo(t.identityType,e.plugins.identity);if(!n)return u(It.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return u(It.INVALID_IDENTITY_FORMAT());let s=n.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,s);if(o.ok===!1||!o.data)return u(It.INVALID_CREDENTIALS());let a=o.data;if(!a.loginEnabled)return u(It.LOGIN_DISABLED());let c=Ip(a,t.credentialType);if(c.locked)return u(It.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=hy(t.credentialType,e.plugins.credential);if(!l)return u(It.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let d=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=d.ok?d.data:null,f=await l.verify({userId:a.userId,identityValue:s,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(f.ok===!1)return await yy(a,t.credentialType,e),u(It.INVALID_CREDENTIALS());let{userId:h,nextStep:g,intents:_}=f.data;_&&_.length>0&&await Ey(_,e);let R;if(t.userAgent&&e.plugins.deviceParser){let N=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),O=N.browser||"Unknown Browser",w=N.os||"Unknown OS";R=`${O} - ${w}`}if(g){let N={userId:h,credentialType:t.credentialType,identityType:t.identityType,identityValue:s,nextStepData:g.data,nextStepType:g.type};t.tid!==void 0&&(N.tenantId=t.tid),R!==void 0&&(N.deviceLabel=R),t.country!==void 0&&(N.country=t.country),t.city!==void 0&&(N.city=t.city);let O=await my(N,e);if(O.ok===!1)return u(O.errors,O.meta);if(!O.ok)return u(It.INTERNAL_ERROR());let{challengeId:w,expiresAt:k,displayData:P,challengeType:L,phase:K}=O.data;return v({requiresChallenge:!0,challenge:{type:L,phase:K,expiresAt:k,data:{challengeId:w,expiresAt:k,...P}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return u(It.IDENTITY_NOT_VERIFIED());let N=a.pendingVerification;if(!!N&&N.purpose===xe.EMAIL_VERIFICATION&&N.channel==="email"&&N.expiresAt>new Date&&N)return v({requiresVerification:!0,verification:{channel:"email",challengeId:N.challengeId,expiresAt:N.expiresAt,identityType:t.identityType,identityValue:s,userId:h}});let w=await bs({channel:"email",identityValue:s,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!w.ok){let k=await e.plugins.database.identities.get(t.identityType,s),P=k.ok&&k.data?k.data.pendingVerification:null;return P&&P.purpose===xe.EMAIL_VERIFICATION&&P.channel==="email"&&P.expiresAt>new Date?v({requiresVerification:!0,verification:{channel:"email",challengeId:P.challengeId,expiresAt:P.expiresAt,identityType:t.identityType,identityValue:s,userId:h}}):u(It.IDENTITY_NOT_VERIFIED())}return v({requiresVerification:!0,verification:{channel:"email",challengeId:w.data.challengeId,expiresAt:w.data.expiresAt,identityType:t.identityType,identityValue:s,userId:h}})}let C=await e.plugins.database.userAuths.get(h);if(C.ok===!1||!C.data)return u(It.USER_AUTH_NOT_FOUND());let D=C.data,F={userStatus:D.userStatus,userId:h,...r&&{tenantId:r}},J=await Hr(F,e);if(J.ok===!1)return u(J.errors,J.meta);if(!J.ok)return u(j.DATABASE_ERROR());let{perms:q,roles:B,tenantType:$}=J.data;if(D.mfaRequired){let N=D.mfaMethods;if(!(!N||N.length===0)){let O=N.filter(w=>e.plugins.mfa?.[w]);if(O.length!==0){let w=O.filter(pe=>e.plugins.mfa?.[pe]?.requiresServerDelivery),k=O.filter(pe=>!e.plugins.mfa?.[pe]?.requiresServerDelivery),P={};R!==void 0&&(P.deviceLabel=R),t.country!==void 0&&(P.country=t.country),t.city!==void 0&&(P.city=t.city);let L={userId:h,availableMethods:O,deliveryMethods:w,userHasMethods:k,device:P};t.tid!==void 0&&(L.tenantId=t.tid);let K=await yl(L,e);if(K.ok===!1)return u(K.errors,K.meta);if(!K.ok)return u(It.INTERNAL_ERROR());let{challengeId:W,expiresAt:Y,phase:ue,selectedMethod:Oe,availableMethods:He}=K.data;return v({requiresMfa:!0,mfa:{phase:ue,challengeId:W,methods:He,...Oe&&{method:Oe},expiresAt:Y,userId:h}})}}}let A={userId:h,...r&&{tenantId:r},...$&&{tenantType:$},...q!==void 0||B?{permissions:{...B&&{roles:B},...q!==void 0&&{perms:q}}}:{},...R||t.country||t.city?{device:{...R&&{deviceLabel:R},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},I=await Mn(A,e);if(I.ok===!1)return u(I.errors,I.meta);if(!I.ok)return u(j.DATABASE_ERROR());let{accessToken:S,refreshToken:y,expiresAt:x}=I.data;return await El(h,e),await gy(a,t.credentialType,e),v({accessToken:S,refreshToken:y,expiresAt:x})}var yt={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:T("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:j.VALIDATION_ERROR,DATABASE_ERROR:j.DATABASE_ERROR,INTERNAL_ERROR:j.INTERNAL_ERROR};var _b={CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function _y(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:s,device:o}=t;if(!r)return v({requiresMfa:!1});if(!n||n.length===0)return v({requiresMfa:!1});let a=n.filter(C=>e.plugins.mfa?.[C]);if(a.length===0)return v({requiresMfa:!1});let c=a.filter(C=>e.plugins.mfa?.[C]?.requiresServerDelivery),l=a.filter(C=>!e.plugins.mfa?.[C]?.requiresServerDelivery),d={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};s!==void 0&&(d.tenantId=s),o!==void 0&&(d.device=o);let p=await yl(d,e);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u([_b.CHALLENGE_CREATE_FAILED()]);let{challengeId:f,expiresAt:h,phase:g,selectedMethod:_,availableMethods:R}=p.data;return v({requiresMfa:!0,mfa:{phase:g,challengeId:f,methods:R,..._&&{method:_},expiresAt:h,userId:i}})}async function ea(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return u(yt.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Fe.PENDING)return u(yt.INVALID_CHALLENGE_STATE());if(n.phase!==gr.VERIFY_CREDENTIAL)return u(yt.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return u(yt.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(yt.CHALLENGE_EXPIRED());let s=n.method;if(!s)return u(yt.INTERNAL_ERROR());let o=e.plugins.credential[s];if(!o)return u(yt.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(x=>x.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Fe.EXPIRED}),u(yt.MAX_ATTEMPTS_EXCEEDED())):u(a.errors,a.meta);if((await o.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return u(yt.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return u(yt.USER_AUTH_NOT_FOUND());let d=l.data,p={userStatus:d.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let f=await Hr(p,e);if(f.ok===!1)return u(f.errors,f.meta);if(!f.ok)return u(yt.INTERNAL_ERROR());let{perms:h,roles:g,tenantType:_}=f.data,R=n.deviceLabel,C=n.country,D=n.city,F={};R!==void 0&&(F.deviceLabel=R),C!==void 0&&(F.country=C),D!==void 0&&(F.city=D);let J={mfaRequired:d.mfaRequired,...d.mfaMethods&&{mfaMethods:d.mfaMethods},userId:n.userId,device:F},q=await _y(J,e);if(q.ok===!1)return u(q.errors,q.meta);if(!q.ok)return u(yt.INTERNAL_ERROR());if(q.data.requiresMfa){let x={requiresMfa:!0,mfa:q.data.mfa};return v(x)}let B={};h!==void 0&&(B.perms=h),g!==void 0&&(B.roles=g);let $={userId:n.userId,permissions:B,device:F};i!==void 0&&($.tenantId=i),_!==void 0&&($.tenantType=_);let A=await Mn($,e);if(A.ok===!1)return u(A.errors,A.meta);if(!A.ok)return u(yt.INTERNAL_ERROR());let{accessToken:I,refreshToken:S,expiresAt:y}=A.data;return v({accessToken:I,refreshToken:S,expiresAt:y})}var st={MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:j.VALIDATION_ERROR,DATABASE_ERROR:j.DATABASE_ERROR,INTERNAL_ERROR:j.INTERNAL_ERROR};async function ta(t,e){if(!e.plugins.mfa)return u(st.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(st.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,s=n.deviceLabel,o=n.country,a=n.city;if(n.status!==Fe.PENDING)return u(st.INVALID_CHALLENGE_STATE());if(n.phase!==gr.VERIFY_MFA)return u(st.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return u(st.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(st.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return u(st.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return u(st.MFA_METHOD_NOT_SUPPORTED());let d=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(d.ok===!1)return d.errors.some($=>$.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(st.TOO_MANY_ATTEMPTS())):u(d.errors,d.meta);if(l.requiresServerDelivery){if(!n.codeHash)return u(st.INVALID_CHALLENGE_STATE());if(!await Is(t.code,n.codeHash))return u(st.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return u(st.MFA_METHOD_NOT_SUPPORTED());let $=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if($.ok===!1||!$.data)return u(st.INVALID_MFA_CODE());let A=$.data;if(!A.verifiedAt)return u(st.INVALID_MFA_CODE());let I=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(I.ok===!1||!I.data.verified)return u(st.INVALID_MFA_CODE());let S=I.data.data?.usedBackupCodeHash;if(S){let x=(A.data.backupCodeHashes??[]).filter(N=>N!==S);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:x}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return u(st.USER_AUTH_NOT_FOUND());let h={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},g=await Hr(h,e);if(g.ok===!1)return u(g.errors,g.meta);if(!g.ok)return u(j.DATABASE_ERROR());let{perms:_,roles:R,tenantType:C}=g.data,D={userId:n.userId,...i&&{tenantId:i},...C&&{tenantType:C},..._!==void 0||R?{permissions:{...R&&{roles:R},..._!==void 0&&{perms:_}}}:{},...s||o||a?{device:{...s&&{deviceLabel:s},...o&&{country:o},...a&&{city:a}}}:{}},F=await Mn(D,e);if(F.ok===!1)return u(F.errors,F.meta);if(!F.ok)return u(j.DATABASE_ERROR());let{accessToken:J,refreshToken:q,expiresAt:B}=F.data;return v({accessToken:J,refreshToken:q,expiresAt:B})}var gt={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:Z("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:Z("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:Z("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:Z("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:T("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:T("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:T("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function ra(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(gt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Fe.PENDING)return u(gt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return u(gt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return u(gt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return u(gt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return u(gt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return u(gt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let s=await e.plugins.database.userAuths.get(t.userId);if(!s.ok)return u(gt.CHALLENGE_ISSUE_FAILED());let o=s.data;if(!o)return u(gt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(f=>f.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(gt.TOO_MANY_ISSUES())):u(a.errors,a.meta);if(!i.sendCode)return u(gt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:o},e);if(!c.ok)return u(gt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,d=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:gr.VERIFY_MFA,codeHash:l})).ok===!1?u(gt.CHALLENGE_UPDATE_FAILED()):v({maskedRecipient:d,expiresAt:n.expiresAt})}var je={IDENTITY_PLUGIN_NOT_FOUND:Z("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:Z("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:Z("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:Z("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:T("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:T("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:T("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:T("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:T("INTERNAL_ERROR","Internal error occurred during registration")};function Ib(t,e){return e[t]}function xb(t,e){return e[t]}async function na(t,e){let r=Ib(t.identityType,e.plugins.identity);if(!r)return u(je.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return u(je.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,i);if(s.ok===!1)return u(je.DATABASE_ERROR());if(s.data)return u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let o=xb(t.credentialType,e.plugins.credential);if(!o)return u(je.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await o.create({value:t.credentialValue});if(a.ok===!1)return u(je.INVALID_CREDENTIAL());if(!a.ok)return u(je.INTERNAL_ERROR());let{value:c,data:l}=a.data,d=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let f={id:d,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===ar.EMAIL&&{contactEmail:t.identityValue},...t.identityType===ar.PHONE&&{contactPhone:t.identityValue},...t.identityType===ar.USERNAME&&{username:t.identityValue}},h={userId:d,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},g={type:t.identityType,value:i,userId:d,loginEnabled:!0,verifiedAt:null,guards:{}},_={userId:d,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===ar.EMAIL&&e.plugins.database.registration){let q=await bb({profileData:{...f,id:d},userAuthData:h,identityData:g,credentialRepoData:_,identityValue:i},e);return q.ok===!1?q.errors.some(B=>B.code==="UNIQUE_CONSTRAINT_VIOLATION")?u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):u(q.errors,q.meta):q.ok?v({userId:d,verification:{channel:"email",challengeId:q.data.challengeId,expiresAt:q.data.expiresAt,identityType:t.identityType,identityValue:i}}):u(je.INTERNAL_ERROR())}let R=await e.plugins.database.users.create(f);if(R.ok===!1||!R.data)return u(je.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(h)).ok===!1)return await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(g)).ok===!1)return await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let F=await e.plugins.database.credentials.create(_);if(F.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let J;if(t.identityType===ar.EMAIL){let q=await Nb({userId:d,identityType:t.identityType,identityValue:i},e);if(q.ok===!1)return await e.plugins.database.credentials.remove(F.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(q.errors,q.meta);if(!q.ok)return await e.plugins.database.credentials.remove(F.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.INTERNAL_ERROR());J={channel:"email",challengeId:q.data.challengeId,expiresAt:q.data.expiresAt,identityType:t.identityType,identityValue:i}}return v({userId:d,...J&&{verification:J}})}async function bb(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await Sb(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?u(je.USER_CREATION_FAILED()):((await wb({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),v({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function Sb(t,e,r){let n=on(6),i=await Kr(n),s=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),o=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:o,userId:t,purpose:xe.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:ar.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:s},pendingVerification:{challengeId:o,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:s,resendAvailableAt:a}}}async function wb(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?u(je.VERIFICATION_EMAIL_SEND_FAILED()):v(void 0):u(je.EMAIL_SYSTEM_NOT_AVAILABLE())}async function Nb(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=on(6),n=await Kr(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),s=e.plugins.database.challenges.generateChallengeId(),o=await e.plugins.database.challenges.create({id:s,userId:t.userId,purpose:xe.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(o.ok===!1)return u(o.errors,o.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:s,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(s),u(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:s,expiresAt:i.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(s),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),u(je.VERIFICATION_EMAIL_SEND_FAILED())):v({challengeId:s,expiresAt:i})}var Vn={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function ia(t,e){let{sessionId:r,userId:n,tenantId:i}=t,s=await e.plugins.database.sessions.get(r);if(s.ok===!1)return u(s.errors,s.meta);if(!s.data)return u(Vn.SESSION_NOT_FOUND());let o=s.data;if(o.revokedAt)return u(Vn.SESSION_REVOKED());if(o.userId!==n)return u(Vn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return u(a.errors,a.meta);if(!a.data)return u(Vn.USER_NOT_FOUND());let c=a.data,l=await Hr({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return u(l.errors,l.meta);if(!l.ok)return u(j.DATABASE_ERROR());let{perms:d,roles:p,tenantType:f}=l.data,h=e.plugins.database.sessions.generateTokenId(),g=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:h,...d!==void 0&&{perms:d},...p&&{roles:p},...f&&{tenantType:f}});if(g.ok===!1)return u(g.errors,g.meta);let _=_s(i,e.security),R=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:h,..._&&{aud:_},tid:i,...f&&{tty:f},...d!==void 0&&{perms:d},...p&&{roles:p}}),C=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:h,..._&&{aud:_},tid:i,...f&&{tty:f}});return v({accessToken:R.token,refreshToken:C.token,expiresAt:R.expiresAt,tenantId:i})}var Rb=/^[\w!#$%&'*.^`|~+-]+$/,Ob=/^[!#-:<>-[\]-~]+$/,kb=/^[ !#-:<-[\]-~]*$/,Iy=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},bp=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let s=i.indexOf("=");if(s===-1)continue;let o=Iy(i.substring(0,s));if(e&&e!==o||!Ob.test(o)||o in n)continue;let a=Iy(i.substring(s+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),kb.test(a)&&(n[o]=Es(a),e))break}return n};var Cb=(t,e,r={})=>{if(!Rb.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},vl=(t,e,r)=>(e=encodeURIComponent(e),Cb(t,e,r));var Sp=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let s=e;return r==="secure"?s="__Secure-"+e:r==="host"&&(s="__Host-"+e),bp(n,s)[s]}return n?bp(n):{}};var Db=(t,e,r)=>{let n;return r?.prefix==="secure"?n=vl("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=vl("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=vl(t,e,{path:"/",...r}),n},sa=(t,e,r,n)=>{let i=Db(e,r,n);t.header("Set-Cookie",i,{append:!0})};var oa=(t,e,r)=>{let n=Sp(t,e,r?.prefix);return sa(t,e,"",{...r,maxAge:0}),n};function wp(t,e){let r=t.tokenStrategy;return typeof r=="string"?r:r[e??"customer"]??"body"}function Al(t){return t==="cookie"||t==="both"}function Pb(t){let e=t.tokenStrategy;return typeof e=="string"?Al(e):Object.values(e).some(r=>r!==void 0&&Al(r))}function Np(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function Ub(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function xy(t,e,r,n,i){let s=r.refreshTokenCookie??{},o=i??Ub(r,n),a=wp(r,o),c=e.refreshToken;if(typeof c!="string"||!c)return e;if(a==="cookie"||a==="both"){let l=Np(r,o);Lb(t,c,{...s,name:l})}if(a==="cookie"){let{refreshToken:l,...d}=e;return d}return e}function by(t,e,r){if(!(r?Al(wp(e,r)):Pb(e)))return;let i=e.refreshTokenCookie??{},s={path:i.path??"/",...i.domain?{domain:i.domain}:{}},o=e.audienceCookieNames?.cookieNames;if(o&&!r){let c=i.name??"refresh_token",l=new Set([o.customer??c,o.tenant??c,o.system??c]);for(let d of l)oa(t,d,s);return}let a=Np(e,r);oa(t,a,s)}function Tl(t,e,r){let n=wp(e,r);if(!Al(n)||!t)return;let i=Np(e,r);return Mb(t,i)}function Lb(t,e,r){sa(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function Mb(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var Sy=new Set(["customer","tenant","system"]);function Pe(t,e){let r=[];if(e.auth!==!1&&r.push(Mo({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(Ho(a))}let n=async a=>{let c=or(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let d=a.get("authResult"),p={body:Fo(a),query:Bo(a),params:Vo(a),user:d?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},f=await e.handler(p),h=e.successStatus;if(f.ok&&f.data!==void 0&&e.tokenMode==="auth"){let g=f.data,_=typeof g.tenantId=="string"?g.tenantId:void 0,R=p.authContextHeader,C=_!==void 0?void 0:typeof R=="string"&&Sy.has(R)?R:void 0,D=xy(a,g,t,_,C),F={...f,data:D};return Be(a,F,{traceId:c,...h!==void 0?{successStatus:h}:{}})}if(f.ok&&e.tokenMode==="logout"){let g=p.authContextHeader,_=typeof g=="string"&&Sy.has(g)?g:void 0;by(a,t,_)}return Be(a,f,{traceId:c,...h!==void 0?{successStatus:h}:{}})}catch(l){let d=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:d}})),Be(a,u(ie.InternalError()),{traceId:c})}},i=[...r,n],o=async(a,c)=>{let l,d=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let f=i[p],h=await f(a,async()=>{await d(p+1)});h instanceof Response&&(l=h)};return await d(0),l};return o.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},o}function Fr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function wy(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function Ny(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function Ry(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function Oy(t){return{plugins:{database:t.plugins.database}}}function ky(t){return Pe(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Rt.authenticate.body},handler:async e=>{let r=Fr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Zo(n,r)}})}function Cy(t){return Pe(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Rt.completeChallenge.body},handler:async e=>{let r=Fr(t.auth);return ea({challengeId:e.body.challengeId,code:e.body.code},r)}})}function Dy(t){return Pe(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Rt.completeMfaChallenge.body},handler:async e=>{let r=Fr(t.auth);return ta({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function Py(t){return Pe(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Rt.issueMfaChallenge.body},handler:async e=>{let r=Fr(t.auth);return ra({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function _l(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var Kb=new Set(["customer","tenant","system"]);function Uy(t){return Pe(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Kb.has(r)?r:void 0,i=Tl(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!_l(e.originHeader,t.trustedOrigins))return u(ie.NotAuthenticated());let a=o??i;if(!a)return u(ie.ValidationError());let c=Ny(t.auth);return ml({refreshToken:a},c)}})}function Hb(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function Bn(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=Hb(e);return typeof r?.sid=="string"?r.sid:void 0}function Ly(t){return Pe(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=Bn(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return u(ie.NotAuthenticated())}let n=Oy(t.auth);return Yo({userId:e.user.id},n)}})}var Fb=new Set(["customer","tenant","system"]);function My(t){return Pe(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Fb.has(r)?r:void 0,i=Tl(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!_l(e.originHeader,t.trustedOrigins))return u(ie.NotAuthenticated());let a=o??i;if(!a)return u(ie.ValidationError());let c=Ry(t.auth);return hl({refreshToken:a},c)}})}function Ky(t){return Pe(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Rt.register.body},handler:async e=>{let r=wy(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),na(n,r)}})}function Hy(t){return Pe(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Rt.selectTenant.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=Bn(e.authorizationHeader);if(!r)return u(ie.NotAuthenticated());let n=Fr(t.auth);return ia({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var aa={USER_AUTH_NOT_FOUND:Z("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Z("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:Z("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function Il(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(aa.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return u(aa.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return u(i.errors,i.meta);let s=i.data??[];t.verifiedOnly&&(s=s.filter(a=>a.verifiedAt!==null));let o=s.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return v({authenticators:o,total:o.length})}var an={USER_AUTH_NOT_FOUND:Z("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Z("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:Z("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:Z("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:Z("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:Z("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:Z("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:Z("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var cn={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function xl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(an.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(an.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(an.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok||!i.data)return u(an.AUTHENTICATOR_NOT_FOUND());let s=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(s.ok===!1)return u(s.errors,s.meta);let o=s.data??[],a=o.filter(_=>_.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return u(an.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let _=await e.plugins.database.credentials.getByUserIdAndType(t.userId,cn.PASSWORD);if(_.ok===!1)return u(_.errors,_.meta);let R=_.data;if(R&&R.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:R.value,data:R.data??{}},credentialValue:t.password})).ok===!1)return u(an.INVALID_PASSWORD())}let d=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(d.ok===!1)return u(d.errors,d.meta);let f=o.filter(_=>_.method===t.method&&(_.id!==t.authenticatorId||_.method!==t.method)).length,h=a.length>1||a.length===1&&!l;await Ie({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:h,remainingCount:f}});let g={method:t.method,mfaStillEnabled:h,remainingCount:f};return t.authenticatorId!==void 0&&(g.authenticatorId=t.authenticatorId),v(g)}var ln={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Z("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:j.DATABASE_ERROR,INTERNAL_ERROR:j.INTERNAL_ERROR};async function bl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(ln.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(ln.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(ln.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return u(ln.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return u(ln.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let s=await i.setup({userId:t.userId,data:t.data||{}},e);if(s.ok===!1)return u(s.errors,s.meta);if(!s.ok)return u(ln.INTERNAL_ERROR());let o=s.data;if(o.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:o.credentialData});if(l.ok===!1)return u(l.errors,l.meta)}await Ie({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=o;return v({method:t.method,data:c})}var dt={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:T("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:T("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:T("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:T("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:Z("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:Z("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:T("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:j.INTERNAL_ERROR};var Fy=["totp","webauthn","passkey","hardware"],Vy=["email","sms","phone"],Vb=new Set([...Fy,...Vy]);async function Sl(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return u(dt.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!Vb.has(i))return u(dt.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return u(dt.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return u(dt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(dt.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(dt.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(dt.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return u(dt.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return u(dt.MFA_NOT_ENABLED());if(!t.password)return u(dt.PASSWORD_REQUIRED());let i=await Bb(t.userId,t.password,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await jb(t.userId,t.mfaMethods,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return u(i.errors,i.meta)}return await Ie({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),v()}async function Bb(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,cn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(dt.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(dt.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return u(dt.PASSWORD_PLUGIN_NOT_CONFIGURED());let s=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return s.ok===!1?u(s.errors,s.meta):v()}async function jb(t,e,r){let n=e.filter(s=>Fy.includes(s)),i=e.filter(s=>Vy.includes(s));if(n.length>0){let s=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!o.has(a))return u(dt.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let s=await r.plugins.database.identities.getByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!o.has(a))return u(dt.METHOD_NOT_VERIFIED({method:a}))}return v()}var vr={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Z("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:T("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:T("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:j.DATABASE_ERROR,INTERNAL_ERROR:j.INTERNAL_ERROR};async function wl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(vr.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(vr.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(vr.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok)return u(vr.INTERNAL_ERROR());let s=i.data;if(!s)return u(vr.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return u(vr.MFA_NOT_AVAILABLE());let o=e.plugins.mfa[t.method];if(!o?.verifyWithCredentials)return u(vr.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await o.verifyWithCredentials({credentialData:s.data,data:t.data||{}});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(vr.INTERNAL_ERROR());let c=a.data;if(!c.verified)return v({method:t.method,verified:!1,data:c.data||{}});if(!s.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return u(l.errors,l.meta);let d=n.mfaMethods||[];if(!d.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...d,t.method]);if(p.ok===!1)return u(p.errors,p.meta)}}return await Ie(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),v({method:t.method,verified:!0,data:c.data||{}})}function ca(t){return{system:{systemId:t.system.system.systemId}}}function By(t){let e={plugins:{database:t.plugins.database},system:ca(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function jy(t){let e={plugins:{database:t.plugins.database},system:ca(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function qy(t){return{plugins:{database:t.plugins.database},system:ca(t)}}function Gy(t){let e={plugins:{database:t.plugins.database},system:ca(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function $y(t){let e={plugins:{database:t.plugins.database},system:ca(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Wy(t){return X(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=qy(t.auth);return Il({userId:e.user.id},r)}})}function zy(t){return X(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:yr.removeAuthenticator.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=Gy(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),xl(n,r)}})}function Jy(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:yr.setupAuthenticator.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=By(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),bl(n,r)}})}function Yy(t){return X(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:yr.updateMfaSettings.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=$y(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),Sl(n,r)}})}function Xy(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:yr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=jy(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),wl(n,r)}})}var Nl={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function Rl(t,e){if(!await e.plugins.database.users.getById(t.userId))return u(Nl.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(!i)return v([]);let s=i.map(o=>{let a={provider:o.provider,externalId:o.externalId,linkedAt:o.createdAt};return o.externalEmail&&(a.externalEmail=o.externalEmail),o.externalName&&(a.externalName=o.externalName),a});return v(s)}var vt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:T("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:T("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:T("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function qb(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return u(j.DATABASE_ERROR());let d=l.data;if(d.userStatus===ye.DELETED)return u(j.ACCOUNT_DELETED());if(d.userStatus===ye.SUSPENDED)return u(j.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let f=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(f.ok===!1)return u(f.errors,f.meta)}return v(c)}let s=null;if(t.email){let c=Qo(ar.EMAIL,e.plugins.identity);if(!c)return u(j.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),d=await e.plugins.database.identities.get(ar.EMAIL,l);if(d.ok===!1)return u(j.DATABASE_ERROR());if(d.data){if(t.emailVerified!==!0)return u(vt.EMAIL_NOT_VERIFIED_BY_PROVIDER());s=d.data.userId;let p=await e.plugins.database.userAuths.get(s);if(!p.ok||!p.data)return u(j.DATABASE_ERROR());let f=p.data;if(f.userStatus===ye.DELETED)return u(j.ACCOUNT_DELETED());if(f.userStatus===ye.SUSPENDED)return u(j.ACCOUNT_SUSPENDED())}}if(!s){if(!t.email)return u(vt.EMAIL_REQUIRED());s=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let R=t.name.trim().split(/\s+/);c=R[0]||"",l=R.slice(1).join(" ")||""}let d={id:s,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(d)).ok)return u(j.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:s,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(s),u(j.DATABASE_ERROR());let h=Qo(ar.EMAIL,e.plugins.identity);if(!h)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(j.PLUGIN_NOT_FOUND());let g=h.normalize(t.email),_=await e.plugins.database.identities.create({type:ar.EMAIL,value:g,userId:s,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(_.ok===!1)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(_.errors,_.meta)}let o={userId:s,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(o.externalEmail=t.email),t.name!==void 0&&(o.externalName=t.name),t.avatarUrl!==void 0&&(o.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(o);return a.ok===!1?u(a.errors,a.meta):v(s)}async function Ol(t,e){if(!t.provider)return u(vt.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return u(vt.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return u(vt.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return u(vt.PROVIDER_NOT_FOUND());let _=await r.verifyCredential(t.credential);if(_.ok===!1)return u(vt.CODE_EXCHANGE_FAILED());if(n=_.data,!n)return u(vt.PROFILE_FETCH_FAILED())}else if(t.code){let _=await r.exchangeCodeForToken(t.code);if(_.ok===!1)return u(vt.CODE_EXCHANGE_FAILED());let R=_.data;if(!R)return u(vt.CODE_EXCHANGE_FAILED());i=R.accessToken}if(!n){if(!i)return u(vt.INVALID_ACCESS_TOKEN());let _=await r.getUserProfile(i);if(_.ok===!1)return u(vt.PROFILE_FETCH_FAILED());if(n=_.data,!n)return u(vt.PROFILE_FETCH_FAILED())}let s=await qb(n,e,t);if(!s.ok)return u(s.errors,s.meta);let o=s.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(o);if(!c.ok||!c.data)return u(j.DATABASE_ERROR());let l=await Hr({userStatus:c.data.userStatus,userId:o,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return u(l.errors,l.meta);let{perms:d,roles:p,tenantType:f}=l.data,h={userId:o,...t.tenantId&&{tenantId:t.tenantId},...f&&{tenantType:f},...d!==void 0||p?{permissions:{...p&&{roles:p},...d!==void 0&&{perms:d}}}:{}},g=await Mn(h,a);return g.ok===!1?u(g.errors,g.meta):(await Ie(e,{event:"oauth_login_success",userId:o,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await El(o,e),v({accessToken:g.data.accessToken,refreshToken:g.data.refreshToken,expiresAt:g.data.expiresAt}))}catch(n){return await Ie(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),u(vt.PROFILE_FETCH_FAILED())}}var Ot={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:T("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:T("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function kl(t,e){if(!t.code)return u(Ot.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return u(Ot.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return u(Ot.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let f=await n.exchangeCodeForToken(t.code);if(f.ok===!1)return u(Ot.CODE_EXCHANGE_FAILED());let h=f.data;if(!h)return u(Ot.CODE_EXCHANGE_FAILED());i=h.accessToken}if(!i)return u(Ot.INVALID_ACCESS_TOKEN());let s=await n.getUserProfile(i);if(s.ok===!1)return u(Ot.PROFILE_FETCH_FAILED());let o=s.data;if(!o)return u(Ot.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,o.id);if(a.ok===!1)return u(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?u(Ot.PROVIDER_ALREADY_LINKED()):u(Ot.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:o.id,createdAt:new Date};o.email!==void 0&&(l.externalEmail=o.email),o.name!==void 0&&(l.externalName=o.name),o.avatarUrl!==void 0&&(l.externalAvatarUrl=o.avatarUrl);let d=await e.plugins.database.userProviders.create(l);if(d.ok===!1)return u(d.errors,d.meta);let p=d.data;return p?(await Ie(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:o.id}}),v(p)):u(Ot.PROFILE_FETCH_FAILED())}catch(i){return await Ie(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),u(Ot.PROFILE_FETCH_FAILED())}}var ws={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:T("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:T("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function Cl(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return u(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return u(ws.PROVIDER_NOT_LINKED());let i=n.find(o=>o.provider===t.provider);if(!i)return u(ws.PROVIDER_NOT_LINKED());if(n.length<=1){let o=await e.plugins.database.identities.getByUserId(t.userId);if(!(o.ok&&o.data&&o.data.length>0))return u(ws.CANNOT_UNLINK_LAST_PROVIDER())}let s=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return s.ok===!1?u(s.errors,s.meta):(await Ie(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),v())}function Qy(t){return X(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=t.auth;return Rl({userId:e.user.id},r)}})}function Zy(t){return X(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:tn.linkProvider.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),kl(n,r)}})}function eg(t){return Pe(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:tn.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),Ol(n,r)}})}function tg(t){return X(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:tn.unlinkProvider.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=t.auth;return Cl({userId:e.user.id,provider:e.body.provider},r)}})}var xt={PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:T("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:T("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:T("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:T("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},Ar={PASSWORD_PLUGIN_NOT_CONFIGURED:xt.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:xt.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:xt.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:xt.SAME_PASSWORD},Ii={EMAIL_SYSTEM_NOT_AVAILABLE:xt.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:xt.SEND_EMAIL_ERROR},Ht={PASSWORD_PLUGIN_NOT_CONFIGURED:xt.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:xt.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:xt.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:xt.CHALLENGE_ALREADY_USED,INVALID_CODE:xt.INVALID_CODE,TOO_MANY_ATTEMPTS:xt.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:xt.AUTH_SCOPE_MISMATCH};async function Ns(t,e){if(!e.plugins.credential?.password)return u(Ar.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,cn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Ar.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(Ar.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return u(Ar.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return u(Ar.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Ar.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return u(l.errors,l.meta);let d=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return d.ok===!1&&console.error("Failed to revoke sessions after password change:",d.errors),await Ie(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),v()}async function Rs(t,e){if(!e.plugins.emailSystem)return u(Ii.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=on(6),s=await Kr(i),o=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return v({challengeId:`fake_challenge_${Date.now()}`,expiresAt:o});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===xe.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return v({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),d=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:xe.PASSWORD_RESET,status:Fe.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:s,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:o});if(d.ok===!1)return u(d.errors,d.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:o.toISOString(),purpose:xe.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),u(Ii.SEND_EMAIL_ERROR());let f=Math.max(0,e.security.verificationResendCooldownSeconds),h=f>0?new Date(Date.now()+f*1e3):null,g=!c||c.purpose===xe.PASSWORD_RESET;return await Promise.all([g?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:xe.PASSWORD_RESET,channel:"email",expiresAt:o,resendAvailableAt:h}}):Promise.resolve(),Ie(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),v({challengeId:l,expiresAt:o})}async function Os(t,e){if(!e.plugins.credential?.password)return u(Ht.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Ht.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==xe.PASSWORD_RESET)return u(Ht.CHALLENGE_NOT_FOUND());if(i.status!==Fe.PENDING)return u(Ht.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return u(Ht.CHALLENGE_EXPIRED());let s=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(s.ok===!1)return s.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?u(Ht.TOO_MANY_ATTEMPTS()):u(s.errors,s.meta);if(!i.codeHash)return u(Ht.INVALID_CODE());if(!await Is(t.code,i.codeHash))return u(Ht.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Ht.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,cn.PASSWORD);if(l.ok===!1)return u(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return u(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:cn.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return u(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let d=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return d.ok===!1&&console.error("Failed to revoke sessions after password reset:",d.errors),await Ie(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),v()}var Dl={NO_CHANGES_PROVIDED:T("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function Pl(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return u(Dl.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return u(j.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return u(j.INTERNAL_ERROR());await Ie(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let o=await e.plugins.database.users.getById(t.userId);return!o.ok||o.data===null?u(j.NOT_FOUND()):v(o.data)}function ks(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function rg(t){return Pe(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:rn.changePassword.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=ks(t.auth),n=e.body,i=Bn(e.authorizationHeader);return Ns({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function ng(t){return Pe(t,{method:"POST",path:"/password/forgot",auth:!1,input:{body:rn.forgotPassword.body},handler:async e=>{let r=ks(t.auth),n={email:e.body.email};return e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),Rs(n,r)}})}function ig(t){return X(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:rn.resetPassword.body},handler:async e=>{let r=ks(t.auth);return Os({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var la={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:T("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to delete session")};async function ua(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?u(la.DATABASE_ERROR()):(await Ie(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),v())}var da={DATABASE_ERROR:T("DATABASE_ERROR","Failed to retrieve sessions")};async function pa(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return u(da.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return v(a,i.meta)}var Cs={INVALID_TOKEN:T("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to revoke token")};async function fa(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?u(Cs.DATABASE_ERROR()):(await Ie(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),v()):u(Cs.INVALID_TOKEN())}function sg(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function og(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function ag(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function cg(t){return X(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:nn.deleteSession.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=og(t.auth);return ua({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function lg(t){return Pe(t,{method:"GET",path:"/sessions",auth:!0,input:{query:nn.listSessions.query},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=sg(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await pa(n,r);if(!i.ok)return i;let s=Bn(e.authorizationHeader);if(s&&i.data){let o=i.data.map(a=>a.id===s?{...a,isCurrent:!0}:a);return v(o,i.meta)}return i}})}function ug(t){return X(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:nn.revokeToken.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=ag(t.auth);return fa({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},ma=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function ha(t,e){return t===void 0?!1:(t&e)===e}var Rp={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},dg=Object.fromEntries(Object.entries(Rp).map(([t,e])=>[e,Number(t)]));function Wt(t){return t?Object.entries(Rp).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function jn(t){let e=0;for(let r of t){let n=dg[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var zt={SYSTEM:"system",DEFAULT:"org"};var cr={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var Tr={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:T("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:T("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","This invite grants permissions the inviter is not entitled to confer"),DATABASE_ERROR:j.DATABASE_ERROR};var Gb={IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:T("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:T("IDENTITY_ALREADY_EXISTS","This identity is already registered")},$b={GUARD_LOCKED:T("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},Wb={INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:T("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:T("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:T("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:T("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},zb={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:T("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:T("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:T("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},Jb={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:T("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:T("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},Yb={MFA_NOT_CONFIGURED:T("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:T("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:T("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:T("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},Xb={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:T("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:T("INVALID_SESSION","Invalid session")},Qb={TOKEN_NOT_FOUND:T("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:T("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:T("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:T("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:T("TOKEN_VERIFICATION_FAILED","Token verification failed")},bt={NOT_MEMBER_OF_TENANT:T("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:T("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:T("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:T("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:T("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},sz={...Gb,...$b,...Wb,...zb,...Jb,...Yb,...Xb,...Qb,...bt};async function Ul(t,e,r,n={}){let{requireVerified:i=!0}=n;if(t.inviteeUserId)return v(t.inviteeUserId===e?null:"user-mismatch");if(t.inviteeEmail||t.inviteePhone){let s=await r.getByUserId(e);if(!s.ok)return u(s.errors,s.meta);let o=i?s.data.filter(p=>p.verifiedAt!==null):s.data,a=(p,f)=>p==="phone"?f.replace(/[\s()\-.]/g,""):f.trim().toLowerCase(),c=(p,f)=>{let h=a(p,f);return h?o.some(g=>g.type===p&&a(p,g.value)===h):!1},l=t.inviteeEmail?c("email",t.inviteeEmail):!1,d=t.inviteePhone?c("phone",t.inviteePhone):!1;return!l&&!d?v("identity-mismatch"):v(null)}return v("identity-mismatch")}function qn(t,e){let{authPerm:r,roles:n,perms:i}=e;if(t.isOwner)return!1;if(r!==void 0&&(r&~(t.authPerm??0))!==0||r!==void 0&&(r&se.CHANGE_MEMBER_PERMISSION)!==0||n?.some(s=>s.trim().toLowerCase()===Xo.OWNER))return!0;if(i!==void 0){let s=t.perms??{},o=(c,l)=>c[l]??c["*"]??0,a=new Set([...Object.keys(i),...Object.keys(s),"*"]);for(let c of a)if((o(i,c)&~o(s,c))!==0)return!0}return!1}async function Ds(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Tr.INVITE_IDENTIFIER_REQUIRED());let o=null,a=!1;if(r){let F=await s.tenantInvites.getById(r);if(!F.ok)return u(F.errors,F.meta);o=F.data}else if(n){let F=await s.tenantInvites.getByToken(n);if(!F.ok)return u(F.errors,F.meta);o=F.data,a=!0}if(!o)return u(Tr.INVITE_NOT_FOUND());if(o.status!==cr.PENDING)return u(Tr.INVITE_NOT_PENDING());if(o.expiresAt<new Date)return u(Tr.INVITE_EXPIRED());let c=await Ul(o,i,s.identities,{requireVerified:!a});if(!c.ok)return u(c.errors,c.meta);if(c.data==="user-mismatch")return u(Tr.INVITE_USER_MISMATCH());if(c.data==="identity-mismatch")return u(Tr.INVITE_IDENTITY_MISMATCH());let l=await s.tenantMembers.get(o.tenantId,i);if(!l.ok)return u(l.errors,l.meta);if(l.data&&l.data.status!==it.REMOVED)return u(Tr.ALREADY_MEMBER());let d=await s.tenants.get(o.tenantId);if(!d.ok)return u(d.errors,d.meta);if(o.authPerm!==void 0&&(o.authPerm&ma)!==0){if(!d.data)return u(bt.TENANT_NOT_FOUND());if(d.data.type!==zt.SYSTEM)return u(bt.ACCOUNT_PERMS_SYSTEM_ONLY())}let p={tenantId:o.tenantId,userId:i,status:it.ACTIVE,isOwner:!1,tenantType:o.tenantType};if(d.data?.parentTenantId!==void 0&&(p.parentTenantId=d.data.parentTenantId),o.authPerm!==void 0||o.roles!==void 0||o.perms!==void 0){let F=await s.tenantMembers.get(o.tenantId,o.invitedById);if(!F.ok)return u(F.errors,F.meta);let J=F.data,q=J&&J.status===it.ACTIVE?J:{isOwner:!1,authPerm:0,perms:{}};if(qn(q,{authPerm:o.authPerm,roles:o.roles,perms:o.perms}))return u(Tr.CANNOT_ESCALATE_PERMISSIONS())}o.roles!==void 0&&(p.roles=o.roles),o.perms!==void 0&&(p.perms=o.perms),o.authPerm!==void 0&&(p.authPerm=o.authPerm);let h=await s.tenantMembers.create(p);if(!h.ok)return u(h.errors,h.meta);let g={tenantId:o.tenantId,userId:i},_=await s.users.getById(i);_.ok&&_.data&&(_.data.contactEmail&&(g.contactEmail=_.data.contactEmail),_.data.contactPhone&&(g.contactPhone=_.data.contactPhone),_.data.displayName&&(g.displayName=_.data.displayName),_.data.givenName&&(g.givenName=_.data.givenName),_.data.familyName&&(g.familyName=_.data.familyName),_.data.avatarUrl&&(g.avatarUrl=_.data.avatarUrl),_.data.locale&&(g.locale=_.data.locale)),o.displayName&&(g.displayName=o.displayName),o.givenName&&(g.givenName=o.givenName),o.familyName&&(g.familyName=o.familyName),o.jobTitle&&(g.jobTitle=o.jobTitle);let R=await s.userTenantProfiles.create(g);if(!R.ok)return u(R.errors,R.meta);let C=await s.tenantInvites.updateStatus(o.id,{status:cr.ACCEPTED,acceptedAt:new Date});if(!C.ok)return u(C.errors,C.meta);let D={tenantId:o.tenantId};return o.roles!==void 0&&(D.roles=o.roles),o.perms!==void 0&&(D.perms=o.perms),o.authPerm!==void 0&&(D.authPerm=o.authPerm),v(D)}var xi={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function bi(t,e,r){if(t===void 0||(t&ma)===0)return v(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==zt.SYSTEM?u(bt.ACCOUNT_PERMS_SYSTEM_ONLY()):v(void 0):u(bt.TENANT_NOT_FOUND()):u(n.errors,n.meta)}var Ll={NOT_MEMBER:bt.NOT_MEMBER_OF_TENANT,SUSPENDED:bt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:bt.INSUFFICIENT_TENANT_PERMISSIONS};async function lt(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,s=await e.tenantMembers.get(r,n);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(Ll.NOT_MEMBER());let o=s.data;return o.status!==it.ACTIVE?u(Ll.SUSPENDED()):o.isOwner?v(o):ha(o.authPerm,i)?v(o):u(Ll.INSUFFICIENT_PERMISSIONS())}async function Ml(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await lt({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(qn(o.data,{authPerm:t.authPerm,roles:t.roles,perms:t.perms}))return u(xi.CANNOT_ESCALATE_PERMISSIONS());let a=await bi(t.authPerm,r,s.tenants);if(!a.ok)return u(a.errors,a.meta);let c=await s.users.getById(n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(xi.USER_NOT_FOUND());let l=c.data,d=await s.tenantMembers.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(d.data&&d.data.status!==it.REMOVED)return u(xi.ALREADY_MEMBER());let p=await s.tenants.get(r);if(!p.ok)return u(p.errors,p.meta);if(!p.data)return u(xi.TENANT_NOT_FOUND());let f=p.data,h={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!1,tenantType:f.type};f.parentTenantId!==void 0&&(h.parentTenantId=f.parentTenantId),t.roles!==void 0&&(h.roles=t.roles),t.perms!==void 0&&(h.perms=t.perms),t.authPerm!==void 0&&(h.authPerm=t.authPerm);let g=await s.tenantMembers.create(h);if(!g.ok)return u(g.errors,g.meta);let _={tenantId:r,userId:n};l.contactEmail&&(_.contactEmail=l.contactEmail),l.contactPhone&&(_.contactPhone=l.contactPhone),l.displayName&&(_.displayName=l.displayName),l.givenName&&(_.givenName=l.givenName),l.familyName&&(_.familyName=l.familyName),l.avatarUrl&&(_.avatarUrl=l.avatarUrl),l.locale&&(_.locale=l.locale),t.contactEmail!==void 0&&(_.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(_.contactPhone=t.contactPhone),t.displayName!==void 0&&(_.displayName=t.displayName),t.givenName!==void 0&&(_.givenName=t.givenName),t.familyName!==void 0&&(_.familyName=t.familyName),t.avatarUrl!==void 0&&(_.avatarUrl=t.avatarUrl),t.locale!==void 0&&(_.locale=t.locale),t.jobTitle!==void 0&&(_.jobTitle=t.jobTitle),t.bio!==void 0&&(_.bio=t.bio),t.metadata!==void 0&&(_.metadata=t.metadata);let R=await s.userTenantProfiles.create(_);return R.ok?v({tenantId:r,userId:n}):u(R.errors,R.meta)}var Ps={TENANT_ALREADY_HAS_OWNER:T("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:T("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:j.DATABASE_ERROR};async function Kl(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:s,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:f,locale:h,jobTitle:g,bio:_,metadata:R}=t,C=e.plugins.database,D=i??"org";if(D===zt.SYSTEM)return u(Ps.SYSTEM_TYPE_FORBIDDEN());let F=await C.users.getById(n);if(!F.ok)return u(F.errors,F.meta);if(!F.data)return u(Ps.USER_NOT_FOUND());let J=await C.tenants.get(r);if(!J.ok)return u(J.errors,J.meta);if(!J.data){let S={id:r,type:D,ownerId:n};s!==void 0&&(S.parentTenantId=s);let y=await C.tenants.create(S);if(!y.ok)return u(y.errors,y.meta)}let q=await C.tenantMembers.hasOwner(r);if(!q.ok)return u(q.errors,q.meta);if(q.data)return u(Ps.TENANT_ALREADY_HAS_OWNER());let B=J.data?.parentTenantId??s,$={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!0,tenantType:D};B!==void 0&&($.parentTenantId=B);let A=await C.tenantMembers.create($);if(!A.ok)return u(A.errors,A.meta);let I=await C.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:f,locale:h,jobTitle:g,bio:_,metadata:R});return I.ok?v({tenantId:r,userId:n}):u(I.errors,I.meta)}async function Hl(t,e){let{email:r,phone:n}=t,i=e.plugins.database,s=[],o=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}return v({pendingInvites:s})}var Gn={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:T("INVITE_IDENTITY_MISMATCH","This invite was sent to an identity you do not own"),DATABASE_ERROR:j.DATABASE_ERROR};async function Us(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Gn.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let l=await s.tenantInvites.getById(r);if(!l.ok)return u(l.errors,l.meta);o=l.data}else if(n){let l=await s.tenantInvites.getByToken(n);if(!l.ok)return u(l.errors,l.meta);o=l.data}if(!o)return u(Gn.INVITE_NOT_FOUND());if(o.status!==cr.PENDING)return u(Gn.INVITE_NOT_PENDING());let a=await Ul(o,i,s.identities,{requireVerified:!1});if(!a.ok)return u(a.errors,a.meta);if(a.data==="user-mismatch")return u(Gn.INVITE_USER_MISMATCH());if(a.data==="identity-mismatch")return u(Gn.INVITE_IDENTITY_MISMATCH());let c=await s.tenantInvites.updateStatus(o.id,{status:cr.DECLINED,declinedAt:new Date});return c.ok?v(void 0):u(c.errors,c.meta)}async function Si(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[s,o]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(bt.NOT_MEMBER_OF_TENANT());if(!o.ok)return u(o.errors,o.meta);let a=s.data,c=o.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),v(l)}var Jt={INVITEE_REQUIRED:T("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:Z("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:T("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:Z("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:j.DATABASE_ERROR};function Zb(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function Ls(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:s,inviteePhone:o,role:a,perms:c,authPerm:l,displayName:d,givenName:p,familyName:f,jobTitle:h}=t,g=t.roles??(a!==void 0?[a]:void 0),_=e.plugins.database,R=await lt({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:_.tenantMembers});if(!R.ok)return u(R.errors,R.meta);if(qn(R.data,{authPerm:l,roles:g,perms:c}))return u(Jt.CANNOT_ESCALATE_PERMISSIONS());let C=await bi(l,r,_.tenants);if(!C.ok)return u(C.errors,C.meta);if(!i&&!s&&!o)return u(Jt.INVITEE_REQUIRED());if(i){let w=await _.users.getById(i);if(!w.ok)return u(w.errors,w.meta);if(!w.data)return u(Jt.INVITEE_USER_NOT_FOUND({userId:i}));let k=await _.tenantMembers.get(r,i);if(!k.ok)return u(k.errors,k.meta);if(k.data&&k.data.status!==it.REMOVED)return u(Jt.ALREADY_MEMBER());let P=await _.tenantInvites.findByTenantAndUserId(r,i);if(!P.ok)return u(P.errors,P.meta);if(P.data)return u(Jt.INVITE_ALREADY_EXISTS())}if(s){let w=await _.identities.get("email",s);if(!w.ok)return u(w.errors,w.meta);if(w.data){let P=await _.tenantMembers.get(r,w.data.userId);if(!P.ok)return u(P.errors,P.meta);if(P.data&&P.data.status!==it.REMOVED)return u(Jt.ALREADY_MEMBER())}let k=await _.tenantInvites.findByTenantAndEmail(r,s);if(!k.ok)return u(k.errors,k.meta);if(k.data)return u(Jt.INVITE_ALREADY_EXISTS())}if(o){let w=await _.identities.get("phone",o);if(!w.ok)return u(w.errors,w.meta);if(w.data){let P=await _.tenantMembers.get(r,w.data.userId);if(!P.ok)return u(P.errors,P.meta);if(P.data&&P.data.status!==it.REMOVED)return u(Jt.ALREADY_MEMBER())}let k=await _.tenantInvites.findByTenantAndPhone(r,o);if(!k.ok)return u(k.errors,k.meta);if(k.data)return u(Jt.INVITE_ALREADY_EXISTS())}let D=await _.tenantInvites.countPendingByTenant(r);if(!D.ok)return u(D.errors,D.meta);if(D.data>=e.security.maxPendingInvitesPerTenant)return u(Jt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let F,J,q,B=await _.users.getById(n);B.ok&&B.data&&(B.data.displayName!==void 0&&(F=B.data.displayName),B.data.contactEmail!==void 0&&(J=B.data.contactEmail));let $=await _.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(F=$.data.displayName),$.data.jobTitle!==void 0&&(q=$.data.jobTitle));let A=zt.DEFAULT,I=await _.tenants.get(r);I.ok&&I.data&&(A=I.data.type);let S=_.tenantInvites.generateInviteId(),y=Zb(),x=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),N={id:S,tenantId:r,tenantType:A,invitedById:n,status:cr.PENDING,inviteToken:y,expiresAt:x};F!==void 0&&(N.invitedByName=F),J!==void 0&&(N.invitedByEmail=J),q!==void 0&&(N.invitedByJobTitle=q),i!==void 0&&(N.inviteeUserId=i),s!==void 0&&(N.inviteeEmail=s),o!==void 0&&(N.inviteePhone=o),g!==void 0&&(N.roles=g),c!==void 0&&(N.perms=c),l!==void 0&&(N.authPerm=l),d!==void 0&&(N.displayName=d),p!==void 0&&(N.givenName=p),f!==void 0&&(N.familyName=f),h!==void 0&&(N.jobTitle=h);let O=await _.tenantInvites.create(N);return O.ok?v({inviteId:S,inviteToken:y,expiresAt:x}):u(O.errors,O.meta)}async function Ms(t,e){let{tenantId:r,actorUserId:n,status:i}=t,s=e.plugins.database,o=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await s.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?v(c.data,c.meta):u(c.errors,c.meta)}async function Ks(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,s=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return u(s.errors,s.meta);let o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(o).length>0?o:void 0);return a.ok?v(a.data,a.meta):u(a.errors,a.meta)}async function Fl(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let s=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return s.ok?v(s.data,s.meta):u(s.errors,s.meta)}var wi={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:T("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:T("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:j.DATABASE_ERROR};async function Hs(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await lt({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(i===n)return u(wi.CANNOT_REMOVE_SELF());let a=await s.tenantMembers.get(r,n);if(!a.ok)return u(a.errors,a.meta);if(!a.data)return u(wi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!o.data.isOwner)return u(wi.CANNOT_MODIFY_OWNER());if(c.isOwner){let d=await s.tenantMembers.listByTenant(r);if(!d.ok)return u(d.errors,d.meta);if(d.data.filter(f=>f.isOwner&&f.status===it.ACTIVE).length<=1)return u(wi.CANNOT_REMOVE_LAST_OWNER())}let l=await s.tenantMembers.remove(r,n);return l.ok?(await s.userTenantProfiles.remove(r,n),v(void 0)):u(l.errors,l.meta)}var Ea={INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:j.DATABASE_ERROR};async function Fs(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,s=await i.tenantInvites.getById(r);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(Ea.INVITE_NOT_FOUND());let o=await lt({tenantId:s.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(s.data.status!==cr.PENDING)return u(Ea.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:cr.REVOKED,revokedAt:new Date});return a.ok?v(void 0):u(a.errors,a.meta)}var $n={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:j.DATABASE_ERROR};async function Vs(t,e){let{tenantId:r,userId:n,actorUserId:i,role:s,perms:o,authPerm:a}=t,c=t.roles??(s!==void 0?[s]:void 0),l=e.plugins.database,d=await lt({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!d.ok)return u(d.errors,d.meta);let p=d.data;if(i===n)return u($n.CANNOT_MODIFY_SELF());let f=await l.tenantMembers.get(r,n);if(!f.ok)return u(f.errors,f.meta);if(!f.data)return u($n.MEMBER_NOT_FOUND());if(f.data.isOwner)return u($n.CANNOT_MODIFY_OWNER());let h=f.data,g=a===void 0?void 0:a&~(h.authPerm??0),_=B=>B.trim().toLowerCase(),R=new Set(h.roles?.map(_)),C=c?.filter(B=>_(B)===Xo.OWNER||!R.has(_(B))),D=(B,$)=>B?.[$]??B?.["*"]??0,F=o===void 0?void 0:Object.fromEntries([...new Set([...Object.keys(o),...Object.keys(h.perms??{}),"*"])].map(B=>{let $=D(o,B);return[B,$&~D(h.perms,B)]}));if(qn(p,{authPerm:g,roles:C,perms:F}))return u($n.CANNOT_ESCALATE_PERMISSIONS());if(!p.isOwner){let B=a===void 0?0:(h.authPerm??0)&~a,$=o===void 0?[]:[...new Set([...Object.keys(o),...Object.keys(h.perms??{}),"*"])].filter(N=>(D(h.perms,N)&~D(o,N))!==0),A=new Set(p.roles?.map(_)),I=c===void 0?[]:(h.roles??[]).filter(N=>!c.some(O=>_(O)===_(N))),S=(B&~(p.authPerm??0))!==0,y=$.some(N=>(D(h.perms,N)&~D(o,N)&~D(p.perms,N))!==0),x=I.some(N=>!A.has(_(N)));if(S||y||x)return u($n.CANNOT_ESCALATE_PERMISSIONS())}let J=await bi(a,r,l.tenants);if(!J.ok)return u(J.errors,J.meta);let q={};if(c!==void 0&&(q.roles=c),o!==void 0&&(q.perms=o),a!==void 0&&(q.authPerm=a),Object.keys(q).length>0){let B=await l.tenantMembers.updatePermissions(r,n,q);if(!B.ok)return u(B.errors,B.meta)}return v(void 0)}var ya={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:j.DATABASE_ERROR};async function Op(t,e){let{tenantId:r,userId:n,actorUserId:i,status:s}=t,o=e.plugins.database,a=await lt({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:o.tenantMembers});if(!a.ok)return u(a.errors,a.meta);if(i===n)return u(ya.CANNOT_MODIFY_SELF());let c=await o.tenantMembers.get(r,n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(ya.MEMBER_NOT_FOUND());if(c.data.isOwner)return u(ya.CANNOT_MODIFY_OWNER());let l=await o.tenantMembers.updateStatus(r,n,s);return l.ok?v(void 0):u(l.errors,l.meta)}var Vl={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:T("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:j.DATABASE_ERROR};async function Bs(t,e){let{tenantId:r,userId:n,...i}=t,s=e.plugins.database,o=await s.tenantMembers.get(r,n);if(!o.ok)return u(o.errors,o.meta);if(!o.data)return u(Vl.MEMBER_NOT_FOUND());let a=o.data,c=a.isOwner||ha(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let d=await s.userTenantProfiles.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(!d.data){let f=await s.userTenantProfiles.create({tenantId:r,userId:n,...l});return f.ok?v(void 0):u(f.errors,f.meta)}let p=await s.userTenantProfiles.update(r,n,l);return p.ok?v(void 0):u(p.errors,p.meta)}var eS=10080,tS=100;function rS(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??eS,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??tS}}}var Vr=H({tenantId:De(E(),sp(1))}),nS=H({limit:b(De(ge(),As(Number),Ge(),Un(),vs(1),gs(100))),cursor:b(E())}),iS=De(H({inviteeEmail:b(De(E(),Zr())),inviteeUserId:b(E()),inviteePhone:b(E()),role:b(E()),roles:b(ee(E())),authPerms:b(ee(E())),displayName:b(E()),givenName:b(E()),familyName:b(E()),jobTitle:b(E())}),dl(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),pg=De(H({inviteId:b(E()),inviteToken:b(E())}),dl(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),sS=H({inviteId:E()}),oS=H({status:b(E()),limit:b(De(ge(),As(Number),Ge(),Un(),vs(1),gs(100))),cursor:b(E())}),aS=H({userId:E(),role:b(E()),roles:b(ee(E())),authPerms:b(ee(E()))}),cS=H({userId:E()}),lS=H({contactEmail:b(E()),contactPhone:b(E()),displayName:b(E()),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),bio:b(E()),jobTitle:b(E()),metadata:b(he(E(),ge()))});function fg(t){let{auth:e,policy:r}=t,n=X(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:et.TENANT},loadResource:async h=>({tenantId:h.params.tenantId}),input:{params:Vr},handler:async h=>{let g=await Si({tenantId:h.params.tenantId,userId:h.user.id},e);if(!g.ok)return g;let _=g.data;if(!_)return v({});let{authPerm:R,...C}=_;return v({...C,authPerms:Wt(R)})}}),i=X(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:et.TENANT},loadResource:async h=>({tenantId:h.params.tenantId}),input:{params:Vr,body:lS},handler:async h=>{let g=h.params.tenantId,_=h.user.id,R={tenantId:g,userId:_},C=h.body;C.contactEmail!==void 0&&(R.contactEmail=C.contactEmail),C.contactPhone!==void 0&&(R.contactPhone=C.contactPhone),C.displayName!==void 0&&(R.displayName=C.displayName),C.givenName!==void 0&&(R.givenName=C.givenName),C.familyName!==void 0&&(R.familyName=C.familyName),C.avatarUrl!==void 0&&(R.avatarUrl=C.avatarUrl),C.locale!==void 0&&(R.locale=C.locale),C.bio!==void 0&&(R.bio=C.bio),C.jobTitle!==void 0&&(R.jobTitle=C.jobTitle),C.metadata!==void 0&&(R.metadata=C.metadata);let D=await Bs(R,e);if(!D.ok)return D;let F=await Si({tenantId:g,userId:_},e);if(!F.ok)return F;let J=F.data;if(!J)return v({});let{authPerm:q,...B}=J;return v({...B,authPerms:Wt(q)})}}),s=X(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:et.TENANT},loadResource:async h=>({tenantId:h.params.tenantId}),input:{params:Vr,body:iS},handler:async h=>{let{inviteeEmail:g,inviteeUserId:_,inviteePhone:R,role:C,roles:D,authPerms:F,displayName:J,givenName:q,familyName:B,jobTitle:$}=h.body,A={tenantId:h.params.tenantId,invitedBy:h.user.id};return g!==void 0&&(A.inviteeEmail=g),_!==void 0&&(A.inviteeUserId=_),R!==void 0&&(A.inviteePhone=R),C!==void 0&&(A.role=C),D!==void 0&&(A.roles=D),F!==void 0&&(A.authPerm=jn(F)),J!==void 0&&(A.displayName=J),q!==void 0&&(A.givenName=q),B!==void 0&&(A.familyName=B),$!==void 0&&(A.jobTitle=$),Ls(A,rS(t))}}),o=X(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:et.TENANT},loadResource:async h=>({tenantId:h.params.tenantId}),input:{params:Vr,query:oS},handler:async h=>{let g={tenantId:h.params.tenantId,actorUserId:h.user.id};h.query.status!==void 0&&(g.status=h.query.status),h.query.limit!==void 0&&(g.limit=h.query.limit),h.query.cursor!==void 0&&(g.cursor=h.query.cursor);let _=await Ms(g,e);if(!_.ok)return _;let R=_.data.map(({authPerm:C,...D})=>({...D,authPerms:Wt(C)}));return v(R,_.meta)}}),a=X(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:et.GLOBAL},input:{params:Vr,body:pg},handler:async h=>{let g={userId:h.user.id};h.body.inviteId!==void 0&&(g.inviteId=h.body.inviteId),h.body.inviteToken!==void 0&&(g.inviteToken=h.body.inviteToken);let _=await Ds(g,e);if(!_.ok)return _;let R=_.data;if(!R)return _;let{authPerm:C,...D}=R;return v({...D,authPerms:Wt(C)})}}),c=X(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:et.GLOBAL},input:{params:Vr,body:pg},handler:async h=>{let g={userId:h.user.id};return h.body.inviteId!==void 0&&(g.inviteId=h.body.inviteId),h.body.inviteToken!==void 0&&(g.inviteToken=h.body.inviteToken),Us(g,e)}}),l=X(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:et.TENANT},loadResource:async h=>({tenantId:h.params.tenantId}),input:{params:Vr,body:sS},handler:async h=>Fs({inviteId:h.body.inviteId,revokedBy:h.user.id},e)}),d=X(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:et.TENANT},loadResource:async h=>({tenantId:h.params.tenantId}),input:{params:Vr,query:nS},handler:async h=>{let g={tenantId:h.params.tenantId,actorUserId:h.user.id};h.query.limit!==void 0&&(g.limit=h.query.limit),h.query.cursor!==void 0&&(g.cursor=h.query.cursor);let _=await Ks(g,e);if(!_.ok)return _;let R=_.data.map(({authPerm:C,...D})=>({...D,authPerms:Wt(C)}));return v({members:R},_.meta)}}),p=X(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:et.TENANT},loadResource:async h=>({tenantId:h.params.tenantId}),input:{params:Vr,body:aS},handler:async h=>{let g={tenantId:h.params.tenantId,userId:h.body.userId,actorUserId:h.user.id};return h.body.role!==void 0&&(g.role=h.body.role),h.body.roles!==void 0&&(g.roles=h.body.roles),h.body.authPerms!==void 0&&(g.authPerm=jn(h.body.authPerms)),Vs(g,e)}}),f=X(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:et.TENANT},loadResource:async h=>({tenantId:h.params.tenantId}),input:{params:Vr,body:cS},handler:async h=>Hs({tenantId:h.params.tenantId,userId:h.body.userId,actorUserId:h.user.id},e)});return ip("/tenants",[n,i,s,o,a,c,l,d,p,f])}function mg(t){return X(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:zo.updateProfile.body},handler:async e=>{if(!e.user)return u(ie.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),Pl(n,r)}})}function Bl(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function hg(t){return Pe(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:Ai.resendVerification.body},handler:async e=>{let r=Bl(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),xs(n,r)}})}function Eg(t){return X(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:Ai.verifyCode.body},handler:async e=>{let r=Bl(t.auth);return Ss({challengeId:e.body.challengeId,code:e.body.code},r)}})}var kp="oauth_state",uS=600;function yg(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function gg(t,e,r){sa(t,kp,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:uS})}function dS(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function vg(t,e){let r=Sp(t,kp);return oa(t,kp,{path:"/"}),!r||!e?!1:dS(r,e)}function pS(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function fS(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function Ag(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:s=[]}=e;return async(o,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=pS(o),d=await fS(o,s),p=[`${i}:ip:${l}`];d&&p.push(`${i}:id:${d}`);for(let f of p){let h=await c.consume(f,{limit:r,windowMs:n});if(!h.allowed){let g=Math.ceil(h.retryAfterMs/1e3);return o.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(g)})}}return a()}}function Le(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function Tg(t,e,r={}){let n=Object.keys(r).length===0,i=o=>n||r[o]!==!1;t.get("/health",o=>o.json({ok:!0},200));let s=(o,a)=>t.use(o,Ag(e.auth,a));if(s("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),s("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),s("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),s("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),s("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),s("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),s("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),s("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),s("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Le(t,ky(e)),Le(t,Ky(e)),Le(t,Uy(e)),Le(t,My(e)),Le(t,Ly(e)),Le(t,Hy(e)),Le(t,Cy(e)),Le(t,Dy(e)),Le(t,Py(e))),i("password")&&(Le(t,rg(e)),Le(t,ng(e)),Le(t,ig(e))),i("verification")&&(Le(t,Eg(e)),Le(t,hg(e))),i("sessions")&&(Le(t,lg(e)),Le(t,cg(e)),Le(t,ug(e))),i("mfa")&&(Le(t,Jy(e)),Le(t,Xy(e)),Le(t,Wy(e)),Le(t,zy(e)),Le(t,Yy(e))),i("oauth")){let o=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=yg();return gg(a,c,o),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let d=await a.req.raw.clone().json();typeof d.state=="string"&&(l=d.state)}catch{l=void 0}return l!==void 0&&!vg(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Le(t,eg(e)),Le(t,Zy(e)),Le(t,tg(e)),Le(t,Qy(e))}i("users")&&Le(t,mg(e)),i("tenants")&&t.route("",fg(e))}function Cp(t){rp(ey);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:s,features:o}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),s&&s.length>0&&(a.trustedOrigins=s);let c=e.security.tokenAudiences?.cookieNames;if(c){let d={cookieNames:c};e.security.systemTenantId&&(d.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=d}let l=new Mr;return Tg(l,a,o),l}var _r=H({message:b(E())}),_g=H({message:b(E()),tenantId:E(),userId:E()}),Dp={tenantId:E(),userId:E(),contactEmail:b(E()),contactPhone:b(E()),displayName:b(E()),displayNameSource:b($t(["user","admin","system"])),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),jobTitle:b(E()),bio:b(E()),metadata:b(he(E(),ge()))},Ig=H({...Dp,status:E(),roles:b(ee(E())),perms:b(he(E(),Ge())),authPerms:ee(E()),isOwner:Et(),createdAt:E(),memberUpdatedAt:E(),profileUpdatedAt:b(E())}),mS=H({...Dp,createdAt:E(),updatedAt:E()}),hS=H({tenantId:E(),userId:E(),status:E(),roles:b(ee(E())),perms:b(he(E(),Ge())),authPerms:ee(E()),isOwner:Et(),createdAt:E(),updatedAt:E(),tenantProfile:b(mS)}),xg=ee(hS),bg=H({tenantId:E(),userId:E()}),ES=H({...Dp,status:E(),roles:b(ee(E())),perms:b(he(E(),Ge())),authPerm:b(Ge()),isOwner:Et(),createdAt:E(),updatedAt:E()}),Sg=ee(ES),yS=H({id:E(),name:b(E()),email:b(E()),jobTitle:b(E())}),wg=H({id:E(),tenantId:E(),invitedBy:yS,inviteeUserId:b(E()),inviteeEmail:b(E()),inviteePhone:b(E()),roles:b(ee(E())),perms:b(he(E(),Ge())),authPerms:ee(E()),displayName:b(E()),givenName:b(E()),familyName:b(E()),jobTitle:b(E()),status:E(),expiresAt:E(),createdAt:E(),updatedAt:E()}),Ng=ee(wg),Rg=H({inviteId:E(),inviteToken:E(),expiresAt:E()}),Og=H({tenantId:E(),userId:E()}),kg=H({invites:ee(wg)}),gS=H({id:E(),contactEmail:b(E()),contactPhone:b(E()),displayName:b(E()),status:E(),createdAt:E(),updatedAt:E()}),Cg=ee(gS),Dg=H({id:E(),contactEmail:b(E()),contactPhone:b(E()),displayName:b(E()),status:E(),createdAt:E(),updatedAt:E(),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),username:b(E()),metadata:b(he(E(),ge())),mfaRequired:Et(),mfaMethods:gi(ee(E()))});var jl={limit:b(De(Ge(),Un())),cursor:b(E())},vS={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:H({tenantId:E(),userId:E(),tenantType:b(E()),contactEmail:b(E()),contactPhone:b(E()),displayName:b(E()),displayNameSource:b($t(["user","admin","system"])),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),jobTitle:b(E()),bio:b(E()),metadata:b(he(E(),ge()))}),response:_g},AS={method:"POST",path:"/tenant/profile",kind:"data",body:H({tenantId:E(),userId:E()}),response:Ig},TS={method:"POST",path:"/tenant/profile/update",kind:"data",body:H({tenantId:E(),userId:E(),contactEmail:b(E()),contactPhone:b(E()),displayName:b(E()),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),bio:b(E()),jobTitle:b(E()),metadata:b(he(E(),ge()))}),response:_r},_S={method:"POST",path:"/tenant/members/list",kind:"data",body:H({tenantId:E(),actorUserId:E(),...jl}),response:xg},IS={method:"POST",path:"/tenant/members/update-status",kind:"data",body:H({tenantId:E(),userId:E(),actorUserId:E(),status:$t(["invited","active","suspended","removed"])}),response:_r},xS={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:H({tenantId:E(),userId:E(),actorUserId:E(),roles:b(ee(E())),perms:b(he(E(),Ge())),authPerms:b(ee(E()))}),response:_r},bS={method:"POST",path:"/tenant/members/remove",kind:"data",body:H({tenantId:E(),userId:E(),actorUserId:E()}),response:_r},SS={method:"POST",path:"/tenant/members/add",kind:"data",body:H({tenantId:E(),userId:E(),actorUserId:E(),roles:b(ee(E())),perms:b(he(E(),Ge())),authPerms:b(ee(E())),contactEmail:b(E()),contactPhone:b(E()),displayName:b(E()),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),jobTitle:b(E()),bio:b(E()),metadata:b(he(E(),ge()))}),response:bg},wS={method:"POST",path:"/tenant/invites/list",kind:"data",body:H({tenantId:E(),actorUserId:E(),status:b($t(["pending","accepted","declined","revoked","expired"])),...jl}),response:Ng},NS={method:"POST",path:"/tenant/invites/create",kind:"data",body:H({tenantId:E(),invitedBy:E(),inviteeUserId:b(E()),inviteeEmail:b(E()),inviteePhone:b(E()),roles:b(ee(E())),perms:b(he(E(),Ge())),authPerms:b(ee(E())),displayName:b(E()),givenName:b(E()),familyName:b(E()),jobTitle:b(E())}),response:Rg},Ug=H({userId:E(),inviteId:b(E()),inviteToken:b(E())}),RS={method:"POST",path:"/tenant/invites/accept",kind:"data",body:Ug,response:Og},OS={method:"POST",path:"/tenant/invites/decline",kind:"data",body:Ug,response:_r},kS={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:H({inviteId:E(),revokedBy:E()}),response:_r},CS={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:H({email:b(E()),phone:b(E())}),response:kg},DS={method:"POST",path:"/user/tenants/list",kind:"data",body:H({userId:E(),tenantType:b(E()),parentTenantId:b(E()),...jl}),response:Sg},js={actorUserId:E(),systemTenantId:E()},PS={method:"POST",path:"/accounts/list",kind:"data",body:H({...js,status:b($t(["active","inactive"])),...jl}),response:Cg},US={method:"POST",path:"/accounts/get",kind:"data",body:H({...js,userId:E()}),response:Dg},LS={method:"POST",path:"/accounts/update-profile",kind:"data",body:H({...js,userId:E(),displayName:b(E()),givenName:b(E()),familyName:b(E()),avatarUrl:b(E()),locale:b(E()),contactEmail:b(E()),contactPhone:b(E()),metadata:b(he(E(),ge()))}),response:_r},MS={method:"POST",path:"/accounts/update-status",kind:"data",body:H({...js,userId:E(),status:$t(["active","suspended","deleted"])}),response:_r},KS={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:H({...js,userId:E(),credentialType:b(E())}),response:_r},HS={method:"POST",path:"/accounts/remove",kind:"data",body:H({...js,userId:E()}),response:_r},ze={bootstrapTenantOwner:vS,getTenantProfile:AS,updateTenantProfile:TS,listTenantMembers:_S,updateTenantMemberStatus:IS,updateTenantMemberPermission:xS,removeTenantMember:bS,addMemberToTenant:SS,listTenantInvites:wS,inviteToTenant:NS,acceptInvite:RS,declineInvite:OS,revokeInvite:kS,checkPendingInvites:CS,listUserTenants:DS,listAccounts:PS,getAccount:US,updateAccountProfile:LS,updateAccountStatus:MS,resetAccountCredentials:KS,removeAccount:HS};async function Wn(t,e,r,n){let i=await lt({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return u(i.errors,i.meta);let s=await n.tenants.get(e);return s.ok?s.data?s.data.type!==zt.SYSTEM?u(bt.ACCOUNT_PERMS_SYSTEM_ONLY()):v({actor:i.data}):u(bt.TENANT_NOT_FOUND()):u(s.errors,s.meta)}var un={CANNOT_REMOVE_ACTIVE_ACCOUNT:T("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:T("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:T("NO_CHANGES","At least one field must be provided")};var FS=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function Pp(t,e){let r=e.plugins.database,n=await Wn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=t.status??"active",s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let o=await r.users.getByStatus(i,s);if(!o.ok)return u(o.errors,o.meta);let a=[];for(let c of o.data){let l=await r.users.getById(c);if(l.ok&&l.data){let d=l.data,p={id:d.id,status:d.status,createdAt:d.createdAt,updatedAt:d.updatedAt};d.contactEmail!==void 0&&(p.contactEmail=d.contactEmail),d.contactPhone!==void 0&&(p.contactPhone=d.contactPhone),d.displayName!==void 0&&(p.displayName=d.displayName),a.push(p)}}return v(a,o.meta)}async function Up(t,e){let r=e.plugins.database,n=await Wn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return u(i.errors,i.meta);if(!i.data)return u(j.NOT_FOUND());let s=i.data,o=await r.userAuths.get(t.userId),a={id:s.id,status:s.status,createdAt:s.createdAt,updatedAt:s.updatedAt,mfaRequired:o.ok&&o.data?o.data.mfaRequired:!1,mfaMethods:o.ok&&o.data?o.data.mfaMethods:null};return s.contactEmail!==void 0&&(a.contactEmail=s.contactEmail),s.contactPhone!==void 0&&(a.contactPhone=s.contactPhone),s.displayName!==void 0&&(a.displayName=s.displayName),s.givenName!==void 0&&(a.givenName=s.givenName),s.familyName!==void 0&&(a.familyName=s.familyName),s.avatarUrl!==void 0&&(a.avatarUrl=s.avatarUrl),s.locale!==void 0&&(a.locale=s.locale),s.username!==void 0&&(a.username=s.username),s.metadata!==void 0&&(a.metadata=s.metadata),v(a)}async function Lp(t,e){let r=e.plugins.database,n=await Wn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(un.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(j.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return u(un.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?v(void 0):u(c.errors,c.meta)}async function Mp(t,e){let r=e.plugins.database,n=await Wn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);if(!FS.has(t.status))return u(un.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(un.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(j.NOT_FOUND());let o=await r.userAuths.updateStatus(t.userId,t.status);if(!o.ok)return u(o.errors,o.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?v(void 0):u(a.errors,a.meta)}async function Kp(t,e){let r=e.plugins.database,n=await Wn(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(un.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(j.NOT_FOUND());let o=await r.credentials.getByUserId(t.userId);if(!o.ok)return u(o.errors,o.meta);for(let a of o.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return u(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return u(a.errors,a.meta)}return v(void 0)}async function Hp(t,e){let r=e.plugins.database,n=await Wn(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(un.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(j.NOT_FOUND());if(s.data.status===ye.ACTIVE)return u(un.CANNOT_REMOVE_ACTIVE_ACCOUNT());let o=await r.credentials.getByUserId(t.userId);if(o.ok)for(let l of o.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?v(void 0):u(c.errors,c.meta)}var VS=3,BS=10080,jS=100;function qS(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??BS,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??jS}}}function qs(t){return{plugins:{database:t.plugins.database}}}function GS(t){return ep({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Fp(t){let{auth:e,internal:r}=t,n=GS(r),i=new Mr;i.use("/*",async(y,x)=>{let N=y.req.header("Authorization");if(!N){await x();return}let O=N.match(/^Bearer\s+(.+)$/i);if(!O){await x();return}let k=O[1].split(".");if(k.length!==3||!k[1]){await x();return}let P;try{let L=k[1].replace(/-/g,"+").replace(/_/g,"/");P=JSON.parse(atob(L))}catch{await x();return}if(P.typ!==VS)return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let L=P.roles,K=Array.isArray(L)?L:[];if(!r.requiredRoles.some(Y=>K.includes(Y)))return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await x()});let s=X(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:ze.bootstrapTenantOwner.body},handler:async y=>{let x={tenantId:y.body.tenantId,userId:y.body.userId};return y.body.tenantType!==void 0&&(x.tenantType=y.body.tenantType),y.body.contactEmail!==void 0&&(x.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(x.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(x.displayName=y.body.displayName),y.body.displayNameSource!==void 0&&(x.displayNameSource=y.body.displayNameSource),y.body.givenName!==void 0&&(x.givenName=y.body.givenName),y.body.familyName!==void 0&&(x.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(x.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(x.locale=y.body.locale),y.body.jobTitle!==void 0&&(x.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(x.bio=y.body.bio),y.body.metadata!==void 0&&(x.metadata=y.body.metadata),Kl(x,e)}}),o=X(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:ze.getTenantProfile.body},handler:async y=>{let x=await Si({tenantId:y.body.tenantId,userId:y.body.userId},e);if(!x.ok)return x;let N=x.data;if(!N)return x;let{authPerm:O,...w}=N;return v({...w,authPerms:Wt(O)})}}),a=X(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:ze.updateTenantProfile.body},handler:async y=>{let{tenantId:x,userId:N,...O}=y.body,w={tenantId:x,userId:N};return O.contactEmail!==void 0&&(w.contactEmail=O.contactEmail),O.contactPhone!==void 0&&(w.contactPhone=O.contactPhone),O.displayName!==void 0&&(w.displayName=O.displayName),O.givenName!==void 0&&(w.givenName=O.givenName),O.familyName!==void 0&&(w.familyName=O.familyName),O.avatarUrl!==void 0&&(w.avatarUrl=O.avatarUrl),O.locale!==void 0&&(w.locale=O.locale),O.bio!==void 0&&(w.bio=O.bio),O.jobTitle!==void 0&&(w.jobTitle=O.jobTitle),O.metadata!==void 0&&(w.metadata=O.metadata),Bs(w,e)}}),c=X(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:ze.listTenantMembers.body},handler:async y=>{let x={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.limit!==void 0&&(x.limit=y.body.limit),y.body.cursor!==void 0&&(x.cursor=y.body.cursor);let N=await Ks(x,e);if(!N.ok)return N;let O=N.data.map(({authPerm:w,...k})=>({...k,authPerms:Wt(w)}));return v(O,N.meta)}}),l=X(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:ze.updateTenantMemberStatus.body},handler:async y=>Op({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId,status:y.body.status},e)}),d=X(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:ze.updateTenantMemberPermission.body},handler:async y=>{let x={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(x.roles=y.body.roles),y.body.perms!==void 0&&(x.perms=y.body.perms),y.body.authPerms!==void 0&&(x.authPerm=jn(y.body.authPerms)),Vs(x,e)}}),p=X(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:ze.removeTenantMember.body},handler:async y=>Hs({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId},e)}),f=X(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:ze.addMemberToTenant.body},handler:async y=>{let x={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(x.roles=y.body.roles),y.body.perms!==void 0&&(x.perms=y.body.perms),y.body.authPerms!==void 0&&(x.authPerm=jn(y.body.authPerms)),y.body.contactEmail!==void 0&&(x.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(x.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(x.displayName=y.body.displayName),y.body.givenName!==void 0&&(x.givenName=y.body.givenName),y.body.familyName!==void 0&&(x.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(x.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(x.locale=y.body.locale),y.body.jobTitle!==void 0&&(x.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(x.bio=y.body.bio),y.body.metadata!==void 0&&(x.metadata=y.body.metadata),Ml(x,e)}}),h=X(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:ze.listTenantInvites.body},handler:async y=>{let x={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.status!==void 0&&(x.status=y.body.status),y.body.limit!==void 0&&(x.limit=y.body.limit),y.body.cursor!==void 0&&(x.cursor=y.body.cursor);let N=await Ms(x,e);if(!N.ok)return N;let O=N.data.map(({authPerm:w,...k})=>({...k,authPerms:Wt(w)}));return v(O,N.meta)}}),g=X(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:ze.inviteToTenant.body},handler:async y=>{let x={tenantId:y.body.tenantId,invitedBy:y.body.invitedBy};return y.body.inviteeUserId!==void 0&&(x.inviteeUserId=y.body.inviteeUserId),y.body.inviteeEmail!==void 0&&(x.inviteeEmail=y.body.inviteeEmail),y.body.inviteePhone!==void 0&&(x.inviteePhone=y.body.inviteePhone),y.body.roles!==void 0&&(x.roles=y.body.roles),y.body.perms!==void 0&&(x.perms=y.body.perms),y.body.authPerms!==void 0&&(x.authPerm=jn(y.body.authPerms)),y.body.displayName!==void 0&&(x.displayName=y.body.displayName),y.body.givenName!==void 0&&(x.givenName=y.body.givenName),y.body.familyName!==void 0&&(x.familyName=y.body.familyName),y.body.jobTitle!==void 0&&(x.jobTitle=y.body.jobTitle),Ls(x,qS(e))}}),_=X(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:ze.acceptInvite.body},handler:async y=>{let x={userId:y.body.userId};y.body.inviteId!==void 0&&(x.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(x.inviteToken=y.body.inviteToken);let N=await Ds(x,e);if(!N.ok)return N;let O=N.data;if(!O)return N;let{authPerm:w,...k}=O;return v({...k,authPerms:Wt(w)})}}),R=X(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:ze.declineInvite.body},handler:async y=>{let x={userId:y.body.userId};return y.body.inviteId!==void 0&&(x.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(x.inviteToken=y.body.inviteToken),Us(x,e)}}),C=X(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:ze.revokeInvite.body},handler:async y=>Fs({inviteId:y.body.inviteId,revokedBy:y.body.revokedBy},e)}),D=X(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:ze.checkPendingInvites.body},handler:async y=>{let x={};return y.body.email!==void 0&&(x.email=y.body.email),y.body.phone!==void 0&&(x.phone=y.body.phone),Hl(x,e)}}),F=X(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:ze.listUserTenants.body},handler:async y=>{let x={userId:y.body.userId};y.body.tenantType!==void 0&&(x.tenantType=y.body.tenantType),y.body.parentTenantId!==void 0&&(x.parentTenantId=y.body.parentTenantId),y.body.limit!==void 0&&(x.limit=y.body.limit),y.body.cursor!==void 0&&(x.cursor=y.body.cursor);let N=await Fl(x,e);if(!N.ok)return N;let O=N.data.map(({authPerm:w,...k})=>({...k,authPerms:Wt(w)}));return v(O,N.meta)}}),J=X(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:ze.listAccounts.body},handler:async y=>{let x={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId};return y.body.status!==void 0&&(x.status=y.body.status),y.body.limit!==void 0&&(x.limit=y.body.limit),y.body.cursor!==void 0&&(x.cursor=y.body.cursor),Pp(x,qs(e))}}),q=X(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:ze.getAccount.body},handler:async y=>Up({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},qs(e))}),B=X(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:ze.updateAccountProfile.body},handler:async y=>{let{actorUserId:x,systemTenantId:N,userId:O,...w}=y.body,k={actorUserId:x,systemTenantId:N,userId:O};return w.displayName!==void 0&&(k.displayName=w.displayName),w.givenName!==void 0&&(k.givenName=w.givenName),w.familyName!==void 0&&(k.familyName=w.familyName),w.avatarUrl!==void 0&&(k.avatarUrl=w.avatarUrl),w.locale!==void 0&&(k.locale=w.locale),w.contactEmail!==void 0&&(k.contactEmail=w.contactEmail),w.contactPhone!==void 0&&(k.contactPhone=w.contactPhone),w.metadata!==void 0&&(k.metadata=w.metadata),Lp(k,qs(e))}}),$=X(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:ze.updateAccountStatus.body},handler:async y=>Mp({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId,status:y.body.status},qs(e))}),A=X(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:ze.resetAccountCredentials.body},handler:async y=>{let x={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId};return y.body.credentialType!==void 0&&(x.credentialType=y.body.credentialType),Kp(x,qs(e))}}),I=X(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:ze.removeAccount.body},handler:async y=>Hp({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},qs(e))});function S(y){let{method:x,path:N}=y.routeMeta,O=x.toLowerCase();i[O](N,y)}return S(s),S(o),S(a),S(c),S(l),S(d),S(p),S(f),S(h),S(g),S(_),S(R),S(C),S(D),S(F),S(J),S(q),S(B),S($),S(A),S(I),i}var Lg=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},Mg=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,s=e.length-1;i<=n;i++,s--)r[i]=e.charCodeAt(i),r[s]=e.charCodeAt(s);return r};function ga(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var $S=t=>t.requestContext;var Vp=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=tw(r),s,o;try{s=i.createRequest(r),o=$S(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(s,{event:r,requestContext:o,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},ql=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=this.getDomainName(t),n=this.getPath(t),i=`https://${r}${n}`,s=e?`${i}?${e}`:i,o=this.getHeaders(t),a=this.getMethod(t),c={headers:o,method:a};if(t.body){let l=t.isBase64Encoded?Mg(t.body):new TextEncoder().encode(t.body);c.body=l,o.set("content-length",l.length.toString())}return new Request(s,c)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??Kg,s=!!(n&&i(n));if(!s){let c=e.headers.get("content-encoding");s=sw(c)}let a={body:s?Lg(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:s,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,a),a.multiValueHeaders?e.headers.forEach((c,l)=>{a.multiValueHeaders[l]=[c]}):e.headers.forEach((c,l)=>{a.headers[l]=c}),a}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},WS=class extends ql{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},zS=new WS,JS=class extends ql{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.multiValueHeaders)for(let[r,n]of Object.entries(t.multiValueHeaders))n&&n.forEach(i=>e.append(r,ga(i)));if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&!e.has(r)&&e.set(r,ga(n));return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},YS=new JS,XS=class extends ql{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=ga(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,ga(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},QS=new XS,ZS=class extends ql{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&n.forEach(i=>e.append(r,ga(i)));return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},ew=new ZS,tw=t=>rw(t)?QS:nw(t)?zS:iw(t)?ew:YS,rw=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,nw=t=>Object.hasOwn(t,"rawPath")&&Object.hasOwn(t.requestContext??{},"http"),iw=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,Kg=t=>!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/.test(t),sw=t=>!!t&&!/^identity$/i.test(t);var Hg=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH","QUERY"],allowHeaders:[],exposeHeaders:[],...t},r=e.exposeHeaders?.length?e.exposeHeaders.join(","):void 0,n=e.allowHeaders?.length?e.allowHeaders.join(","):void 0,i=(o=>typeof o=="string"?o==="*"?()=>o:a=>o===a?a:null:typeof o=="function"?o:a=>o.includes(a)?a:null)(e.origin),s=(o=>{if(typeof o=="function")return async(a,c)=>(await o(a,c)).join(",");if(Array.isArray(o)){let a=o.join(",");return()=>a}else return()=>""})(e.allowMethods);return async function(a,c){function l(p,f){a.res.headers.set(p,f)}let d=await i(a.req.header("origin")||"",a);if(d&&l("Access-Control-Allow-Origin",d),e.credentials&&l("Access-Control-Allow-Credentials","true"),r&&l("Access-Control-Expose-Headers",r),a.req.method==="OPTIONS"){e.origin!=="*"&&l("Vary","Origin"),e.maxAge!=null&&l("Access-Control-Max-Age",e.maxAge.toString());let p=await s(a.req.header("origin")||"",a);p&&l("Access-Control-Allow-Methods",p);let f=n;if(!f){let h=a.req.header("Access-Control-Request-Headers");h&&(f=h.split(",").map(g=>g.trim()).join(","))}return f&&(l("Access-Control-Allow-Headers",f),a.res.headers.append("Vary","Access-Control-Request-Headers")),a.res.headers.delete("Content-Length"),a.res.headers.delete("Content-Type"),new Response(null,{headers:a.res.headers,status:204,statusText:"No Content"})}await c(),e.origin!=="*"&&a.header("Vary","Origin",{append:!0})}};var ow={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function Ni(t={}){let e={...ow,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var Bp={LOW:Ni({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:Ni({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:Ni({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:Ni({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var Fg={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function jp(t,e={}){return{system:t,policy:{...Fg.policy,...e.policy??{}},version:e.version??Fg.version,...e.email&&{email:e.email}}}var Vg=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],Bg=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],qp=[...Vg,...Bg];var lr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function jg(t,e){if(!t||typeof t!="object")throw new lr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new lr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new lr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new lr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new lr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new lr(e,'"health" must be a function if provided')}function qg(t,e,r){for(let n of r){if(!(n in t))throw new lr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new lr(e,`"${n}" must be a function`)}}var Gg={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function $g(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",s=typeof r.parseUserAgent=="function";if(!i&&!s)throw new lr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Gg[e];n&&qg(t,String(e),n)}function Gp(t,e){jg(t,String(e)),$g(t,e)}var Wg={debug:0,info:1,warn:2,error:3},Gl=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=Wg[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&Wg[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),s=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${s} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function zg(t){return new Gl(t)}var $l=new Gl({enabled:!1});function Gs(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Ri(t,e){let r=Gs(t),n=Gs(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Jg(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Ri(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=Gs(r),i=Gs(t);return!n||!i?!1:i.major===n.major&&Ri(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=Gs(r),i=Gs(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Ri(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Ri(t,e.slice(2))>=0:e.startsWith(">")?Ri(t,e.slice(1))>0:e.startsWith("<=")?Ri(t,e.slice(2))<=0:e.startsWith("<")?Ri(t,e.slice(1))<0:!1}function aw(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function cw(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function $s(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())$p(n,i);return t}let e=[];if(aw(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,s]=n;$p(i,s),r.set(i,s)}return r}function $p(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");cw(t,e)}function Wp(t,e){$p(t,e)}function Wl(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function zl(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function zp(t,e={},r,n=$l,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let s=new Map;for(let g of t)s.set(g.name,g);let o=new Map,a=new Map;for(let g of s.keys())o.set(g,0),a.set(g,[]);for(let g of s.values()){let _=g.dependencies??[];for(let R of _){let C=typeof R=="string"?R:R.name,D=typeof R=="string"?void 0:R.version;if(!s.has(C))throw new Error(`Plugin '${String(g.name)}' depends on '${String(C)}' which is not defined`);if(D){let F=s.get(C);if(F.version&&!Jg(F.version,D))throw new Error(`Plugin '${String(g.name)}' requires '${String(C)}' ${D}, but version ${F.version} is provided`)}a.get(C).push(g.name),o.set(g.name,(o.get(g.name)??0)+1)}}let c=[];for(let[g,_]of o.entries())_===0&&c.push(g);let l=[];for(;c.length>0;){let g=c.shift();l.push(g);for(let _ of a.get(g)??[]){let R=(o.get(_)??0)-1;o.set(_,R),R===0&&c.push(_)}}if(l.length!==s.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let d={},p={get(g){if(!d[g])throw new Error(`Plugin '${String(g)}' not found or not yet initialized`);return d[g]},has(g){return g in d},getRegistry(){return d}};for(let g of l){n.group(`Initializing plugin: ${String(g)}`),n.time(`Plugin: ${String(g)}`);let _=s.get(g),R=e[g],C=null;if(R!==void 0?(n.debug("Using override"),Wl(R)?(n.debug("Creating from factory wrapper"),C=await R.create(p)):zl(R)?(n.debug("Lazy loading plugin"),C=await R.load()):(n.debug("Using direct instance"),C=R)):_.factory?(n.debug("Creating from descriptor factory"),C=await _.factory(p)):_.instance&&(n.debug("Using descriptor instance"),C=_.instance),!C&&_.required)throw new Error(`Required plugin '${String(g)}' is missing`);if(C){if(g==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{Gp(C,g),n.debug("Validation passed")}catch(J){throw n.error("Validation failed:",J),new Error(`Plugin '${String(g)}' validation failed: ${J instanceof Error?J.message:String(J)}`)}}d[g]=C;let F=C;F.initialize&&(n.debug("Calling plugin initialize()"),await F.initialize()),n.info(`Plugin '${String(g)}' initialized successfully`)}else n.warn(`Plugin '${String(g)}' is null/undefined`);n.timeEnd(`Plugin: ${String(g)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),d.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),d.credential=e.credential),i.extraEntries&&Object.assign(d,i.extraEntries),!lw(d))throw new Error("Plugin registry is incomplete - missing required plugins");let f=d,h=$s(f.oauthProviders);if(!h){let g=e.oauthProviders;g!==void 0&&!Wl(g)&&!zl(g)?h=$s(g)??new Map:h=new Map}return f.oauthProviders=h,await r?.afterInit?.(f),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),f}function lw(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function Jp(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function va(t){let e=t.debug?zg({enabled:!0,prefix:"[auth-core SDK]"}):$l;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=$s(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await zp(qp,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let s=Ni(t.security??{});e.debug("Security level:",s.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let o=jp({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",o.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:s,system:o,async healthCheck(){let a=[];for(let[l,d]of Object.entries(i)){if(!d||typeof d!="object")continue;let p=d,f={name:String(l),healthy:!0};if(p.health)try{let h=await p.health();f.healthy=h,h||(f.error=`Plugin '${l}' health check failed`)}catch(h){f.healthy=!1,f.error=h instanceof Error?h.message:"Health check threw error"}a.push(f)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await Jp(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");Wp(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var Yl=[];function Aa(t){let e=process.env[t];return e||(Yl.push(t),"")}function Yp(t,e){return e?Aa(t):process.env[t]??""}function Yg(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function fw(t){let e=Yg(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var mw=process.env.SMTP_MODE==="smtp"?"smtp":"console",Oi=process.env.EMAIL_MODE;if(Oi&&Oi!=="queue"&&Oi!=="smtp"&&Oi!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Oi}`);var Ws=Oi||mw,hw=Ws==="console"?"console":"smtp",Xp=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",Xl=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(Ws==="queue"&&Xp!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${Xp}`);if(Xl!=="generic"&&Xl!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${Xl}`);function Jl(t,e){if(t){if(t==="body"||t==="cookie"||t==="both")return t;throw new Error(`${e} must be one of body|cookie|both, got: ${t}`)}}function Ew(){let t=Jl(process.env.REFRESH_TOKEN_STRATEGY,"REFRESH_TOKEN_STRATEGY"),e=Jl(process.env.REFRESH_TOKEN_STRATEGY_CUSTOMER,"REFRESH_TOKEN_STRATEGY_CUSTOMER"),r=Jl(process.env.REFRESH_TOKEN_STRATEGY_TENANT,"REFRESH_TOKEN_STRATEGY_TENANT"),n=Jl(process.env.REFRESH_TOKEN_STRATEGY_SYSTEM,"REFRESH_TOKEN_STRATEGY_SYSTEM");if(e||r||n){let i=t??"body";return{customer:e??i,tenant:r??i,system:n??i}}return t??"cookie"}var Ta=Ew(),yw=typeof Ta=="string"?Ta==="cookie"||Ta==="both":Object.values(Ta).some(t=>t==="cookie"||t==="both"),V={dynamodbTableName:Aa("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:Aa("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:Aa("JWT_PRIVATE_KEY"),jwtPublicKey:Aa("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:Yp("SMTP_USER",Ws==="smtp"),pass:Yp("SMTP_PASS",Ws==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:hw},email:{mode:Ws,queue:{provider:Xp,url:Yp("EMAIL_QUEUE_URL",Ws==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:Xl,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:fw("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:Yg("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:Ta,...yw?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__",tokenAudiences:{customer:process.env.TOKEN_AUD_CUSTOMER||"customer",tenant:process.env.TOKEN_AUD_TENANT||"tenant",system:process.env.TOKEN_AUD_SYSTEM||"system",cookieNames:{customer:process.env.REFRESH_COOKIE_CUSTOMER||"refresh_token",tenant:process.env.REFRESH_COOKIE_TENANT||"refresh_token_tenant",system:process.env.REFRESH_COOKIE_SYSTEM||"refresh_token_system"}}},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function Xg(){if(Yl.length>0){let t=Yl.map(e=>`  - ${e}`).join(`
-`);throw new Error(`Missing required environment variables (${Yl.length}):
-${t}`)}if(V.nodeEnv==="production"&&!V.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Qp(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function gw(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Ql(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return gw(r)}async function Zp(t,e){let r=await Ql(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var vw="otp",Qg={INVALID_CODE:T("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:T("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function Aw(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function Zg(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:vw,challengeType:"verification-code",async create(){return v({value:"",data:null})},async update(){return v({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let o=Qp(e),a=await Ql(o),c=new Date(Date.now()+r*60*1e3);return v({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:o,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:Aw(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await Zp(n.credentialValue,i)?v({userId:n.userId,intents:[]}):u(Qg.INVALID_CODE()):u(Qg.MISSING_CHALLENGE_CONTEXT())}}}function ev(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}var Zl=t=>t?`"${t}" `:"";function Je(t,e=""){if(typeof t!="number")throw new TypeError(Zl(e)+"expected number, got "+typeof t);if(!Number.isSafeInteger(t)||t<0)throw new RangeError(Zl(e)+"expected integer >= 0, got "+t);return t}function rv(t,e=""){if(typeof t!="boolean")throw new TypeError(Zl(e)+"expected boolean, got type="+typeof t);return t}function dn(t,e,r=""){if(ev(t)&&(e===void 0||t.length===e))return t;e!==void 0&&Je(e,"length");let n=ev(t),i=e!==void 0?` of length ${e}`:"",s=n?`length=${t.length}`:`type=${typeof t}`,o=Zl(r)+"expected Uint8Array"+i+", got "+s;throw n?new RangeError(o):new TypeError(o)}function eu(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("expected hash wrapped by utils.createHasher");if(Je(t.outputLen),Je(t.blockLen),t.outputLen<1||t.blockLen<1)throw new Error("hash blockLen / outputLen must be >= 1")}var tv=(t,e)=>{if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError((e==="object"?"":`"${e}" `)+"expected object, got type="+typeof t)};function pn(t,e=!0){if(t.destroyed)throw new Error("hash was destroyed");if(e&&t.finished)throw new Error("digest() was already called")}function zs(t,e){dn(t,void 0,"output");let r=e.outputLen;if(!(t.length>=r))throw new RangeError('"output" expected length >= '+r)}function ki(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function Yt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function Js(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function Ir(t,e){return t<<32-e|t>>>e}function be(t,e){return t<<e|t>>>32-e>>>0}var Tw=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function _w(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function Iw(t){for(let e=0;e<t.length;e++)t[e]=_w(t[e]);return t}var Ys=Tw?t=>t:Iw;function xw(t){if(typeof t!="string")throw new TypeError("string expected");return new Uint8Array(new TextEncoder().encode(t))}function ef(t,e=""){return typeof t=="string"?xw(t):dn(t,void 0,e)}function Xs(t,e,r="opts"){return tv(t,"defaults"),e!==void 0&&tv(e,r),Object.assign(t,e)}function tu(t,e={}){if(typeof t!="function")throw new TypeError('"hashCons" expected function, got type='+typeof t);e=Xs({},e,"info");let r=(i,s)=>t(s).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function tf(t=32){Je(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var ru=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var nu=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(eu(e),dn(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("expected Hash instance");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let s=0;s<i.length;s++)i[s]^=54;this.iHash.update(i),this.oHash=e.create();for(let s=0;s<i.length;s++)i[s]^=106;this.oHash.update(i),Yt(i)}update(e){return pn(this),this.iHash.update(e),this}digestInto(e){pn(this),zs(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:s,blockLen:o,outputLen:a,canXOF:c}=this;return e=e,e.finished=i,e.destroyed=s,e.blockLen=o,e.outputLen=a,e.canXOF=c,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},nv=(()=>{let t=((e,r,n)=>new nu(e,r).update(n).digest());return t.create=(e,r)=>new nu(e,r),t})();function Sw(t,e,r,n){eu(t);let i=Xs({dkLen:32,asyncTick:10},n),{c:s,dkLen:o,asyncTick:a}=i;if(Je(s,"c"),Je(o,"dkLen"),Je(a,"asyncTick"),s<1)throw new Error('"c" (iterations) must be >= 1');if(o<1)throw new Error('"dkLen" must be >= 1');if(o>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=ef(e,"password"),l=ef(r,"salt"),d=new Uint8Array(o),{iHash:p,oHash:f,outputLen:h}=nv.create(t,c),g=new Uint8Array(h),_=ww(p,f,l,g);return{c:s,dkLen:o,asyncTick:a,DK:d,outputLen:h,eng:_}}function ww(t,e,r,n){let i=new Uint8Array(4),s=Js(i),o=t._cloneInto().update(r),a=e._cloneInto(),c=t._cloneInto,l=e._cloneInto;return{u1:(d,p)=>{s.setInt32(0,d,!1),o._cloneInto(a).update(i).digestInto(n),e._cloneInto(a).update(n).digestInto(n),p.set(n.subarray(0,p.length))},rounds:(d,p)=>{for(let f=1;f<d;f++){c.call(t,a).update(n).digestInto(n),l.call(e,a).update(n).digestInto(n);for(let h=0;h<p.length;h++)p[h]^=n[h]}},output:d=>(t.destroy(),e.destroy(),o.destroy(),a.destroy(),Yt(n),d)}}function rf(t,e,r,n){let{c:i,dkLen:s,DK:o,outputLen:a,eng:c}=Sw(t,e,r,n);for(let l=1,d=0;d<s;l++,d+=a){let p=o.subarray(d,d+a);c.u1(l,p),c.rounds(i,p)}return c.output(o)}var iu=BigInt(4294967295),iv=BigInt(32);function Nw(t,e=!1){return e?{h:Number(t&iu),l:Number(t>>iv&iu)}:{h:Number(t>>iv&iu)|0,l:Number(t&iu)|0}}function sv(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let s=0;s<r;s++){let{h:o,l:a}=Nw(t[s],e);[n[s],i[s]]=[o,a]}return[n,i]}var Rw=t=>t/2**32|0,Ow=t=>t>>>0;function ov(t,e,r,n){let i=Rw(r),s=Ow(r);t.setUint32(e,n?s:i,n),t.setUint32(e+4,n?i:s,n)}function av(t,e,r){return t&e^~t&r}function cv(t,e,r){return t&e^t&r^e&r}var su=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=Js(this.buffer)}update(e){pn(this),dn(e);let{view:r,buffer:n,blockLen:i}=this,s=e.length,o=!1;for(let a=0;a<s;){let c=Math.min(i-this.pos,s-a);if(c===i){let l=Js(e);for(;i<=s-a;a+=i)this.process(l,a);o=!0;continue}n.set(a===0&&c===s?e:e.subarray(a,a+c),this.pos),this.pos+=c,a+=c,this.pos===i&&(this.process(r,0),this.pos=0,o=!0)}return this.length+=e.length,o&&this.roundClean(),this}digestInto(e){pn(this),zs(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:s}=this,{pos:o}=this;r[o++]=128,r.fill(0,o),this.padOffset>i-o&&(this.process(n,0),r.fill(0)),ov(n,i-8,this.length*8,s),this.process(n,0),this.roundClean();let a=e===r?n:Js(e),c=this.outputLen,l=c/4,d=this.get();if(c%4||l>d.length)throw new Error("invalid outputLen");for(let p=0;p<l;p++)a.setUint32(4*p,d[p],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:r,length:n,finished:i,destroyed:s,pos:o}=this;return e.destroyed=s,e.finished=i,e.length=n,e.pos=o,o&&e.buffer.set(r),e}clone(){return this._cloneInto()}},lv=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var kw=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),zn=new Uint32Array(64),nf=class extends su{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,r){super(64,e,8,!1),this.A=r[0]|0,this.B=r[1]|0,this.C=r[2]|0,this.D=r[3]|0,this.E=r[4]|0,this.F=r[5]|0,this.G=r[6]|0,this.H=r[7]|0}get(){let{A:e,B:r,C:n,D:i,E:s,F:o,G:a,H:c}=this;return[e,r,n,i,s,o,a,c]}set(e,r,n,i,s,o,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=s|0,this.F=o|0,this.G=a|0,this.H=c|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,r){for(let p=0;p<16;p++,r+=4)zn[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let f=zn[p-15],h=zn[p-2],g=Ir(f,7)^Ir(f,18)^f>>>3,_=Ir(h,17)^Ir(h,19)^h>>>10;zn[p]=_+zn[p-7]+g+zn[p-16]|0}let{A:n,B:i,C:s,D:o,E:a,F:c,G:l,H:d}=this;for(let p=0;p<64;p++){let f=Ir(a,6)^Ir(a,11)^Ir(a,25),h=d+f+av(a,c,l)+kw[p]+zn[p]|0,_=(Ir(n,2)^Ir(n,13)^Ir(n,22))+cv(n,i,s)|0;d=l,l=c,c=a,a=o+h|0,o=s,s=i,i=n,n=h+_|0}n=n+this.A|0,i=i+this.B|0,s=s+this.C|0,o=o+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,d=d+this.H|0,this.set(n,i,s,o,a,c,l,d)}roundClean(){Yt(zn)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),Yt(this.buffer)}},sf=class extends nf{constructor(){super(32,lv)}};var of=tu(()=>new sf,ru(1));function uv(t,e,r,n,i,s){let o=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],d=t[e++]^r[n++],p=t[e++]^r[n++],f=t[e++]^r[n++],h=t[e++]^r[n++],g=t[e++]^r[n++],_=t[e++]^r[n++],R=t[e++]^r[n++],C=t[e++]^r[n++],D=t[e++]^r[n++],F=t[e++]^r[n++],J=t[e++]^r[n++],q=t[e++]^r[n++],B=o,$=a,A=c,I=l,S=d,y=p,x=f,N=h,O=g,w=_,k=R,P=C,L=D,K=F,W=J,Y=q;for(let ue=0;ue<8;ue+=2)S^=be(B+L|0,7),O^=be(S+B|0,9),L^=be(O+S|0,13),B^=be(L+O|0,18),w^=be(y+$|0,7),K^=be(w+y|0,9),$^=be(K+w|0,13),y^=be($+K|0,18),W^=be(k+x|0,7),A^=be(W+k|0,9),x^=be(A+W|0,13),k^=be(x+A|0,18),I^=be(Y+P|0,7),N^=be(I+Y|0,9),P^=be(N+I|0,13),Y^=be(P+N|0,18),$^=be(B+I|0,7),A^=be($+B|0,9),I^=be(A+$|0,13),B^=be(I+A|0,18),x^=be(y+S|0,7),N^=be(x+y|0,9),S^=be(N+x|0,13),y^=be(S+N|0,18),P^=be(k+w|0,7),O^=be(P+k|0,9),w^=be(O+P|0,13),k^=be(w+O|0,18),L^=be(Y+W|0,7),K^=be(L+Y|0,9),W^=be(K+L|0,13),Y^=be(W+K|0,18);i[s++]=o+B|0,i[s++]=a+$|0,i[s++]=c+A|0,i[s++]=l+I|0,i[s++]=d+S|0,i[s++]=p+y|0,i[s++]=f+x|0,i[s++]=h+N|0,i[s++]=g+O|0,i[s++]=_+w|0,i[s++]=R+k|0,i[s++]=C+P|0,i[s++]=D+L|0,i[s++]=F+K|0,i[s++]=J+W|0,i[s++]=q+Y|0}function af(t,e,r,n,i){let s=n+0,o=n+16*i;for(let a=0;a<16;a++)r[o+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,s+=16,e+=16)uv(r,o,t,e,r,s),a>0&&(o+=16),uv(r,s,t,e+=16,r,o)}function Cw(t,e,r){let n=Xs({dkLen:32,asyncTick:10,maxmem:1073742848},r),{N:i,r:s,p:o,dkLen:a,asyncTick:c,maxmem:l,onProgress:d}=n;if(Je(i,"N"),Je(s,"r"),Je(o,"p"),Je(a,"dkLen"),Je(c,"asyncTick"),Je(l,"maxmem"),d!==void 0&&typeof d!="function")throw new Error('"onProgress" must be a function');if(s<1)throw new Error('"r" expected integer >= 1');let p=128*s,f=p/4,h=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>h)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(o<1||o>(h-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(h-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let g=p*(i+o+1);if(g>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+g+", maxmem="+l);let _=rf(of,t,e,{c:1,dkLen:p*o}),R=ki(_),C=ki(new Uint8Array(p*i)),D=ki(new Uint8Array(p)),F=()=>{};if(d){let J=2*i*o,q=Math.max(Math.floor(J/1e4),1),B=0;F=()=>{if(B++,d&&(!(B%q)||B===J))try{d(B/J)}catch($){throw Yt(_,C,D),$}}}return{N:i,r:s,p:o,dkLen:a,blockSize32:f,V:C,B32:R,B:_,tmp:D,blockMixCb:F,asyncTick:c}}function Dw(t,e,r,n,i){let s=rf(of,t,r,{c:1,dkLen:e});return Yt(r,n,i),s}function ou(t,e,r){let{N:n,r:i,p:s,dkLen:o,blockSize32:a,V:c,B32:l,B:d,tmp:p,blockMixCb:f}=Cw(t,e,r);Ys(l);for(let h=0;h<s;h++){let g=a*h;for(let _=0;_<a;_++)c[_]=l[g+_];for(let _=0,R=0;_<n-1;_++)af(c,R,c,R+=a,i),f();af(c,(n-1)*a,l,g,i),f();for(let _=0;_<n;_++){let R=(l[g+a-16]&n-1)>>>0;for(let C=0;C<a;C++)p[C]=l[g+C]^c[R*a+C];af(p,0,l,g,i),f()}}return Ys(l),Dw(t,o,d,c,p)}var Pw={N:2**15,r:8,p:1,dkLen:32,saltLength:32},Uw={N:2**14,r:8,p:1};function dv(t,e,r){return`${t.N}.${t.r}.${t.p}.${pv(e)}.${pv(r)}`}function Lw(t){let e=t.split(".");if(e.length===5){let[r,n,i,s,o]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:au(s),expected:au(o)}}if(e.length===2){let[r,n]=e;return{params:Uw,salt:au(r),expected:au(n)}}return null}function pv(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function au(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function fv(t={}){let e={...Pw,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=tf(e.saltLength),s=await ou(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),o=dv({N:e.N,r:e.r,p:e.p},i,s);return v({value:o,data:n.metadata??null})}catch(i){let s=i instanceof Error?i.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async update(n,i){if(!n.value)return v({});try{if(typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let s=tf(e.saltLength),o=await ou(r.encode(n.value),s,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=dv({N:e.N,r:e.r,p:e.p},s,o);return v({value:a,...n.data&&{data:n.data}})}catch(s){let o=s instanceof Error?s.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async verify(n){try{if(!n.credential?.value)return u([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return u([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=Lw(n.credential.value);if(!i)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:s,salt:o,expected:a}=i;if(o.length!==e.saltLength||a.length!==e.dkLen)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await ou(r.encode(n.credentialValue),o,{N:s.N,r:s.r,p:s.p,dkLen:e.dkLen});if(c.length!==a.length)return u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?v({userId:n.userId,credentialId:"password"}):u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),u([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var hv=qm(mv(),1);function Ev(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new hv.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let s=r.browser.name??"",o=r.os.name??"";return{deviceName:i,browser:s,os:o,browserName:s,osName:o}}}}import{createHash as Mw}from"node:crypto";import{SendMessageCommand as Kw,SQSClient as Hw}from"@aws-sdk/client-sqs";var Fw={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var lu=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new Hw(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new Kw({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:Vw(n)})}return v(void 0)}catch(r){return u({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},s=this.config.eventTypeMap?.[e.template]??Fw[e.template]??e.template,o=Ci(i.eventId)??Ci(i.challengeId)??crypto.randomUUID(),a=n?`${o}:${Bw(r)}`:o,c=Ci(i.locale),l=Ci(i.traceId)??a,d=jw(this.config.defaultMetadata,i),p=qw(i);if(this.config.envelope==="snapshot-auth-v1"){let f=Ci(d?.tenantId),h=Ci(d?.tenantType),g=Ci(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:s,to:r,...g?{userId:g}:{},...f?{tenantId:f}:{},...h?{tenantType:h}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:s,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...d?{metadata:d}:{},data:p}}};function Ci(t){return typeof t=="string"&&t.length>0?t:void 0}function Vw(t){return t.split("@")[1]||"(unknown)"}function Bw(t){return Mw("sha256").update(t).digest("hex").slice(0,16)}function jw(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function qw(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var Ia=class t{static createAwsSqs(e){return new lu(e)}static create(e){return t.createAwsSqs(e.sqs)}};var pT=qm(dT(),1);var vu=class{transporter;config;name="email-system-direct-smtp";version="1.0.0";constructor(e){this.config=e,this.transporter=pT.default.createTransport({host:e.host,port:e.port,secure:e.secure||!1,auth:e.auth,tls:e.tls})}async initialize(){await this.transporter.verify()}async send(e){try{let r=e,n,i,s;switch(e.template){case"verification":{let a=e.variables?.code;n="X\xE1c th\u1EF1c t\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n",i=this.getVerificationEmailTemplate(a),s=`M\xE3 x\xE1c th\u1EF1c c\u1EE7a b\u1EA1n l\xE0: ${a}`;break}case"password-reset":{let a=e.variables?.token;n="\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u",i=this.getPasswordResetEmailTemplate(a),s=`\u0110\u1EC3 \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, h\xE3y s\u1EED d\u1EE5ng token sau: ${a}`;break}case"custom":n=e.variables?.subject||e.subject||"Th\xF4ng b\xE1o",i=e.variables?.html||r.html||"",s=e.variables?.text||r.text||"";break;default:n=e.subject||"Th\xF4ng b\xE1o",i=r.html||"",s=r.text||""}let o={from:`${this.config.fromName||""} <${this.config.fromEmail}>`,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:n,text:s,html:i,replyTo:r.replyTo,cc:r.cc?Array.isArray(r.cc)?r.cc.join(", "):r.cc:void 0,bcc:r.bcc?Array.isArray(r.bcc)?r.bcc.join(", "):r.bcc:void 0};return await this.transporter.sendMail(o),v(void 0)}catch(r){return u({code:"EMAIL_SEND_ERROR",message:r instanceof Error?r.message:"Failed to send email"})}}async cleanup(){this.transporter.close()}getVerificationEmailTemplate(e){return`
+Invalid`)}},FromEmailAddress:"invalid@invalid",Destination:{ToAddresses:["invalid@invalid"]}};return this.getRegion(()=>{let s;try{let a=new this.ses.SendEmailCommand(o);s=this.ses.sesClient.send(a)}catch(a){setImmediate(()=>i(a));return}s.then(()=>setImmediate(()=>i(null))).catch(a=>setImmediate(()=>i(a)))}),r}},iT=Um;var o0=()=>(process.env.ETHEREAL_API||"https://api.nodemailer.com").replace(/\/+$/,""),s0=()=>(process.env.ETHEREAL_WEB||"https://ethereal.email").replace(/\/+$/,""),a0=()=>(process.env.ETHEREAL_API_KEY||"").replace(/\s*/g,"")||null,c0=()=>["true","yes","y","1"].includes((process.env.ETHEREAL_CACHE||"yes").toString().trim().toLowerCase()),Ts=!1;function l0(t,e){let r;if(typeof t=="object"&&typeof t.send!="function"||typeof t=="string"&&/^(smtps?|direct):/i.test(t)){let n=typeof t=="string"?t:t.url;if(n){let i=gs(n);r=typeof t=="object"?Or(!1,et({},t,o=>o==="url"),i):i}else r=t;if(r.pool)t=new ZA(r);else if(r.sendmail)t=new tT(r);else if(r.streamTransport)t=new rT(r);else if(r.jsonTransport)t=new nT(r);else if(r.SES){let i=r.SES;if(i.ses&&i.aws){let o=new Error("Using legacy SES configuration, expecting @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw o.code=Es,o}t=new iT(r)}else t=new eT(r)}return new $A(t,r,e)}function u0(t,e){let r;!e&&typeof t=="function"&&(e=t,t=!1),e||(r=new Promise((p,f)=>{e=Mt(p,f)}));let n=e;if(c0()&&Ts)return setImmediate(()=>n(null,Ts)),r;t=t||o0();let i=[],o=0,s={},a={requestor:Ku,version:Xe},c=a0();c&&(s.Authorization="Bearer "+c);let l={contentType:"application/json",method:"POST",headers:s,body:Buffer.from(JSON.stringify(a))};/^https:/i.test(t)&&(l.tls={rejectUnauthorized:!0});let u=ui(t+"/user",l);return u.on("readable",()=>{let p;for(;(p=u.read())!==null;)i.push(p),o+=p.length}),u.once("error",p=>n(p)),u.once("end",()=>{let p=Buffer.concat(i,o),f;try{f=JSON.parse(p.toString())}catch(m){return n(m)}if(f.status!=="success"||f.error)return n(new Error(f.error||"Request failed"));delete f.status,Ts=f,n(null,Ts)}),r}function d0(t){if(!t||!t.response)return!1;let e=new Map,r=t.response.toString();if(r.length>2&&r.charAt(r.length-1)==="]"){let n=r.indexOf("[",r.lastIndexOf("]",r.length-2)+1);n>=0&&n<r.length-2&&r.substring(n+1,r.length-1).replace(/\b([A-Z0-9]+)=([^\s]+)/g,(o,s,a)=>(e.set(s,a),o))}return e.has("STATUS")&&e.has("MSGID")?(Ts&&Ts.web||s0())+"/message/"+e.get("MSGID"):!1}var p0={createTransport:l0,createTestAccount:u0,getTestMessageUrl:d0},oT=p0;var cd=class{transporter;config;name="email-system-direct-smtp";version="1.0.0";constructor(e){this.config=e,this.transporter=oT.createTransport({host:e.host,port:e.port,secure:e.secure||!1,auth:e.auth,tls:e.tls})}async initialize(){await this.transporter.verify()}async send(e){try{let r=e,n,i,o;switch(e.template){case"verification":{let a=e.variables?.code;n="X\xE1c th\u1EF1c t\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n",i=this.getVerificationEmailTemplate(a),o=`M\xE3 x\xE1c th\u1EF1c c\u1EE7a b\u1EA1n l\xE0: ${a}`;break}case"password-reset":{let a=e.variables?.token;n="\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u",i=this.getPasswordResetEmailTemplate(a),o=`\u0110\u1EC3 \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, h\xE3y s\u1EED d\u1EE5ng token sau: ${a}`;break}case"custom":n=e.variables?.subject||e.subject||"Th\xF4ng b\xE1o",i=e.variables?.html||r.html||"",o=e.variables?.text||r.text||"";break;default:n=e.subject||"Th\xF4ng b\xE1o",i=r.html||"",o=r.text||""}let s={from:`${this.config.fromName||""} <${this.config.fromEmail}>`,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:n,text:o,html:i,replyTo:r.replyTo,cc:r.cc?Array.isArray(r.cc)?r.cc.join(", "):r.cc:void 0,bcc:r.bcc?Array.isArray(r.bcc)?r.bcc.join(", "):r.bcc:void 0};return await this.transporter.sendMail(s),T(void 0)}catch(r){return d({code:"EMAIL_SEND_ERROR",message:r instanceof Error?r.message:"Failed to send email"})}}async cleanup(){this.transporter.close()}getVerificationEmailTemplate(e){return`
       <!DOCTYPE html>
       <html>
       <head>
@@ -131,10 +128,10 @@ ${t}`)}if(V.nodeEnv==="production"&&!V.gatewaySecret)throw new Error("GATEWAY_SE
         </div>
       </body>
       </html>
-    `}};var Pa=class t{static createDirectSmtp(e){return new vu(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var v0={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function fT(t={}){let e={...v0,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let s=e.requireTLD?"[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${s}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return u([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return u([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return u([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let s=i.split("@");if(s.length!==2)return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[o,a]=s;return!o||o.length>64?u([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?u([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):v()}}}function im(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function A0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function sm(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return A0(r)}var om="email",Au={EMAIL_SYSTEM_NOT_AVAILABLE:T("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:T("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:T("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:T("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function T0(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function mT(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:om,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return u(Au.EMAIL_SYSTEM_NOT_AVAILABLE());let s=await i.plugins.database.users.getById(n.userId),o=s.ok&&s.data?s.data.contactEmail:void 0;if(!o)return u(Au.RECIPIENT_NOT_FOUND());let a=im(e),c=await sm(a);return(await i.plugins.emailSystem.send({to:o,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?u(Au.SEND_FAILED()):v({codeHash:c,maskedRecipient:T0(o)})},async issueChallenge(n){return v({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(om)?[om]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(Au.USE_CHALLENGE_CODE_HASH())}}}var hT="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function Tu(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let s="";for(let o of i)s+=hT[o%hT.length];r.push(s)}return r}function _0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function _u(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return _0(r)}function I0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function am(t,e){let r=await _u(t),n=null;for(let i of e)I0(r,i)&&(n=i);return n}var cm="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function ET(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let s of e){let o=cm.indexOf(s);if(o===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|o,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function yT(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=cm[r>>>e&31];return e>0&&(n+=cm[r<<5-e&31]),n}function Iu(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),yT(e)}function x0(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function b0(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,x0(e))),s=i[i.length-1]&15;return(((i[s]&127)<<24|(i[s+1]&255)<<16|(i[s+2]&255)<<8|i[s+3]&255)%10**r).toString().padStart(r,"0")}async function xu(t,e,r=Date.now(),n={}){let i=n.period??30,s=n.digits??6,o=n.window??1,a=e.trim();if(a.length!==s||!/^\d+$/u.test(a))return!1;let c=ET(t),l=Math.floor(r/1e3/i),d=!1;for(let p=-o;p<=o;p++){let f=await b0(c,l+p,s);S0(f,a)&&(d=!0)}return d}function S0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function gT(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var lm="totp",w0={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function vT(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:lm,requiresServerDelivery:!1,generateSecret(){return Iu()},generateBackupCodes(i){return Tu(i||r)},async issueChallenge(i){return v({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(lm)?[lm]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(w0.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let s=Iu(),o=Tu(r),a=await Promise.all(o.map(p=>_u(p))),c=i.data.accountName??i.userId,l=gT({secretBase32:s,accountName:c,issuer:e});return v({secret:s,otpauthUri:l,backupCodes:o,credentialData:{secret:s,backupCodeHashes:a}})},async verifyWithCredentials(i){let s=i.credentialData,o=i.data.code?.trim();if(!o||!s?.secret)return v({verified:!1,data:{}});if(await xu(s.secret,o,Date.now(),{window:n}))return v({verified:!0,data:{}});let c=s.backupCodeHashes??[];if(c.length>0){let l=await am(o,c);if(l)return v({verified:!0,data:{usedBackupCodeHash:l}})}return v({verified:!1,data:{}})},async verifyCredential(i,s){let o=i.data.code,a=i.data.secret;if(!o||!a)return v({verified:!1,data:{}});let c=await xu(a,o,Date.now(),{window:n});return v({verified:c,data:{}})}}}var um={scopes:["email","public_profile"],apiVersion:"v18.0"};var Gr={INVALID_CODE:T("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:T("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function dm(t={}){let{scopes:e=um.scopes,apiVersion:r=um.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,s){let o=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...s&&{state:s}});return`${n.AUTHORIZATION}?${o.toString()}`},async exchangeCodeForToken(i,s){try{if(!i)return u(Gr.INVALID_CODE());let o=new URLSearchParams({client_id:s.clientId,client_secret:s.clientSecret,code:i,redirect_uri:s.redirectUri}),a=await fetch(`${n.TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Gr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return v({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(o){return console.error("Facebook token exchange error:",o),u(Gr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return u(Gr.INVALID_TOKEN());let s=["id","email","name","first_name","last_name","picture","locale"],o=new URLSearchParams({fields:s.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Gr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return v(l)}catch(s){return console.error("Facebook user profile error:",s),u(Gr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return u(Gr.INVALID_TOKEN());let s=`${t.appId}|${t.appSecret}`,o=new URLSearchParams({input_token:i,access_token:s}),a=await fetch(`${n.DEBUG_TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):u(Gr.INVALID_TOKEN()):u(Gr.INVALID_TOKEN())}catch(s){return console.error("Facebook token verification error:",s),u(Gr.INVALID_TOKEN())}}}}var bu={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},Ui={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var Ze={INVALID_CODE:T("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:T("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:T("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:T("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:T("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function N0(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function R0(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=N0(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function pm(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=bu.scopes,accessType:s=bu.accessType,includeGrantedScopes:o=bu.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let d=c?.clientId??e,p=c?.redirectUri??n;if(!d||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let f=new URLSearchParams({client_id:d,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:s,...l&&{state:l},...a&&{prompt:a},...o&&{include_granted_scopes:"true"}});return`${Ui.AUTHORIZATION}?${f.toString()}`},async exchangeCodeForToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r,f=l?.redirectUri??n;try{if(!c)return u(Ze.INVALID_CODE());if(!d||!p||!f)return u(Ze.MISSING_CONFIG());let h=new URLSearchParams({client_id:d,client_secret:p,code:c,redirect_uri:f,grant_type:"authorization_code"}),g=await fetch(Ui.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:h.toString()});if(!g.ok)return console.error("Google token exchange failed with status:",g.status),u(Ze.TOKEN_EXCHANGE_FAILED());let _=await g.json();return v({accessToken:_.access_token,..._.refresh_token&&{refreshToken:_.refresh_token},..._.expires_in&&{expiresIn:_.expires_in}})}catch(h){return console.error("Google token exchange error:",h),u(Ze.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return u(Ze.INVALID_TOKEN());let l=await fetch(Ui.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),u(Ze.USER_PROFILE_FAILED());let d=await l.json(),p={id:d.id,...d.email&&{email:d.email},...d.verified_email!==void 0&&{emailVerified:d.verified_email},...d.name&&{name:d.name},...d.given_name&&{givenName:d.given_name},...d.family_name&&{familyName:d.family_name},...d.picture&&{avatarUrl:d.picture},...d.locale&&{locale:d.locale},provider:"google"};return v(p)}catch(l){return console.error("Google user profile error:",l),u(Ze.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return u(Ze.INVALID_TOKEN());let l=await fetch(`${Ui.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return u(Ze.INVALID_TOKEN());let d=await l.json();return parseInt(d.expires_in,10)<=0?u(Ze.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),u(Ze.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return u(Ze.INVALID_CREDENTIAL());let l=await fetch(`${Ui.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),u(Ze.INVALID_CREDENTIAL());let d=await l.json();if(!e)return u(Ze.MISSING_CONFIG());if(d.aud!==e)return u(Ze.INVALID_CREDENTIAL());if(parseInt(d.expires_in,10)<=0)return u(Ze.INVALID_CREDENTIAL());let f=d.email_verified==="true",h=R0(c),g={id:d.sub,...d.email&&{email:d.email},...d.email&&{emailVerified:f},...h?.name&&{name:h.name},...h?.given_name&&{givenName:h.given_name},...h?.family_name&&{familyName:h.family_name},...h?.picture&&{avatarUrl:h.picture},...h?.locale&&{locale:h.locale},provider:"google"};return v(g)}catch(l){return console.error("Google credential verification error:",l),u(Ze.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return u(Ze.INVALID_TOKEN());if(!d||!p)return u(Ze.MISSING_CONFIG());let f=new URLSearchParams({client_id:d,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),h=await fetch(Ui.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!h.ok)return console.error("Google refresh token failed with status:",h.status),u(Ze.REFRESH_TOKEN_FAILED());let g=await h.json();return v({accessToken:g.access_token,...g.expires_in&&{expiresIn:g.expires_in}})}catch(f){return console.error("Google refresh token error:",f),u(Ze.REFRESH_TOKEN_FAILED())}}}}function AT(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function s(){if(n===0)return;let o=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(d=>d>o);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(s,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(o,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let d=Date.now(),p=d-l,f=e.get(o)??{hits:[]},h=f.hits.filter(g=>g>p);if(h.length>=c){let g=h[0]??d,_=Math.max(0,g+l-d);return f.hits=h,e.set(o,f),{allowed:!1,remaining:0,retryAfterMs:_,limit:c}}return h.push(d),f.hits=h,e.set(o,f),{allowed:!0,remaining:c-h.length,retryAfterMs:0,limit:c}},async reset(o){e.delete(o)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as tk,DynamoDBClient as rk}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as nk}from"@aws-sdk/lib-dynamodb";var M={DatabaseConnectionError:T("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:Z("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:Z("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:Z("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:Z("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:T("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:T("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:Z("INVALID_DATA","Invalid data: {reason}"),Timeout:T("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:T("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:Z("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:Z("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function te(t){return t.getTime()}function z(t){return new Date(t)}function TT(t){return Math.floor(t/1e3)}function oe(){return Date.now()}function Ua(t){return t instanceof Date?TT(t.getTime()):TT(t)}function fm(t){return t<Date.now()}function br(t){return t?te(t):null}function Dt(t){return t==null?null:z(t)}function Pt(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function Sr(t){let e=[],r=[],n={},i={},s=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let d=`#${c}`;if(n[d]=c,l==null)r.push(d);else{let p=`:val${s}`;e.push(`${d} = ${p}`),i[p]=l,s++}}let o=[];return e.length>0&&o.push(`SET ${e.join(", ")}`),r.length>0&&o.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:o.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function mm(t="PK"){return`attribute_not_exists(${t})`}var hm={USER:"USR"},ae={USER:`${hm.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Ve={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},At="#",U={USER_PK:t=>`${ae.USER}${t}`,USER_AUTH_SK:()=>Ve.AUTH,USER_PROFILE_SK:()=>Ve.PROFILE,USER_MFA_SK:t=>`${Ve.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Ve.MFA}${t}${At}${e}`,TENANT_MEMBER_PK:t=>`${ae.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ae.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Ve.OWNER,TENANT_PK:t=>`${ae.TENANT}${t}`,TENANT_SK:()=>Ve.METADATA,INVITE_PK:t=>`${ae.INVITE}${t}`,INVITE_SK:()=>Ve.METADATA,TENANT_PROFILE_PK:t=>`${ae.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Ve.TENANT_PROFILE}${ae.USER}${t}`,SESSION_PK:t=>`${ae.SESSION}${t}`,SESSION_METADATA_SK:()=>Ve.METADATA,SESSION_SK:()=>Ve.METADATA,PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${At}${e}`,PROVIDER_PK:(t,e)=>`${ae.PROVIDER}${t}${At}${e}`,PROVIDER_METADATA_SK:()=>Ve.METADATA,CHALLENGE_PK:t=>`${ae.CHALLENGE}${t}`,CHALLENGE_SK:()=>Ve.METADATA,IDENTITY_PK:(t,e)=>`${ae.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Ve.METADATA,CREDENTIAL_PK:t=>`${ae.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Ve.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ae.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ae.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ae.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ae.IDENTITY}${t}#${e}`},ce={userId:t=>t.slice(ae.USER.length),sessionId:t=>t.slice(ae.SESSION.length),providerPKInfo:t=>{let e=t.slice(ae.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Ve.PROVIDER.length),r=e.indexOf(At);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Ve.MFA.length),r=e.indexOf(At);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ae.TENANT.length),tenantMemberUserId:t=>t.slice(ae.USER.length),challengeIdFromPK:t=>t.slice(ae.CHALLENGE.length),inviteId:t=>t.slice(ae.INVITE.length),tenantProfileUserId:t=>t.slice(Ve.TENANT_PROFILE.length+ae.USER.length),identityPKInfo:t=>{let e=t.slice(ae.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ae.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ae.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ae.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ae.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${At}${e}`,USER_SESSION_PK:t=>`${ae.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${At}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${hm.USER}${At}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ae.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${At}${e}`,INVITE_TENANT_PK:t=>`${ae.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${At}${e}${At}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${At}`,USER_TENANT_PK:t=>`${ae.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${At}${e??"ROOT"}${At}${r}${At}${n}`},m={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},Se={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},Su={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${At}${e}`,extractCreatedAt:t=>{let e=t.indexOf(At),r=e===-1?t:t.slice(0,e);return Number(r)}};import{DeleteCommand as Z0,GetCommand as eO,PutCommand as tO,UpdateCommand as UT}from"@aws-sdk/lib-dynamodb";var O0=BigInt(0),La=BigInt(1),k0=BigInt(2),C0=BigInt(7),D0=BigInt(256),P0=BigInt(113),xT=[],bT=[],ST=[];for(let t=0,e=La,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],xT.push(2*(5*n+r)),bT.push((t+1)*(t+2)/2%64);let i=O0;for(let s=0;s<7;s++)e=(e<<La^(e>>C0)*P0)%D0,e&k0&&(i^=La<<(La<<BigInt(s))-La);ST.push(i)}var wT=sv(ST,!0),U0=wT[0],L0=wT[1],M0=(t,e,r)=>t<<r|e>>>32-r,K0=(t,e,r)=>e<<r|t>>>32-r,H0=(t,e,r)=>e<<r-32|t>>>64-r,F0=(t,e,r)=>t<<r-32|e>>>64-r,_T=(t,e,r)=>r>32?H0(t,e,r):M0(t,e,r),IT=(t,e,r)=>r>32?F0(t,e,r):K0(t,e,r),to=new Uint32Array(10);function V0(t,e=24){if(!(t instanceof Uint32Array))throw new TypeError('"s" expected Uint32Array(50), got type='+typeof t);if(t.length!==50)throw new RangeError('"s" expected Uint32Array(50), got length='+t.length);if(Je(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');for(let r=24-e;r<24;r++){for(let s=0;s<10;s++)to[s]=t[s]^t[s+10]^t[s+20]^t[s+30]^t[s+40];for(let s=0;s<10;s+=2){let o=(s+8)%10,a=(s+2)%10,c=to[a],l=to[a+1],d=_T(c,l,1)^to[o],p=IT(c,l,1)^to[o+1];for(let f=0;f<50;f+=10)t[s+f]^=d,t[s+f+1]^=p}let n=t[2],i=t[3];for(let s=0;s<24;s++){let o=bT[s],a=_T(n,i,o),c=IT(n,i,o),l=xT[s];n=t[l],i=t[l+1],t[l]=a,t[l+1]=c}for(let s=0;s<50;s+=10){let o=t[s],a=t[s+1],c=t[s+2],l=t[s+3];t[s]^=~t[s+2]&t[s+4],t[s+1]^=~t[s+3]&t[s+5],t[s+2]^=~t[s+4]&t[s+6],t[s+3]^=~t[s+5]&t[s+7],t[s+4]^=~t[s+6]&t[s+8],t[s+5]^=~t[s+7]&t[s+9],t[s+6]^=~t[s+8]&o,t[s+7]^=~t[s+9]&a,t[s+8]^=~o&c,t[s+9]^=~a&l}t[0]^=U0[r],t[1]^=L0[r]}Yt(to)}var Em=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,s=24){if(Je(e,"blockLen"),Je(r,"suffix"),Je(s,"rounds"),rv(i,"enableXOF"),this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=s,Je(n,"outputLen"),!(0<e&&e<200))throw new Error('"blockLen" must be 1..199');this.state=new Uint8Array(200),this.state32=ki(this.state)}clone(){return this._cloneInto()}keccak(){Ys(this.state32),V0(this.state32,this.rounds),Ys(this.state32),this.posOut=0,this.pos=0}update(e){pn(this),dn(e);let{blockLen:r,state:n,state32:i}=this,s=e.length,o=r%4===0&&e.byteOffset%4===0,a=r/4,c=o&&s>=r?ki(e):void 0;for(let l=0;l<s;){if(c!==void 0&&this.pos===0&&l%4===0&&s-l>=r){for(let p=0,f=l/4;p<a;p++)i[p]^=c[f+p];l+=r,this.pos=r,this.keccak();continue}let d=Math.min(r-this.pos,s-l);for(let p=0;p<d;p++)n[this.pos++]^=e[l++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){pn(this,!1),dn(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,s=e.length;i<s;){this.posOut>=n&&this.keccak();let o=Math.min(n-this.posOut,s-i);e.set(r.subarray(this.posOut,this.posOut+o),i),this.posOut+=o,i+=o}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not enabled");return this.writeInto(e)}xof(e){return Je(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(zs(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.length===this.outputLen?e:e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,Yt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:s,enableXOF:o}=this;return e||=new t(r,n,i,o,s),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=s,e.suffix=n,e.outputLen=i,e.enableXOF=o,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},B0=(t,e,r,n={})=>tu(()=>new Em(e,t,r),n);var NT=B0(6,72,64,ru(10));var j0=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,ym=Math.ceil,pr=Math.floor,Ft="[BigNumber Error] ",RT=Ft+"Number primitive has more than 15 significant digits: ",wr=1e14,le=14,gm=9007199254740991,vm=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],Xn=1e7,ft=1e9;function OT(t){var e,r,n,i=D.prototype={constructor:D,toString:null,valueOf:null},s=new D(1),o=20,a=4,c=-7,l=21,d=-1e7,p=1e7,f=!1,h=1,g=0,_={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},R="0123456789abcdefghijklmnopqrstuvwxyz",C=!0;function D(A,I){var S,y,x,N,O,w,k,P,L=this;if(!(L instanceof D))return new D(A,I);if(I==null){if(A&&A._isBigNumber===!0){L.s=A.s,!A.c||A.e>p?L.c=L.e=null:A.e<d?L.c=[L.e=0]:(L.e=A.e,L.c=A.c.slice());return}if((w=typeof A=="number")&&A*0==0){if(L.s=1/A<0?(A=-A,-1):1,A===~~A){for(N=0,O=A;O>=10;O/=10,N++);N>p?L.c=L.e=null:(L.e=N,L.c=[A]);return}P=String(A)}else{if(!j0.test(P=String(A)))return n(L,P,w);L.s=P.charCodeAt(0)==45?(P=P.slice(1),-1):1}(N=P.indexOf("."))>-1&&(P=P.replace(".","")),(O=P.search(/e/i))>0?(N<0&&(N=O),N+=+P.slice(O+1),P=P.substring(0,O)):N<0&&(N=P.length)}else{if($e(I,2,R.length,"Base"),I==10&&C)return L=new D(A),B(L,o+L.e+1,a);if(P=String(A),w=typeof A=="number"){if(A*0!=0)return n(L,P,w,I);if(L.s=1/A<0?(P=P.slice(1),-1):1,D.DEBUG&&P.replace(/^0\.0*|\./,"").length>15)throw Error(RT+A)}else L.s=P.charCodeAt(0)===45?(P=P.slice(1),-1):1;for(S=R.slice(0,I),N=O=0,k=P.length;O<k;O++)if(S.indexOf(y=P.charAt(O))<0){if(y=="."){if(O>N){N=k;continue}}else if(!x&&(P==P.toUpperCase()&&(P=P.toLowerCase())||P==P.toLowerCase()&&(P=P.toUpperCase()))){x=!0,O=-1,N=0;continue}return n(L,String(A),w,I)}w=!1,P=r(P,I,10,L.s),(N=P.indexOf("."))>-1?P=P.replace(".",""):N=P.length}for(O=0;P.charCodeAt(O)===48;O++);for(k=P.length;P.charCodeAt(--k)===48;);if(P=P.slice(O,++k)){if(k-=O,w&&D.DEBUG&&k>15&&(A>gm||A!==pr(A)))throw Error(RT+L.s*A);if((N=N-O-1)>p)L.c=L.e=null;else if(N<d)L.c=[L.e=0];else{if(L.e=N,L.c=[],O=(N+1)%le,N<0&&(O+=le),O<k){for(O&&L.c.push(+P.slice(0,O)),k-=le;O<k;)L.c.push(+P.slice(O,O+=le));O=le-(P=P.slice(O)).length}else O-=k;for(;O--;P+="0");L.c.push(+P)}}else L.c=[L.e=0]}D.clone=OT,D.ROUND_UP=0,D.ROUND_DOWN=1,D.ROUND_CEIL=2,D.ROUND_FLOOR=3,D.ROUND_HALF_UP=4,D.ROUND_HALF_DOWN=5,D.ROUND_HALF_EVEN=6,D.ROUND_HALF_CEIL=7,D.ROUND_HALF_FLOOR=8,D.EUCLID=9,D.config=D.set=function(A){var I,S;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(I="DECIMAL_PLACES")&&(S=A[I],$e(S,0,ft,I),o=S),A.hasOwnProperty(I="ROUNDING_MODE")&&(S=A[I],$e(S,0,8,I),a=S),A.hasOwnProperty(I="EXPONENTIAL_AT")&&(S=A[I],S&&S.pop?($e(S[0],-ft,0,I),$e(S[1],0,ft,I),c=S[0],l=S[1]):($e(S,-ft,ft,I),c=-(l=S<0?-S:S))),A.hasOwnProperty(I="RANGE"))if(S=A[I],S&&S.pop)$e(S[0],-ft,-1,I),$e(S[1],1,ft,I),d=S[0],p=S[1];else if($e(S,-ft,ft,I),S)d=-(p=S<0?-S:S);else throw Error(Ft+I+" cannot be zero: "+S);if(A.hasOwnProperty(I="CRYPTO"))if(S=A[I],S===!!S)if(S)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))f=S;else throw f=!S,Error(Ft+"crypto unavailable");else f=S;else throw Error(Ft+I+" not true or false: "+S);if(A.hasOwnProperty(I="MODULO_MODE")&&(S=A[I],$e(S,0,9,I),h=S),A.hasOwnProperty(I="POW_PRECISION")&&(S=A[I],$e(S,0,ft,I),g=S),A.hasOwnProperty(I="FORMAT"))if(S=A[I],typeof S=="object")_=S;else throw Error(Ft+I+" not an object: "+S);if(A.hasOwnProperty(I="ALPHABET"))if(S=A[I],typeof S=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(S))C=S.slice(0,10)=="0123456789",R=S;else throw Error(Ft+I+" invalid: "+S)}else throw Error(Ft+"Object expected: "+A);return{DECIMAL_PLACES:o,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[d,p],CRYPTO:f,MODULO_MODE:h,POW_PRECISION:g,FORMAT:_,ALPHABET:R}},D.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!D.DEBUG)return!0;var I,S,y=A.c,x=A.e,N=A.s;e:if({}.toString.call(y)=="[object Array]"){if((N===1||N===-1)&&x>=-ft&&x<=ft&&x===pr(x)){if(y[0]===0){if(x===0&&y.length===1)return!0;break e}if(I=(x+1)%le,I<1&&(I+=le),String(y[0]).length==I){for(I=0;I<y.length;I++)if(S=y[I],S<0||S>=wr||S!==pr(S))break e;if(S!==0)return!0}}}else if(y===null&&x===null&&(N===null||N===1||N===-1))return!0;throw Error(Ft+"Invalid BigNumber: "+A)},D.maximum=D.max=function(){return J(arguments,-1)},D.minimum=D.min=function(){return J(arguments,1)},D.random=(function(){var A=9007199254740992,I=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(S){var y,x,N,O,w,k=0,P=[],L=new D(s);if(S==null?S=o:$e(S,0,ft),O=ym(S/le),f)if(crypto.getRandomValues){for(y=crypto.getRandomValues(new Uint32Array(O*=2));k<O;)w=y[k]*131072+(y[k+1]>>>11),w>=9e15?(x=crypto.getRandomValues(new Uint32Array(2)),y[k]=x[0],y[k+1]=x[1]):(P.push(w%1e14),k+=2);k=O/2}else if(crypto.randomBytes){for(y=crypto.randomBytes(O*=7);k<O;)w=(y[k]&31)*281474976710656+y[k+1]*1099511627776+y[k+2]*4294967296+y[k+3]*16777216+(y[k+4]<<16)+(y[k+5]<<8)+y[k+6],w>=9e15?crypto.randomBytes(7).copy(y,k):(P.push(w%1e14),k+=7);k=O/7}else throw f=!1,Error(Ft+"crypto unavailable");if(!f)for(;k<O;)w=I(),w<9e15&&(P[k++]=w%1e14);for(O=P[--k],S%=le,O&&S&&(w=vm[le-S],P[k]=pr(O/w)*w);P[k]===0;P.pop(),k--);if(k<0)P=[N=0];else{for(N=-1;P[0]===0;P.splice(0,1),N-=le);for(k=1,w=P[0];w>=10;w/=10,k++);k<le&&(N-=le-k)}return L.e=N,L.c=P,L}})(),D.sum=function(){for(var A=1,I=arguments,S=new D(I[0]);A<I.length;)S=S.plus(I[A++]);return S},r=(function(){var A="0123456789";function I(S,y,x,N){for(var O,w=[0],k,P=0,L=S.length;P<L;){for(k=w.length;k--;w[k]*=y);for(w[0]+=N.indexOf(S.charAt(P++)),O=0;O<w.length;O++)w[O]>x-1&&(w[O+1]==null&&(w[O+1]=0),w[O+1]+=w[O]/x|0,w[O]%=x)}return w.reverse()}return function(S,y,x,N,O){var w,k,P,L,K,W,Y,ue,Oe=S.indexOf("."),He=o,pe=a;for(Oe>=0&&(L=g,g=0,S=S.replace(".",""),ue=new D(y),W=ue.pow(S.length-Oe),g=L,ue.c=I(fn(dr(W.c),W.e,"0"),10,x,A),ue.e=ue.c.length),Y=I(S,y,x,O?(w=R,A):(w=A,R)),P=L=Y.length;Y[--L]==0;Y.pop());if(!Y[0])return w.charAt(0);if(Oe<0?--P:(W.c=Y,W.e=P,W.s=N,W=e(W,ue,He,pe,x),Y=W.c,K=W.r,P=W.e),k=P+He+1,Oe=Y[k],L=x/2,K=K||k<0||Y[k+1]!=null,K=pe<4?(Oe!=null||K)&&(pe==0||pe==(W.s<0?3:2)):Oe>L||Oe==L&&(pe==4||K||pe==6&&Y[k-1]&1||pe==(W.s<0?8:7)),k<1||!Y[0])S=K?fn(w.charAt(1),-He,w.charAt(0)):w.charAt(0);else{if(Y.length=k,K)for(--x;++Y[--k]>x;)Y[k]=0,k||(++P,Y=[1].concat(Y));for(L=Y.length;!Y[--L];);for(Oe=0,S="";Oe<=L;S+=w.charAt(Y[Oe++]));S=fn(S,P,w.charAt(0))}return S}})(),e=(function(){function A(y,x,N){var O,w,k,P,L=0,K=y.length,W=x%Xn,Y=x/Xn|0;for(y=y.slice();K--;)k=y[K]%Xn,P=y[K]/Xn|0,O=Y*k+P*W,w=W*k+O%Xn*Xn+L,L=(w/N|0)+(O/Xn|0)+Y*P,y[K]=w%N;return L&&(y=[L].concat(y)),y}function I(y,x,N,O){var w,k;if(N!=O)k=N>O?1:-1;else for(w=k=0;w<N;w++)if(y[w]!=x[w]){k=y[w]>x[w]?1:-1;break}return k}function S(y,x,N,O){for(var w=0;N--;)y[N]-=w,w=y[N]<x[N]?1:0,y[N]=w*O+y[N]-x[N];for(;!y[0]&&y.length>1;y.splice(0,1));}return function(y,x,N,O,w){var k,P,L,K,W,Y,ue,Oe,He,pe,we,ot,Ki,yn,Hi,Tt,ni,_t=y.s==x.s?1:-1,Ye=y.c,Me=x.c;if(!Ye||!Ye[0]||!Me||!Me[0])return new D(!y.s||!x.s||(Ye?Me&&Ye[0]==Me[0]:!Me)?NaN:Ye&&Ye[0]==0||!Me?_t*0:_t/0);for(Oe=new D(_t),He=Oe.c=[],P=y.e-x.e,_t=N+P+1,w||(w=wr,P=fr(y.e/le)-fr(x.e/le),_t=_t/le|0),L=0;Me[L]==(Ye[L]||0);L++);if(Me[L]>(Ye[L]||0)&&P--,_t<0)He.push(1),K=!0;else{for(yn=Ye.length,Tt=Me.length,L=0,_t+=2,W=pr(w/(Me[0]+1)),W>1&&(Me=A(Me,W,w),Ye=A(Ye,W,w),Tt=Me.length,yn=Ye.length),Ki=Tt,pe=Ye.slice(0,Tt),we=pe.length;we<Tt;pe[we++]=0);ni=Me.slice(),ni=[0].concat(ni),Hi=Me[0],Me[1]>=w/2&&Hi++;do{if(W=0,k=I(Me,pe,Tt,we),k<0){if(ot=pe[0],Tt!=we&&(ot=ot*w+(pe[1]||0)),W=pr(ot/Hi),W>1)for(W>=w&&(W=w-1),Y=A(Me,W,w),ue=Y.length,we=pe.length;I(Y,pe,ue,we)==1;)W--,S(Y,Tt<ue?ni:Me,ue,w),ue=Y.length,k=1;else W==0&&(k=W=1),Y=Me.slice(),ue=Y.length;if(ue<we&&(Y=[0].concat(Y)),S(pe,Y,we,w),we=pe.length,k==-1)for(;I(Me,pe,Tt,we)<1;)W++,S(pe,Tt<we?ni:Me,we,w),we=pe.length}else k===0&&(W++,pe=[0]);He[L++]=W,pe[0]?pe[we++]=Ye[Ki]||0:(pe=[Ye[Ki]],we=1)}while((Ki++<yn||pe[0]!=null)&&_t--);K=pe[0]!=null,He[0]||He.splice(0,1)}if(w==wr){for(L=1,_t=He[0];_t>=10;_t/=10,L++);B(Oe,N+(Oe.e=L+P*le-1)+1,O,K)}else Oe.e=P,Oe.r=+K;return Oe}})();function F(A,I,S,y){var x,N,O,w,k;if(S==null?S=a:$e(S,0,8),!A.c)return A.toString();if(x=A.c[0],O=A.e,I==null)k=dr(A.c),k=y==1||y==2&&(O<=c||O>=l)?Nu(k,O):fn(k,O,"0");else if(A=B(new D(A),I,S),N=A.e,k=dr(A.c),w=k.length,y==1||y==2&&(I<=N||N<=c)){for(;w<I;k+="0",w++);k=Nu(k,N)}else if(I-=O+(y===2&&N>O),k=fn(k,N,"0"),N+1>w){if(--I>0)for(k+=".";I--;k+="0");}else if(I+=N-w,I>0)for(N+1==w&&(k+=".");I--;k+="0");return A.s<0&&x?"-"+k:k}function J(A,I){for(var S,y,x=1,N=new D(A[0]);x<A.length;x++)y=new D(A[x]),(!y.s||(S=Li(N,y))===I||S===0&&N.s===I)&&(N=y);return N}function q(A,I,S){for(var y=1,x=I.length;!I[--x];I.pop());for(x=I[0];x>=10;x/=10,y++);return(S=y+S*le-1)>p?A.c=A.e=null:S<d?A.c=[A.e=0]:(A.e=S,A.c=I),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,I=/^([^.]+)\.$/,S=/^\.([^.]+)$/,y=/^-?(Infinity|NaN)$/,x=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(N,O,w,k){var P,L=w?O:O.replace(x,"");if(y.test(L))N.s=isNaN(L)?null:L<0?-1:1;else{if(!w&&(L=L.replace(A,function(K,W,Y){return P=(Y=Y.toLowerCase())=="x"?16:Y=="b"?2:8,!k||k==P?W:K}),k&&(P=k,L=L.replace(I,"$1").replace(S,"0.$1")),O!=L))return new D(L,P);if(D.DEBUG)throw Error(Ft+"Not a"+(k?" base "+k:"")+" number: "+O);N.s=null}N.c=N.e=null}})();function B(A,I,S,y){var x,N,O,w,k,P,L,K=A.c,W=vm;if(K){e:{for(x=1,w=K[0];w>=10;w/=10,x++);if(N=I-x,N<0)N+=le,O=I,k=K[P=0],L=pr(k/W[x-O-1]%10);else if(P=ym((N+1)/le),P>=K.length)if(y){for(;K.length<=P;K.push(0));k=L=0,x=1,N%=le,O=N-le+1}else break e;else{for(k=w=K[P],x=1;w>=10;w/=10,x++);N%=le,O=N-le+x,L=O<0?0:pr(k/W[x-O-1]%10)}if(y=y||I<0||K[P+1]!=null||(O<0?k:k%W[x-O-1]),y=S<4?(L||y)&&(S==0||S==(A.s<0?3:2)):L>5||L==5&&(S==4||y||S==6&&(N>0?O>0?k/W[x-O]:0:K[P-1])%10&1||S==(A.s<0?8:7)),I<1||!K[0])return K.length=0,y?(I-=A.e+1,K[0]=W[(le-I%le)%le],A.e=-I||0):K[0]=A.e=0,A;if(N==0?(K.length=P,w=1,P--):(K.length=P+1,w=W[le-N],K[P]=O>0?pr(k/W[x-O]%W[O])*w:0),y)for(;;)if(P==0){for(N=1,O=K[0];O>=10;O/=10,N++);for(O=K[0]+=w,w=1;O>=10;O/=10,w++);N!=w&&(A.e++,K[0]==wr&&(K[0]=1));break}else{if(K[P]+=w,K[P]!=wr)break;K[P--]=0,w=1}for(N=K.length;K[--N]===0;K.pop());}A.e>p?A.c=A.e=null:A.e<d&&(A.c=[A.e=0])}return A}function $(A){var I,S=A.e;return S===null?A.toString():(I=dr(A.c),I=S<=c||S>=l?Nu(I,S):fn(I,S,"0"),A.s<0?"-"+I:I)}return i.absoluteValue=i.abs=function(){var A=new D(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,I){return Li(this,new D(A,I))},i.decimalPlaces=i.dp=function(A,I){var S,y,x,N=this;if(A!=null)return $e(A,0,ft),I==null?I=a:$e(I,0,8),B(new D(N),A+N.e+1,I);if(!(S=N.c))return null;if(y=((x=S.length-1)-fr(this.e/le))*le,x=S[x])for(;x%10==0;x/=10,y--);return y<0&&(y=0),y},i.dividedBy=i.div=function(A,I){return e(this,new D(A,I),o,a)},i.dividedToIntegerBy=i.idiv=function(A,I){return e(this,new D(A,I),0,1)},i.exponentiatedBy=i.pow=function(A,I){var S,y,x,N,O,w,k,P,L,K=this;if(A=new D(A),A.c&&!A.isInteger())throw Error(Ft+"Exponent not an integer: "+$(A));if(I!=null&&(I=new D(I)),w=A.e>14,!K.c||!K.c[0]||K.c[0]==1&&!K.e&&K.c.length==1||!A.c||!A.c[0])return L=new D(Math.pow(+$(K),w?A.s*(2-wu(A)):+$(A))),I?L.mod(I):L;if(k=A.s<0,I){if(I.c?!I.c[0]:!I.s)return new D(NaN);y=!k&&K.isInteger()&&I.isInteger(),y&&(K=K.mod(I))}else{if(A.e>9&&(K.e>0||K.e<-1||(K.e==0?K.c[0]>1||w&&K.c[1]>=24e7:K.c[0]<8e13||w&&K.c[0]<=9999975e7)))return N=K.s<0&&wu(A)?-0:0,K.e>-1&&(N=1/N),new D(k?1/N:N);g&&(N=ym(g/le+2))}for(w?(S=new D(.5),k&&(A.s=1),P=wu(A)):(x=Math.abs(+$(A)),P=x%2),L=new D(s);;){if(P){if(L=L.times(K),!L.c)break;N?L.c.length>N&&(L.c.length=N):y&&(L=L.mod(I))}if(x){if(x=pr(x/2),x===0)break;P=x%2}else if(A=A.times(S),B(A,A.e+1,1),A.e>14)P=wu(A);else{if(x=+$(A),x===0)break;P=x%2}K=K.times(K),N?K.c&&K.c.length>N&&(K.c.length=N):y&&(K=K.mod(I))}return y?L:(k&&(L=s.div(L)),I?L.mod(I):N?B(L,g,a,O):L)},i.integerValue=function(A){var I=new D(this);return A==null?A=a:$e(A,0,8),B(I,I.e+1,A)},i.isEqualTo=i.eq=function(A,I){return Li(this,new D(A,I))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,I){return Li(this,new D(A,I))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,I){return(I=Li(this,new D(A,I)))===1||I===0},i.isInteger=function(){return!!this.c&&fr(this.e/le)>this.c.length-2},i.isLessThan=i.lt=function(A,I){return Li(this,new D(A,I))<0},i.isLessThanOrEqualTo=i.lte=function(A,I){return(I=Li(this,new D(A,I)))===-1||I===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,I){var S,y,x,N,O=this,w=O.s;if(A=new D(A,I),I=A.s,!w||!I)return new D(NaN);if(w!=I)return A.s=-I,O.plus(A);var k=O.e/le,P=A.e/le,L=O.c,K=A.c;if(!k||!P){if(!L||!K)return L?(A.s=-I,A):new D(K?O:NaN);if(!L[0]||!K[0])return K[0]?(A.s=-I,A):new D(L[0]?O:a==3?-0:0)}if(k=fr(k),P=fr(P),L=L.slice(),w=k-P){for((N=w<0)?(w=-w,x=L):(P=k,x=K),x.reverse(),I=w;I--;x.push(0));x.reverse()}else for(y=(N=(w=L.length)<(I=K.length))?w:I,w=I=0;I<y;I++)if(L[I]!=K[I]){N=L[I]<K[I];break}if(N&&(x=L,L=K,K=x,A.s=-A.s),I=(y=K.length)-(S=L.length),I>0)for(;I--;L[S++]=0);for(I=wr-1;y>w;){if(L[--y]<K[y]){for(S=y;S&&!L[--S];L[S]=I);--L[S],L[y]+=wr}L[y]-=K[y]}for(;L[0]==0;L.splice(0,1),--P);return L[0]?q(A,L,P):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,I){var S,y,x=this;return A=new D(A,I),!x.c||!A.s||A.c&&!A.c[0]?new D(NaN):!A.c||x.c&&!x.c[0]?new D(x):(h==9?(y=A.s,A.s=1,S=e(x,A,0,3),A.s=y,S.s*=y):S=e(x,A,0,h),A=x.minus(S.times(A)),!A.c[0]&&h==1&&(A.s=x.s),A)},i.multipliedBy=i.times=function(A,I){var S,y,x,N,O,w,k,P,L,K,W,Y,ue,Oe,He,pe=this,we=pe.c,ot=(A=new D(A,I)).c;if(!we||!ot||!we[0]||!ot[0])return!pe.s||!A.s||we&&!we[0]&&!ot||ot&&!ot[0]&&!we?A.c=A.e=A.s=null:(A.s*=pe.s,!we||!ot?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(y=fr(pe.e/le)+fr(A.e/le),A.s*=pe.s,k=we.length,K=ot.length,k<K&&(ue=we,we=ot,ot=ue,x=k,k=K,K=x),x=k+K,ue=[];x--;ue.push(0));for(Oe=wr,He=Xn,x=K;--x>=0;){for(S=0,W=ot[x]%He,Y=ot[x]/He|0,O=k,N=x+O;N>x;)P=we[--O]%He,L=we[O]/He|0,w=Y*P+L*W,P=W*P+w%He*He+ue[N]+S,S=(P/Oe|0)+(w/He|0)+Y*L,ue[N--]=P%Oe;ue[N]=S}return S?++y:ue.splice(0,1),q(A,ue,y)},i.negated=function(){var A=new D(this);return A.s=-A.s||null,A},i.plus=function(A,I){var S,y=this,x=y.s;if(A=new D(A,I),I=A.s,!x||!I)return new D(NaN);if(x!=I)return A.s=-I,y.minus(A);var N=y.e/le,O=A.e/le,w=y.c,k=A.c;if(!N||!O){if(!w||!k)return new D(x/0);if(!w[0]||!k[0])return k[0]?A:new D(w[0]?y:x*0)}if(N=fr(N),O=fr(O),w=w.slice(),x=N-O){for(x>0?(O=N,S=k):(x=-x,S=w),S.reverse();x--;S.push(0));S.reverse()}for(x=w.length,I=k.length,x-I<0&&(S=k,k=w,w=S,I=x),x=0;I;)x=(w[--I]=w[I]+k[I]+x)/wr|0,w[I]=wr===w[I]?0:w[I]%wr;return x&&(w=[x].concat(w),++O),q(A,w,O)},i.precision=i.sd=function(A,I){var S,y,x,N=this;if(A!=null&&A!==!!A)return $e(A,1,ft),I==null?I=a:$e(I,0,8),B(new D(N),A,I);if(!(S=N.c))return null;if(x=S.length-1,y=x*le+1,x=S[x]){for(;x%10==0;x/=10,y--);for(x=S[0];x>=10;x/=10,y++);}return A&&N.e+1>y&&(y=N.e+1),y},i.shiftedBy=function(A){return $e(A,-gm,gm),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,I,S,y,x,N=this,O=N.c,w=N.s,k=N.e,P=o+4,L=new D("0.5");if(w!==1||!O||!O[0])return new D(!w||w<0&&(!O||O[0])?NaN:O?N:1/0);if(w=Math.sqrt(+$(N)),w==0||w==1/0?(I=dr(O),(I.length+k)%2==0&&(I+="0"),w=Math.sqrt(+I),k=fr((k+1)/2)-(k<0||k%2),w==1/0?I="5e"+k:(I=w.toExponential(),I=I.slice(0,I.indexOf("e")+1)+k),S=new D(I)):S=new D(w+""),S.c[0]){for(k=S.e,w=k+P,w<3&&(w=0);;)if(x=S,S=L.times(x.plus(e(N,x,P,1))),dr(x.c).slice(0,w)===(I=dr(S.c)).slice(0,w))if(S.e<k&&--w,I=I.slice(w-3,w+1),I=="9999"||!y&&I=="4999"){if(!y&&(B(x,x.e+o+2,0),x.times(x).eq(N))){S=x;break}P+=4,w+=4,y=1}else{(!+I||!+I.slice(1)&&I.charAt(0)=="5")&&(B(S,S.e+o+2,1),A=!S.times(S).eq(N));break}}return B(S,S.e+o+1,a,A)},i.toExponential=function(A,I){return A!=null&&($e(A,0,ft),A++),F(this,A,I,1)},i.toFixed=function(A,I){return A!=null&&($e(A,0,ft),A=A+this.e+1),F(this,A,I)},i.toFormat=function(A,I,S){var y,x=this;if(S==null)A!=null&&I&&typeof I=="object"?(S=I,I=null):A&&typeof A=="object"?(S=A,A=I=null):S=_;else if(typeof S!="object")throw Error(Ft+"Argument not an object: "+S);if(y=x.toFixed(A,I),x.c){var N,O=y.split("."),w=+S.groupSize,k=+S.secondaryGroupSize,P=S.groupSeparator||"",L=O[0],K=O[1],W=x.s<0,Y=W?L.slice(1):L,ue=Y.length;if(k&&(N=w,w=k,k=N,ue-=N),w>0&&ue>0){for(N=ue%w||w,L=Y.substr(0,N);N<ue;N+=w)L+=P+Y.substr(N,w);k>0&&(L+=P+Y.slice(N)),W&&(L="-"+L)}y=K?L+(S.decimalSeparator||"")+((k=+S.fractionGroupSize)?K.replace(new RegExp("\\d{"+k+"}\\B","g"),"$&"+(S.fractionGroupSeparator||"")):K):L}return(S.prefix||"")+y+(S.suffix||"")},i.toFraction=function(A){var I,S,y,x,N,O,w,k,P,L,K,W,Y=this,ue=Y.c;if(A!=null&&(w=new D(A),!w.isInteger()&&(w.c||w.s!==1)||w.lt(s)))throw Error(Ft+"Argument "+(w.isInteger()?"out of range: ":"not an integer: ")+$(w));if(!ue)return new D(Y);for(I=new D(s),P=S=new D(s),y=k=new D(s),W=dr(ue),N=I.e=W.length-Y.e-1,I.c[0]=vm[(O=N%le)<0?le+O:O],A=!A||w.comparedTo(I)>0?N>0?I:P:w,O=p,p=1/0,w=new D(W),k.c[0]=0;L=e(w,I,0,1),x=S.plus(L.times(y)),x.comparedTo(A)!=1;)S=y,y=x,P=k.plus(L.times(x=P)),k=x,I=w.minus(L.times(x=I)),w=x;return x=e(A.minus(S),y,0,1),k=k.plus(x.times(P)),S=S.plus(x.times(y)),k.s=P.s=Y.s,N=N*2,K=e(P,y,N,a).minus(Y).abs().comparedTo(e(k,S,N,a).minus(Y).abs())<1?[P,y]:[k,S],p=O,K},i.toNumber=function(){return+$(this)},i.toPrecision=function(A,I){return A!=null&&$e(A,1,ft),F(this,A,I,2)},i.toString=function(A){var I,S=this,y=S.s,x=S.e;return x===null?y?(I="Infinity",y<0&&(I="-"+I)):I="NaN":(A==null?I=x<=c||x>=l?Nu(dr(S.c),x):fn(dr(S.c),x,"0"):A===10&&C?(S=B(new D(S),o+x+1,a),I=fn(dr(S.c),S.e,"0")):($e(A,2,R.length,"Base"),I=r(fn(dr(S.c),x,"0"),10,A,y,!0)),y<0&&S.c[0]&&(I="-"+I)),I},i.valueOf=i.toJSON=function(){return $(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&D.set(t),D}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,s=t[0]+"";n<i;){for(e=t[n++]+"",r=le-e.length;r--;e="0"+e);s+=e}for(i=s.length;s.charCodeAt(--i)===48;);return s.slice(0,i+1||1)}function Li(t,e){var r,n,i=t.c,s=e.c,o=t.s,a=e.s,c=t.e,l=e.e;if(!o||!a)return null;if(r=i&&!i[0],n=s&&!s[0],r||n)return r?n?0:-a:o;if(o!=a)return o;if(r=o<0,n=c==l,!i||!s)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=s.length)?c:l,o=0;o<a;o++)if(i[o]!=s[o])return i[o]>s[o]^r?1:-1;return c==l?0:c>l^r?1:-1}function $e(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Ft+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function wu(t){var e=t.c.length-1;return fr(t.e/le)==e&&t.c[e]%2!=0}function Nu(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function fn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var q0=OT(),kT=q0;var G0=24,Ma=32,$0=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,Tm=$0(),Am=(t=4,e=Tm)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function W0(t){let e=new kT(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var DT=(t="")=>{let e=new TextEncoder;return W0(NT(e.encode(t))).toString(36).slice(1)},CT=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),z0=t=>CT[Math.floor(t()*CT.length)],J0=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=Tm}={})=>{let r=Object.keys(t).toString(),n=r.length?r+Am(Ma,e):Am(Ma,e);return DT(n).substring(0,Ma)},Y0=t=>()=>t++,X0=476782367,PT=({random:t=Tm,counter:e=Y0(Math.floor(t()*X0)),length:r=G0,fingerprint:n=J0({random:t})}={})=>{if(r>Ma)throw new Error(`Length must be between 2 and ${Ma}. Received: ${r}`);return function(){let s=z0(t),o=Date.now().toString(36),a=e().toString(36),c=Am(r,t),l=`${o+c+a+n}`;return`${s+DT(l).substring(1,r)}`}},mt=Q0(PT);function Q0(t){let e;return()=>(e||(e=t()),e())}function Ka(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Ce(t){return Ka(t)==="ConditionalCheckFailedException"}var Ha=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return mt()}async get(e){try{let r=await this.docClient.send(new eO({TableName:this.tableName,Key:{[m.PK]:U.CHALLENGE_PK(e),[m.SK]:U.CHALLENGE_SK()}}));if(!r.Item)return v(null);let n=this.unmarshall(r.Item);return fm(te(n.expiresAt))?v(null):v(n)}catch{return u(M.DatabaseQueryError({query:"get challenge"}))}}async create(e){try{let r=oe(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:z(r)},s=te(e.expiresAt),o=Math.floor((s+this.ttlGracePeriod)/1e3);return await this.docClient.send(new tO({TableName:this.tableName,Item:this.marshall(i,o)})),v(i)}catch{return u(M.DatabaseQueryError({query:"create challenge"}))}}async update(e,r){try{let n=[],i={},s={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=m.METHOD,s[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=m.PHASE,s[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=m.CODE_HASH,s[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=m.CHALLENGE_STATUS,s[":challengeStatus"]=r.status),n.length===0?v(void 0):(await this.docClient.send(new UT({TableName:this.tableName,Key:{[m.PK]:U.CHALLENGE_PK(e),[m.SK]:U.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),v(void 0))}catch{return u(M.DatabaseQueryError({query:"update challenge"}))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let o=(await this.docClient.send(new UT({TableName:this.tableName,Key:{[m.PK]:U.CHALLENGE_PK(e),[m.SK]:U.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":m.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[m.ATTEMPTS]??0;return v(o)}catch(s){return Ce(s)?u(M.AttemptsExceeded()):u(M.DatabaseQueryError({query:"increment challenge attempts"}))}}async remove(e){try{return await this.docClient.send(new Z0({TableName:this.tableName,Key:{[m.PK]:U.CHALLENGE_PK(e),[m.SK]:U.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":m.PK}})),v(void 0)}catch(r){return Ce(r)?v(void 0):u(M.DatabaseQueryError({query:"remove challenge"}))}}marshall(e,r){let n={[m.PK]:U.CHALLENGE_PK(e.id),[m.SK]:U.CHALLENGE_SK(),[m.USER_ID]:e.userId,[m.PURPOSE]:e.purpose,[m.CHALLENGE_STATUS]:e.status,[m.EXPIRES_AT]:te(e.expiresAt),[m.CREATED_AT]:te(e.createdAt),[m.TTL]:r};return e.tenantId&&(n[m.TENANT_ID]=e.tenantId),e.phase&&(n[m.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[m.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[m.METHOD]=e.method),e.codeHash&&(n[m.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[m.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[m.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[m.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[m.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[m.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[m.COUNTRY]=e.country),e.city&&(n[m.CITY]=e.city),e.metadata&&(n[m.METADATA]=e.metadata),e.flowKey&&(n[m.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:ce.challengeIdFromPK(e[m.PK]),userId:e[m.USER_ID],purpose:e[m.PURPOSE],status:e[m.CHALLENGE_STATUS],expiresAt:z(e[m.EXPIRES_AT]),createdAt:z(e[m.CREATED_AT])};return e[m.TENANT_ID]&&(n.tenantId=e[m.TENANT_ID]),e[m.PHASE]&&(n.phase=e[m.PHASE]),e[m.ALLOWED_METHODS]&&(n.allowedMethods=e[m.ALLOWED_METHODS]),e[m.METHOD]&&(n.method=e[m.METHOD]),e[m.CODE_HASH]&&(n.codeHash=e[m.CODE_HASH]),e[m.ATTEMPTS]!==void 0&&(n.attempts=e[m.ATTEMPTS]),e[m.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[m.MAX_ATTEMPTS]),e[m.IDENTITY_TYPE]&&(n.identityType=e[m.IDENTITY_TYPE]),e[m.IDENTITY_VALUE]&&(n.identityValue=e[m.IDENTITY_VALUE]),e[m.DEVICE_LABEL]&&(n.deviceLabel=e[m.DEVICE_LABEL]),e[m.COUNTRY]&&(n.country=e[m.COUNTRY]),e[m.CITY]&&(n.city=e[m.CITY]),e[m.METADATA]&&(n.metadata=e[m.METADATA]),e[m.FLOW_KEY]&&(n.flowKey=e[m.FLOW_KEY]),n}};import{BatchGetCommand as rO,DeleteCommand as nO,GetCommand as iO,PutCommand as sO,QueryCommand as Ru,UpdateCommand as oO}from"@aws-sdk/lib-dynamodb";var Fa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return mt()}async get(e){try{let r=await this.docClient.send(new iO({TableName:this.tableName,Key:{[m.PK]:U.CREDENTIAL_PK(e),[m.SK]:U.CREDENTIAL_SK()}}));return r.Item?v(this.unmarshall(r.Item)):v(null)}catch{return u(M.DatabaseQueryError({query:"get credential"}))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new Ru({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${m.CREDENTIAL_USER_PK} = :userPk AND begins_with(${m.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return v(null);let i=n.Items[0];if(!i)return v(null);let s=ce.credentialId(i[m.PK]);return this.get(s)}catch{return u(M.DatabaseQueryError({query:"get credential by user and type"}))}}async getByUserId(e){try{let r=await this.docClient.send(new Ru({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${m.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return v([]);let n=r.Items.map(o=>ce.credentialId(o[m.PK])),i=await this.batchGet(n);if(i.ok===!1)return u(i.errors,i.meta);if(!i.data)return v([]);let s=i.data.filter(o=>o!==null);return v(s)}catch{return u(M.DatabaseQueryError({query:"get credentials by user"}))}}async create(e){try{let r=oe(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new sO({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${m.PK})`})),v(i)}catch(r){return Ce(r)?u(M.UniqueConstraintViolation({field:"credential"})):u(M.DatabaseQueryError({query:"create credential"}))}}async update(e,r){try{let n=oe(),i=[],s={},o={};return i.push(`#${m.UPDATED_AT} = :updatedAt`),s[`#${m.UPDATED_AT}`]=m.UPDATED_AT,o[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${m.CREDENTIAL_VALUE} = :value`),s[`#${m.CREDENTIAL_VALUE}`]=m.CREDENTIAL_VALUE,o[":value"]=r.value),r.data!==void 0&&(i.push(`#${m.METADATA} = :data`),s[`#${m.METADATA}`]=m.METADATA,o[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${m.REVOKED_AT} = :revokedAt`),s[`#${m.REVOKED_AT}`]=m.REVOKED_AT,o[":revokedAt"]=r.revokedAt?te(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${m.LAST_USED_AT} = :lastUsedAt`),s[`#${m.LAST_USED_AT}`]=m.LAST_USED_AT,o[":lastUsedAt"]=r.lastUsedAt?te(r.lastUsedAt):null),await this.docClient.send(new oO({TableName:this.tableName,Key:{[m.PK]:U.CREDENTIAL_PK(e),[m.SK]:U.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${m.PK})`})),v(void 0)}catch(n){return Ce(n)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"update credential"}))}}async remove(e){try{return await this.docClient.send(new nO({TableName:this.tableName,Key:{[m.PK]:U.CREDENTIAL_PK(e),[m.SK]:U.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${m.PK})`})),v(void 0)}catch(r){return Ce(r)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"delete credential"}))}}async hasType(e,r){try{let n=await this.docClient.send(new Ru({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${m.CREDENTIAL_USER_PK} = :userPk AND begins_with(${m.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return v((n.Count||0)>0)}catch{return u(M.DatabaseQueryError({query:"check credential type"}))}}async countByUserId(e){try{let r=await this.docClient.send(new Ru({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${m.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Select:"COUNT"}));return v(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count credentials"}))}}async batchGet(e){if(e.length===0)return v([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let o=(await this.docClient.send(new rO({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[m.PK]:U.CREDENTIAL_PK(c),[m.SK]:U.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of o){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return v(n)}catch{return u(M.DatabaseQueryError({query:"batch get credentials"}))}}marshall(e){let r={[m.PK]:U.CREDENTIAL_PK(e.id),[m.SK]:U.CREDENTIAL_SK(),[m.CREDENTIAL_USER_PK]:U.USER_PK(e.userId),[m.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(e.type,e.id),[m.USER_ID]:e.userId,[m.CREDENTIAL_VALUE]:e.value,[m.METADATA]:e.data,[m.REVOKED_AT]:e.revokedAt?te(e.revokedAt):null,[m.CREATED_AT]:te(e.createdAt),[m.UPDATED_AT]:te(e.updatedAt)};return e.lastUsedAt&&(r[m.LAST_USED_AT]=te(e.lastUsedAt)),r}unmarshall(e){let r=ce.credentialId(e[m.PK]),n=ce.credentialTypeFromUserSK(e[m.CREDENTIAL_USER_SK]);return{id:r,userId:e[m.USER_ID],type:n,value:e[m.CREDENTIAL_VALUE],data:e[m.METADATA]||{},revokedAt:Dt(e[m.REVOKED_AT]),createdAt:z(e[m.CREATED_AT]),updatedAt:z(e[m.UPDATED_AT]),lastUsedAt:Dt(e[m.LAST_USED_AT])}}};import{BatchGetCommand as aO,DeleteCommand as cO,GetCommand as lO,PutCommand as uO,QueryCommand as dO,UpdateCommand as _m}from"@aws-sdk/lib-dynamodb";function Im(t){return{failedAttempts:t.failedAttempts,lastFailedAt:br(t.lastFailedAt),lockedUntil:br(t.lockedUntil)}}function LT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Dt(n.lastFailedAt),lockedUntil:Dt(n.lockedUntil)};return e}function MT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=Im(n));return e}var Va=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new lO({TableName:this.tableName,Key:{[m.PK]:U.IDENTITY_PK(e,r),[m.SK]:U.IDENTITY_SK()}}));if(!n.Item)return v(null);let i=this.unmarshall(n.Item);return v(i)}catch(n){return console.error("[DynamoDB] identities.get error:",n),u(M.DatabaseQueryError({query:"get identity"}))}}async getByUserId(e){try{let r=await this.docClient.send(new dO({TableName:this.tableName,IndexName:Se.USER_IDENTITIES,KeyConditionExpression:`${m.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":U.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let s=this.unmarshall(i);s!==null&&n.push(s)}return v(n)}catch{return u(M.DatabaseQueryError({query:"get identities by userId"}))}}async create(e){try{let r=oe(),n={...e,createdAt:z(r),updatedAt:z(r)};return await this.docClient.send(new uO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),v(n)}catch(r){return Ce(r)?u(M.UniqueConstraintViolation({field:"identity"})):u(M.DatabaseQueryError({query:"create identity"}))}}async update(e,r,n){try{let i=[],s=[],o={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),o["#loginEnabled"]=m.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=br(n.verifiedAt);l===null?(s.push("#verifiedAt"),o["#verifiedAt"]=m.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),o["#verifiedAt"]=m.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),o["#guards"]=m.GUARDS,a[":guards"]=MT(n.guards)),n.pendingVerification!==void 0&&(o["#pendingVerification"]=m.PENDING_VERIFICATION,n.pendingVerification===null?s.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Pt({...n.pendingVerification,expiresAt:te(n.pendingVerification.expiresAt),resendAvailableAt:br(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),o["#updatedAt"]=m.UPDATED_AT,a[":updatedAt"]=oe();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),s.length>0&&c.push(`REMOVE ${s.join(", ")}`),await this.docClient.send(new _m({TableName:this.tableName,Key:{[m.PK]:U.IDENTITY_PK(e,r),[m.SK]:U.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:o,ExpressionAttributeValues:a})),v(void 0)}catch{return u(M.DatabaseQueryError({query:"update identity"}))}}async remove(e,r){try{return await this.docClient.send(new cO({TableName:this.tableName,Key:{[m.PK]:U.IDENTITY_PK(e,r),[m.SK]:U.IDENTITY_SK()}})),v(void 0)}catch{return u(M.DatabaseQueryError({query:"remove identity"}))}}async updateGuard(e,r,n,i){let s={[m.PK]:U.IDENTITY_PK(e,r),[m.SK]:U.IDENTITY_SK()};try{return await this.docClient.send(new _m({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":m.GUARDS,"#guardKey":n,"#updatedAt":m.UPDATED_AT},ExpressionAttributeValues:{":guard":Im(i),":updatedAt":oe()}})),v(void 0)}catch(o){if(Ce(o))try{return await this.docClient.send(new _m({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":m.GUARDS,"#updatedAt":m.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:Im(i)},":updatedAt":oe()}})),v(void 0)}catch{return u(M.DatabaseQueryError({query:"update guard"}))}return u(M.DatabaseQueryError({query:"update guard"}))}}async batchGet(e){try{if(e.length===0)return v([]);let n=(await this.docClient.send(new aO({RequestItems:{[this.tableName]:{Keys:e.map(({type:o,value:a})=>({[m.PK]:U.IDENTITY_PK(o,a),[m.SK]:U.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let o of n){let a=this.unmarshall(o);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let s=e.map(({type:o,value:a})=>{let c=`${o}#${a}`;return i.get(c)||null});return v(s)}catch{return u(M.DatabaseQueryError({query:"batch get identities"}))}}marshall(e){let r={[m.PK]:U.IDENTITY_PK(e.type,e.value),[m.SK]:U.IDENTITY_SK(),[m.IDENTITY_USER_PK]:U.USER_INDEX_PK(e.userId),[m.IDENTITY_USER_SK]:U.USER_INDEX_SK(e.type,e.value),[m.USER_ID]:e.userId,[m.LOGIN_ENABLED]:e.loginEnabled,[m.CREATED_AT]:te(e.createdAt),[m.UPDATED_AT]:te(e.updatedAt)},n=br(e.verifiedAt);return n!==null&&(r[m.VERIFIED_AT]=n),r[m.GUARDS]=MT(e.guards),e.pendingVerification&&(r[m.PENDING_VERIFICATION]=Pt({...e.pendingVerification,expiresAt:te(e.pendingVerification.expiresAt),resendAvailableAt:br(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=ce.identityPKInfo(e[m.PK]);if(!r){let n=e[m.IDENTITY_USER_SK]?ce.userIndexSKInfo(e[m.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[m.USER_ID],loginEnabled:e[m.LOGIN_ENABLED],verifiedAt:Dt(e[m.VERIFIED_AT]),guards:LT(e[m.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[m.PENDING_VERIFICATION]),createdAt:z(e[m.CREATED_AT]),updatedAt:z(e[m.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[m.PK],GSI1SK:e[m.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[m.USER_ID],loginEnabled:e[m.LOGIN_ENABLED],verifiedAt:Dt(e[m.VERIFIED_AT]),guards:LT(e[m.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[m.PENDING_VERIFICATION]),createdAt:z(e[m.CREATED_AT]),updatedAt:z(e[m.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:z(r.expiresAt),resendAvailableAt:Dt(r.resendAvailableAt)}}};import{TransactWriteCommand as pO}from"@aws-sdk/lib-dynamodb";var Ba=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=oe(),n=mt(),i=te(e.challenge.expiresAt),s=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new pO({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,s))]})),v(void 0)}catch(r){return Ka(r)==="TransactionCanceledException"||Ce(r)?u(M.UniqueConstraintViolation({field:"registration"})):u(M.DatabaseQueryError({query:"create email verification registration transaction"}))}}putItem(e){return{Put:{TableName:this.tableName,Item:Pt(e),ConditionExpression:`attribute_not_exists(${m.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[m.PK]:U.USER_PK(e.profile.id),[m.SK]:U.USER_PROFILE_SK(),userStatus:n,[m.CREATED_AT]:r,[m.UPDATED_AT]:r,[m.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[m.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[m.PK]:U.USER_PK(e.userAuth.userId),[m.SK]:U.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[m.CREATED_AT]:r,[m.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[m.PK]:U.IDENTITY_PK(n.type,n.value),[m.SK]:U.IDENTITY_SK(),[m.IDENTITY_USER_PK]:U.USER_INDEX_PK(n.userId),[m.IDENTITY_USER_SK]:U.USER_INDEX_SK(n.type,n.value),[m.USER_ID]:n.userId,[m.LOGIN_ENABLED]:n.loginEnabled,[m.CREATED_AT]:r,[m.UPDATED_AT]:r,[m.PENDING_VERIFICATION]:Pt({...n.pendingVerification,expiresAt:te(n.pendingVerification.expiresAt),resendAvailableAt:br(n.pendingVerification.resendAvailableAt)})},s=br(n.verifiedAt);return s!==null&&(i[m.VERIFIED_AT]=s),i[m.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,s={[m.PK]:U.CREDENTIAL_PK(r),[m.SK]:U.CREDENTIAL_SK(),[m.CREDENTIAL_USER_PK]:U.USER_PK(i.userId),[m.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(i.type,r),[m.USER_ID]:i.userId,[m.CREDENTIAL_VALUE]:i.value,[m.METADATA]:i.data,[m.REVOKED_AT]:i.revokedAt?te(i.revokedAt):null,[m.CREATED_AT]:n,[m.UPDATED_AT]:n};return i.lastUsedAt&&(s[m.LAST_USED_AT]=te(i.lastUsedAt)),s}marshallChallenge(e,r,n){let i=e.challenge,s={[m.PK]:U.CHALLENGE_PK(i.id),[m.SK]:U.CHALLENGE_SK(),[m.USER_ID]:i.userId,[m.PURPOSE]:i.purpose,[m.CHALLENGE_STATUS]:i.status,[m.EXPIRES_AT]:te(i.expiresAt),[m.CREATED_AT]:r,[m.TTL]:n};return i.tenantId&&(s[m.TENANT_ID]=i.tenantId),i.phase&&(s[m.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(s[m.ALLOWED_METHODS]=i.allowedMethods),i.method&&(s[m.METHOD]=i.method),i.codeHash&&(s[m.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(s[m.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(s[m.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(s[m.IDENTITY_TYPE]=i.identityType),i.identityValue&&(s[m.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(s[m.DEVICE_LABEL]=i.deviceLabel),i.country&&(s[m.COUNTRY]=i.country),i.city&&(s[m.CITY]=i.city),i.metadata&&(s[m.METADATA]=i.metadata),i.flowKey&&(s[m.FLOW_KEY]=i.flowKey),s}};import{DynamoDBClient as hO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as EO,GetCommand as FT,PutCommand as yO,QueryCommand as ja,UpdateCommand as no}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as fO}from"@aws-sdk/lib-dynamodb";var KT=100,HT=5;function mO(t){return new Promise(e=>setTimeout(e,t))}async function ro(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=KT){let s=r.slice(i,i+KT),o=0;for(;s.length>0;){let a=await t.send(new fO({RequestItems:{[e]:{Keys:s}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(o+=1,o>HT)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${HT} retries`);s=l,await mO(2**o*25)}}return n}var qa=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new hO({});this.docClient=e.docClient||EO.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return mt()}generateTokenId(){return mt()}async get(e){try{let r=await this.docClient.send(new FT({TableName:this.tableName,Key:{[m.PK]:U.SESSION_PK(e),[m.SK]:U.SESSION_SK()}}));return r.Item?v(this.unmarshall(r.Item)):v(null)}catch{return u(M.DatabaseQueryError({query:"get session"}))}}async create(e){try{let r=oe(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),s={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},o=Ua(te(e.expiresAt)+this.ttlGracePeriod),a=Su.sessionSK(r,n);return await this.docClient.send(new yO({TableName:this.tableName,Item:this.marshall(s,o,a)})),v(s)}catch{return u(M.DatabaseQueryError({query:"create session"}))}}async update(e,r){try{let n=[],i={},s={};if(r.tokenId!==void 0&&(n.push(`#${m.TOKEN_ID} = :tokenId`),i[`#${m.TOKEN_ID}`]=m.TOKEN_ID,s[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${m.EXPIRES_AT} = :expiresAt`),i[`#${m.EXPIRES_AT}`]=m.EXPIRES_AT,s[":expiresAt"]=te(r.expiresAt);let o=Ua(te(r.expiresAt)+this.ttlGracePeriod);n.push(`#${m.TTL} = :ttl`),i[`#${m.TTL}`]=m.TTL,s[":ttl"]=o}return r.lastUsedAt!==void 0&&(n.push(`#${m.LAST_USED_AT} = :lastUsedAt`),i[`#${m.LAST_USED_AT}`]=m.LAST_USED_AT,s[":lastUsedAt"]=te(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${m.METADATA} = :metadata`),i[`#${m.METADATA}`]=m.METADATA,s[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${m.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${m.PREVIOUS_TOKEN_ID}`]=m.PREVIOUS_TOKEN_ID,s[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${m.ROTATED_AT} = :rotatedAt`),i[`#${m.ROTATED_AT}`]=m.ROTATED_AT,s[":rotatedAt"]=r.rotatedAt),n.length===0?v():(await this.docClient.send(new no({TableName:this.tableName,Key:{[m.PK]:U.SESSION_PK(e),[m.SK]:U.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),v())}catch{return u(M.DatabaseQueryError({query:"update session"}))}}async rotateToken(e,r,n){try{let i=Ua(te(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new no({TableName:this.tableName,Key:{[m.PK]:U.SESSION_PK(e),[m.SK]:U.SESSION_SK()},UpdateExpression:`SET #${m.TOKEN_ID} = :tokenId, #${m.PREVIOUS_TOKEN_ID} = :previousTokenId, #${m.ROTATED_AT} = :rotatedAt, #${m.EXPIRES_AT} = :expiresAt, #${m.LAST_USED_AT} = :lastUsedAt, #${m.TTL} = :ttl`,ConditionExpression:`#${m.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${m.TOKEN_ID}`]:m.TOKEN_ID,[`#${m.PREVIOUS_TOKEN_ID}`]:m.PREVIOUS_TOKEN_ID,[`#${m.ROTATED_AT}`]:m.ROTATED_AT,[`#${m.EXPIRES_AT}`]:m.EXPIRES_AT,[`#${m.LAST_USED_AT}`]:m.LAST_USED_AT,[`#${m.TTL}`]:m.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":te(n.expiresAt),":lastUsedAt":te(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),v(!0)}catch(i){return Ce(i)?v(!1):u(M.DatabaseQueryError({query:"rotate session token"}))}}async switchTenant(e,r){try{let n=[`#${m.TENANT_ID} = :tenantId`,`#${m.TOKEN_ID} = :tokenId`,`#${m.LAST_USED_AT} = :lastUsedAt`],i=[],s={[`#${m.TENANT_ID}`]:m.TENANT_ID,[`#${m.TOKEN_ID}`]:m.TOKEN_ID,[`#${m.LAST_USED_AT}`]:m.LAST_USED_AT},o={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":oe()};s[`#${m.TENANT_TYPE}`]=m.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${m.TENANT_TYPE} = :tenantType`),o[":tenantType"]=r.tenantType):i.push(`#${m.TENANT_TYPE}`),s[`#${m.PERM}`]=m.PERM,r.perms!==void 0?(n.push(`#${m.PERM} = :perms`),o[":perms"]=JSON.stringify(r.perms)):i.push(`#${m.PERM}`),s[`#${m.ROLES}`]=m.ROLES,r.roles!==void 0?(n.push(`#${m.ROLES} = :roles`),o[":roles"]=r.roles):i.push(`#${m.ROLES}`),s["#revokedAt"]=m.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new no({TableName:this.tableName,Key:{[m.PK]:U.SESSION_PK(e),[m.SK]:U.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${m.PK}) AND attribute_not_exists(#revokedAt)`})),v()}catch(n){return Ce(n)?u(M.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):u(M.DatabaseQueryError({query:"switch tenant"}))}}async revoke(e){try{return await this.docClient.send(new no({TableName:this.tableName,Key:{[m.PK]:U.SESSION_PK(e),[m.SK]:U.SESSION_SK()},UpdateExpression:`SET #${m.REVOKED_AT} = :revokedAt REMOVE #${m.ACTIVE_SESSION_PK}, #${m.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${m.REVOKED_AT}`]:m.REVOKED_AT,[`#${m.ACTIVE_SESSION_PK}`]:m.ACTIVE_SESSION_PK,[`#${m.ACTIVE_SESSION_SK}`]:m.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":te(new Date)},ConditionExpression:`attribute_exists(${m.PK})`})),v()}catch(r){return Ce(r)?v():u(M.DatabaseQueryError({query:"revoke session"}))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new no({TableName:this.tableName,Key:{[m.PK]:U.SESSION_PK(e),[m.SK]:U.SESSION_SK()},UpdateExpression:`SET #${m.REVOKED_AT} = :revokedAt REMOVE #${m.ACTIVE_SESSION_PK}, #${m.ACTIVE_SESSION_SK}`,ConditionExpression:`#${m.USER_ID} = :userId AND attribute_not_exists(#${m.REVOKED_AT})`,ExpressionAttributeNames:{[`#${m.REVOKED_AT}`]:m.REVOKED_AT,[`#${m.USER_ID}`]:m.USER_ID,[`#${m.ACTIVE_SESSION_PK}`]:m.ACTIVE_SESSION_PK,[`#${m.ACTIVE_SESSION_SK}`]:m.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":te(new Date),":userId":r}})),v()}catch(n){return Ce(n)?v():u(M.DatabaseQueryError({query:"revoke session by user"}))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new ja({TableName:this.tableName,IndexName:Se.USER_SESSIONS,KeyConditionExpression:`${m.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let h={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return v([],{pagination:h})}let a=s.Items.map(h=>ce.sessionId(h[m.PK])).map(h=>({[m.PK]:U.SESSION_PK(h),[m.SK]:U.SESSION_SK()})),l=(await ro(this.docClient,this.tableName,a)).map(h=>this.unmarshall(h)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return v(l,{pagination:f})}catch{return u(M.DatabaseQueryError({query:"find sessions by user"}))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new ja({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${m.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let h={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return v([],{pagination:h})}let a=s.Items.map(h=>ce.sessionId(h[m.PK])).map(h=>({[m.PK]:U.SESSION_PK(h),[m.SK]:U.SESSION_SK()})),l=(await ro(this.docClient,this.tableName,a)).map(h=>this.unmarshall(h)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return v(l,{pagination:f})}catch{return u(M.DatabaseQueryError({query:"find active sessions by user"}))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new ja({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${m.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return v([]);let n=r.Items.map(i=>{let s=ce.sessionId(i[m.PK]),o=Su.extractCreatedAt(i[m.ACTIVE_SESSION_SK]);return{id:s,createdAt:new Date(o)}});return v(n)}catch{return u(M.DatabaseQueryError({query:"get active sessions for limit"}))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=te(new Date),i=await Promise.allSettled(e.map(o=>this.docClient.send(new no({TableName:this.tableName,Key:{[m.PK]:U.SESSION_PK(o),[m.SK]:U.SESSION_SK()},UpdateExpression:`SET #${m.REVOKED_AT} = :revokedAt REMOVE #${m.ACTIVE_SESSION_PK}, #${m.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${m.REVOKED_AT}`]:m.REVOKED_AT,[`#${m.ACTIVE_SESSION_PK}`]:m.ACTIVE_SESSION_PK,[`#${m.ACTIVE_SESSION_SK}`]:m.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),s=0;for(let o of i)o.status==="fulfilled"?s+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:Ka(o.reason)});return s}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new ja({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${m.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return v(0);let i=n.Items.map(o=>ce.sessionId(o[m.PK])).filter(o=>!r||o!==r),s=await this.revokeSessionsByIds(i,"revokeAllByUserId");return v(s)}catch{return u(M.DatabaseQueryError({query:"revoke all sessions by user"}))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return v(r)}catch{return u(M.DatabaseQueryError({query:"revoke batch sessions"}))}}async countByUserId(e){try{let r=await this.docClient.send(new ja({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${m.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return v(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count active sessions by user"}))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new FT({TableName:this.tableName,Key:{[m.PK]:U.SESSION_PK(r),[m.SK]:U.SESSION_SK()},ProjectionExpression:`${m.TOKEN_ID}, ${m.REVOKED_AT}, ${m.EXPIRES_AT}`}));if(!n.Item)return v(!1);let i=n.Item,s=i[m.TOKEN_ID]===e&&!i[m.REVOKED_AT]&&z(i[m.EXPIRES_AT])>new Date;return v(s)}catch{return u(M.DatabaseQueryError({query:"check token active"}))}}marshall(e,r,n){let i={[m.PK]:U.SESSION_PK(e.id),[m.SK]:U.SESSION_SK(),[m.USER_SESSION_PK]:U.USER_PK(e.userId),[m.USER_SESSION_SK]:n,...!e.revokedAt&&{[m.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[m.ACTIVE_SESSION_SK]:n},[m.USER_ID]:e.userId,[m.TOKEN_ID]:e.tokenId,[m.EXPIRES_AT]:te(e.expiresAt),[m.CREATED_AT]:te(e.createdAt),[m.LAST_USED_AT]:te(e.lastUsedAt),[m.TTL]:r};return e.tenantId&&(i[m.TENANT_ID]=e.tenantId),e.tenantType&&(i[m.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[m.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[m.ROLES]=e.roles),e.deviceLabel&&(i[m.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[m.COUNTRY]=e.country),e.city&&(i[m.CITY]=e.city),e.metadata&&(i[m.METADATA]=e.metadata),e.revokedAt&&(i[m.REVOKED_AT]=te(e.revokedAt)),e.previousTokenId&&(i[m.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[m.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:ce.sessionId(e[m.PK]),userId:e[m.USER_ID],tokenId:e[m.TOKEN_ID],expiresAt:z(e[m.EXPIRES_AT]),createdAt:z(e[m.CREATED_AT]),lastUsedAt:z(e[m.LAST_USED_AT]),revokedAt:e[m.REVOKED_AT]?z(e[m.REVOKED_AT]):null};return e[m.TENANT_ID]&&(n.tenantId=e[m.TENANT_ID]),e[m.TENANT_TYPE]&&(n.tenantType=e[m.TENANT_TYPE]),e[m.PERM]!==void 0&&(n.perms=JSON.parse(e[m.PERM])),e[m.ROLES]!==void 0&&(n.roles=e[m.ROLES]),e[m.DEVICE_LABEL]&&(n.deviceLabel=e[m.DEVICE_LABEL]),e[m.COUNTRY]&&(n.country=e[m.COUNTRY]),e[m.CITY]&&(n.city=e[m.CITY]),e[m.METADATA]&&(n.metadata=e[m.METADATA]),e[m.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[m.PREVIOUS_TOKEN_ID]),e[m.ROTATED_AT]!==void 0&&(n.rotatedAt=e[m.ROTATED_AT]),n}};import{QueryCommand as gO}from"@aws-sdk/lib-dynamodb";var Ga=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":m.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=m.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new gO(o)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch(n){return console.error("[DynamoDBTenantInviteQuery.listByTenant] Error:",n instanceof Error?n.message:n),u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e){let r=ce.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(i.declinedAt=z(e.declinedAt)),e.revokedAt&&(i.revokedAt=z(e.revokedAt)),i}};import{GetCommand as VT,PutCommand as vO,QueryCommand as Qn,UpdateCommand as AO}from"@aws-sdk/lib-dynamodb";var TO=10080*60*1e3,$a=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:ce.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[m.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(n.declinedAt=z(e.declinedAt)),e.revokedAt&&(n.revokedAt=z(e.revokedAt)),n}generateInviteId(){return mt()}async getById(e){try{let r=await this.docClient.send(new VT({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()}}));return r.Item?v(this.mapItemToEntity(r.Item)):v(null)}catch{return u(M.DatabaseQueryError({query:"getById invite"}))}}async getByToken(e){try{let n=(await this.docClient.send(new Qn({TableName:this.tableName,IndexName:Se.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":m.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return v(null);let i=n[0],s=await this.docClient.send(new VT({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return s.Item?v(this.mapItemToEntity(s.Item)):v(null)}catch{return u(M.DatabaseQueryError({query:"getByToken invite"}))}}async create(e){try{let r=oe(),n=te(e.expiresAt),i=Math.floor((n+TO)/1e3),s={PK:U.INVITE_PK(e.id),SK:U.INVITE_SK(),[m.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[m.INVITED_BY_ID]:e.invitedById,[m.INVITE_STATUS]:e.status,[m.INVITE_TOKEN]:e.inviteToken,[m.EXPIRES_AT]:n,[m.CREATED_AT]:r,[m.UPDATED_AT]:r,[m.TTL]:i,[m.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[m.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[m.INVITE_TOKEN_GSI]:e.inviteToken},o={};e.invitedByName&&(o.name=e.invitedByName),e.invitedByEmail&&(o.email=e.invitedByEmail),e.invitedByJobTitle&&(o.jobTitle=e.invitedByJobTitle),Object.keys(o).length>0&&(s[m.INVITED_BY_INFO]=o),e.inviteeUserId&&(s[m.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(s[m.INVITEE_EMAIL]=e.inviteeEmail,s[m.INVITEE_EMAIL_GSI]=e.inviteeEmail,s[m.INVITEE_EMAIL_TENANT_SK]=`${ae.TENANT}${e.tenantId}`),e.inviteePhone&&(s[m.INVITEE_PHONE]=e.inviteePhone,s[m.INVITEE_PHONE_GSI]=e.inviteePhone,s[m.INVITEE_PHONE_TENANT_SK]=`${ae.TENANT}${e.tenantId}`),e.roles!==void 0&&(s[m.ROLES]=e.roles),e.perms!==void 0&&(s[m.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(s[m.AUTH_PERM]=e.authPerm),e.displayName&&(s[m.DISPLAY_NAME]=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.jobTitle&&(s.jobTitle=e.jobTitle),await this.docClient.send(new vO({TableName:this.tableName,Item:s,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:z(r),updatedAt:z(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),v(a)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"invite id"})):u(M.UnknownError({message:r.message}))}}async updateStatus(e,r){try{let n=oe(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],s={"#inviteStatus":m.INVITE_STATUS,"#inviteTenantSk":m.INVITE_TENANT_SK,"#updatedAt":m.UPDATED_AT},o={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),s["#acceptedAt"]=m.ACCEPTED_AT,o[":acceptedAt"]=te(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),s["#declinedAt"]=m.DECLINED_AT,o[":declinedAt"]=te(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),s["#revokedAt"]=m.REVOKED_AT,o[":revokedAt"]=te(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),s["#inviteTokenGsi"]=m.INVITE_TOKEN_GSI,s["#inviteeEmailGsi"]=m.INVITEE_EMAIL_GSI,s["#inviteeEmailTenantSk"]=m.INVITEE_EMAIL_TENANT_SK,s["#inviteePhoneGsi"]=m.INVITEE_PHONE_GSI,s["#inviteePhoneTenantSk"]=m.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new AO({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),v(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantInvite",id:e})):u(M.UnknownError({message:n.message}))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new Qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":m.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":m.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ae.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?v(null):v(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndEmail"}))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new Qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":m.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":m.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ae.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?v(null):v(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndPhone"}))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new Qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":m.INVITE_TENANT_PK,"#sk":m.INVITE_TENANT_SK,"#inviteeUserId":m.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?v(null):v(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndUserId"}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":m.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=m.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new Qn(o)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant"}))}}async findPendingByEmail(e){try{let r=oe(),i=(await this.docClient.send(new Qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":m.INVITEE_EMAIL_GSI,"#expiresAt":m.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return v([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await ro(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return v(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByEmail"}))}}async findPendingByPhone(e){try{let r=oe(),i=(await this.docClient.send(new Qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":m.INVITEE_PHONE_GSI,"#expiresAt":m.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return v([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await ro(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return v(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByPhone"}))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new Qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":m.INVITE_TENANT_PK,"#sk":m.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return v(r.Count??0)}catch{return u(M.DatabaseQueryError({query:"countPendingByTenant"}))}}async expireOld(e){return v(0)}};import{QueryCommand as _O}from"@aws-sdk/lib-dynamodb";var Wa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=(await this.docClient.send(new _O(i))).Items||[],a=[],c=new Map;for(let h of o){let g=h.SK;if(g.startsWith(Ve.TENANT_PROFILE)){let _=ce.tenantProfileUserId(g);c.set(_,h)}else g.startsWith(ae.USER)&&a.push(h)}a.sort((h,g)=>g.createdAt-h.createdAt);let l=a.slice(0,n),d=a.length>n,p=l.map(h=>{let g=ce.tenantMemberUserId(h.SK),_=c.get(g);return this.toListItem(h,e,g,_)}),f=d&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:d,cursor:f,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e,r,n,i){let s={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};if(e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm),i){let o={tenantId:r,userId:n,createdAt:z(i.createdAt),updatedAt:z(i.updatedAt)};i.contactEmail&&(o.contactEmail=i.contactEmail),i.contactPhone&&(o.contactPhone=i.contactPhone),i.displayName&&(o.displayName=i.displayName),i.displayNameSource&&(o.displayNameSource=i.displayNameSource),i.givenName&&(o.givenName=i.givenName),i.familyName&&(o.familyName=i.familyName),i.avatarUrl&&(o.avatarUrl=i.avatarUrl),i.locale&&(o.locale=i.locale),i.jobTitle&&(o.jobTitle=i.jobTitle),i.bio&&(o.bio=i.bio),i.metadata&&(o.metadata=JSON.parse(i.metadata)),s.tenantProfile=o}return s}};import{DeleteCommand as IO,DynamoDBDocumentClient as xO,GetCommand as BT,PutCommand as bO,QueryCommand as SO,TransactWriteCommand as wO,UpdateCommand as jT}from"@aws-sdk/lib-dynamodb";var za=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=xO.from(e)}mapItemToEntity(e){let r=ce.tenantId(e.PK),n=ce.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new BT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)}}));if(!n.Item)return v(null);let i=this.mapItemToEntity(n.Item);return v(i)}catch{return u(M.DatabaseQueryError({query:"get"}))}}async create(e){try{let r=oe(),n=e.isOwner?void 0:e.authPerm,i=Pt({PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new wO({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new bO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),v(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?u(M.UniqueConstraintViolation({field:"tenant owner"})):u(M.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant member"})):u(M.UnknownError({message:r.message}))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:oe()},{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=Sr(i);return await this.docClient.send(new jT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),v(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async updateStatus(e,r,n){try{return await this.docClient.send(new jT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":oe()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),v(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e),":skPrefix":ae.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=await this.docClient.send(new SO(i)),o=(s.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!s.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return mr(o,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch(n){let i=n instanceof Error?`${n.name}: ${n.message}`:String(n);return console.error("[DynamoDBTenantMemberRepository.listByTenant] Error:",i),u(M.DatabaseQueryError({query:`listByTenant \u2014 ${i}`}))}}async hasOwner(e){try{let r=await this.docClient.send(new BT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_OWNER_MARKER_SK()}}));return v(!!r.Item)}catch{return u(M.DatabaseQueryError({query:"hasOwner"}))}}async remove(e,r){try{return await this.docClient.send(new IO({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),v(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};import{BatchGetCommand as NO,QueryCommand as RO}from"@aws-sdk/lib-dynamodb";var Ja=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??zt.DEFAULT,s=r?.parentTenantId,o=s?`${i}#${s}#`:`${i}#`,a={TableName:this.tableName,IndexName:Se.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":o},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new RO(a)),l=c.Items??[],d=await this.fetchProfileMap(e,l),p=l.map(g=>this.toListItem(g,e,d)),f=!!c.LastEvaluatedKey,h=f?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:f,cursor:h,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByUser query"}))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(o=>({PK:U.TENANT_PROFILE_PK(ce.tenantId(o.PK)),SK:U.TENANT_PROFILE_SK(e)})),s=await this.docClient.send(new NO({RequestItems:{[this.tableName]:{Keys:i}}}));for(let o of s.Responses?.[this.tableName]??[]){let a=o,c=ce.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=ce.tenantId(e.PK),s={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm);let o=n.get(i);return o&&(o.contactEmail&&(s.contactEmail=o.contactEmail),o.contactPhone&&(s.contactPhone=o.contactPhone),o.displayName&&(s.displayName=o.displayName),o.displayNameSource&&(s.displayNameSource=o.displayNameSource),o.givenName&&(s.givenName=o.givenName),o.familyName&&(s.familyName=o.familyName),o.avatarUrl&&(s.avatarUrl=o.avatarUrl),o.locale&&(s.locale=o.locale),o.jobTitle&&(s.jobTitle=o.jobTitle),o.bio&&(s.bio=o.bio),o.metadata&&(s.metadata=JSON.parse(o.metadata))),s}};import{DeleteCommand as OO,GetCommand as kO,PutCommand as CO,UpdateCommand as DO}from"@aws-sdk/lib-dynamodb";var Ya=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return mt()}toEntity(e){let n={id:ce.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new kO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()}}));return r.Item?v(this.toEntity(r.Item)):v(null)}catch{return u(M.DatabaseQueryError({query:"get tenant"}))}}async create(e){try{let r=e.id??this.generateTenantId(),n=oe(),i=Pt({PK:U.TENANT_PK(r),SK:U.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new CO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),v(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant"})):u(M.UnknownError({message:r.message}))}}async update(e,r){try{let n={updatedAt:oe()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o}=Sr(n);return await this.docClient.send(new DO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),v(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:n.message}))}}async delete(e){try{return await this.docClient.send(new OO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),v(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:r.message}))}}async list(){return u(M.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return u(M.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return u(M.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as PO,GetCommand as UO,PutCommand as LO,UpdateCommand as Ou}from"@aws-sdk/lib-dynamodb";var Xa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new UO({TableName:this.tableName,Key:{[m.PK]:U.USER_PK(e),[m.SK]:U.USER_AUTH_SK()}}));return r.Item?v(this.unmarshall(r.Item,e)):v(null)}catch{return u(M.DatabaseQueryError({query:"get user auth"}))}}async create(e){try{let r=oe(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new LO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${m.PK})`})),v(n)}catch(r){return Ce(r)?u(M.UniqueConstraintViolation({field:"userAuth"})):u(M.DatabaseQueryError({query:"create user auth"}))}}async updateStatus(e,r){try{let n=oe();return await this.docClient.send(new Ou({TableName:this.tableName,Key:{[m.PK]:U.USER_PK(e),[m.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${m.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${m.UPDATED_AT}`]:m.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${m.PK})`})),v(void 0)}catch(n){return Ce(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update user auth status"}))}}async updateMfaRequired(e,r){try{let n=oe();return await this.docClient.send(new Ou({TableName:this.tableName,Key:{[m.PK]:U.USER_PK(e),[m.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${m.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${m.UPDATED_AT}`]:m.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${m.PK})`})),v(void 0)}catch(n){return Ce(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa required"}))}}async updateMfaMethods(e,r){try{let n=oe();return await this.docClient.send(new Ou({TableName:this.tableName,Key:{[m.PK]:U.USER_PK(e),[m.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${m.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${m.UPDATED_AT}`]:m.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${m.PK})`})),v(void 0)}catch(n){return Ce(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa methods"}))}}async updateMfaSettings(e,r){try{let n=oe();return await this.docClient.send(new Ou({TableName:this.tableName,Key:{[m.PK]:U.USER_PK(e),[m.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${m.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${m.UPDATED_AT}`]:m.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${m.PK})`})),v(void 0)}catch(n){return Ce(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa settings"}))}}async remove(e){try{return await this.docClient.send(new PO({TableName:this.tableName,Key:{[m.PK]:U.USER_PK(e),[m.SK]:U.USER_AUTH_SK()}})),v(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user auth"}))}}marshall(e){return{[m.PK]:U.USER_PK(e.userId),[m.SK]:U.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[m.CREATED_AT]:te(e.createdAt),[m.UPDATED_AT]:te(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:z(e[m.CREATED_AT]),updatedAt:z(e[m.UPDATED_AT])}}};import{DynamoDBDocumentClient as MO,DeleteCommand as KO,GetCommand as HO,PutCommand as FO,QueryCommand as qT,UpdateCommand as xm}from"@aws-sdk/lib-dynamodb";function io(t,e){return e?U.USER_MFA_WITH_ID_SK(t,e):U.USER_MFA_SK(t)}var Qa=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=MO.from(e)}toDynamoDBItem(e){let r={PK:U.USER_PK(e.userId),SK:io(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=ce.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:z(e.createdAt),verifiedAt:Dt(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Dt(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Dt(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Dt(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=io(r,n),s=await this.docClient.send(new HO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}}));return s.Item?v(this.fromDynamoDBItem(s.Item,e)):v(null)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.get error:",i),u(M.DatabaseQueryError({query:"get MFA authenticator"}))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":Ve.MFA}},s=((await this.docClient.send(new qT(r))).Items??[]).map(o=>this.fromDynamoDBItem(o,e));return v(s)}catch(r){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserId error:",r),u(M.DatabaseQueryError({query:"find MFA authenticators by user"}))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":`${Ve.MFA}${r}`}},o=((await this.docClient.send(new qT(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return v(o)}catch(n){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserIdAndMethod error:",n),u(M.DatabaseQueryError({query:"find MFA authenticators by method"}))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=mt());let n=this.toDynamoDBItem(r);return await this.docClient.send(new FO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),v(this.fromDynamoDBItem(n,e.userId))}catch(r){return Ce(r)?u(M.UniqueConstraintViolation({field:"MFA authenticator"})):(console.error("DynamoDBUserMFAAuthenticatorRepository.create error:",r),u(M.DatabaseQueryError({query:"create MFA authenticator"})))}}async update(e,r,n,i){try{let s=io(r,n),o=[],a={},c={};if(i.label!==void 0&&(o.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(o.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(o.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(o.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(o.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(o.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(o.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(o.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),o.length===0)return v(void 0);let l={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:s},UpdateExpression:`SET ${o.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new xm(l)),v(void 0)}catch(s){return console.error("DynamoDBUserMFAAuthenticatorRepository.update error:",s),u(M.DatabaseQueryError({query:"update MFA authenticator"}))}}async remove(e,r,n){try{let i=io(r,n);return await this.docClient.send(new KO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}})),v(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.remove error:",i),u(M.DatabaseQueryError({query:"remove MFA authenticator"}))}}async incrementFailedAttempts(e,r,n,i,s){try{let o=io(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},d={":zero":0,":inc":1,":lastFailedAt":a};s!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",d[":lockedUntil"]=a+s*60*1e3,d[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:o},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:d};return await this.docClient.send(new xm(p)),v(void 0)}catch(o){return console.error("DynamoDBUserMFAAuthenticatorRepository.incrementFailedAttempts error:",o),u(M.DatabaseQueryError({query:"increment failed attempts"}))}}async resetFailedAttempts(e,r,n){try{let i=io(r,n),s={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new xm(s)),v(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.resetFailedAttempts error:",i),u(M.DatabaseQueryError({query:"reset failed attempts"}))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as VO,DynamoDBDocumentClient as BO,GetCommand as jO,PutCommand as qO,QueryCommand as GT,UpdateCommand as $T}from"@aws-sdk/lib-dynamodb";var Za=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=BO.from(e)}generateUserId(){return mt()}async getById(e){try{let r=await this.docClient.send(new jO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}}));if(!r.Item)return v(null);let n=r.Item;if(n.deletedAt)return v(null);let s={id:ce.userId(n.PK),status:n.userStatus,createdAt:z(n.createdAt),updatedAt:z(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:z(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return v(s)}catch{return u(M.DatabaseQueryError({query:"getById user"}))}}async create(e){try{let r=oe(),n=e.id||this.generateUserId(),i=e.status||"pending",s={PK:U.USER_PK(n),SK:U.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(s.contactEmail=e.contactEmail),e.contactPhone&&(s.contactPhone=e.contactPhone),e.username&&(s.username=e.username),e.displayName&&(s.displayName=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.avatarUrl&&(s.avatarUrl=e.avatarUrl),e.locale&&(s.locale=e.locale),e.metadata&&(s.metadata=JSON.stringify(e.metadata)),s[m.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),s[m.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new qO({TableName:this.tableName,Item:Pt(s),ConditionExpression:mm("PK")}));let o={id:n,status:i,createdAt:z(r),updatedAt:z(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return v(o)}catch{return u(M.DatabaseQueryError({query:"create user"}))}}async updateProfile(e,r){try{let n=oe(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return v(void 0);i.updatedAt=n;let s=Sr(i);return await this.docClient.send(new $T({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:s.UpdateExpression,ExpressionAttributeNames:s.ExpressionAttributeNames,ExpressionAttributeValues:s.ExpressionAttributeValues})),v(void 0)}catch{return u(M.DatabaseQueryError({query:"updateProfile"}))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=Ae.USER_STATUS_PK(e),o=await this.docClient.send(new GT({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${m.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":s},Limit:n,ExclusiveStartKey:i})),a=[];if(o.Items&&o.Items.length>0)for(let d of o.Items){let p=ce.userId(d.PK);a.push(p)}let c=!!o.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return v(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch{return u(M.DatabaseQueryError({query:"get users by status"}))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new GT({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${m.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return v(n.Count||0)}catch{return u(M.DatabaseQueryError({query:"count users by status"}))}}async syncAuthStatus(e,r){try{let n=oe(),i=`SET userStatus = :userStatus, #${m.UPDATED_AT} = :updatedAt, #${m.USER_STATUS_PK} = :statusPk, #${m.USER_STATUS_SK} = :statusSk`,s={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",s[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new $T({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${m.UPDATED_AT}`]:m.UPDATED_AT,[`#${m.USER_STATUS_PK}`]:m.USER_STATUS_PK,[`#${m.USER_STATUS_SK}`]:m.USER_STATUS_SK},ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),v(void 0)}catch(n){return Ce(n)?u(M.NotFound({entity:"userProfile",id:e})):u(M.DatabaseQueryError({query:"sync auth status"}))}}async remove(e){try{return await this.docClient.send(new VO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}})),v(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user profile"}))}}};import{DeleteCommand as GO,DynamoDBDocumentClient as $O,GetCommand as WO,PutCommand as zO,QueryCommand as JO,UpdateCommand as YO}from"@aws-sdk/lib-dynamodb";var ec=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=$O.from(e)}mapItemToUserProviderLink(e){let r=ce.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:z(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=oe(),n={PK:U.PROVIDER_PK(e.provider,e.externalId),SK:U.PROVIDER_METADATA_SK(),userProviderPk:U.USER_PK(e.userId),userProviderSk:U.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?te(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Pt(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new WO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}}));return n.Item?v(this.mapItemToUserProviderLink(n.Item)):v(null)}catch{return u(M.DatabaseQueryError({query:"find provider by external id"}))}}async findByUserId(e){try{let r=await this.docClient.send(new JO({TableName:this.tableName,IndexName:Se.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":m.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":U.USER_PK(e)}}));return!r.Items||r.Items.length===0?v([]):v(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch{return u(M.DatabaseQueryError({query:"find providers by user id"}))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new zO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),v(this.mapItemToUserProviderLink(n))}catch(r){return Ce(r)?u(M.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):u(M.DatabaseQueryError({query:"create user provider"}))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return v(void 0);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=Sr(i);return await this.docClient.send(new YO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a})),v(void 0)}catch{return u(M.DatabaseQueryError({query:"update user provider"}))}}async remove(e,r){try{return await this.docClient.send(new GO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}})),v(void 0)}catch{return u(M.DatabaseQueryError({query:"delete user provider"}))}}};import{DeleteCommand as XO,GetCommand as QO,PutCommand as ZO,UpdateCommand as ek}from"@aws-sdk/lib-dynamodb";var tc=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=ce.tenantId(e.PK),n=ce.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new QO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)}}));return n.Item?v(this.mapItemToEntity(n.Item)):v(null)}catch{return u(M.DatabaseQueryError({query:"get user tenant profile"}))}}async create(e){try{let r=oe(),n={PK:U.TENANT_PROFILE_PK(e.tenantId),SK:U.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new ZO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:z(r),updatedAt:z(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),v(i)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"user tenant profile"})):u(M.UnknownError({message:r.message}))}}async update(e,r,n){try{let i={updatedAt:oe()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=Sr(i);return await this.docClient.send(new ek({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),v(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async remove(e,r){try{return await this.docClient.send(new XO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),v(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};var bm=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new rk(e.clientConfig||{});let r=nk.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Za(this.client,this.tableName),this.sessions=new qa({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new ec(this.client,this.tableName),this.userMfaAuthenticators=new Qa(this.client,this.tableName),this.challenges=new Ha({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new Va({docClient:r,tableName:this.tableName}),this.credentials=new Fa({docClient:r,tableName:this.tableName}),this.registration=new Ba({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Xa({docClient:r,tableName:this.tableName}),this.tenantMembers=new za(this.client,this.tableName),this.tenantInvites=new $a({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new tc(r,this.tableName),this.tenants=new Ya({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new Ga({docClient:r,tableName:this.tableName}),tenantMembers:new Wa({docClient:r,tableName:this.tableName}),tenants:new Ja({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new tk({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function WT(t){return new bm(t)}Do();var Sm=1,zT=2,JT=3,YT="auth-craft:internal";async function ik(t){let e=t.replace(/^0x/,""),r=QT(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let s=`-----BEGIN PRIVATE KEY-----
+    `}};var oc=class t{static createDirectSmtp(e){return new cd(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var f0={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function sT(t={}){let e={...f0,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let o=e.requireTLD?"[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${o}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return d([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return d([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return d([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return d([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let o=i.split("@");if(o.length!==2)return d([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[s,a]=o;return!s||s.length>64?d([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?d([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):T()}}}function Lm(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function m0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Mm(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return m0(r)}var Km="email",ld={EMAIL_SYSTEM_NOT_AVAILABLE:_("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:_("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:_("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:_("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function h0(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function aT(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:Km,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return d(ld.EMAIL_SYSTEM_NOT_AVAILABLE());let o=await i.plugins.database.users.getById(n.userId),s=o.ok&&o.data?o.data.contactEmail:void 0;if(!s)return d(ld.RECIPIENT_NOT_FOUND());let a=Lm(e),c=await Mm(a);return(await i.plugins.emailSystem.send({to:s,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?d(ld.SEND_FAILED()):T({codeHash:c,maskedRecipient:h0(s)})},async issueChallenge(n){return T({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(Km)?[Km]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return d(ld.USE_CHALLENGE_CODE_HASH())}}}var cT="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function ud(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let o="";for(let s of i)o+=cT[s%cT.length];r.push(o)}return r}function E0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function dd(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return E0(r)}function y0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function Hm(t,e){let r=await dd(t),n=null;for(let i of e)y0(r,i)&&(n=i);return n}var Fm="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function lT(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let o of e){let s=Fm.indexOf(o);if(s===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|s,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function uT(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=Fm[r>>>e&31];return e>0&&(n+=Fm[r<<5-e&31]),n}function pd(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),uT(e)}function g0(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function v0(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,g0(e))),o=i[i.length-1]&15;return(((i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255)%10**r).toString().padStart(r,"0")}async function fd(t,e,r=Date.now(),n={}){let i=n.period??30,o=n.digits??6,s=n.window??1,a=e.trim();if(a.length!==o||!/^\d+$/u.test(a))return!1;let c=lT(t),l=Math.floor(r/1e3/i),u=!1;for(let p=-s;p<=s;p++){let f=await v0(c,l+p,o);A0(f,a)&&(u=!0)}return u}function A0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function dT(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var Vm="totp",T0={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function pT(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:Vm,requiresServerDelivery:!1,generateSecret(){return pd()},generateBackupCodes(i){return ud(i||r)},async issueChallenge(i){return T({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(Vm)?[Vm]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return d(T0.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let o=pd(),s=ud(r),a=await Promise.all(s.map(p=>dd(p))),c=i.data.accountName??i.userId,l=dT({secretBase32:o,accountName:c,issuer:e});return T({secret:o,otpauthUri:l,backupCodes:s,credentialData:{secret:o,backupCodeHashes:a}})},async verifyWithCredentials(i){let o=i.credentialData,s=i.data.code?.trim();if(!s||!o?.secret)return T({verified:!1,data:{}});if(await fd(o.secret,s,Date.now(),{window:n}))return T({verified:!0,data:{}});let c=o.backupCodeHashes??[];if(c.length>0){let l=await Hm(s,c);if(l)return T({verified:!0,data:{usedBackupCodeHash:l}})}return T({verified:!1,data:{}})},async verifyCredential(i,o){let s=i.data.code,a=i.data.secret;if(!s||!a)return T({verified:!1,data:{}});let c=await fd(a,s,Date.now(),{window:n});return T({verified:c,data:{}})}}}var Bm={scopes:["email","public_profile"],apiVersion:"v18.0"};var Zr={INVALID_CODE:_("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:_("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:_("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:_("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:_("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function jm(t={}){let{scopes:e=Bm.scopes,apiVersion:r=Bm.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,o){let s=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...o&&{state:o}});return`${n.AUTHORIZATION}?${s.toString()}`},async exchangeCodeForToken(i,o){try{if(!i)return d(Zr.INVALID_CODE());let s=new URLSearchParams({client_id:o.clientId,client_secret:o.clientSecret,code:i,redirect_uri:o.redirectUri}),a=await fetch(`${n.TOKEN}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return d(Zr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return T({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(s){return console.error("Facebook token exchange error:",s),d(Zr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return d(Zr.INVALID_TOKEN());let o=["id","email","name","first_name","last_name","picture","locale"],s=new URLSearchParams({fields:o.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return d(Zr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return T(l)}catch(o){return console.error("Facebook user profile error:",o),d(Zr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return d(Zr.INVALID_TOKEN());let o=`${t.appId}|${t.appSecret}`,s=new URLSearchParams({input_token:i,access_token:o}),a=await fetch(`${n.DEBUG_TOKEN}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):d(Zr.INVALID_TOKEN()):d(Zr.INVALID_TOKEN())}catch(o){return console.error("Facebook token verification error:",o),d(Zr.INVALID_TOKEN())}}}}var md={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},Ji={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var tt={INVALID_CODE:_("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:_("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:_("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:_("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:_("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:_("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:_("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:_("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function _0(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function I0(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=_0(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function Gm(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=md.scopes,accessType:o=md.accessType,includeGrantedScopes:s=md.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let u=c?.clientId??e,p=c?.redirectUri??n;if(!u||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let f=new URLSearchParams({client_id:u,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:o,...l&&{state:l},...a&&{prompt:a},...s&&{include_granted_scopes:"true"}});return`${Ji.AUTHORIZATION}?${f.toString()}`},async exchangeCodeForToken(c,l){let u=l?.clientId??e,p=l?.clientSecret??r,f=l?.redirectUri??n;try{if(!c)return d(tt.INVALID_CODE());if(!u||!p||!f)return d(tt.MISSING_CONFIG());let m=new URLSearchParams({client_id:u,client_secret:p,code:c,redirect_uri:f,grant_type:"authorization_code"}),E=await fetch(Ji.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:m.toString()});if(!E.ok)return console.error("Google token exchange failed with status:",E.status),d(tt.TOKEN_EXCHANGE_FAILED());let v=await E.json();return T({accessToken:v.access_token,...v.refresh_token&&{refreshToken:v.refresh_token},...v.expires_in&&{expiresIn:v.expires_in}})}catch(m){return console.error("Google token exchange error:",m),d(tt.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return d(tt.INVALID_TOKEN());let l=await fetch(Ji.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),d(tt.USER_PROFILE_FAILED());let u=await l.json(),p={id:u.id,...u.email&&{email:u.email},...u.verified_email!==void 0&&{emailVerified:u.verified_email},...u.name&&{name:u.name},...u.given_name&&{givenName:u.given_name},...u.family_name&&{familyName:u.family_name},...u.picture&&{avatarUrl:u.picture},...u.locale&&{locale:u.locale},provider:"google"};return T(p)}catch(l){return console.error("Google user profile error:",l),d(tt.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return d(tt.INVALID_TOKEN());let l=await fetch(`${Ji.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return d(tt.INVALID_TOKEN());let u=await l.json();return parseInt(u.expires_in,10)<=0?d(tt.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),d(tt.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return d(tt.INVALID_CREDENTIAL());let l=await fetch(`${Ji.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),d(tt.INVALID_CREDENTIAL());let u=await l.json();if(!e)return d(tt.MISSING_CONFIG());if(u.aud!==e)return d(tt.INVALID_CREDENTIAL());if(parseInt(u.expires_in,10)<=0)return d(tt.INVALID_CREDENTIAL());let f=u.email_verified==="true",m=I0(c),E={id:u.sub,...u.email&&{email:u.email},...u.email&&{emailVerified:f},...m?.name&&{name:m.name},...m?.given_name&&{givenName:m.given_name},...m?.family_name&&{familyName:m.family_name},...m?.picture&&{avatarUrl:m.picture},...m?.locale&&{locale:m.locale},provider:"google"};return T(E)}catch(l){return console.error("Google credential verification error:",l),d(tt.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let u=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return d(tt.INVALID_TOKEN());if(!u||!p)return d(tt.MISSING_CONFIG());let f=new URLSearchParams({client_id:u,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),m=await fetch(Ji.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!m.ok)return console.error("Google refresh token failed with status:",m.status),d(tt.REFRESH_TOKEN_FAILED());let E=await m.json();return T({accessToken:E.access_token,...E.expires_in&&{expiresIn:E.expires_in}})}catch(f){return console.error("Google refresh token error:",f),d(tt.REFRESH_TOKEN_FAILED())}}}}function fT(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function o(){if(n===0)return;let s=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(u=>u>s);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(o,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(s,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let u=Date.now(),p=u-l,f=e.get(s)??{hits:[]},m=f.hits.filter(E=>E>p);if(m.length>=c){let E=m[0]??u,v=Math.max(0,E+l-u);return f.hits=m,e.set(s,f),{allowed:!1,remaining:0,retryAfterMs:v,limit:c}}return m.push(u),f.hits=m,e.set(s,f),{allowed:!0,remaining:c-m.length,retryAfterMs:0,limit:c}},async reset(s){e.delete(s)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as XO,DynamoDBClient as QO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as ZO}from"@aws-sdk/lib-dynamodb";var te={DatabaseConnectionError:_("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:Q("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:Q("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:Q("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:Q("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:_("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:_("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:Q("INVALID_DATA","Invalid data: {reason}"),Timeout:_("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:_("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:Q("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:Q("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function re(t){return t.getTime()}function J(t){return new Date(t)}function mT(t){return Math.floor(t/1e3)}function ae(){return Date.now()}function sc(t){return t instanceof Date?mT(t.getTime()):mT(t)}function $m(t){return t<Date.now()}function Cr(t){return t?re(t):null}function Kt(t){return t==null?null:J(t)}function Ht(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function Dr(t){let e=[],r=[],n={},i={},o=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let u=`#${c}`;if(n[u]=c,l==null)r.push(u);else{let p=`:val${o}`;e.push(`${u} = ${p}`),i[p]=l,o++}}let s=[];return e.length>0&&s.push(`SET ${e.join(", ")}`),r.length>0&&s.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:s.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function qm(t="PK"){return`attribute_not_exists(${t})`}var Wm={USER:"USR"},ce={USER:`${Wm.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Be={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},Tt="#",U={USER_PK:t=>`${ce.USER}${t}`,USER_AUTH_SK:()=>Be.AUTH,USER_PROFILE_SK:()=>Be.PROFILE,USER_MFA_SK:t=>`${Be.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Be.MFA}${t}${Tt}${e}`,TENANT_MEMBER_PK:t=>`${ce.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ce.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Be.OWNER,TENANT_PK:t=>`${ce.TENANT}${t}`,TENANT_SK:()=>Be.METADATA,INVITE_PK:t=>`${ce.INVITE}${t}`,INVITE_SK:()=>Be.METADATA,TENANT_PROFILE_PK:t=>`${ce.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Be.TENANT_PROFILE}${ce.USER}${t}`,SESSION_PK:t=>`${ce.SESSION}${t}`,SESSION_METADATA_SK:()=>Be.METADATA,SESSION_SK:()=>Be.METADATA,PROVIDER_SK:(t,e)=>`${Be.PROVIDER}${t}${Tt}${e}`,PROVIDER_PK:(t,e)=>`${ce.PROVIDER}${t}${Tt}${e}`,PROVIDER_METADATA_SK:()=>Be.METADATA,CHALLENGE_PK:t=>`${ce.CHALLENGE}${t}`,CHALLENGE_SK:()=>Be.METADATA,IDENTITY_PK:(t,e)=>`${ce.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Be.METADATA,CREDENTIAL_PK:t=>`${ce.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Be.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ce.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ce.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ce.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ce.IDENTITY}${t}#${e}`},le={userId:t=>t.slice(ce.USER.length),sessionId:t=>t.slice(ce.SESSION.length),providerPKInfo:t=>{let e=t.slice(ce.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Be.PROVIDER.length),r=e.indexOf(Tt);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Be.MFA.length),r=e.indexOf(Tt);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ce.TENANT.length),tenantMemberUserId:t=>t.slice(ce.USER.length),challengeIdFromPK:t=>t.slice(ce.CHALLENGE.length),inviteId:t=>t.slice(ce.INVITE.length),tenantProfileUserId:t=>t.slice(Be.TENANT_PROFILE.length+ce.USER.length),identityPKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ce.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ce.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ce.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${Tt}${e}`,USER_SESSION_PK:t=>`${ce.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${Tt}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${Wm.USER}${Tt}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ce.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Be.PROVIDER}${t}${Tt}${e}`,INVITE_TENANT_PK:t=>`${ce.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${Tt}${e}${Tt}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${Tt}`,USER_TENANT_PK:t=>`${ce.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${Tt}${e??"ROOT"}${Tt}${r}${Tt}${n}`},h={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},hd={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${Tt}${e}`,extractCreatedAt:t=>{let e=t.indexOf(Tt),r=e===-1?t:t.slice(0,e);return Number(r)}};var ue={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},We="S",x0={partitionKey:{name:"PK",type:We},sortKey:{name:"SK",type:We},ttlAttribute:"TTL",globalSecondaryIndexes:[{indexName:ue.ACTIVE_SESSIONS,partitionKey:{name:"activeSessionPk",type:We},sortKey:{name:"activeSessionSk",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.USER_SESSIONS,partitionKey:{name:"userSessionPk",type:We},sortKey:{name:"userSessionSk",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.USERS_BY_STATUS,partitionKey:{name:"userStatusPk",type:We},sortKey:{name:"userStatusSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["displayName","createdAt"]}},{indexName:ue.USER_PROVIDERS,partitionKey:{name:"userProviderPk",type:We},sortKey:{name:"userProviderSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["userId","externalEmail","externalName","createdAt"]}},{indexName:ue.USER_IDENTITIES,partitionKey:{name:"identityUserPk",type:We},sortKey:{name:"identityUserSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["loginEnabled","verifiedAt","createdAt"]}},{indexName:ue.USER_CREDENTIALS,partitionKey:{name:"credentialUserPk",type:We},sortKey:{name:"credentialUserSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["revokedAt","createdAt"]}},{indexName:ue.USER_TENANTS,partitionKey:{name:"userTenantPk",type:We},sortKey:{name:"userTenantSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["userStatus","role","roles","perm","authPerm","isOwner","createdAt","updatedAt"]}},{indexName:ue.TENANT_INVITES,partitionKey:{name:"inviteTenantPk",type:We},sortKey:{name:"inviteTenantSk",type:We},projection:{type:"ALL"}},{indexName:ue.INVITE_TOKEN,partitionKey:{name:"inviteTokenGsi",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.INVITEE_EMAIL,partitionKey:{name:"inviteeEmailGsi",type:We},sortKey:{name:"inviteeEmailTenantSk",type:We},projection:{type:"ALL"}},{indexName:ue.INVITEE_PHONE,partitionKey:{name:"inviteePhoneGsi",type:We},sortKey:{name:"inviteePhoneTenantSk",type:We},projection:{type:"ALL"}}]};import{DeleteCommand as J0,GetCommand as Y0,PutCommand as X0,UpdateCommand as RT}from"@aws-sdk/lib-dynamodb";var b0=BigInt(0),ac=BigInt(1),S0=BigInt(2),w0=BigInt(7),N0=BigInt(256),R0=BigInt(113),yT=[],gT=[],vT=[];for(let t=0,e=ac,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],yT.push(2*(5*n+r)),gT.push((t+1)*(t+2)/2%64);let i=b0;for(let o=0;o<7;o++)e=(e<<ac^(e>>w0)*R0)%N0,e&S0&&(i^=ac<<(ac<<BigInt(o))-ac);vT.push(i)}var AT=Ov(vT,!0),O0=AT[0],k0=AT[1],C0=(t,e,r)=>t<<r|e>>>32-r,D0=(t,e,r)=>e<<r|t>>>32-r,P0=(t,e,r)=>e<<r-32|t>>>64-r,U0=(t,e,r)=>t<<r-32|e>>>64-r,hT=(t,e,r)=>r>32?P0(t,e,r):C0(t,e,r),ET=(t,e,r)=>r>32?U0(t,e,r):D0(t,e,r),_s=new Uint32Array(10);function L0(t,e=24){if(!(t instanceof Uint32Array))throw new TypeError('"s" expected Uint32Array(50), got type='+typeof t);if(t.length!==50)throw new RangeError('"s" expected Uint32Array(50), got length='+t.length);if(Ye(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');for(let r=24-e;r<24;r++){for(let o=0;o<10;o++)_s[o]=t[o]^t[o+10]^t[o+20]^t[o+30]^t[o+40];for(let o=0;o<10;o+=2){let s=(o+8)%10,a=(o+2)%10,c=_s[a],l=_s[a+1],u=hT(c,l,1)^_s[s],p=ET(c,l,1)^_s[s+1];for(let f=0;f<50;f+=10)t[o+f]^=u,t[o+f+1]^=p}let n=t[2],i=t[3];for(let o=0;o<24;o++){let s=gT[o],a=hT(n,i,s),c=ET(n,i,s),l=yT[o];n=t[l],i=t[l+1],t[l]=a,t[l+1]=c}for(let o=0;o<50;o+=10){let s=t[o],a=t[o+1],c=t[o+2],l=t[o+3];t[o]^=~t[o+2]&t[o+4],t[o+1]^=~t[o+3]&t[o+5],t[o+2]^=~t[o+4]&t[o+6],t[o+3]^=~t[o+5]&t[o+7],t[o+4]^=~t[o+6]&t[o+8],t[o+5]^=~t[o+7]&t[o+9],t[o+6]^=~t[o+8]&s,t[o+7]^=~t[o+9]&a,t[o+8]^=~s&c,t[o+9]^=~a&l}t[0]^=O0[r],t[1]^=k0[r]}Nt(_s)}var zm=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,o=24){if(Ye(e,"blockLen"),Ye(r,"suffix"),Ye(o,"rounds"),wv(i,"enableXOF"),this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=o,Ye(n,"outputLen"),!(0<e&&e<200))throw new Error('"blockLen" must be 1..199');this.state=new Uint8Array(200),this.state32=ji(this.state)}clone(){return this._cloneInto()}keccak(){fs(this.state32),L0(this.state32,this.rounds),fs(this.state32),this.posOut=0,this.pos=0}update(e){bn(this),xn(e);let{blockLen:r,state:n,state32:i}=this,o=e.length,s=r%4===0&&e.byteOffset%4===0,a=r/4,c=s&&o>=r?ji(e):void 0;for(let l=0;l<o;){if(c!==void 0&&this.pos===0&&l%4===0&&o-l>=r){for(let p=0,f=l/4;p<a;p++)i[p]^=c[f+p];l+=r,this.pos=r,this.keccak();continue}let u=Math.min(r-this.pos,o-l);for(let p=0;p<u;p++)n[this.pos++]^=e[l++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){bn(this,!1),xn(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,o=e.length;i<o;){this.posOut>=n&&this.keccak();let s=Math.min(n-this.posOut,o-i);e.set(r.subarray(this.posOut,this.posOut+s),i),this.posOut+=s,i+=s}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not enabled");return this.writeInto(e)}xof(e){return Ye(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(ds(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.length===this.outputLen?e:e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,Nt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:o,enableXOF:s}=this;return e||=new t(r,n,i,s,o),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=o,e.suffix=n,e.outputLen=i,e.enableXOF=s,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},M0=(t,e,r,n={})=>Ru(()=>new zm(e,t,r),n);var TT=M0(6,72,64,Ou(10));var K0=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,Jm=Math.ceil,pr=Math.floor,Gt="[BigNumber Error] ",_T=Gt+"Number primitive has more than 15 significant digits: ",Pr=1e14,de=14,Ym=9007199254740991,Xm=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],pi=1e7,mt=1e9;function IT(t){var e,r,n,i=R.prototype={constructor:R,toString:null,valueOf:null},o=new R(1),s=20,a=4,c=-7,l=21,u=-1e7,p=1e7,f=!1,m=1,E=0,v={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},N="0123456789abcdefghijklmnopqrstuvwxyz",S=!0;function R(A,x){var b,g,I,O,D,k,C,P,L=this;if(!(L instanceof R))return new R(A,x);if(x==null){if(A&&A._isBigNumber===!0){L.s=A.s,!A.c||A.e>p?L.c=L.e=null:A.e<u?L.c=[L.e=0]:(L.e=A.e,L.c=A.c.slice());return}if((k=typeof A=="number")&&A*0==0){if(L.s=1/A<0?(A=-A,-1):1,A===~~A){for(O=0,D=A;D>=10;D/=10,O++);O>p?L.c=L.e=null:(L.e=O,L.c=[A]);return}P=String(A)}else{if(!K0.test(P=String(A)))return n(L,P,k);L.s=P.charCodeAt(0)==45?(P=P.slice(1),-1):1}(O=P.indexOf("."))>-1&&(P=P.replace(".","")),(D=P.search(/e/i))>0?(O<0&&(O=D),O+=+P.slice(D+1),P=P.substring(0,D)):O<0&&(O=P.length)}else{if(ze(x,2,N.length,"Base"),x==10&&S)return L=new R(A),V(L,s+L.e+1,a);if(P=String(A),k=typeof A=="number"){if(A*0!=0)return n(L,P,k,x);if(L.s=1/A<0?(P=P.slice(1),-1):1,R.DEBUG&&P.replace(/^0\.0*|\./,"").length>15)throw Error(_T+A)}else L.s=P.charCodeAt(0)===45?(P=P.slice(1),-1):1;for(b=N.slice(0,x),O=D=0,C=P.length;D<C;D++)if(b.indexOf(g=P.charAt(D))<0){if(g=="."){if(D>O){O=C;continue}}else if(!I&&(P==P.toUpperCase()&&(P=P.toLowerCase())||P==P.toLowerCase()&&(P=P.toUpperCase()))){I=!0,D=-1,O=0;continue}return n(L,String(A),k,x)}k=!1,P=r(P,x,10,L.s),(O=P.indexOf("."))>-1?P=P.replace(".",""):O=P.length}for(D=0;P.charCodeAt(D)===48;D++);for(C=P.length;P.charCodeAt(--C)===48;);if(P=P.slice(D,++C)){if(C-=D,k&&R.DEBUG&&C>15&&(A>Ym||A!==pr(A)))throw Error(_T+L.s*A);if((O=O-D-1)>p)L.c=L.e=null;else if(O<u)L.c=[L.e=0];else{if(L.e=O,L.c=[],D=(O+1)%de,O<0&&(D+=de),D<C){for(D&&L.c.push(+P.slice(0,D)),C-=de;D<C;)L.c.push(+P.slice(D,D+=de));D=de-(P=P.slice(D)).length}else D-=C;for(;D--;P+="0");L.c.push(+P)}}else L.c=[L.e=0]}R.clone=IT,R.ROUND_UP=0,R.ROUND_DOWN=1,R.ROUND_CEIL=2,R.ROUND_FLOOR=3,R.ROUND_HALF_UP=4,R.ROUND_HALF_DOWN=5,R.ROUND_HALF_EVEN=6,R.ROUND_HALF_CEIL=7,R.ROUND_HALF_FLOOR=8,R.EUCLID=9,R.config=R.set=function(A){var x,b;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(x="DECIMAL_PLACES")&&(b=A[x],ze(b,0,mt,x),s=b),A.hasOwnProperty(x="ROUNDING_MODE")&&(b=A[x],ze(b,0,8,x),a=b),A.hasOwnProperty(x="EXPONENTIAL_AT")&&(b=A[x],b&&b.pop?(ze(b[0],-mt,0,x),ze(b[1],0,mt,x),c=b[0],l=b[1]):(ze(b,-mt,mt,x),c=-(l=b<0?-b:b))),A.hasOwnProperty(x="RANGE"))if(b=A[x],b&&b.pop)ze(b[0],-mt,-1,x),ze(b[1],1,mt,x),u=b[0],p=b[1];else if(ze(b,-mt,mt,x),b)u=-(p=b<0?-b:b);else throw Error(Gt+x+" cannot be zero: "+b);if(A.hasOwnProperty(x="CRYPTO"))if(b=A[x],b===!!b)if(b)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))f=b;else throw f=!b,Error(Gt+"crypto unavailable");else f=b;else throw Error(Gt+x+" not true or false: "+b);if(A.hasOwnProperty(x="MODULO_MODE")&&(b=A[x],ze(b,0,9,x),m=b),A.hasOwnProperty(x="POW_PRECISION")&&(b=A[x],ze(b,0,mt,x),E=b),A.hasOwnProperty(x="FORMAT"))if(b=A[x],typeof b=="object")v=b;else throw Error(Gt+x+" not an object: "+b);if(A.hasOwnProperty(x="ALPHABET"))if(b=A[x],typeof b=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(b))S=b.slice(0,10)=="0123456789",N=b;else throw Error(Gt+x+" invalid: "+b)}else throw Error(Gt+"Object expected: "+A);return{DECIMAL_PLACES:s,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[u,p],CRYPTO:f,MODULO_MODE:m,POW_PRECISION:E,FORMAT:v,ALPHABET:N}},R.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!R.DEBUG)return!0;var x,b,g=A.c,I=A.e,O=A.s;e:if({}.toString.call(g)=="[object Array]"){if((O===1||O===-1)&&I>=-mt&&I<=mt&&I===pr(I)){if(g[0]===0){if(I===0&&g.length===1)return!0;break e}if(x=(I+1)%de,x<1&&(x+=de),String(g[0]).length==x){for(x=0;x<g.length;x++)if(b=g[x],b<0||b>=Pr||b!==pr(b))break e;if(b!==0)return!0}}}else if(g===null&&I===null&&(O===null||O===1||O===-1))return!0;throw Error(Gt+"Invalid BigNumber: "+A)},R.maximum=R.max=function(){return K(arguments,-1)},R.minimum=R.min=function(){return K(arguments,1)},R.random=(function(){var A=9007199254740992,x=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(b){var g,I,O,D,k,C=0,P=[],L=new R(o);if(b==null?b=s:ze(b,0,mt),D=Jm(b/de),f)if(crypto.getRandomValues){for(g=crypto.getRandomValues(new Uint32Array(D*=2));C<D;)k=g[C]*131072+(g[C+1]>>>11),k>=9e15?(I=crypto.getRandomValues(new Uint32Array(2)),g[C]=I[0],g[C+1]=I[1]):(P.push(k%1e14),C+=2);C=D/2}else if(crypto.randomBytes){for(g=crypto.randomBytes(D*=7);C<D;)k=(g[C]&31)*281474976710656+g[C+1]*1099511627776+g[C+2]*4294967296+g[C+3]*16777216+(g[C+4]<<16)+(g[C+5]<<8)+g[C+6],k>=9e15?crypto.randomBytes(7).copy(g,C):(P.push(k%1e14),C+=7);C=D/7}else throw f=!1,Error(Gt+"crypto unavailable");if(!f)for(;C<D;)k=x(),k<9e15&&(P[C++]=k%1e14);for(D=P[--C],b%=de,D&&b&&(k=Xm[de-b],P[C]=pr(D/k)*k);P[C]===0;P.pop(),C--);if(C<0)P=[O=0];else{for(O=-1;P[0]===0;P.splice(0,1),O-=de);for(C=1,k=P[0];k>=10;k/=10,C++);C<de&&(O-=de-C)}return L.e=O,L.c=P,L}})(),R.sum=function(){for(var A=1,x=arguments,b=new R(x[0]);A<x.length;)b=b.plus(x[A++]);return b},r=(function(){var A="0123456789";function x(b,g,I,O){for(var D,k=[0],C,P=0,L=b.length;P<L;){for(C=k.length;C--;k[C]*=g);for(k[0]+=O.indexOf(b.charAt(P++)),D=0;D<k.length;D++)k[D]>I-1&&(k[D+1]==null&&(k[D+1]=0),k[D+1]+=k[D]/I|0,k[D]%=I)}return k.reverse()}return function(b,g,I,O,D){var k,C,P,L,H,z,Y,pe,Oe=b.indexOf("."),Fe=s,me=a;for(Oe>=0&&(L=E,E=0,b=b.replace(".",""),pe=new R(g),z=pe.pow(b.length-Oe),E=L,pe.c=x(Nn(dr(z.c),z.e,"0"),10,I,A),pe.e=pe.c.length),Y=x(b,g,I,D?(k=N,A):(k=A,N)),P=L=Y.length;Y[--L]==0;Y.pop());if(!Y[0])return k.charAt(0);if(Oe<0?--P:(z.c=Y,z.e=P,z.s=O,z=e(z,pe,Fe,me,I),Y=z.c,H=z.r,P=z.e),C=P+Fe+1,Oe=Y[C],L=I/2,H=H||C<0||Y[C+1]!=null,H=me<4?(Oe!=null||H)&&(me==0||me==(z.s<0?3:2)):Oe>L||Oe==L&&(me==4||H||me==6&&Y[C-1]&1||me==(z.s<0?8:7)),C<1||!Y[0])b=H?Nn(k.charAt(1),-Fe,k.charAt(0)):k.charAt(0);else{if(Y.length=C,H)for(--I;++Y[--C]>I;)Y[C]=0,C||(++P,Y=[1].concat(Y));for(L=Y.length;!Y[--L];);for(Oe=0,b="";Oe<=L;b+=k.charAt(Y[Oe++]));b=Nn(b,P,k.charAt(0))}return b}})(),e=(function(){function A(g,I,O){var D,k,C,P,L=0,H=g.length,z=I%pi,Y=I/pi|0;for(g=g.slice();H--;)C=g[H]%pi,P=g[H]/pi|0,D=Y*C+P*z,k=z*C+D%pi*pi+L,L=(k/O|0)+(D/pi|0)+Y*P,g[H]=k%O;return L&&(g=[L].concat(g)),g}function x(g,I,O,D){var k,C;if(O!=D)C=O>D?1:-1;else for(k=C=0;k<O;k++)if(g[k]!=I[k]){C=g[k]>I[k]?1:-1;break}return C}function b(g,I,O,D){for(var k=0;O--;)g[O]-=k,k=g[O]<I[O]?1:0,g[O]=k*D+g[O]-I[O];for(;!g[0]&&g.length>1;g.splice(0,1));}return function(g,I,O,D,k){var C,P,L,H,z,Y,pe,Oe,Fe,me,we,st,Zi,Cn,eo,_t,yi,It=g.s==I.s?1:-1,Qe=g.c,Ke=I.c;if(!Qe||!Qe[0]||!Ke||!Ke[0])return new R(!g.s||!I.s||(Qe?Ke&&Qe[0]==Ke[0]:!Ke)?NaN:Qe&&Qe[0]==0||!Ke?It*0:It/0);for(Oe=new R(It),Fe=Oe.c=[],P=g.e-I.e,It=O+P+1,k||(k=Pr,P=fr(g.e/de)-fr(I.e/de),It=It/de|0),L=0;Ke[L]==(Qe[L]||0);L++);if(Ke[L]>(Qe[L]||0)&&P--,It<0)Fe.push(1),H=!0;else{for(Cn=Qe.length,_t=Ke.length,L=0,It+=2,z=pr(k/(Ke[0]+1)),z>1&&(Ke=A(Ke,z,k),Qe=A(Qe,z,k),_t=Ke.length,Cn=Qe.length),Zi=_t,me=Qe.slice(0,_t),we=me.length;we<_t;me[we++]=0);yi=Ke.slice(),yi=[0].concat(yi),eo=Ke[0],Ke[1]>=k/2&&eo++;do{if(z=0,C=x(Ke,me,_t,we),C<0){if(st=me[0],_t!=we&&(st=st*k+(me[1]||0)),z=pr(st/eo),z>1)for(z>=k&&(z=k-1),Y=A(Ke,z,k),pe=Y.length,we=me.length;x(Y,me,pe,we)==1;)z--,b(Y,_t<pe?yi:Ke,pe,k),pe=Y.length,C=1;else z==0&&(C=z=1),Y=Ke.slice(),pe=Y.length;if(pe<we&&(Y=[0].concat(Y)),b(me,Y,we,k),we=me.length,C==-1)for(;x(Ke,me,_t,we)<1;)z++,b(me,_t<we?yi:Ke,we,k),we=me.length}else C===0&&(z++,me=[0]);Fe[L++]=z,me[0]?me[we++]=Qe[Zi]||0:(me=[Qe[Zi]],we=1)}while((Zi++<Cn||me[0]!=null)&&It--);H=me[0]!=null,Fe[0]||Fe.splice(0,1)}if(k==Pr){for(L=1,It=Fe[0];It>=10;It/=10,L++);V(Oe,O+(Oe.e=L+P*de-1)+1,D,H)}else Oe.e=P,Oe.r=+H;return Oe}})();function M(A,x,b,g){var I,O,D,k,C;if(b==null?b=a:ze(b,0,8),!A.c)return A.toString();if(I=A.c[0],D=A.e,x==null)C=dr(A.c),C=g==1||g==2&&(D<=c||D>=l)?yd(C,D):Nn(C,D,"0");else if(A=V(new R(A),x,b),O=A.e,C=dr(A.c),k=C.length,g==1||g==2&&(x<=O||O<=c)){for(;k<x;C+="0",k++);C=yd(C,O)}else if(x-=D+(g===2&&O>D),C=Nn(C,O,"0"),O+1>k){if(--x>0)for(C+=".";x--;C+="0");}else if(x+=O-k,x>0)for(O+1==k&&(C+=".");x--;C+="0");return A.s<0&&I?"-"+C:C}function K(A,x){for(var b,g,I=1,O=new R(A[0]);I<A.length;I++)g=new R(A[I]),(!g.s||(b=Yi(O,g))===x||b===0&&O.s===x)&&(O=g);return O}function B(A,x,b){for(var g=1,I=x.length;!x[--I];x.pop());for(I=x[0];I>=10;I/=10,g++);return(b=g+b*de-1)>p?A.c=A.e=null:b<u?A.c=[A.e=0]:(A.e=b,A.c=x),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,x=/^([^.]+)\.$/,b=/^\.([^.]+)$/,g=/^-?(Infinity|NaN)$/,I=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(O,D,k,C){var P,L=k?D:D.replace(I,"");if(g.test(L))O.s=isNaN(L)?null:L<0?-1:1;else{if(!k&&(L=L.replace(A,function(H,z,Y){return P=(Y=Y.toLowerCase())=="x"?16:Y=="b"?2:8,!C||C==P?z:H}),C&&(P=C,L=L.replace(x,"$1").replace(b,"0.$1")),D!=L))return new R(L,P);if(R.DEBUG)throw Error(Gt+"Not a"+(C?" base "+C:"")+" number: "+D);O.s=null}O.c=O.e=null}})();function V(A,x,b,g){var I,O,D,k,C,P,L,H=A.c,z=Xm;if(H){e:{for(I=1,k=H[0];k>=10;k/=10,I++);if(O=x-I,O<0)O+=de,D=x,C=H[P=0],L=pr(C/z[I-D-1]%10);else if(P=Jm((O+1)/de),P>=H.length)if(g){for(;H.length<=P;H.push(0));C=L=0,I=1,O%=de,D=O-de+1}else break e;else{for(C=k=H[P],I=1;k>=10;k/=10,I++);O%=de,D=O-de+I,L=D<0?0:pr(C/z[I-D-1]%10)}if(g=g||x<0||H[P+1]!=null||(D<0?C:C%z[I-D-1]),g=b<4?(L||g)&&(b==0||b==(A.s<0?3:2)):L>5||L==5&&(b==4||g||b==6&&(O>0?D>0?C/z[I-D]:0:H[P-1])%10&1||b==(A.s<0?8:7)),x<1||!H[0])return H.length=0,g?(x-=A.e+1,H[0]=z[(de-x%de)%de],A.e=-x||0):H[0]=A.e=0,A;if(O==0?(H.length=P,k=1,P--):(H.length=P+1,k=z[de-O],H[P]=D>0?pr(C/z[I-D]%z[D])*k:0),g)for(;;)if(P==0){for(O=1,D=H[0];D>=10;D/=10,O++);for(D=H[0]+=k,k=1;D>=10;D/=10,k++);O!=k&&(A.e++,H[0]==Pr&&(H[0]=1));break}else{if(H[P]+=k,H[P]!=Pr)break;H[P--]=0,k=1}for(O=H.length;H[--O]===0;H.pop());}A.e>p?A.c=A.e=null:A.e<u&&(A.c=[A.e=0])}return A}function $(A){var x,b=A.e;return b===null?A.toString():(x=dr(A.c),x=b<=c||b>=l?yd(x,b):Nn(x,b,"0"),A.s<0?"-"+x:x)}return i.absoluteValue=i.abs=function(){var A=new R(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,x){return Yi(this,new R(A,x))},i.decimalPlaces=i.dp=function(A,x){var b,g,I,O=this;if(A!=null)return ze(A,0,mt),x==null?x=a:ze(x,0,8),V(new R(O),A+O.e+1,x);if(!(b=O.c))return null;if(g=((I=b.length-1)-fr(this.e/de))*de,I=b[I])for(;I%10==0;I/=10,g--);return g<0&&(g=0),g},i.dividedBy=i.div=function(A,x){return e(this,new R(A,x),s,a)},i.dividedToIntegerBy=i.idiv=function(A,x){return e(this,new R(A,x),0,1)},i.exponentiatedBy=i.pow=function(A,x){var b,g,I,O,D,k,C,P,L,H=this;if(A=new R(A),A.c&&!A.isInteger())throw Error(Gt+"Exponent not an integer: "+$(A));if(x!=null&&(x=new R(x)),k=A.e>14,!H.c||!H.c[0]||H.c[0]==1&&!H.e&&H.c.length==1||!A.c||!A.c[0])return L=new R(Math.pow(+$(H),k?A.s*(2-Ed(A)):+$(A))),x?L.mod(x):L;if(C=A.s<0,x){if(x.c?!x.c[0]:!x.s)return new R(NaN);g=!C&&H.isInteger()&&x.isInteger(),g&&(H=H.mod(x))}else{if(A.e>9&&(H.e>0||H.e<-1||(H.e==0?H.c[0]>1||k&&H.c[1]>=24e7:H.c[0]<8e13||k&&H.c[0]<=9999975e7)))return O=H.s<0&&Ed(A)?-0:0,H.e>-1&&(O=1/O),new R(C?1/O:O);E&&(O=Jm(E/de+2))}for(k?(b=new R(.5),C&&(A.s=1),P=Ed(A)):(I=Math.abs(+$(A)),P=I%2),L=new R(o);;){if(P){if(L=L.times(H),!L.c)break;O?L.c.length>O&&(L.c.length=O):g&&(L=L.mod(x))}if(I){if(I=pr(I/2),I===0)break;P=I%2}else if(A=A.times(b),V(A,A.e+1,1),A.e>14)P=Ed(A);else{if(I=+$(A),I===0)break;P=I%2}H=H.times(H),O?H.c&&H.c.length>O&&(H.c.length=O):g&&(H=H.mod(x))}return g?L:(C&&(L=o.div(L)),x?L.mod(x):O?V(L,E,a,D):L)},i.integerValue=function(A){var x=new R(this);return A==null?A=a:ze(A,0,8),V(x,x.e+1,A)},i.isEqualTo=i.eq=function(A,x){return Yi(this,new R(A,x))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,x){return Yi(this,new R(A,x))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,x){return(x=Yi(this,new R(A,x)))===1||x===0},i.isInteger=function(){return!!this.c&&fr(this.e/de)>this.c.length-2},i.isLessThan=i.lt=function(A,x){return Yi(this,new R(A,x))<0},i.isLessThanOrEqualTo=i.lte=function(A,x){return(x=Yi(this,new R(A,x)))===-1||x===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,x){var b,g,I,O,D=this,k=D.s;if(A=new R(A,x),x=A.s,!k||!x)return new R(NaN);if(k!=x)return A.s=-x,D.plus(A);var C=D.e/de,P=A.e/de,L=D.c,H=A.c;if(!C||!P){if(!L||!H)return L?(A.s=-x,A):new R(H?D:NaN);if(!L[0]||!H[0])return H[0]?(A.s=-x,A):new R(L[0]?D:a==3?-0:0)}if(C=fr(C),P=fr(P),L=L.slice(),k=C-P){for((O=k<0)?(k=-k,I=L):(P=C,I=H),I.reverse(),x=k;x--;I.push(0));I.reverse()}else for(g=(O=(k=L.length)<(x=H.length))?k:x,k=x=0;x<g;x++)if(L[x]!=H[x]){O=L[x]<H[x];break}if(O&&(I=L,L=H,H=I,A.s=-A.s),x=(g=H.length)-(b=L.length),x>0)for(;x--;L[b++]=0);for(x=Pr-1;g>k;){if(L[--g]<H[g]){for(b=g;b&&!L[--b];L[b]=x);--L[b],L[g]+=Pr}L[g]-=H[g]}for(;L[0]==0;L.splice(0,1),--P);return L[0]?B(A,L,P):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,x){var b,g,I=this;return A=new R(A,x),!I.c||!A.s||A.c&&!A.c[0]?new R(NaN):!A.c||I.c&&!I.c[0]?new R(I):(m==9?(g=A.s,A.s=1,b=e(I,A,0,3),A.s=g,b.s*=g):b=e(I,A,0,m),A=I.minus(b.times(A)),!A.c[0]&&m==1&&(A.s=I.s),A)},i.multipliedBy=i.times=function(A,x){var b,g,I,O,D,k,C,P,L,H,z,Y,pe,Oe,Fe,me=this,we=me.c,st=(A=new R(A,x)).c;if(!we||!st||!we[0]||!st[0])return!me.s||!A.s||we&&!we[0]&&!st||st&&!st[0]&&!we?A.c=A.e=A.s=null:(A.s*=me.s,!we||!st?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(g=fr(me.e/de)+fr(A.e/de),A.s*=me.s,C=we.length,H=st.length,C<H&&(pe=we,we=st,st=pe,I=C,C=H,H=I),I=C+H,pe=[];I--;pe.push(0));for(Oe=Pr,Fe=pi,I=H;--I>=0;){for(b=0,z=st[I]%Fe,Y=st[I]/Fe|0,D=C,O=I+D;O>I;)P=we[--D]%Fe,L=we[D]/Fe|0,k=Y*P+L*z,P=z*P+k%Fe*Fe+pe[O]+b,b=(P/Oe|0)+(k/Fe|0)+Y*L,pe[O--]=P%Oe;pe[O]=b}return b?++g:pe.splice(0,1),B(A,pe,g)},i.negated=function(){var A=new R(this);return A.s=-A.s||null,A},i.plus=function(A,x){var b,g=this,I=g.s;if(A=new R(A,x),x=A.s,!I||!x)return new R(NaN);if(I!=x)return A.s=-x,g.minus(A);var O=g.e/de,D=A.e/de,k=g.c,C=A.c;if(!O||!D){if(!k||!C)return new R(I/0);if(!k[0]||!C[0])return C[0]?A:new R(k[0]?g:I*0)}if(O=fr(O),D=fr(D),k=k.slice(),I=O-D){for(I>0?(D=O,b=C):(I=-I,b=k),b.reverse();I--;b.push(0));b.reverse()}for(I=k.length,x=C.length,I-x<0&&(b=C,C=k,k=b,x=I),I=0;x;)I=(k[--x]=k[x]+C[x]+I)/Pr|0,k[x]=Pr===k[x]?0:k[x]%Pr;return I&&(k=[I].concat(k),++D),B(A,k,D)},i.precision=i.sd=function(A,x){var b,g,I,O=this;if(A!=null&&A!==!!A)return ze(A,1,mt),x==null?x=a:ze(x,0,8),V(new R(O),A,x);if(!(b=O.c))return null;if(I=b.length-1,g=I*de+1,I=b[I]){for(;I%10==0;I/=10,g--);for(I=b[0];I>=10;I/=10,g++);}return A&&O.e+1>g&&(g=O.e+1),g},i.shiftedBy=function(A){return ze(A,-Ym,Ym),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,x,b,g,I,O=this,D=O.c,k=O.s,C=O.e,P=s+4,L=new R("0.5");if(k!==1||!D||!D[0])return new R(!k||k<0&&(!D||D[0])?NaN:D?O:1/0);if(k=Math.sqrt(+$(O)),k==0||k==1/0?(x=dr(D),(x.length+C)%2==0&&(x+="0"),k=Math.sqrt(+x),C=fr((C+1)/2)-(C<0||C%2),k==1/0?x="5e"+C:(x=k.toExponential(),x=x.slice(0,x.indexOf("e")+1)+C),b=new R(x)):b=new R(k+""),b.c[0]){for(C=b.e,k=C+P,k<3&&(k=0);;)if(I=b,b=L.times(I.plus(e(O,I,P,1))),dr(I.c).slice(0,k)===(x=dr(b.c)).slice(0,k))if(b.e<C&&--k,x=x.slice(k-3,k+1),x=="9999"||!g&&x=="4999"){if(!g&&(V(I,I.e+s+2,0),I.times(I).eq(O))){b=I;break}P+=4,k+=4,g=1}else{(!+x||!+x.slice(1)&&x.charAt(0)=="5")&&(V(b,b.e+s+2,1),A=!b.times(b).eq(O));break}}return V(b,b.e+s+1,a,A)},i.toExponential=function(A,x){return A!=null&&(ze(A,0,mt),A++),M(this,A,x,1)},i.toFixed=function(A,x){return A!=null&&(ze(A,0,mt),A=A+this.e+1),M(this,A,x)},i.toFormat=function(A,x,b){var g,I=this;if(b==null)A!=null&&x&&typeof x=="object"?(b=x,x=null):A&&typeof A=="object"?(b=A,A=x=null):b=v;else if(typeof b!="object")throw Error(Gt+"Argument not an object: "+b);if(g=I.toFixed(A,x),I.c){var O,D=g.split("."),k=+b.groupSize,C=+b.secondaryGroupSize,P=b.groupSeparator||"",L=D[0],H=D[1],z=I.s<0,Y=z?L.slice(1):L,pe=Y.length;if(C&&(O=k,k=C,C=O,pe-=O),k>0&&pe>0){for(O=pe%k||k,L=Y.substr(0,O);O<pe;O+=k)L+=P+Y.substr(O,k);C>0&&(L+=P+Y.slice(O)),z&&(L="-"+L)}g=H?L+(b.decimalSeparator||"")+((C=+b.fractionGroupSize)?H.replace(new RegExp("\\d{"+C+"}\\B","g"),"$&"+(b.fractionGroupSeparator||"")):H):L}return(b.prefix||"")+g+(b.suffix||"")},i.toFraction=function(A){var x,b,g,I,O,D,k,C,P,L,H,z,Y=this,pe=Y.c;if(A!=null&&(k=new R(A),!k.isInteger()&&(k.c||k.s!==1)||k.lt(o)))throw Error(Gt+"Argument "+(k.isInteger()?"out of range: ":"not an integer: ")+$(k));if(!pe)return new R(Y);for(x=new R(o),P=b=new R(o),g=C=new R(o),z=dr(pe),O=x.e=z.length-Y.e-1,x.c[0]=Xm[(D=O%de)<0?de+D:D],A=!A||k.comparedTo(x)>0?O>0?x:P:k,D=p,p=1/0,k=new R(z),C.c[0]=0;L=e(k,x,0,1),I=b.plus(L.times(g)),I.comparedTo(A)!=1;)b=g,g=I,P=C.plus(L.times(I=P)),C=I,x=k.minus(L.times(I=x)),k=I;return I=e(A.minus(b),g,0,1),C=C.plus(I.times(P)),b=b.plus(I.times(g)),C.s=P.s=Y.s,O=O*2,H=e(P,g,O,a).minus(Y).abs().comparedTo(e(C,b,O,a).minus(Y).abs())<1?[P,g]:[C,b],p=D,H},i.toNumber=function(){return+$(this)},i.toPrecision=function(A,x){return A!=null&&ze(A,1,mt),M(this,A,x,2)},i.toString=function(A){var x,b=this,g=b.s,I=b.e;return I===null?g?(x="Infinity",g<0&&(x="-"+x)):x="NaN":(A==null?x=I<=c||I>=l?yd(dr(b.c),I):Nn(dr(b.c),I,"0"):A===10&&S?(b=V(new R(b),s+I+1,a),x=Nn(dr(b.c),b.e,"0")):(ze(A,2,N.length,"Base"),x=r(Nn(dr(b.c),I,"0"),10,A,g,!0)),g<0&&b.c[0]&&(x="-"+x)),x},i.valueOf=i.toJSON=function(){return $(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&R.set(t),R}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,o=t[0]+"";n<i;){for(e=t[n++]+"",r=de-e.length;r--;e="0"+e);o+=e}for(i=o.length;o.charCodeAt(--i)===48;);return o.slice(0,i+1||1)}function Yi(t,e){var r,n,i=t.c,o=e.c,s=t.s,a=e.s,c=t.e,l=e.e;if(!s||!a)return null;if(r=i&&!i[0],n=o&&!o[0],r||n)return r?n?0:-a:s;if(s!=a)return s;if(r=s<0,n=c==l,!i||!o)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=o.length)?c:l,s=0;s<a;s++)if(i[s]!=o[s])return i[s]>o[s]^r?1:-1;return c==l?0:c>l^r?1:-1}function ze(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Gt+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function Ed(t){var e=t.c.length-1;return fr(t.e/de)==e&&t.c[e]%2!=0}function yd(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function Nn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var H0=IT(),xT=H0;var F0=24,cc=32,V0=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,Zm=V0(),Qm=(t=4,e=Zm)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function B0(t){let e=new xT(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var ST=(t="")=>{let e=new TextEncoder;return B0(TT(e.encode(t))).toString(36).slice(1)},bT=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),j0=t=>bT[Math.floor(t()*bT.length)],G0=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=Zm}={})=>{let r=Object.keys(t).toString(),n=r.length?r+Qm(cc,e):Qm(cc,e);return ST(n).substring(0,cc)},$0=t=>()=>t++,q0=476782367,wT=({random:t=Zm,counter:e=$0(Math.floor(t()*q0)),length:r=F0,fingerprint:n=G0({random:t})}={})=>{if(r>cc)throw new Error(`Length must be between 2 and ${cc}. Received: ${r}`);return function(){let o=j0(t),s=Date.now().toString(36),a=e().toString(36),c=Qm(r,t),l=`${s+c+a+n}`;return`${o+ST(l).substring(1,r)}`}},ht=W0(wT);function W0(t){let e;return()=>(e||(e=t()),e())}function Is(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Ce(t){return Is(t)==="ConditionalCheckFailedException"}function z0(t){let e=Is(t),r=t instanceof Error?t.message:typeof t=="string"?t:void 0;return[e,r].filter(Boolean).join(": ")||String(t)}function NT(t,e){console.error(`[repo-plugin-dynamodb] ${t} failed \u2014 ${z0(e)}`)}function G(t,e){return NT(t,e),te.DatabaseQueryError({query:t})}function Rt(t,e){return NT(t,e),te.UnknownError({message:t})}var lc=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return ht()}async get(e){try{let r=await this.docClient.send(new Y0({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()}}));if(!r.Item)return T(null);let n=this.unmarshall(r.Item);return $m(re(n.expiresAt))?T(null):T(n)}catch(r){return d(G("get challenge",r))}}async create(e){try{let r=ae(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:J(r)},o=re(e.expiresAt),s=Math.floor((o+this.ttlGracePeriod)/1e3);return await this.docClient.send(new X0({TableName:this.tableName,Item:this.marshall(i,s)})),T(i)}catch(r){return d(G("create challenge",r))}}async update(e,r){try{let n=[],i={},o={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=h.METHOD,o[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=h.PHASE,o[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=h.CODE_HASH,o[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=h.CHALLENGE_STATUS,o[":challengeStatus"]=r.status),n.length===0?T(void 0):(await this.docClient.send(new RT({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:o})),T(void 0))}catch(n){return d(G("update challenge",n))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let s=(await this.docClient.send(new RT({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":h.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[h.ATTEMPTS]??0;return T(s)}catch(o){return Ce(o)?d(te.AttemptsExceeded()):d(G("increment challenge attempts",o))}}async remove(e){try{return await this.docClient.send(new J0({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":h.PK}})),T(void 0)}catch(r){return Ce(r)?T(void 0):d(G("remove challenge",r))}}marshall(e,r){let n={[h.PK]:U.CHALLENGE_PK(e.id),[h.SK]:U.CHALLENGE_SK(),[h.USER_ID]:e.userId,[h.PURPOSE]:e.purpose,[h.CHALLENGE_STATUS]:e.status,[h.EXPIRES_AT]:re(e.expiresAt),[h.CREATED_AT]:re(e.createdAt),[h.TTL]:r};return e.tenantId&&(n[h.TENANT_ID]=e.tenantId),e.phase&&(n[h.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[h.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[h.METHOD]=e.method),e.codeHash&&(n[h.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[h.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[h.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[h.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[h.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[h.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[h.COUNTRY]=e.country),e.city&&(n[h.CITY]=e.city),e.metadata&&(n[h.METADATA]=e.metadata),e.flowKey&&(n[h.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:le.challengeIdFromPK(e[h.PK]),userId:e[h.USER_ID],purpose:e[h.PURPOSE],status:e[h.CHALLENGE_STATUS],expiresAt:J(e[h.EXPIRES_AT]),createdAt:J(e[h.CREATED_AT])};return e[h.TENANT_ID]&&(n.tenantId=e[h.TENANT_ID]),e[h.PHASE]&&(n.phase=e[h.PHASE]),e[h.ALLOWED_METHODS]&&(n.allowedMethods=e[h.ALLOWED_METHODS]),e[h.METHOD]&&(n.method=e[h.METHOD]),e[h.CODE_HASH]&&(n.codeHash=e[h.CODE_HASH]),e[h.ATTEMPTS]!==void 0&&(n.attempts=e[h.ATTEMPTS]),e[h.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[h.MAX_ATTEMPTS]),e[h.IDENTITY_TYPE]&&(n.identityType=e[h.IDENTITY_TYPE]),e[h.IDENTITY_VALUE]&&(n.identityValue=e[h.IDENTITY_VALUE]),e[h.DEVICE_LABEL]&&(n.deviceLabel=e[h.DEVICE_LABEL]),e[h.COUNTRY]&&(n.country=e[h.COUNTRY]),e[h.CITY]&&(n.city=e[h.CITY]),e[h.METADATA]&&(n.metadata=e[h.METADATA]),e[h.FLOW_KEY]&&(n.flowKey=e[h.FLOW_KEY]),n}};import{BatchGetCommand as Q0,DeleteCommand as Z0,GetCommand as eO,PutCommand as tO,QueryCommand as gd,UpdateCommand as rO}from"@aws-sdk/lib-dynamodb";var uc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return ht()}async get(e){try{let r=await this.docClient.send(new eO({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()}}));return r.Item?T(this.unmarshall(r.Item)):T(null)}catch(r){return d(G("get credential",r))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk AND begins_with(${h.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return T(null);let i=n.Items[0];if(!i)return T(null);let o=le.credentialId(i[h.PK]);return this.get(o)}catch(n){return d(G("get credential by user and type",n))}}async getByUserId(e){try{let r=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return T([]);let n=r.Items.map(s=>le.credentialId(s[h.PK])),i=await this.batchGet(n);if(i.ok===!1)return d(i.errors,i.meta);if(!i.data)return T([]);let o=i.data.filter(s=>s!==null);return T(o)}catch(r){return d(G("get credentials by user",r))}}async create(e){try{let r=ae(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new tO({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${h.PK})`})),T(i)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"credential"})):d(G("create credential",r))}}async update(e,r){try{let n=ae(),i=[],o={},s={};return i.push(`#${h.UPDATED_AT} = :updatedAt`),o[`#${h.UPDATED_AT}`]=h.UPDATED_AT,s[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${h.CREDENTIAL_VALUE} = :value`),o[`#${h.CREDENTIAL_VALUE}`]=h.CREDENTIAL_VALUE,s[":value"]=r.value),r.data!==void 0&&(i.push(`#${h.METADATA} = :data`),o[`#${h.METADATA}`]=h.METADATA,s[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${h.REVOKED_AT} = :revokedAt`),o[`#${h.REVOKED_AT}`]=h.REVOKED_AT,s[":revokedAt"]=r.revokedAt?re(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${h.LAST_USED_AT} = :lastUsedAt`),o[`#${h.LAST_USED_AT}`]=h.LAST_USED_AT,s[":lastUsedAt"]=r.lastUsedAt?re(r.lastUsedAt):null),await this.docClient.send(new rO({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"credential",id:e})):d(G("update credential",n))}}async remove(e){try{return await this.docClient.send(new Z0({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(r){return Ce(r)?d(te.NotFound({entity:"credential",id:e})):d(G("delete credential",r))}}async hasType(e,r){try{let n=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk AND begins_with(${h.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return T((n.Count||0)>0)}catch(n){return d(G("check credential type",n))}}async countByUserId(e){try{let r=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Select:"COUNT"}));return T(r.Count||0)}catch(r){return d(G("count credentials",r))}}async batchGet(e){if(e.length===0)return T([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let s=(await this.docClient.send(new Q0({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[h.PK]:U.CREDENTIAL_PK(c),[h.SK]:U.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of s){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return T(n)}catch(r){return d(G("batch get credentials",r))}}marshall(e){let r={[h.PK]:U.CREDENTIAL_PK(e.id),[h.SK]:U.CREDENTIAL_SK(),[h.CREDENTIAL_USER_PK]:U.USER_PK(e.userId),[h.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(e.type,e.id),[h.USER_ID]:e.userId,[h.CREDENTIAL_VALUE]:e.value,[h.METADATA]:e.data,[h.REVOKED_AT]:e.revokedAt?re(e.revokedAt):null,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)};return e.lastUsedAt&&(r[h.LAST_USED_AT]=re(e.lastUsedAt)),r}unmarshall(e){let r=le.credentialId(e[h.PK]),n=le.credentialTypeFromUserSK(e[h.CREDENTIAL_USER_SK]);return{id:r,userId:e[h.USER_ID],type:n,value:e[h.CREDENTIAL_VALUE],data:e[h.METADATA]||{},revokedAt:Kt(e[h.REVOKED_AT]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT]),lastUsedAt:Kt(e[h.LAST_USED_AT])}}};import{BatchGetCommand as nO,DeleteCommand as iO,GetCommand as oO,PutCommand as sO,QueryCommand as aO,UpdateCommand as eh}from"@aws-sdk/lib-dynamodb";function th(t){return{failedAttempts:t.failedAttempts,lastFailedAt:Cr(t.lastFailedAt),lockedUntil:Cr(t.lockedUntil)}}function OT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Kt(n.lastFailedAt),lockedUntil:Kt(n.lockedUntil)};return e}function kT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=th(n));return e}var dc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new oO({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()}}));if(!n.Item)return T(null);let i=this.unmarshall(n.Item);return T(i)}catch(n){return d(G("get identity",n))}}async getByUserId(e){try{let r=await this.docClient.send(new aO({TableName:this.tableName,IndexName:ue.USER_IDENTITIES,KeyConditionExpression:`${h.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":U.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let o=this.unmarshall(i);o!==null&&n.push(o)}return T(n)}catch(r){return d(G("get identities by userId",r))}}async create(e){try{let r=ae(),n={...e,createdAt:J(r),updatedAt:J(r)};return await this.docClient.send(new sO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),T(n)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"identity"})):d(G("create identity",r))}}async update(e,r,n){try{let i=[],o=[],s={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),s["#loginEnabled"]=h.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=Cr(n.verifiedAt);l===null?(o.push("#verifiedAt"),s["#verifiedAt"]=h.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),s["#verifiedAt"]=h.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),s["#guards"]=h.GUARDS,a[":guards"]=kT(n.guards)),n.pendingVerification!==void 0&&(s["#pendingVerification"]=h.PENDING_VERIFICATION,n.pendingVerification===null?o.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Ht({...n.pendingVerification,expiresAt:re(n.pendingVerification.expiresAt),resendAvailableAt:Cr(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),s["#updatedAt"]=h.UPDATED_AT,a[":updatedAt"]=ae();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),o.length>0&&c.push(`REMOVE ${o.join(", ")}`),await this.docClient.send(new eh({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:s,ExpressionAttributeValues:a})),T(void 0)}catch(i){return d(G("update identity",i))}}async remove(e,r){try{return await this.docClient.send(new iO({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()}})),T(void 0)}catch(n){return d(G("remove identity",n))}}async updateGuard(e,r,n,i){let o={[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()};try{return await this.docClient.send(new eh({TableName:this.tableName,Key:o,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":h.GUARDS,"#guardKey":n,"#updatedAt":h.UPDATED_AT},ExpressionAttributeValues:{":guard":th(i),":updatedAt":ae()}})),T(void 0)}catch(s){if(Ce(s))try{return await this.docClient.send(new eh({TableName:this.tableName,Key:o,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":h.GUARDS,"#updatedAt":h.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:th(i)},":updatedAt":ae()}})),T(void 0)}catch(a){return d(G("update guard",a))}return d(G("update guard",s))}}async batchGet(e){try{if(e.length===0)return T([]);let n=(await this.docClient.send(new nO({RequestItems:{[this.tableName]:{Keys:e.map(({type:s,value:a})=>({[h.PK]:U.IDENTITY_PK(s,a),[h.SK]:U.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let s of n){let a=this.unmarshall(s);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let o=e.map(({type:s,value:a})=>{let c=`${s}#${a}`;return i.get(c)||null});return T(o)}catch(r){return d(G("batch get identities",r))}}marshall(e){let r={[h.PK]:U.IDENTITY_PK(e.type,e.value),[h.SK]:U.IDENTITY_SK(),[h.IDENTITY_USER_PK]:U.USER_INDEX_PK(e.userId),[h.IDENTITY_USER_SK]:U.USER_INDEX_SK(e.type,e.value),[h.USER_ID]:e.userId,[h.LOGIN_ENABLED]:e.loginEnabled,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)},n=Cr(e.verifiedAt);return n!==null&&(r[h.VERIFIED_AT]=n),r[h.GUARDS]=kT(e.guards),e.pendingVerification&&(r[h.PENDING_VERIFICATION]=Ht({...e.pendingVerification,expiresAt:re(e.pendingVerification.expiresAt),resendAvailableAt:Cr(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=le.identityPKInfo(e[h.PK]);if(!r){let n=e[h.IDENTITY_USER_SK]?le.userIndexSKInfo(e[h.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[h.USER_ID],loginEnabled:e[h.LOGIN_ENABLED],verifiedAt:Kt(e[h.VERIFIED_AT]),guards:OT(e[h.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[h.PENDING_VERIFICATION]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[h.PK],GSI1SK:e[h.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[h.USER_ID],loginEnabled:e[h.LOGIN_ENABLED],verifiedAt:Kt(e[h.VERIFIED_AT]),guards:OT(e[h.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[h.PENDING_VERIFICATION]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:J(r.expiresAt),resendAvailableAt:Kt(r.resendAvailableAt)}}};import{TransactWriteCommand as cO}from"@aws-sdk/lib-dynamodb";var pc=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=ae(),n=ht(),i=re(e.challenge.expiresAt),o=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new cO({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,o))]})),T(void 0)}catch(r){return Is(r)==="TransactionCanceledException"||Ce(r)?d(te.UniqueConstraintViolation({field:"registration"})):d(G("create email verification registration transaction",r))}}putItem(e){return{Put:{TableName:this.tableName,Item:Ht(e),ConditionExpression:`attribute_not_exists(${h.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[h.PK]:U.USER_PK(e.profile.id),[h.SK]:U.USER_PROFILE_SK(),userStatus:n,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[h.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[h.PK]:U.USER_PK(e.userAuth.userId),[h.SK]:U.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[h.CREATED_AT]:r,[h.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[h.PK]:U.IDENTITY_PK(n.type,n.value),[h.SK]:U.IDENTITY_SK(),[h.IDENTITY_USER_PK]:U.USER_INDEX_PK(n.userId),[h.IDENTITY_USER_SK]:U.USER_INDEX_SK(n.type,n.value),[h.USER_ID]:n.userId,[h.LOGIN_ENABLED]:n.loginEnabled,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.PENDING_VERIFICATION]:Ht({...n.pendingVerification,expiresAt:re(n.pendingVerification.expiresAt),resendAvailableAt:Cr(n.pendingVerification.resendAvailableAt)})},o=Cr(n.verifiedAt);return o!==null&&(i[h.VERIFIED_AT]=o),i[h.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,o={[h.PK]:U.CREDENTIAL_PK(r),[h.SK]:U.CREDENTIAL_SK(),[h.CREDENTIAL_USER_PK]:U.USER_PK(i.userId),[h.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(i.type,r),[h.USER_ID]:i.userId,[h.CREDENTIAL_VALUE]:i.value,[h.METADATA]:i.data,[h.REVOKED_AT]:i.revokedAt?re(i.revokedAt):null,[h.CREATED_AT]:n,[h.UPDATED_AT]:n};return i.lastUsedAt&&(o[h.LAST_USED_AT]=re(i.lastUsedAt)),o}marshallChallenge(e,r,n){let i=e.challenge,o={[h.PK]:U.CHALLENGE_PK(i.id),[h.SK]:U.CHALLENGE_SK(),[h.USER_ID]:i.userId,[h.PURPOSE]:i.purpose,[h.CHALLENGE_STATUS]:i.status,[h.EXPIRES_AT]:re(i.expiresAt),[h.CREATED_AT]:r,[h.TTL]:n};return i.tenantId&&(o[h.TENANT_ID]=i.tenantId),i.phase&&(o[h.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(o[h.ALLOWED_METHODS]=i.allowedMethods),i.method&&(o[h.METHOD]=i.method),i.codeHash&&(o[h.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(o[h.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(o[h.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(o[h.IDENTITY_TYPE]=i.identityType),i.identityValue&&(o[h.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(o[h.DEVICE_LABEL]=i.deviceLabel),i.country&&(o[h.COUNTRY]=i.country),i.city&&(o[h.CITY]=i.city),i.metadata&&(o[h.METADATA]=i.metadata),i.flowKey&&(o[h.FLOW_KEY]=i.flowKey),o}};import{DynamoDBClient as dO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as pO,GetCommand as PT,PutCommand as fO,QueryCommand as fc,UpdateCommand as bs}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as lO}from"@aws-sdk/lib-dynamodb";var CT=100,DT=5;function uO(t){return new Promise(e=>setTimeout(e,t))}async function xs(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=CT){let o=r.slice(i,i+CT),s=0;for(;o.length>0;){let a=await t.send(new lO({RequestItems:{[e]:{Keys:o}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(s+=1,s>DT)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${DT} retries`);o=l,await uO(2**s*25)}}return n}var mc=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new dO({});this.docClient=e.docClient||pO.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return ht()}generateTokenId(){return ht()}async get(e){try{let r=await this.docClient.send(new PT({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()}}));return r.Item?T(this.unmarshall(r.Item)):T(null)}catch(r){return d(G("get session",r))}}async create(e){try{let r=ae(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),o={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},s=sc(re(e.expiresAt)+this.ttlGracePeriod),a=hd.sessionSK(r,n);return await this.docClient.send(new fO({TableName:this.tableName,Item:this.marshall(o,s,a)})),T(o)}catch(r){return d(G("create session",r))}}async update(e,r){try{let n=[],i={},o={};if(r.tokenId!==void 0&&(n.push(`#${h.TOKEN_ID} = :tokenId`),i[`#${h.TOKEN_ID}`]=h.TOKEN_ID,o[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${h.EXPIRES_AT} = :expiresAt`),i[`#${h.EXPIRES_AT}`]=h.EXPIRES_AT,o[":expiresAt"]=re(r.expiresAt);let s=sc(re(r.expiresAt)+this.ttlGracePeriod);n.push(`#${h.TTL} = :ttl`),i[`#${h.TTL}`]=h.TTL,o[":ttl"]=s}return r.lastUsedAt!==void 0&&(n.push(`#${h.LAST_USED_AT} = :lastUsedAt`),i[`#${h.LAST_USED_AT}`]=h.LAST_USED_AT,o[":lastUsedAt"]=re(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${h.METADATA} = :metadata`),i[`#${h.METADATA}`]=h.METADATA,o[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${h.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${h.PREVIOUS_TOKEN_ID}`]=h.PREVIOUS_TOKEN_ID,o[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${h.ROTATED_AT} = :rotatedAt`),i[`#${h.ROTATED_AT}`]=h.ROTATED_AT,o[":rotatedAt"]=r.rotatedAt),n.length===0?T():(await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:o})),T())}catch(n){return d(G("update session",n))}}async rotateToken(e,r,n){try{let i=sc(re(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.TOKEN_ID} = :tokenId, #${h.PREVIOUS_TOKEN_ID} = :previousTokenId, #${h.ROTATED_AT} = :rotatedAt, #${h.EXPIRES_AT} = :expiresAt, #${h.LAST_USED_AT} = :lastUsedAt, #${h.TTL} = :ttl`,ConditionExpression:`#${h.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${h.TOKEN_ID}`]:h.TOKEN_ID,[`#${h.PREVIOUS_TOKEN_ID}`]:h.PREVIOUS_TOKEN_ID,[`#${h.ROTATED_AT}`]:h.ROTATED_AT,[`#${h.EXPIRES_AT}`]:h.EXPIRES_AT,[`#${h.LAST_USED_AT}`]:h.LAST_USED_AT,[`#${h.TTL}`]:h.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":re(n.expiresAt),":lastUsedAt":re(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),T(!0)}catch(i){return Ce(i)?T(!1):d(G("rotate session token",i))}}async switchTenant(e,r){try{let n=[`#${h.TENANT_ID} = :tenantId`,`#${h.TOKEN_ID} = :tokenId`,`#${h.LAST_USED_AT} = :lastUsedAt`],i=[],o={[`#${h.TENANT_ID}`]:h.TENANT_ID,[`#${h.TOKEN_ID}`]:h.TOKEN_ID,[`#${h.LAST_USED_AT}`]:h.LAST_USED_AT},s={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":ae()};o[`#${h.TENANT_TYPE}`]=h.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${h.TENANT_TYPE} = :tenantType`),s[":tenantType"]=r.tenantType):i.push(`#${h.TENANT_TYPE}`),o[`#${h.PERM}`]=h.PERM,r.perms!==void 0?(n.push(`#${h.PERM} = :perms`),s[":perms"]=JSON.stringify(r.perms)):i.push(`#${h.PERM}`),o[`#${h.ROLES}`]=h.ROLES,r.roles!==void 0?(n.push(`#${h.ROLES} = :roles`),s[":roles"]=r.roles):i.push(`#${h.ROLES}`),o["#revokedAt"]=h.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:`attribute_exists(${h.PK}) AND attribute_not_exists(#revokedAt)`})),T()}catch(n){return Ce(n)?d(te.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):d(G("switch tenant",n))}}async revoke(e){try{return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":re(new Date)},ConditionExpression:`attribute_exists(${h.PK})`})),T()}catch(r){return Ce(r)?T():d(G("revoke session",r))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ConditionExpression:`#${h.USER_ID} = :userId AND attribute_not_exists(#${h.REVOKED_AT})`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.USER_ID}`]:h.USER_ID,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":re(new Date),":userId":r}})),T()}catch(n){return Ce(n)?T():d(G("revoke session by user",n))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.USER_SESSIONS,KeyConditionExpression:`${h.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!o.Items||o.Items.length===0){let m={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return T([],{pagination:m})}let a=o.Items.map(m=>le.sessionId(m[h.PK])).map(m=>({[h.PK]:U.SESSION_PK(m),[h.SK]:U.SESSION_SK()})),l=(await xs(this.docClient,this.tableName,a)).map(m=>this.unmarshall(m)),u=!!o.LastEvaluatedKey,p=u?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:u,hasPrev:!!r?.cursor,cursor:p};return T(l,{pagination:f})}catch(n){return d(G("find sessions by user",n))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!o.Items||o.Items.length===0){let m={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return T([],{pagination:m})}let a=o.Items.map(m=>le.sessionId(m[h.PK])).map(m=>({[h.PK]:U.SESSION_PK(m),[h.SK]:U.SESSION_SK()})),l=(await xs(this.docClient,this.tableName,a)).map(m=>this.unmarshall(m)),u=!!o.LastEvaluatedKey,p=u?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:u,hasPrev:!!r?.cursor,cursor:p};return T(l,{pagination:f})}catch(n){return d(G("find active sessions by user",n))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return T([]);let n=r.Items.map(i=>{let o=le.sessionId(i[h.PK]),s=hd.extractCreatedAt(i[h.ACTIVE_SESSION_SK]);return{id:o,createdAt:new Date(s)}});return T(n)}catch(r){return d(G("get active sessions for limit",r))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=re(new Date),i=await Promise.allSettled(e.map(s=>this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(s),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),o=0;for(let s of i)s.status==="fulfilled"?o+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:Is(s.reason)});return o}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return T(0);let i=n.Items.map(s=>le.sessionId(s[h.PK])).filter(s=>!r||s!==r),o=await this.revokeSessionsByIds(i,"revokeAllByUserId");return T(o)}catch(n){return d(G("revoke all sessions by user",n))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return T(r)}catch(r){return d(G("revoke batch sessions",r))}}async countByUserId(e){try{let r=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return T(r.Count||0)}catch(r){return d(G("count active sessions by user",r))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new PT({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(r),[h.SK]:U.SESSION_SK()},ProjectionExpression:`${h.TOKEN_ID}, ${h.REVOKED_AT}, ${h.EXPIRES_AT}`}));if(!n.Item)return T(!1);let i=n.Item,o=i[h.TOKEN_ID]===e&&!i[h.REVOKED_AT]&&J(i[h.EXPIRES_AT])>new Date;return T(o)}catch(n){return d(G("check token active",n))}}marshall(e,r,n){let i={[h.PK]:U.SESSION_PK(e.id),[h.SK]:U.SESSION_SK(),[h.USER_SESSION_PK]:U.USER_PK(e.userId),[h.USER_SESSION_SK]:n,...!e.revokedAt&&{[h.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[h.ACTIVE_SESSION_SK]:n},[h.USER_ID]:e.userId,[h.TOKEN_ID]:e.tokenId,[h.EXPIRES_AT]:re(e.expiresAt),[h.CREATED_AT]:re(e.createdAt),[h.LAST_USED_AT]:re(e.lastUsedAt),[h.TTL]:r};return e.tenantId&&(i[h.TENANT_ID]=e.tenantId),e.tenantType&&(i[h.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[h.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[h.ROLES]=e.roles),e.deviceLabel&&(i[h.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[h.COUNTRY]=e.country),e.city&&(i[h.CITY]=e.city),e.metadata&&(i[h.METADATA]=e.metadata),e.revokedAt&&(i[h.REVOKED_AT]=re(e.revokedAt)),e.previousTokenId&&(i[h.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[h.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:le.sessionId(e[h.PK]),userId:e[h.USER_ID],tokenId:e[h.TOKEN_ID],expiresAt:J(e[h.EXPIRES_AT]),createdAt:J(e[h.CREATED_AT]),lastUsedAt:J(e[h.LAST_USED_AT]),revokedAt:e[h.REVOKED_AT]?J(e[h.REVOKED_AT]):null};return e[h.TENANT_ID]&&(n.tenantId=e[h.TENANT_ID]),e[h.TENANT_TYPE]&&(n.tenantType=e[h.TENANT_TYPE]),e[h.PERM]!==void 0&&(n.perms=JSON.parse(e[h.PERM])),e[h.ROLES]!==void 0&&(n.roles=e[h.ROLES]),e[h.DEVICE_LABEL]&&(n.deviceLabel=e[h.DEVICE_LABEL]),e[h.COUNTRY]&&(n.country=e[h.COUNTRY]),e[h.CITY]&&(n.city=e[h.CITY]),e[h.METADATA]&&(n.metadata=e[h.METADATA]),e[h.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[h.PREVIOUS_TOKEN_ID]),e[h.ROTATED_AT]!==void 0&&(n.rotatedAt=e[h.ROTATED_AT]),n}};import{QueryCommand as mO}from"@aws-sdk/lib-dynamodb";var hc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":h.INVITE_TENANT_PK},o={":pk":Ae.INVITE_TENANT_PK(e)},s={TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:o,ScanIndexForward:!1,Limit:n};r?.cursor&&(s.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(s.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=h.INVITE_TENANT_SK,o[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new mO(s)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,u=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:u,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant query",n))}}toListItem(e){let r=le.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:J(e.expiresAt),createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=J(e.acceptedAt)),e.declinedAt&&(i.declinedAt=J(e.declinedAt)),e.revokedAt&&(i.revokedAt=J(e.revokedAt)),i}};import{GetCommand as UT,PutCommand as hO,QueryCommand as fi,UpdateCommand as EO}from"@aws-sdk/lib-dynamodb";var yO=10080*60*1e3,Ec=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:le.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:J(e.expiresAt),createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[h.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=J(e.acceptedAt)),e.declinedAt&&(n.declinedAt=J(e.declinedAt)),e.revokedAt&&(n.revokedAt=J(e.revokedAt)),n}generateInviteId(){return ht()}async getById(e){try{let r=await this.docClient.send(new UT({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()}}));return r.Item?T(this.mapItemToEntity(r.Item)):T(null)}catch(r){return d(G("getById invite",r))}}async getByToken(e){try{let n=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":h.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return T(null);let i=n[0],o=await this.docClient.send(new UT({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return o.Item?T(this.mapItemToEntity(o.Item)):T(null)}catch(r){return d(G("getByToken invite",r))}}async create(e){try{let r=ae(),n=re(e.expiresAt),i=Math.floor((n+yO)/1e3),o={PK:U.INVITE_PK(e.id),SK:U.INVITE_SK(),[h.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[h.INVITED_BY_ID]:e.invitedById,[h.INVITE_STATUS]:e.status,[h.INVITE_TOKEN]:e.inviteToken,[h.EXPIRES_AT]:n,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.TTL]:i,[h.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[h.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[h.INVITE_TOKEN_GSI]:e.inviteToken},s={};e.invitedByName&&(s.name=e.invitedByName),e.invitedByEmail&&(s.email=e.invitedByEmail),e.invitedByJobTitle&&(s.jobTitle=e.invitedByJobTitle),Object.keys(s).length>0&&(o[h.INVITED_BY_INFO]=s),e.inviteeUserId&&(o[h.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(o[h.INVITEE_EMAIL]=e.inviteeEmail,o[h.INVITEE_EMAIL_GSI]=e.inviteeEmail,o[h.INVITEE_EMAIL_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.inviteePhone&&(o[h.INVITEE_PHONE]=e.inviteePhone,o[h.INVITEE_PHONE_GSI]=e.inviteePhone,o[h.INVITEE_PHONE_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.roles!==void 0&&(o[h.ROLES]=e.roles),e.perms!==void 0&&(o[h.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(o[h.AUTH_PERM]=e.authPerm),e.displayName&&(o[h.DISPLAY_NAME]=e.displayName),e.givenName&&(o.givenName=e.givenName),e.familyName&&(o.familyName=e.familyName),e.jobTitle&&(o.jobTitle=e.jobTitle),await this.docClient.send(new hO({TableName:this.tableName,Item:o,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:J(r),updatedAt:J(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),T(a)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"invite id"})):d(Rt("create invite",r))}}async updateStatus(e,r){try{let n=ae(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],o={"#inviteStatus":h.INVITE_STATUS,"#inviteTenantSk":h.INVITE_TENANT_SK,"#updatedAt":h.UPDATED_AT},s={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),o["#acceptedAt"]=h.ACCEPTED_AT,s[":acceptedAt"]=re(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),o["#declinedAt"]=h.DECLINED_AT,s[":declinedAt"]=re(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),o["#revokedAt"]=h.REVOKED_AT,s[":revokedAt"]=re(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),o["#inviteTokenGsi"]=h.INVITE_TOKEN_GSI,o["#inviteeEmailGsi"]=h.INVITEE_EMAIL_GSI,o["#inviteeEmailTenantSk"]=h.INVITEE_EMAIL_TENANT_SK,o["#inviteePhoneGsi"]=h.INVITEE_PHONE_GSI,o["#inviteePhoneTenantSk"]=h.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new EO({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantInvite",id:e})):d(Rt("updateStatus invite",n))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":h.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":h.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndEmail",n))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":h.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":h.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndPhone",n))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":h.INVITE_TENANT_PK,"#sk":h.INVITE_TENANT_SK,"#inviteeUserId":h.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndUserId",n))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":h.INVITE_TENANT_PK},o={":pk":Ae.INVITE_TENANT_PK(e)},s={TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:o,ScanIndexForward:!1,Limit:n};r?.cursor&&(s.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(s.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=h.INVITE_TENANT_SK,o[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new fi(s)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,u=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:u,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant",n))}}async findPendingByEmail(e){try{let r=ae(),i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":h.INVITEE_EMAIL_GSI,"#expiresAt":h.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return T([]);let o=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await xs(this.docClient,this.tableName,o)).map(c=>this.mapItemToEntity(c));return T(a)}catch(r){return d(G("findPendingByEmail",r))}}async findPendingByPhone(e){try{let r=ae(),i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":h.INVITEE_PHONE_GSI,"#expiresAt":h.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return T([]);let o=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await xs(this.docClient,this.tableName,o)).map(c=>this.mapItemToEntity(c));return T(a)}catch(r){return d(G("findPendingByPhone",r))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":h.INVITE_TENANT_PK,"#sk":h.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return T(r.Count??0)}catch(r){return d(G("countPendingByTenant",r))}}async expireOld(e){return T(0)}};import{QueryCommand as gO}from"@aws-sdk/lib-dynamodb";var yc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=(await this.docClient.send(new gO(i))).Items||[],a=[],c=new Map;for(let m of s){let E=m.SK;if(E.startsWith(Be.TENANT_PROFILE)){let v=le.tenantProfileUserId(E);c.set(v,m)}else E.startsWith(ce.USER)&&a.push(m)}a.sort((m,E)=>E.createdAt-m.createdAt);let l=a.slice(0,n),u=a.length>n,p=l.map(m=>{let E=le.tenantMemberUserId(m.SK),v=c.get(E);return this.toListItem(m,e,E,v)}),f=u&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:u,cursor:f,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant query",n))}}toListItem(e,r,n,i){let o={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};if(e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(o.authPerm=e.authPerm),i){let s={tenantId:r,userId:n,createdAt:J(i.createdAt),updatedAt:J(i.updatedAt)};i.contactEmail&&(s.contactEmail=i.contactEmail),i.contactPhone&&(s.contactPhone=i.contactPhone),i.displayName&&(s.displayName=i.displayName),i.displayNameSource&&(s.displayNameSource=i.displayNameSource),i.givenName&&(s.givenName=i.givenName),i.familyName&&(s.familyName=i.familyName),i.avatarUrl&&(s.avatarUrl=i.avatarUrl),i.locale&&(s.locale=i.locale),i.jobTitle&&(s.jobTitle=i.jobTitle),i.bio&&(s.bio=i.bio),i.metadata&&(s.metadata=JSON.parse(i.metadata)),o.tenantProfile=s}return o}};import{DeleteCommand as vO,DynamoDBDocumentClient as AO,GetCommand as LT,PutCommand as TO,QueryCommand as _O,TransactWriteCommand as IO,UpdateCommand as MT}from"@aws-sdk/lib-dynamodb";var gc=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=AO.from(e)}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new LT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)}}));if(!n.Item)return T(null);let i=this.mapItemToEntity(n.Item);return T(i)}catch(n){return d(G("get",n))}}async create(e){try{let r=ae(),n=e.isOwner?void 0:e.authPerm,i=Ht({PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new IO({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new TO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?d(te.UniqueConstraintViolation({field:"tenant owner"})):d(te.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"tenant member"})):d(Rt("create tenant member",r))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:ae()},{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Dr(i);return await this.docClient.send(new MT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("updatePermissions tenant member",i))}}async updateStatus(e,r,n){try{return await this.docClient.send(new MT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":ae()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("updateStatus tenant member",i))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e),":skPrefix":ce.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=await this.docClient.send(new _O(i)),s=(o.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!o.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return mr(s,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant",n))}}async hasOwner(e){try{let r=await this.docClient.send(new LT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_OWNER_MARKER_SK()}}));return T(!!r.Item)}catch(r){return d(G("hasOwner",r))}}async remove(e,r){try{return await this.docClient.send(new vO({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("remove tenant member",n))}}};import{BatchGetCommand as xO,QueryCommand as bO}from"@aws-sdk/lib-dynamodb";var vc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??Qt.DEFAULT,o=r?.parentTenantId,s=o?`${i}#${o}#`:`${i}#`,a={TableName:this.tableName,IndexName:ue.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":s},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new bO(a)),l=c.Items??[],u=await this.fetchProfileMap(e,l),p=l.map(E=>this.toListItem(E,e,u)),f=!!c.LastEvaluatedKey,m=f?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:f,cursor:m,prevCursor:r?.cursor??null})}catch(n){return d(G("listByUser query",n))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(s=>({PK:U.TENANT_PROFILE_PK(le.tenantId(s.PK)),SK:U.TENANT_PROFILE_SK(e)})),o=await this.docClient.send(new xO({RequestItems:{[this.tableName]:{Keys:i}}}));for(let s of o.Responses?.[this.tableName]??[]){let a=s,c=le.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=le.tenantId(e.PK),o={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(o.authPerm=e.authPerm);let s=n.get(i);return s&&(s.contactEmail&&(o.contactEmail=s.contactEmail),s.contactPhone&&(o.contactPhone=s.contactPhone),s.displayName&&(o.displayName=s.displayName),s.displayNameSource&&(o.displayNameSource=s.displayNameSource),s.givenName&&(o.givenName=s.givenName),s.familyName&&(o.familyName=s.familyName),s.avatarUrl&&(o.avatarUrl=s.avatarUrl),s.locale&&(o.locale=s.locale),s.jobTitle&&(o.jobTitle=s.jobTitle),s.bio&&(o.bio=s.bio),s.metadata&&(o.metadata=JSON.parse(s.metadata))),o}};import{DeleteCommand as SO,GetCommand as wO,PutCommand as NO,UpdateCommand as RO}from"@aws-sdk/lib-dynamodb";var Ac=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return ht()}toEntity(e){let n={id:le.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new wO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()}}));return r.Item?T(this.toEntity(r.Item)):T(null)}catch(r){return d(G("get tenant",r))}}async create(e){try{let r=e.id??this.generateTenantId(),n=ae(),i=Ht({PK:U.TENANT_PK(r),SK:U.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new NO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"tenant"})):d(Rt("create tenant",r))}}async update(e,r){try{let n={updatedAt:ae()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:o,ExpressionAttributeValues:s}=Dr(n);return await this.docClient.send(new RO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"Tenant",id:e})):d(Rt("update tenant",n))}}async delete(e){try{return await this.docClient.send(new SO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"Tenant",id:e})):d(Rt("delete tenant",r))}}async list(){return d(te.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return d(te.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return d(te.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as OO,GetCommand as kO,PutCommand as CO,UpdateCommand as vd}from"@aws-sdk/lib-dynamodb";var Tc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new kO({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()}}));return r.Item?T(this.unmarshall(r.Item,e)):T(null)}catch(r){return d(G("get user auth",r))}}async create(e){try{let r=ae(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new CO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${h.PK})`})),T(n)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"userAuth"})):d(G("create user auth",r))}}async updateStatus(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update user auth status",n))}}async updateMfaRequired(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa required",n))}}async updateMfaMethods(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa methods",n))}}async updateMfaSettings(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa settings",n))}}async remove(e){try{return await this.docClient.send(new OO({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()}})),T(void 0)}catch(r){return d(G("remove user auth",r))}}marshall(e){return{[h.PK]:U.USER_PK(e.userId),[h.SK]:U.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}}};import{DynamoDBDocumentClient as DO,DeleteCommand as PO,GetCommand as UO,PutCommand as LO,QueryCommand as KT,UpdateCommand as rh}from"@aws-sdk/lib-dynamodb";function Ss(t,e){return e?U.USER_MFA_WITH_ID_SK(t,e):U.USER_MFA_SK(t)}var _c=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=DO.from(e)}toDynamoDBItem(e){let r={PK:U.USER_PK(e.userId),SK:Ss(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=le.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:J(e.createdAt),verifiedAt:Kt(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Kt(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Kt(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Kt(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=Ss(r,n),o=await this.docClient.send(new UO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}}));return o.Item?T(this.fromDynamoDBItem(o.Item,e)):T(null)}catch(i){return d(G("get MFA authenticator",i))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":Be.MFA}},o=((await this.docClient.send(new KT(r))).Items??[]).map(s=>this.fromDynamoDBItem(s,e));return T(o)}catch(r){return d(G("find MFA authenticators by user",r))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":`${Be.MFA}${r}`}},s=((await this.docClient.send(new KT(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return T(s)}catch(n){return d(G("find MFA authenticators by method",n))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=ht());let n=this.toDynamoDBItem(r);return await this.docClient.send(new LO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(this.fromDynamoDBItem(n,e.userId))}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"MFA authenticator"})):d(G("create MFA authenticator",r))}}async update(e,r,n,i){try{let o=Ss(r,n),s=[],a={},c={};if(i.label!==void 0&&(s.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(s.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(s.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(s.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(s.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(s.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(s.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(s.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),s.length===0)return T(void 0);let l={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:o},UpdateExpression:`SET ${s.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new rh(l)),T(void 0)}catch(o){return d(G("update MFA authenticator",o))}}async remove(e,r,n){try{let i=Ss(r,n);return await this.docClient.send(new PO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}})),T(void 0)}catch(i){return d(G("remove MFA authenticator",i))}}async incrementFailedAttempts(e,r,n,i,o){try{let s=Ss(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},u={":zero":0,":inc":1,":lastFailedAt":a};o!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",u[":lockedUntil"]=a+o*60*1e3,u[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:s},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:u};return await this.docClient.send(new rh(p)),T(void 0)}catch(s){return d(G("increment failed attempts",s))}}async resetFailedAttempts(e,r,n){try{let i=Ss(r,n),o={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new rh(o)),T(void 0)}catch(i){return d(G("reset failed attempts",i))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as MO,DynamoDBDocumentClient as KO,GetCommand as HO,PutCommand as FO,QueryCommand as HT,UpdateCommand as FT}from"@aws-sdk/lib-dynamodb";var Ic=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=KO.from(e)}generateUserId(){return ht()}async getById(e){try{let r=await this.docClient.send(new HO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}}));if(!r.Item)return T(null);let n=r.Item;if(n.deletedAt)return T(null);let o={id:le.userId(n.PK),status:n.userStatus,createdAt:J(n.createdAt),updatedAt:J(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:J(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return T(o)}catch(r){return d(G("getById user",r))}}async create(e){try{let r=ae(),n=e.id||this.generateUserId(),i=e.status||"pending",o={PK:U.USER_PK(n),SK:U.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(o.contactEmail=e.contactEmail),e.contactPhone&&(o.contactPhone=e.contactPhone),e.username&&(o.username=e.username),e.displayName&&(o.displayName=e.displayName),e.givenName&&(o.givenName=e.givenName),e.familyName&&(o.familyName=e.familyName),e.avatarUrl&&(o.avatarUrl=e.avatarUrl),e.locale&&(o.locale=e.locale),e.metadata&&(o.metadata=JSON.stringify(e.metadata)),o[h.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),o[h.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new FO({TableName:this.tableName,Item:Ht(o),ConditionExpression:qm("PK")}));let s={id:n,status:i,createdAt:J(r),updatedAt:J(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return T(s)}catch(r){return d(G("create user",r))}}async updateProfile(e,r){try{let n=ae(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return T(void 0);i.updatedAt=n;let o=Dr(i);return await this.docClient.send(new FT({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:o.UpdateExpression,ExpressionAttributeNames:o.ExpressionAttributeNames,ExpressionAttributeValues:o.ExpressionAttributeValues})),T(void 0)}catch(n){return d(G("updateProfile",n))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=Ae.USER_STATUS_PK(e),s=await this.docClient.send(new HT({TableName:this.tableName,IndexName:ue.USERS_BY_STATUS,KeyConditionExpression:`${h.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":o},Limit:n,ExclusiveStartKey:i})),a=[];if(s.Items&&s.Items.length>0)for(let u of s.Items){let p=le.userId(u.PK);a.push(p)}let c=!!s.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return T(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch(n){return d(G("get users by status",n))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new HT({TableName:this.tableName,IndexName:ue.USERS_BY_STATUS,KeyConditionExpression:`${h.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return T(n.Count||0)}catch(r){return d(G("count users by status",r))}}async syncAuthStatus(e,r){try{let n=ae(),i=`SET userStatus = :userStatus, #${h.UPDATED_AT} = :updatedAt, #${h.USER_STATUS_PK} = :statusPk, #${h.USER_STATUS_SK} = :statusSk`,o={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",o[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new FT({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${h.UPDATED_AT}`]:h.UPDATED_AT,[`#${h.USER_STATUS_PK}`]:h.USER_STATUS_PK,[`#${h.USER_STATUS_SK}`]:h.USER_STATUS_SK},ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userProfile",id:e})):d(G("sync auth status",n))}}async remove(e){try{return await this.docClient.send(new MO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}})),T(void 0)}catch(r){return d(G("remove user profile",r))}}};import{DeleteCommand as VO,DynamoDBDocumentClient as BO,GetCommand as jO,PutCommand as GO,QueryCommand as $O,UpdateCommand as qO}from"@aws-sdk/lib-dynamodb";var xc=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=BO.from(e)}mapItemToUserProviderLink(e){let r=le.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:J(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=ae(),n={PK:U.PROVIDER_PK(e.provider,e.externalId),SK:U.PROVIDER_METADATA_SK(),userProviderPk:U.USER_PK(e.userId),userProviderSk:U.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?re(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Ht(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new jO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}}));return n.Item?T(this.mapItemToUserProviderLink(n.Item)):T(null)}catch(n){return d(G("find provider by external id",n))}}async findByUserId(e){try{let r=await this.docClient.send(new $O({TableName:this.tableName,IndexName:ue.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":h.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":U.USER_PK(e)}}));return!r.Items||r.Items.length===0?T([]):T(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch(r){return d(G("find providers by user id",r))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new GO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),T(this.mapItemToUserProviderLink(n))}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):d(G("create user provider",r))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return T(void 0);let{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Dr(i);return await this.docClient.send(new qO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a})),T(void 0)}catch(i){return d(G("update user provider",i))}}async remove(e,r){try{return await this.docClient.send(new VO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}})),T(void 0)}catch(n){return d(G("delete user provider",n))}}};import{DeleteCommand as WO,GetCommand as zO,PutCommand as JO,UpdateCommand as YO}from"@aws-sdk/lib-dynamodb";var bc=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new zO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)}}));return n.Item?T(this.mapItemToEntity(n.Item)):T(null)}catch(n){return d(G("get user tenant profile",n))}}async create(e){try{let r=ae(),n={PK:U.TENANT_PROFILE_PK(e.tenantId),SK:U.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new JO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:J(r),updatedAt:J(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),T(i)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"user tenant profile"})):d(Rt("create user tenant profile",r))}}async update(e,r,n){try{let i={updatedAt:ae()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Dr(i);return await this.docClient.send(new YO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):d(Rt("update user tenant profile",i))}}async remove(e,r){try{return await this.docClient.send(new WO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):d(Rt("remove user tenant profile",n))}}};var nh=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new QO(e.clientConfig||{});let r=ZO.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Ic(this.client,this.tableName),this.sessions=new mc({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new xc(this.client,this.tableName),this.userMfaAuthenticators=new _c(this.client,this.tableName),this.challenges=new lc({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new dc({docClient:r,tableName:this.tableName}),this.credentials=new uc({docClient:r,tableName:this.tableName}),this.registration=new pc({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Tc({docClient:r,tableName:this.tableName}),this.tenantMembers=new gc(this.client,this.tableName),this.tenantInvites=new Ec({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new bc(r,this.tableName),this.tenants=new Ac({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new hc({docClient:r,tableName:this.tableName}),tenantMembers:new yc({docClient:r,tableName:this.tableName}),tenants:new vc({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new XO({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function VT(t){return new nh(t)}ra();var ih=1,BT=2,jT=3,GT="auth-craft:internal";async function ek(t){let e=t.replace(/^0x/,""),r=qT(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let o=`-----BEGIN PRIVATE KEY-----
 `+btoa(String.fromCharCode(...i)).match(/.{1,64}/g).join(`
 `)+`
------END PRIVATE KEY-----`;return Co(s,"EdDSA")}async function sk(t){let e=t.replace(/^0x/,""),r=QT(e),n=ak(r);return Mt({kty:"OKP",crv:"Ed25519",x:n},"EdDSA")}async function wm(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return Mt(JSON.parse(r),e);if(!r.includes(`
-`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Mt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return ik(r)}if(r.startsWith("-----"))return Co(r,e)}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function XT(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return Mt(JSON.parse(r),e);if(!r.includes(`
-`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Mt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return sk(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(Do(),vE));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function ok(t){return new TextEncoder().encode(t)}function QT(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function ak(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var ku=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await ok(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await wm(this.config.privateKey,e),i=await XT(this.config.publicKey,e),s,o;return this.config.servicePrivateKey&&this.config.servicePublicKey?(s=await wm(this.config.servicePrivateKey,e),o=await XT(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(s=await wm(this.config.servicePrivateKey,e),o=i):(s=n,o=i),{privateKey:n,publicKey:i,servicePrivateKey:s,servicePublicKey:o}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),s=i+r*60,o=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:o??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?zT:Sm,iat:i,exp:s};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new us(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,s=this.config.clockTolerance??0,o={algorithms:[i],clockTolerance:s};this.config.issuer&&(o.issuer=this.config.issuer),n&&(typeof n=="string"||n.length>0)&&(o.audience=n);let{payload:a}=await Rn(e,r,o);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1);return this.signJwt(s,n.privateKey)}accessVerifyAudience(){return this.config.accessTokenAudiences&&this.config.accessTokenAudiences.length>0?this.config.accessTokenAudiences:this.config.accessTokenAudience??this.config.audience}refreshVerifyAudience(){return this.config.refreshTokenAudiences&&this.config.refreshTokenAudiences.length>0?this.config.refreshTokenAudiences:this.config.refreshTokenAudience??this.config.audience}async verify(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==Sm?null:n}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1),o={...s};return e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=e.perms),{token:await this.signJwt(o,n.privateKey),expiresAt:s.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==Sm||!("jti"in n)?null:n}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,s=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(s,n.privateKey),expiresAt:s.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.refreshVerifyAudience());return!n||n.typ!==zT||!("sid"in n)||!("jti"in n)?null:n}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,s=e.aud??this.config.serviceTokenAudience??YT,o={sub:e.sub,aud:s,iss:this.config.issuer??"",jti:e.jti,typ:JT,iat:n,exp:n+i*60};return e.roles!==void 0&&(o.roles=e.roles),this.signJwt(o,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??YT,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==JT?null:i}async initialize(){}async cleanup(){}};function Nm(t){return new ku(t)}import{DynamoDBClient as ck}from"@aws-sdk/client-dynamodb";function lk(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),v(void 0)}}}function uk(){return V.email.mode==="console"?lk():V.email.mode==="queue"?Ia.createAwsSqs({queueUrl:V.email.queue.url,...V.email.queue.region?{region:V.email.queue.region}:{},envelope:V.email.queue.envelope,sourceSystem:V.email.queue.sourceSystem,eventTypeMap:V.email.queue.eventTypeMap,defaultMetadata:V.email.queue.defaultMetadata}):Pa.createDirectSmtp({host:V.smtp.host,port:V.smtp.port,secure:V.smtp.secure,auth:{user:V.smtp.user,pass:V.smtp.pass},fromEmail:V.smtp.from,fromName:"Auth Craft"})}async function ZT(){let t=fv(),e=Zg({codeLifetimeMinutes:V.auth.verificationCodeLifetimeMinutes}),r=fT(),n=Nm({algorithm:V.jwtAlgorithm,privateKey:V.jwtPrivateKey,publicKey:V.jwtPublicKey,accessTokenExpiresIn:V.auth.tokens.accessTokenLifetimeMinutes*60,refreshTokenExpiresIn:V.auth.tokens.refreshTokenLifetimeMinutes*60,issuer:V.jwtIssuer,accessTokenAudience:V.jwtAccessTokenAudience,refreshTokenAudience:V.jwtRefreshTokenAudience,accessTokenAudiences:[V.security.tokenAudiences.customer,V.security.tokenAudiences.tenant,V.security.tokenAudiences.system],refreshTokenAudiences:[V.security.tokenAudiences.customer,V.security.tokenAudiences.tenant,V.security.tokenAudiences.system]}),i=new ck({region:V.awsRegion,...V.dynamodbEndpoint?{endpoint:V.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),s=WT({tableName:V.dynamodbTableName,client:i}),o=uk(),a=new Map;V.oauth.facebook&&a.set("facebook",dm({appId:V.oauth.facebook.clientId,appSecret:V.oauth.facebook.clientSecret,redirectUri:V.oauth.facebook.redirectUri})),V.oauth.google&&a.set("google",pm({clientId:V.oauth.google.clientId,clientSecret:V.oauth.google.clientSecret,redirectUri:V.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:s,emailSystem:o,deviceParser:Ev(),rateLimiter:AT(),mfa:{totp:vT({issuer:V.auth.systemName}),email:mT()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await va({systemId:V.auth.systemName,plugins:c,security:{...Bp.HIGH,maxFailedAttempts:V.security.maxLoginAttempts,lockoutDurationMinutes:V.security.lockoutDurationMinutes,requireVerifiedIdentity:V.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:V.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:V.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:V.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:V.auth.verificationResendCooldownSeconds,verifySessionOnAuth:V.security.verifySessionOnAuth,systemTenantId:V.security.systemTenantId,tokenAudiences:V.security.tokenAudiences},system:{environment:V.nodeEnv},policy:{auditEnabled:V.features.auditEnabled,deviceTrackingEnabled:V.features.deviceTracking,sessionRotationEnabled:!0},version:V.auth.appVersion,email:{appName:"Auth Craft",appUrl:V.auth.appUrl,supportEmail:V.auth.supportEmail}})}var rc={INTERNAL_ERROR:Z("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:T("INVALID_TOKEN_TYPE","Access token required")};function D_(t,e){let r=Qr(e);return t.json(r.body,r.status)}function Zk(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}Xg();var Mi=V.appBasePath?(V.appBasePath.startsWith("/")?V.appBasePath:`/${V.appBasePath}`).replace(/\/$/,""):"",P_=Mi?`${Mi}/health`:"/health",Fm=null,Rr=null;async function eC(){return Fm||(Fm=await ZT(),console.log("\u2705 Auth SDK initialized")),Fm}async function U_(){if(!Rr){let t=await eC(),e={algorithm:V.jwtAlgorithm,publicKey:V.jwtPublicKey,issuer:V.jwtIssuer},r=Er(e),n=ds({gateway:{...V.gatewayJwt.publicKeyHex?{publicKeyHex:V.gatewayJwt.publicKeyHex}:{},expectedIssuer:V.gatewayJwt.issuer,expectedAudience:V.gatewayJwt.audience,header:V.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==sn.Access?u(rc.INVALID_TOKEN_TYPE()):c}}}),i=Fd({auth:{jwt:{...e,verify:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==sn.Access?u(rc.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Rr=new Mr,V.nodeEnv!=="production"&&Rr.use("*",async(o,a)=>{let c=o.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:o.req.method,path:o.req.path,gatewaySecret:o.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:o.res.status,duration:`${Date.now()-l}ms`}))}),V.corsOrigins.length>0&&Rr.use("*",Hg({origin:V.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),V.gatewaySecret&&Rr.use("*",async(o,a)=>{if(o.req.path===P_)return a();let c=o.req.header("X-Gateway-Secret");return!c||!Zk(c,V.gatewaySecret)?(V.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),o.notFound()):a()}),Rr.get(P_,o=>D_(o,v({status:"healthy",timestamp:new Date().toISOString()}))),Rr.use("*",Vd);let s=Cp({auth:t,policy:i,tokenStrategy:V.auth.tokens.refreshTokenStrategy,...V.auth.tokens.refreshTokenCookie?{refreshTokenCookie:V.auth.tokens.refreshTokenCookie}:{},...V.corsOrigins.length>0?{trustedOrigins:V.corsOrigins}:{}});if(Rr.route(Mi,s),console.log(`\u{1F510} Auth routes mounted at ${Mi||"/"}`),V.internal.publicKey){let o=Mi?`${Mi}${V.internal.serviceRoutePath}`:V.internal.serviceRoutePath,a=Fp({auth:t,internal:{publicKeyJwk:V.internal.publicKey,alg:V.internal.alg,audience:V.internal.audience,issuer:V.internal.issuer}});Rr.route(o,a),console.log(`\u{1F512} Internal routes mounted at ${o}`)}Rr.onError((o,a)=>{console.error("\u274C [Error]",{message:o.message,stack:o.stack,path:a.req.path});let c=V.nodeEnv==="production"?"Internal Server Error":o.message||"Internal Server Error";return D_(a,u(rc.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Rr}var vie=async(t,e)=>{try{let r=await U_();return Vp(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=V.nodeEnv==="production"?"Internal Server Error":n,s=Qr(u(rc.INTERNAL_ERROR({message:i})));return{statusCode:s.status,body:JSON.stringify(s.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(C_(),k_));U_().then(e=>{let r=V.port,n=V.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${V.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${Mi||""}`),console.log(`\u{1F511} Gateway secret: ${V.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${V.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{vie as handler};
+-----END PRIVATE KEY-----`;return ta(o,"EdDSA")}async function tk(t){let e=t.replace(/^0x/,""),r=qT(e),n=nk(r);return Vt({kty:"OKP",crv:"Ed25519",x:n},"EdDSA")}async function oh(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return Vt(JSON.parse(r),e);if(!r.includes(`
+`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Vt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return ek(r)}if(r.startsWith("-----"))return ta(r,e)}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function $T(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return Vt(JSON.parse(r),e);if(!r.includes(`
+`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Vt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return tk(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(ra(),GE));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function rk(t){return new TextEncoder().encode(t)}function qT(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function nk(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var Ad=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await rk(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await oh(this.config.privateKey,e),i=await $T(this.config.publicKey,e),o,s;return this.config.servicePrivateKey&&this.config.servicePublicKey?(o=await oh(this.config.servicePrivateKey,e),s=await $T(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(o=await oh(this.config.servicePrivateKey,e),s=i):(o=n,s=i),{privateKey:n,publicKey:i,servicePrivateKey:o,servicePublicKey:s}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),o=i+r*60,s=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:s??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?BT:ih,iat:i,exp:o};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new No(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,o=this.config.clockTolerance??0,s={algorithms:[i],clockTolerance:o};this.config.issuer&&(s.issuer=this.config.issuer),n&&(typeof n=="string"||n.length>0)&&(s.audience=n);let{payload:a}=await jn(e,r,s);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,o=this.buildBasePayload(e,i,!1);return this.signJwt(o,n.privateKey)}accessVerifyAudience(){return this.config.accessTokenAudiences&&this.config.accessTokenAudiences.length>0?this.config.accessTokenAudiences:this.config.accessTokenAudience??this.config.audience}refreshVerifyAudience(){return this.config.refreshTokenAudiences&&this.config.refreshTokenAudiences.length>0?this.config.refreshTokenAudiences:this.config.refreshTokenAudience??this.config.audience}async verify(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==ih?null:n}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,o=this.buildBasePayload(e,i,!1),s={...o};return e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=e.perms),{token:await this.signJwt(s,n.privateKey),expiresAt:o.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==ih||!("jti"in n)?null:n}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,o=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(o,n.privateKey),expiresAt:o.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.refreshVerifyAudience());return!n||n.typ!==BT||!("sid"in n)||!("jti"in n)?null:n}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,o=e.aud??this.config.serviceTokenAudience??GT,s={sub:e.sub,aud:o,iss:this.config.issuer??"",jti:e.jti,typ:jT,iat:n,exp:n+i*60};return e.roles!==void 0&&(s.roles=e.roles),this.signJwt(s,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??GT,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==jT?null:i}async initialize(){}async cleanup(){}};function sh(t){return new Ad(t)}import{DynamoDBClient as ik}from"@aws-sdk/client-dynamodb";function ok(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),T(void 0)}}}function sk(){return j.email.mode==="console"?ok():j.email.mode==="queue"?$a.createAwsSqs({queueUrl:j.email.queue.url,...j.email.queue.region?{region:j.email.queue.region}:{},envelope:j.email.queue.envelope,sourceSystem:j.email.queue.sourceSystem,eventTypeMap:j.email.queue.eventTypeMap,defaultMetadata:j.email.queue.defaultMetadata}):oc.createDirectSmtp({host:j.smtp.host,port:j.smtp.port,secure:j.smtp.secure,auth:{user:j.smtp.user,pass:j.smtp.pass},fromEmail:j.smtp.from,fromName:"Auth Craft"})}async function WT(){let t=Kv(),e=xv({codeLifetimeMinutes:j.auth.verificationCodeLifetimeMinutes}),r=sT(),n=sh({algorithm:j.jwtAlgorithm,privateKey:j.jwtPrivateKey,publicKey:j.jwtPublicKey,accessTokenExpiresIn:j.auth.tokens.accessTokenLifetimeMinutes,refreshTokenExpiresIn:j.auth.tokens.refreshTokenLifetimeMinutes,issuer:j.jwtIssuer,accessTokenAudience:j.jwtAccessTokenAudience,refreshTokenAudience:j.jwtRefreshTokenAudience,accessTokenAudiences:[j.security.tokenAudiences.customer,j.security.tokenAudiences.tenant,j.security.tokenAudiences.system],refreshTokenAudiences:[j.security.tokenAudiences.customer,j.security.tokenAudiences.tenant,j.security.tokenAudiences.system]}),i=new ik({region:j.awsRegion,...j.dynamodbEndpoint?{endpoint:j.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),o=VT({tableName:j.dynamodbTableName,client:i}),s=sk(),a=new Map;j.oauth.facebook&&a.set("facebook",jm({appId:j.oauth.facebook.clientId,appSecret:j.oauth.facebook.clientSecret,redirectUri:j.oauth.facebook.redirectUri})),j.oauth.google&&a.set("google",Gm({clientId:j.oauth.google.clientId,clientSecret:j.oauth.google.clientSecret,redirectUri:j.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:o,emailSystem:s,deviceParser:Vv(),rateLimiter:fT(),mfa:{totp:pT({issuer:j.auth.systemName}),email:aT()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await Va({systemId:j.auth.systemName,plugins:c,security:{...If.HIGH,maxFailedAttempts:j.security.maxLoginAttempts,lockoutDurationMinutes:j.security.lockoutDurationMinutes,requireVerifiedIdentity:j.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:j.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:j.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:j.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:j.auth.verificationResendCooldownSeconds,verifySessionOnAuth:j.security.verifySessionOnAuth,systemTenantId:j.security.systemTenantId,tokenAudiences:j.security.tokenAudiences},system:{environment:j.nodeEnv},policy:{auditEnabled:j.features.auditEnabled,deviceTrackingEnabled:j.features.deviceTracking,sessionRotationEnabled:!0},version:j.auth.appVersion,email:{appName:"Auth Craft",appUrl:j.auth.appUrl,supportEmail:j.auth.supportEmail}})}var Sc={INTERNAL_ERROR:Q("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:_("INVALID_TOKEN_TYPE","Access token required")};function N_(t,e){let r=dn(e);return t.json(r.body,r.status)}function Yk(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}_v();var Qi=j.appBasePath?(j.appBasePath.startsWith("/")?j.appBasePath:`/${j.appBasePath}`).replace(/\/$/,""):"",R_=Qi?`${Qi}/health`:"/health",vh=null,Lr=null;async function Xk(){return vh||(vh=await WT(),console.log("\u2705 Auth SDK initialized")),vh}async function O_(){if(!Lr){let t=await Xk(),e={algorithm:j.jwtAlgorithm,publicKey:j.jwtPublicKey,issuer:j.jwtIssuer},r=Ar(e),n=Ro({gateway:{...j.gatewayJwt.publicKeyHex?{publicKeyHex:j.gatewayJwt.publicKeyHex}:{},expectedIssuer:j.gatewayJwt.issuer,expectedAudience:j.gatewayJwt.audience,header:j.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(s,a)=>{let c=await r(s,a);return c.ok&&c.data.typ!==gn.Access?d(Sc.INVALID_TOKEN_TYPE()):c}}}),i=gp({auth:{jwt:{...e,verify:async(s,a)=>{let c=await r(s,a);return c.ok&&c.data.typ!==gn.Access?d(Sc.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Lr=new Gr,j.nodeEnv!=="production"&&Lr.use("*",async(s,a)=>{let c=s.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:s.req.method,path:s.req.path,gatewaySecret:s.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:s.res.status,duration:`${Date.now()-l}ms`}))}),j.corsOrigins.length>0&&Lr.use("*",uv({origin:j.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),j.gatewaySecret&&Lr.use("*",async(s,a)=>{if(s.req.path===R_)return a();let c=s.req.header("X-Gateway-Secret");return!c||!Yk(c,j.gatewaySecret)?(j.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),s.notFound()):a()}),Lr.get(R_,s=>N_(s,T({status:"healthy",timestamp:new Date().toISOString()}))),Lr.use("*",vp);let o=ff({auth:t,policy:i,tokenStrategy:j.auth.tokens.refreshTokenStrategy,...j.auth.tokens.refreshTokenCookie?{refreshTokenCookie:j.auth.tokens.refreshTokenCookie}:{},...j.corsOrigins.length>0?{trustedOrigins:j.corsOrigins}:{}});if(Lr.route(Qi,o),console.log(`\u{1F510} Auth routes mounted at ${Qi||"/"}`),j.internal.publicKey){let s=Qi?`${Qi}${j.internal.serviceRoutePath}`:j.internal.serviceRoutePath,a=Tf({auth:t,internal:{publicKeyJwk:j.internal.publicKey,alg:j.internal.alg,audience:j.internal.audience,issuer:j.internal.issuer}});Lr.route(s,a),console.log(`\u{1F512} Internal routes mounted at ${s}`)}Lr.onError((s,a)=>{console.error("\u274C [Error]",{message:s.message,stack:s.stack,path:a.req.path});let c=j.nodeEnv==="production"?"Internal Server Error":s.message||"Internal Server Error";return N_(a,d(Sc.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Lr}var Moe=async(t,e)=>{try{let r=await O_();return _f(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=j.nodeEnv==="production"?"Internal Server Error":n,o=dn(d(Sc.INTERNAL_ERROR({message:i})));return{statusCode:o.status,body:JSON.stringify(o.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(w_(),S_));O_().then(e=>{let r=j.port,n=j.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${j.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${Qi||""}`),console.log(`\u{1F511} Gateway secret: ${j.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${j.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{Moe as handler};
 //# sourceMappingURL=index.mjs.map