@camstack/system 1.1.6 → 1.1.7

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,9 +1,43 @@
-import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { n as require_ms, t as require_semver } from "../../semver-BQBSy1FJ.mjs";
+import { createRequire } from "node:module";
 import { ApiKeyRecordSchema, BaseAddon, ScopedTokenSchema, UserRecordSchema, authProviderCapability, userManagementCapability } from "@camstack/types";
-import * as crypto$2 from "node:crypto";
+import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";
 import nodeCrypto from "crypto";
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+//#endregion
 //#region ../../node_modules/safe-buffer/index.js
 var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
@@ -227,14 +261,14 @@ var require_buffer_equal_constant_time = /* @__PURE__ */ __commonJSMin(((exports
 //#region ../../node_modules/jwa/index.js
 var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var Buffer = require_safe_buffer().Buffer;
-	var crypto$3 = __require("crypto");
+	var crypto$2 = __require("crypto");
 	var formatEcdsa = require_ecdsa_sig_formatter();
 	var util$2 = __require("util");
 	var MSG_INVALID_ALGORITHM = "\"%s\" is not a valid algorithm.\n  Supported algorithms are:\n  \"HS256\", \"HS384\", \"HS512\", \"RS256\", \"RS384\", \"RS512\", \"PS256\", \"PS384\", \"PS512\", \"ES256\", \"ES384\", \"ES512\" and \"none\".";
 	var MSG_INVALID_SECRET = "secret must be a string or buffer";
 	var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
 	var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
-	var supportsKeyObjects = typeof crypto$3.createPublicKey === "function";
+	var supportsKeyObjects = typeof crypto$2.createPublicKey === "function";
 	if (supportsKeyObjects) {
 		MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
 		MSG_INVALID_SECRET += "or a KeyObject";
@@ -287,14 +321,14 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, secret) {
 			checkIsSecretKey(secret);
 			thing = normalizeInput(thing);
-			var hmac = crypto$3.createHmac("sha" + bits, secret);
+			var hmac = crypto$2.createHmac("sha" + bits, secret);
 			return fromBase64((hmac.update(thing), hmac.digest("base64")));
 		};
 	}
 	var bufferEqual;
-	var timingSafeEqual = "timingSafeEqual" in crypto$3 ? function timingSafeEqual(a, b) {
+	var timingSafeEqual = "timingSafeEqual" in crypto$2 ? function timingSafeEqual(a, b) {
 		if (a.byteLength !== b.byteLength) return false;
-		return crypto$3.timingSafeEqual(a, b);
+		return crypto$2.timingSafeEqual(a, b);
 	} : function timingSafeEqual(a, b) {
 		if (!bufferEqual) bufferEqual = require_buffer_equal_constant_time();
 		return bufferEqual(a, b);
@@ -309,7 +343,7 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, privateKey) {
 			checkIsPrivateKey(privateKey);
 			thing = normalizeInput(thing);
-			var signer = crypto$3.createSign("RSA-SHA" + bits);
+			var signer = crypto$2.createSign("RSA-SHA" + bits);
 			return fromBase64((signer.update(thing), signer.sign(privateKey, "base64")));
 		};
 	}
@@ -318,7 +352,7 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			checkIsPublicKey(publicKey);
 			thing = normalizeInput(thing);
 			signature = toBase64(signature);
-			var verifier = crypto$3.createVerify("RSA-SHA" + bits);
+			var verifier = crypto$2.createVerify("RSA-SHA" + bits);
 			verifier.update(thing);
 			return verifier.verify(publicKey, signature, "base64");
 		};
@@ -327,11 +361,11 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, privateKey) {
 			checkIsPrivateKey(privateKey);
 			thing = normalizeInput(thing);
-			var signer = crypto$3.createSign("RSA-SHA" + bits);
+			var signer = crypto$2.createSign("RSA-SHA" + bits);
 			return fromBase64((signer.update(thing), signer.sign({
 				key: privateKey,
-				padding: crypto$3.constants.RSA_PKCS1_PSS_PADDING,
-				saltLength: crypto$3.constants.RSA_PSS_SALTLEN_DIGEST
+				padding: crypto$2.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: crypto$2.constants.RSA_PSS_SALTLEN_DIGEST
 			}, "base64")));
 		};
 	}
@@ -340,12 +374,12 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			checkIsPublicKey(publicKey);
 			thing = normalizeInput(thing);
 			signature = toBase64(signature);
-			var verifier = crypto$3.createVerify("RSA-SHA" + bits);
+			var verifier = crypto$2.createVerify("RSA-SHA" + bits);
 			verifier.update(thing);
 			return verifier.verify({
 				key: publicKey,
-				padding: crypto$3.constants.RSA_PKCS1_PSS_PADDING,
-				saltLength: crypto$3.constants.RSA_PSS_SALTLEN_DIGEST
+				padding: crypto$2.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: crypto$2.constants.RSA_PSS_SALTLEN_DIGEST
 			}, signature, "base64");
 		};
 	}
@@ -674,6 +708,124 @@ var require_TokenExpiredError = /* @__PURE__ */ __commonJSMin(((exports, module)
 	module.exports = TokenExpiredError;
 }));
 //#endregion
+//#region ../../node_modules/ms/index.js
+var require_ms = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* Helpers.
+	*/
+	var s = 1e3;
+	var m = s * 60;
+	var h = m * 60;
+	var d = h * 24;
+	var w = d * 7;
+	var y = d * 365.25;
+	/**
+	* Parse or format the given `val`.
+	*
+	* Options:
+	*
+	*  - `long` verbose formatting [false]
+	*
+	* @param {String|Number} val
+	* @param {Object} [options]
+	* @throws {Error} throw an error if val is not a non-empty string or a number
+	* @return {String|Number}
+	* @api public
+	*/
+	module.exports = function(val, options) {
+		options = options || {};
+		var type = typeof val;
+		if (type === "string" && val.length > 0) return parse(val);
+		else if (type === "number" && isFinite(val)) return options.long ? fmtLong(val) : fmtShort(val);
+		throw new Error("val is not a non-empty string or a valid number. val=" + JSON.stringify(val));
+	};
+	/**
+	* Parse the given `str` and return milliseconds.
+	*
+	* @param {String} str
+	* @return {Number}
+	* @api private
+	*/
+	function parse(str) {
+		str = String(str);
+		if (str.length > 100) return;
+		var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(str);
+		if (!match) return;
+		var n = parseFloat(match[1]);
+		switch ((match[2] || "ms").toLowerCase()) {
+			case "years":
+			case "year":
+			case "yrs":
+			case "yr":
+			case "y": return n * y;
+			case "weeks":
+			case "week":
+			case "w": return n * w;
+			case "days":
+			case "day":
+			case "d": return n * d;
+			case "hours":
+			case "hour":
+			case "hrs":
+			case "hr":
+			case "h": return n * h;
+			case "minutes":
+			case "minute":
+			case "mins":
+			case "min":
+			case "m": return n * m;
+			case "seconds":
+			case "second":
+			case "secs":
+			case "sec":
+			case "s": return n * s;
+			case "milliseconds":
+			case "millisecond":
+			case "msecs":
+			case "msec":
+			case "ms": return n;
+			default: return;
+		}
+	}
+	/**
+	* Short format for `ms`.
+	*
+	* @param {Number} ms
+	* @return {String}
+	* @api private
+	*/
+	function fmtShort(ms) {
+		var msAbs = Math.abs(ms);
+		if (msAbs >= d) return Math.round(ms / d) + "d";
+		if (msAbs >= h) return Math.round(ms / h) + "h";
+		if (msAbs >= m) return Math.round(ms / m) + "m";
+		if (msAbs >= s) return Math.round(ms / s) + "s";
+		return ms + "ms";
+	}
+	/**
+	* Long format for `ms`.
+	*
+	* @param {Number} ms
+	* @return {String}
+	* @api private
+	*/
+	function fmtLong(ms) {
+		var msAbs = Math.abs(ms);
+		if (msAbs >= d) return plural(ms, msAbs, d, "day");
+		if (msAbs >= h) return plural(ms, msAbs, h, "hour");
+		if (msAbs >= m) return plural(ms, msAbs, m, "minute");
+		if (msAbs >= s) return plural(ms, msAbs, s, "second");
+		return ms + " ms";
+	}
+	/**
+	* Pluralization helper.
+	*/
+	function plural(ms, msAbs, n, name) {
+		var isPlural = msAbs >= n * 1.5;
+		return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
+	}
+}));
+//#endregion
 //#region ../../node_modules/jsonwebtoken/lib/timespan.js
 var require_timespan = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var ms = require_ms();
@@ -688,202 +840,1586 @@ var require_timespan = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region ../../node_modules/jsonwebtoken/lib/asymmetricKeyDetailsSupported.js
-var require_asymmetricKeyDetailsSupported = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	module.exports = require_semver().satisfies(process.version, ">=15.7.0");
+//#region ../../node_modules/semver/internal/constants.js
+var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SEMVER_SPEC_VERSION = "2.0.0";
+	var MAX_LENGTH = 256;
+	var MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER || 9007199254740991;
+	module.exports = {
+		MAX_LENGTH,
+		MAX_SAFE_COMPONENT_LENGTH: 16,
+		MAX_SAFE_BUILD_LENGTH: MAX_LENGTH - 6,
+		MAX_SAFE_INTEGER,
+		RELEASE_TYPES: [
+			"major",
+			"premajor",
+			"minor",
+			"preminor",
+			"patch",
+			"prepatch",
+			"prerelease"
+		],
+		SEMVER_SPEC_VERSION,
+		FLAG_INCLUDE_PRERELEASE: 1,
+		FLAG_LOOSE: 2
+	};
 }));
 //#endregion
-//#region ../../node_modules/jsonwebtoken/lib/rsaPssKeyDetailsSupported.js
-var require_rsaPssKeyDetailsSupported = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	module.exports = require_semver().satisfies(process.version, ">=16.9.0");
+//#region ../../node_modules/semver/internal/debug.js
+var require_debug = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () => {};
 }));
 //#endregion
-//#region ../../node_modules/jsonwebtoken/lib/validateAsymmetricKey.js
-var require_validateAsymmetricKey = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var ASYMMETRIC_KEY_DETAILS_SUPPORTED = require_asymmetricKeyDetailsSupported();
-	var RSA_PSS_KEY_DETAILS_SUPPORTED = require_rsaPssKeyDetailsSupported();
-	var allowedAlgorithmsForKeys = {
-		"ec": [
-			"ES256",
-			"ES384",
-			"ES512"
-		],
-		"rsa": [
-			"RS256",
-			"PS256",
-			"RS384",
-			"PS384",
-			"RS512",
-			"PS512"
-		],
-		"rsa-pss": [
-			"PS256",
-			"PS384",
-			"PS512"
-		]
+//#region ../../node_modules/semver/internal/re.js
+var require_re = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var { MAX_SAFE_COMPONENT_LENGTH, MAX_SAFE_BUILD_LENGTH, MAX_LENGTH } = require_constants();
+	var debug = require_debug();
+	exports = module.exports = {};
+	var re = exports.re = [];
+	var safeRe = exports.safeRe = [];
+	var src = exports.src = [];
+	var safeSrc = exports.safeSrc = [];
+	var t = exports.t = {};
+	var R = 0;
+	var LETTERDASHNUMBER = "[a-zA-Z0-9-]";
+	var safeRegexReplacements = [
+		["\\s", 1],
+		["\\d", MAX_LENGTH],
+		[LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH]
+	];
+	var makeSafeRegex = (value) => {
+		for (const [token, max] of safeRegexReplacements) value = value.split(`${token}*`).join(`${token}{0,${max}}`).split(`${token}+`).join(`${token}{1,${max}}`);
+		return value;
 	};
-	var allowedCurves = {
-		ES256: "prime256v1",
-		ES384: "secp384r1",
-		ES512: "secp521r1"
+	var createToken = (name, value, isGlobal) => {
+		const safe = makeSafeRegex(value);
+		const index = R++;
+		debug(name, index, value);
+		t[name] = index;
+		src[index] = value;
+		safeSrc[index] = safe;
+		re[index] = new RegExp(value, isGlobal ? "g" : void 0);
+		safeRe[index] = new RegExp(safe, isGlobal ? "g" : void 0);
 	};
-	module.exports = function(algorithm, key) {
-		if (!algorithm || !key) return;
-		const keyType = key.asymmetricKeyType;
-		if (!keyType) return;
-		const allowedAlgorithms = allowedAlgorithmsForKeys[keyType];
-		if (!allowedAlgorithms) throw new Error(`Unknown key type "${keyType}".`);
-		if (!allowedAlgorithms.includes(algorithm)) throw new Error(`"alg" parameter for "${keyType}" key type must be one of: ${allowedAlgorithms.join(", ")}.`);
-		/* istanbul ignore next */
-		if (ASYMMETRIC_KEY_DETAILS_SUPPORTED) switch (keyType) {
-			case "ec":
-				const keyCurve = key.asymmetricKeyDetails.namedCurve;
-				const allowedCurve = allowedCurves[algorithm];
-				if (keyCurve !== allowedCurve) throw new Error(`"alg" parameter "${algorithm}" requires curve "${allowedCurve}".`);
-				break;
-			case "rsa-pss":
-				if (RSA_PSS_KEY_DETAILS_SUPPORTED) {
-					const length = parseInt(algorithm.slice(-3), 10);
-					const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
-					if (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm) throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${algorithm}.`);
-					if (saltLength !== void 0 && saltLength > length >> 3) throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${algorithm}.`);
-				}
-				break;
-		}
+	createToken("NUMERICIDENTIFIER", "0|[1-9]\\d*");
+	createToken("NUMERICIDENTIFIERLOOSE", "\\d+");
+	createToken("NONNUMERICIDENTIFIER", `\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`);
+	createToken("MAINVERSION", `(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})`);
+	createToken("MAINVERSIONLOOSE", `(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})`);
+	createToken("PRERELEASEIDENTIFIER", `(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIER]})`);
+	createToken("PRERELEASEIDENTIFIERLOOSE", `(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIERLOOSE]})`);
+	createToken("PRERELEASE", `(?:-(${src[t.PRERELEASEIDENTIFIER]}(?:\\.${src[t.PRERELEASEIDENTIFIER]})*))`);
+	createToken("PRERELEASELOOSE", `(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${src[t.PRERELEASEIDENTIFIERLOOSE]})*))`);
+	createToken("BUILDIDENTIFIER", `${LETTERDASHNUMBER}+`);
+	createToken("BUILD", `(?:\\+(${src[t.BUILDIDENTIFIER]}(?:\\.${src[t.BUILDIDENTIFIER]})*))`);
+	createToken("FULLPLAIN", `v?${src[t.MAINVERSION]}${src[t.PRERELEASE]}?${src[t.BUILD]}?`);
+	createToken("FULL", `^${src[t.FULLPLAIN]}$`);
+	createToken("LOOSEPLAIN", `[v=\\s]*${src[t.MAINVERSIONLOOSE]}${src[t.PRERELEASELOOSE]}?${src[t.BUILD]}?`);
+	createToken("LOOSE", `^${src[t.LOOSEPLAIN]}$`);
+	createToken("GTLT", "((?:<|>)?=?)");
+	createToken("XRANGEIDENTIFIERLOOSE", `${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);
+	createToken("XRANGEIDENTIFIER", `${src[t.NUMERICIDENTIFIER]}|x|X|\\*`);
+	createToken("XRANGEPLAIN", `[v=\\s]*(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:${src[t.PRERELEASE]})?${src[t.BUILD]}?)?)?`);
+	createToken("XRANGEPLAINLOOSE", `[v=\\s]*(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:${src[t.PRERELEASELOOSE]})?${src[t.BUILD]}?)?)?`);
+	createToken("XRANGE", `^${src[t.GTLT]}\\s*${src[t.XRANGEPLAIN]}$`);
+	createToken("XRANGELOOSE", `^${src[t.GTLT]}\\s*${src[t.XRANGEPLAINLOOSE]}$`);
+	createToken("COERCEPLAIN", `(^|[^\\d])(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}})(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?`);
+	createToken("COERCE", `${src[t.COERCEPLAIN]}(?:$|[^\\d])`);
+	createToken("COERCEFULL", src[t.COERCEPLAIN] + `(?:${src[t.PRERELEASE]})?(?:${src[t.BUILD]})?(?:$|[^\\d])`);
+	createToken("COERCERTL", src[t.COERCE], true);
+	createToken("COERCERTLFULL", src[t.COERCEFULL], true);
+	createToken("LONETILDE", "(?:~>?)");
+	createToken("TILDETRIM", `(\\s*)${src[t.LONETILDE]}\\s+`, true);
+	exports.tildeTrimReplace = "$1~";
+	createToken("TILDE", `^${src[t.LONETILDE]}${src[t.XRANGEPLAIN]}$`);
+	createToken("TILDELOOSE", `^${src[t.LONETILDE]}${src[t.XRANGEPLAINLOOSE]}$`);
+	createToken("LONECARET", "(?:\\^)");
+	createToken("CARETTRIM", `(\\s*)${src[t.LONECARET]}\\s+`, true);
+	exports.caretTrimReplace = "$1^";
+	createToken("CARET", `^${src[t.LONECARET]}${src[t.XRANGEPLAIN]}$`);
+	createToken("CARETLOOSE", `^${src[t.LONECARET]}${src[t.XRANGEPLAINLOOSE]}$`);
+	createToken("COMPARATORLOOSE", `^${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]})$|^$`);
+	createToken("COMPARATOR", `^${src[t.GTLT]}\\s*(${src[t.FULLPLAIN]})$|^$`);
+	createToken("COMPARATORTRIM", `(\\s*)${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]}|${src[t.XRANGEPLAIN]})`, true);
+	exports.comparatorTrimReplace = "$1$2$3";
+	createToken("HYPHENRANGE", `^\\s*(${src[t.XRANGEPLAIN]})\\s+-\\s+(${src[t.XRANGEPLAIN]})\\s*$`);
+	createToken("HYPHENRANGELOOSE", `^\\s*(${src[t.XRANGEPLAINLOOSE]})\\s+-\\s+(${src[t.XRANGEPLAINLOOSE]})\\s*$`);
+	createToken("STAR", "(<|>)?=?\\s*\\*");
+	createToken("GTE0", "^\\s*>=\\s*0\\.0\\.0\\s*$");
+	createToken("GTE0PRE", "^\\s*>=\\s*0\\.0\\.0-0\\s*$");
+}));
+//#endregion
+//#region ../../node_modules/semver/internal/parse-options.js
+var require_parse_options = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var looseOption = Object.freeze({ loose: true });
+	var emptyOpts = Object.freeze({});
+	var parseOptions = (options) => {
+		if (!options) return emptyOpts;
+		if (typeof options !== "object") return looseOption;
+		return options;
 	};
+	module.exports = parseOptions;
 }));
 //#endregion
-//#region ../../node_modules/jsonwebtoken/lib/psSupported.js
-var require_psSupported = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	module.exports = require_semver().satisfies(process.version, "^6.12.0 || >=8.0.0");
+//#region ../../node_modules/semver/internal/identifiers.js
+var require_identifiers = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var numeric = /^[0-9]+$/;
+	var compareIdentifiers = (a, b) => {
+		if (typeof a === "number" && typeof b === "number") return a === b ? 0 : a < b ? -1 : 1;
+		const anum = numeric.test(a);
+		const bnum = numeric.test(b);
+		if (anum && bnum) {
+			a = +a;
+			b = +b;
+		}
+		return a === b ? 0 : anum && !bnum ? -1 : bnum && !anum ? 1 : a < b ? -1 : 1;
+	};
+	var rcompareIdentifiers = (a, b) => compareIdentifiers(b, a);
+	module.exports = {
+		compareIdentifiers,
+		rcompareIdentifiers
+	};
 }));
 //#endregion
-//#region ../../node_modules/jsonwebtoken/verify.js
-var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var JsonWebTokenError = require_JsonWebTokenError();
-	var NotBeforeError = require_NotBeforeError();
-	var TokenExpiredError = require_TokenExpiredError();
-	var decode = require_decode();
-	var timespan = require_timespan();
-	var validateAsymmetricKey = require_validateAsymmetricKey();
-	var PS_SUPPORTED = require_psSupported();
-	var jws = require_jws();
-	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey } = __require("crypto");
-	var PUB_KEY_ALGS = [
-		"RS256",
-		"RS384",
-		"RS512"
-	];
-	var EC_KEY_ALGS = [
-		"ES256",
-		"ES384",
-		"ES512"
-	];
-	var RSA_KEY_ALGS = [
-		"RS256",
-		"RS384",
-		"RS512"
-	];
-	var HS_ALGS = [
-		"HS256",
-		"HS384",
-		"HS512"
-	];
-	if (PS_SUPPORTED) {
-		PUB_KEY_ALGS.splice(PUB_KEY_ALGS.length, 0, "PS256", "PS384", "PS512");
-		RSA_KEY_ALGS.splice(RSA_KEY_ALGS.length, 0, "PS256", "PS384", "PS512");
-	}
-	module.exports = function(jwtString, secretOrPublicKey, options, callback) {
-		if (typeof options === "function" && !callback) {
-			callback = options;
-			options = {};
+//#region ../../node_modules/semver/classes/semver.js
+var require_semver$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var debug = require_debug();
+	var { MAX_LENGTH, MAX_SAFE_INTEGER } = require_constants();
+	var { safeRe: re, t } = require_re();
+	var parseOptions = require_parse_options();
+	var { compareIdentifiers } = require_identifiers();
+	var isPrereleaseIdentifier = (prerelease, identifier) => {
+		const identifiers = identifier.split(".");
+		if (identifiers.length > prerelease.length) return false;
+		for (let i = 0; i < identifiers.length; i++) if (compareIdentifiers(prerelease[i], identifiers[i]) !== 0) return false;
+		return true;
+	};
+	module.exports = class SemVer {
+		constructor(version, options) {
+			options = parseOptions(options);
+			if (version instanceof SemVer) if (version.loose === !!options.loose && version.includePrerelease === !!options.includePrerelease) return version;
+			else version = version.version;
+			else if (typeof version !== "string") throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);
+			if (version.length > MAX_LENGTH) throw new TypeError(`version is longer than ${MAX_LENGTH} characters`);
+			debug("SemVer", version, options);
+			this.options = options;
+			this.loose = !!options.loose;
+			this.includePrerelease = !!options.includePrerelease;
+			const m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL]);
+			if (!m) throw new TypeError(`Invalid Version: ${version}`);
+			this.raw = version;
+			this.major = +m[1];
+			this.minor = +m[2];
+			this.patch = +m[3];
+			if (this.major > MAX_SAFE_INTEGER || this.major < 0) throw new TypeError("Invalid major version");
+			if (this.minor > MAX_SAFE_INTEGER || this.minor < 0) throw new TypeError("Invalid minor version");
+			if (this.patch > MAX_SAFE_INTEGER || this.patch < 0) throw new TypeError("Invalid patch version");
+			if (!m[4]) this.prerelease = [];
+			else this.prerelease = m[4].split(".").map((id) => {
+				if (/^[0-9]+$/.test(id)) {
+					const num = +id;
+					if (num >= 0 && num < MAX_SAFE_INTEGER) return num;
+				}
+				return id;
+			});
+			this.build = m[5] ? m[5].split(".") : [];
+			this.format();
 		}
-		if (!options) options = {};
-		options = Object.assign({}, options);
-		let done;
-		if (callback) done = callback;
-		else done = function(err, data) {
-			if (err) throw err;
-			return data;
-		};
-		if (options.clockTimestamp && typeof options.clockTimestamp !== "number") return done(new JsonWebTokenError("clockTimestamp must be a number"));
-		if (options.nonce !== void 0 && (typeof options.nonce !== "string" || options.nonce.trim() === "")) return done(new JsonWebTokenError("nonce must be a non-empty string"));
-		if (options.allowInvalidAsymmetricKeyTypes !== void 0 && typeof options.allowInvalidAsymmetricKeyTypes !== "boolean") return done(new JsonWebTokenError("allowInvalidAsymmetricKeyTypes must be a boolean"));
-		const clockTimestamp = options.clockTimestamp || Math.floor(Date.now() / 1e3);
-		if (!jwtString) return done(new JsonWebTokenError("jwt must be provided"));
-		if (typeof jwtString !== "string") return done(new JsonWebTokenError("jwt must be a string"));
-		const parts = jwtString.split(".");
-		if (parts.length !== 3) return done(new JsonWebTokenError("jwt malformed"));
-		let decodedToken;
-		try {
-			decodedToken = decode(jwtString, { complete: true });
-		} catch (err) {
-			return done(err);
+		format() {
+			this.version = `${this.major}.${this.minor}.${this.patch}`;
+			if (this.prerelease.length) this.version += `-${this.prerelease.join(".")}`;
+			return this.version;
 		}
-		if (!decodedToken) return done(new JsonWebTokenError("invalid token"));
-		const header = decodedToken.header;
-		let getSecret;
-		if (typeof secretOrPublicKey === "function") {
-			if (!callback) return done(new JsonWebTokenError("verify must be called asynchronous if secret or public key is provided as a callback"));
-			getSecret = secretOrPublicKey;
-		} else getSecret = function(header, secretCallback) {
-			return secretCallback(null, secretOrPublicKey);
-		};
-		return getSecret(header, function(err, secretOrPublicKey) {
-			if (err) return done(new JsonWebTokenError("error in secret or public key callback: " + err.message));
-			const hasSignature = parts[2].trim() !== "";
-			if (!hasSignature && secretOrPublicKey) return done(new JsonWebTokenError("jwt signature is required"));
-			if (hasSignature && !secretOrPublicKey) return done(new JsonWebTokenError("secret or public key must be provided"));
-			if (!hasSignature && !options.algorithms) return done(new JsonWebTokenError("please specify \"none\" in \"algorithms\" to verify unsigned tokens"));
-			if (secretOrPublicKey != null && !(secretOrPublicKey instanceof KeyObject$1)) try {
-				secretOrPublicKey = createPublicKey(secretOrPublicKey);
-			} catch (_) {
-				try {
-					secretOrPublicKey = createSecretKey$1(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
-				} catch (_) {
-					return done(new JsonWebTokenError("secretOrPublicKey is not valid key material"));
-				}
-			}
-			if (!options.algorithms) if (secretOrPublicKey.type === "secret") options.algorithms = HS_ALGS;
-			else if (["rsa", "rsa-pss"].includes(secretOrPublicKey.asymmetricKeyType)) options.algorithms = RSA_KEY_ALGS;
-			else if (secretOrPublicKey.asymmetricKeyType === "ec") options.algorithms = EC_KEY_ALGS;
-			else options.algorithms = PUB_KEY_ALGS;
-			if (options.algorithms.indexOf(decodedToken.header.alg) === -1) return done(new JsonWebTokenError("invalid algorithm"));
-			if (header.alg.startsWith("HS") && secretOrPublicKey.type !== "secret") return done(new JsonWebTokenError(`secretOrPublicKey must be a symmetric key when using ${header.alg}`));
-			else if (/^(?:RS|PS|ES)/.test(header.alg) && secretOrPublicKey.type !== "public") return done(new JsonWebTokenError(`secretOrPublicKey must be an asymmetric key when using ${header.alg}`));
-			if (!options.allowInvalidAsymmetricKeyTypes) try {
-				validateAsymmetricKey(header.alg, secretOrPublicKey);
-			} catch (e) {
-				return done(e);
-			}
-			let valid;
-			try {
-				valid = jws.verify(jwtString, decodedToken.header.alg, secretOrPublicKey);
-			} catch (e) {
-				return done(e);
-			}
-			if (!valid) return done(new JsonWebTokenError("invalid signature"));
-			const payload = decodedToken.payload;
-			if (typeof payload.nbf !== "undefined" && !options.ignoreNotBefore) {
-				if (typeof payload.nbf !== "number") return done(new JsonWebTokenError("invalid nbf value"));
-				if (payload.nbf > clockTimestamp + (options.clockTolerance || 0)) return done(new NotBeforeError("jwt not active", /* @__PURE__ */ new Date(payload.nbf * 1e3)));
+		toString() {
+			return this.version;
+		}
+		compare(other) {
+			debug("SemVer.compare", this.version, this.options, other);
+			if (!(other instanceof SemVer)) {
+				if (typeof other === "string" && other === this.version) return 0;
+				other = new SemVer(other, this.options);
 			}
-			if (typeof payload.exp !== "undefined" && !options.ignoreExpiration) {
-				if (typeof payload.exp !== "number") return done(new JsonWebTokenError("invalid exp value"));
-				if (clockTimestamp >= payload.exp + (options.clockTolerance || 0)) return done(new TokenExpiredError("jwt expired", /* @__PURE__ */ new Date(payload.exp * 1e3)));
+			if (other.version === this.version) return 0;
+			return this.compareMain(other) || this.comparePre(other);
+		}
+		compareMain(other) {
+			if (!(other instanceof SemVer)) other = new SemVer(other, this.options);
+			if (this.major < other.major) return -1;
+			if (this.major > other.major) return 1;
+			if (this.minor < other.minor) return -1;
+			if (this.minor > other.minor) return 1;
+			if (this.patch < other.patch) return -1;
+			if (this.patch > other.patch) return 1;
+			return 0;
+		}
+		comparePre(other) {
+			if (!(other instanceof SemVer)) other = new SemVer(other, this.options);
+			if (this.prerelease.length && !other.prerelease.length) return -1;
+			else if (!this.prerelease.length && other.prerelease.length) return 1;
+			else if (!this.prerelease.length && !other.prerelease.length) return 0;
+			let i = 0;
+			do {
+				const a = this.prerelease[i];
+				const b = other.prerelease[i];
+				debug("prerelease compare", i, a, b);
+				if (a === void 0 && b === void 0) return 0;
+				else if (b === void 0) return 1;
+				else if (a === void 0) return -1;
+				else if (a === b) continue;
+				else return compareIdentifiers(a, b);
+			} while (++i);
+		}
+		compareBuild(other) {
+			if (!(other instanceof SemVer)) other = new SemVer(other, this.options);
+			let i = 0;
+			do {
+				const a = this.build[i];
+				const b = other.build[i];
+				debug("build compare", i, a, b);
+				if (a === void 0 && b === void 0) return 0;
+				else if (b === void 0) return 1;
+				else if (a === void 0) return -1;
+				else if (a === b) continue;
+				else return compareIdentifiers(a, b);
+			} while (++i);
+		}
+		inc(release, identifier, identifierBase) {
+			if (release.startsWith("pre")) {
+				if (!identifier && identifierBase === false) throw new Error("invalid increment argument: identifier is empty");
+				if (identifier) {
+					const match = `-${identifier}`.match(this.options.loose ? re[t.PRERELEASELOOSE] : re[t.PRERELEASE]);
+					if (!match || match[1] !== identifier) throw new Error(`invalid identifier: ${identifier}`);
+				}
 			}
-			if (options.audience) {
-				const audiences = Array.isArray(options.audience) ? options.audience : [options.audience];
-				if (!(Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some(function(targetAudience) {
-					return audiences.some(function(audience) {
-						return audience instanceof RegExp ? audience.test(targetAudience) : audience === targetAudience;
-					});
-				})) return done(new JsonWebTokenError("jwt audience invalid. expected: " + audiences.join(" or ")));
+			switch (release) {
+				case "premajor":
+					this.prerelease.length = 0;
+					this.patch = 0;
+					this.minor = 0;
+					this.major++;
+					this.inc("pre", identifier, identifierBase);
+					break;
+				case "preminor":
+					this.prerelease.length = 0;
+					this.patch = 0;
+					this.minor++;
+					this.inc("pre", identifier, identifierBase);
+					break;
+				case "prepatch":
+					this.prerelease.length = 0;
+					this.inc("patch", identifier, identifierBase);
+					this.inc("pre", identifier, identifierBase);
+					break;
+				case "prerelease":
+					if (this.prerelease.length === 0) this.inc("patch", identifier, identifierBase);
+					this.inc("pre", identifier, identifierBase);
+					break;
+				case "release":
+					if (this.prerelease.length === 0) throw new Error(`version ${this.raw} is not a prerelease`);
+					this.prerelease.length = 0;
+					break;
+				case "major":
+					if (this.minor !== 0 || this.patch !== 0 || this.prerelease.length === 0) this.major++;
+					this.minor = 0;
+					this.patch = 0;
+					this.prerelease = [];
+					break;
+				case "minor":
+					if (this.patch !== 0 || this.prerelease.length === 0) this.minor++;
+					this.patch = 0;
+					this.prerelease = [];
+					break;
+				case "patch":
+					if (this.prerelease.length === 0) this.patch++;
+					this.prerelease = [];
+					break;
+				case "pre": {
+					const base = Number(identifierBase) ? 1 : 0;
+					if (this.prerelease.length === 0) this.prerelease = [base];
+					else {
+						let i = this.prerelease.length;
+						while (--i >= 0) if (typeof this.prerelease[i] === "number") {
+							this.prerelease[i]++;
+							i = -2;
+						}
+						if (i === -1) {
+							if (identifier === this.prerelease.join(".") && identifierBase === false) throw new Error("invalid increment argument: identifier already exists");
+							this.prerelease.push(base);
+						}
+					}
+					if (identifier) {
+						let prerelease = [identifier, base];
+						if (identifierBase === false) prerelease = [identifier];
+						if (isPrereleaseIdentifier(this.prerelease, identifier)) {
+							const prereleaseBase = this.prerelease[identifier.split(".").length];
+							if (isNaN(prereleaseBase)) this.prerelease = prerelease;
+						} else this.prerelease = prerelease;
+					}
+					break;
+				}
+				default: throw new Error(`invalid increment argument: ${release}`);
 			}
-			if (options.issuer) {
-				if (typeof options.issuer === "string" && payload.iss !== options.issuer || Array.isArray(options.issuer) && options.issuer.indexOf(payload.iss) === -1) return done(new JsonWebTokenError("jwt issuer invalid. expected: " + options.issuer));
+			this.raw = this.format();
+			if (this.build.length) this.raw += `+${this.build.join(".")}`;
+			return this;
+		}
+	};
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/parse.js
+var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var parse = (version, options, throwErrors = false) => {
+		if (version instanceof SemVer) return version;
+		try {
+			return new SemVer(version, options);
+		} catch (er) {
+			if (!throwErrors) return null;
+			throw er;
+		}
+	};
+	module.exports = parse;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/valid.js
+var require_valid$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var parse = require_parse();
+	var valid = (version, options) => {
+		const v = parse(version, options);
+		return v ? v.version : null;
+	};
+	module.exports = valid;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/clean.js
+var require_clean = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var parse = require_parse();
+	var clean = (version, options) => {
+		const s = parse(version.trim().replace(/^[=v]+/, ""), options);
+		return s ? s.version : null;
+	};
+	module.exports = clean;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/inc.js
+var require_inc = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var inc = (version, release, options, identifier, identifierBase) => {
+		if (typeof options === "string") {
+			identifierBase = identifier;
+			identifier = options;
+			options = void 0;
+		}
+		try {
+			return new SemVer(version instanceof SemVer ? version.version : version, options).inc(release, identifier, identifierBase).version;
+		} catch (er) {
+			return null;
+		}
+	};
+	module.exports = inc;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/diff.js
+var require_diff = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var parse = require_parse();
+	var diff = (version1, version2) => {
+		const v1 = parse(version1, null, true);
+		const v2 = parse(version2, null, true);
+		const comparison = v1.compare(v2);
+		if (comparison === 0) return null;
+		const v1Higher = comparison > 0;
+		const highVersion = v1Higher ? v1 : v2;
+		const lowVersion = v1Higher ? v2 : v1;
+		const highHasPre = !!highVersion.prerelease.length;
+		if (!!lowVersion.prerelease.length && !highHasPre) {
+			if (!lowVersion.patch && !lowVersion.minor) return "major";
+			if (lowVersion.compareMain(highVersion) === 0) {
+				if (lowVersion.minor && !lowVersion.patch) return "minor";
+				return "patch";
 			}
-			if (options.subject) {
+		}
+		const prefix = highHasPre ? "pre" : "";
+		if (v1.major !== v2.major) return prefix + "major";
+		if (v1.minor !== v2.minor) return prefix + "minor";
+		if (v1.patch !== v2.patch) return prefix + "patch";
+		return "prerelease";
+	};
+	module.exports = diff;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/major.js
+var require_major = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var major = (a, loose) => new SemVer(a, loose).major;
+	module.exports = major;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/minor.js
+var require_minor = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var minor = (a, loose) => new SemVer(a, loose).minor;
+	module.exports = minor;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/patch.js
+var require_patch = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var patch = (a, loose) => new SemVer(a, loose).patch;
+	module.exports = patch;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/prerelease.js
+var require_prerelease = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var parse = require_parse();
+	var prerelease = (version, options) => {
+		const parsed = parse(version, options);
+		return parsed && parsed.prerelease.length ? parsed.prerelease : null;
+	};
+	module.exports = prerelease;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/compare.js
+var require_compare = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var compare = (a, b, loose) => new SemVer(a, loose).compare(new SemVer(b, loose));
+	module.exports = compare;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/rcompare.js
+var require_rcompare = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compare = require_compare();
+	var rcompare = (a, b, loose) => compare(b, a, loose);
+	module.exports = rcompare;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/compare-loose.js
+var require_compare_loose = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compare = require_compare();
+	var compareLoose = (a, b) => compare(a, b, true);
+	module.exports = compareLoose;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/compare-build.js
+var require_compare_build = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var compareBuild = (a, b, loose) => {
+		const versionA = new SemVer(a, loose);
+		const versionB = new SemVer(b, loose);
+		return versionA.compare(versionB) || versionA.compareBuild(versionB);
+	};
+	module.exports = compareBuild;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/sort.js
+var require_sort = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compareBuild = require_compare_build();
+	var sort = (list, loose) => list.sort((a, b) => compareBuild(a, b, loose));
+	module.exports = sort;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/rsort.js
+var require_rsort = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compareBuild = require_compare_build();
+	var rsort = (list, loose) => list.sort((a, b) => compareBuild(b, a, loose));
+	module.exports = rsort;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/gt.js
+var require_gt = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compare = require_compare();
+	var gt = (a, b, loose) => compare(a, b, loose) > 0;
+	module.exports = gt;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/lt.js
+var require_lt = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compare = require_compare();
+	var lt = (a, b, loose) => compare(a, b, loose) < 0;
+	module.exports = lt;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/eq.js
+var require_eq = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compare = require_compare();
+	var eq = (a, b, loose) => compare(a, b, loose) === 0;
+	module.exports = eq;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/neq.js
+var require_neq = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compare = require_compare();
+	var neq = (a, b, loose) => compare(a, b, loose) !== 0;
+	module.exports = neq;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/gte.js
+var require_gte = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compare = require_compare();
+	var gte = (a, b, loose) => compare(a, b, loose) >= 0;
+	module.exports = gte;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/lte.js
+var require_lte = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var compare = require_compare();
+	var lte = (a, b, loose) => compare(a, b, loose) <= 0;
+	module.exports = lte;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/cmp.js
+var require_cmp = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var eq = require_eq();
+	var neq = require_neq();
+	var gt = require_gt();
+	var gte = require_gte();
+	var lt = require_lt();
+	var lte = require_lte();
+	var cmp = (a, op, b, loose) => {
+		switch (op) {
+			case "===":
+				if (typeof a === "object") a = a.version;
+				if (typeof b === "object") b = b.version;
+				return a === b;
+			case "!==":
+				if (typeof a === "object") a = a.version;
+				if (typeof b === "object") b = b.version;
+				return a !== b;
+			case "":
+			case "=":
+			case "==": return eq(a, b, loose);
+			case "!=": return neq(a, b, loose);
+			case ">": return gt(a, b, loose);
+			case ">=": return gte(a, b, loose);
+			case "<": return lt(a, b, loose);
+			case "<=": return lte(a, b, loose);
+			default: throw new TypeError(`Invalid operator: ${op}`);
+		}
+	};
+	module.exports = cmp;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/coerce.js
+var require_coerce = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var parse = require_parse();
+	var { safeRe: re, t } = require_re();
+	var coerce = (version, options) => {
+		if (version instanceof SemVer) return version;
+		if (typeof version === "number") version = String(version);
+		if (typeof version !== "string") return null;
+		options = options || {};
+		let match = null;
+		if (!options.rtl) match = version.match(options.includePrerelease ? re[t.COERCEFULL] : re[t.COERCE]);
+		else {
+			const coerceRtlRegex = options.includePrerelease ? re[t.COERCERTLFULL] : re[t.COERCERTL];
+			let next;
+			while ((next = coerceRtlRegex.exec(version)) && (!match || match.index + match[0].length !== version.length)) {
+				if (!match || next.index + next[0].length !== match.index + match[0].length) match = next;
+				coerceRtlRegex.lastIndex = next.index + next[1].length + next[2].length;
+			}
+			coerceRtlRegex.lastIndex = -1;
+		}
+		if (match === null) return null;
+		const major = match[2];
+		return parse(`${major}.${match[3] || "0"}.${match[4] || "0"}${options.includePrerelease && match[5] ? `-${match[5]}` : ""}${options.includePrerelease && match[6] ? `+${match[6]}` : ""}`, options);
+	};
+	module.exports = coerce;
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/truncate.js
+var require_truncate = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var parse = require_parse();
+	var constants = require_constants();
+	var SemVer = require_semver$1();
+	var truncate = (version, truncation, options) => {
+		if (!constants.RELEASE_TYPES.includes(truncation)) return null;
+		const clonedVersion = cloneInputVersion(version, options);
+		return clonedVersion && doTruncation(clonedVersion, truncation);
+	};
+	var cloneInputVersion = (version, options) => {
+		return parse(version instanceof SemVer ? version.version : version, options);
+	};
+	var doTruncation = (version, truncation) => {
+		if (isPrerelease(truncation)) return version.version;
+		version.prerelease = [];
+		switch (truncation) {
+			case "major":
+				version.minor = 0;
+				version.patch = 0;
+				break;
+			case "minor":
+				version.patch = 0;
+				break;
+		}
+		return version.format();
+	};
+	var isPrerelease = (type) => {
+		return type.startsWith("pre");
+	};
+	module.exports = truncate;
+}));
+//#endregion
+//#region ../../node_modules/semver/internal/lrucache.js
+var require_lrucache = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var LRUCache = class {
+		constructor() {
+			this.max = 1e3;
+			this.map = /* @__PURE__ */ new Map();
+		}
+		get(key) {
+			const value = this.map.get(key);
+			if (value === void 0) return;
+			else {
+				this.map.delete(key);
+				this.map.set(key, value);
+				return value;
+			}
+		}
+		delete(key) {
+			return this.map.delete(key);
+		}
+		set(key, value) {
+			if (!this.delete(key) && value !== void 0) {
+				if (this.map.size >= this.max) {
+					const firstKey = this.map.keys().next().value;
+					this.delete(firstKey);
+				}
+				this.map.set(key, value);
+			}
+			return this;
+		}
+	};
+	module.exports = LRUCache;
+}));
+//#endregion
+//#region ../../node_modules/semver/classes/range.js
+var require_range = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SPACE_CHARACTERS = /\s+/g;
+	module.exports = class Range {
+		constructor(range, options) {
+			options = parseOptions(options);
+			if (range instanceof Range) if (range.loose === !!options.loose && range.includePrerelease === !!options.includePrerelease) return range;
+			else return new Range(range.raw, options);
+			if (range instanceof Comparator) {
+				this.raw = range.value;
+				this.set = [[range]];
+				this.formatted = void 0;
+				return this;
+			}
+			this.options = options;
+			this.loose = !!options.loose;
+			this.includePrerelease = !!options.includePrerelease;
+			this.raw = range.trim().replace(SPACE_CHARACTERS, " ");
+			this.set = this.raw.split("||").map((r) => this.parseRange(r.trim())).filter((c) => c.length);
+			if (!this.set.length) throw new TypeError(`Invalid SemVer Range: ${this.raw}`);
+			if (this.set.length > 1) {
+				const first = this.set[0];
+				this.set = this.set.filter((c) => !isNullSet(c[0]));
+				if (this.set.length === 0) this.set = [first];
+				else if (this.set.length > 1) {
+					for (const c of this.set) if (c.length === 1 && isAny(c[0])) {
+						this.set = [c];
+						break;
+					}
+				}
+			}
+			this.formatted = void 0;
+		}
+		get range() {
+			if (this.formatted === void 0) {
+				this.formatted = "";
+				for (let i = 0; i < this.set.length; i++) {
+					if (i > 0) this.formatted += "||";
+					const comps = this.set[i];
+					for (let k = 0; k < comps.length; k++) {
+						if (k > 0) this.formatted += " ";
+						this.formatted += comps[k].toString().trim();
+					}
+				}
+			}
+			return this.formatted;
+		}
+		format() {
+			return this.range;
+		}
+		toString() {
+			return this.range;
+		}
+		parseRange(range) {
+			range = range.replace(BUILDSTRIPRE, "");
+			const memoKey = ((this.options.includePrerelease && FLAG_INCLUDE_PRERELEASE) | (this.options.loose && FLAG_LOOSE)) + ":" + range;
+			const cached = cache.get(memoKey);
+			if (cached) return cached;
+			const loose = this.options.loose;
+			const hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE];
+			range = range.replace(hr, hyphenReplace(this.options.includePrerelease));
+			debug("hyphen replace", range);
+			range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace);
+			debug("comparator trim", range);
+			range = range.replace(re[t.TILDETRIM], tildeTrimReplace);
+			debug("tilde trim", range);
+			range = range.replace(re[t.CARETTRIM], caretTrimReplace);
+			debug("caret trim", range);
+			let rangeList = range.split(" ").map((comp) => parseComparator(comp, this.options)).join(" ").split(/\s+/).map((comp) => replaceGTE0(comp, this.options));
+			if (loose) rangeList = rangeList.filter((comp) => {
+				debug("loose invalid filter", comp, this.options);
+				return !!comp.match(re[t.COMPARATORLOOSE]);
+			});
+			debug("range list", rangeList);
+			const rangeMap = /* @__PURE__ */ new Map();
+			const comparators = rangeList.map((comp) => new Comparator(comp, this.options));
+			for (const comp of comparators) {
+				if (isNullSet(comp)) return [comp];
+				rangeMap.set(comp.value, comp);
+			}
+			if (rangeMap.size > 1 && rangeMap.has("")) rangeMap.delete("");
+			const result = [...rangeMap.values()];
+			cache.set(memoKey, result);
+			return result;
+		}
+		intersects(range, options) {
+			if (!(range instanceof Range)) throw new TypeError("a Range is required");
+			return this.set.some((thisComparators) => {
+				return isSatisfiable(thisComparators, options) && range.set.some((rangeComparators) => {
+					return isSatisfiable(rangeComparators, options) && thisComparators.every((thisComparator) => {
+						return rangeComparators.every((rangeComparator) => {
+							return thisComparator.intersects(rangeComparator, options);
+						});
+					});
+				});
+			});
+		}
+		test(version) {
+			if (!version) return false;
+			if (typeof version === "string") try {
+				version = new SemVer(version, this.options);
+			} catch (er) {
+				return false;
+			}
+			for (let i = 0; i < this.set.length; i++) if (testSet(this.set[i], version, this.options)) return true;
+			return false;
+		}
+	};
+	var cache = new (require_lrucache())();
+	var parseOptions = require_parse_options();
+	var Comparator = require_comparator();
+	var debug = require_debug();
+	var SemVer = require_semver$1();
+	var { safeRe: re, src, t, comparatorTrimReplace, tildeTrimReplace, caretTrimReplace } = require_re();
+	var { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require_constants();
+	var BUILDSTRIPRE = new RegExp(src[t.BUILD], "g");
+	var isNullSet = (c) => c.value === "<0.0.0-0";
+	var isAny = (c) => c.value === "";
+	var isSatisfiable = (comparators, options) => {
+		let result = true;
+		const remainingComparators = comparators.slice();
+		let testComparator = remainingComparators.pop();
+		while (result && remainingComparators.length) {
+			result = remainingComparators.every((otherComparator) => {
+				return testComparator.intersects(otherComparator, options);
+			});
+			testComparator = remainingComparators.pop();
+		}
+		return result;
+	};
+	var parseComparator = (comp, options) => {
+		comp = comp.replace(re[t.BUILD], "");
+		debug("comp", comp, options);
+		comp = replaceCarets(comp, options);
+		debug("caret", comp);
+		comp = replaceTildes(comp, options);
+		debug("tildes", comp);
+		comp = replaceXRanges(comp, options);
+		debug("xrange", comp);
+		comp = replaceStars(comp, options);
+		debug("stars", comp);
+		return comp;
+	};
+	var isX = (id) => !id || id.toLowerCase() === "x" || id === "*";
+	var invalidXRangeOrder = (M, m, p) => isX(M) && !isX(m) || isX(m) && p && !isX(p);
+	var replaceTildes = (comp, options) => {
+		return comp.trim().split(/\s+/).map((c) => replaceTilde(c, options)).join(" ");
+	};
+	var replaceTilde = (comp, options) => {
+		const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE];
+		const z = options.includePrerelease ? "-0" : "";
+		return comp.replace(r, (_, M, m, p, pr) => {
+			debug("tilde", comp, _, M, m, p, pr);
+			let ret;
+			if (isX(M)) ret = "";
+			else if (isX(m)) ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`;
+			else if (isX(p)) ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`;
+			else if (pr) {
+				debug("replaceTilde pr", pr);
+				ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
+			} else ret = `>=${M}.${m}.${p} <${M}.${+m + 1}.0-0`;
+			debug("tilde return", ret);
+			return ret;
+		});
+	};
+	var replaceCarets = (comp, options) => {
+		return comp.trim().split(/\s+/).map((c) => replaceCaret(c, options)).join(" ");
+	};
+	var replaceCaret = (comp, options) => {
+		debug("caret", comp, options);
+		const r = options.loose ? re[t.CARETLOOSE] : re[t.CARET];
+		const z = options.includePrerelease ? "-0" : "";
+		return comp.replace(r, (_, M, m, p, pr) => {
+			debug("caret", comp, _, M, m, p, pr);
+			let ret;
+			if (isX(M)) ret = "";
+			else if (isX(m)) ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`;
+			else if (isX(p)) if (M === "0") ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`;
+			else ret = `>=${M}.${m}.0${z} <${+M + 1}.0.0-0`;
+			else if (pr) {
+				debug("replaceCaret pr", pr);
+				if (M === "0") if (m === "0") ret = `>=${M}.${m}.${p}-${pr} <${M}.${m}.${+p + 1}-0`;
+				else ret = `>=${M}.${m}.${p}-${pr} <${M}.${+m + 1}.0-0`;
+				else ret = `>=${M}.${m}.${p}-${pr} <${+M + 1}.0.0-0`;
+			} else {
+				debug("no pr");
+				if (M === "0") if (m === "0") ret = `>=${M}.${m}.${p} <${M}.${m}.${+p + 1}-0`;
+				else ret = `>=${M}.${m}.${p} <${M}.${+m + 1}.0-0`;
+				else ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
+			}
+			debug("caret return", ret);
+			return ret;
+		});
+	};
+	var replaceXRanges = (comp, options) => {
+		debug("replaceXRanges", comp, options);
+		return comp.split(/\s+/).map((c) => replaceXRange(c, options)).join(" ");
+	};
+	var replaceXRange = (comp, options) => {
+		comp = comp.trim();
+		const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE];
+		return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
+			debug("xRange", comp, ret, gtlt, M, m, p, pr);
+			if (invalidXRangeOrder(M, m, p)) return comp;
+			const xM = isX(M);
+			const xm = xM || isX(m);
+			const xp = xm || isX(p);
+			const anyX = xp;
+			if (gtlt === "=" && anyX) gtlt = "";
+			pr = options.includePrerelease ? "-0" : "";
+			if (xM) if (gtlt === ">" || gtlt === "<") ret = "<0.0.0-0";
+			else ret = "*";
+			else if (gtlt && anyX) {
+				if (xm) m = 0;
+				p = 0;
+				if (gtlt === ">") {
+					gtlt = ">=";
+					if (xm) {
+						M = +M + 1;
+						m = 0;
+						p = 0;
+					} else {
+						m = +m + 1;
+						p = 0;
+					}
+				} else if (gtlt === "<=") {
+					gtlt = "<";
+					if (xm) M = +M + 1;
+					else m = +m + 1;
+				}
+				if (gtlt === "<") pr = "-0";
+				ret = `${gtlt + M}.${m}.${p}${pr}`;
+			} else if (xm) ret = `>=${M}.0.0${pr} <${+M + 1}.0.0-0`;
+			else if (xp) ret = `>=${M}.${m}.0${pr} <${M}.${+m + 1}.0-0`;
+			debug("xRange return", ret);
+			return ret;
+		});
+	};
+	var replaceStars = (comp, options) => {
+		debug("replaceStars", comp, options);
+		return comp.trim().replace(re[t.STAR], "");
+	};
+	var replaceGTE0 = (comp, options) => {
+		debug("replaceGTE0", comp, options);
+		return comp.trim().replace(re[options.includePrerelease ? t.GTE0PRE : t.GTE0], "");
+	};
+	var hyphenReplace = (incPr) => ($0, from, fM, fm, fp, fpr, fb, to, tM, tm, tp, tpr) => {
+		if (isX(fM)) from = "";
+		else if (isX(fm)) from = `>=${fM}.0.0${incPr ? "-0" : ""}`;
+		else if (isX(fp)) from = `>=${fM}.${fm}.0${incPr ? "-0" : ""}`;
+		else if (fpr) from = `>=${from}`;
+		else from = `>=${from}${incPr ? "-0" : ""}`;
+		if (isX(tM)) to = "";
+		else if (isX(tm)) to = `<${+tM + 1}.0.0-0`;
+		else if (isX(tp)) to = `<${tM}.${+tm + 1}.0-0`;
+		else if (tpr) to = `<=${tM}.${tm}.${tp}-${tpr}`;
+		else if (incPr) to = `<${tM}.${tm}.${+tp + 1}-0`;
+		else to = `<=${to}`;
+		return `${from} ${to}`.trim();
+	};
+	var testSet = (set, version, options) => {
+		for (let i = 0; i < set.length; i++) if (!set[i].test(version)) return false;
+		if (version.prerelease.length && !options.includePrerelease) {
+			for (let i = 0; i < set.length; i++) {
+				debug(set[i].semver);
+				if (set[i].semver === Comparator.ANY) continue;
+				if (set[i].semver.prerelease.length > 0) {
+					const allowed = set[i].semver;
+					if (allowed.major === version.major && allowed.minor === version.minor && allowed.patch === version.patch) return true;
+				}
+			}
+			return false;
+		}
+		return true;
+	};
+}));
+//#endregion
+//#region ../../node_modules/semver/classes/comparator.js
+var require_comparator = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var ANY = Symbol("SemVer ANY");
+	module.exports = class Comparator {
+		static get ANY() {
+			return ANY;
+		}
+		constructor(comp, options) {
+			options = parseOptions(options);
+			if (comp instanceof Comparator) if (comp.loose === !!options.loose) return comp;
+			else comp = comp.value;
+			comp = comp.trim().split(/\s+/).join(" ");
+			debug("comparator", comp, options);
+			this.options = options;
+			this.loose = !!options.loose;
+			this.parse(comp);
+			if (this.semver === ANY) this.value = "";
+			else this.value = this.operator + this.semver.version;
+			debug("comp", this);
+		}
+		parse(comp) {
+			const r = this.options.loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR];
+			const m = comp.match(r);
+			if (!m) throw new TypeError(`Invalid comparator: ${comp}`);
+			this.operator = m[1] !== void 0 ? m[1] : "";
+			if (this.operator === "=") this.operator = "";
+			if (!m[2]) this.semver = ANY;
+			else this.semver = new SemVer(m[2], this.options.loose);
+		}
+		toString() {
+			return this.value;
+		}
+		test(version) {
+			debug("Comparator.test", version, this.options.loose);
+			if (this.semver === ANY || version === ANY) return true;
+			if (typeof version === "string") try {
+				version = new SemVer(version, this.options);
+			} catch (er) {
+				return false;
+			}
+			return cmp(version, this.operator, this.semver, this.options);
+		}
+		intersects(comp, options) {
+			if (!(comp instanceof Comparator)) throw new TypeError("a Comparator is required");
+			if (this.operator === "") {
+				if (this.value === "") return true;
+				return new Range(comp.value, options).test(this.value);
+			} else if (comp.operator === "") {
+				if (comp.value === "") return true;
+				return new Range(this.value, options).test(comp.semver);
+			}
+			options = parseOptions(options);
+			if (options.includePrerelease && (this.value === "<0.0.0-0" || comp.value === "<0.0.0-0")) return false;
+			if (!options.includePrerelease && (this.value.startsWith("<0.0.0") || comp.value.startsWith("<0.0.0"))) return false;
+			if (this.operator.startsWith(">") && comp.operator.startsWith(">")) return true;
+			if (this.operator.startsWith("<") && comp.operator.startsWith("<")) return true;
+			if (this.semver.version === comp.semver.version && this.operator.includes("=") && comp.operator.includes("=")) return true;
+			if (cmp(this.semver, "<", comp.semver, options) && this.operator.startsWith(">") && comp.operator.startsWith("<")) return true;
+			if (cmp(this.semver, ">", comp.semver, options) && this.operator.startsWith("<") && comp.operator.startsWith(">")) return true;
+			return false;
+		}
+	};
+	var parseOptions = require_parse_options();
+	var { safeRe: re, t } = require_re();
+	var cmp = require_cmp();
+	var debug = require_debug();
+	var SemVer = require_semver$1();
+	var Range = require_range();
+}));
+//#endregion
+//#region ../../node_modules/semver/functions/satisfies.js
+var require_satisfies = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var Range = require_range();
+	var satisfies = (version, range, options) => {
+		try {
+			range = new Range(range, options);
+		} catch (er) {
+			return false;
+		}
+		return range.test(version);
+	};
+	module.exports = satisfies;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/to-comparators.js
+var require_to_comparators = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var Range = require_range();
+	var toComparators = (range, options) => new Range(range, options).set.map((comp) => comp.map((c) => c.value).join(" ").trim().split(" "));
+	module.exports = toComparators;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/max-satisfying.js
+var require_max_satisfying = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var Range = require_range();
+	var maxSatisfying = (versions, range, options) => {
+		let max = null;
+		let maxSV = null;
+		let rangeObj = null;
+		try {
+			rangeObj = new Range(range, options);
+		} catch (er) {
+			return null;
+		}
+		versions.forEach((v) => {
+			if (rangeObj.test(v)) {
+				if (!max || maxSV.compare(v) === -1) {
+					max = v;
+					maxSV = new SemVer(max, options);
+				}
+			}
+		});
+		return max;
+	};
+	module.exports = maxSatisfying;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/min-satisfying.js
+var require_min_satisfying = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var Range = require_range();
+	var minSatisfying = (versions, range, options) => {
+		let min = null;
+		let minSV = null;
+		let rangeObj = null;
+		try {
+			rangeObj = new Range(range, options);
+		} catch (er) {
+			return null;
+		}
+		versions.forEach((v) => {
+			if (rangeObj.test(v)) {
+				if (!min || minSV.compare(v) === 1) {
+					min = v;
+					minSV = new SemVer(min, options);
+				}
+			}
+		});
+		return min;
+	};
+	module.exports = minSatisfying;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/min-version.js
+var require_min_version = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var Range = require_range();
+	var gt = require_gt();
+	var minVersion = (range, loose) => {
+		range = new Range(range, loose);
+		let minver = new SemVer("0.0.0");
+		if (range.test(minver)) return minver;
+		minver = new SemVer("0.0.0-0");
+		if (range.test(minver)) return minver;
+		minver = null;
+		for (let i = 0; i < range.set.length; ++i) {
+			const comparators = range.set[i];
+			let setMin = null;
+			comparators.forEach((comparator) => {
+				const compver = new SemVer(comparator.semver.version);
+				switch (comparator.operator) {
+					case ">":
+						if (compver.prerelease.length === 0) compver.patch++;
+						else compver.prerelease.push(0);
+						compver.raw = compver.format();
+					case "":
+					case ">=":
+						if (!setMin || gt(compver, setMin)) setMin = compver;
+						break;
+					case "<":
+					case "<=": break;
+					/* istanbul ignore next */
+					default: throw new Error(`Unexpected operation: ${comparator.operator}`);
+				}
+			});
+			if (setMin && (!minver || gt(minver, setMin))) minver = setMin;
+		}
+		if (minver && range.test(minver)) return minver;
+		return null;
+	};
+	module.exports = minVersion;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/valid.js
+var require_valid = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var Range = require_range();
+	var validRange = (range, options) => {
+		try {
+			return new Range(range, options).range || "*";
+		} catch (er) {
+			return null;
+		}
+	};
+	module.exports = validRange;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/outside.js
+var require_outside = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var SemVer = require_semver$1();
+	var Comparator = require_comparator();
+	var { ANY } = Comparator;
+	var Range = require_range();
+	var satisfies = require_satisfies();
+	var gt = require_gt();
+	var lt = require_lt();
+	var lte = require_lte();
+	var gte = require_gte();
+	var outside = (version, range, hilo, options) => {
+		version = new SemVer(version, options);
+		range = new Range(range, options);
+		let gtfn, ltefn, ltfn, comp, ecomp;
+		switch (hilo) {
+			case ">":
+				gtfn = gt;
+				ltefn = lte;
+				ltfn = lt;
+				comp = ">";
+				ecomp = ">=";
+				break;
+			case "<":
+				gtfn = lt;
+				ltefn = gte;
+				ltfn = gt;
+				comp = "<";
+				ecomp = "<=";
+				break;
+			default: throw new TypeError("Must provide a hilo val of \"<\" or \">\"");
+		}
+		if (satisfies(version, range, options)) return false;
+		for (let i = 0; i < range.set.length; ++i) {
+			const comparators = range.set[i];
+			let high = null;
+			let low = null;
+			comparators.forEach((comparator) => {
+				if (comparator.semver === ANY) comparator = new Comparator(">=0.0.0");
+				high = high || comparator;
+				low = low || comparator;
+				if (gtfn(comparator.semver, high.semver, options)) high = comparator;
+				else if (ltfn(comparator.semver, low.semver, options)) low = comparator;
+			});
+			if (high.operator === comp || high.operator === ecomp) return false;
+			if ((!low.operator || low.operator === comp) && ltefn(version, low.semver)) return false;
+			else if (low.operator === ecomp && ltfn(version, low.semver)) return false;
+		}
+		return true;
+	};
+	module.exports = outside;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/gtr.js
+var require_gtr = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var outside = require_outside();
+	var gtr = (version, range, options) => outside(version, range, ">", options);
+	module.exports = gtr;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/ltr.js
+var require_ltr = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var outside = require_outside();
+	var ltr = (version, range, options) => outside(version, range, "<", options);
+	module.exports = ltr;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/intersects.js
+var require_intersects = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var Range = require_range();
+	var intersects = (r1, r2, options) => {
+		r1 = new Range(r1, options);
+		r2 = new Range(r2, options);
+		return r1.intersects(r2, options);
+	};
+	module.exports = intersects;
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/simplify.js
+var require_simplify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var satisfies = require_satisfies();
+	var compare = require_compare();
+	module.exports = (versions, range, options) => {
+		const set = [];
+		let first = null;
+		let prev = null;
+		const v = versions.sort((a, b) => compare(a, b, options));
+		for (const version of v) if (satisfies(version, range, options)) {
+			prev = version;
+			if (!first) first = version;
+		} else {
+			if (prev) set.push([first, prev]);
+			prev = null;
+			first = null;
+		}
+		if (first) set.push([first, null]);
+		const ranges = [];
+		for (const [min, max] of set) if (min === max) ranges.push(min);
+		else if (!max && min === v[0]) ranges.push("*");
+		else if (!max) ranges.push(`>=${min}`);
+		else if (min === v[0]) ranges.push(`<=${max}`);
+		else ranges.push(`${min} - ${max}`);
+		const simplified = ranges.join(" || ");
+		const original = typeof range.raw === "string" ? range.raw : String(range);
+		return simplified.length < original.length ? simplified : range;
+	};
+}));
+//#endregion
+//#region ../../node_modules/semver/ranges/subset.js
+var require_subset = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var Range = require_range();
+	var Comparator = require_comparator();
+	var { ANY } = Comparator;
+	var satisfies = require_satisfies();
+	var compare = require_compare();
+	var subset = (sub, dom, options = {}) => {
+		if (sub === dom) return true;
+		sub = new Range(sub, options);
+		dom = new Range(dom, options);
+		let sawNonNull = false;
+		OUTER: for (const simpleSub of sub.set) {
+			for (const simpleDom of dom.set) {
+				const isSub = simpleSubset(simpleSub, simpleDom, options);
+				sawNonNull = sawNonNull || isSub !== null;
+				if (isSub) continue OUTER;
+			}
+			if (sawNonNull) return false;
+		}
+		return true;
+	};
+	var minimumVersionWithPreRelease = [new Comparator(">=0.0.0-0")];
+	var minimumVersion = [new Comparator(">=0.0.0")];
+	var simpleSubset = (sub, dom, options) => {
+		if (sub === dom) return true;
+		if (sub.length === 1 && sub[0].semver === ANY) if (dom.length === 1 && dom[0].semver === ANY) return true;
+		else if (options.includePrerelease) sub = minimumVersionWithPreRelease;
+		else sub = minimumVersion;
+		if (dom.length === 1 && dom[0].semver === ANY) if (options.includePrerelease) return true;
+		else dom = minimumVersion;
+		const eqSet = /* @__PURE__ */ new Set();
+		let gt, lt;
+		for (const c of sub) if (c.operator === ">" || c.operator === ">=") gt = higherGT(gt, c, options);
+		else if (c.operator === "<" || c.operator === "<=") lt = lowerLT(lt, c, options);
+		else eqSet.add(c.semver);
+		if (eqSet.size > 1) return null;
+		let gtltComp;
+		if (gt && lt) {
+			gtltComp = compare(gt.semver, lt.semver, options);
+			if (gtltComp > 0) return null;
+			else if (gtltComp === 0 && (gt.operator !== ">=" || lt.operator !== "<=")) return null;
+		}
+		for (const eq of eqSet) {
+			if (gt && !satisfies(eq, String(gt), options)) return null;
+			if (lt && !satisfies(eq, String(lt), options)) return null;
+			for (const c of dom) if (!satisfies(eq, String(c), options)) return false;
+			return true;
+		}
+		let higher, lower;
+		let hasDomLT, hasDomGT;
+		let needDomLTPre = lt && !options.includePrerelease && lt.semver.prerelease.length ? lt.semver : false;
+		let needDomGTPre = gt && !options.includePrerelease && gt.semver.prerelease.length ? gt.semver : false;
+		if (needDomLTPre && needDomLTPre.prerelease.length === 1 && lt.operator === "<" && needDomLTPre.prerelease[0] === 0) needDomLTPre = false;
+		for (const c of dom) {
+			hasDomGT = hasDomGT || c.operator === ">" || c.operator === ">=";
+			hasDomLT = hasDomLT || c.operator === "<" || c.operator === "<=";
+			if (gt) {
+				if (needDomGTPre) {
+					if (c.semver.prerelease && c.semver.prerelease.length && c.semver.major === needDomGTPre.major && c.semver.minor === needDomGTPre.minor && c.semver.patch === needDomGTPre.patch) needDomGTPre = false;
+				}
+				if (c.operator === ">" || c.operator === ">=") {
+					higher = higherGT(gt, c, options);
+					if (higher === c && higher !== gt) return false;
+				} else if (gt.operator === ">=" && !c.test(gt.semver)) return false;
+			}
+			if (lt) {
+				if (needDomLTPre) {
+					if (c.semver.prerelease && c.semver.prerelease.length && c.semver.major === needDomLTPre.major && c.semver.minor === needDomLTPre.minor && c.semver.patch === needDomLTPre.patch) needDomLTPre = false;
+				}
+				if (c.operator === "<" || c.operator === "<=") {
+					lower = lowerLT(lt, c, options);
+					if (lower === c && lower !== lt) return false;
+				} else if (lt.operator === "<=" && !c.test(lt.semver)) return false;
+			}
+			if (!c.operator && (lt || gt) && gtltComp !== 0) return false;
+		}
+		if (gt && hasDomLT && !lt && gtltComp !== 0) return false;
+		if (lt && hasDomGT && !gt && gtltComp !== 0) return false;
+		if (needDomGTPre || needDomLTPre) return false;
+		return true;
+	};
+	var higherGT = (a, b, options) => {
+		if (!a) return b;
+		const comp = compare(a.semver, b.semver, options);
+		return comp > 0 ? a : comp < 0 ? b : b.operator === ">" && a.operator === ">=" ? b : a;
+	};
+	var lowerLT = (a, b, options) => {
+		if (!a) return b;
+		const comp = compare(a.semver, b.semver, options);
+		return comp < 0 ? a : comp > 0 ? b : b.operator === "<" && a.operator === "<=" ? b : a;
+	};
+	module.exports = subset;
+}));
+//#endregion
+//#region ../../node_modules/semver/index.js
+var require_semver = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var internalRe = require_re();
+	var constants = require_constants();
+	var SemVer = require_semver$1();
+	var identifiers = require_identifiers();
+	module.exports = {
+		parse: require_parse(),
+		valid: require_valid$1(),
+		clean: require_clean(),
+		inc: require_inc(),
+		diff: require_diff(),
+		major: require_major(),
+		minor: require_minor(),
+		patch: require_patch(),
+		prerelease: require_prerelease(),
+		compare: require_compare(),
+		rcompare: require_rcompare(),
+		compareLoose: require_compare_loose(),
+		compareBuild: require_compare_build(),
+		sort: require_sort(),
+		rsort: require_rsort(),
+		gt: require_gt(),
+		lt: require_lt(),
+		eq: require_eq(),
+		neq: require_neq(),
+		gte: require_gte(),
+		lte: require_lte(),
+		cmp: require_cmp(),
+		coerce: require_coerce(),
+		truncate: require_truncate(),
+		Comparator: require_comparator(),
+		Range: require_range(),
+		satisfies: require_satisfies(),
+		toComparators: require_to_comparators(),
+		maxSatisfying: require_max_satisfying(),
+		minSatisfying: require_min_satisfying(),
+		minVersion: require_min_version(),
+		validRange: require_valid(),
+		outside: require_outside(),
+		gtr: require_gtr(),
+		ltr: require_ltr(),
+		intersects: require_intersects(),
+		simplifyRange: require_simplify(),
+		subset: require_subset(),
+		SemVer,
+		re: internalRe.re,
+		src: internalRe.src,
+		tokens: internalRe.t,
+		SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
+		RELEASE_TYPES: constants.RELEASE_TYPES,
+		compareIdentifiers: identifiers.compareIdentifiers,
+		rcompareIdentifiers: identifiers.rcompareIdentifiers
+	};
+}));
+//#endregion
+//#region ../../node_modules/jsonwebtoken/lib/asymmetricKeyDetailsSupported.js
+var require_asymmetricKeyDetailsSupported = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = require_semver().satisfies(process.version, ">=15.7.0");
+}));
+//#endregion
+//#region ../../node_modules/jsonwebtoken/lib/rsaPssKeyDetailsSupported.js
+var require_rsaPssKeyDetailsSupported = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = require_semver().satisfies(process.version, ">=16.9.0");
+}));
+//#endregion
+//#region ../../node_modules/jsonwebtoken/lib/validateAsymmetricKey.js
+var require_validateAsymmetricKey = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var ASYMMETRIC_KEY_DETAILS_SUPPORTED = require_asymmetricKeyDetailsSupported();
+	var RSA_PSS_KEY_DETAILS_SUPPORTED = require_rsaPssKeyDetailsSupported();
+	var allowedAlgorithmsForKeys = {
+		"ec": [
+			"ES256",
+			"ES384",
+			"ES512"
+		],
+		"rsa": [
+			"RS256",
+			"PS256",
+			"RS384",
+			"PS384",
+			"RS512",
+			"PS512"
+		],
+		"rsa-pss": [
+			"PS256",
+			"PS384",
+			"PS512"
+		]
+	};
+	var allowedCurves = {
+		ES256: "prime256v1",
+		ES384: "secp384r1",
+		ES512: "secp521r1"
+	};
+	module.exports = function(algorithm, key) {
+		if (!algorithm || !key) return;
+		const keyType = key.asymmetricKeyType;
+		if (!keyType) return;
+		const allowedAlgorithms = allowedAlgorithmsForKeys[keyType];
+		if (!allowedAlgorithms) throw new Error(`Unknown key type "${keyType}".`);
+		if (!allowedAlgorithms.includes(algorithm)) throw new Error(`"alg" parameter for "${keyType}" key type must be one of: ${allowedAlgorithms.join(", ")}.`);
+		/* istanbul ignore next */
+		if (ASYMMETRIC_KEY_DETAILS_SUPPORTED) switch (keyType) {
+			case "ec":
+				const keyCurve = key.asymmetricKeyDetails.namedCurve;
+				const allowedCurve = allowedCurves[algorithm];
+				if (keyCurve !== allowedCurve) throw new Error(`"alg" parameter "${algorithm}" requires curve "${allowedCurve}".`);
+				break;
+			case "rsa-pss":
+				if (RSA_PSS_KEY_DETAILS_SUPPORTED) {
+					const length = parseInt(algorithm.slice(-3), 10);
+					const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
+					if (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm) throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${algorithm}.`);
+					if (saltLength !== void 0 && saltLength > length >> 3) throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${algorithm}.`);
+				}
+				break;
+		}
+	};
+}));
+//#endregion
+//#region ../../node_modules/jsonwebtoken/lib/psSupported.js
+var require_psSupported = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = require_semver().satisfies(process.version, "^6.12.0 || >=8.0.0");
+}));
+//#endregion
+//#region ../../node_modules/jsonwebtoken/verify.js
+var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var JsonWebTokenError = require_JsonWebTokenError();
+	var NotBeforeError = require_NotBeforeError();
+	var TokenExpiredError = require_TokenExpiredError();
+	var decode = require_decode();
+	var timespan = require_timespan();
+	var validateAsymmetricKey = require_validateAsymmetricKey();
+	var PS_SUPPORTED = require_psSupported();
+	var jws = require_jws();
+	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey } = __require("crypto");
+	var PUB_KEY_ALGS = [
+		"RS256",
+		"RS384",
+		"RS512"
+	];
+	var EC_KEY_ALGS = [
+		"ES256",
+		"ES384",
+		"ES512"
+	];
+	var RSA_KEY_ALGS = [
+		"RS256",
+		"RS384",
+		"RS512"
+	];
+	var HS_ALGS = [
+		"HS256",
+		"HS384",
+		"HS512"
+	];
+	if (PS_SUPPORTED) {
+		PUB_KEY_ALGS.splice(PUB_KEY_ALGS.length, 0, "PS256", "PS384", "PS512");
+		RSA_KEY_ALGS.splice(RSA_KEY_ALGS.length, 0, "PS256", "PS384", "PS512");
+	}
+	module.exports = function(jwtString, secretOrPublicKey, options, callback) {
+		if (typeof options === "function" && !callback) {
+			callback = options;
+			options = {};
+		}
+		if (!options) options = {};
+		options = Object.assign({}, options);
+		let done;
+		if (callback) done = callback;
+		else done = function(err, data) {
+			if (err) throw err;
+			return data;
+		};
+		if (options.clockTimestamp && typeof options.clockTimestamp !== "number") return done(new JsonWebTokenError("clockTimestamp must be a number"));
+		if (options.nonce !== void 0 && (typeof options.nonce !== "string" || options.nonce.trim() === "")) return done(new JsonWebTokenError("nonce must be a non-empty string"));
+		if (options.allowInvalidAsymmetricKeyTypes !== void 0 && typeof options.allowInvalidAsymmetricKeyTypes !== "boolean") return done(new JsonWebTokenError("allowInvalidAsymmetricKeyTypes must be a boolean"));
+		const clockTimestamp = options.clockTimestamp || Math.floor(Date.now() / 1e3);
+		if (!jwtString) return done(new JsonWebTokenError("jwt must be provided"));
+		if (typeof jwtString !== "string") return done(new JsonWebTokenError("jwt must be a string"));
+		const parts = jwtString.split(".");
+		if (parts.length !== 3) return done(new JsonWebTokenError("jwt malformed"));
+		let decodedToken;
+		try {
+			decodedToken = decode(jwtString, { complete: true });
+		} catch (err) {
+			return done(err);
+		}
+		if (!decodedToken) return done(new JsonWebTokenError("invalid token"));
+		const header = decodedToken.header;
+		let getSecret;
+		if (typeof secretOrPublicKey === "function") {
+			if (!callback) return done(new JsonWebTokenError("verify must be called asynchronous if secret or public key is provided as a callback"));
+			getSecret = secretOrPublicKey;
+		} else getSecret = function(header, secretCallback) {
+			return secretCallback(null, secretOrPublicKey);
+		};
+		return getSecret(header, function(err, secretOrPublicKey) {
+			if (err) return done(new JsonWebTokenError("error in secret or public key callback: " + err.message));
+			const hasSignature = parts[2].trim() !== "";
+			if (!hasSignature && secretOrPublicKey) return done(new JsonWebTokenError("jwt signature is required"));
+			if (hasSignature && !secretOrPublicKey) return done(new JsonWebTokenError("secret or public key must be provided"));
+			if (!hasSignature && !options.algorithms) return done(new JsonWebTokenError("please specify \"none\" in \"algorithms\" to verify unsigned tokens"));
+			if (secretOrPublicKey != null && !(secretOrPublicKey instanceof KeyObject$1)) try {
+				secretOrPublicKey = createPublicKey(secretOrPublicKey);
+			} catch (_) {
+				try {
+					secretOrPublicKey = createSecretKey$1(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
+				} catch (_) {
+					return done(new JsonWebTokenError("secretOrPublicKey is not valid key material"));
+				}
+			}
+			if (!options.algorithms) if (secretOrPublicKey.type === "secret") options.algorithms = HS_ALGS;
+			else if (["rsa", "rsa-pss"].includes(secretOrPublicKey.asymmetricKeyType)) options.algorithms = RSA_KEY_ALGS;
+			else if (secretOrPublicKey.asymmetricKeyType === "ec") options.algorithms = EC_KEY_ALGS;
+			else options.algorithms = PUB_KEY_ALGS;
+			if (options.algorithms.indexOf(decodedToken.header.alg) === -1) return done(new JsonWebTokenError("invalid algorithm"));
+			if (header.alg.startsWith("HS") && secretOrPublicKey.type !== "secret") return done(new JsonWebTokenError(`secretOrPublicKey must be a symmetric key when using ${header.alg}`));
+			else if (/^(?:RS|PS|ES)/.test(header.alg) && secretOrPublicKey.type !== "public") return done(new JsonWebTokenError(`secretOrPublicKey must be an asymmetric key when using ${header.alg}`));
+			if (!options.allowInvalidAsymmetricKeyTypes) try {
+				validateAsymmetricKey(header.alg, secretOrPublicKey);
+			} catch (e) {
+				return done(e);
+			}
+			let valid;
+			try {
+				valid = jws.verify(jwtString, decodedToken.header.alg, secretOrPublicKey);
+			} catch (e) {
+				return done(e);
+			}
+			if (!valid) return done(new JsonWebTokenError("invalid signature"));
+			const payload = decodedToken.payload;
+			if (typeof payload.nbf !== "undefined" && !options.ignoreNotBefore) {
+				if (typeof payload.nbf !== "number") return done(new JsonWebTokenError("invalid nbf value"));
+				if (payload.nbf > clockTimestamp + (options.clockTolerance || 0)) return done(new NotBeforeError("jwt not active", /* @__PURE__ */ new Date(payload.nbf * 1e3)));
+			}
+			if (typeof payload.exp !== "undefined" && !options.ignoreExpiration) {
+				if (typeof payload.exp !== "number") return done(new JsonWebTokenError("invalid exp value"));
+				if (clockTimestamp >= payload.exp + (options.clockTolerance || 0)) return done(new TokenExpiredError("jwt expired", /* @__PURE__ */ new Date(payload.exp * 1e3)));
+			}
+			if (options.audience) {
+				const audiences = Array.isArray(options.audience) ? options.audience : [options.audience];
+				if (!(Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some(function(targetAudience) {
+					return audiences.some(function(audience) {
+						return audience instanceof RegExp ? audience.test(targetAudience) : audience === targetAudience;
+					});
+				})) return done(new JsonWebTokenError("jwt audience invalid. expected: " + audiences.join(" or ")));
+			}
+			if (options.issuer) {
+				if (typeof options.issuer === "string" && payload.iss !== options.issuer || Array.isArray(options.issuer) && options.issuer.indexOf(payload.iss) === -1) return done(new JsonWebTokenError("jwt issuer invalid. expected: " + options.issuer));
+			}
+			if (options.subject) {
 				if (payload.sub !== options.subject) return done(new JsonWebTokenError("jwt subject invalid. expected: " + options.subject));
 			}
 			if (options.jwtid) {
@@ -2640,7 +4176,7 @@ var randomFallback = null;
 * @throws {Error} If no random implementation is available
 * @inner
 */
-function randomBytes$1(len) {
+function randomBytes$2(len) {
 	try {
 		return crypto.getRandomValues(new Uint8Array(len));
 	} catch {}
@@ -2667,7 +4203,7 @@ function genSaltSync(rounds, seed_length) {
 	if (rounds < 10) salt.push("0");
 	salt.push(rounds.toString());
 	salt.push("$");
-	salt.push(base64_encode(randomBytes$1(BCRYPT_SALT_LEN), BCRYPT_SALT_LEN));
+	salt.push(base64_encode(randomBytes$2(BCRYPT_SALT_LEN), BCRYPT_SALT_LEN));
 	return salt.join("");
 }
 /**
@@ -4440,7 +5976,7 @@ var AuthManager = class {
 		const configured = this.config.get("auth.jwtSecret");
 		if (configured) this.jwtSecret = configured;
 		else {
-			const secret = crypto$2.randomBytes(32).toString("hex");
+			const secret = crypto$1.randomBytes(32).toString("hex");
 			this.config.update("auth", { jwtSecret: secret });
 			this.logger.info("Generated JWT secret and saved to config.yaml (auth.jwtSecret)");
 			this.jwtSecret = secret;
@@ -4461,15 +5997,15 @@ var AuthManager = class {
 		return compare(password, hash);
 	}
 	generateApiKey() {
-		const token = crypto$2.randomBytes(32).toString("hex");
+		const token = crypto$1.randomBytes(32).toString("hex");
 		return {
 			token,
-			hash: crypto$2.createHash("sha256").update(token).digest("hex"),
+			hash: crypto$1.createHash("sha256").update(token).digest("hex"),
 			prefix: token.slice(0, 8)
 		};
 	}
 	validateApiKey(token, storedHash) {
-		return crypto$2.createHash("sha256").update(token).digest("hex") === storedHash;
+		return crypto$1.createHash("sha256").update(token).digest("hex") === storedHash;
 	}
 	/**
 	* Create a service token for agent/worker authentication.
@@ -4645,7 +6181,7 @@ var UserManager = class {
 		const passwordHash = await this.auth.hashPassword(input.password);
 		const now = Date.now();
 		const record = {
-			id: crypto$2.randomUUID(),
+			id: crypto$1.randomUUID(),
 			username: input.username,
 			passwordHash,
 			isAdmin: input.isAdmin ?? false,
@@ -4762,7 +6298,7 @@ var ApiKeyManager = class {
 		const { token: rawToken, hash, prefix } = this.auth.generateApiKey();
 		const now = Date.now();
 		const record = {
-			id: crypto$2.randomUUID(),
+			id: crypto$1.randomUUID(),
 			label: input.label,
 			isAdmin: input.isAdmin ?? false,
 			allowedProviders: input.allowedProviders ?? "*",
@@ -4839,11 +6375,11 @@ var ScopedTokenManager = class {
 		this.store = store;
 	}
 	async create(userId, name, scopes, expiresAt) {
-		const rawToken = `${TOKEN_PREFIX}${crypto$2.randomBytes(32).toString("hex")}`;
-		const tokenHash = crypto$2.createHash("sha256").update(rawToken).digest("hex");
+		const rawToken = `${TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("hex")}`;
+		const tokenHash = crypto$1.createHash("sha256").update(rawToken).digest("hex");
 		const tokenPrefix = rawToken.slice(0, 12);
 		const record = {
-			id: crypto$2.randomUUID(),
+			id: crypto$1.randomUUID(),
 			userId,
 			name,
 			tokenHash,
@@ -4867,7 +6403,7 @@ var ScopedTokenManager = class {
 	}
 	async validate(rawToken) {
 		if (!rawToken.startsWith(TOKEN_PREFIX)) return null;
-		const tokenHash = crypto$2.createHash("sha256").update(rawToken).digest("hex");
+		const tokenHash = crypto$1.createHash("sha256").update(rawToken).digest("hex");
 		const results = await this.store.query.query({
 			collection: TOKENS_COLLECTION,
 			filter: { where: { tokenHash } }
@@ -5011,7 +6547,7 @@ var OauthSessionManager = class {
 	async create(input) {
 		const now = Date.now();
 		const session = {
-			id: crypto$2.randomUUID(),
+			id: crypto$1.randomUUID(),
 			userId: input.userId,
 			username: input.username,
 			integrationId: input.integrationId,
@@ -5090,682 +6626,2144 @@ var OauthSessionManager = class {
 			data: { ...updated }
 		});
 	}
+}, i$2 = class extends Error {
+	constructor(e, t) {
+		super(e, t), this.name = "OTPError";
+	}
+}, G$3 = class extends i$2 {
+	constructor(e) {
+		super(e), this.name = "PluginError";
+	}
+}, Y$3 = class extends G$3 {
+	constructor() {
+		super("Crypto plugin is required."), this.name = "CryptoPluginMissingError";
+	}
+}, L$2 = class extends G$3 {
+	constructor() {
+		super("Base32 plugin is required."), this.name = "Base32PluginMissingError";
+	}
+}, a$2 = class extends i$2 {
+	constructor(e) {
+		super(e), this.name = "ConfigurationError";
+	}
 };
-//#endregion
-//#region ../../node_modules/@otplib/plugin-crypto/index.js
-/**
-* @otplib/plugin-crypto
-*
-* @author Gerald Yeo <contact@fusedthought.com>
-* @version: 12.0.1
-* @license: MIT
-**/
-var require_plugin_crypto = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	function _interopDefault(ex) {
-		return ex && typeof ex === "object" && "default" in ex ? ex["default"] : ex;
-	}
-	var crypto$1 = _interopDefault(__require("crypto"));
-	var createDigest = (algorithm, hmacKey, counter) => {
-		return crypto$1.createHmac(algorithm, Buffer.from(hmacKey, "hex")).update(Buffer.from(counter, "hex")).digest().toString("hex");
+new TextEncoder();
+new TextDecoder();
+var ur$3 = 3600, pr$3 = Number.MAX_SAFE_INTEGER, er$3 = Symbol("otplib.guardrails.override");
+function y$2(r, e, t) {
+	if (typeof e != "number" || !Number.isSafeInteger(e)) throw new a$2(`Guardrail '${r}' must be a safe integer`);
+	if (e < t) throw new a$2(`Guardrail '${r}' must be >= ${t}`);
+}
+var d$5 = Object.freeze({
+	MIN_SECRET_BYTES: 16,
+	MAX_SECRET_BYTES: 64,
+	MIN_PERIOD: 1,
+	MAX_PERIOD: ur$3,
+	MAX_COUNTER: pr$3,
+	MAX_WINDOW: 99,
+	[er$3]: !1
+});
+function hr$2(r) {
+	if (!r) return d$5;
+	r.MIN_SECRET_BYTES !== void 0 && y$2("MIN_SECRET_BYTES", r.MIN_SECRET_BYTES, 1), r.MAX_SECRET_BYTES !== void 0 && y$2("MAX_SECRET_BYTES", r.MAX_SECRET_BYTES, 1), r.MIN_PERIOD !== void 0 && y$2("MIN_PERIOD", r.MIN_PERIOD, 1), r.MAX_PERIOD !== void 0 && y$2("MAX_PERIOD", r.MAX_PERIOD, 1), r.MAX_COUNTER !== void 0 && y$2("MAX_COUNTER", r.MAX_COUNTER, 0), r.MAX_WINDOW !== void 0 && y$2("MAX_WINDOW", r.MAX_WINDOW, 1);
+	let e = {
+		...d$5,
+		...r
 	};
-	var createRandomBytes = (size, encoding) => {
-		return crypto$1.randomBytes(size).toString(encoding);
+	if (e.MIN_SECRET_BYTES > e.MAX_SECRET_BYTES) throw new a$2("Guardrail 'MIN_SECRET_BYTES' must be <= 'MAX_SECRET_BYTES'");
+	if (e.MIN_PERIOD > e.MAX_PERIOD) throw new a$2("Guardrail 'MIN_PERIOD' must be <= 'MAX_PERIOD'");
+	return Object.freeze({
+		...e,
+		[er$3]: !0
+	});
+}
+function Dr(r) {
+	let { crypto: e, base32: t, length: o = 20 } = r;
+	dr$2(e), nr$2(t);
+	let n = e.randomBytes(o);
+	return t.encode(n, { padding: !1 });
+}
+function dr$2(r) {
+	if (!r) throw new Y$3();
+}
+function nr$2(r) {
+	if (!r) throw new L$2();
+}
+//#endregion
+//#region ../../node_modules/@otplib/hotp/node_modules/@otplib/core/dist/index.js
+var i$1 = class extends Error {
+	constructor(e, t) {
+		super(e, t), this.name = "OTPError";
+	}
+}, x$2 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "SecretError";
+	}
+}, h$1 = class extends x$2 {
+	constructor(e, t) {
+		super(`Secret must be at least ${e} bytes (${e * 8} bits), got ${t} bytes`), this.name = "SecretTooShortError";
+	}
+}, P$1 = class extends x$2 {
+	constructor(e, t) {
+		super(`Secret must not exceed ${e} bytes, got ${t} bytes`), this.name = "SecretTooLongError";
+	}
+}, m$2 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "CounterError";
+	}
+}, O$2 = class extends m$2 {
+	constructor() {
+		super("Counter must be non-negative"), this.name = "CounterNegativeError";
+	}
+}, T$2 = class extends m$2 {
+	constructor() {
+		super("Counter exceeds maximum safe integer value"), this.name = "CounterOverflowError";
+	}
+}, b$2 = class extends m$2 {
+	constructor() {
+		super("Counter must be a finite integer"), this.name = "CounterNotIntegerError";
+	}
+}, R$2 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "TokenError";
+	}
+}, I$2 = class extends R$2 {
+	constructor(e, t) {
+		super(`Token must be ${e} digits, got ${t}`), this.name = "TokenLengthError";
+	}
+}, M$1 = class extends R$2 {
+	constructor() {
+		super("Token must contain only digits"), this.name = "TokenFormatError";
+	}
+}, N$1 = class extends i$1 {
+	constructor(e, t) {
+		super(e, t), this.name = "CryptoError";
+	}
+}, c$2 = class extends N$1 {
+	constructor(e, t) {
+		super(`HMAC computation failed: ${e}`, t), this.name = "HMACError";
+	}
+}, v$2 = class extends N$1 {
+	constructor(e, t) {
+		super(`Random byte generation failed: ${e}`, t), this.name = "RandomBytesError";
+	}
+}, g$1 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "CounterToleranceError";
+	}
+}, U$2 = class extends g$1 {
+	constructor(e, t) {
+		super(`Counter tolerance validation failed: total checks (${t}) exceeds MAX_WINDOW (${e})`), this.name = "CounterToleranceTooLargeError";
+	}
+}, X$1 = class extends g$1 {
+	constructor() {
+		super("Counter tolerance cannot contain negative values"), this.name = "CounterToleranceNegativeError";
+	}
+}, G$2 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "PluginError";
+	}
+}, Y$2 = class extends G$2 {
+	constructor() {
+		super("Crypto plugin is required."), this.name = "CryptoPluginMissingError";
+	}
+}, L$1 = class extends G$2 {
+	constructor() {
+		super("Base32 plugin is required."), this.name = "Base32PluginMissingError";
+	}
+}, a$1 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "ConfigurationError";
+	}
+}, W$1 = class extends a$1 {
+	constructor() {
+		super("Secret is required. Use generateSecret() to create one, or provide via { secret: 'YOUR_BASE32_SECRET' }"), this.name = "SecretMissingError";
+	}
+};
+new TextEncoder();
+new TextDecoder();
+var ur$2 = 3600, pr$2 = Number.MAX_SAFE_INTEGER, er$2 = Symbol("otplib.guardrails.override");
+function y$1(r, e, t) {
+	if (typeof e != "number" || !Number.isSafeInteger(e)) throw new a$1(`Guardrail '${r}' must be a safe integer`);
+	if (e < t) throw new a$1(`Guardrail '${r}' must be >= ${t}`);
+}
+var d$4 = Object.freeze({
+	MIN_SECRET_BYTES: 16,
+	MAX_SECRET_BYTES: 64,
+	MIN_PERIOD: 1,
+	MAX_PERIOD: ur$2,
+	MAX_COUNTER: pr$2,
+	MAX_WINDOW: 99,
+	[er$2]: !1
+});
+function hr$1(r) {
+	if (!r) return d$4;
+	r.MIN_SECRET_BYTES !== void 0 && y$1("MIN_SECRET_BYTES", r.MIN_SECRET_BYTES, 1), r.MAX_SECRET_BYTES !== void 0 && y$1("MAX_SECRET_BYTES", r.MAX_SECRET_BYTES, 1), r.MIN_PERIOD !== void 0 && y$1("MIN_PERIOD", r.MIN_PERIOD, 1), r.MAX_PERIOD !== void 0 && y$1("MAX_PERIOD", r.MAX_PERIOD, 1), r.MAX_COUNTER !== void 0 && y$1("MAX_COUNTER", r.MAX_COUNTER, 0), r.MAX_WINDOW !== void 0 && y$1("MAX_WINDOW", r.MAX_WINDOW, 1);
+	let e = {
+		...d$4,
+		...r
 	};
-	exports.createDigest = createDigest;
-	exports.createRandomBytes = createRandomBytes;
-}));
+	if (e.MIN_SECRET_BYTES > e.MAX_SECRET_BYTES) throw new a$1("Guardrail 'MIN_SECRET_BYTES' must be <= 'MAX_SECRET_BYTES'");
+	if (e.MIN_PERIOD > e.MAX_PERIOD) throw new a$1("Guardrail 'MIN_PERIOD' must be <= 'MAX_PERIOD'");
+	return Object.freeze({
+		...e,
+		[er$2]: !0
+	});
+}
+function Or$1(r, e = d$4) {
+	if (r.length < e.MIN_SECRET_BYTES) throw new h$1(e.MIN_SECRET_BYTES, r.length);
+	if (r.length > e.MAX_SECRET_BYTES) throw new P$1(e.MAX_SECRET_BYTES, r.length);
+}
+function br(r, e = d$4) {
+	if (typeof r == "number") {
+		if (!Number.isFinite(r) || !Number.isInteger(r)) throw new b$2();
+		if (!Number.isSafeInteger(r)) throw new T$2();
+	}
+	let t = typeof r == "bigint" ? r : BigInt(r);
+	if (t < 0n) throw new O$2();
+	if (t > BigInt(e.MAX_COUNTER)) throw new T$2();
+}
+function Sr$1(r, e) {
+	if (r.length !== e) throw new I$2(e, r.length);
+	if (!/^\d+$/.test(r)) throw new M$1();
+}
+function Br(r, e = d$4) {
+	let [t, o] = Er(r);
+	if (!Number.isSafeInteger(t) || !Number.isSafeInteger(o)) throw new g$1("Counter tolerance values must be safe integers");
+	if (t < 0 || o < 0) throw new X$1();
+	let n = t + o + 1;
+	if (n > e.MAX_WINDOW) throw new U$2(e.MAX_WINDOW, n);
+}
+function _r(r) {
+	let e = typeof r == "bigint" ? r : BigInt(r), t = /* @__PURE__ */ new ArrayBuffer(8);
+	return new DataView(t).setBigUint64(0, e, !1), new Uint8Array(t);
+}
+function Rr(r) {
+	let e = r[r.length - 1] & 15;
+	return (r[e] & 127) << 24 | r[e + 1] << 16 | r[e + 2] << 8 | r[e + 3];
+}
+function Ir(r, e) {
+	return (r % 10 ** e).toString().padStart(e, "0");
+}
+function vr$1(r, e) {
+	return typeof r == "string" ? (nr$1(e), e.decode(r)) : r;
+}
+function Er(r = 0) {
+	return Array.isArray(r) ? r : [0, r];
+}
+function dr$1(r) {
+	if (!r) throw new Y$2();
+}
+function nr$1(r) {
+	if (!r) throw new L$1();
+}
+function Xr$1(r) {
+	if (!r) throw new W$1();
+}
+var K = class {
+	constructor(e) {
+		this.crypto = e;
+	}
+	get plugin() {
+		return this.crypto;
+	}
+	async hmac(e, t, o) {
+		try {
+			let n = this.crypto.hmac(e, t, o);
+			return n instanceof Promise ? await n : n;
+		} catch (n) {
+			throw new c$2(n instanceof Error ? n.message : String(n), { cause: n });
+		}
+	}
+	hmacSync(e, t, o) {
+		try {
+			let n = this.crypto.hmac(e, t, o);
+			if (n instanceof Promise) throw new c$2("Crypto plugin does not support synchronous HMAC operations");
+			return n;
+		} catch (n) {
+			if (n instanceof c$2) throw n;
+			throw new c$2(n instanceof Error ? n.message : String(n), { cause: n });
+		}
+	}
+	randomBytes(e) {
+		try {
+			return this.crypto.randomBytes(e);
+		} catch (t) {
+			throw new v$2(t instanceof Error ? t.message : String(t), { cause: t });
+		}
+	}
+};
+function Wr(r) {
+	return new K(r);
+}
 //#endregion
-//#region ../../node_modules/thirty-two/lib/thirty-two/thirty-two.js
-var require_thirty_two$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
-	var charTable = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-	var byteTable = [
-		255,
-		255,
-		26,
-		27,
-		28,
-		29,
-		30,
-		31,
-		255,
-		255,
-		255,
-		255,
-		255,
-		255,
-		255,
-		255,
-		255,
-		0,
-		1,
-		2,
-		3,
-		4,
-		5,
-		6,
-		7,
-		8,
-		9,
-		10,
-		11,
-		12,
-		13,
-		14,
-		15,
-		16,
-		17,
-		18,
-		19,
-		20,
-		21,
-		22,
-		23,
-		24,
-		25,
-		255,
-		255,
-		255,
-		255,
-		255,
-		255,
-		0,
-		1,
-		2,
-		3,
-		4,
-		5,
-		6,
-		7,
-		8,
-		9,
-		10,
-		11,
-		12,
-		13,
-		14,
-		15,
-		16,
-		17,
-		18,
-		19,
-		20,
-		21,
-		22,
-		23,
-		24,
-		25,
-		255,
-		255,
-		255,
-		255,
-		255
-	];
-	function quintetCount(buff) {
-		var quintets = Math.floor(buff.length / 5);
-		return buff.length % 5 === 0 ? quintets : quintets + 1;
-	}
-	exports.encode = function(plain) {
-		if (!Buffer.isBuffer(plain)) plain = new Buffer(plain);
-		var i = 0;
-		var j = 0;
-		var shiftIndex = 0;
-		var digit = 0;
-		var encoded = new Buffer(quintetCount(plain) * 8);
-		while (i < plain.length) {
-			var current = plain[i];
-			if (shiftIndex > 3) {
-				digit = current & 255 >> shiftIndex;
-				shiftIndex = (shiftIndex + 5) % 8;
-				digit = digit << shiftIndex | (i + 1 < plain.length ? plain[i + 1] : 0) >> 8 - shiftIndex;
-				i++;
-			} else {
-				digit = current >> 8 - (shiftIndex + 5) & 31;
-				shiftIndex = (shiftIndex + 5) % 8;
-				if (shiftIndex === 0) i++;
-			}
-			encoded[j] = charTable.charCodeAt(digit);
-			j++;
+//#region ../../node_modules/@otplib/uri/dist/index.js
+function m$1(r) {
+	let { type: e, label: s, params: t } = r, o = `otpauth://${e}/${s.split(":").map((c) => encodeURIComponent(c)).join(":")}?`, n = [];
+	return t.secret && n.push(`secret=${encodeURIComponent(t.secret)}`), t.issuer && n.push(`issuer=${encodeURIComponent(t.issuer)}`), t.algorithm && t.algorithm !== "sha1" && n.push(`algorithm=${t.algorithm.toUpperCase()}`), t.digits && t.digits !== 6 && n.push(`digits=${t.digits}`), e === "hotp" && t.counter !== void 0 && n.push(`counter=${t.counter}`), e === "totp" && t.period !== void 0 && t.period !== 30 && n.push(`period=${t.period}`), o += n.join("&"), o;
+}
+function x$1(r) {
+	let { issuer: e, label: s, secret: t, algorithm: i = "sha1", digits: o = 6, period: n = 30 } = r;
+	return m$1({
+		type: "totp",
+		label: e ? `${e}:${s}` : s,
+		params: {
+			secret: t,
+			issuer: e,
+			algorithm: i,
+			digits: o,
+			period: n
 		}
-		for (i = j; i < encoded.length; i++) encoded[i] = 61;
-		return encoded;
-	};
-	exports.decode = function(encoded) {
-		var shiftIndex = 0;
-		var plainDigit = 0;
-		var plainChar;
-		var plainPos = 0;
-		if (!Buffer.isBuffer(encoded)) encoded = new Buffer(encoded);
-		var decoded = new Buffer(Math.ceil(encoded.length * 5 / 8));
-		for (var i = 0; i < encoded.length; i++) {
-			if (encoded[i] === 61) break;
-			var encodedByte = encoded[i] - 48;
-			if (encodedByte < byteTable.length) {
-				plainDigit = byteTable[encodedByte];
-				if (shiftIndex <= 3) {
-					shiftIndex = (shiftIndex + 5) % 8;
-					if (shiftIndex === 0) {
-						plainChar |= plainDigit;
-						decoded[plainPos] = plainChar;
-						plainPos++;
-						plainChar = 0;
-					} else plainChar |= 255 & plainDigit << 8 - shiftIndex;
-				} else {
-					shiftIndex = (shiftIndex + 5) % 8;
-					plainChar |= 255 & plainDigit >>> shiftIndex;
-					decoded[plainPos] = plainChar;
-					plainPos++;
-					plainChar = 255 & plainDigit << 8 - shiftIndex;
-				}
-			} else throw new Error("Invalid input - it is not base32 encoded string");
+	});
+}
+function U$1(r) {
+	let { issuer: e, label: s, secret: t, counter: i = 0, algorithm: o = "sha1", digits: n = 6 } = r;
+	return m$1({
+		type: "hotp",
+		label: e ? `${e}:${s}` : s,
+		params: {
+			secret: t,
+			issuer: e,
+			algorithm: o,
+			digits: n,
+			counter: i
 		}
-		return decoded.slice(0, plainPos);
+	});
+}
+//#endregion
+//#region ../../node_modules/@otplib/hotp/dist/index.js
+function v$1(u) {
+	let { secret: t, counter: e, algorithm: r = "sha1", digits: i = 6, crypto: n, base32: o, guardrails: a, hooks: s } = u;
+	Xr$1(t), dr$1(n);
+	let c = vr$1(t, o);
+	Or$1(c, a), br(e, a);
+	return {
+		ctx: Wr(n),
+		algorithm: r,
+		digits: i,
+		secretBytes: c,
+		counterBytes: _r(e),
+		hooks: s
 	};
-}));
+}
+function F$1(u) {
+	let { ctx: t, algorithm: e, digits: r, secretBytes: i, counterBytes: n, hooks: o } = v$1(u), a = t.hmacSync(e, i, n), s = o?.truncateDigest ? o.truncateDigest(a) : Rr(a);
+	return o?.encodeToken ? o.encodeToken(s, r) : Ir(s, r);
+}
+function G$1(u) {
+	let { secret: t, counter: e, token: r, algorithm: i = "sha1", digits: n = 6, crypto: o, base32: a, counterTolerance: s = 0, guardrails: c = hr$1(), hooks: p } = u;
+	Xr$1(t), dr$1(o);
+	let l = vr$1(t, a);
+	Or$1(l, c), br(e, c), p?.validateToken ? p.validateToken(r, n) : Sr$1(r, n), Br(s, c);
+	let V = typeof e == "bigint" ? Number(e) : e, [f, d] = Er(s);
+	return {
+		token: r,
+		counterNum: V,
+		past: f,
+		future: d,
+		totalChecks: f + d + 1,
+		crypto: o,
+		getGenerateOptions: (B) => ({
+			secret: l,
+			counter: B,
+			algorithm: i,
+			digits: n,
+			crypto: o,
+			guardrails: c,
+			hooks: p
+		})
+	};
+}
+function Y$1(u) {
+	let { token: t, counterNum: e, past: r, totalChecks: i, crypto: n, getGenerateOptions: o } = G$1(u), a = Math.max(0, r - e);
+	for (let s = a; s < i; s++) {
+		let c = s - r, l = F$1(o(e + c));
+		if (n.constantTimeEqual(l, t)) return {
+			valid: !0,
+			delta: c | 0
+		};
+	}
+	return { valid: !1 };
+}
 //#endregion
-//#region ../../node_modules/thirty-two/lib/thirty-two/index.js
-var require_thirty_two = /* @__PURE__ */ __commonJSMin(((exports) => {
-	var base32 = require_thirty_two$1();
-	exports.encode = base32.encode;
-	exports.decode = base32.decode;
-}));
+//#region ../../node_modules/@otplib/totp/node_modules/@otplib/core/dist/index.js
+var i = class extends Error {
+	constructor(e, t) {
+		super(e, t), this.name = "OTPError";
+	}
+}, x = class extends i {
+	constructor(e) {
+		super(e), this.name = "SecretError";
+	}
+}, h = class extends x {
+	constructor(e, t) {
+		super(`Secret must be at least ${e} bytes (${e * 8} bits), got ${t} bytes`), this.name = "SecretTooShortError";
+	}
+}, P = class extends x {
+	constructor(e, t) {
+		super(`Secret must not exceed ${e} bytes, got ${t} bytes`), this.name = "SecretTooLongError";
+	}
+}, A$1 = class extends i {
+	constructor(e) {
+		super(e), this.name = "TimeError";
+	}
+}, C = class extends A$1 {
+	constructor() {
+		super("Time must be non-negative"), this.name = "TimeNegativeError";
+	}
+}, S = class extends A$1 {
+	constructor() {
+		super("Time must be a finite number"), this.name = "TimeNotFiniteError";
+	}
+}, B = class extends i {
+	constructor(e) {
+		super(e), this.name = "PeriodError";
+	}
+}, w$1 = class extends B {
+	constructor(e) {
+		super(`Period must be at least ${e} second(s)`), this.name = "PeriodTooSmallError";
+	}
+}, _$1 = class extends B {
+	constructor(e) {
+		super(`Period must not exceed ${e} seconds`), this.name = "PeriodTooLargeError";
+	}
+}, R$1 = class extends i {
+	constructor(e) {
+		super(e), this.name = "TokenError";
+	}
+}, I$1 = class extends R$1 {
+	constructor(e, t) {
+		super(`Token must be ${e} digits, got ${t}`), this.name = "TokenLengthError";
+	}
+}, M = class extends R$1 {
+	constructor() {
+		super("Token must contain only digits"), this.name = "TokenFormatError";
+	}
+}, E = class extends i {
+	constructor(e) {
+		super(e), this.name = "EpochToleranceError";
+	}
+}, k$1 = class extends E {
+	constructor() {
+		super("Epoch tolerance cannot contain negative values"), this.name = "EpochToleranceNegativeError";
+	}
+}, q = class extends E {
+	constructor(e, t) {
+		super(`Epoch tolerance must not exceed ${e} seconds, got ${t}. Large tolerances can cause performance issues.`), this.name = "EpochToleranceTooLargeError";
+	}
+}, G = class extends i {
+	constructor(e) {
+		super(e), this.name = "PluginError";
+	}
+}, Y = class extends G {
+	constructor() {
+		super("Crypto plugin is required."), this.name = "CryptoPluginMissingError";
+	}
+}, L = class extends G {
+	constructor() {
+		super("Base32 plugin is required."), this.name = "Base32PluginMissingError";
+	}
+}, a = class extends i {
+	constructor(e) {
+		super(e), this.name = "ConfigurationError";
+	}
+}, W = class extends a {
+	constructor() {
+		super("Secret is required. Use generateSecret() to create one, or provide via { secret: 'YOUR_BASE32_SECRET' }"), this.name = "SecretMissingError";
+	}
+}, f = class extends i {
+	constructor(e) {
+		super(e), this.name = "AfterTimeStepError";
+	}
+}, J = class extends f {
+	constructor() {
+		super("afterTimeStep must be >= 0"), this.name = "AfterTimeStepNegativeError";
+	}
+}, Q = class extends f {
+	constructor() {
+		super("Invalid afterTimeStep: non-integer value"), this.name = "AfterTimeStepNotIntegerError";
+	}
+}, Z$1 = class extends f {
+	constructor() {
+		super("Invalid afterTimeStep: cannot be greater than current time step plus window"), this.name = "AfterTimeStepRangeExceededError";
+	}
+};
+new TextEncoder();
+new TextDecoder();
+var ur$1 = 3600, pr$1 = Number.MAX_SAFE_INTEGER, er$1 = Symbol("otplib.guardrails.override");
+function y(r, e, t) {
+	if (typeof e != "number" || !Number.isSafeInteger(e)) throw new a(`Guardrail '${r}' must be a safe integer`);
+	if (e < t) throw new a(`Guardrail '${r}' must be >= ${t}`);
+}
+var d$3 = Object.freeze({
+	MIN_SECRET_BYTES: 16,
+	MAX_SECRET_BYTES: 64,
+	MIN_PERIOD: 1,
+	MAX_PERIOD: ur$1,
+	MAX_COUNTER: pr$1,
+	MAX_WINDOW: 99,
+	[er$1]: !1
+});
+function hr(r) {
+	if (!r) return d$3;
+	r.MIN_SECRET_BYTES !== void 0 && y("MIN_SECRET_BYTES", r.MIN_SECRET_BYTES, 1), r.MAX_SECRET_BYTES !== void 0 && y("MAX_SECRET_BYTES", r.MAX_SECRET_BYTES, 1), r.MIN_PERIOD !== void 0 && y("MIN_PERIOD", r.MIN_PERIOD, 1), r.MAX_PERIOD !== void 0 && y("MAX_PERIOD", r.MAX_PERIOD, 1), r.MAX_COUNTER !== void 0 && y("MAX_COUNTER", r.MAX_COUNTER, 0), r.MAX_WINDOW !== void 0 && y("MAX_WINDOW", r.MAX_WINDOW, 1);
+	let e = {
+		...d$3,
+		...r
+	};
+	if (e.MIN_SECRET_BYTES > e.MAX_SECRET_BYTES) throw new a("Guardrail 'MIN_SECRET_BYTES' must be <= 'MAX_SECRET_BYTES'");
+	if (e.MIN_PERIOD > e.MAX_PERIOD) throw new a("Guardrail 'MIN_PERIOD' must be <= 'MAX_PERIOD'");
+	return Object.freeze({
+		...e,
+		[er$1]: !0
+	});
+}
+function Or(r, e = d$3) {
+	if (r.length < e.MIN_SECRET_BYTES) throw new h(e.MIN_SECRET_BYTES, r.length);
+	if (r.length > e.MAX_SECRET_BYTES) throw new P(e.MAX_SECRET_BYTES, r.length);
+}
+function Ar(r) {
+	if (!Number.isFinite(r)) throw new S();
+	if (r < 0) throw new C();
+}
+function Cr(r, e = d$3) {
+	if (!Number.isInteger(r) || r < e.MIN_PERIOD) throw new w$1(e.MIN_PERIOD);
+	if (r > e.MAX_PERIOD) throw new _$1(e.MAX_PERIOD);
+}
+function Sr(r, e) {
+	if (r.length !== e) throw new I$1(e, r.length);
+	if (!/^\d+$/.test(r)) throw new M();
+}
+function wr(r, e = 30, t = d$3) {
+	let [o, n] = Array.isArray(r) ? r : [r, r];
+	if (!Number.isSafeInteger(o) || !Number.isSafeInteger(n)) throw new E("Epoch tolerance values must be safe integers");
+	if (o < 0 || n < 0) throw new k$1();
+	let s = (t.MAX_WINDOW - 1) * e, u = o + n;
+	if (u > s) throw new q(s, u);
+}
+function vr(r, e) {
+	return typeof r == "string" ? (nr(e), e.decode(r)) : r;
+}
+function Ur(r = 0) {
+	return Array.isArray(r) ? r : [r, r];
+}
+function dr(r) {
+	if (!r) throw new Y();
+}
+function nr(r) {
+	if (!r) throw new L();
+}
+function Xr(r) {
+	if (!r) throw new W();
+}
 //#endregion
-//#region ../../node_modules/@otplib/plugin-thirty-two/index.js
-/**
-* @otplib/plugin-thirty-two
-*
-* @author Gerald Yeo <contact@fusedthought.com>
-* @version: 12.0.1
-* @license: MIT
-**/
-var require_plugin_thirty_two = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	function _interopDefault(ex) {
-		return ex && typeof ex === "object" && "default" in ex ? ex["default"] : ex;
-	}
-	var thirtyTwo = _interopDefault(require_thirty_two());
-	var keyDecoder = (encodedSecret, encoding) => {
-		return thirtyTwo.decode(encodedSecret).toString(encoding);
+//#region ../../node_modules/@otplib/totp/dist/index.js
+function k(r) {
+	let { secret: e, epoch: n = Math.floor(Date.now() / 1e3), t0: o = 0, period: i = 30, algorithm: s = "sha1", digits: l = 6, crypto: a, base32: u, guardrails: c = hr(), hooks: t } = r;
+	Xr(e), dr(a);
+	let p = vr(e, u);
+	Or(p, c), Ar(n), Cr(i, c);
+	return {
+		secret: p,
+		counter: Math.floor((n - o) / i),
+		algorithm: s,
+		digits: l,
+		crypto: a,
+		guardrails: c,
+		hooks: t
 	};
-	var keyEncoder = (secret, encoding) => {
-		return thirtyTwo.encode(Buffer.from(secret, encoding).toString("ascii")).toString().replace(/=/g, "");
+}
+function Z(r) {
+	return F$1(k(r));
+}
+function _(r, e) {
+	if (r !== void 0) {
+		if (r < 0) throw new J();
+		if (!Number.isSafeInteger(r)) throw new Q();
+		if (r > e) throw new Z$1();
+	}
+}
+function w(r, e) {
+	return e !== void 0 && r <= e;
+}
+function R(r) {
+	let { secret: e, token: n, epoch: o = Math.floor(Date.now() / 1e3), t0: i = 0, period: s = 30, algorithm: l = "sha1", digits: a = 6, crypto: u, base32: c, epochTolerance: t = 0, afterTimeStep: p, guardrails: f = hr(), hooks: T } = r;
+	Xr(e), dr(u);
+	let m = vr(e, c);
+	Or(m, f), Ar(o), Cr(s, f), T?.validateToken ? T.validateToken(n, a) : Sr(n, a), wr(t, s, f);
+	let M = Math.floor((o - i) / s), [I, q] = Ur(t), A = Math.max(0, Math.floor((o - I - i) / s)), S = Math.floor((o + q - i) / s);
+	return _(p, S), {
+		token: n,
+		crypto: u,
+		minCounter: A,
+		maxCounter: S,
+		currentCounter: M,
+		t0: i,
+		period: s,
+		afterTimeStep: p,
+		getGenerateOptions: (D) => ({
+			secret: m,
+			epoch: D * s + i,
+			t0: i,
+			period: s,
+			algorithm: l,
+			digits: a,
+			crypto: u,
+			guardrails: f,
+			hooks: T
+		})
 	};
-	exports.keyDecoder = keyDecoder;
-	exports.keyEncoder = keyEncoder;
-}));
+}
+function ie(r) {
+	let { token: e, crypto: n, minCounter: o, maxCounter: i, currentCounter: s, t0: l, period: a, afterTimeStep: u, getGenerateOptions: c } = R(r);
+	for (let t = o; t <= i; t++) {
+		if (w(t, u)) continue;
+		let p = Z(c(t));
+		if (n.constantTimeEqual(p, e)) return {
+			valid: !0,
+			delta: t - s,
+			epoch: t * a + l,
+			timeStep: t
+		};
+	}
+	return { valid: !1 };
+}
 //#endregion
-//#region ../../node_modules/@otplib/core/index.js
+//#region ../../node_modules/@scure/base/index.js
+/*! scure-base - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+function isBytes$1(a) {
+	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+function isArrayOf(isString, arr) {
+	if (!Array.isArray(arr)) return false;
+	if (arr.length === 0) return true;
+	if (isString) return arr.every((item) => typeof item === "string");
+	else return arr.every((item) => Number.isSafeInteger(item));
+}
+function afn(input) {
+	if (typeof input !== "function") throw new TypeError("function expected");
+	return true;
+}
+function astr(label, input) {
+	if (typeof input !== "string") throw new TypeError(`${label}: string expected`);
+	return true;
+}
+function anumber$1(n) {
+	if (typeof n !== "number") throw new TypeError(`number expected, got ${typeof n}`);
+	if (!Number.isSafeInteger(n)) throw new RangeError(`invalid integer: ${n}`);
+}
+function aArr(input) {
+	if (!Array.isArray(input)) throw new TypeError("array expected");
+}
+function astrArr(label, input) {
+	if (!isArrayOf(true, input)) throw new TypeError(`${label}: array of strings expected`);
+}
+function anumArr(label, input) {
+	if (!isArrayOf(false, input)) throw new TypeError(`${label}: array of numbers expected`);
+}
 /**
-* @otplib/core
-*
-* @author Gerald Yeo <contact@fusedthought.com>
-* @version: 12.0.1
-* @license: MIT
-**/
-var require_core = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	function objectValues(value) {
-		return Object.keys(value).map((key) => value[key]);
-	}
-	(function(HashAlgorithms) {
-		HashAlgorithms["SHA1"] = "sha1";
-		HashAlgorithms["SHA256"] = "sha256";
-		HashAlgorithms["SHA512"] = "sha512";
-	})(exports.HashAlgorithms || (exports.HashAlgorithms = {}));
-	var HASH_ALGORITHMS = objectValues(exports.HashAlgorithms);
-	(function(KeyEncodings) {
-		KeyEncodings["ASCII"] = "ascii";
-		KeyEncodings["BASE64"] = "base64";
-		KeyEncodings["HEX"] = "hex";
-		KeyEncodings["LATIN1"] = "latin1";
-		KeyEncodings["UTF8"] = "utf8";
-	})(exports.KeyEncodings || (exports.KeyEncodings = {}));
-	var KEY_ENCODINGS = objectValues(exports.KeyEncodings);
-	(function(Strategy) {
-		Strategy["HOTP"] = "hotp";
-		Strategy["TOTP"] = "totp";
-	})(exports.Strategy || (exports.Strategy = {}));
-	var STRATEGY = objectValues(exports.Strategy);
-	var createDigestPlaceholder = () => {
-		throw new Error("Please provide an options.createDigest implementation.");
+* @__NO_SIDE_EFFECTS__
+*/
+function chain(...args) {
+	const id = (a) => a;
+	const wrap = (a, b) => (c) => a(b(c));
+	return {
+		encode: args.map((x) => x.encode).reduceRight(wrap, id),
+		decode: args.map((x) => x.decode).reduce(wrap, id)
 	};
-	function isTokenValid(value) {
-		return /^(\d+)$/.test(value);
-	}
-	function padStart(value, maxLength, fillString) {
-		if (value.length >= maxLength) return value;
-		return `${Array(maxLength + 1).join(fillString)}${value}`.slice(-1 * maxLength);
-	}
-	function keyuri(options) {
-		const tmpl = `otpauth://${options.type}/{labelPrefix}:{accountName}?secret={secret}{query}`;
-		const params = [];
-		if (STRATEGY.indexOf(options.type) < 0) throw new Error(`Expecting options.type to be one of ${STRATEGY.join(", ")}. Received ${options.type}.`);
-		if (options.type === "hotp") {
-			if (options.counter == null || typeof options.counter !== "number") throw new Error("Expecting options.counter to be a number when options.type is \"hotp\".");
-			params.push(`&counter=${options.counter}`);
-		}
-		if (options.type === "totp" && options.step) params.push(`&period=${options.step}`);
-		if (options.digits) params.push(`&digits=${options.digits}`);
-		if (options.algorithm) params.push(`&algorithm=${options.algorithm.toUpperCase()}`);
-		if (options.issuer) params.push(`&issuer=${encodeURIComponent(options.issuer)}`);
-		return tmpl.replace("{labelPrefix}", encodeURIComponent(options.issuer || options.accountName)).replace("{accountName}", encodeURIComponent(options.accountName)).replace("{secret}", options.secret).replace("{query}", params.join(""));
-	}
-	var OTP = class OTP {
-		constructor(defaultOptions = {}) {
-			this._defaultOptions = Object.freeze({ ...defaultOptions });
-			this._options = Object.freeze({});
-		}
-		create(defaultOptions = {}) {
-			return new OTP(defaultOptions);
-		}
-		clone(defaultOptions = {}) {
-			const instance = this.create({
-				...this._defaultOptions,
-				...defaultOptions
-			});
-			instance.options = this._options;
-			return instance;
-		}
-		get options() {
-			return Object.freeze({
-				...this._defaultOptions,
-				...this._options
+}
+/**
+* Encodes integer radix representation to array of strings using alphabet and back.
+* Could also be array of strings.
+* @__NO_SIDE_EFFECTS__
+*/
+function alphabet(letters) {
+	const lettersA = typeof letters === "string" ? letters.split("") : letters;
+	const len = lettersA.length;
+	astrArr("alphabet", lettersA);
+	const indexes = new Map(lettersA.map((l, i) => [l, i]));
+	return {
+		encode: (digits) => {
+			aArr(digits);
+			return digits.map((i) => {
+				if (!Number.isSafeInteger(i) || i < 0 || i >= len) throw new Error(`alphabet.encode: digit index outside alphabet "${i}". Allowed: ${letters}`);
+				return lettersA[i];
 			});
-		}
-		set options(options) {
-			this._options = Object.freeze({
-				...this._options,
-				...options
+		},
+		decode: (input) => {
+			aArr(input);
+			return input.map((letter) => {
+				astr("alphabet.decode", letter);
+				const i = indexes.get(letter);
+				if (i === void 0) throw new Error(`Unknown letter: "${letter}". Allowed: ${letters}`);
+				return i;
 			});
 		}
-		allOptions() {
-			return this.options;
-		}
-		resetOptions() {
-			this._options = Object.freeze({});
-		}
-	};
-	function hotpOptionsValidator(options) {
-		if (typeof options.createDigest !== "function") throw new Error("Expecting options.createDigest to be a function.");
-		if (typeof options.createHmacKey !== "function") throw new Error("Expecting options.createHmacKey to be a function.");
-		if (typeof options.digits !== "number") throw new Error("Expecting options.digits to be a number.");
-		if (!options.algorithm || HASH_ALGORITHMS.indexOf(options.algorithm) < 0) throw new Error(`Expecting options.algorithm to be one of ${HASH_ALGORITHMS.join(", ")}. Received ${options.algorithm}.`);
-		if (!options.encoding || KEY_ENCODINGS.indexOf(options.encoding) < 0) throw new Error(`Expecting options.encoding to be one of ${KEY_ENCODINGS.join(", ")}. Received ${options.encoding}.`);
-	}
-	var hotpCreateHmacKey = (algorithm, secret, encoding) => {
-		return Buffer.from(secret, encoding).toString("hex");
 	};
-	function hotpDefaultOptions() {
-		return {
-			algorithm: exports.HashAlgorithms.SHA1,
-			createHmacKey: hotpCreateHmacKey,
-			createDigest: createDigestPlaceholder,
-			digits: 6,
-			encoding: exports.KeyEncodings.ASCII
-		};
-	}
-	function hotpOptions(opt) {
-		const options = {
-			...hotpDefaultOptions(),
-			...opt
-		};
-		hotpOptionsValidator(options);
-		return Object.freeze(options);
-	}
-	function hotpCounter(counter) {
-		return padStart(counter.toString(16), 16, "0");
-	}
-	function hotpDigestToToken(hexDigest, digits) {
-		const digest = Buffer.from(hexDigest, "hex");
-		const offset = digest[digest.length - 1] & 15;
-		const token = ((digest[offset] & 127) << 24 | (digest[offset + 1] & 255) << 16 | (digest[offset + 2] & 255) << 8 | digest[offset + 3] & 255) % Math.pow(10, digits);
-		return padStart(String(token), digits, "0");
-	}
-	function hotpDigest(secret, counter, options) {
-		const hexCounter = hotpCounter(counter);
-		const hmacKey = options.createHmacKey(options.algorithm, secret, options.encoding);
-		return options.createDigest(options.algorithm, hmacKey, hexCounter);
-	}
-	function hotpToken(secret, counter, options) {
-		return hotpDigestToToken(options.digest || hotpDigest(secret, counter, options), options.digits);
-	}
-	function hotpCheck(token, secret, counter, options) {
-		if (!isTokenValid(token)) return false;
-		return token === hotpToken(secret, counter, options);
-	}
-	function hotpKeyuri(accountName, issuer, secret, counter, options) {
-		return keyuri({
-			algorithm: options.algorithm,
-			digits: options.digits,
-			type: exports.Strategy.HOTP,
-			accountName,
-			counter,
-			issuer,
-			secret
-		});
-	}
-	var HOTP = class HOTP extends OTP {
-		create(defaultOptions = {}) {
-			return new HOTP(defaultOptions);
-		}
-		allOptions() {
-			return hotpOptions(this.options);
-		}
-		generate(secret, counter) {
-			return hotpToken(secret, counter, this.allOptions());
-		}
-		check(token, secret, counter) {
-			return hotpCheck(token, secret, counter, this.allOptions());
-		}
-		verify(opts) {
-			if (typeof opts !== "object") throw new Error("Expecting argument 0 of verify to be an object");
-			return this.check(opts.token, opts.secret, opts.counter);
-		}
-		keyuri(accountName, issuer, secret, counter) {
-			return hotpKeyuri(accountName, issuer, secret, counter, this.allOptions());
+}
+/**
+* @__NO_SIDE_EFFECTS__
+*/
+function join(separator = "") {
+	astr("join", separator);
+	return {
+		encode: (from) => {
+			astrArr("join.decode", from);
+			return from.join(separator);
+		},
+		decode: (to) => {
+			astr("join.decode", to);
+			return to.split(separator);
 		}
 	};
-	function parseWindowBounds(win) {
-		if (typeof win === "number") return [Math.abs(win), Math.abs(win)];
-		if (Array.isArray(win)) {
-			const [past, future] = win;
-			if (typeof past === "number" && typeof future === "number") return [Math.abs(past), Math.abs(future)];
-		}
-		throw new Error("Expecting options.window to be an number or [number, number].");
-	}
-	function totpOptionsValidator(options) {
-		hotpOptionsValidator(options);
-		parseWindowBounds(options.window);
-		if (typeof options.epoch !== "number") throw new Error("Expecting options.epoch to be a number.");
-		if (typeof options.step !== "number") throw new Error("Expecting options.step to be a number.");
-	}
-	var totpPadSecret = (secret, encoding, minLength) => {
-		const currentLength = secret.length;
-		const hexSecret = Buffer.from(secret, encoding).toString("hex");
-		if (currentLength < minLength) {
-			const newSecret = new Array(minLength - currentLength + 1).join(hexSecret);
-			return Buffer.from(newSecret, "hex").slice(0, minLength).toString("hex");
+}
+/**
+* Pad strings array so it has integer number of bits
+* @__NO_SIDE_EFFECTS__
+*/
+function padding(bits, chr = "=") {
+	anumber$1(bits);
+	astr("padding", chr);
+	return {
+		encode(data) {
+			astrArr("padding.encode", data);
+			while (data.length * bits % 8) data.push(chr);
+			return data;
+		},
+		decode(input) {
+			astrArr("padding.decode", input);
+			let end = input.length;
+			if (end * bits % 8) throw new Error("padding: invalid, string should have whole number of bytes");
+			for (; end > 0 && input[end - 1] === chr; end--) if ((end - 1) * bits % 8 === 0) throw new Error("padding: invalid, string has too much padding");
+			return input.slice(0, end);
 		}
-		return hexSecret;
 	};
-	var totpCreateHmacKey = (algorithm, secret, encoding) => {
-		switch (algorithm) {
-			case exports.HashAlgorithms.SHA1: return totpPadSecret(secret, encoding, 20);
-			case exports.HashAlgorithms.SHA256: return totpPadSecret(secret, encoding, 32);
-			case exports.HashAlgorithms.SHA512: return totpPadSecret(secret, encoding, 64);
-			default: throw new Error(`Expecting algorithm to be one of ${HASH_ALGORITHMS.join(", ")}. Received ${algorithm}.`);
+}
+/**
+* @__NO_SIDE_EFFECTS__
+*/
+function normalize(fn) {
+	afn(fn);
+	return {
+		encode: (from) => from,
+		decode: (to) => fn(to)
+	};
+}
+var gcd = (a, b) => b === 0 ? a : gcd(b, a % b);
+var radix2carry = /* @__NO_SIDE_EFFECTS__ */ (from, to) => from + (to - gcd(from, to));
+var powers = /* @__PURE__ */ (() => {
+	let res = [];
+	for (let i = 0; i < 40; i++) res.push(2 ** i);
+	return res;
+})();
+/**
+* Implemented with numbers, because BigInt is 5x slower
+*/
+function convertRadix2(data, from, to, padding) {
+	aArr(data);
+	if (from <= 0 || from > 32) throw new RangeError(`convertRadix2: wrong from=${from}`);
+	if (to <= 0 || to > 32) throw new RangeError(`convertRadix2: wrong to=${to}`);
+	if (/* @__PURE__ */ radix2carry(from, to) > 32) throw new Error(`convertRadix2: carry overflow from=${from} to=${to} carryBits=${/* @__PURE__ */ radix2carry(from, to)}`);
+	let carry = 0;
+	let pos = 0;
+	const max = powers[from];
+	const mask = powers[to] - 1;
+	const res = [];
+	for (const n of data) {
+		anumber$1(n);
+		if (n >= max) throw new Error(`convertRadix2: invalid data word=${n} from=${from}`);
+		carry = carry << from | n;
+		if (pos + from > 32) throw new Error(`convertRadix2: carry overflow pos=${pos} from=${from}`);
+		pos += from;
+		for (; pos >= to; pos -= to) res.push((carry >> pos - to & mask) >>> 0);
+		const pow = powers[pos];
+		if (pow === void 0) throw new Error("invalid carry");
+		carry &= pow - 1;
+	}
+	carry = carry << to - pos & mask;
+	if (!padding && pos >= from) throw new Error("Excess padding");
+	if (!padding && carry > 0) throw new Error(`Non-zero padding: ${carry}`);
+	if (padding && pos > 0) res.push(carry >>> 0);
+	return res;
+}
+/**
+* If both bases are power of same number (like `2**8 <-> 2**64`),
+* there is a linear algorithm. For now we have implementation for power-of-two bases only.
+* @__NO_SIDE_EFFECTS__
+*/
+function radix2(bits, revPadding = false) {
+	anumber$1(bits);
+	if (bits <= 0 || bits > 32) throw new RangeError("radix2: bits should be in (0..32]");
+	if (/* @__PURE__ */ radix2carry(8, bits) > 32 || /* @__PURE__ */ radix2carry(bits, 8) > 32) throw new RangeError("radix2: carry overflow");
+	return {
+		encode: (bytes) => {
+			if (!isBytes$1(bytes)) throw new TypeError("radix2.encode input should be Uint8Array");
+			return convertRadix2(Array.from(bytes), 8, bits, !revPadding);
+		},
+		decode: (digits) => {
+			anumArr("radix2.decode", digits);
+			return Uint8Array.from(convertRadix2(digits, bits, 8, revPadding));
 		}
 	};
-	function totpDefaultOptions() {
+}
+function unsafeWrapper(fn) {
+	afn(fn);
+	return function(...args) {
+		try {
+			return fn.apply(null, args);
+		} catch (e) {}
+	};
+}
+chain(radix2(4), alphabet("0123456789ABCDEF"), join(""));
+/**
+* base32 encoding from RFC 4648. Has padding.
+* RFC 4648 §6 Table 3 uses uppercase letters, and RFC 4648 §3.4 allows applications to choose
+* upper- or lowercase alphabets. We keep the published uppercase table and do not case-fold decode input.
+* Use `base32nopad` for unpadded version.
+* Also check out `base32hex`, `base32hexnopad`, `base32crockford`.
+* @example
+* ```js
+* base32.encode(Uint8Array.from([0x12, 0xab]));
+* // => 'CKVQ===='
+* base32.decode('CKVQ====');
+* // => Uint8Array.from([0x12, 0xab])
+* ```
+*/
+var base32 = /* @__PURE__ */ Object.freeze(chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), padding(5), join("")));
+chain(radix2(5), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"), join(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), padding(5), join(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHIJKLMNOPQRSTUV"), join(""));
+chain(radix2(5), alphabet("0123456789ABCDEFGHJKMNPQRSTVWXYZ"), join(""), normalize((s) => s.toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1")));
+var hasBase64Builtin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toBase64 === "function" && typeof Uint8Array.fromBase64 === "function")();
+hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), padding(6), join(""));
+chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"), join(""));
+hasBase64Builtin || chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), padding(6), join(""));
+chain(radix2(6), alphabet("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"), join(""));
+var BECH_ALPHABET = chain(alphabet("qpzry9x8gf2tvdw0s3jn54khce6mua7l"), join(""));
+var POLYMOD_GENERATORS = [
+	996825010,
+	642813549,
+	513874426,
+	1027748829,
+	705979059
+];
+function bech32Polymod(pre) {
+	const b = pre >> 25;
+	let chk = (pre & 33554431) << 5;
+	for (let i = 0; i < POLYMOD_GENERATORS.length; i++) if ((b >> i & 1) === 1) chk ^= POLYMOD_GENERATORS[i];
+	return chk;
+}
+function bechChecksum(prefix, words, encodingConst = 1) {
+	const len = prefix.length;
+	let chk = 1;
+	for (let i = 0; i < len; i++) {
+		const c = prefix.charCodeAt(i);
+		if (c < 33 || c > 126) throw new Error(`Invalid prefix (${prefix})`);
+		chk = bech32Polymod(chk) ^ c >> 5;
+	}
+	chk = bech32Polymod(chk);
+	for (let i = 0; i < len; i++) chk = bech32Polymod(chk) ^ prefix.charCodeAt(i) & 31;
+	for (let v of words) chk = bech32Polymod(chk) ^ v;
+	for (let i = 0; i < 6; i++) chk = bech32Polymod(chk);
+	chk ^= encodingConst;
+	return BECH_ALPHABET.encode(convertRadix2([chk % powers[30]], 30, 5, false));
+}
+/**
+* @__NO_SIDE_EFFECTS__
+*/
+function genBech32(encoding) {
+	const ENCODING_CONST = encoding === "bech32" ? 1 : 734539939;
+	const _words = radix2(5);
+	const fromWords = _words.decode;
+	const toWords = _words.encode;
+	const fromWordsUnsafe = unsafeWrapper(fromWords);
+	function encode(prefix, words, limit = 90) {
+		astr("bech32.encode prefix", prefix);
+		if (isBytes$1(words)) words = Array.from(words);
+		anumArr("bech32.encode", words);
+		const plen = prefix.length;
+		if (plen === 0) throw new TypeError(`Invalid prefix length ${plen}`);
+		const actualLength = plen + 7 + words.length;
+		if (limit !== false && actualLength > limit) throw new TypeError(`Length ${actualLength} exceeds limit ${limit}`);
+		const lowered = prefix.toLowerCase();
+		const sum = bechChecksum(lowered, words, ENCODING_CONST);
+		return `${lowered}1${BECH_ALPHABET.encode(words)}${sum}`;
+	}
+	function decode(str, limit = 90) {
+		astr("bech32.decode input", str);
+		const slen = str.length;
+		if (slen < 8 || limit !== false && slen > limit) throw new TypeError(`invalid string length: ${slen} (${str}). Expected (8..${limit})`);
+		const lowered = str.toLowerCase();
+		if (str !== lowered && str !== str.toUpperCase()) throw new Error(`String must be lowercase or uppercase`);
+		const sepIndex = lowered.lastIndexOf("1");
+		if (sepIndex === 0 || sepIndex === -1) throw new Error(`Letter "1" must be present between prefix and data only`);
+		const prefix = lowered.slice(0, sepIndex);
+		const data = lowered.slice(sepIndex + 1);
+		if (data.length < 6) throw new Error("Data must be at least 6 characters long");
+		const words = BECH_ALPHABET.decode(data).slice(0, -6);
+		const sum = bechChecksum(prefix, words, ENCODING_CONST);
+		if (!data.endsWith(sum)) throw new Error(`Invalid checksum in ${str}: expected "${sum}"`);
 		return {
-			algorithm: exports.HashAlgorithms.SHA1,
-			createDigest: createDigestPlaceholder,
-			createHmacKey: totpCreateHmacKey,
-			digits: 6,
-			encoding: exports.KeyEncodings.ASCII,
-			epoch: Date.now(),
-			step: 30,
-			window: 0
+			prefix,
+			words
 		};
 	}
-	function totpOptions(opt) {
-		const options = {
-			...totpDefaultOptions(),
-			...opt
+	const decodeUnsafe = unsafeWrapper(decode);
+	function decodeToBytes(str) {
+		const { prefix, words } = decode(str, false);
+		return {
+			prefix,
+			words,
+			bytes: fromWords(words)
 		};
-		totpOptionsValidator(options);
-		return Object.freeze(options);
-	}
-	function totpCounter(epoch, step) {
-		return Math.floor(epoch / step / 1e3);
 	}
-	function totpToken(secret, options) {
-		return hotpToken(secret, totpCounter(options.epoch, options.step), options);
+	function encodeFromBytes(prefix, bytes) {
+		return encode(prefix, toWords(bytes));
 	}
-	function totpEpochsInWindow(epoch, direction, deltaPerEpoch, numOfEpoches) {
-		const result = [];
-		if (numOfEpoches === 0) return result;
-		for (let i = 1; i <= numOfEpoches; i++) {
-			const delta = direction * i * deltaPerEpoch;
-			result.push(epoch + delta);
+	return {
+		encode,
+		decode,
+		encodeFromBytes,
+		decodeToBytes,
+		decodeUnsafe,
+		fromWords,
+		fromWordsUnsafe,
+		toWords
+	};
+}
+genBech32("bech32");
+genBech32("bech32m");
+/* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")() || chain(radix2(4), alphabet("0123456789abcdef"), join(""), normalize((s) => {
+	if (typeof s !== "string" || s.length % 2 !== 0) throw new TypeError(`hex.decode: expected string, got ${typeof s} with length ${s.length}`);
+	return s.toLowerCase();
+}));
+//#endregion
+//#region ../../node_modules/@otplib/plugin-base32-scure/dist/index.js
+var r = class {
+	name = "scure";
+	encode(o, e = {}) {
+		let { padding: t = !1 } = e, n = base32.encode(o);
+		return t ? n : n.replace(/=+$/, "");
+	}
+	decode(o) {
+		try {
+			let e = o.toUpperCase(), t = e.padEnd(Math.ceil(e.length / 8) * 8, "=");
+			return base32.decode(t);
+		} catch (e) {
+			throw new Error(`Invalid Base32 string: ${e.message}`);
 		}
-		return result;
 	}
-	function totpEpochAvailable(epoch, step, win) {
-		const bounds = parseWindowBounds(win);
-		const delta = step * 1e3;
-		return {
-			current: epoch,
-			past: totpEpochsInWindow(epoch, -1, delta, bounds[0]),
-			future: totpEpochsInWindow(epoch, 1, delta, bounds[1])
-		};
+}, d$2 = Object.freeze(new r());
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@noble/hashes/utils.js
+/**
+* Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+* @param a - value to test
+* @returns `true` when the value is a Uint8Array-compatible view.
+* @example
+* Check whether a value is a Uint8Array-compatible view.
+* ```ts
+* isBytes(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function isBytes(a) {
+	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+/**
+* Asserts something is a non-negative integer.
+* @param n - number to validate
+* @param title - label included in thrown errors
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @example
+* Validate a non-negative integer option.
+* ```ts
+* anumber(32, 'length');
+* ```
+*/
+function anumber(n, title = "") {
+	if (typeof n !== "number") {
+		const prefix = title && `"${title}" `;
+		throw new TypeError(`${prefix}expected number, got ${typeof n}`);
 	}
-	function totpCheck(token, secret, options) {
-		if (!isTokenValid(token)) return false;
-		return token === totpToken(secret, options);
-	}
-	function totpCheckByEpoch(epochs, token, secret, options) {
-		let position = null;
-		epochs.some((epoch, idx) => {
-			if (totpCheck(token, secret, {
-				...options,
-				epoch
-			})) {
-				position = idx + 1;
-				return true;
-			}
-			return false;
-		});
-		return position;
-	}
-	function totpCheckWithWindow(token, secret, options) {
-		if (totpCheck(token, secret, options)) return 0;
-		const epochs = totpEpochAvailable(options.epoch, options.step, options.window);
-		const backward = totpCheckByEpoch(epochs.past, token, secret, options);
-		if (backward !== null) return backward * -1;
-		return totpCheckByEpoch(epochs.future, token, secret, options);
-	}
-	function totpTimeUsed(epoch, step) {
-		return Math.floor(epoch / 1e3) % step;
-	}
-	function totpTimeRemaining(epoch, step) {
-		return step - totpTimeUsed(epoch, step);
-	}
-	function totpKeyuri(accountName, issuer, secret, options) {
-		return keyuri({
-			algorithm: options.algorithm,
-			digits: options.digits,
-			step: options.step,
-			type: exports.Strategy.TOTP,
-			accountName,
-			issuer,
-			secret
-		});
+	if (!Number.isSafeInteger(n) || n < 0) {
+		const prefix = title && `"${title}" `;
+		throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
 	}
-	var TOTP = class TOTP extends HOTP {
-		create(defaultOptions = {}) {
-			return new TOTP(defaultOptions);
-		}
-		allOptions() {
-			return totpOptions(this.options);
+}
+/**
+* Asserts something is Uint8Array.
+* @param value - value to validate
+* @param length - optional exact length constraint
+* @param title - label included in thrown errors
+* @returns The validated byte array.
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @example
+* Validate that a value is a byte array.
+* ```ts
+* abytes(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function abytes(value, length, title = "") {
+	const bytes = isBytes(value);
+	const len = value?.length;
+	const needsLen = length !== void 0;
+	if (!bytes || needsLen && len !== length) {
+		const prefix = title && `"${title}" `;
+		const ofLen = needsLen ? ` of length ${length}` : "";
+		const got = bytes ? `length=${len}` : `type=${typeof value}`;
+		const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+		if (!bytes) throw new TypeError(message);
+		throw new RangeError(message);
+	}
+	return value;
+}
+/**
+* Asserts something is a wrapped hash constructor.
+* @param h - hash constructor to validate
+* @throws On wrong argument types or invalid hash wrapper shape. {@link TypeError}
+* @throws On invalid hash metadata ranges or values. {@link RangeError}
+* @throws If the hash metadata allows empty outputs or block sizes. {@link Error}
+* @example
+* Validate a callable hash wrapper.
+* ```ts
+* import { ahash } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* ahash(sha256);
+* ```
+*/
+function ahash(h) {
+	if (typeof h !== "function" || typeof h.create !== "function") throw new TypeError("Hash must wrapped by utils.createHasher");
+	anumber(h.outputLen);
+	anumber(h.blockLen);
+	if (h.outputLen < 1) throw new Error("\"outputLen\" must be >= 1");
+	if (h.blockLen < 1) throw new Error("\"blockLen\" must be >= 1");
+}
+/**
+* Asserts a hash instance has not been destroyed or finished.
+* @param instance - hash instance to validate
+* @param checkFinished - whether to reject finalized instances
+* @throws If the hash instance has already been destroyed or finalized. {@link Error}
+* @example
+* Validate that a hash instance is still usable.
+* ```ts
+* import { aexists } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const hash = sha256.create();
+* aexists(hash);
+* ```
+*/
+function aexists(instance, checkFinished = true) {
+	if (instance.destroyed) throw new Error("Hash instance has been destroyed");
+	if (checkFinished && instance.finished) throw new Error("Hash#digest() has already been called");
+}
+/**
+* Asserts output is a sufficiently-sized byte array.
+* @param out - destination buffer
+* @param instance - hash instance providing output length
+* Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @example
+* Validate a caller-provided digest buffer.
+* ```ts
+* import { aoutput } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const hash = sha256.create();
+* aoutput(new Uint8Array(hash.outputLen), hash);
+* ```
+*/
+function aoutput(out, instance) {
+	abytes(out, void 0, "digestInto() output");
+	const min = instance.outputLen;
+	if (out.length < min) throw new RangeError("\"digestInto() output\" expected to be of length >=" + min);
+}
+/**
+* Zeroizes typed arrays in place. Warning: JS provides no guarantees.
+* @param arrays - arrays to overwrite with zeros
+* @example
+* Zeroize sensitive buffers in place.
+* ```ts
+* clean(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function clean(...arrays) {
+	for (let i = 0; i < arrays.length; i++) arrays[i].fill(0);
+}
+/**
+* Creates a DataView for byte-level manipulation.
+* @param arr - source typed array
+* @returns DataView over the same buffer region.
+* @example
+* Create a DataView over an existing buffer.
+* ```ts
+* createView(new Uint8Array(4));
+* ```
+*/
+function createView(arr) {
+	return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+/**
+* Rotate-right operation for uint32 values.
+* @param word - source word
+* @param shift - shift amount in bits
+* @returns Rotated word.
+* @example
+* Rotate a 32-bit word to the right.
+* ```ts
+* rotr(0x12345678, 8);
+* ```
+*/
+function rotr(word, shift) {
+	return word << 32 - shift | word >>> shift;
+}
+/**
+* Rotate-left operation for uint32 values.
+* @param word - source word
+* @param shift - shift amount in bits
+* @returns Rotated word.
+* @example
+* Rotate a 32-bit word to the left.
+* ```ts
+* rotl(0x12345678, 8);
+* ```
+*/
+function rotl(word, shift) {
+	return word << shift | word >>> 32 - shift >>> 0;
+}
+/**
+* Creates a callable hash function from a stateful class constructor.
+* @param hashCons - hash constructor or factory
+* @param info - optional metadata such as DER OID
+* @returns Frozen callable hash wrapper with `.create()`.
+*   Wrapper construction eagerly calls `hashCons(undefined)` once to read
+*   `outputLen` / `blockLen`, so constructor side effects happen at module
+*   init time.
+* @example
+* Wrap a stateful hash constructor into a callable helper.
+* ```ts
+* import { createHasher } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const wrapped = createHasher(sha256.create, { oid: sha256.oid });
+* wrapped(new Uint8Array([1]));
+* ```
+*/
+function createHasher(hashCons, info = {}) {
+	const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+	const tmp = hashCons(void 0);
+	hashC.outputLen = tmp.outputLen;
+	hashC.blockLen = tmp.blockLen;
+	hashC.canXOF = tmp.canXOF;
+	hashC.create = (opts) => hashCons(opts);
+	Object.assign(hashC, info);
+	return Object.freeze(hashC);
+}
+/**
+* Cryptographically secure PRNG backed by `crypto.getRandomValues`.
+* @param bytesLength - number of random bytes to generate
+* @returns Random bytes.
+* The platform `getRandomValues()` implementation still defines any
+* single-call length cap, and this helper rejects oversize requests
+* with a stable library `RangeError` instead of host-specific errors.
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}
+* @example
+* Generate a fresh random key or nonce.
+* ```ts
+* const key = randomBytes(16);
+* ```
+*/
+function randomBytes$1(bytesLength = 32) {
+	anumber(bytesLength, "bytesLength");
+	const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+	if (typeof cr?.getRandomValues !== "function") throw new Error("crypto.getRandomValues must be defined");
+	if (bytesLength > 65536) throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+	return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+/**
+* Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
+* @param suffix - final OID byte for the selected hash.
+*   The helper accepts any byte even though only the documented NIST hash
+*   suffixes are meaningful downstream.
+* @returns Object containing the DER-encoded OID.
+* @example
+* Build OID metadata for a NIST hash.
+* ```ts
+* oidNist(0x01);
+* ```
+*/
+var oidNist = (suffix) => ({ oid: Uint8Array.from([
+	6,
+	9,
+	96,
+	134,
+	72,
+	1,
+	101,
+	3,
+	4,
+	2,
+	suffix
+]) });
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@noble/hashes/hmac.js
+/**
+* HMAC: RFC2104 message authentication code.
+* @module
+*/
+/**
+* Internal class for HMAC.
+* Accepts any byte key, although RFC 2104 §3 recommends keys at least
+* `HashLen` bytes long.
+*/
+var _HMAC = class {
+	oHash;
+	iHash;
+	blockLen;
+	outputLen;
+	canXOF = false;
+	finished = false;
+	destroyed = false;
+	constructor(hash, key) {
+		ahash(hash);
+		abytes(key, void 0, "key");
+		this.iHash = hash.create();
+		if (typeof this.iHash.update !== "function") throw new Error("Expected instance of class which extends utils.Hash");
+		this.blockLen = this.iHash.blockLen;
+		this.outputLen = this.iHash.outputLen;
+		const blockLen = this.blockLen;
+		const pad = new Uint8Array(blockLen);
+		pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
+		this.iHash.update(pad);
+		this.oHash = hash.create();
+		for (let i = 0; i < pad.length; i++) pad[i] ^= 106;
+		this.oHash.update(pad);
+		clean(pad);
+	}
+	update(buf) {
+		aexists(this);
+		this.iHash.update(buf);
+		return this;
+	}
+	digestInto(out) {
+		aexists(this);
+		aoutput(out, this);
+		this.finished = true;
+		const buf = out.subarray(0, this.outputLen);
+		this.iHash.digestInto(buf);
+		this.oHash.update(buf);
+		this.oHash.digestInto(buf);
+		this.destroy();
+	}
+	digest() {
+		const out = new Uint8Array(this.oHash.outputLen);
+		this.digestInto(out);
+		return out;
+	}
+	_cloneInto(to) {
+		to ||= Object.create(Object.getPrototypeOf(this), {});
+		const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+		to = to;
+		to.finished = finished;
+		to.destroyed = destroyed;
+		to.blockLen = blockLen;
+		to.outputLen = outputLen;
+		to.oHash = oHash._cloneInto(to.oHash);
+		to.iHash = iHash._cloneInto(to.iHash);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+	destroy() {
+		this.destroyed = true;
+		this.oHash.destroy();
+		this.iHash.destroy();
+	}
+};
+var hmac = /* @__PURE__ */ (() => {
+	const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
+	hmac_.create = (hash, key) => new _HMAC(hash, key);
+	return hmac_;
+})();
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@noble/hashes/_md.js
+/**
+* Internal Merkle-Damgard hash utils.
+* @module
+*/
+/**
+* Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.
+* Returns bits from `b` when `a` is set, otherwise from `c`.
+* The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never
+* set the same bit.
+* @param a - selector word
+* @param b - word chosen when selector bit is set
+* @param c - word chosen when selector bit is clear
+* @returns Mixed 32-bit word.
+* @example
+* Combine three words with the shared 32-bit choice primitive.
+* ```ts
+* Chi(0xffffffff, 0x12345678, 0x87654321);
+* ```
+*/
+function Chi(a, b, c) {
+	return a & b ^ ~a & c;
+}
+/**
+* Shared 32-bit majority primitive reused by SHA-256 and SHA-1.
+* Returns bits shared by at least two inputs.
+* @param a - first input word
+* @param b - second input word
+* @param c - third input word
+* @returns Mixed 32-bit word.
+* @example
+* Combine three words with the shared 32-bit majority primitive.
+* ```ts
+* Maj(0xffffffff, 0x12345678, 0x87654321);
+* ```
+*/
+function Maj(a, b, c) {
+	return a & b ^ a & c ^ b & c;
+}
+/**
+* Merkle-Damgard hash construction base class.
+* Could be used to create MD5, RIPEMD, SHA1, SHA2.
+* Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
+* strings with partial-byte tails.
+* @param blockLen - internal block size in bytes
+* @param outputLen - digest size in bytes
+* @param padOffset - trailing length field size in bytes
+* @param isLE - whether length and state words are encoded in little-endian
+* @example
+* Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
+* ```ts
+* import { _SHA1 } from '@noble/hashes/legacy.js';
+* const hash = new _SHA1();
+* hash.update(new Uint8Array([97, 98, 99]));
+* hash.digest();
+* ```
+*/
+var HashMD = class {
+	blockLen;
+	outputLen;
+	canXOF = false;
+	padOffset;
+	isLE;
+	buffer;
+	view;
+	finished = false;
+	length = 0;
+	pos = 0;
+	destroyed = false;
+	constructor(blockLen, outputLen, padOffset, isLE) {
+		this.blockLen = blockLen;
+		this.outputLen = outputLen;
+		this.padOffset = padOffset;
+		this.isLE = isLE;
+		this.buffer = new Uint8Array(blockLen);
+		this.view = createView(this.buffer);
+	}
+	update(data) {
+		aexists(this);
+		abytes(data);
+		const { view, buffer, blockLen } = this;
+		const len = data.length;
+		for (let pos = 0; pos < len;) {
+			const take = Math.min(blockLen - this.pos, len - pos);
+			if (take === blockLen) {
+				const dataView = createView(data);
+				for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
+				continue;
+			}
+			buffer.set(data.subarray(pos, pos + take), this.pos);
+			this.pos += take;
+			pos += take;
+			if (this.pos === blockLen) {
+				this.process(view, 0);
+				this.pos = 0;
+			}
 		}
-		generate(secret) {
-			return totpToken(secret, this.allOptions());
+		this.length += data.length;
+		this.roundClean();
+		return this;
+	}
+	digestInto(out) {
+		aexists(this);
+		aoutput(out, this);
+		this.finished = true;
+		const { buffer, view, blockLen, isLE } = this;
+		let { pos } = this;
+		buffer[pos++] = 128;
+		clean(this.buffer.subarray(pos));
+		if (this.padOffset > blockLen - pos) {
+			this.process(view, 0);
+			pos = 0;
 		}
-		checkDelta(token, secret) {
-			return totpCheckWithWindow(token, secret, this.allOptions());
+		for (let i = pos; i < blockLen; i++) buffer[i] = 0;
+		view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+		this.process(view, 0);
+		const oview = createView(out);
+		const len = this.outputLen;
+		if (len % 4) throw new Error("_sha2: outputLen must be aligned to 32bit");
+		const outLen = len / 4;
+		const state = this.get();
+		if (outLen > state.length) throw new Error("_sha2: outputLen bigger than state");
+		for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
+	}
+	digest() {
+		const { buffer, outputLen } = this;
+		this.digestInto(buffer);
+		const res = buffer.slice(0, outputLen);
+		this.destroy();
+		return res;
+	}
+	_cloneInto(to) {
+		to ||= new this.constructor();
+		to.set(...this.get());
+		const { blockLen, buffer, length, finished, destroyed, pos } = this;
+		to.destroyed = destroyed;
+		to.finished = finished;
+		to.length = length;
+		to.pos = pos;
+		if (length % blockLen) to.buffer.set(buffer);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+};
+/**
+* Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
+* Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
+*/
+/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the
+* square roots of the first eight prime numbers. Exported as a shared table; callers must treat
+* it as read-only because constructors copy words from it by index. */
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+	1779033703,
+	3144134277,
+	1013904242,
+	2773480762,
+	1359893119,
+	2600822924,
+	528734635,
+	1541459225
+]);
+/** Initial SHA512 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen
+* big-endian 32-bit halves. Derived from the fractional parts of the square roots of the first
+* eight prime numbers. Exported as a shared table; callers must treat it as read-only because
+* constructors copy halves from it by index. */
+var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+	1779033703,
+	4089235720,
+	3144134277,
+	2227873595,
+	1013904242,
+	4271175723,
+	2773480762,
+	1595750129,
+	1359893119,
+	2917565137,
+	2600822924,
+	725511199,
+	528734635,
+	4215389547,
+	1541459225,
+	327033209
+]);
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@noble/hashes/legacy.js
+/**
+
+SHA1 (RFC 3174), MD5 (RFC 1321), and RIPEMD160 legacy, weak hash functions.
+RFC 2286 only covers HMAC-RIPEMD160 wrapper material and test vectors,
+not the base RIPEMD-160 compression spec.
+Don't use them in a new protocol. What "weak" means:
+
+- Collisions can be made with 2^18 effort in MD5, 2^60 in SHA1, 2^80 in RIPEMD160.
+- No practical pre-image attacks (only theoretical, 2^123.4)
+- HMAC seems kinda ok: https://www.rfc-editor.org/rfc/rfc6151
+* @module
+*/
+/** Initial SHA-1 state from RFC 3174 §6.1. */
+var SHA1_IV = /* @__PURE__ */ Uint32Array.from([
+	1732584193,
+	4023233417,
+	2562383102,
+	271733878,
+	3285377520
+]);
+var SHA1_W = /* @__PURE__ */ new Uint32Array(80);
+/** Internal SHA1 legacy hash class. */
+var _SHA1 = class extends HashMD {
+	A = SHA1_IV[0] | 0;
+	B = SHA1_IV[1] | 0;
+	C = SHA1_IV[2] | 0;
+	D = SHA1_IV[3] | 0;
+	E = SHA1_IV[4] | 0;
+	constructor() {
+		super(64, 20, 8, false);
+	}
+	get() {
+		const { A, B, C, D, E } = this;
+		return [
+			A,
+			B,
+			C,
+			D,
+			E
+		];
+	}
+	set(A, B, C, D, E) {
+		this.A = A | 0;
+		this.B = B | 0;
+		this.C = C | 0;
+		this.D = D | 0;
+		this.E = E | 0;
+	}
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) SHA1_W[i] = view.getUint32(offset, false);
+		for (let i = 16; i < 80; i++) SHA1_W[i] = rotl(SHA1_W[i - 3] ^ SHA1_W[i - 8] ^ SHA1_W[i - 14] ^ SHA1_W[i - 16], 1);
+		let { A, B, C, D, E } = this;
+		for (let i = 0; i < 80; i++) {
+			let F, K;
+			if (i < 20) {
+				F = Chi(B, C, D);
+				K = 1518500249;
+			} else if (i < 40) {
+				F = B ^ C ^ D;
+				K = 1859775393;
+			} else if (i < 60) {
+				F = Maj(B, C, D);
+				K = 2400959708;
+			} else {
+				F = B ^ C ^ D;
+				K = 3395469782;
+			}
+			const T = rotl(A, 5) + F + E + K + SHA1_W[i] | 0;
+			E = D;
+			D = C;
+			C = rotl(B, 30);
+			B = A;
+			A = T;
 		}
-		check(token, secret) {
-			return typeof this.checkDelta(token, secret) === "number";
+		A = A + this.A | 0;
+		B = B + this.B | 0;
+		C = C + this.C | 0;
+		D = D + this.D | 0;
+		E = E + this.E | 0;
+		this.set(A, B, C, D, E);
+	}
+	roundClean() {
+		clean(SHA1_W);
+	}
+	destroy() {
+		this.destroyed = true;
+		this.set(0, 0, 0, 0, 0);
+		clean(this.buffer);
+	}
+};
+/**
+* SHA1 (RFC 3174) legacy hash function. It was cryptographically broken.
+* @param msg - message bytes to hash
+* @returns Digest bytes.
+* @example
+* Hash a message with SHA1.
+* ```ts
+* sha1(new Uint8Array([97, 98, 99]));
+* ```
+*/
+var sha1 = /* @__PURE__ */ createHasher(() => new _SHA1());
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@noble/hashes/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+	if (le) return {
+		h: Number(n & U32_MASK64),
+		l: Number(n >> _32n & U32_MASK64)
+	};
+	return {
+		h: Number(n >> _32n & U32_MASK64) | 0,
+		l: Number(n & U32_MASK64) | 0
+	};
+}
+function split(lst, le = false) {
+	const len = lst.length;
+	let Ah = new Uint32Array(len);
+	let Al = new Uint32Array(len);
+	for (let i = 0; i < len; i++) {
+		const { h, l } = fromBig(lst[i], le);
+		[Ah[i], Al[i]] = [h, l];
+	}
+	return [Ah, Al];
+}
+var shrSH = (h, _l, s) => h >>> s;
+var shrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+function add(Ah, Al, Bh, Bl) {
+	const l = (Al >>> 0) + (Bl >>> 0);
+	return {
+		h: Ah + Bh + (l / 2 ** 32 | 0) | 0,
+		l: l | 0
+	};
+}
+var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@noble/hashes/sha2.js
+/**
+* SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
+* SHA256 is the fastest hash implementable in JS, even faster than Blake3.
+* Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and
+* {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.
+* @module
+*/
+/**
+* SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits
+* of the cube roots of the first 64 primes (2..311).
+*/
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
+var SHA2_32B = class extends HashMD {
+	constructor(outputLen) {
+		super(64, outputLen, 8, false);
+	}
+	get() {
+		const { A, B, C, D, E, F, G, H } = this;
+		return [
+			A,
+			B,
+			C,
+			D,
+			E,
+			F,
+			G,
+			H
+		];
+	}
+	set(A, B, C, D, E, F, G, H) {
+		this.A = A | 0;
+		this.B = B | 0;
+		this.C = C | 0;
+		this.D = D | 0;
+		this.E = E | 0;
+		this.F = F | 0;
+		this.G = G | 0;
+		this.H = H | 0;
+	}
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) SHA256_W[i] = view.getUint32(offset, false);
+		for (let i = 16; i < 64; i++) {
+			const W15 = SHA256_W[i - 15];
+			const W2 = SHA256_W[i - 2];
+			const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+			SHA256_W[i] = (rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10) + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
 		}
-		verify(opts) {
-			if (typeof opts !== "object") throw new Error("Expecting argument 0 of verify to be an object");
-			return this.check(opts.token, opts.secret);
+		let { A, B, C, D, E, F, G, H } = this;
+		for (let i = 0; i < 64; i++) {
+			const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+			const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+			const T2 = (rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22)) + Maj(A, B, C) | 0;
+			H = G;
+			G = F;
+			F = E;
+			E = D + T1 | 0;
+			D = C;
+			C = B;
+			B = A;
+			A = T1 + T2 | 0;
 		}
-		timeRemaining() {
-			const options = this.allOptions();
-			return totpTimeRemaining(options.epoch, options.step);
+		A = A + this.A | 0;
+		B = B + this.B | 0;
+		C = C + this.C | 0;
+		D = D + this.D | 0;
+		E = E + this.E | 0;
+		F = F + this.F | 0;
+		G = G + this.G | 0;
+		H = H + this.H | 0;
+		this.set(A, B, C, D, E, F, G, H);
+	}
+	roundClean() {
+		clean(SHA256_W);
+	}
+	destroy() {
+		this.destroyed = true;
+		this.set(0, 0, 0, 0, 0, 0, 0, 0);
+		clean(this.buffer);
+	}
+};
+/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
+var _SHA256 = class extends SHA2_32B {
+	A = SHA256_IV[0] | 0;
+	B = SHA256_IV[1] | 0;
+	C = SHA256_IV[2] | 0;
+	D = SHA256_IV[3] | 0;
+	E = SHA256_IV[4] | 0;
+	F = SHA256_IV[5] | 0;
+	G = SHA256_IV[6] | 0;
+	H = SHA256_IV[7] | 0;
+	constructor() {
+		super(32);
+	}
+};
+var K512 = /* @__PURE__ */ (() => split([
+	"0x428a2f98d728ae22",
+	"0x7137449123ef65cd",
+	"0xb5c0fbcfec4d3b2f",
+	"0xe9b5dba58189dbbc",
+	"0x3956c25bf348b538",
+	"0x59f111f1b605d019",
+	"0x923f82a4af194f9b",
+	"0xab1c5ed5da6d8118",
+	"0xd807aa98a3030242",
+	"0x12835b0145706fbe",
+	"0x243185be4ee4b28c",
+	"0x550c7dc3d5ffb4e2",
+	"0x72be5d74f27b896f",
+	"0x80deb1fe3b1696b1",
+	"0x9bdc06a725c71235",
+	"0xc19bf174cf692694",
+	"0xe49b69c19ef14ad2",
+	"0xefbe4786384f25e3",
+	"0x0fc19dc68b8cd5b5",
+	"0x240ca1cc77ac9c65",
+	"0x2de92c6f592b0275",
+	"0x4a7484aa6ea6e483",
+	"0x5cb0a9dcbd41fbd4",
+	"0x76f988da831153b5",
+	"0x983e5152ee66dfab",
+	"0xa831c66d2db43210",
+	"0xb00327c898fb213f",
+	"0xbf597fc7beef0ee4",
+	"0xc6e00bf33da88fc2",
+	"0xd5a79147930aa725",
+	"0x06ca6351e003826f",
+	"0x142929670a0e6e70",
+	"0x27b70a8546d22ffc",
+	"0x2e1b21385c26c926",
+	"0x4d2c6dfc5ac42aed",
+	"0x53380d139d95b3df",
+	"0x650a73548baf63de",
+	"0x766a0abb3c77b2a8",
+	"0x81c2c92e47edaee6",
+	"0x92722c851482353b",
+	"0xa2bfe8a14cf10364",
+	"0xa81a664bbc423001",
+	"0xc24b8b70d0f89791",
+	"0xc76c51a30654be30",
+	"0xd192e819d6ef5218",
+	"0xd69906245565a910",
+	"0xf40e35855771202a",
+	"0x106aa07032bbd1b8",
+	"0x19a4c116b8d2d0c8",
+	"0x1e376c085141ab53",
+	"0x2748774cdf8eeb99",
+	"0x34b0bcb5e19b48a8",
+	"0x391c0cb3c5c95a63",
+	"0x4ed8aa4ae3418acb",
+	"0x5b9cca4f7763e373",
+	"0x682e6ff3d6b2b8a3",
+	"0x748f82ee5defb2fc",
+	"0x78a5636f43172f60",
+	"0x84c87814a1f0ab72",
+	"0x8cc702081a6439ec",
+	"0x90befffa23631e28",
+	"0xa4506cebde82bde9",
+	"0xbef9a3f7b2c67915",
+	"0xc67178f2e372532b",
+	"0xca273eceea26619c",
+	"0xd186b8c721c0c207",
+	"0xeada7dd6cde0eb1e",
+	"0xf57d4f7fee6ed178",
+	"0x06f067aa72176fba",
+	"0x0a637dc5a2c898a6",
+	"0x113f9804bef90dae",
+	"0x1b710b35131c471b",
+	"0x28db77f523047d84",
+	"0x32caab7b40c72493",
+	"0x3c9ebe0a15c9bebc",
+	"0x431d67c49c100d4c",
+	"0x4cc5d4becb3e42b6",
+	"0x597f299cfc657e2a",
+	"0x5fcb6fab3ad6faec",
+	"0x6c44198c4a475817"
+].map((n) => BigInt(n))))();
+var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
+var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
+var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */
+var SHA2_64B = class extends HashMD {
+	constructor(outputLen) {
+		super(128, outputLen, 16, false);
+	}
+	get() {
+		const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+		return [
+			Ah,
+			Al,
+			Bh,
+			Bl,
+			Ch,
+			Cl,
+			Dh,
+			Dl,
+			Eh,
+			El,
+			Fh,
+			Fl,
+			Gh,
+			Gl,
+			Hh,
+			Hl
+		];
+	}
+	set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+		this.Ah = Ah | 0;
+		this.Al = Al | 0;
+		this.Bh = Bh | 0;
+		this.Bl = Bl | 0;
+		this.Ch = Ch | 0;
+		this.Cl = Cl | 0;
+		this.Dh = Dh | 0;
+		this.Dl = Dl | 0;
+		this.Eh = Eh | 0;
+		this.El = El | 0;
+		this.Fh = Fh | 0;
+		this.Fl = Fl | 0;
+		this.Gh = Gh | 0;
+		this.Gl = Gl | 0;
+		this.Hh = Hh | 0;
+		this.Hl = Hl | 0;
+	}
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) {
+			SHA512_W_H[i] = view.getUint32(offset);
+			SHA512_W_L[i] = view.getUint32(offset += 4);
 		}
-		timeUsed() {
-			const options = this.allOptions();
-			return totpTimeUsed(options.epoch, options.step);
+		for (let i = 16; i < 80; i++) {
+			const W15h = SHA512_W_H[i - 15] | 0;
+			const W15l = SHA512_W_L[i - 15] | 0;
+			const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+			const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+			const W2h = SHA512_W_H[i - 2] | 0;
+			const W2l = SHA512_W_L[i - 2] | 0;
+			const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+			const SUMl = add4L(s0l, rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6), SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+			SHA512_W_H[i] = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]) | 0;
+			SHA512_W_L[i] = SUMl | 0;
 		}
-		keyuri(accountName, issuer, secret) {
-			return totpKeyuri(accountName, issuer, secret, this.allOptions());
+		let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+		for (let i = 0; i < 80; i++) {
+			const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+			const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+			const CHIh = Eh & Fh ^ ~Eh & Gh;
+			const CHIl = El & Fl ^ ~El & Gl;
+			const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+			const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+			const T1l = T1ll | 0;
+			const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+			const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+			const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+			const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+			Hh = Gh | 0;
+			Hl = Gl | 0;
+			Gh = Fh | 0;
+			Gl = Fl | 0;
+			Fh = Eh | 0;
+			Fl = El | 0;
+			({h: Eh, l: El} = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+			Dh = Ch | 0;
+			Dl = Cl | 0;
+			Ch = Bh | 0;
+			Cl = Bl | 0;
+			Bh = Ah | 0;
+			Bl = Al | 0;
+			const All = add3L(T1l, sigma0l, MAJl);
+			Ah = add3H(All, T1h, sigma0h, MAJh);
+			Al = All | 0;
 		}
-	};
-	function authenticatorOptionValidator(options) {
-		totpOptionsValidator(options);
-		if (typeof options.keyDecoder !== "function") throw new Error("Expecting options.keyDecoder to be a function.");
-		if (options.keyEncoder && typeof options.keyEncoder !== "function") throw new Error("Expecting options.keyEncoder to be a function.");
-	}
-	function authenticatorDefaultOptions() {
-		return {
-			algorithm: exports.HashAlgorithms.SHA1,
-			createDigest: createDigestPlaceholder,
-			createHmacKey: totpCreateHmacKey,
-			digits: 6,
-			encoding: exports.KeyEncodings.HEX,
-			epoch: Date.now(),
-			step: 30,
-			window: 0
-		};
-	}
-	function authenticatorOptions(opt) {
-		const options = {
-			...authenticatorDefaultOptions(),
-			...opt
-		};
-		authenticatorOptionValidator(options);
-		return Object.freeze(options);
+		({h: Ah, l: Al} = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+		({h: Bh, l: Bl} = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+		({h: Ch, l: Cl} = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+		({h: Dh, l: Dl} = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+		({h: Eh, l: El} = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+		({h: Fh, l: Fl} = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+		({h: Gh, l: Gl} = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+		({h: Hh, l: Hl} = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+		this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
+	}
+	roundClean() {
+		clean(SHA512_W_H, SHA512_W_L);
+	}
+	destroy() {
+		this.destroyed = true;
+		clean(this.buffer);
+		this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
 	}
-	function authenticatorEncoder(secret, options) {
-		return options.keyEncoder(secret, options.encoding);
+};
+/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */
+var _SHA512 = class extends SHA2_64B {
+	Ah = SHA512_IV[0] | 0;
+	Al = SHA512_IV[1] | 0;
+	Bh = SHA512_IV[2] | 0;
+	Bl = SHA512_IV[3] | 0;
+	Ch = SHA512_IV[4] | 0;
+	Cl = SHA512_IV[5] | 0;
+	Dh = SHA512_IV[6] | 0;
+	Dl = SHA512_IV[7] | 0;
+	Eh = SHA512_IV[8] | 0;
+	El = SHA512_IV[9] | 0;
+	Fh = SHA512_IV[10] | 0;
+	Fl = SHA512_IV[11] | 0;
+	Gh = SHA512_IV[12] | 0;
+	Gl = SHA512_IV[13] | 0;
+	Hh = SHA512_IV[14] | 0;
+	Hl = SHA512_IV[15] | 0;
+	constructor() {
+		super(64);
 	}
-	function authenticatorDecoder(secret, options) {
-		return options.keyDecoder(secret, options.encoding);
+};
+/**
+* SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
+*
+* - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
+* - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+* - Each sha256 hash is executing 2^18 bit operations.
+* - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
+* @param msg - message bytes to hash
+* @returns Digest bytes.
+* @example
+* Hash a message with SHA2-256.
+* ```ts
+* sha256(new Uint8Array([97, 98, 99]));
+* ```
+*/
+var sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), /* @__PURE__ */ oidNist(1));
+/**
+* SHA2-512 hash function from RFC 4634.
+* @param msg - message bytes to hash
+* @returns Digest bytes.
+* @example
+* Hash a message with SHA2-512.
+* ```ts
+* sha512(new Uint8Array([97, 98, 99]));
+* ```
+*/
+var sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), /* @__PURE__ */ oidNist(3)), yr = new TextEncoder();
+new TextDecoder();
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@otplib/core/dist/index.js
+var ur = 3600, pr = Number.MAX_SAFE_INTEGER;
+Object.freeze({
+	MIN_SECRET_BYTES: 16,
+	MAX_SECRET_BYTES: 64,
+	MIN_PERIOD: 1,
+	MAX_PERIOD: ur,
+	MAX_COUNTER: pr,
+	MAX_WINDOW: 99,
+	[Symbol("otplib.guardrails.override")]: !1
+});
+function gr(r, e) {
+	return r.length === e.length;
+}
+function tr(r, e) {
+	let t = rr(r), o = rr(e);
+	if (!gr(t, o)) return !1;
+	let n = 0;
+	for (let s = 0; s < t.length; s++) n |= t[s] ^ o[s];
+	return n === 0;
+}
+function rr(r) {
+	return typeof r == "string" ? yr.encode(r) : r;
+}
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/dist/index.js
+var t = class {
+	name = "noble";
+	hmac(r, n, a) {
+		return hmac(r === "sha1" ? sha1 : r === "sha256" ? sha256 : sha512, n, a);
 	}
-	function authenticatorGenerateSecret(numberOfBytes, options) {
-		return authenticatorEncoder(options.createRandomBytes(numberOfBytes, options.encoding), options);
+	randomBytes(r) {
+		return randomBytes$1(r);
 	}
-	function authenticatorToken(secret, options) {
-		return totpToken(authenticatorDecoder(secret, options), options);
+	constantTimeEqual(r, n) {
+		return tr(r, n);
 	}
-	function authenticatorCheckWithWindow(token, secret, options) {
-		return totpCheckWithWindow(token, authenticatorDecoder(secret, options), options);
+}, A = Object.freeze(new t());
+//#endregion
+//#region node_modules/otplib/dist/index.js
+function c(t) {
+	return {
+		secret: t.secret,
+		strategy: t.strategy ?? "totp",
+		crypto: t.crypto ?? A,
+		base32: t.base32 ?? d$2,
+		algorithm: t.algorithm ?? "sha1",
+		digits: t.digits ?? 6,
+		period: t.period ?? 30,
+		epoch: t.epoch ?? Math.floor(Date.now() / 1e3),
+		t0: t.t0 ?? 0,
+		counter: t.counter,
+		guardrails: t.guardrails ?? hr$2(),
+		hooks: t.hooks
+	};
+}
+function O(t) {
+	return {
+		...c(t),
+		token: t.token,
+		epochTolerance: t.epochTolerance ?? 0,
+		counterTolerance: t.counterTolerance ?? 0,
+		afterTimeStep: t.afterTimeStep
+	};
+}
+function l(t, e, r) {
+	if (t === "totp") return r.totp();
+	if (t === "hotp") {
+		if (e === void 0) throw new a$2("Counter is required for HOTP strategy. Example: { strategy: 'hotp', counter: 0 }");
+		return r.hotp(e);
 	}
-	exports.Authenticator = class Authenticator extends TOTP {
-		create(defaultOptions = {}) {
-			return new Authenticator(defaultOptions);
-		}
-		allOptions() {
-			return authenticatorOptions(this.options);
-		}
-		generate(secret) {
-			return authenticatorToken(secret, this.allOptions());
-		}
-		checkDelta(token, secret) {
-			return authenticatorCheckWithWindow(token, secret, this.allOptions());
-		}
-		encode(secret) {
-			return authenticatorEncoder(secret, this.allOptions());
-		}
-		decode(secret) {
-			return authenticatorDecoder(secret, this.allOptions());
-		}
-		generateSecret(numberOfBytes = 10) {
-			return authenticatorGenerateSecret(numberOfBytes, this.allOptions());
-		}
+	throw new a$2(`Unknown OTP strategy: ${t}. Valid strategies are 'totp' or 'hotp'.`);
+}
+function I(t) {
+	let { crypto: e = A, base32: r = d$2, length: a = 20 } = t || {};
+	return Dr({
+		crypto: e,
+		base32: r,
+		length: a
+	});
+}
+function T(t) {
+	let { strategy: e = "totp", issuer: r, label: a, secret: o, algorithm: i = "sha1", digits: s = 6, period: n = 30, counter: p } = t;
+	return l(e, p, {
+		totp: () => x$1({
+			issuer: r,
+			label: a,
+			secret: o,
+			algorithm: i,
+			digits: s,
+			period: n
+		}),
+		hotp: (y) => U$1({
+			issuer: r,
+			label: a,
+			secret: o,
+			algorithm: i,
+			digits: s,
+			counter: y
+		})
+	});
+}
+function d(t) {
+	let e = O(t), { secret: r, token: a, crypto: o, base32: i, algorithm: s, digits: n, hooks: p } = e, y = {
+		secret: r,
+		token: a,
+		crypto: o,
+		base32: i,
+		algorithm: s,
+		digits: n,
+		hooks: p
 	};
-	exports.HASH_ALGORITHMS = HASH_ALGORITHMS;
-	exports.HOTP = HOTP;
-	exports.KEY_ENCODINGS = KEY_ENCODINGS;
-	exports.OTP = OTP;
-	exports.STRATEGY = STRATEGY;
-	exports.TOTP = TOTP;
-	exports.authenticatorCheckWithWindow = authenticatorCheckWithWindow;
-	exports.authenticatorDecoder = authenticatorDecoder;
-	exports.authenticatorDefaultOptions = authenticatorDefaultOptions;
-	exports.authenticatorEncoder = authenticatorEncoder;
-	exports.authenticatorGenerateSecret = authenticatorGenerateSecret;
-	exports.authenticatorOptionValidator = authenticatorOptionValidator;
-	exports.authenticatorOptions = authenticatorOptions;
-	exports.authenticatorToken = authenticatorToken;
-	exports.createDigestPlaceholder = createDigestPlaceholder;
-	exports.hotpCheck = hotpCheck;
-	exports.hotpCounter = hotpCounter;
-	exports.hotpCreateHmacKey = hotpCreateHmacKey;
-	exports.hotpDefaultOptions = hotpDefaultOptions;
-	exports.hotpDigestToToken = hotpDigestToToken;
-	exports.hotpKeyuri = hotpKeyuri;
-	exports.hotpOptions = hotpOptions;
-	exports.hotpOptionsValidator = hotpOptionsValidator;
-	exports.hotpToken = hotpToken;
-	exports.isTokenValid = isTokenValid;
-	exports.keyuri = keyuri;
-	exports.objectValues = objectValues;
-	exports.padStart = padStart;
-	exports.totpCheck = totpCheck;
-	exports.totpCheckByEpoch = totpCheckByEpoch;
-	exports.totpCheckWithWindow = totpCheckWithWindow;
-	exports.totpCounter = totpCounter;
-	exports.totpCreateHmacKey = totpCreateHmacKey;
-	exports.totpDefaultOptions = totpDefaultOptions;
-	exports.totpEpochAvailable = totpEpochAvailable;
-	exports.totpKeyuri = totpKeyuri;
-	exports.totpOptions = totpOptions;
-	exports.totpOptionsValidator = totpOptionsValidator;
-	exports.totpPadSecret = totpPadSecret;
-	exports.totpTimeRemaining = totpTimeRemaining;
-	exports.totpTimeUsed = totpTimeUsed;
-	exports.totpToken = totpToken;
-}));
-//#endregion
-//#region ../../node_modules/@otplib/preset-default/index.js
-/**
-* @otplib/preset-default
-*
-* @author Gerald Yeo <contact@fusedthought.com>
-* @version: 12.0.1
-* @license: MIT
-**/
-var require_preset_default = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	var pluginCrypto = require_plugin_crypto();
-	var pluginThirtyTwo = require_plugin_thirty_two();
-	var core = require_core();
-	var hotp = new core.HOTP({ createDigest: pluginCrypto.createDigest });
-	var totp = new core.TOTP({ createDigest: pluginCrypto.createDigest });
-	exports.authenticator = new core.Authenticator({
-		createDigest: pluginCrypto.createDigest,
-		createRandomBytes: pluginCrypto.createRandomBytes,
-		keyDecoder: pluginThirtyTwo.keyDecoder,
-		keyEncoder: pluginThirtyTwo.keyEncoder
+	return l(e.strategy, e.counter, {
+		totp: () => ie({
+			...y,
+			period: e.period,
+			epoch: e.epoch,
+			t0: e.t0,
+			epochTolerance: e.epochTolerance,
+			afterTimeStep: e.afterTimeStep,
+			guardrails: e.guardrails
+		}),
+		hotp: (f) => Y$1({
+			...y,
+			counter: f,
+			counterTolerance: e.counterTolerance,
+			guardrails: e.guardrails
+		})
 	});
-	exports.hotp = hotp;
-	exports.totp = totp;
-}));
-/**
-* otplib
-*
-* @author Gerald Yeo <contact@fusedthought.com>
-* @version: 12.0.1
-* @license: MIT
-**/
+}
 //#endregion
 //#region src/auth/totp-manager.ts
-var import_otplib = (/* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	var presetDefault = require_preset_default();
-	Object.keys(presetDefault).forEach(function(k) {
-		if (k !== "default") Object.defineProperty(exports, k, {
-			enumerable: true,
-			get: function() {
-				return presetDefault[k];
-			}
-		});
-	});
-})))();
 /**
 * TOTP / 2FA enrollment manager.
 *
@@ -5784,13 +8782,16 @@ var import_otplib = (/* @__PURE__ */ __commonJSMin(((exports) => {
 * we do NOT reuse the old secret on re-enroll (avoids the case where a
 * leaked secret stays valid after a "rotation").
 *
-* The shared `authenticator` from `otplib` uses RFC 6238 TOTP with the
-* default 30-second window. We bump the validation window from 1 step
-* to 1 step in either direction (±30s) — operator clock skew is the
-* usual culprit for "valid code rejected" complaints.
+* `otplib` v13's functional API (`generateSync`/`verifySync`) uses RFC 6238
+* TOTP with a default 30-second period. We pass a per-call `epochTolerance`
+* of one step in either direction (±30 s) — operator clock skew is the usual
+* culprit for "valid code rejected" complaints.
 */
 var TOTP_COLLECTION = "user_totp";
 var ISSUER = "CamStack";
+/** RFC 6238 default time step. otplib v13 measures `epochTolerance` in
+*  seconds, so a `window` of N steps maps to `N * TOTP_PERIOD_SECONDS`. */
+var TOTP_PERIOD_SECONDS = 30;
 function parseRow(data) {
 	const userId = data["userId"];
 	const secret = data["secret"];
@@ -5808,9 +8809,12 @@ function parseRow(data) {
 }
 var TotpManager = class {
 	store;
+	/** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
+	*  per-call `epochTolerance`. Default window 1 = ±30 s. */
+	epochTolerance;
 	constructor(store, opts = {}) {
 		this.store = store;
-		import_otplib.authenticator.options = { window: opts.window ?? 1 };
+		this.epochTolerance = (opts.window ?? 1) * TOTP_PERIOD_SECONDS;
 	}
 	/**
 	* Begin enrollment. Always generates a fresh secret — calling `setup`
@@ -5822,8 +8826,12 @@ var TotpManager = class {
 	* recognition. `ISSUER` is the CamStack brand.
 	*/
 	async setup(userId, username) {
-		const secret = import_otplib.authenticator.generateSecret();
-		const otpauthUrl = import_otplib.authenticator.keyuri(username, ISSUER, secret);
+		const secret = I();
+		const otpauthUrl = T({
+			secret,
+			label: username,
+			issuer: ISSUER
+		});
 		const row = {
 			userId,
 			secret,
@@ -5856,7 +8864,11 @@ var TotpManager = class {
 	async confirm(userId, code) {
 		const row = await this.find(userId);
 		if (!row) return false;
-		if (!import_otplib.authenticator.check(code, row.secret)) return false;
+		if (!d({
+			token: code,
+			secret: row.secret,
+			epochTolerance: this.epochTolerance
+		}).valid) return false;
 		if (row.confirmedAt === null) {
 			const next = {
 				...row,
@@ -5889,7 +8901,11 @@ var TotpManager = class {
 		const row = await this.find(userId);
 		if (!row) return false;
 		if (row.confirmedAt === null) return false;
-		return import_otplib.authenticator.check(code, row.secret);
+		return d({
+			token: code,
+			secret: row.secret,
+			epochTolerance: this.epochTolerance
+		}).valid;
 	}
 	/**
 	* Read the user's enrollment status. Pending half-enrollments are
@@ -6559,4 +9575,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, require_safe_buffer as a, AuthManager as i, ApiKeyManager as n, UserManager as r, ScopedTokenManager as t };
+export { LocalAuthAddon, LocalAuthAddon as default, require_ms as a, __esmMin as c, __toCommonJS as d, __toESM as f, AuthManager as i, __exportAll as l, ApiKeyManager as n, require_safe_buffer as o, UserManager as r, __commonJSMin as s, ScopedTokenManager as t, __require as u };