@reason-machines/cli-darwin-arm64 0.2.168 → 0.2.169

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/bin/Background/Reason.app/Contents/Info.plist +2 -2
  2. package/bin/Background/Reason.app/Contents/MacOS/ReasonBackgroundIdentity +0 -0
  3. package/bin/Reason.app/Contents/CodeResources +0 -0
  4. package/bin/Reason.app/Contents/Info.plist +2 -2
  5. package/bin/Reason.app/Contents/MacOS/Reason +0 -0
  6. package/bin/ara +1 -1
  7. package/bin/libara_device_keychain.dylib +0 -0
  8. package/bin/runtime/srt/sandbox-runtime.mjs +37 -35
  9. package/package.json +1 -1
package/bin/runtime/srt/sandbox-runtime.mjs CHANGED
@@ -1,69 +1,71 @@
1
1
  // @bun
2
- var PU=Object.create;var{getPrototypeOf:_U,defineProperty:u9,getOwnPropertyNames:xU}=Object;var vU=Object.prototype.hasOwnProperty;function kU($){return this[$]}var fU,yU,g9=($,J,X)=>{var Q=$!=null&&typeof $==="object";if(Q){var Y=J?fU??=new WeakMap:yU??=new WeakMap,G=Y.get($);if(G)return G}X=$!=null?PU(_U($)):{};let W=J||!$||!$.__esModule?u9(X,"default",{value:$,enumerable:!0}):X;for(let U of xU($))if(!vU.call(W,U))u9(W,U,{get:kU.bind($,U),enumerable:!0});if(Q)Y.set($,W);return W};var O$=($,J)=>()=>(J||$((J={exports:{}}).exports,J),J.exports);var bU=($)=>$;function hU($,J){this[$]=bU.bind(null,J)}var uU=($,J)=>{for(var X in J)u9($,X,{get:J[X],enumerable:!0,configurable:!0,set:hU.bind(J,X)})};var OX=import.meta.require;var z$=O$((aE,EG)=>{EG.exports={options:{usePureJavaScript:!1}}});var LG=O$((sE,NG)=>{var p9={};NG.exports=p9;var FG={};p9.encode=function($,J,X){if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');if(X!==void 0&&typeof X!=="number")throw TypeError('"maxline" must be a number.');var Q="";if(!($ instanceof Uint8Array))Q=iU($,J);else{var Y=0,G=J.length,W=J.charAt(0),U=[0];for(Y=0;Y<$.length;++Y){for(var M=0,O=$[Y];M<U.length;++M)O+=U[M]<<8,U[M]=O%G,O=O/G|0;while(O>0)U.push(O%G),O=O/G|0}for(Y=0;$[Y]===0&&Y<$.length-1;++Y)Q+=W;for(Y=U.length-1;Y>=0;--Y)Q+=J[U[Y]]}if(X){var V=new RegExp(".{1,"+X+"}","g");Q=Q.match(V).join(`\r
3
- `)}return Q};p9.decode=function($,J){if(typeof $!=="string")throw TypeError('"input" must be a string.');if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');var X=FG[J];if(!X){X=FG[J]=[];for(var Q=0;Q<J.length;++Q)X[J.charCodeAt(Q)]=Q}$=$.replace(/\s/g,"");var Y=J.length,G=J.charAt(0),W=[0];for(var Q=0;Q<$.length;Q++){var U=X[$.charCodeAt(Q)];if(U===void 0)return;for(var M=0,O=U;M<W.length;++M)O+=W[M]*Y,W[M]=O&255,O>>=8;while(O>0)W.push(O&255),O>>=8}for(var V=0;$[V]===G&&V<$.length-1;++V)W.push(0);if(typeof Buffer<"u")return Buffer.from(W.reverse());return new Uint8Array(W.reverse())};function iU($,J){var X=0,Q=J.length,Y=J.charAt(0),G=[0];for(X=0;X<$.length();++X){for(var W=0,U=$.at(X);W<G.length;++W)U+=G[W]<<8,G[W]=U%Q,U=U/Q|0;while(U>0)G.push(U%Q),U=U/Q|0}var M="";for(X=0;$.at(X)===0&&X<$.length()-1;++X)M+=Y;for(X=G.length-1;X>=0;--X)M+=J[G[X]];return M}});var w$=O$((rE,ZG)=>{var AG=z$(),RG=LG(),j=ZG.exports=AG.util=AG.util||{};(function(){if(typeof process<"u"&&process.nextTick){if(j.nextTick=process.nextTick,typeof setImmediate==="function")j.setImmediate=setImmediate;else j.setImmediate=j.nextTick;return}if(typeof setImmediate==="function"){j.setImmediate=function(){return setImmediate.apply(void 0,arguments)},j.nextTick=function(U){return setImmediate(U)};return}if(j.setImmediate=function(U){setTimeout(U,0)},typeof window<"u"&&typeof window.postMessage==="function"){let U=function(M){if(M.source===window&&M.data===$){M.stopPropagation();var O=J.slice();J.length=0,O.forEach(function(V){V()})}};var W=U,$="forge.setImmediate",J=[];j.setImmediate=function(M){if(J.push(M),J.length===1)window.postMessage($,"*")},window.addEventListener("message",U,!0)}if(typeof MutationObserver<"u"){var X=Date.now(),Q=!0,Y=document.createElement("div"),J=[];new MutationObserver(function(){var M=J.slice();J.length=0,M.forEach(function(O){O()})}).observe(Y,{attributes:!0});var G=j.setImmediate;j.setImmediate=function(M){if(Date.now()-X>15)X=Date.now(),G(M);else if(J.push(M),J.length===1)Y.setAttribute("a",Q=!Q)}}j.nextTick=j.setImmediate})();j.isNodejs=typeof process<"u"&&process.versions&&process.versions.node;j.globalScope=function(){if(j.isNodejs)return global;return typeof self>"u"?window:self}();j.isArray=Array.isArray||function($){return Object.prototype.toString.call($)==="[object Array]"};j.isArrayBuffer=function($){return typeof ArrayBuffer<"u"&&$ instanceof ArrayBuffer};j.isArrayBufferView=function($){return $&&j.isArrayBuffer($.buffer)&&$.byteLength!==void 0};function EX($){if(!($===8||$===16||$===24||$===32))throw Error("Only 8, 16, 24, or 32 bits supported: "+$)}j.ByteBuffer=d9;function d9($){if(this.data="",this.read=0,typeof $==="string")this.data=$;else if(j.isArrayBuffer($)||j.isArrayBufferView($))if(typeof Buffer<"u"&&$ instanceof Buffer)this.data=$.toString("binary");else{var J=new Uint8Array($);try{this.data=String.fromCharCode.apply(null,J)}catch(Q){for(var X=0;X<J.length;++X)this.putByte(J[X])}}else if($ instanceof d9||typeof $==="object"&&typeof $.data==="string"&&typeof $.read==="number")this.data=$.data,this.read=$.read;this._constructedStringLength=0}j.ByteStringBuffer=d9;var oU=4096;j.ByteStringBuffer.prototype._optimizeConstructedString=function($){if(this._constructedStringLength+=$,this._constructedStringLength>oU)this.data.substr(0,1),this._constructedStringLength=0};j.ByteStringBuffer.prototype.length=function(){return this.data.length-this.read};j.ByteStringBuffer.prototype.isEmpty=function(){return this.length()<=0};j.ByteStringBuffer.prototype.putByte=function($){return this.putBytes(String.fromCharCode($))};j.ByteStringBuffer.prototype.fillWithByte=function($,J){$=String.fromCharCode($);var X=this.data;while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return this.data=X,this._optimizeConstructedString(J),this};j.ByteStringBuffer.prototype.putBytes=function($){return this.data+=$,this._optimizeConstructedString($.length),this};j.ByteStringBuffer.prototype.putString=function($){return this.putBytes(j.encodeUtf8($))};j.ByteStringBuffer.prototype.putInt16=function($){return this.putBytes(String.fromCharCode($>>8&255)+String.fromCharCode($&255))};j.ByteStringBuffer.prototype.putInt24=function($){return this.putBytes(String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};j.ByteStringBuffer.prototype.putInt32=function($){return this.putBytes(String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};j.ByteStringBuffer.prototype.putInt16Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255))};j.ByteStringBuffer.prototype.putInt24Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255))};j.ByteStringBuffer.prototype.putInt32Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>24&255))};j.ByteStringBuffer.prototype.putInt=function($,J){EX(J);var X="";do J-=8,X+=String.fromCharCode($>>J&255);while(J>0);return this.putBytes(X)};j.ByteStringBuffer.prototype.putSignedInt=function($,J){if($<0)$+=2<<J-1;return this.putInt($,J)};j.ByteStringBuffer.prototype.putBuffer=function($){return this.putBytes($.getBytes())};j.ByteStringBuffer.prototype.getByte=function(){return this.data.charCodeAt(this.read++)};j.ByteStringBuffer.prototype.getInt16=function(){var $=this.data.charCodeAt(this.read)<<8^this.data.charCodeAt(this.read+1);return this.read+=2,$};j.ByteStringBuffer.prototype.getInt24=function(){var $=this.data.charCodeAt(this.read)<<16^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2);return this.read+=3,$};j.ByteStringBuffer.prototype.getInt32=function(){var $=this.data.charCodeAt(this.read)<<24^this.data.charCodeAt(this.read+1)<<16^this.data.charCodeAt(this.read+2)<<8^this.data.charCodeAt(this.read+3);return this.read+=4,$};j.ByteStringBuffer.prototype.getInt16Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8;return this.read+=2,$};j.ByteStringBuffer.prototype.getInt24Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16;return this.read+=3,$};j.ByteStringBuffer.prototype.getInt32Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16^this.data.charCodeAt(this.read+3)<<24;return this.read+=4,$};j.ByteStringBuffer.prototype.getInt=function($){EX($);var J=0;do J=(J<<8)+this.data.charCodeAt(this.read++),$-=8;while($>0);return J};j.ByteStringBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};j.ByteStringBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};j.ByteStringBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};j.ByteStringBuffer.prototype.at=function($){return this.data.charCodeAt(this.read+$)};j.ByteStringBuffer.prototype.setAt=function($,J){return this.data=this.data.substr(0,this.read+$)+String.fromCharCode(J)+this.data.substr(this.read+$+1),this};j.ByteStringBuffer.prototype.last=function(){return this.data.charCodeAt(this.data.length-1)};j.ByteStringBuffer.prototype.copy=function(){var $=j.createBuffer(this.data);return $.read=this.read,$};j.ByteStringBuffer.prototype.compact=function(){if(this.read>0)this.data=this.data.slice(this.read),this.read=0;return this};j.ByteStringBuffer.prototype.clear=function(){return this.data="",this.read=0,this};j.ByteStringBuffer.prototype.truncate=function($){var J=Math.max(0,this.length()-$);return this.data=this.data.substr(this.read,J),this.read=0,this};j.ByteStringBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.length;++J){var X=this.data.charCodeAt(J);if(X<16)$+="0";$+=X.toString(16)}return $};j.ByteStringBuffer.prototype.toString=function(){return j.decodeUtf8(this.bytes())};function aU($,J){J=J||{},this.read=J.readOffset||0,this.growSize=J.growSize||1024;var X=j.isArrayBuffer($),Q=j.isArrayBufferView($);if(X||Q){if(X)this.data=new DataView($);else this.data=new DataView($.buffer,$.byteOffset,$.byteLength);this.write="writeOffset"in J?J.writeOffset:this.data.byteLength;return}if(this.data=new DataView(new ArrayBuffer(0)),this.write=0,$!==null&&$!==void 0)this.putBytes($);if("writeOffset"in J)this.write=J.writeOffset}j.DataBuffer=aU;j.DataBuffer.prototype.length=function(){return this.write-this.read};j.DataBuffer.prototype.isEmpty=function(){return this.length()<=0};j.DataBuffer.prototype.accommodate=function($,J){if(this.length()>=$)return this;J=Math.max(J||this.growSize,$);var X=new Uint8Array(this.data.buffer,this.data.byteOffset,this.data.byteLength),Q=new Uint8Array(this.length()+J);return Q.set(X),this.data=new DataView(Q.buffer),this};j.DataBuffer.prototype.putByte=function($){return this.accommodate(1),this.data.setUint8(this.write++,$),this};j.DataBuffer.prototype.fillWithByte=function($,J){this.accommodate(J);for(var X=0;X<J;++X)this.data.setUint8($);return this};j.DataBuffer.prototype.putBytes=function($,J){if(j.isArrayBufferView($)){var X=new Uint8Array($.buffer,$.byteOffset,$.byteLength),Q=X.byteLength-X.byteOffset;this.accommodate(Q);var Y=new Uint8Array(this.data.buffer,this.write);return Y.set(X),this.write+=Q,this}if(j.isArrayBuffer($)){var X=new Uint8Array($);this.accommodate(X.byteLength);var Y=new Uint8Array(this.data.buffer);return Y.set(X,this.write),this.write+=X.byteLength,this}if($ instanceof j.DataBuffer||typeof $==="object"&&typeof $.read==="number"&&typeof $.write==="number"&&j.isArrayBufferView($.data)){var X=new Uint8Array($.data.byteLength,$.read,$.length());this.accommodate(X.byteLength);var Y=new Uint8Array($.data.byteLength,this.write);return Y.set(X),this.write+=X.byteLength,this}if($ instanceof j.ByteStringBuffer)$=$.data,J="binary";if(J=J||"binary",typeof $==="string"){var G;if(J==="hex")return this.accommodate(Math.ceil($.length/2)),G=new Uint8Array(this.data.buffer,this.write),this.write+=j.binary.hex.decode($,G,this.write),this;if(J==="base64")return this.accommodate(Math.ceil($.length/4)*3),G=new Uint8Array(this.data.buffer,this.write),this.write+=j.binary.base64.decode($,G,this.write),this;if(J==="utf8")$=j.encodeUtf8($),J="binary";if(J==="binary"||J==="raw")return this.accommodate($.length),G=new Uint8Array(this.data.buffer,this.write),this.write+=j.binary.raw.decode(G),this;if(J==="utf16")return this.accommodate($.length*2),G=new Uint16Array(this.data.buffer,this.write),this.write+=j.text.utf16.encode(G),this;throw Error("Invalid encoding: "+J)}throw Error("Invalid parameter: "+$)};j.DataBuffer.prototype.putBuffer=function($){return this.putBytes($),$.clear(),this};j.DataBuffer.prototype.putString=function($){return this.putBytes($,"utf16")};j.DataBuffer.prototype.putInt16=function($){return this.accommodate(2),this.data.setInt16(this.write,$),this.write+=2,this};j.DataBuffer.prototype.putInt24=function($){return this.accommodate(3),this.data.setInt16(this.write,$>>8&65535),this.data.setInt8(this.write,$>>16&255),this.write+=3,this};j.DataBuffer.prototype.putInt32=function($){return this.accommodate(4),this.data.setInt32(this.write,$),this.write+=4,this};j.DataBuffer.prototype.putInt16Le=function($){return this.accommodate(2),this.data.setInt16(this.write,$,!0),this.write+=2,this};j.DataBuffer.prototype.putInt24Le=function($){return this.accommodate(3),this.data.setInt8(this.write,$>>16&255),this.data.setInt16(this.write,$>>8&65535,!0),this.write+=3,this};j.DataBuffer.prototype.putInt32Le=function($){return this.accommodate(4),this.data.setInt32(this.write,$,!0),this.write+=4,this};j.DataBuffer.prototype.putInt=function($,J){EX(J),this.accommodate(J/8);do J-=8,this.data.setInt8(this.write++,$>>J&255);while(J>0);return this};j.DataBuffer.prototype.putSignedInt=function($,J){if(EX(J),this.accommodate(J/8),$<0)$+=2<<J-1;return this.putInt($,J)};j.DataBuffer.prototype.getByte=function(){return this.data.getInt8(this.read++)};j.DataBuffer.prototype.getInt16=function(){var $=this.data.getInt16(this.read);return this.read+=2,$};j.DataBuffer.prototype.getInt24=function(){var $=this.data.getInt16(this.read)<<8^this.data.getInt8(this.read+2);return this.read+=3,$};j.DataBuffer.prototype.getInt32=function(){var $=this.data.getInt32(this.read);return this.read+=4,$};j.DataBuffer.prototype.getInt16Le=function(){var $=this.data.getInt16(this.read,!0);return this.read+=2,$};j.DataBuffer.prototype.getInt24Le=function(){var $=this.data.getInt8(this.read)^this.data.getInt16(this.read+1,!0)<<8;return this.read+=3,$};j.DataBuffer.prototype.getInt32Le=function(){var $=this.data.getInt32(this.read,!0);return this.read+=4,$};j.DataBuffer.prototype.getInt=function($){EX($);var J=0;do J=(J<<8)+this.data.getInt8(this.read++),$-=8;while($>0);return J};j.DataBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};j.DataBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};j.DataBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};j.DataBuffer.prototype.at=function($){return this.data.getUint8(this.read+$)};j.DataBuffer.prototype.setAt=function($,J){return this.data.setUint8($,J),this};j.DataBuffer.prototype.last=function(){return this.data.getUint8(this.write-1)};j.DataBuffer.prototype.copy=function(){return new j.DataBuffer(this)};j.DataBuffer.prototype.compact=function(){if(this.read>0){var $=new Uint8Array(this.data.buffer,this.read),J=new Uint8Array($.byteLength);J.set($),this.data=new DataView(J),this.write-=this.read,this.read=0}return this};j.DataBuffer.prototype.clear=function(){return this.data=new DataView(new ArrayBuffer(0)),this.read=this.write=0,this};j.DataBuffer.prototype.truncate=function($){return this.write=Math.max(0,this.length()-$),this.read=Math.min(this.read,this.write),this};j.DataBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.byteLength;++J){var X=this.data.getUint8(J);if(X<16)$+="0";$+=X.toString(16)}return $};j.DataBuffer.prototype.toString=function($){var J=new Uint8Array(this.data,this.read,this.length());if($=$||"utf8",$==="binary"||$==="raw")return j.binary.raw.encode(J);if($==="hex")return j.binary.hex.encode(J);if($==="base64")return j.binary.base64.encode(J);if($==="utf8")return j.text.utf8.decode(J);if($==="utf16")return j.text.utf16.decode(J);throw Error("Invalid encoding: "+$)};j.createBuffer=function($,J){if(J=J||"raw",$!==void 0&&J==="utf8")$=j.encodeUtf8($);return new j.ByteBuffer($)};j.fillString=function($,J){var X="";while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return X};j.xorBytes=function($,J,X){var Q="",Y="",G="",W=0,U=0;for(;X>0;--X,++W){if(Y=$.charCodeAt(W)^J.charCodeAt(W),U>=10)Q+=G,G="",U=0;G+=String.fromCharCode(Y),++U}return Q+=G,Q};j.hexToBytes=function($){var J="",X=0;if($.length&!0)X=1,J+=String.fromCharCode(parseInt($[0],16));for(;X<$.length;X+=2)J+=String.fromCharCode(parseInt($.substr(X,2),16));return J};j.bytesToHex=function($){return j.createBuffer($).toHex()};j.int32ToBytes=function($){return String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255)};var I0="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",C0=[62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,64,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],DG="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";j.encode64=function($,J){var X="",Q="",Y,G,W,U=0;while(U<$.length){if(Y=$.charCodeAt(U++),G=$.charCodeAt(U++),W=$.charCodeAt(U++),X+=I0.charAt(Y>>2),X+=I0.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=I0.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":I0.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
4
- `,X=X.substr(J)}return Q+=X,Q};j.decode64=function($){$=$.replace(/[^A-Za-z0-9\+\/\=]/g,"");var J="",X,Q,Y,G,W=0;while(W<$.length)if(X=C0[$.charCodeAt(W++)-43],Q=C0[$.charCodeAt(W++)-43],Y=C0[$.charCodeAt(W++)-43],G=C0[$.charCodeAt(W++)-43],J+=String.fromCharCode(X<<2|Q>>4),Y!==64){if(J+=String.fromCharCode((Q&15)<<4|Y>>2),G!==64)J+=String.fromCharCode((Y&3)<<6|G)}return J};j.encodeUtf8=function($){return unescape(encodeURIComponent($))};j.decodeUtf8=function($){return decodeURIComponent(escape($))};j.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:RG.encode,decode:RG.decode}};j.binary.raw.encode=function($){return String.fromCharCode.apply(null,$)};j.binary.raw.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};j.binary.hex.encode=j.bytesToHex;j.binary.hex.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/2));X=X||0;var Y=0,G=X;if($.length&1)Y=1,Q[G++]=parseInt($[0],16);for(;Y<$.length;Y+=2)Q[G++]=parseInt($.substr(Y,2),16);return J?G-X:Q};j.binary.base64.encode=function($,J){var X="",Q="",Y,G,W,U=0;while(U<$.byteLength){if(Y=$[U++],G=$[U++],W=$[U++],X+=I0.charAt(Y>>2),X+=I0.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=I0.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":I0.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
5
- `,X=X.substr(J)}return Q+=X,Q};j.binary.base64.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/4)*3);$=$.replace(/[^A-Za-z0-9\+\/\=]/g,""),X=X||0;var Y,G,W,U,M=0,O=X;while(M<$.length)if(Y=C0[$.charCodeAt(M++)-43],G=C0[$.charCodeAt(M++)-43],W=C0[$.charCodeAt(M++)-43],U=C0[$.charCodeAt(M++)-43],Q[O++]=Y<<2|G>>4,W!==64){if(Q[O++]=(G&15)<<4|W>>2,U!==64)Q[O++]=(W&3)<<6|U}return J?O-X:Q.subarray(0,O)};j.binary.base58.encode=function($,J){return j.binary.baseN.encode($,DG,J)};j.binary.base58.decode=function($,J){return j.binary.baseN.decode($,DG,J)};j.text={utf8:{},utf16:{}};j.text.utf8.encode=function($,J,X){$=j.encodeUtf8($);var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};j.text.utf8.decode=function($){return j.decodeUtf8(String.fromCharCode.apply(null,$))};j.text.utf16.encode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length*2);var Y=new Uint16Array(Q.buffer);X=X||0;var G=X,W=X;for(var U=0;U<$.length;++U)Y[W++]=$.charCodeAt(U),G+=2;return J?G-X:Q};j.text.utf16.decode=function($){return String.fromCharCode.apply(null,new Uint16Array($.buffer))};j.deflate=function($,J,X){if(J=j.decode64($.deflate(j.encode64(J)).rval),X){var Q=2,Y=J.charCodeAt(1);if(Y&32)Q=6;J=J.substring(Q,J.length-4)}return J};j.inflate=function($,J,X){var Q=$.inflate(j.encode64(J)).rval;return Q===null?null:j.decode64(Q)};var c9=function($,J,X){if(!$)throw Error("WebStorage not available.");var Q;if(X===null)Q=$.removeItem(J);else X=j.encode64(JSON.stringify(X)),Q=$.setItem(J,X);if(typeof Q<"u"&&Q.rval!==!0){var Y=Error(Q.error.message);throw Y.id=Q.error.id,Y.name=Q.error.name,Y}},n9=function($,J){if(!$)throw Error("WebStorage not available.");var X=$.getItem(J);if($.init)if(X.rval===null){if(X.error){var Q=Error(X.error.message);throw Q.id=X.error.id,Q.name=X.error.name,Q}X=null}else X=X.rval;if(X!==null)X=JSON.parse(j.decode64(X));return X},sU=function($,J,X,Q){var Y=n9($,J);if(Y===null)Y={};Y[X]=Q,c9($,J,Y)},rU=function($,J,X){var Q=n9($,J);if(Q!==null)Q=X in Q?Q[X]:null;return Q},tU=function($,J,X){var Q=n9($,J);if(Q!==null&&X in Q){delete Q[X];var Y=!0;for(var G in Q){Y=!1;break}if(Y)Q=null;c9($,J,Q)}},eU=function($,J){c9($,J,null)},zY=function($,J,X){var Q=null;if(typeof X>"u")X=["web","flash"];var Y,G=!1,W=null;for(var U in X){Y=X[U];try{if(Y==="flash"||Y==="both"){if(J[0]===null)throw Error("Flash local storage not available.");Q=$.apply(this,J),G=Y==="flash"}if(Y==="web"||Y==="both")J[0]=localStorage,Q=$.apply(this,J),G=!0}catch(M){W=M}if(G)break}if(!G)throw W;return Q};j.setItem=function($,J,X,Q,Y){zY(sU,arguments,Y)};j.getItem=function($,J,X,Q){return zY(rU,arguments,Q)};j.removeItem=function($,J,X,Q){zY(tU,arguments,Q)};j.clearItems=function($,J,X){zY(eU,arguments,X)};j.isEmpty=function($){for(var J in $)if($.hasOwnProperty(J))return!1;return!0};j.format=function($){var J=/%./g,X,Q,Y=0,G=[],W=0;while(X=J.exec($)){if(Q=$.substring(W,J.lastIndex-2),Q.length>0)G.push(Q);W=J.lastIndex;var U=X[0][1];switch(U){case"s":case"o":if(Y<arguments.length)G.push(arguments[Y+++1]);else G.push("<?>");break;case"%":G.push("%");break;default:G.push("<%"+U+"?>")}}return G.push($.substring(W)),G.join("")};j.formatNumber=function($,J,X,Q){var Y=$,G=isNaN(J=Math.abs(J))?2:J,W=X===void 0?",":X,U=Q===void 0?".":Q,M=Y<0?"-":"",O=parseInt(Y=Math.abs(+Y||0).toFixed(G),10)+"",V=O.length>3?O.length%3:0;return M+(V?O.substr(0,V)+U:"")+O.substr(V).replace(/(\d{3})(?=\d)/g,"$1"+U)+(G?W+Math.abs(Y-O).toFixed(G).slice(2):"")};j.formatSize=function($){if($>=1073741824)$=j.formatNumber($/1073741824,2,".","")+" GiB";else if($>=1048576)$=j.formatNumber($/1048576,2,".","")+" MiB";else if($>=1024)$=j.formatNumber($/1024,0)+" KiB";else $=j.formatNumber($,0)+" bytes";return $};j.bytesFromIP=function($){if($.indexOf(".")!==-1)return j.bytesFromIPv4($);if($.indexOf(":")!==-1)return j.bytesFromIPv6($);return null};j.bytesFromIPv4=function($){if($=$.split("."),$.length!==4)return null;var J=j.createBuffer();for(var X=0;X<$.length;++X){var Q=parseInt($[X],10);if(isNaN(Q))return null;J.putByte(Q)}return J.getBytes()};j.bytesFromIPv6=function($){var J=0;$=$.split(":").filter(function(W){if(W.length===0)++J;return!0});var X=(8-$.length+J)*2,Q=j.createBuffer();for(var Y=0;Y<8;++Y){if(!$[Y]||$[Y].length===0){Q.fillWithByte(0,X),X=0;continue}var G=j.hexToBytes($[Y]);if(G.length<2)Q.putByte(0);Q.putBytes(G)}return Q.getBytes()};j.bytesToIP=function($){if($.length===4)return j.bytesToIPv4($);if($.length===16)return j.bytesToIPv6($);return null};j.bytesToIPv4=function($){if($.length!==4)return null;var J=[];for(var X=0;X<$.length;++X)J.push($.charCodeAt(X));return J.join(".")};j.bytesToIPv6=function($){if($.length!==16)return null;var J=[],X=[],Q=0;for(var Y=0;Y<$.length;Y+=2){var G=j.bytesToHex($[Y]+$[Y+1]);while(G[0]==="0"&&G!=="0")G=G.substr(1);if(G==="0"){var W=X[X.length-1],U=J.length;if(!W||U!==W.end+1)X.push({start:U,end:U});else if(W.end=U,W.end-W.start>X[Q].end-X[Q].start)Q=X.length-1}J.push(G)}if(X.length>0){var M=X[Q];if(M.end-M.start>0){if(J.splice(M.start,M.end-M.start+1,""),M.start===0)J.unshift("");if(M.end===7)J.push("")}}return J.join(":")};j.estimateCores=function($,J){if(typeof $==="function")J=$,$={};if($=$||{},"cores"in j&&!$.update)return J(null,j.cores);if(typeof navigator<"u"&&"hardwareConcurrency"in navigator&&navigator.hardwareConcurrency>0)return j.cores=navigator.hardwareConcurrency,J(null,j.cores);if(typeof Worker>"u")return j.cores=1,J(null,j.cores);if(typeof Blob>"u")return j.cores=2,J(null,j.cores);var X=URL.createObjectURL(new Blob(["(",function(){self.addEventListener("message",function(W){var U=Date.now(),M=U+4;while(Date.now()<M);self.postMessage({st:U,et:M})})}.toString(),")()"],{type:"application/javascript"}));Q([],5,16);function Q(W,U,M){if(U===0){var O=Math.floor(W.reduce(function(V,H){return V+H},0)/W.length);return j.cores=Math.max(1,O),URL.revokeObjectURL(X),J(null,j.cores)}Y(M,function(V,H){W.push(G(M,H)),Q(W,U-1,M)})}function Y(W,U){var M=[],O=[];for(var V=0;V<W;++V){var H=new Worker(X);H.addEventListener("message",function(q){if(O.push(q.data),O.length===W){for(var F=0;F<W;++F)M[F].terminate();U(null,O)}}),M.push(H)}for(var V=0;V<W;++V)M[V].postMessage(V)}function G(W,U){var M=[];for(var O=0;O<W;++O){var V=U[O],H=M[O]=[];for(var q=0;q<W;++q){if(O===q)continue;var F=U[q];if(V.st>F.st&&V.st<F.et||F.st>V.st&&F.st<V.et)H.push(q)}}return M.reduce(function(K,A){return Math.max(K,A.length)},0)}}});var EY=O$((tE,BG)=>{var MJ=z$();w$();BG.exports=MJ.cipher=MJ.cipher||{};MJ.cipher.algorithms=MJ.cipher.algorithms||{};MJ.cipher.createCipher=function($,J){var X=$;if(typeof X==="string"){if(X=MJ.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new MJ.cipher.BlockCipher({algorithm:X,key:J,decrypt:!1})};MJ.cipher.createDecipher=function($,J){var X=$;if(typeof X==="string"){if(X=MJ.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new MJ.cipher.BlockCipher({algorithm:X,key:J,decrypt:!0})};MJ.cipher.registerAlgorithm=function($,J){$=$.toUpperCase(),MJ.cipher.algorithms[$]=J};MJ.cipher.getAlgorithm=function($){if($=$.toUpperCase(),$ in MJ.cipher.algorithms)return MJ.cipher.algorithms[$];return null};var i9=MJ.cipher.BlockCipher=function($){this.algorithm=$.algorithm,this.mode=this.algorithm.mode,this.blockSize=this.mode.blockSize,this._finish=!1,this._input=null,this.output=null,this._op=$.decrypt?this.mode.decrypt:this.mode.encrypt,this._decrypt=$.decrypt,this.algorithm.initialize($)};i9.prototype.start=function($){$=$||{};var J={};for(var X in $)J[X]=$[X];J.decrypt=this._decrypt,this._finish=!1,this._input=MJ.util.createBuffer(),this.output=$.output||MJ.util.createBuffer(),this.mode.start(J)};i9.prototype.update=function($){if($)this._input.putBuffer($);while(!this._op.call(this.mode,this._input,this.output,this._finish)&&!this._finish);this._input.compact()};i9.prototype.finish=function($){if($&&(this.mode.name==="ECB"||this.mode.name==="CBC"))this.mode.pad=function(X){return $(this.blockSize,X,!1)},this.mode.unpad=function(X){return $(this.blockSize,X,!0)};var J={};if(J.decrypt=this._decrypt,J.overflow=this._input.length()%this.blockSize,!this._decrypt&&this.mode.pad){if(!this.mode.pad(this._input,J))return!1}if(this._finish=!0,this.update(),this._decrypt&&this.mode.unpad){if(!this.mode.unpad(this.output,J))return!1}if(this.mode.afterFinish){if(!this.mode.afterFinish(this.output,J))return!1}return!0}});var a9=O$((eE,jG)=>{var OJ=z$();w$();OJ.cipher=OJ.cipher||{};var A$=jG.exports=OJ.cipher.modes=OJ.cipher.modes||{};A$.ecb=function($){$=$||{},this.name="ECB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};A$.ecb.prototype.start=function($){};A$.ecb.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};A$.ecb.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};A$.ecb.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};A$.ecb.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};A$.cbc=function($){$=$||{},this.name="CBC",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};A$.cbc.prototype.start=function($){if($.iv===null){if(!this._prev)throw Error("Invalid IV parameter.");this._iv=this._prev.slice(0)}else if(!("iv"in $))throw Error("Invalid IV parameter.");else this._iv=FY($.iv,this.blockSize),this._prev=this._iv.slice(0)};A$.cbc.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=this._prev[Q]^$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q]);this._prev=this._outBlock};A$.cbc.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._prev[Q]^this._outBlock[Q]);this._prev=this._inBlock.slice(0)};A$.cbc.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};A$.cbc.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};A$.cfb=function($){$=$||{},this.name="CFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};A$.cfb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=FY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};A$.cfb.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32()^this._outBlock[Y],J.putInt32(this._inBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32()^this._outBlock[Y],this._partialOutput.putInt32(this._partialBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};A$.cfb.prototype.decrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32(),J.putInt32(this._inBlock[Y]^this._outBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32(),this._partialOutput.putInt32(this._partialBlock[Y]^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};A$.ofb=function($){$=$||{},this.name="OFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};A$.ofb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=FY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};A$.ofb.prototype.encrypt=function($,J,X){var Q=$.length();if($.length()===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]),this._inBlock[Y]=this._outBlock[Y];return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._outBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};A$.ofb.prototype.decrypt=A$.ofb.prototype.encrypt;A$.ctr=function($){$=$||{},this.name="CTR",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};A$.ctr.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=FY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};A$.ctr.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize)for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]);else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}NY(this._inBlock)};A$.ctr.prototype.decrypt=A$.ctr.prototype.encrypt;A$.gcm=function($){$=$||{},this.name="GCM",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0,this._R=3774873600};A$.gcm.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");var J=OJ.util.createBuffer($.iv);this._cipherLength=0;var X;if("additionalData"in $)X=OJ.util.createBuffer($.additionalData);else X=OJ.util.createBuffer();if("tagLength"in $)this._tagLength=$.tagLength;else this._tagLength=128;if(this._tag=null,$.decrypt){if(this._tag=OJ.util.createBuffer($.tag).getBytes(),this._tag.length!==this._tagLength/8)throw Error("Authentication tag does not match tag length.")}this._hashBlock=Array(this._ints),this.tag=null,this._hashSubkey=Array(this._ints),this.cipher.encrypt([0,0,0,0],this._hashSubkey),this.componentBits=4,this._m=this.generateHashTable(this._hashSubkey,this.componentBits);var Q=J.length();if(Q===12)this._j0=[J.getInt32(),J.getInt32(),J.getInt32(),1];else{this._j0=[0,0,0,0];while(J.length()>0)this._j0=this.ghash(this._hashSubkey,this._j0,[J.getInt32(),J.getInt32(),J.getInt32(),J.getInt32()]);this._j0=this.ghash(this._hashSubkey,this._j0,[0,0].concat(o9(Q*8)))}this._inBlock=this._j0.slice(0),NY(this._inBlock),this._partialBytes=0,X=OJ.util.createBuffer(X),this._aDataLength=o9(X.length()*8);var Y=X.length()%this.blockSize;if(Y)X.fillWithByte(0,this.blockSize-Y);this._s=[0,0,0,0];while(X.length()>0)this._s=this.ghash(this._hashSubkey,this._s,[X.getInt32(),X.getInt32(),X.getInt32(),X.getInt32()])};A$.gcm.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^=$.getInt32());this._cipherLength+=this.blockSize}else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G<=0||X){if(X){var W=Q%this.blockSize;this._cipherLength+=W,this._partialOutput.truncate(this.blockSize-W)}else this._cipherLength+=this.blockSize;for(var Y=0;Y<this._ints;++Y)this._outBlock[Y]=this._partialOutput.getInt32();this._partialOutput.read-=this.blockSize}if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return $.read-=this.blockSize,J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}this._s=this.ghash(this._hashSubkey,this._s,this._outBlock),NY(this._inBlock)};A$.gcm.prototype.decrypt=function($,J,X){var Q=$.length();if(Q<this.blockSize&&!(X&&Q>0))return!0;this.cipher.encrypt(this._inBlock,this._outBlock),NY(this._inBlock),this._hashBlock[0]=$.getInt32(),this._hashBlock[1]=$.getInt32(),this._hashBlock[2]=$.getInt32(),this._hashBlock[3]=$.getInt32(),this._s=this.ghash(this._hashSubkey,this._s,this._hashBlock);for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^this._hashBlock[Y]);if(Q<this.blockSize)this._cipherLength+=Q%this.blockSize;else this._cipherLength+=this.blockSize};A$.gcm.prototype.afterFinish=function($,J){var X=!0;if(J.decrypt&&J.overflow)$.truncate(this.blockSize-J.overflow);this.tag=OJ.util.createBuffer();var Q=this._aDataLength.concat(o9(this._cipherLength*8));this._s=this.ghash(this._hashSubkey,this._s,Q);var Y=[];this.cipher.encrypt(this._j0,Y);for(var G=0;G<this._ints;++G)this.tag.putInt32(this._s[G]^Y[G]);if(this.tag.truncate(this.tag.length()%(this._tagLength/8)),J.decrypt&&this.tag.bytes()!==this._tag)X=!1;return X};A$.gcm.prototype.multiply=function($,J){var X=[0,0,0,0],Q=J.slice(0);for(var Y=0;Y<128;++Y){var G=$[Y/32|0]&1<<31-Y%32;if(G)X[0]^=Q[0],X[1]^=Q[1],X[2]^=Q[2],X[3]^=Q[3];this.pow(Q,Q)}return X};A$.gcm.prototype.pow=function($,J){var X=$[3]&1;for(var Q=3;Q>0;--Q)J[Q]=$[Q]>>>1|($[Q-1]&1)<<31;if(J[0]=$[0]>>>1,X)J[0]^=this._R};A$.gcm.prototype.tableMultiply=function($){var J=[0,0,0,0];for(var X=0;X<32;++X){var Q=X/8|0,Y=$[Q]>>>(7-X%8)*4&15,G=this._m[X][Y];J[0]^=G[0],J[1]^=G[1],J[2]^=G[2],J[3]^=G[3]}return J};A$.gcm.prototype.ghash=function($,J,X){return J[0]^=X[0],J[1]^=X[1],J[2]^=X[2],J[3]^=X[3],this.tableMultiply(J)};A$.gcm.prototype.generateHashTable=function($,J){var X=8/J,Q=4*X,Y=16*X,G=Array(Y);for(var W=0;W<Y;++W){var U=[0,0,0,0],M=W/Q|0,O=(Q-1-W%Q)*J;U[M]=1<<J-1<<O,G[W]=this.generateSubHashTable(this.multiply(U,$),J)}return G};A$.gcm.prototype.generateSubHashTable=function($,J){var X=1<<J,Q=X>>>1,Y=Array(X);Y[Q]=$.slice(0);var G=Q>>>1;while(G>0)this.pow(Y[2*G],Y[G]=[]),G>>=1;G=2;while(G<Q){for(var W=1;W<G;++W){var U=Y[G],M=Y[W];Y[G+W]=[U[0]^M[0],U[1]^M[1],U[2]^M[2],U[3]^M[3]]}G*=2}Y[0]=[0,0,0,0];for(G=Q+1;G<X;++G){var O=Y[G^Q];Y[G]=[$[0]^O[0],$[1]^O[1],$[2]^O[2],$[3]^O[3]]}return Y};function FY($,J){if(typeof $==="string")$=OJ.util.createBuffer($);if(OJ.util.isArray($)&&$.length>4){var X=$;$=OJ.util.createBuffer();for(var Q=0;Q<X.length;++Q)$.putByte(X[Q])}if($.length()<J)throw Error("Invalid IV length; got "+$.length()+" bytes and expected "+J+" bytes.");if(!OJ.util.isArray($)){var Y=[],G=J/4;for(var Q=0;Q<G;++Q)Y.push($.getInt32());$=Y}return $}function NY($){$[$.length-1]=$[$.length-1]+1&4294967295}function o9($){return[$/4294967296|0,$&4294967295]}});var w0=O$(($F,CG)=>{var m$=z$();EY();a9();w$();CG.exports=m$.aes=m$.aes||{};m$.aes.startEncrypting=function($,J,X,Q){var Y=LY({key:$,output:X,decrypt:!1,mode:Q});return Y.start(J),Y};m$.aes.createEncryptionCipher=function($,J){return LY({key:$,output:null,decrypt:!1,mode:J})};m$.aes.startDecrypting=function($,J,X,Q){var Y=LY({key:$,output:X,decrypt:!0,mode:Q});return Y.start(J),Y};m$.aes.createDecryptionCipher=function($,J){return LY({key:$,output:null,decrypt:!0,mode:J})};m$.aes.Algorithm=function($,J){if(!t9)SG();var X=this;X.name=$,X.mode=new J({blockSize:16,cipher:{encrypt:function(Q,Y){return r9(X._w,Q,Y,!1)},decrypt:function(Q,Y){return r9(X._w,Q,Y,!0)}}}),X._init=!1};m$.aes.Algorithm.prototype.initialize=function($){if(this._init)return;var J=$.key,X;if(typeof J==="string"&&(J.length===16||J.length===24||J.length===32))J=m$.util.createBuffer(J);else if(m$.util.isArray(J)&&(J.length===16||J.length===24||J.length===32)){X=J,J=m$.util.createBuffer();for(var Q=0;Q<X.length;++Q)J.putByte(X[Q])}if(!m$.util.isArray(J)){X=J,J=[];var Y=X.length();if(Y===16||Y===24||Y===32){Y=Y>>>2;for(var Q=0;Q<Y;++Q)J.push(X.getInt32())}}if(!m$.util.isArray(J)||!(J.length===4||J.length===6||J.length===8))throw Error("Invalid key parameter.");var G=this.mode.name,W=["CFB","OFB","CTR","GCM"].indexOf(G)!==-1;this._w=IG(J,$.decrypt&&!W),this._init=!0};m$.aes._expandKey=function($,J){if(!t9)SG();return IG($,J)};m$.aes._updateBlock=r9;jQ("AES-ECB",m$.cipher.modes.ecb);jQ("AES-CBC",m$.cipher.modes.cbc);jQ("AES-CFB",m$.cipher.modes.cfb);jQ("AES-OFB",m$.cipher.modes.ofb);jQ("AES-CTR",m$.cipher.modes.ctr);jQ("AES-GCM",m$.cipher.modes.gcm);function jQ($,J){var X=function(){return new m$.aes.Algorithm($,J)};m$.cipher.registerAlgorithm($,X)}var t9=!1,BQ=4,LJ,s9,TG,$Q,gJ;function SG(){t9=!0,TG=[0,1,2,4,8,16,32,64,128,27,54];var $=Array(256);for(var J=0;J<128;++J)$[J]=J<<1,$[J+128]=J+128<<1^283;LJ=Array(256),s9=Array(256),$Q=[,,,,],gJ=[,,,,];for(var J=0;J<4;++J)$Q[J]=Array(256),gJ[J]=Array(256);var X=0,Q=0,Y,G,W,U,M,O,V;for(var J=0;J<256;++J){U=Q^Q<<1^Q<<2^Q<<3^Q<<4,U=U>>8^U&255^99,LJ[X]=U,s9[U]=X,M=$[U],Y=$[X],G=$[Y],W=$[G],O=M<<24^U<<16^U<<8^(U^M),V=(Y^G^W)<<24^(X^W)<<16^(X^G^W)<<8^(X^Y^W);for(var H=0;H<4;++H)$Q[H][X]=O,gJ[H][U]=V,O=O<<24|O>>>8,V=V<<24|V>>>8;if(X===0)X=Q=1;else X=Y^$[$[$[Y^W]]],Q^=$[$[Q]]}}function IG($,J){var X=$.slice(0),Q,Y=1,G=X.length,W=G+6+1,U=BQ*W;for(var M=G;M<U;++M){if(Q=X[M-1],M%G===0)Q=LJ[Q>>>16&255]<<24^LJ[Q>>>8&255]<<16^LJ[Q&255]<<8^LJ[Q>>>24]^TG[Y]<<24,Y++;else if(G>6&&M%G===4)Q=LJ[Q>>>24]<<24^LJ[Q>>>16&255]<<16^LJ[Q>>>8&255]<<8^LJ[Q&255];X[M]=X[M-G]^Q}if(J){var O,V=gJ[0],H=gJ[1],q=gJ[2],F=gJ[3],K=X.slice(0);U=X.length;for(var M=0,A=U-BQ;M<U;M+=BQ,A-=BQ)if(M===0||M===U-BQ)K[M]=X[A],K[M+1]=X[A+3],K[M+2]=X[A+2],K[M+3]=X[A+1];else for(var L=0;L<BQ;++L)O=X[A+L],K[M+(3&-L)]=V[LJ[O>>>24]]^H[LJ[O>>>16&255]]^q[LJ[O>>>8&255]]^F[LJ[O&255]];X=K}return X}function r9($,J,X,Q){var Y=$.length/4-1,G,W,U,M,O;if(Q)G=gJ[0],W=gJ[1],U=gJ[2],M=gJ[3],O=s9;else G=$Q[0],W=$Q[1],U=$Q[2],M=$Q[3],O=LJ;var V,H,q,F,K,A,L;V=J[0]^$[0],H=J[Q?3:1]^$[1],q=J[2]^$[2],F=J[Q?1:3]^$[3];var R=3;for(var I=1;I<Y;++I)K=G[V>>>24]^W[H>>>16&255]^U[q>>>8&255]^M[F&255]^$[++R],A=G[H>>>24]^W[q>>>16&255]^U[F>>>8&255]^M[V&255]^$[++R],L=G[q>>>24]^W[F>>>16&255]^U[V>>>8&255]^M[H&255]^$[++R],F=G[F>>>24]^W[V>>>16&255]^U[H>>>8&255]^M[q&255]^$[++R],V=K,H=A,q=L;X[0]=O[V>>>24]<<24^O[H>>>16&255]<<16^O[q>>>8&255]<<8^O[F&255]^$[++R],X[Q?3:1]=O[H>>>24]<<24^O[q>>>16&255]<<16^O[F>>>8&255]<<8^O[V&255]^$[++R],X[2]=O[q>>>24]<<24^O[F>>>16&255]<<16^O[V>>>8&255]<<8^O[H&255]^$[++R],X[Q?1:3]=O[F>>>24]<<24^O[V>>>16&255]<<16^O[H>>>8&255]<<8^O[q&255]^$[++R]}function LY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="AES-"+J,Q;if($.decrypt)Q=m$.cipher.createDecipher(X,$.key);else Q=m$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var U=null;if(W instanceof m$.util.ByteBuffer)U=W,W={};W=W||{},W.output=U,W.iv=G,Y.call(Q,W)},Q}});var P0=O$((JF,wG)=>{var FX=z$();FX.pki=FX.pki||{};var e9=wG.exports=FX.pki.oids=FX.oids=FX.oids||{};function h($,J){e9[$]=J,e9[J]=$}function k$($,J){e9[$]=J}h("1.2.840.113549.1.1.1","rsaEncryption");h("1.2.840.113549.1.1.4","md5WithRSAEncryption");h("1.2.840.113549.1.1.5","sha1WithRSAEncryption");h("1.2.840.113549.1.1.7","RSAES-OAEP");h("1.2.840.113549.1.1.8","mgf1");h("1.2.840.113549.1.1.9","pSpecified");h("1.2.840.113549.1.1.10","RSASSA-PSS");h("1.2.840.113549.1.1.11","sha256WithRSAEncryption");h("1.2.840.113549.1.1.12","sha384WithRSAEncryption");h("1.2.840.113549.1.1.13","sha512WithRSAEncryption");h("1.3.101.112","EdDSA25519");h("1.2.840.10040.4.3","dsa-with-sha1");h("1.3.14.3.2.7","desCBC");h("1.3.14.3.2.26","sha1");h("1.3.14.3.2.29","sha1WithRSASignature");h("2.16.840.1.101.3.4.2.1","sha256");h("2.16.840.1.101.3.4.2.2","sha384");h("2.16.840.1.101.3.4.2.3","sha512");h("2.16.840.1.101.3.4.2.4","sha224");h("2.16.840.1.101.3.4.2.5","sha512-224");h("2.16.840.1.101.3.4.2.6","sha512-256");h("1.2.840.113549.2.2","md2");h("1.2.840.113549.2.5","md5");h("1.2.840.113549.1.7.1","data");h("1.2.840.113549.1.7.2","signedData");h("1.2.840.113549.1.7.3","envelopedData");h("1.2.840.113549.1.7.4","signedAndEnvelopedData");h("1.2.840.113549.1.7.5","digestedData");h("1.2.840.113549.1.7.6","encryptedData");h("1.2.840.113549.1.9.1","emailAddress");h("1.2.840.113549.1.9.2","unstructuredName");h("1.2.840.113549.1.9.3","contentType");h("1.2.840.113549.1.9.4","messageDigest");h("1.2.840.113549.1.9.5","signingTime");h("1.2.840.113549.1.9.6","counterSignature");h("1.2.840.113549.1.9.7","challengePassword");h("1.2.840.113549.1.9.8","unstructuredAddress");h("1.2.840.113549.1.9.14","extensionRequest");h("1.2.840.113549.1.9.20","friendlyName");h("1.2.840.113549.1.9.21","localKeyId");h("1.2.840.113549.1.9.22.1","x509Certificate");h("1.2.840.113549.1.12.10.1.1","keyBag");h("1.2.840.113549.1.12.10.1.2","pkcs8ShroudedKeyBag");h("1.2.840.113549.1.12.10.1.3","certBag");h("1.2.840.113549.1.12.10.1.4","crlBag");h("1.2.840.113549.1.12.10.1.5","secretBag");h("1.2.840.113549.1.12.10.1.6","safeContentsBag");h("1.2.840.113549.1.5.13","pkcs5PBES2");h("1.2.840.113549.1.5.12","pkcs5PBKDF2");h("1.2.840.113549.1.12.1.1","pbeWithSHAAnd128BitRC4");h("1.2.840.113549.1.12.1.2","pbeWithSHAAnd40BitRC4");h("1.2.840.113549.1.12.1.3","pbeWithSHAAnd3-KeyTripleDES-CBC");h("1.2.840.113549.1.12.1.4","pbeWithSHAAnd2-KeyTripleDES-CBC");h("1.2.840.113549.1.12.1.5","pbeWithSHAAnd128BitRC2-CBC");h("1.2.840.113549.1.12.1.6","pbewithSHAAnd40BitRC2-CBC");h("1.2.840.113549.2.7","hmacWithSHA1");h("1.2.840.113549.2.8","hmacWithSHA224");h("1.2.840.113549.2.9","hmacWithSHA256");h("1.2.840.113549.2.10","hmacWithSHA384");h("1.2.840.113549.2.11","hmacWithSHA512");h("1.2.840.113549.3.7","des-EDE3-CBC");h("2.16.840.1.101.3.4.1.2","aes128-CBC");h("2.16.840.1.101.3.4.1.22","aes192-CBC");h("2.16.840.1.101.3.4.1.42","aes256-CBC");h("2.5.4.3","commonName");h("2.5.4.4","surname");h("2.5.4.5","serialNumber");h("2.5.4.6","countryName");h("2.5.4.7","localityName");h("2.5.4.8","stateOrProvinceName");h("2.5.4.9","streetAddress");h("2.5.4.10","organizationName");h("2.5.4.11","organizationalUnitName");h("2.5.4.12","title");h("2.5.4.13","description");h("2.5.4.15","businessCategory");h("2.5.4.17","postalCode");h("2.5.4.42","givenName");h("2.5.4.65","pseudonym");h("1.3.6.1.4.1.311.60.2.1.2","jurisdictionOfIncorporationStateOrProvinceName");h("1.3.6.1.4.1.311.60.2.1.3","jurisdictionOfIncorporationCountryName");h("2.16.840.1.113730.1.1","nsCertType");h("2.16.840.1.113730.1.13","nsComment");k$("2.5.29.1","authorityKeyIdentifier");k$("2.5.29.2","keyAttributes");k$("2.5.29.3","certificatePolicies");k$("2.5.29.4","keyUsageRestriction");k$("2.5.29.5","policyMapping");k$("2.5.29.6","subtreesConstraint");k$("2.5.29.7","subjectAltName");k$("2.5.29.8","issuerAltName");k$("2.5.29.9","subjectDirectoryAttributes");k$("2.5.29.10","basicConstraints");k$("2.5.29.11","nameConstraints");k$("2.5.29.12","policyConstraints");k$("2.5.29.13","basicConstraints");h("2.5.29.14","subjectKeyIdentifier");h("2.5.29.15","keyUsage");k$("2.5.29.16","privateKeyUsagePeriod");h("2.5.29.17","subjectAltName");h("2.5.29.18","issuerAltName");h("2.5.29.19","basicConstraints");k$("2.5.29.20","cRLNumber");k$("2.5.29.21","cRLReason");k$("2.5.29.22","expirationDate");k$("2.5.29.23","instructionCode");k$("2.5.29.24","invalidityDate");k$("2.5.29.25","cRLDistributionPoints");k$("2.5.29.26","issuingDistributionPoint");k$("2.5.29.27","deltaCRLIndicator");k$("2.5.29.28","issuingDistributionPoint");k$("2.5.29.29","certificateIssuer");k$("2.5.29.30","nameConstraints");h("2.5.29.31","cRLDistributionPoints");h("2.5.29.32","certificatePolicies");k$("2.5.29.33","policyMappings");k$("2.5.29.34","policyConstraints");h("2.5.29.35","authorityKeyIdentifier");k$("2.5.29.36","policyConstraints");h("2.5.29.37","extKeyUsage");k$("2.5.29.46","freshestCRL");k$("2.5.29.54","inhibitAnyPolicy");h("1.3.6.1.4.1.11129.2.4.2","timestampList");h("1.3.6.1.5.5.7.1.1","authorityInfoAccess");h("1.3.6.1.5.5.7.3.1","serverAuth");h("1.3.6.1.5.5.7.3.2","clientAuth");h("1.3.6.1.5.5.7.3.3","codeSigning");h("1.3.6.1.5.5.7.3.4","emailProtection");h("1.3.6.1.5.5.7.3.8","timeStamping")});var mJ=O$((QF,_G)=>{var p$=z$();w$();P0();var c=_G.exports=p$.asn1=p$.asn1||{};c.Class={UNIVERSAL:0,APPLICATION:64,CONTEXT_SPECIFIC:128,PRIVATE:192};c.Type={NONE:0,BOOLEAN:1,INTEGER:2,BITSTRING:3,OCTETSTRING:4,NULL:5,OID:6,ODESC:7,EXTERNAL:8,REAL:9,ENUMERATED:10,EMBEDDED:11,UTF8:12,ROID:13,SEQUENCE:16,SET:17,PRINTABLESTRING:19,IA5STRING:22,UTCTIME:23,GENERALIZEDTIME:24,BMPSTRING:30};c.maxDepth=256;c.create=function($,J,X,Q,Y){if(p$.util.isArray(Q)){var G=[];for(var W=0;W<Q.length;++W)if(Q[W]!==void 0)G.push(Q[W]);Q=G}var U={tagClass:$,type:J,constructed:X,composed:X||p$.util.isArray(Q),value:Q};if(Y&&"bitStringContents"in Y)U.bitStringContents=Y.bitStringContents,U.original=c.copy(U);return U};c.copy=function($,J){var X;if(p$.util.isArray($)){X=[];for(var Q=0;Q<$.length;++Q)X.push(c.copy($[Q],J));return X}if(typeof $==="string")return $;if(X={tagClass:$.tagClass,type:$.type,constructed:$.constructed,composed:$.composed,value:c.copy($.value,J)},J&&!J.excludeBitStringContents)X.bitStringContents=$.bitStringContents;return X};c.equals=function($,J,X){if(p$.util.isArray($)){if(!p$.util.isArray(J))return!1;if($.length!==J.length)return!1;for(var Q=0;Q<$.length;++Q)if(!c.equals($[Q],J[Q]))return!1;return!0}if(typeof $!==typeof J)return!1;if(typeof $==="string")return $===J;var Y=$.tagClass===J.tagClass&&$.type===J.type&&$.constructed===J.constructed&&$.composed===J.composed&&c.equals($.value,J.value);if(X&&X.includeBitStringContents)Y=Y&&$.bitStringContents===J.bitStringContents;return Y};c.getBerValueLength=function($){var J=$.getByte();if(J===128)return;var X,Q=J&128;if(!Q)X=J;else X=$.getInt((J&127)<<3);return X};function NX($,J,X){if(X>J){var Q=Error("Too few bytes to parse DER.");throw Q.available=$.length(),Q.remaining=J,Q.requested=X,Q}}var $M=function($,J){var X=$.getByte();if(J--,X===128)return;var Q,Y=X&128;if(!Y)Q=X;else{var G=X&127;NX($,J,G),Q=$.getInt(G<<3)}if(Q<0)throw Error("Negative length: "+Q);return Q};c.fromDer=function($,J){if(J===void 0)J={strict:!0,parseAllBytes:!0,decodeBitStrings:!0};if(typeof J==="boolean")J={strict:J,parseAllBytes:!0,decodeBitStrings:!0};if(!("strict"in J))J.strict=!0;if(!("parseAllBytes"in J))J.parseAllBytes=!0;if(!("decodeBitStrings"in J))J.decodeBitStrings=!0;if(!("maxDepth"in J))J.maxDepth=c.maxDepth;if(typeof $==="string")$=p$.util.createBuffer($);var X=$.length(),Q=AY($,$.length(),0,J);if(J.parseAllBytes&&$.length()!==0){var Y=Error("Unparsed DER bytes remain after ASN.1 parsing.");throw Y.byteCount=X,Y.remaining=$.length(),Y}return Q};function AY($,J,X,Q){if(X>=Q.maxDepth)throw Error("ASN.1 parsing error: Max depth exceeded.");var Y;NX($,J,2);var G=$.getByte();J--;var W=G&192,U=G&31;Y=$.length();var M=$M($,J);if(J-=Y-$.length(),M!==void 0&&M>J){if(Q.strict){var O=Error("Too few bytes to read ASN.1 value.");throw O.available=$.length(),O.remaining=J,O.requested=M,O}M=J}var V,H,q=(G&32)===32;if(q)if(V=[],M===void 0)for(;;){if(NX($,J,2),$.bytes(2)===String.fromCharCode(0,0)){$.getBytes(2),J-=2;break}Y=$.length(),V.push(AY($,J,X+1,Q)),J-=Y-$.length()}else while(M>0)Y=$.length(),V.push(AY($,M,X+1,Q)),J-=Y-$.length(),M-=Y-$.length();if(V===void 0&&W===c.Class.UNIVERSAL&&U===c.Type.BITSTRING)H=$.bytes(M);if(V===void 0&&Q.decodeBitStrings&&W===c.Class.UNIVERSAL&&U===c.Type.BITSTRING&&M>1){var F=$.read,K=J,A=0;if(U===c.Type.BITSTRING)NX($,J,1),A=$.getByte(),J--;if(A===0)try{Y=$.length();var L={strict:!0,decodeBitStrings:!0},R=AY($,J,X+1,L),I=Y-$.length();if(J-=I,U==c.Type.BITSTRING)I++;var T=R.tagClass;if(I===M&&(T===c.Class.UNIVERSAL||T===c.Class.CONTEXT_SPECIFIC))V=[R]}catch(w){}if(V===void 0)$.read=F,J=K}if(V===void 0){if(M===void 0){if(Q.strict)throw Error("Non-constructed ASN.1 object of indefinite length.");M=J}if(U===c.Type.BMPSTRING){V="";for(;M>0;M-=2)NX($,J,2),V+=String.fromCharCode($.getInt16()),J-=2}else V=$.getBytes(M),J-=M}var C=H===void 0?null:{bitStringContents:H};return c.create(W,U,q,V,C)}c.toDer=function($){var J=p$.util.createBuffer(),X=$.tagClass|$.type,Q=p$.util.createBuffer(),Y=!1;if("bitStringContents"in $){if(Y=!0,$.original)Y=c.equals($,$.original)}if(Y)Q.putBytes($.bitStringContents);else if($.composed){if($.constructed)X|=32;else Q.putByte(0);for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0)Q.putBuffer(c.toDer($.value[G]))}else if($.type===c.Type.BMPSTRING)for(var G=0;G<$.value.length;++G)Q.putInt16($.value.charCodeAt(G));else if($.type===c.Type.INTEGER&&$.value.length>1&&($.value.charCodeAt(0)===0&&($.value.charCodeAt(1)&128)===0||$.value.charCodeAt(0)===255&&($.value.charCodeAt(1)&128)===128))Q.putBytes($.value.substr(1));else Q.putBytes($.value);if(J.putByte(X),Q.length()<=127)J.putByte(Q.length()&127);else{var W=Q.length(),U="";do U+=String.fromCharCode(W&255),W=W>>>8;while(W>0);J.putByte(U.length|128);for(var G=U.length-1;G>=0;--G)J.putByte(U.charCodeAt(G))}return J.putBuffer(Q),J};c.oidToDer=function($){var J=$.split("."),X=p$.util.createBuffer();X.putByte(40*parseInt(J[0],10)+parseInt(J[1],10));var Q,Y,G,W;for(var U=2;U<J.length;++U){if(Q=!0,Y=[],G=parseInt(J[U],10),G>4294967295)throw Error("OID value too large; max is 32-bits.");do{if(W=G&127,G=G>>>7,!Q)W|=128;Y.push(W),Q=!1}while(G>0);for(var M=Y.length-1;M>=0;--M)X.putByte(Y[M])}return X};c.derToOid=function($){var J;if(typeof $==="string")$=p$.util.createBuffer($);var X=$.getByte();J=Math.floor(X/40)+"."+X%40;var Q=0;while($.length()>0){if(Q>70368744177663)throw Error("OID value too large; max is 53-bits.");if(X=$.getByte(),Q=Q*128,X&128)Q+=X&127;else J+="."+(Q+X),Q=0}return J};c.utcTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,2),10);X=X>=50?1900+X:2000+X;var Q=parseInt($.substr(2,2),10)-1,Y=parseInt($.substr(4,2),10),G=parseInt($.substr(6,2),10),W=parseInt($.substr(8,2),10),U=0;if($.length>11){var M=$.charAt(10),O=10;if(M!=="+"&&M!=="-")U=parseInt($.substr(10,2),10),O+=2}if(J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,U,0),O){if(M=$.charAt(O),M==="+"||M==="-"){var V=parseInt($.substr(O+1,2),10),H=parseInt($.substr(O+4,2),10),q=V*60+H;if(q*=60000,M==="+")J.setTime(+J-q);else J.setTime(+J+q)}}return J};c.generalizedTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,4),10),Q=parseInt($.substr(4,2),10)-1,Y=parseInt($.substr(6,2),10),G=parseInt($.substr(8,2),10),W=parseInt($.substr(10,2),10),U=parseInt($.substr(12,2),10),M=0,O=0,V=!1;if($.charAt($.length-1)==="Z")V=!0;var H=$.length-5,q=$.charAt(H);if(q==="+"||q==="-"){var F=parseInt($.substr(H+1,2),10),K=parseInt($.substr(H+4,2),10);if(O=F*60+K,O*=60000,q==="+")O*=-1;V=!0}if($.charAt(14)===".")M=parseFloat($.substr(14),10)*1000;if(V)J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,U,M),J.setTime(+J+O);else J.setFullYear(X,Q,Y),J.setHours(G,W,U,M);return J};c.dateToUtcTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push((""+$.getUTCFullYear()).substr(2)),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};c.dateToGeneralizedTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push(""+$.getUTCFullYear()),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};c.integerToDer=function($){var J=p$.util.createBuffer();if($>=-128&&$<128)return J.putSignedInt($,8);if($>=-32768&&$<32768)return J.putSignedInt($,16);if($>=-8388608&&$<8388608)return J.putSignedInt($,24);if($>=-2147483648&&$<2147483648)return J.putSignedInt($,32);var X=Error("Integer too large; max is 32-bits.");throw X.integer=$,X};c.derToInteger=function($){if(typeof $==="string")$=p$.util.createBuffer($);var J=$.length()*8;if(J>32)throw Error("Integer too large; max is 32-bits.");return $.getSignedInt(J)};c.validate=function($,J,X,Q){var Y=!1;if(($.tagClass===J.tagClass||typeof J.tagClass>"u")&&($.type===J.type||typeof J.type>"u")){if($.constructed===J.constructed||typeof J.constructed>"u"){if(Y=!0,J.value&&p$.util.isArray(J.value)){var G=0;for(var W=0;Y&&W<J.value.length;++W){var U=J.value[W];Y=!!U.optional;var M=$.value[G];if(!M){if(!U.optional){if(Y=!1,Q)Q.push("["+J.name+'] Missing required element. Expected tag class "'+U.tagClass+'", type "'+U.type+'"')}continue}var O=typeof U.tagClass<"u"&&typeof U.type<"u";if(O&&(M.tagClass!==U.tagClass||M.type!==U.type))if(U.optional){Y=!0;continue}else{if(Y=!1,Q)Q.push("["+J.name+"] Tag mismatch. Expected ("+U.tagClass+","+U.type+"), got ("+M.tagClass+","+M.type+")");break}var V=c.validate(M,U,X,Q);if(V)++G,Y=!0;else if(U.optional)Y=!0;else{Y=!1;break}}}if(Y&&X){if(J.capture)X[J.capture]=$.value;if(J.captureAsn1)X[J.captureAsn1]=$;if(J.captureBitStringContents&&"bitStringContents"in $)X[J.captureBitStringContents]=$.bitStringContents;if(J.captureBitStringValue&&"bitStringContents"in $){var H;if($.bitStringContents.length<2)X[J.captureBitStringValue]="";else{var q=$.bitStringContents.charCodeAt(0);if(q!==0)throw Error("captureBitStringValue only supported for zero unused bits");X[J.captureBitStringValue]=$.bitStringContents.slice(1)}}}}else if(Q)Q.push("["+J.name+'] Expected constructed "'+J.constructed+'", got "'+$.constructed+'"')}else if(Q){if($.tagClass!==J.tagClass)Q.push("["+J.name+'] Expected tag class "'+J.tagClass+'", got "'+$.tagClass+'"');if($.type!==J.type)Q.push("["+J.name+'] Expected type "'+J.type+'", got "'+$.type+'"')}return Y};var PG=/[^\\u0000-\\u00ff]/;c.prettyPrint=function($,J,X){var Q="";if(J=J||0,X=X||2,J>0)Q+=`
6
- `;var Y="";for(var G=0;G<J*X;++G)Y+=" ";switch(Q+=Y+"Tag: ",$.tagClass){case c.Class.UNIVERSAL:Q+="Universal:";break;case c.Class.APPLICATION:Q+="Application:";break;case c.Class.CONTEXT_SPECIFIC:Q+="Context-Specific:";break;case c.Class.PRIVATE:Q+="Private:";break}if($.tagClass===c.Class.UNIVERSAL)switch(Q+=$.type,$.type){case c.Type.NONE:Q+=" (None)";break;case c.Type.BOOLEAN:Q+=" (Boolean)";break;case c.Type.INTEGER:Q+=" (Integer)";break;case c.Type.BITSTRING:Q+=" (Bit string)";break;case c.Type.OCTETSTRING:Q+=" (Octet string)";break;case c.Type.NULL:Q+=" (Null)";break;case c.Type.OID:Q+=" (Object Identifier)";break;case c.Type.ODESC:Q+=" (Object Descriptor)";break;case c.Type.EXTERNAL:Q+=" (External or Instance of)";break;case c.Type.REAL:Q+=" (Real)";break;case c.Type.ENUMERATED:Q+=" (Enumerated)";break;case c.Type.EMBEDDED:Q+=" (Embedded PDV)";break;case c.Type.UTF8:Q+=" (UTF8)";break;case c.Type.ROID:Q+=" (Relative Object Identifier)";break;case c.Type.SEQUENCE:Q+=" (Sequence)";break;case c.Type.SET:Q+=" (Set)";break;case c.Type.PRINTABLESTRING:Q+=" (Printable String)";break;case c.Type.IA5String:Q+=" (IA5String (ASCII))";break;case c.Type.UTCTIME:Q+=" (UTC time)";break;case c.Type.GENERALIZEDTIME:Q+=" (Generalized time)";break;case c.Type.BMPSTRING:Q+=" (BMP String)";break}else Q+=$.type;if(Q+=`
2
+ var xU=Object.create;var{getPrototypeOf:vU,defineProperty:g9,getOwnPropertyNames:kU}=Object;var fU=Object.prototype.hasOwnProperty;function yU($){return this[$]}var bU,hU,m9=($,J,X)=>{var Q=$!=null&&typeof $==="object";if(Q){var Y=J?bU??=new WeakMap:hU??=new WeakMap,G=Y.get($);if(G)return G}X=$!=null?xU(vU($)):{};let W=J||!$||!$.__esModule?g9(X,"default",{value:$,enumerable:!0}):X;for(let U of kU($))if(!fU.call(W,U))g9(W,U,{get:yU.bind($,U),enumerable:!0});if(Q)Y.set($,W);return W};var H$=($,J)=>()=>(J||$((J={exports:{}}).exports,J),J.exports);var uU=($)=>$;function gU($,J){this[$]=uU.bind(null,J)}var mU=($,J)=>{for(var X in J)g9($,X,{get:J[X],enumerable:!0,configurable:!0,set:gU.bind(J,X)})};var OX=import.meta.require;var F$=H$(($F,FG)=>{FG.exports={options:{usePureJavaScript:!1}}});var AG=H$((JF,LG)=>{var d9={};LG.exports=d9;var NG={};d9.encode=function($,J,X){if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');if(X!==void 0&&typeof X!=="number")throw TypeError('"maxline" must be a number.');var Q="";if(!($ instanceof Uint8Array))Q=aU($,J);else{var Y=0,G=J.length,W=J.charAt(0),U=[0];for(Y=0;Y<$.length;++Y){for(var M=0,O=$[Y];M<U.length;++M)O+=U[M]<<8,U[M]=O%G,O=O/G|0;while(O>0)U.push(O%G),O=O/G|0}for(Y=0;$[Y]===0&&Y<$.length-1;++Y)Q+=W;for(Y=U.length-1;Y>=0;--Y)Q+=J[U[Y]]}if(X){var V=new RegExp(".{1,"+X+"}","g");Q=Q.match(V).join(`\r
3
+ `)}return Q};d9.decode=function($,J){if(typeof $!=="string")throw TypeError('"input" must be a string.');if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');var X=NG[J];if(!X){X=NG[J]=[];for(var Q=0;Q<J.length;++Q)X[J.charCodeAt(Q)]=Q}$=$.replace(/\s/g,"");var Y=J.length,G=J.charAt(0),W=[0];for(var Q=0;Q<$.length;Q++){var U=X[$.charCodeAt(Q)];if(U===void 0)return;for(var M=0,O=U;M<W.length;++M)O+=W[M]*Y,W[M]=O&255,O>>=8;while(O>0)W.push(O&255),O>>=8}for(var V=0;$[V]===G&&V<$.length-1;++V)W.push(0);if(typeof Buffer<"u")return Buffer.from(W.reverse());return new Uint8Array(W.reverse())};function aU($,J){var X=0,Q=J.length,Y=J.charAt(0),G=[0];for(X=0;X<$.length();++X){for(var W=0,U=$.at(X);W<G.length;++W)U+=G[W]<<8,G[W]=U%Q,U=U/Q|0;while(U>0)G.push(U%Q),U=U/Q|0}var M="";for(X=0;$.at(X)===0&&X<$.length()-1;++X)M+=Y;for(X=G.length-1;X>=0;--X)M+=J[G[X]];return M}});var _$=H$((QF,BG)=>{var RG=F$(),DG=AG(),T=BG.exports=RG.util=RG.util||{};(function(){if(typeof process<"u"&&process.nextTick){if(T.nextTick=process.nextTick,typeof setImmediate==="function")T.setImmediate=setImmediate;else T.setImmediate=T.nextTick;return}if(typeof setImmediate==="function"){T.setImmediate=function(){return setImmediate.apply(void 0,arguments)},T.nextTick=function(U){return setImmediate(U)};return}if(T.setImmediate=function(U){setTimeout(U,0)},typeof window<"u"&&typeof window.postMessage==="function"){let U=function(M){if(M.source===window&&M.data===$){M.stopPropagation();var O=J.slice();J.length=0,O.forEach(function(V){V()})}};var W=U,$="forge.setImmediate",J=[];T.setImmediate=function(M){if(J.push(M),J.length===1)window.postMessage($,"*")},window.addEventListener("message",U,!0)}if(typeof MutationObserver<"u"){var X=Date.now(),Q=!0,Y=document.createElement("div"),J=[];new MutationObserver(function(){var M=J.slice();J.length=0,M.forEach(function(O){O()})}).observe(Y,{attributes:!0});var G=T.setImmediate;T.setImmediate=function(M){if(Date.now()-X>15)X=Date.now(),G(M);else if(J.push(M),J.length===1)Y.setAttribute("a",Q=!Q)}}T.nextTick=T.setImmediate})();T.isNodejs=typeof process<"u"&&process.versions&&process.versions.node;T.globalScope=function(){if(T.isNodejs)return global;return typeof self>"u"?window:self}();T.isArray=Array.isArray||function($){return Object.prototype.toString.call($)==="[object Array]"};T.isArrayBuffer=function($){return typeof ArrayBuffer<"u"&&$ instanceof ArrayBuffer};T.isArrayBufferView=function($){return $&&T.isArrayBuffer($.buffer)&&$.byteLength!==void 0};function EX($){if(!($===8||$===16||$===24||$===32))throw Error("Only 8, 16, 24, or 32 bits supported: "+$)}T.ByteBuffer=c9;function c9($){if(this.data="",this.read=0,typeof $==="string")this.data=$;else if(T.isArrayBuffer($)||T.isArrayBufferView($))if(typeof Buffer<"u"&&$ instanceof Buffer)this.data=$.toString("binary");else{var J=new Uint8Array($);try{this.data=String.fromCharCode.apply(null,J)}catch(Q){for(var X=0;X<J.length;++X)this.putByte(J[X])}}else if($ instanceof c9||typeof $==="object"&&typeof $.data==="string"&&typeof $.read==="number")this.data=$.data,this.read=$.read;this._constructedStringLength=0}T.ByteStringBuffer=c9;var sU=4096;T.ByteStringBuffer.prototype._optimizeConstructedString=function($){if(this._constructedStringLength+=$,this._constructedStringLength>sU)this.data.substr(0,1),this._constructedStringLength=0};T.ByteStringBuffer.prototype.length=function(){return this.data.length-this.read};T.ByteStringBuffer.prototype.isEmpty=function(){return this.length()<=0};T.ByteStringBuffer.prototype.putByte=function($){return this.putBytes(String.fromCharCode($))};T.ByteStringBuffer.prototype.fillWithByte=function($,J){$=String.fromCharCode($);var X=this.data;while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return this.data=X,this._optimizeConstructedString(J),this};T.ByteStringBuffer.prototype.putBytes=function($){return this.data+=$,this._optimizeConstructedString($.length),this};T.ByteStringBuffer.prototype.putString=function($){return this.putBytes(T.encodeUtf8($))};T.ByteStringBuffer.prototype.putInt16=function($){return this.putBytes(String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt24=function($){return this.putBytes(String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt32=function($){return this.putBytes(String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt16Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255))};T.ByteStringBuffer.prototype.putInt24Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255))};T.ByteStringBuffer.prototype.putInt32Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>24&255))};T.ByteStringBuffer.prototype.putInt=function($,J){EX(J);var X="";do J-=8,X+=String.fromCharCode($>>J&255);while(J>0);return this.putBytes(X)};T.ByteStringBuffer.prototype.putSignedInt=function($,J){if($<0)$+=2<<J-1;return this.putInt($,J)};T.ByteStringBuffer.prototype.putBuffer=function($){return this.putBytes($.getBytes())};T.ByteStringBuffer.prototype.getByte=function(){return this.data.charCodeAt(this.read++)};T.ByteStringBuffer.prototype.getInt16=function(){var $=this.data.charCodeAt(this.read)<<8^this.data.charCodeAt(this.read+1);return this.read+=2,$};T.ByteStringBuffer.prototype.getInt24=function(){var $=this.data.charCodeAt(this.read)<<16^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2);return this.read+=3,$};T.ByteStringBuffer.prototype.getInt32=function(){var $=this.data.charCodeAt(this.read)<<24^this.data.charCodeAt(this.read+1)<<16^this.data.charCodeAt(this.read+2)<<8^this.data.charCodeAt(this.read+3);return this.read+=4,$};T.ByteStringBuffer.prototype.getInt16Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8;return this.read+=2,$};T.ByteStringBuffer.prototype.getInt24Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16;return this.read+=3,$};T.ByteStringBuffer.prototype.getInt32Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16^this.data.charCodeAt(this.read+3)<<24;return this.read+=4,$};T.ByteStringBuffer.prototype.getInt=function($){EX($);var J=0;do J=(J<<8)+this.data.charCodeAt(this.read++),$-=8;while($>0);return J};T.ByteStringBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};T.ByteStringBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};T.ByteStringBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};T.ByteStringBuffer.prototype.at=function($){return this.data.charCodeAt(this.read+$)};T.ByteStringBuffer.prototype.setAt=function($,J){return this.data=this.data.substr(0,this.read+$)+String.fromCharCode(J)+this.data.substr(this.read+$+1),this};T.ByteStringBuffer.prototype.last=function(){return this.data.charCodeAt(this.data.length-1)};T.ByteStringBuffer.prototype.copy=function(){var $=T.createBuffer(this.data);return $.read=this.read,$};T.ByteStringBuffer.prototype.compact=function(){if(this.read>0)this.data=this.data.slice(this.read),this.read=0;return this};T.ByteStringBuffer.prototype.clear=function(){return this.data="",this.read=0,this};T.ByteStringBuffer.prototype.truncate=function($){var J=Math.max(0,this.length()-$);return this.data=this.data.substr(this.read,J),this.read=0,this};T.ByteStringBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.length;++J){var X=this.data.charCodeAt(J);if(X<16)$+="0";$+=X.toString(16)}return $};T.ByteStringBuffer.prototype.toString=function(){return T.decodeUtf8(this.bytes())};function rU($,J){J=J||{},this.read=J.readOffset||0,this.growSize=J.growSize||1024;var X=T.isArrayBuffer($),Q=T.isArrayBufferView($);if(X||Q){if(X)this.data=new DataView($);else this.data=new DataView($.buffer,$.byteOffset,$.byteLength);this.write="writeOffset"in J?J.writeOffset:this.data.byteLength;return}if(this.data=new DataView(new ArrayBuffer(0)),this.write=0,$!==null&&$!==void 0)this.putBytes($);if("writeOffset"in J)this.write=J.writeOffset}T.DataBuffer=rU;T.DataBuffer.prototype.length=function(){return this.write-this.read};T.DataBuffer.prototype.isEmpty=function(){return this.length()<=0};T.DataBuffer.prototype.accommodate=function($,J){if(this.length()>=$)return this;J=Math.max(J||this.growSize,$);var X=new Uint8Array(this.data.buffer,this.data.byteOffset,this.data.byteLength),Q=new Uint8Array(this.length()+J);return Q.set(X),this.data=new DataView(Q.buffer),this};T.DataBuffer.prototype.putByte=function($){return this.accommodate(1),this.data.setUint8(this.write++,$),this};T.DataBuffer.prototype.fillWithByte=function($,J){this.accommodate(J);for(var X=0;X<J;++X)this.data.setUint8($);return this};T.DataBuffer.prototype.putBytes=function($,J){if(T.isArrayBufferView($)){var X=new Uint8Array($.buffer,$.byteOffset,$.byteLength),Q=X.byteLength-X.byteOffset;this.accommodate(Q);var Y=new Uint8Array(this.data.buffer,this.write);return Y.set(X),this.write+=Q,this}if(T.isArrayBuffer($)){var X=new Uint8Array($);this.accommodate(X.byteLength);var Y=new Uint8Array(this.data.buffer);return Y.set(X,this.write),this.write+=X.byteLength,this}if($ instanceof T.DataBuffer||typeof $==="object"&&typeof $.read==="number"&&typeof $.write==="number"&&T.isArrayBufferView($.data)){var X=new Uint8Array($.data.byteLength,$.read,$.length());this.accommodate(X.byteLength);var Y=new Uint8Array($.data.byteLength,this.write);return Y.set(X),this.write+=X.byteLength,this}if($ instanceof T.ByteStringBuffer)$=$.data,J="binary";if(J=J||"binary",typeof $==="string"){var G;if(J==="hex")return this.accommodate(Math.ceil($.length/2)),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.hex.decode($,G,this.write),this;if(J==="base64")return this.accommodate(Math.ceil($.length/4)*3),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.base64.decode($,G,this.write),this;if(J==="utf8")$=T.encodeUtf8($),J="binary";if(J==="binary"||J==="raw")return this.accommodate($.length),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.raw.decode(G),this;if(J==="utf16")return this.accommodate($.length*2),G=new Uint16Array(this.data.buffer,this.write),this.write+=T.text.utf16.encode(G),this;throw Error("Invalid encoding: "+J)}throw Error("Invalid parameter: "+$)};T.DataBuffer.prototype.putBuffer=function($){return this.putBytes($),$.clear(),this};T.DataBuffer.prototype.putString=function($){return this.putBytes($,"utf16")};T.DataBuffer.prototype.putInt16=function($){return this.accommodate(2),this.data.setInt16(this.write,$),this.write+=2,this};T.DataBuffer.prototype.putInt24=function($){return this.accommodate(3),this.data.setInt16(this.write,$>>8&65535),this.data.setInt8(this.write,$>>16&255),this.write+=3,this};T.DataBuffer.prototype.putInt32=function($){return this.accommodate(4),this.data.setInt32(this.write,$),this.write+=4,this};T.DataBuffer.prototype.putInt16Le=function($){return this.accommodate(2),this.data.setInt16(this.write,$,!0),this.write+=2,this};T.DataBuffer.prototype.putInt24Le=function($){return this.accommodate(3),this.data.setInt8(this.write,$>>16&255),this.data.setInt16(this.write,$>>8&65535,!0),this.write+=3,this};T.DataBuffer.prototype.putInt32Le=function($){return this.accommodate(4),this.data.setInt32(this.write,$,!0),this.write+=4,this};T.DataBuffer.prototype.putInt=function($,J){EX(J),this.accommodate(J/8);do J-=8,this.data.setInt8(this.write++,$>>J&255);while(J>0);return this};T.DataBuffer.prototype.putSignedInt=function($,J){if(EX(J),this.accommodate(J/8),$<0)$+=2<<J-1;return this.putInt($,J)};T.DataBuffer.prototype.getByte=function(){return this.data.getInt8(this.read++)};T.DataBuffer.prototype.getInt16=function(){var $=this.data.getInt16(this.read);return this.read+=2,$};T.DataBuffer.prototype.getInt24=function(){var $=this.data.getInt16(this.read)<<8^this.data.getInt8(this.read+2);return this.read+=3,$};T.DataBuffer.prototype.getInt32=function(){var $=this.data.getInt32(this.read);return this.read+=4,$};T.DataBuffer.prototype.getInt16Le=function(){var $=this.data.getInt16(this.read,!0);return this.read+=2,$};T.DataBuffer.prototype.getInt24Le=function(){var $=this.data.getInt8(this.read)^this.data.getInt16(this.read+1,!0)<<8;return this.read+=3,$};T.DataBuffer.prototype.getInt32Le=function(){var $=this.data.getInt32(this.read,!0);return this.read+=4,$};T.DataBuffer.prototype.getInt=function($){EX($);var J=0;do J=(J<<8)+this.data.getInt8(this.read++),$-=8;while($>0);return J};T.DataBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};T.DataBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};T.DataBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};T.DataBuffer.prototype.at=function($){return this.data.getUint8(this.read+$)};T.DataBuffer.prototype.setAt=function($,J){return this.data.setUint8($,J),this};T.DataBuffer.prototype.last=function(){return this.data.getUint8(this.write-1)};T.DataBuffer.prototype.copy=function(){return new T.DataBuffer(this)};T.DataBuffer.prototype.compact=function(){if(this.read>0){var $=new Uint8Array(this.data.buffer,this.read),J=new Uint8Array($.byteLength);J.set($),this.data=new DataView(J),this.write-=this.read,this.read=0}return this};T.DataBuffer.prototype.clear=function(){return this.data=new DataView(new ArrayBuffer(0)),this.read=this.write=0,this};T.DataBuffer.prototype.truncate=function($){return this.write=Math.max(0,this.length()-$),this.read=Math.min(this.read,this.write),this};T.DataBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.byteLength;++J){var X=this.data.getUint8(J);if(X<16)$+="0";$+=X.toString(16)}return $};T.DataBuffer.prototype.toString=function($){var J=new Uint8Array(this.data,this.read,this.length());if($=$||"utf8",$==="binary"||$==="raw")return T.binary.raw.encode(J);if($==="hex")return T.binary.hex.encode(J);if($==="base64")return T.binary.base64.encode(J);if($==="utf8")return T.text.utf8.decode(J);if($==="utf16")return T.text.utf16.decode(J);throw Error("Invalid encoding: "+$)};T.createBuffer=function($,J){if(J=J||"raw",$!==void 0&&J==="utf8")$=T.encodeUtf8($);return new T.ByteBuffer($)};T.fillString=function($,J){var X="";while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return X};T.xorBytes=function($,J,X){var Q="",Y="",G="",W=0,U=0;for(;X>0;--X,++W){if(Y=$.charCodeAt(W)^J.charCodeAt(W),U>=10)Q+=G,G="",U=0;G+=String.fromCharCode(Y),++U}return Q+=G,Q};T.hexToBytes=function($){var J="",X=0;if($.length&!0)X=1,J+=String.fromCharCode(parseInt($[0],16));for(;X<$.length;X+=2)J+=String.fromCharCode(parseInt($.substr(X,2),16));return J};T.bytesToHex=function($){return T.createBuffer($).toHex()};T.int32ToBytes=function($){return String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255)};var I0="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",C0=[62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,64,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],ZG="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";T.encode64=function($,J){var X="",Q="",Y,G,W,U=0;while(U<$.length){if(Y=$.charCodeAt(U++),G=$.charCodeAt(U++),W=$.charCodeAt(U++),X+=I0.charAt(Y>>2),X+=I0.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=I0.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":I0.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
4
+ `,X=X.substr(J)}return Q+=X,Q};T.decode64=function($){$=$.replace(/[^A-Za-z0-9\+\/\=]/g,"");var J="",X,Q,Y,G,W=0;while(W<$.length)if(X=C0[$.charCodeAt(W++)-43],Q=C0[$.charCodeAt(W++)-43],Y=C0[$.charCodeAt(W++)-43],G=C0[$.charCodeAt(W++)-43],J+=String.fromCharCode(X<<2|Q>>4),Y!==64){if(J+=String.fromCharCode((Q&15)<<4|Y>>2),G!==64)J+=String.fromCharCode((Y&3)<<6|G)}return J};T.encodeUtf8=function($){return unescape(encodeURIComponent($))};T.decodeUtf8=function($){return decodeURIComponent(escape($))};T.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:DG.encode,decode:DG.decode}};T.binary.raw.encode=function($){return String.fromCharCode.apply(null,$)};T.binary.raw.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};T.binary.hex.encode=T.bytesToHex;T.binary.hex.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/2));X=X||0;var Y=0,G=X;if($.length&1)Y=1,Q[G++]=parseInt($[0],16);for(;Y<$.length;Y+=2)Q[G++]=parseInt($.substr(Y,2),16);return J?G-X:Q};T.binary.base64.encode=function($,J){var X="",Q="",Y,G,W,U=0;while(U<$.byteLength){if(Y=$[U++],G=$[U++],W=$[U++],X+=I0.charAt(Y>>2),X+=I0.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=I0.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":I0.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
5
+ `,X=X.substr(J)}return Q+=X,Q};T.binary.base64.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/4)*3);$=$.replace(/[^A-Za-z0-9\+\/\=]/g,""),X=X||0;var Y,G,W,U,M=0,O=X;while(M<$.length)if(Y=C0[$.charCodeAt(M++)-43],G=C0[$.charCodeAt(M++)-43],W=C0[$.charCodeAt(M++)-43],U=C0[$.charCodeAt(M++)-43],Q[O++]=Y<<2|G>>4,W!==64){if(Q[O++]=(G&15)<<4|W>>2,U!==64)Q[O++]=(W&3)<<6|U}return J?O-X:Q.subarray(0,O)};T.binary.base58.encode=function($,J){return T.binary.baseN.encode($,ZG,J)};T.binary.base58.decode=function($,J){return T.binary.baseN.decode($,ZG,J)};T.text={utf8:{},utf16:{}};T.text.utf8.encode=function($,J,X){$=T.encodeUtf8($);var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};T.text.utf8.decode=function($){return T.decodeUtf8(String.fromCharCode.apply(null,$))};T.text.utf16.encode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length*2);var Y=new Uint16Array(Q.buffer);X=X||0;var G=X,W=X;for(var U=0;U<$.length;++U)Y[W++]=$.charCodeAt(U),G+=2;return J?G-X:Q};T.text.utf16.decode=function($){return String.fromCharCode.apply(null,new Uint16Array($.buffer))};T.deflate=function($,J,X){if(J=T.decode64($.deflate(T.encode64(J)).rval),X){var Q=2,Y=J.charCodeAt(1);if(Y&32)Q=6;J=J.substring(Q,J.length-4)}return J};T.inflate=function($,J,X){var Q=$.inflate(T.encode64(J)).rval;return Q===null?null:T.decode64(Q)};var n9=function($,J,X){if(!$)throw Error("WebStorage not available.");var Q;if(X===null)Q=$.removeItem(J);else X=T.encode64(JSON.stringify(X)),Q=$.setItem(J,X);if(typeof Q<"u"&&Q.rval!==!0){var Y=Error(Q.error.message);throw Y.id=Q.error.id,Y.name=Q.error.name,Y}},i9=function($,J){if(!$)throw Error("WebStorage not available.");var X=$.getItem(J);if($.init)if(X.rval===null){if(X.error){var Q=Error(X.error.message);throw Q.id=X.error.id,Q.name=X.error.name,Q}X=null}else X=X.rval;if(X!==null)X=JSON.parse(T.decode64(X));return X},tU=function($,J,X,Q){var Y=i9($,J);if(Y===null)Y={};Y[X]=Q,n9($,J,Y)},eU=function($,J,X){var Q=i9($,J);if(Q!==null)Q=X in Q?Q[X]:null;return Q},$M=function($,J,X){var Q=i9($,J);if(Q!==null&&X in Q){delete Q[X];var Y=!0;for(var G in Q){Y=!1;break}if(Y)Q=null;n9($,J,Q)}},JM=function($,J){n9($,J,null)},EY=function($,J,X){var Q=null;if(typeof X>"u")X=["web","flash"];var Y,G=!1,W=null;for(var U in X){Y=X[U];try{if(Y==="flash"||Y==="both"){if(J[0]===null)throw Error("Flash local storage not available.");Q=$.apply(this,J),G=Y==="flash"}if(Y==="web"||Y==="both")J[0]=localStorage,Q=$.apply(this,J),G=!0}catch(M){W=M}if(G)break}if(!G)throw W;return Q};T.setItem=function($,J,X,Q,Y){EY(tU,arguments,Y)};T.getItem=function($,J,X,Q){return EY(eU,arguments,Q)};T.removeItem=function($,J,X,Q){EY($M,arguments,Q)};T.clearItems=function($,J,X){EY(JM,arguments,X)};T.isEmpty=function($){for(var J in $)if($.hasOwnProperty(J))return!1;return!0};T.format=function($){var J=/%./g,X,Q,Y=0,G=[],W=0;while(X=J.exec($)){if(Q=$.substring(W,J.lastIndex-2),Q.length>0)G.push(Q);W=J.lastIndex;var U=X[0][1];switch(U){case"s":case"o":if(Y<arguments.length)G.push(arguments[Y+++1]);else G.push("<?>");break;case"%":G.push("%");break;default:G.push("<%"+U+"?>")}}return G.push($.substring(W)),G.join("")};T.formatNumber=function($,J,X,Q){var Y=$,G=isNaN(J=Math.abs(J))?2:J,W=X===void 0?",":X,U=Q===void 0?".":Q,M=Y<0?"-":"",O=parseInt(Y=Math.abs(+Y||0).toFixed(G),10)+"",V=O.length>3?O.length%3:0;return M+(V?O.substr(0,V)+U:"")+O.substr(V).replace(/(\d{3})(?=\d)/g,"$1"+U)+(G?W+Math.abs(Y-O).toFixed(G).slice(2):"")};T.formatSize=function($){if($>=1073741824)$=T.formatNumber($/1073741824,2,".","")+" GiB";else if($>=1048576)$=T.formatNumber($/1048576,2,".","")+" MiB";else if($>=1024)$=T.formatNumber($/1024,0)+" KiB";else $=T.formatNumber($,0)+" bytes";return $};T.bytesFromIP=function($){if($.indexOf(".")!==-1)return T.bytesFromIPv4($);if($.indexOf(":")!==-1)return T.bytesFromIPv6($);return null};T.bytesFromIPv4=function($){if($=$.split("."),$.length!==4)return null;var J=T.createBuffer();for(var X=0;X<$.length;++X){var Q=parseInt($[X],10);if(isNaN(Q))return null;J.putByte(Q)}return J.getBytes()};T.bytesFromIPv6=function($){var J=0;$=$.split(":").filter(function(W){if(W.length===0)++J;return!0});var X=(8-$.length+J)*2,Q=T.createBuffer();for(var Y=0;Y<8;++Y){if(!$[Y]||$[Y].length===0){Q.fillWithByte(0,X),X=0;continue}var G=T.hexToBytes($[Y]);if(G.length<2)Q.putByte(0);Q.putBytes(G)}return Q.getBytes()};T.bytesToIP=function($){if($.length===4)return T.bytesToIPv4($);if($.length===16)return T.bytesToIPv6($);return null};T.bytesToIPv4=function($){if($.length!==4)return null;var J=[];for(var X=0;X<$.length;++X)J.push($.charCodeAt(X));return J.join(".")};T.bytesToIPv6=function($){if($.length!==16)return null;var J=[],X=[],Q=0;for(var Y=0;Y<$.length;Y+=2){var G=T.bytesToHex($[Y]+$[Y+1]);while(G[0]==="0"&&G!=="0")G=G.substr(1);if(G==="0"){var W=X[X.length-1],U=J.length;if(!W||U!==W.end+1)X.push({start:U,end:U});else if(W.end=U,W.end-W.start>X[Q].end-X[Q].start)Q=X.length-1}J.push(G)}if(X.length>0){var M=X[Q];if(M.end-M.start>0){if(J.splice(M.start,M.end-M.start+1,""),M.start===0)J.unshift("");if(M.end===7)J.push("")}}return J.join(":")};T.estimateCores=function($,J){if(typeof $==="function")J=$,$={};if($=$||{},"cores"in T&&!$.update)return J(null,T.cores);if(typeof navigator<"u"&&"hardwareConcurrency"in navigator&&navigator.hardwareConcurrency>0)return T.cores=navigator.hardwareConcurrency,J(null,T.cores);if(typeof Worker>"u")return T.cores=1,J(null,T.cores);if(typeof Blob>"u")return T.cores=2,J(null,T.cores);var X=URL.createObjectURL(new Blob(["(",function(){self.addEventListener("message",function(W){var U=Date.now(),M=U+4;while(Date.now()<M);self.postMessage({st:U,et:M})})}.toString(),")()"],{type:"application/javascript"}));Q([],5,16);function Q(W,U,M){if(U===0){var O=Math.floor(W.reduce(function(V,H){return V+H},0)/W.length);return T.cores=Math.max(1,O),URL.revokeObjectURL(X),J(null,T.cores)}Y(M,function(V,H){W.push(G(M,H)),Q(W,U-1,M)})}function Y(W,U){var M=[],O=[];for(var V=0;V<W;++V){var H=new Worker(X);H.addEventListener("message",function(q){if(O.push(q.data),O.length===W){for(var F=0;F<W;++F)M[F].terminate();U(null,O)}}),M.push(H)}for(var V=0;V<W;++V)M[V].postMessage(V)}function G(W,U){var M=[];for(var O=0;O<W;++O){var V=U[O],H=M[O]=[];for(var q=0;q<W;++q){if(O===q)continue;var F=U[q];if(V.st>F.st&&V.st<F.et||F.st>V.st&&F.st<V.et)H.push(q)}}return M.reduce(function(K,A){return Math.max(K,A.length)},0)}}});var FY=H$((XF,jG)=>{var MJ=F$();_$();jG.exports=MJ.cipher=MJ.cipher||{};MJ.cipher.algorithms=MJ.cipher.algorithms||{};MJ.cipher.createCipher=function($,J){var X=$;if(typeof X==="string"){if(X=MJ.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new MJ.cipher.BlockCipher({algorithm:X,key:J,decrypt:!1})};MJ.cipher.createDecipher=function($,J){var X=$;if(typeof X==="string"){if(X=MJ.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new MJ.cipher.BlockCipher({algorithm:X,key:J,decrypt:!0})};MJ.cipher.registerAlgorithm=function($,J){$=$.toUpperCase(),MJ.cipher.algorithms[$]=J};MJ.cipher.getAlgorithm=function($){if($=$.toUpperCase(),$ in MJ.cipher.algorithms)return MJ.cipher.algorithms[$];return null};var o9=MJ.cipher.BlockCipher=function($){this.algorithm=$.algorithm,this.mode=this.algorithm.mode,this.blockSize=this.mode.blockSize,this._finish=!1,this._input=null,this.output=null,this._op=$.decrypt?this.mode.decrypt:this.mode.encrypt,this._decrypt=$.decrypt,this.algorithm.initialize($)};o9.prototype.start=function($){$=$||{};var J={};for(var X in $)J[X]=$[X];J.decrypt=this._decrypt,this._finish=!1,this._input=MJ.util.createBuffer(),this.output=$.output||MJ.util.createBuffer(),this.mode.start(J)};o9.prototype.update=function($){if($)this._input.putBuffer($);while(!this._op.call(this.mode,this._input,this.output,this._finish)&&!this._finish);this._input.compact()};o9.prototype.finish=function($){if($&&(this.mode.name==="ECB"||this.mode.name==="CBC"))this.mode.pad=function(X){return $(this.blockSize,X,!1)},this.mode.unpad=function(X){return $(this.blockSize,X,!0)};var J={};if(J.decrypt=this._decrypt,J.overflow=this._input.length()%this.blockSize,!this._decrypt&&this.mode.pad){if(!this.mode.pad(this._input,J))return!1}if(this._finish=!0,this.update(),this._decrypt&&this.mode.unpad){if(!this.mode.unpad(this.output,J))return!1}if(this.mode.afterFinish){if(!this.mode.afterFinish(this.output,J))return!1}return!0}});var s9=H$((YF,TG)=>{var OJ=F$();_$();OJ.cipher=OJ.cipher||{};var R$=TG.exports=OJ.cipher.modes=OJ.cipher.modes||{};R$.ecb=function($){$=$||{},this.name="ECB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};R$.ecb.prototype.start=function($){};R$.ecb.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};R$.ecb.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};R$.ecb.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};R$.ecb.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};R$.cbc=function($){$=$||{},this.name="CBC",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};R$.cbc.prototype.start=function($){if($.iv===null){if(!this._prev)throw Error("Invalid IV parameter.");this._iv=this._prev.slice(0)}else if(!("iv"in $))throw Error("Invalid IV parameter.");else this._iv=NY($.iv,this.blockSize),this._prev=this._iv.slice(0)};R$.cbc.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=this._prev[Q]^$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q]);this._prev=this._outBlock};R$.cbc.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._prev[Q]^this._outBlock[Q]);this._prev=this._inBlock.slice(0)};R$.cbc.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};R$.cbc.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};R$.cfb=function($){$=$||{},this.name="CFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.cfb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=NY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.cfb.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32()^this._outBlock[Y],J.putInt32(this._inBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32()^this._outBlock[Y],this._partialOutput.putInt32(this._partialBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.cfb.prototype.decrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32(),J.putInt32(this._inBlock[Y]^this._outBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32(),this._partialOutput.putInt32(this._partialBlock[Y]^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.ofb=function($){$=$||{},this.name="OFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.ofb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=NY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.ofb.prototype.encrypt=function($,J,X){var Q=$.length();if($.length()===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]),this._inBlock[Y]=this._outBlock[Y];return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._outBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.ofb.prototype.decrypt=R$.ofb.prototype.encrypt;R$.ctr=function($){$=$||{},this.name="CTR",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.ctr.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=NY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.ctr.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize)for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]);else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}LY(this._inBlock)};R$.ctr.prototype.decrypt=R$.ctr.prototype.encrypt;R$.gcm=function($){$=$||{},this.name="GCM",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0,this._R=3774873600};R$.gcm.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");var J=OJ.util.createBuffer($.iv);this._cipherLength=0;var X;if("additionalData"in $)X=OJ.util.createBuffer($.additionalData);else X=OJ.util.createBuffer();if("tagLength"in $)this._tagLength=$.tagLength;else this._tagLength=128;if(this._tag=null,$.decrypt){if(this._tag=OJ.util.createBuffer($.tag).getBytes(),this._tag.length!==this._tagLength/8)throw Error("Authentication tag does not match tag length.")}this._hashBlock=Array(this._ints),this.tag=null,this._hashSubkey=Array(this._ints),this.cipher.encrypt([0,0,0,0],this._hashSubkey),this.componentBits=4,this._m=this.generateHashTable(this._hashSubkey,this.componentBits);var Q=J.length();if(Q===12)this._j0=[J.getInt32(),J.getInt32(),J.getInt32(),1];else{this._j0=[0,0,0,0];while(J.length()>0)this._j0=this.ghash(this._hashSubkey,this._j0,[J.getInt32(),J.getInt32(),J.getInt32(),J.getInt32()]);this._j0=this.ghash(this._hashSubkey,this._j0,[0,0].concat(a9(Q*8)))}this._inBlock=this._j0.slice(0),LY(this._inBlock),this._partialBytes=0,X=OJ.util.createBuffer(X),this._aDataLength=a9(X.length()*8);var Y=X.length()%this.blockSize;if(Y)X.fillWithByte(0,this.blockSize-Y);this._s=[0,0,0,0];while(X.length()>0)this._s=this.ghash(this._hashSubkey,this._s,[X.getInt32(),X.getInt32(),X.getInt32(),X.getInt32()])};R$.gcm.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^=$.getInt32());this._cipherLength+=this.blockSize}else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G<=0||X){if(X){var W=Q%this.blockSize;this._cipherLength+=W,this._partialOutput.truncate(this.blockSize-W)}else this._cipherLength+=this.blockSize;for(var Y=0;Y<this._ints;++Y)this._outBlock[Y]=this._partialOutput.getInt32();this._partialOutput.read-=this.blockSize}if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return $.read-=this.blockSize,J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}this._s=this.ghash(this._hashSubkey,this._s,this._outBlock),LY(this._inBlock)};R$.gcm.prototype.decrypt=function($,J,X){var Q=$.length();if(Q<this.blockSize&&!(X&&Q>0))return!0;this.cipher.encrypt(this._inBlock,this._outBlock),LY(this._inBlock),this._hashBlock[0]=$.getInt32(),this._hashBlock[1]=$.getInt32(),this._hashBlock[2]=$.getInt32(),this._hashBlock[3]=$.getInt32(),this._s=this.ghash(this._hashSubkey,this._s,this._hashBlock);for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^this._hashBlock[Y]);if(Q<this.blockSize)this._cipherLength+=Q%this.blockSize;else this._cipherLength+=this.blockSize};R$.gcm.prototype.afterFinish=function($,J){var X=!0;if(J.decrypt&&J.overflow)$.truncate(this.blockSize-J.overflow);this.tag=OJ.util.createBuffer();var Q=this._aDataLength.concat(a9(this._cipherLength*8));this._s=this.ghash(this._hashSubkey,this._s,Q);var Y=[];this.cipher.encrypt(this._j0,Y);for(var G=0;G<this._ints;++G)this.tag.putInt32(this._s[G]^Y[G]);if(this.tag.truncate(this.tag.length()%(this._tagLength/8)),J.decrypt&&this.tag.bytes()!==this._tag)X=!1;return X};R$.gcm.prototype.multiply=function($,J){var X=[0,0,0,0],Q=J.slice(0);for(var Y=0;Y<128;++Y){var G=$[Y/32|0]&1<<31-Y%32;if(G)X[0]^=Q[0],X[1]^=Q[1],X[2]^=Q[2],X[3]^=Q[3];this.pow(Q,Q)}return X};R$.gcm.prototype.pow=function($,J){var X=$[3]&1;for(var Q=3;Q>0;--Q)J[Q]=$[Q]>>>1|($[Q-1]&1)<<31;if(J[0]=$[0]>>>1,X)J[0]^=this._R};R$.gcm.prototype.tableMultiply=function($){var J=[0,0,0,0];for(var X=0;X<32;++X){var Q=X/8|0,Y=$[Q]>>>(7-X%8)*4&15,G=this._m[X][Y];J[0]^=G[0],J[1]^=G[1],J[2]^=G[2],J[3]^=G[3]}return J};R$.gcm.prototype.ghash=function($,J,X){return J[0]^=X[0],J[1]^=X[1],J[2]^=X[2],J[3]^=X[3],this.tableMultiply(J)};R$.gcm.prototype.generateHashTable=function($,J){var X=8/J,Q=4*X,Y=16*X,G=Array(Y);for(var W=0;W<Y;++W){var U=[0,0,0,0],M=W/Q|0,O=(Q-1-W%Q)*J;U[M]=1<<J-1<<O,G[W]=this.generateSubHashTable(this.multiply(U,$),J)}return G};R$.gcm.prototype.generateSubHashTable=function($,J){var X=1<<J,Q=X>>>1,Y=Array(X);Y[Q]=$.slice(0);var G=Q>>>1;while(G>0)this.pow(Y[2*G],Y[G]=[]),G>>=1;G=2;while(G<Q){for(var W=1;W<G;++W){var U=Y[G],M=Y[W];Y[G+W]=[U[0]^M[0],U[1]^M[1],U[2]^M[2],U[3]^M[3]]}G*=2}Y[0]=[0,0,0,0];for(G=Q+1;G<X;++G){var O=Y[G^Q];Y[G]=[$[0]^O[0],$[1]^O[1],$[2]^O[2],$[3]^O[3]]}return Y};function NY($,J){if(typeof $==="string")$=OJ.util.createBuffer($);if(OJ.util.isArray($)&&$.length>4){var X=$;$=OJ.util.createBuffer();for(var Q=0;Q<X.length;++Q)$.putByte(X[Q])}if($.length()<J)throw Error("Invalid IV length; got "+$.length()+" bytes and expected "+J+" bytes.");if(!OJ.util.isArray($)){var Y=[],G=J/4;for(var Q=0;Q<G;++Q)Y.push($.getInt32());$=Y}return $}function LY($){$[$.length-1]=$[$.length-1]+1&4294967295}function a9($){return[$/4294967296|0,$&4294967295]}});var w0=H$((GF,wG)=>{var m$=F$();FY();s9();_$();wG.exports=m$.aes=m$.aes||{};m$.aes.startEncrypting=function($,J,X,Q){var Y=AY({key:$,output:X,decrypt:!1,mode:Q});return Y.start(J),Y};m$.aes.createEncryptionCipher=function($,J){return AY({key:$,output:null,decrypt:!1,mode:J})};m$.aes.startDecrypting=function($,J,X,Q){var Y=AY({key:$,output:X,decrypt:!0,mode:Q});return Y.start(J),Y};m$.aes.createDecryptionCipher=function($,J){return AY({key:$,output:null,decrypt:!0,mode:J})};m$.aes.Algorithm=function($,J){if(!e9)IG();var X=this;X.name=$,X.mode=new J({blockSize:16,cipher:{encrypt:function(Q,Y){return t9(X._w,Q,Y,!1)},decrypt:function(Q,Y){return t9(X._w,Q,Y,!0)}}}),X._init=!1};m$.aes.Algorithm.prototype.initialize=function($){if(this._init)return;var J=$.key,X;if(typeof J==="string"&&(J.length===16||J.length===24||J.length===32))J=m$.util.createBuffer(J);else if(m$.util.isArray(J)&&(J.length===16||J.length===24||J.length===32)){X=J,J=m$.util.createBuffer();for(var Q=0;Q<X.length;++Q)J.putByte(X[Q])}if(!m$.util.isArray(J)){X=J,J=[];var Y=X.length();if(Y===16||Y===24||Y===32){Y=Y>>>2;for(var Q=0;Q<Y;++Q)J.push(X.getInt32())}}if(!m$.util.isArray(J)||!(J.length===4||J.length===6||J.length===8))throw Error("Invalid key parameter.");var G=this.mode.name,W=["CFB","OFB","CTR","GCM"].indexOf(G)!==-1;this._w=CG(J,$.decrypt&&!W),this._init=!0};m$.aes._expandKey=function($,J){if(!e9)IG();return CG($,J)};m$.aes._updateBlock=t9;jQ("AES-ECB",m$.cipher.modes.ecb);jQ("AES-CBC",m$.cipher.modes.cbc);jQ("AES-CFB",m$.cipher.modes.cfb);jQ("AES-OFB",m$.cipher.modes.ofb);jQ("AES-CTR",m$.cipher.modes.ctr);jQ("AES-GCM",m$.cipher.modes.gcm);function jQ($,J){var X=function(){return new m$.aes.Algorithm($,J)};m$.cipher.registerAlgorithm($,X)}var e9=!1,BQ=4,LJ,r9,SG,$Q,gJ;function IG(){e9=!0,SG=[0,1,2,4,8,16,32,64,128,27,54];var $=Array(256);for(var J=0;J<128;++J)$[J]=J<<1,$[J+128]=J+128<<1^283;LJ=Array(256),r9=Array(256),$Q=[,,,,],gJ=[,,,,];for(var J=0;J<4;++J)$Q[J]=Array(256),gJ[J]=Array(256);var X=0,Q=0,Y,G,W,U,M,O,V;for(var J=0;J<256;++J){U=Q^Q<<1^Q<<2^Q<<3^Q<<4,U=U>>8^U&255^99,LJ[X]=U,r9[U]=X,M=$[U],Y=$[X],G=$[Y],W=$[G],O=M<<24^U<<16^U<<8^(U^M),V=(Y^G^W)<<24^(X^W)<<16^(X^G^W)<<8^(X^Y^W);for(var H=0;H<4;++H)$Q[H][X]=O,gJ[H][U]=V,O=O<<24|O>>>8,V=V<<24|V>>>8;if(X===0)X=Q=1;else X=Y^$[$[$[Y^W]]],Q^=$[$[Q]]}}function CG($,J){var X=$.slice(0),Q,Y=1,G=X.length,W=G+6+1,U=BQ*W;for(var M=G;M<U;++M){if(Q=X[M-1],M%G===0)Q=LJ[Q>>>16&255]<<24^LJ[Q>>>8&255]<<16^LJ[Q&255]<<8^LJ[Q>>>24]^SG[Y]<<24,Y++;else if(G>6&&M%G===4)Q=LJ[Q>>>24]<<24^LJ[Q>>>16&255]<<16^LJ[Q>>>8&255]<<8^LJ[Q&255];X[M]=X[M-G]^Q}if(J){var O,V=gJ[0],H=gJ[1],q=gJ[2],F=gJ[3],K=X.slice(0);U=X.length;for(var M=0,A=U-BQ;M<U;M+=BQ,A-=BQ)if(M===0||M===U-BQ)K[M]=X[A],K[M+1]=X[A+3],K[M+2]=X[A+2],K[M+3]=X[A+1];else for(var L=0;L<BQ;++L)O=X[A+L],K[M+(3&-L)]=V[LJ[O>>>24]]^H[LJ[O>>>16&255]]^q[LJ[O>>>8&255]]^F[LJ[O&255]];X=K}return X}function t9($,J,X,Q){var Y=$.length/4-1,G,W,U,M,O;if(Q)G=gJ[0],W=gJ[1],U=gJ[2],M=gJ[3],O=r9;else G=$Q[0],W=$Q[1],U=$Q[2],M=$Q[3],O=LJ;var V,H,q,F,K,A,L;V=J[0]^$[0],H=J[Q?3:1]^$[1],q=J[2]^$[2],F=J[Q?1:3]^$[3];var R=3;for(var I=1;I<Y;++I)K=G[V>>>24]^W[H>>>16&255]^U[q>>>8&255]^M[F&255]^$[++R],A=G[H>>>24]^W[q>>>16&255]^U[F>>>8&255]^M[V&255]^$[++R],L=G[q>>>24]^W[F>>>16&255]^U[V>>>8&255]^M[H&255]^$[++R],F=G[F>>>24]^W[V>>>16&255]^U[H>>>8&255]^M[q&255]^$[++R],V=K,H=A,q=L;X[0]=O[V>>>24]<<24^O[H>>>16&255]<<16^O[q>>>8&255]<<8^O[F&255]^$[++R],X[Q?3:1]=O[H>>>24]<<24^O[q>>>16&255]<<16^O[F>>>8&255]<<8^O[V&255]^$[++R],X[2]=O[q>>>24]<<24^O[F>>>16&255]<<16^O[V>>>8&255]<<8^O[H&255]^$[++R],X[Q?1:3]=O[F>>>24]<<24^O[V>>>16&255]<<16^O[H>>>8&255]<<8^O[q&255]^$[++R]}function AY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="AES-"+J,Q;if($.decrypt)Q=m$.cipher.createDecipher(X,$.key);else Q=m$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var U=null;if(W instanceof m$.util.ByteBuffer)U=W,W={};W=W||{},W.output=U,W.iv=G,Y.call(Q,W)},Q}});var P0=H$((WF,PG)=>{var FX=F$();FX.pki=FX.pki||{};var $8=PG.exports=FX.pki.oids=FX.oids=FX.oids||{};function b($,J){$8[$]=J,$8[J]=$}function k$($,J){$8[$]=J}b("1.2.840.113549.1.1.1","rsaEncryption");b("1.2.840.113549.1.1.4","md5WithRSAEncryption");b("1.2.840.113549.1.1.5","sha1WithRSAEncryption");b("1.2.840.113549.1.1.7","RSAES-OAEP");b("1.2.840.113549.1.1.8","mgf1");b("1.2.840.113549.1.1.9","pSpecified");b("1.2.840.113549.1.1.10","RSASSA-PSS");b("1.2.840.113549.1.1.11","sha256WithRSAEncryption");b("1.2.840.113549.1.1.12","sha384WithRSAEncryption");b("1.2.840.113549.1.1.13","sha512WithRSAEncryption");b("1.3.101.112","EdDSA25519");b("1.2.840.10040.4.3","dsa-with-sha1");b("1.3.14.3.2.7","desCBC");b("1.3.14.3.2.26","sha1");b("1.3.14.3.2.29","sha1WithRSASignature");b("2.16.840.1.101.3.4.2.1","sha256");b("2.16.840.1.101.3.4.2.2","sha384");b("2.16.840.1.101.3.4.2.3","sha512");b("2.16.840.1.101.3.4.2.4","sha224");b("2.16.840.1.101.3.4.2.5","sha512-224");b("2.16.840.1.101.3.4.2.6","sha512-256");b("1.2.840.113549.2.2","md2");b("1.2.840.113549.2.5","md5");b("1.2.840.113549.1.7.1","data");b("1.2.840.113549.1.7.2","signedData");b("1.2.840.113549.1.7.3","envelopedData");b("1.2.840.113549.1.7.4","signedAndEnvelopedData");b("1.2.840.113549.1.7.5","digestedData");b("1.2.840.113549.1.7.6","encryptedData");b("1.2.840.113549.1.9.1","emailAddress");b("1.2.840.113549.1.9.2","unstructuredName");b("1.2.840.113549.1.9.3","contentType");b("1.2.840.113549.1.9.4","messageDigest");b("1.2.840.113549.1.9.5","signingTime");b("1.2.840.113549.1.9.6","counterSignature");b("1.2.840.113549.1.9.7","challengePassword");b("1.2.840.113549.1.9.8","unstructuredAddress");b("1.2.840.113549.1.9.14","extensionRequest");b("1.2.840.113549.1.9.20","friendlyName");b("1.2.840.113549.1.9.21","localKeyId");b("1.2.840.113549.1.9.22.1","x509Certificate");b("1.2.840.113549.1.12.10.1.1","keyBag");b("1.2.840.113549.1.12.10.1.2","pkcs8ShroudedKeyBag");b("1.2.840.113549.1.12.10.1.3","certBag");b("1.2.840.113549.1.12.10.1.4","crlBag");b("1.2.840.113549.1.12.10.1.5","secretBag");b("1.2.840.113549.1.12.10.1.6","safeContentsBag");b("1.2.840.113549.1.5.13","pkcs5PBES2");b("1.2.840.113549.1.5.12","pkcs5PBKDF2");b("1.2.840.113549.1.12.1.1","pbeWithSHAAnd128BitRC4");b("1.2.840.113549.1.12.1.2","pbeWithSHAAnd40BitRC4");b("1.2.840.113549.1.12.1.3","pbeWithSHAAnd3-KeyTripleDES-CBC");b("1.2.840.113549.1.12.1.4","pbeWithSHAAnd2-KeyTripleDES-CBC");b("1.2.840.113549.1.12.1.5","pbeWithSHAAnd128BitRC2-CBC");b("1.2.840.113549.1.12.1.6","pbewithSHAAnd40BitRC2-CBC");b("1.2.840.113549.2.7","hmacWithSHA1");b("1.2.840.113549.2.8","hmacWithSHA224");b("1.2.840.113549.2.9","hmacWithSHA256");b("1.2.840.113549.2.10","hmacWithSHA384");b("1.2.840.113549.2.11","hmacWithSHA512");b("1.2.840.113549.3.7","des-EDE3-CBC");b("2.16.840.1.101.3.4.1.2","aes128-CBC");b("2.16.840.1.101.3.4.1.22","aes192-CBC");b("2.16.840.1.101.3.4.1.42","aes256-CBC");b("2.5.4.3","commonName");b("2.5.4.4","surname");b("2.5.4.5","serialNumber");b("2.5.4.6","countryName");b("2.5.4.7","localityName");b("2.5.4.8","stateOrProvinceName");b("2.5.4.9","streetAddress");b("2.5.4.10","organizationName");b("2.5.4.11","organizationalUnitName");b("2.5.4.12","title");b("2.5.4.13","description");b("2.5.4.15","businessCategory");b("2.5.4.17","postalCode");b("2.5.4.42","givenName");b("2.5.4.65","pseudonym");b("1.3.6.1.4.1.311.60.2.1.2","jurisdictionOfIncorporationStateOrProvinceName");b("1.3.6.1.4.1.311.60.2.1.3","jurisdictionOfIncorporationCountryName");b("2.16.840.1.113730.1.1","nsCertType");b("2.16.840.1.113730.1.13","nsComment");k$("2.5.29.1","authorityKeyIdentifier");k$("2.5.29.2","keyAttributes");k$("2.5.29.3","certificatePolicies");k$("2.5.29.4","keyUsageRestriction");k$("2.5.29.5","policyMapping");k$("2.5.29.6","subtreesConstraint");k$("2.5.29.7","subjectAltName");k$("2.5.29.8","issuerAltName");k$("2.5.29.9","subjectDirectoryAttributes");k$("2.5.29.10","basicConstraints");k$("2.5.29.11","nameConstraints");k$("2.5.29.12","policyConstraints");k$("2.5.29.13","basicConstraints");b("2.5.29.14","subjectKeyIdentifier");b("2.5.29.15","keyUsage");k$("2.5.29.16","privateKeyUsagePeriod");b("2.5.29.17","subjectAltName");b("2.5.29.18","issuerAltName");b("2.5.29.19","basicConstraints");k$("2.5.29.20","cRLNumber");k$("2.5.29.21","cRLReason");k$("2.5.29.22","expirationDate");k$("2.5.29.23","instructionCode");k$("2.5.29.24","invalidityDate");k$("2.5.29.25","cRLDistributionPoints");k$("2.5.29.26","issuingDistributionPoint");k$("2.5.29.27","deltaCRLIndicator");k$("2.5.29.28","issuingDistributionPoint");k$("2.5.29.29","certificateIssuer");k$("2.5.29.30","nameConstraints");b("2.5.29.31","cRLDistributionPoints");b("2.5.29.32","certificatePolicies");k$("2.5.29.33","policyMappings");k$("2.5.29.34","policyConstraints");b("2.5.29.35","authorityKeyIdentifier");k$("2.5.29.36","policyConstraints");b("2.5.29.37","extKeyUsage");k$("2.5.29.46","freshestCRL");k$("2.5.29.54","inhibitAnyPolicy");b("1.3.6.1.4.1.11129.2.4.2","timestampList");b("1.3.6.1.5.5.7.1.1","authorityInfoAccess");b("1.3.6.1.5.5.7.3.1","serverAuth");b("1.3.6.1.5.5.7.3.2","clientAuth");b("1.3.6.1.5.5.7.3.3","codeSigning");b("1.3.6.1.5.5.7.3.4","emailProtection");b("1.3.6.1.5.5.7.3.8","timeStamping")});var mJ=H$((UF,xG)=>{var p$=F$();_$();P0();var d=xG.exports=p$.asn1=p$.asn1||{};d.Class={UNIVERSAL:0,APPLICATION:64,CONTEXT_SPECIFIC:128,PRIVATE:192};d.Type={NONE:0,BOOLEAN:1,INTEGER:2,BITSTRING:3,OCTETSTRING:4,NULL:5,OID:6,ODESC:7,EXTERNAL:8,REAL:9,ENUMERATED:10,EMBEDDED:11,UTF8:12,ROID:13,SEQUENCE:16,SET:17,PRINTABLESTRING:19,IA5STRING:22,UTCTIME:23,GENERALIZEDTIME:24,BMPSTRING:30};d.maxDepth=256;d.create=function($,J,X,Q,Y){if(p$.util.isArray(Q)){var G=[];for(var W=0;W<Q.length;++W)if(Q[W]!==void 0)G.push(Q[W]);Q=G}var U={tagClass:$,type:J,constructed:X,composed:X||p$.util.isArray(Q),value:Q};if(Y&&"bitStringContents"in Y)U.bitStringContents=Y.bitStringContents,U.original=d.copy(U);return U};d.copy=function($,J){var X;if(p$.util.isArray($)){X=[];for(var Q=0;Q<$.length;++Q)X.push(d.copy($[Q],J));return X}if(typeof $==="string")return $;if(X={tagClass:$.tagClass,type:$.type,constructed:$.constructed,composed:$.composed,value:d.copy($.value,J)},J&&!J.excludeBitStringContents)X.bitStringContents=$.bitStringContents;return X};d.equals=function($,J,X){if(p$.util.isArray($)){if(!p$.util.isArray(J))return!1;if($.length!==J.length)return!1;for(var Q=0;Q<$.length;++Q)if(!d.equals($[Q],J[Q]))return!1;return!0}if(typeof $!==typeof J)return!1;if(typeof $==="string")return $===J;var Y=$.tagClass===J.tagClass&&$.type===J.type&&$.constructed===J.constructed&&$.composed===J.composed&&d.equals($.value,J.value);if(X&&X.includeBitStringContents)Y=Y&&$.bitStringContents===J.bitStringContents;return Y};d.getBerValueLength=function($){var J=$.getByte();if(J===128)return;var X,Q=J&128;if(!Q)X=J;else X=$.getInt((J&127)<<3);return X};function NX($,J,X){if(X>J){var Q=Error("Too few bytes to parse DER.");throw Q.available=$.length(),Q.remaining=J,Q.requested=X,Q}}var QM=function($,J){var X=$.getByte();if(J--,X===128)return;var Q,Y=X&128;if(!Y)Q=X;else{var G=X&127;NX($,J,G),Q=$.getInt(G<<3)}if(Q<0)throw Error("Negative length: "+Q);return Q};d.fromDer=function($,J){if(J===void 0)J={strict:!0,parseAllBytes:!0,decodeBitStrings:!0};if(typeof J==="boolean")J={strict:J,parseAllBytes:!0,decodeBitStrings:!0};if(!("strict"in J))J.strict=!0;if(!("parseAllBytes"in J))J.parseAllBytes=!0;if(!("decodeBitStrings"in J))J.decodeBitStrings=!0;if(!("maxDepth"in J))J.maxDepth=d.maxDepth;if(typeof $==="string")$=p$.util.createBuffer($);var X=$.length(),Q=RY($,$.length(),0,J);if(J.parseAllBytes&&$.length()!==0){var Y=Error("Unparsed DER bytes remain after ASN.1 parsing.");throw Y.byteCount=X,Y.remaining=$.length(),Y}return Q};function RY($,J,X,Q){if(X>=Q.maxDepth)throw Error("ASN.1 parsing error: Max depth exceeded.");var Y;NX($,J,2);var G=$.getByte();J--;var W=G&192,U=G&31;Y=$.length();var M=QM($,J);if(J-=Y-$.length(),M!==void 0&&M>J){if(Q.strict){var O=Error("Too few bytes to read ASN.1 value.");throw O.available=$.length(),O.remaining=J,O.requested=M,O}M=J}var V,H,q=(G&32)===32;if(q)if(V=[],M===void 0)for(;;){if(NX($,J,2),$.bytes(2)===String.fromCharCode(0,0)){$.getBytes(2),J-=2;break}Y=$.length(),V.push(RY($,J,X+1,Q)),J-=Y-$.length()}else while(M>0)Y=$.length(),V.push(RY($,M,X+1,Q)),J-=Y-$.length(),M-=Y-$.length();if(V===void 0&&W===d.Class.UNIVERSAL&&U===d.Type.BITSTRING)H=$.bytes(M);if(V===void 0&&Q.decodeBitStrings&&W===d.Class.UNIVERSAL&&U===d.Type.BITSTRING&&M>1){var F=$.read,K=J,A=0;if(U===d.Type.BITSTRING)NX($,J,1),A=$.getByte(),J--;if(A===0)try{Y=$.length();var L={strict:!0,decodeBitStrings:!0},R=RY($,J,X+1,L),I=Y-$.length();if(J-=I,U==d.Type.BITSTRING)I++;var j=R.tagClass;if(I===M&&(j===d.Class.UNIVERSAL||j===d.Class.CONTEXT_SPECIFIC))V=[R]}catch(w){}if(V===void 0)$.read=F,J=K}if(V===void 0){if(M===void 0){if(Q.strict)throw Error("Non-constructed ASN.1 object of indefinite length.");M=J}if(U===d.Type.BMPSTRING){V="";for(;M>0;M-=2)NX($,J,2),V+=String.fromCharCode($.getInt16()),J-=2}else V=$.getBytes(M),J-=M}var C=H===void 0?null:{bitStringContents:H};return d.create(W,U,q,V,C)}d.toDer=function($){var J=p$.util.createBuffer(),X=$.tagClass|$.type,Q=p$.util.createBuffer(),Y=!1;if("bitStringContents"in $){if(Y=!0,$.original)Y=d.equals($,$.original)}if(Y)Q.putBytes($.bitStringContents);else if($.composed){if($.constructed)X|=32;else Q.putByte(0);for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0)Q.putBuffer(d.toDer($.value[G]))}else if($.type===d.Type.BMPSTRING)for(var G=0;G<$.value.length;++G)Q.putInt16($.value.charCodeAt(G));else if($.type===d.Type.INTEGER&&$.value.length>1&&($.value.charCodeAt(0)===0&&($.value.charCodeAt(1)&128)===0||$.value.charCodeAt(0)===255&&($.value.charCodeAt(1)&128)===128))Q.putBytes($.value.substr(1));else Q.putBytes($.value);if(J.putByte(X),Q.length()<=127)J.putByte(Q.length()&127);else{var W=Q.length(),U="";do U+=String.fromCharCode(W&255),W=W>>>8;while(W>0);J.putByte(U.length|128);for(var G=U.length-1;G>=0;--G)J.putByte(U.charCodeAt(G))}return J.putBuffer(Q),J};d.oidToDer=function($){var J=$.split("."),X=p$.util.createBuffer();X.putByte(40*parseInt(J[0],10)+parseInt(J[1],10));var Q,Y,G,W;for(var U=2;U<J.length;++U){if(Q=!0,Y=[],G=parseInt(J[U],10),G>4294967295)throw Error("OID value too large; max is 32-bits.");do{if(W=G&127,G=G>>>7,!Q)W|=128;Y.push(W),Q=!1}while(G>0);for(var M=Y.length-1;M>=0;--M)X.putByte(Y[M])}return X};d.derToOid=function($){var J;if(typeof $==="string")$=p$.util.createBuffer($);var X=$.getByte();J=Math.floor(X/40)+"."+X%40;var Q=0;while($.length()>0){if(Q>70368744177663)throw Error("OID value too large; max is 53-bits.");if(X=$.getByte(),Q=Q*128,X&128)Q+=X&127;else J+="."+(Q+X),Q=0}return J};d.utcTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,2),10);X=X>=50?1900+X:2000+X;var Q=parseInt($.substr(2,2),10)-1,Y=parseInt($.substr(4,2),10),G=parseInt($.substr(6,2),10),W=parseInt($.substr(8,2),10),U=0;if($.length>11){var M=$.charAt(10),O=10;if(M!=="+"&&M!=="-")U=parseInt($.substr(10,2),10),O+=2}if(J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,U,0),O){if(M=$.charAt(O),M==="+"||M==="-"){var V=parseInt($.substr(O+1,2),10),H=parseInt($.substr(O+4,2),10),q=V*60+H;if(q*=60000,M==="+")J.setTime(+J-q);else J.setTime(+J+q)}}return J};d.generalizedTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,4),10),Q=parseInt($.substr(4,2),10)-1,Y=parseInt($.substr(6,2),10),G=parseInt($.substr(8,2),10),W=parseInt($.substr(10,2),10),U=parseInt($.substr(12,2),10),M=0,O=0,V=!1;if($.charAt($.length-1)==="Z")V=!0;var H=$.length-5,q=$.charAt(H);if(q==="+"||q==="-"){var F=parseInt($.substr(H+1,2),10),K=parseInt($.substr(H+4,2),10);if(O=F*60+K,O*=60000,q==="+")O*=-1;V=!0}if($.charAt(14)===".")M=parseFloat($.substr(14),10)*1000;if(V)J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,U,M),J.setTime(+J+O);else J.setFullYear(X,Q,Y),J.setHours(G,W,U,M);return J};d.dateToUtcTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push((""+$.getUTCFullYear()).substr(2)),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};d.dateToGeneralizedTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push(""+$.getUTCFullYear()),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};d.integerToDer=function($){var J=p$.util.createBuffer();if($>=-128&&$<128)return J.putSignedInt($,8);if($>=-32768&&$<32768)return J.putSignedInt($,16);if($>=-8388608&&$<8388608)return J.putSignedInt($,24);if($>=-2147483648&&$<2147483648)return J.putSignedInt($,32);var X=Error("Integer too large; max is 32-bits.");throw X.integer=$,X};d.derToInteger=function($){if(typeof $==="string")$=p$.util.createBuffer($);var J=$.length()*8;if(J>32)throw Error("Integer too large; max is 32-bits.");return $.getSignedInt(J)};d.validate=function($,J,X,Q){var Y=!1;if(($.tagClass===J.tagClass||typeof J.tagClass>"u")&&($.type===J.type||typeof J.type>"u")){if($.constructed===J.constructed||typeof J.constructed>"u"){if(Y=!0,J.value&&p$.util.isArray(J.value)){var G=0;for(var W=0;Y&&W<J.value.length;++W){var U=J.value[W];Y=!!U.optional;var M=$.value[G];if(!M){if(!U.optional){if(Y=!1,Q)Q.push("["+J.name+'] Missing required element. Expected tag class "'+U.tagClass+'", type "'+U.type+'"')}continue}var O=typeof U.tagClass<"u"&&typeof U.type<"u";if(O&&(M.tagClass!==U.tagClass||M.type!==U.type))if(U.optional){Y=!0;continue}else{if(Y=!1,Q)Q.push("["+J.name+"] Tag mismatch. Expected ("+U.tagClass+","+U.type+"), got ("+M.tagClass+","+M.type+")");break}var V=d.validate(M,U,X,Q);if(V)++G,Y=!0;else if(U.optional)Y=!0;else{Y=!1;break}}}if(Y&&X){if(J.capture)X[J.capture]=$.value;if(J.captureAsn1)X[J.captureAsn1]=$;if(J.captureBitStringContents&&"bitStringContents"in $)X[J.captureBitStringContents]=$.bitStringContents;if(J.captureBitStringValue&&"bitStringContents"in $){var H;if($.bitStringContents.length<2)X[J.captureBitStringValue]="";else{var q=$.bitStringContents.charCodeAt(0);if(q!==0)throw Error("captureBitStringValue only supported for zero unused bits");X[J.captureBitStringValue]=$.bitStringContents.slice(1)}}}}else if(Q)Q.push("["+J.name+'] Expected constructed "'+J.constructed+'", got "'+$.constructed+'"')}else if(Q){if($.tagClass!==J.tagClass)Q.push("["+J.name+'] Expected tag class "'+J.tagClass+'", got "'+$.tagClass+'"');if($.type!==J.type)Q.push("["+J.name+'] Expected type "'+J.type+'", got "'+$.type+'"')}return Y};var _G=/[^\\u0000-\\u00ff]/;d.prettyPrint=function($,J,X){var Q="";if(J=J||0,X=X||2,J>0)Q+=`
6
+ `;var Y="";for(var G=0;G<J*X;++G)Y+=" ";switch(Q+=Y+"Tag: ",$.tagClass){case d.Class.UNIVERSAL:Q+="Universal:";break;case d.Class.APPLICATION:Q+="Application:";break;case d.Class.CONTEXT_SPECIFIC:Q+="Context-Specific:";break;case d.Class.PRIVATE:Q+="Private:";break}if($.tagClass===d.Class.UNIVERSAL)switch(Q+=$.type,$.type){case d.Type.NONE:Q+=" (None)";break;case d.Type.BOOLEAN:Q+=" (Boolean)";break;case d.Type.INTEGER:Q+=" (Integer)";break;case d.Type.BITSTRING:Q+=" (Bit string)";break;case d.Type.OCTETSTRING:Q+=" (Octet string)";break;case d.Type.NULL:Q+=" (Null)";break;case d.Type.OID:Q+=" (Object Identifier)";break;case d.Type.ODESC:Q+=" (Object Descriptor)";break;case d.Type.EXTERNAL:Q+=" (External or Instance of)";break;case d.Type.REAL:Q+=" (Real)";break;case d.Type.ENUMERATED:Q+=" (Enumerated)";break;case d.Type.EMBEDDED:Q+=" (Embedded PDV)";break;case d.Type.UTF8:Q+=" (UTF8)";break;case d.Type.ROID:Q+=" (Relative Object Identifier)";break;case d.Type.SEQUENCE:Q+=" (Sequence)";break;case d.Type.SET:Q+=" (Set)";break;case d.Type.PRINTABLESTRING:Q+=" (Printable String)";break;case d.Type.IA5String:Q+=" (IA5String (ASCII))";break;case d.Type.UTCTIME:Q+=" (UTC time)";break;case d.Type.GENERALIZEDTIME:Q+=" (Generalized time)";break;case d.Type.BMPSTRING:Q+=" (BMP String)";break}else Q+=$.type;if(Q+=`
7
7
  `,Q+=Y+"Constructed: "+$.constructed+`
8
- `,$.composed){var W=0,U="";for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0){if(W+=1,U+=c.prettyPrint($.value[G],J+1,X),G+1<$.value.length)U+=","}Q+=Y+"Sub values: "+W+U}else{if(Q+=Y+"Value: ",$.type===c.Type.OID){var M=c.derToOid($.value);if(Q+=M,p$.pki&&p$.pki.oids){if(M in p$.pki.oids)Q+=" ("+p$.pki.oids[M]+") "}}if($.type===c.Type.INTEGER)try{Q+=c.derToInteger($.value)}catch(V){Q+="0x"+p$.util.bytesToHex($.value)}else if($.type===c.Type.BITSTRING){if($.value.length>1)Q+="0x"+p$.util.bytesToHex($.value.slice(1));else Q+="(none)";if($.value.length>0){var O=$.value.charCodeAt(0);if(O==1)Q+=" (1 unused bit shown)";else if(O>1)Q+=" ("+O+" unused bits shown)"}}else if($.type===c.Type.OCTETSTRING){if(!PG.test($.value))Q+="("+$.value+") ";Q+="0x"+p$.util.bytesToHex($.value)}else if($.type===c.Type.UTF8)try{Q+=p$.util.decodeUtf8($.value)}catch(V){if(V.message==="URI malformed")Q+="0x"+p$.util.bytesToHex($.value)+" (malformed UTF8)";else throw V}else if($.type===c.Type.PRINTABLESTRING||$.type===c.Type.IA5String)Q+=$.value;else if(PG.test($.value))Q+="0x"+p$.util.bytesToHex($.value);else if($.value.length===0)Q+="[null]";else Q+=$.value}return Q}});var eJ=O$((XF,xG)=>{var RY=z$();xG.exports=RY.md=RY.md||{};RY.md.algorithms=RY.md.algorithms||{}});var TQ=O$((YF,vG)=>{var F0=z$();eJ();w$();var JM=vG.exports=F0.hmac=F0.hmac||{};JM.create=function(){var $=null,J=null,X=null,Q=null,Y={};return Y.start=function(G,W){if(G!==null)if(typeof G==="string")if(G=G.toLowerCase(),G in F0.md.algorithms)J=F0.md.algorithms[G].create();else throw Error('Unknown hash algorithm "'+G+'"');else J=G;if(W===null)W=$;else{if(typeof W==="string")W=F0.util.createBuffer(W);else if(F0.util.isArray(W)){var U=W;W=F0.util.createBuffer();for(var M=0;M<U.length;++M)W.putByte(U[M])}var O=W.length();if(O>J.blockLength)J.start(),J.update(W.bytes()),W=J.digest();X=F0.util.createBuffer(),Q=F0.util.createBuffer(),O=W.length();for(var M=0;M<O;++M){var U=W.at(M);X.putByte(54^U),Q.putByte(92^U)}if(O<J.blockLength){var U=J.blockLength-O;for(var M=0;M<U;++M)X.putByte(54),Q.putByte(92)}$=W,X=X.bytes(),Q=Q.bytes()}J.start(),J.update(X)},Y.update=function(G){J.update(G)},Y.getMac=function(){var G=J.digest().bytes();return J.start(),J.update(Q),J.update(G),J.digest()},Y.digest=Y.getMac,Y}});var ZY=O$((GF,bG)=>{var $0=z$();eJ();w$();var fG=bG.exports=$0.md5=$0.md5||{};$0.md.md5=$0.md.algorithms.md5=fG;fG.create=function(){if(!yG)QM();var $=null,J=$0.util.createBuffer(),X=Array(16),Q={algorithm:"md5",blockLength:64,digestLength:16,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=$0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=$0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),kG($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=$0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes($8.substr(0,Q.blockLength-W));var U,M=0;for(var O=Q.fullMessageLength.length-1;O>=0;--O)U=Q.fullMessageLength[O]*8+M,M=U/4294967296>>>0,Y.putInt32Le(U>>>0);var V={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3};kG(V,X,Y);var H=$0.util.createBuffer();return H.putInt32Le(V.h0),H.putInt32Le(V.h1),H.putInt32Le(V.h2),H.putInt32Le(V.h3),H},Q};var $8=null,DY=null,LX=null,SQ=null,yG=!1;function QM(){$8=String.fromCharCode(128),$8+=$0.util.fillString(String.fromCharCode(0),64),DY=[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,1,6,11,0,5,10,15,4,9,14,3,8,13,2,7,12,5,8,11,14,1,4,7,10,13,0,3,6,9,12,15,2,0,7,14,5,12,3,10,1,8,15,6,13,4,11,2,9],LX=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],SQ=Array(64);for(var $=0;$<64;++$)SQ[$]=Math.floor(Math.abs(Math.sin($+1))*4294967296);yG=!0}function kG($,J,X){var Q,Y,G,W,U,M,O,V,H=X.length();while(H>=64){Y=$.h0,G=$.h1,W=$.h2,U=$.h3;for(V=0;V<16;++V)J[V]=X.getInt32Le(),M=U^G&(W^U),Q=Y+M+SQ[V]+J[V],O=LX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<32;++V)M=W^U&(G^W),Q=Y+M+SQ[V]+J[DY[V]],O=LX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<48;++V)M=G^W^U,Q=Y+M+SQ[V]+J[DY[V]],O=LX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<64;++V)M=W^(G|~U),Q=Y+M+SQ[V]+J[DY[V]],O=LX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+U|0,H-=64}}});var JQ=O$((WF,uG)=>{var jY=z$();w$();var hG=uG.exports=jY.pem=jY.pem||{};hG.encode=function($,J){J=J||{};var X="-----BEGIN "+$.type+`-----\r
9
- `,Q;if($.procType)Q={name:"Proc-Type",values:[String($.procType.version),$.procType.type]},X+=BY(Q);if($.contentDomain)Q={name:"Content-Domain",values:[$.contentDomain]},X+=BY(Q);if($.dekInfo){if(Q={name:"DEK-Info",values:[$.dekInfo.algorithm]},$.dekInfo.parameters)Q.values.push($.dekInfo.parameters);X+=BY(Q)}if($.headers)for(var Y=0;Y<$.headers.length;++Y)X+=BY($.headers[Y]);if($.procType)X+=`\r
10
- `;return X+=jY.util.encode64($.body,J.maxline||64)+`\r
8
+ `,$.composed){var W=0,U="";for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0){if(W+=1,U+=d.prettyPrint($.value[G],J+1,X),G+1<$.value.length)U+=","}Q+=Y+"Sub values: "+W+U}else{if(Q+=Y+"Value: ",$.type===d.Type.OID){var M=d.derToOid($.value);if(Q+=M,p$.pki&&p$.pki.oids){if(M in p$.pki.oids)Q+=" ("+p$.pki.oids[M]+") "}}if($.type===d.Type.INTEGER)try{Q+=d.derToInteger($.value)}catch(V){Q+="0x"+p$.util.bytesToHex($.value)}else if($.type===d.Type.BITSTRING){if($.value.length>1)Q+="0x"+p$.util.bytesToHex($.value.slice(1));else Q+="(none)";if($.value.length>0){var O=$.value.charCodeAt(0);if(O==1)Q+=" (1 unused bit shown)";else if(O>1)Q+=" ("+O+" unused bits shown)"}}else if($.type===d.Type.OCTETSTRING){if(!_G.test($.value))Q+="("+$.value+") ";Q+="0x"+p$.util.bytesToHex($.value)}else if($.type===d.Type.UTF8)try{Q+=p$.util.decodeUtf8($.value)}catch(V){if(V.message==="URI malformed")Q+="0x"+p$.util.bytesToHex($.value)+" (malformed UTF8)";else throw V}else if($.type===d.Type.PRINTABLESTRING||$.type===d.Type.IA5String)Q+=$.value;else if(_G.test($.value))Q+="0x"+p$.util.bytesToHex($.value);else if($.value.length===0)Q+="[null]";else Q+=$.value}return Q}});var eJ=H$((MF,vG)=>{var DY=F$();vG.exports=DY.md=DY.md||{};DY.md.algorithms=DY.md.algorithms||{}});var TQ=H$((OF,kG)=>{var F0=F$();eJ();_$();var XM=kG.exports=F0.hmac=F0.hmac||{};XM.create=function(){var $=null,J=null,X=null,Q=null,Y={};return Y.start=function(G,W){if(G!==null)if(typeof G==="string")if(G=G.toLowerCase(),G in F0.md.algorithms)J=F0.md.algorithms[G].create();else throw Error('Unknown hash algorithm "'+G+'"');else J=G;if(W===null)W=$;else{if(typeof W==="string")W=F0.util.createBuffer(W);else if(F0.util.isArray(W)){var U=W;W=F0.util.createBuffer();for(var M=0;M<U.length;++M)W.putByte(U[M])}var O=W.length();if(O>J.blockLength)J.start(),J.update(W.bytes()),W=J.digest();X=F0.util.createBuffer(),Q=F0.util.createBuffer(),O=W.length();for(var M=0;M<O;++M){var U=W.at(M);X.putByte(54^U),Q.putByte(92^U)}if(O<J.blockLength){var U=J.blockLength-O;for(var M=0;M<U;++M)X.putByte(54),Q.putByte(92)}$=W,X=X.bytes(),Q=Q.bytes()}J.start(),J.update(X)},Y.update=function(G){J.update(G)},Y.getMac=function(){var G=J.digest().bytes();return J.start(),J.update(Q),J.update(G),J.digest()},Y.digest=Y.getMac,Y}});var BY=H$((VF,hG)=>{var $0=F$();eJ();_$();var yG=hG.exports=$0.md5=$0.md5||{};$0.md.md5=$0.md.algorithms.md5=yG;yG.create=function(){if(!bG)YM();var $=null,J=$0.util.createBuffer(),X=Array(16),Q={algorithm:"md5",blockLength:64,digestLength:16,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=$0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=$0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),fG($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=$0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(J8.substr(0,Q.blockLength-W));var U,M=0;for(var O=Q.fullMessageLength.length-1;O>=0;--O)U=Q.fullMessageLength[O]*8+M,M=U/4294967296>>>0,Y.putInt32Le(U>>>0);var V={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3};fG(V,X,Y);var H=$0.util.createBuffer();return H.putInt32Le(V.h0),H.putInt32Le(V.h1),H.putInt32Le(V.h2),H.putInt32Le(V.h3),H},Q};var J8=null,ZY=null,LX=null,SQ=null,bG=!1;function YM(){J8=String.fromCharCode(128),J8+=$0.util.fillString(String.fromCharCode(0),64),ZY=[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,1,6,11,0,5,10,15,4,9,14,3,8,13,2,7,12,5,8,11,14,1,4,7,10,13,0,3,6,9,12,15,2,0,7,14,5,12,3,10,1,8,15,6,13,4,11,2,9],LX=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],SQ=Array(64);for(var $=0;$<64;++$)SQ[$]=Math.floor(Math.abs(Math.sin($+1))*4294967296);bG=!0}function fG($,J,X){var Q,Y,G,W,U,M,O,V,H=X.length();while(H>=64){Y=$.h0,G=$.h1,W=$.h2,U=$.h3;for(V=0;V<16;++V)J[V]=X.getInt32Le(),M=U^G&(W^U),Q=Y+M+SQ[V]+J[V],O=LX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<32;++V)M=W^U&(G^W),Q=Y+M+SQ[V]+J[ZY[V]],O=LX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<48;++V)M=G^W^U,Q=Y+M+SQ[V]+J[ZY[V]],O=LX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<64;++V)M=W^(G|~U),Q=Y+M+SQ[V]+J[ZY[V]],O=LX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+U|0,H-=64}}});var JQ=H$((HF,gG)=>{var TY=F$();_$();var uG=gG.exports=TY.pem=TY.pem||{};uG.encode=function($,J){J=J||{};var X="-----BEGIN "+$.type+`-----\r
9
+ `,Q;if($.procType)Q={name:"Proc-Type",values:[String($.procType.version),$.procType.type]},X+=jY(Q);if($.contentDomain)Q={name:"Content-Domain",values:[$.contentDomain]},X+=jY(Q);if($.dekInfo){if(Q={name:"DEK-Info",values:[$.dekInfo.algorithm]},$.dekInfo.parameters)Q.values.push($.dekInfo.parameters);X+=jY(Q)}if($.headers)for(var Y=0;Y<$.headers.length;++Y)X+=jY($.headers[Y]);if($.procType)X+=`\r
10
+ `;return X+=TY.util.encode64($.body,J.maxline||64)+`\r
11
11
  `,X+="-----END "+$.type+`-----\r
12
- `,X};hG.decode=function($){var J=[],X=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g,Q=/([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/,Y=/\r?\n/,G;while(!0){if(G=X.exec($),!G)break;var W=G[1];if(W==="NEW CERTIFICATE REQUEST")W="CERTIFICATE REQUEST";var U={type:W,procType:null,contentDomain:null,dekInfo:null,headers:[],body:jY.util.decode64(G[3])};if(J.push(U),!G[2])continue;var M=G[2].split(Y),O=0;while(G&&O<M.length){var V=M[O].replace(/\s+$/,"");for(var H=O+1;H<M.length;++H){var q=M[H];if(!/\s/.test(q[0]))break;V+=q,O=H}if(G=V.match(Q),G){var F={name:G[1],values:[]},K=G[2].split(",");for(var A=0;A<K.length;++A)F.values.push(XM(K[A]));if(!U.procType){if(F.name!=="Proc-Type")throw Error('Invalid PEM formatted message. The first encapsulated header must be "Proc-Type".');else if(F.values.length!==2)throw Error('Invalid PEM formatted message. The "Proc-Type" header must have two subfields.');U.procType={version:K[0],type:K[1]}}else if(!U.contentDomain&&F.name==="Content-Domain")U.contentDomain=K[0]||"";else if(!U.dekInfo&&F.name==="DEK-Info"){if(F.values.length===0)throw Error('Invalid PEM formatted message. The "DEK-Info" header must have at least one subfield.');U.dekInfo={algorithm:K[0],parameters:K[1]||null}}else U.headers.push(F)}++O}if(U.procType==="ENCRYPTED"&&!U.dekInfo)throw Error('Invalid PEM formatted message. The "DEK-Info" header must be present if "Proc-Type" is "ENCRYPTED".')}if(J.length===0)throw Error("Invalid PEM formatted message.");return J};function BY($){var J=$.name+": ",X=[],Q=function(M,O){return" "+O};for(var Y=0;Y<$.values.length;++Y)X.push($.values[Y].replace(/^(\S+\r\n)/,Q));J+=X.join(",")+`\r
12
+ `,X};uG.decode=function($){var J=[],X=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g,Q=/([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/,Y=/\r?\n/,G;while(!0){if(G=X.exec($),!G)break;var W=G[1];if(W==="NEW CERTIFICATE REQUEST")W="CERTIFICATE REQUEST";var U={type:W,procType:null,contentDomain:null,dekInfo:null,headers:[],body:TY.util.decode64(G[3])};if(J.push(U),!G[2])continue;var M=G[2].split(Y),O=0;while(G&&O<M.length){var V=M[O].replace(/\s+$/,"");for(var H=O+1;H<M.length;++H){var q=M[H];if(!/\s/.test(q[0]))break;V+=q,O=H}if(G=V.match(Q),G){var F={name:G[1],values:[]},K=G[2].split(",");for(var A=0;A<K.length;++A)F.values.push(GM(K[A]));if(!U.procType){if(F.name!=="Proc-Type")throw Error('Invalid PEM formatted message. The first encapsulated header must be "Proc-Type".');else if(F.values.length!==2)throw Error('Invalid PEM formatted message. The "Proc-Type" header must have two subfields.');U.procType={version:K[0],type:K[1]}}else if(!U.contentDomain&&F.name==="Content-Domain")U.contentDomain=K[0]||"";else if(!U.dekInfo&&F.name==="DEK-Info"){if(F.values.length===0)throw Error('Invalid PEM formatted message. The "DEK-Info" header must have at least one subfield.');U.dekInfo={algorithm:K[0],parameters:K[1]||null}}else U.headers.push(F)}++O}if(U.procType==="ENCRYPTED"&&!U.dekInfo)throw Error('Invalid PEM formatted message. The "DEK-Info" header must be present if "Proc-Type" is "ENCRYPTED".')}if(J.length===0)throw Error("Invalid PEM formatted message.");return J};function jY($){var J=$.name+": ",X=[],Q=function(M,O){return" "+O};for(var Y=0;Y<$.values.length;++Y)X.push($.values[Y].replace(/^(\S+\r\n)/,Q));J+=X.join(",")+`\r
13
13
  `;var G=0,W=-1;for(var Y=0;Y<J.length;++Y,++G)if(G>65&&W!==-1){var U=J[W];if(U===",")++W,J=J.substr(0,W)+`\r
14
14
  `+J.substr(W);else J=J.substr(0,W)+`\r
15
- `+U+J.substr(W+1);G=Y-W-1,W=-1,++Y}else if(J[Y]===" "||J[Y]==="\t"||J[Y]===",")W=Y;return J}function XM($){return $.replace(/^\s+/,"")}});var AX=O$((UF,mG)=>{var i$=z$();EY();a9();w$();mG.exports=i$.des=i$.des||{};i$.des.startEncrypting=function($,J,X,Q){var Y=TY({key:$,output:X,decrypt:!1,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};i$.des.createEncryptionCipher=function($,J){return TY({key:$,output:null,decrypt:!1,mode:J})};i$.des.startDecrypting=function($,J,X,Q){var Y=TY({key:$,output:X,decrypt:!0,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};i$.des.createDecryptionCipher=function($,J){return TY({key:$,output:null,decrypt:!0,mode:J})};i$.des.Algorithm=function($,J){var X=this;X.name=$,X.mode=new J({blockSize:8,cipher:{encrypt:function(Q,Y){return gG(X._keys,Q,Y,!1)},decrypt:function(Q,Y){return gG(X._keys,Q,Y,!0)}}}),X._init=!1};i$.des.Algorithm.prototype.initialize=function($){if(this._init)return;var J=i$.util.createBuffer($.key);if(this.name.indexOf("3DES")===0){if(J.length()!==24)throw Error("Invalid Triple-DES key size: "+J.length()*8)}this._keys=qM(J),this._init=!0};J0("DES-ECB",i$.cipher.modes.ecb);J0("DES-CBC",i$.cipher.modes.cbc);J0("DES-CFB",i$.cipher.modes.cfb);J0("DES-OFB",i$.cipher.modes.ofb);J0("DES-CTR",i$.cipher.modes.ctr);J0("3DES-ECB",i$.cipher.modes.ecb);J0("3DES-CBC",i$.cipher.modes.cbc);J0("3DES-CFB",i$.cipher.modes.cfb);J0("3DES-OFB",i$.cipher.modes.ofb);J0("3DES-CTR",i$.cipher.modes.ctr);function J0($,J){var X=function(){return new i$.des.Algorithm($,J)};i$.cipher.registerAlgorithm($,X)}var YM=[16843776,0,65536,16843780,16842756,66564,4,65536,1024,16843776,16843780,1024,16778244,16842756,16777216,4,1028,16778240,16778240,66560,66560,16842752,16842752,16778244,65540,16777220,16777220,65540,0,1028,66564,16777216,65536,16843780,4,16842752,16843776,16777216,16777216,1024,16842756,65536,66560,16777220,1024,4,16778244,66564,16843780,65540,16842752,16778244,16777220,1028,66564,16843776,1028,16778240,16778240,0,65540,66560,0,16842756],GM=[-2146402272,-2147450880,32768,1081376,1048576,32,-2146435040,-2147450848,-2147483616,-2146402272,-2146402304,-2147483648,-2147450880,1048576,32,-2146435040,1081344,1048608,-2147450848,0,-2147483648,32768,1081376,-2146435072,1048608,-2147483616,0,1081344,32800,-2146402304,-2146435072,32800,0,1081376,-2146435040,1048576,-2147450848,-2146435072,-2146402304,32768,-2146435072,-2147450880,32,-2146402272,1081376,32,32768,-2147483648,32800,-2146402304,1048576,-2147483616,1048608,-2147450848,-2147483616,1048608,1081344,0,-2147450880,32800,-2147483648,-2146435040,-2146402272,1081344],WM=[520,134349312,0,134348808,134218240,0,131592,134218240,131080,134217736,134217736,131072,134349320,131080,134348800,520,134217728,8,134349312,512,131584,134348800,134348808,131592,134218248,131584,131072,134218248,8,134349320,512,134217728,134349312,134217728,131080,520,131072,134349312,134218240,0,512,131080,134349320,134218240,134217736,512,0,134348808,134218248,131072,134217728,134349320,8,131592,131584,134217736,134348800,134218248,520,134348800,131592,8,134348808,131584],UM=[8396801,8321,8321,128,8396928,8388737,8388609,8193,0,8396800,8396800,8396929,129,0,8388736,8388609,1,8192,8388608,8396801,128,8388608,8193,8320,8388737,1,8320,8388736,8192,8396928,8396929,129,8388736,8388609,8396800,8396929,129,0,0,8396800,8320,8388736,8388737,1,8396801,8321,8321,128,8396929,129,1,8192,8388609,8193,8396928,8388737,8193,8320,8388608,8396801,128,8388608,8192,8396928],MM=[256,34078976,34078720,1107296512,524288,256,1073741824,34078720,1074266368,524288,33554688,1074266368,1107296512,1107820544,524544,1073741824,33554432,1074266112,1074266112,0,1073742080,1107820800,1107820800,33554688,1107820544,1073742080,0,1107296256,34078976,33554432,1107296256,524544,524288,1107296512,256,33554432,1073741824,34078720,1107296512,1074266368,33554688,1073741824,1107820544,34078976,1074266368,256,33554432,1107820544,1107820800,524544,1107296256,1107820800,34078720,0,1074266112,1107296256,524544,33554688,1073742080,524288,0,1074266112,34078976,1073742080],OM=[536870928,541065216,16384,541081616,541065216,16,541081616,4194304,536887296,4210704,4194304,536870928,4194320,536887296,536870912,16400,0,4194320,536887312,16384,4210688,536887312,16,541065232,541065232,0,4210704,541081600,16400,4210688,541081600,536870912,536887296,16,541065232,4210688,541081616,4194304,16400,536870928,4194304,536887296,536870912,16400,536870928,541081616,4210688,541065216,4210704,541081600,0,541065232,16,16384,541065216,4210704,16384,4194320,536887312,0,541081600,536870912,4194320,536887312],VM=[2097152,69206018,67110914,0,2048,67110914,2099202,69208064,69208066,2097152,0,67108866,2,67108864,69206018,2050,67110912,2099202,2097154,67110912,67108866,69206016,69208064,2097154,69206016,2048,2050,69208066,2099200,2,67108864,2099200,67108864,2099200,2097152,67110914,67110914,69206018,69206018,2,2097154,67108864,67110912,2097152,69208064,2050,2099202,69208064,2050,67108866,69208066,69206016,2099200,0,2,69208066,0,2099202,69206016,2048,67108866,67110912,2048,2097154],HM=[268439616,4096,262144,268701760,268435456,268439616,64,268435456,262208,268697600,268701760,266240,268701696,266304,4096,64,268697600,268435520,268439552,4160,266240,262208,268697664,268701696,4160,0,0,268697664,268435520,268439552,266304,262144,266304,262144,268701696,4096,64,268697664,4096,266304,268439552,64,268435520,268697600,268697664,268435456,262144,268439616,0,268701760,262208,268435520,268697600,268439552,268439616,0,268701760,266240,266240,4160,4160,262208,268435456,268701696];function qM($){var J=[0,4,536870912,536870916,65536,65540,536936448,536936452,512,516,536871424,536871428,66048,66052,536936960,536936964],X=[0,1,1048576,1048577,67108864,67108865,68157440,68157441,256,257,1048832,1048833,67109120,67109121,68157696,68157697],Q=[0,8,2048,2056,16777216,16777224,16779264,16779272,0,8,2048,2056,16777216,16777224,16779264,16779272],Y=[0,2097152,134217728,136314880,8192,2105344,134225920,136323072,131072,2228224,134348800,136445952,139264,2236416,134356992,136454144],G=[0,262144,16,262160,0,262144,16,262160,4096,266240,4112,266256,4096,266240,4112,266256],W=[0,1024,32,1056,0,1024,32,1056,33554432,33555456,33554464,33555488,33554432,33555456,33554464,33555488],U=[0,268435456,524288,268959744,2,268435458,524290,268959746,0,268435456,524288,268959744,2,268435458,524290,268959746],M=[0,65536,2048,67584,536870912,536936448,536872960,536938496,131072,196608,133120,198656,537001984,537067520,537004032,537069568],O=[0,262144,0,262144,2,262146,2,262146,33554432,33816576,33554432,33816576,33554434,33816578,33554434,33816578],V=[0,268435456,8,268435464,0,268435456,8,268435464,1024,268436480,1032,268436488,1024,268436480,1032,268436488],H=[0,32,0,32,1048576,1048608,1048576,1048608,8192,8224,8192,8224,1056768,1056800,1056768,1056800],q=[0,16777216,512,16777728,2097152,18874368,2097664,18874880,67108864,83886080,67109376,83886592,69206016,85983232,69206528,85983744],F=[0,4096,134217728,134221824,524288,528384,134742016,134746112,16,4112,134217744,134221840,524304,528400,134742032,134746128],K=[0,4,256,260,0,4,256,260,1,5,257,261,1,5,257,261],A=$.length()>8?3:1,L=[],R=[0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0],I=0,T;for(var C=0;C<A;C++){var w=$.getInt32(),P=$.getInt32();T=(w>>>4^P)&252645135,P^=T,w^=T<<4,T=(P>>>-16^w)&65535,w^=T,P^=T<<-16,T=(w>>>2^P)&858993459,P^=T,w^=T<<2,T=(P>>>-16^w)&65535,w^=T,P^=T<<-16,T=(w>>>1^P)&1431655765,P^=T,w^=T<<1,T=(P>>>8^w)&16711935,w^=T,P^=T<<8,T=(w>>>1^P)&1431655765,P^=T,w^=T<<1,T=w<<8|P>>>20&240,w=P<<24|P<<8&16711680|P>>>8&65280|P>>>24&240,P=T;for(var l=0;l<R.length;++l){if(R[l])w=w<<2|w>>>26,P=P<<2|P>>>26;else w=w<<1|w>>>27,P=P<<1|P>>>27;w&=-15,P&=-15;var k=J[w>>>28]|X[w>>>24&15]|Q[w>>>20&15]|Y[w>>>16&15]|G[w>>>12&15]|W[w>>>8&15]|U[w>>>4&15],p=M[P>>>28]|O[P>>>24&15]|V[P>>>20&15]|H[P>>>16&15]|q[P>>>12&15]|F[P>>>8&15]|K[P>>>4&15];T=(p>>>16^k)&65535,L[I++]=k^T,L[I++]=p^T<<16}}return L}function gG($,J,X,Q){var Y=$.length===32?3:9,G;if(Y===3)G=Q?[30,-2,-2]:[0,32,2];else G=Q?[94,62,-2,32,64,2,30,-2,-2]:[0,32,2,62,30,-2,64,96,2];var W,U=J[0],M=J[1];W=(U>>>4^M)&252645135,M^=W,U^=W<<4,W=(U>>>16^M)&65535,M^=W,U^=W<<16,W=(M>>>2^U)&858993459,U^=W,M^=W<<2,W=(M>>>8^U)&16711935,U^=W,M^=W<<8,W=(U>>>1^M)&1431655765,M^=W,U^=W<<1,U=U<<1|U>>>31,M=M<<1|M>>>31;for(var O=0;O<Y;O+=3){var V=G[O+1],H=G[O+2];for(var q=G[O];q!=V;q+=H){var F=M^$[q],K=(M>>>4|M<<28)^$[q+1];W=U,U=M,M=W^(GM[F>>>24&63]|UM[F>>>16&63]|OM[F>>>8&63]|HM[F&63]|YM[K>>>24&63]|WM[K>>>16&63]|MM[K>>>8&63]|VM[K&63])}W=U,U=M,M=W}U=U>>>1|U<<31,M=M>>>1|M<<31,W=(U>>>1^M)&1431655765,M^=W,U^=W<<1,W=(M>>>8^U)&16711935,U^=W,M^=W<<8,W=(M>>>2^U)&858993459,U^=W,M^=W<<2,W=(U>>>16^M)&65535,M^=W,U^=W<<16,W=(U>>>4^M)&252645135,M^=W,U^=W<<4,X[0]=U,X[1]=M}function TY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="DES-"+J,Q;if($.decrypt)Q=i$.cipher.createDecipher(X,$.key);else Q=i$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var U=null;if(W instanceof i$.util.ByteBuffer)U=W,W={};W=W||{},W.output=U,W.iv=G,Y.call(Q,W)},Q}});var SY=O$((MF,lG)=>{var AJ=z$();TQ();eJ();w$();var KM=AJ.pkcs5=AJ.pkcs5||{},N0;if(AJ.util.isNodejs&&!AJ.options.usePureJavaScript)N0=OX("crypto");lG.exports=AJ.pbkdf2=KM.pbkdf2=function($,J,X,Q,Y,G){if(typeof Y==="function")G=Y,Y=null;if(AJ.util.isNodejs&&!AJ.options.usePureJavaScript&&N0.pbkdf2&&(Y===null||typeof Y!=="object")&&(N0.pbkdf2Sync.length>4||(!Y||Y==="sha1"))){if(typeof Y!=="string")Y="sha1";if($=Buffer.from($,"binary"),J=Buffer.from(J,"binary"),!G){if(N0.pbkdf2Sync.length===4)return N0.pbkdf2Sync($,J,X,Q).toString("binary");return N0.pbkdf2Sync($,J,X,Q,Y).toString("binary")}if(N0.pbkdf2Sync.length===4)return N0.pbkdf2($,J,X,Q,function(T,C){if(T)return G(T);G(null,C.toString("binary"))});return N0.pbkdf2($,J,X,Q,Y,function(T,C){if(T)return G(T);G(null,C.toString("binary"))})}if(typeof Y>"u"||Y===null)Y="sha1";if(typeof Y==="string"){if(!(Y in AJ.md.algorithms))throw Error("Unknown hash algorithm: "+Y);Y=AJ.md[Y].create()}var W=Y.digestLength;if(Q>4294967295*W){var U=Error("Derived key is too long.");if(G)return G(U);throw U}var M=Math.ceil(Q/W),O=Q-(M-1)*W,V=AJ.hmac.create();V.start(Y,$);var H="",q,F,K;if(!G){for(var A=1;A<=M;++A){V.start(null,null),V.update(J),V.update(AJ.util.int32ToBytes(A)),q=K=V.digest().getBytes();for(var L=2;L<=X;++L)V.start(null,null),V.update(K),F=V.digest().getBytes(),q=AJ.util.xorBytes(q,F,W),K=F;H+=A<M?q:q.substr(0,O)}return H}var A=1,L;function R(){if(A>M)return G(null,H);V.start(null,null),V.update(J),V.update(AJ.util.int32ToBytes(A)),q=K=V.digest().getBytes(),L=2,I()}function I(){if(L<=X)return V.start(null,null),V.update(K),F=V.digest().getBytes(),q=AJ.util.xorBytes(q,F,W),K=F,++L,AJ.util.setImmediate(I);H+=A<M?q:q.substr(0,O),++A,R()}R()}});var Q8=O$((OF,iG)=>{var Q0=z$();eJ();w$();var dG=iG.exports=Q0.sha256=Q0.sha256||{};Q0.md.sha256=Q0.md.algorithms.sha256=dG;dG.create=function(){if(!cG)zM();var $=null,J=Q0.util.createBuffer(),X=Array(64),Q={algorithm:"sha256",blockLength:64,digestLength:32,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=Q0.util.createBuffer(),$={h0:1779033703,h1:3144134277,h2:1013904242,h3:2773480762,h4:1359893119,h5:2600822924,h6:528734635,h7:1541459225},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=Q0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),pG($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=Q0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(J8.substr(0,Q.blockLength-W));var U,M,O=Q.fullMessageLength[0]*8;for(var V=0;V<Q.fullMessageLength.length-1;++V)U=Q.fullMessageLength[V+1]*8,M=U/4294967296>>>0,O+=M,Y.putInt32(O>>>0),O=U>>>0;Y.putInt32(O);var H={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4,h5:$.h5,h6:$.h6,h7:$.h7};pG(H,X,Y);var q=Q0.util.createBuffer();return q.putInt32(H.h0),q.putInt32(H.h1),q.putInt32(H.h2),q.putInt32(H.h3),q.putInt32(H.h4),q.putInt32(H.h5),q.putInt32(H.h6),q.putInt32(H.h7),q},Q};var J8=null,cG=!1,nG=null;function zM(){J8=String.fromCharCode(128),J8+=Q0.util.fillString(String.fromCharCode(0),64),nG=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],cG=!0}function pG($,J,X){var Q,Y,G,W,U,M,O,V,H,q,F,K,A,L,R,I=X.length();while(I>=64){for(O=0;O<16;++O)J[O]=X.getInt32();for(;O<64;++O)Q=J[O-2],Q=(Q>>>17|Q<<15)^(Q>>>19|Q<<13)^Q>>>10,Y=J[O-15],Y=(Y>>>7|Y<<25)^(Y>>>18|Y<<14)^Y>>>3,J[O]=Q+J[O-7]+Y+J[O-16]|0;V=$.h0,H=$.h1,q=$.h2,F=$.h3,K=$.h4,A=$.h5,L=$.h6,R=$.h7;for(O=0;O<64;++O)W=(K>>>6|K<<26)^(K>>>11|K<<21)^(K>>>25|K<<7),U=L^K&(A^L),G=(V>>>2|V<<30)^(V>>>13|V<<19)^(V>>>22|V<<10),M=V&H|q&(V^H),Q=R+W+U+nG[O]+J[O],Y=G+M,R=L,L=A,A=K,K=F+Q>>>0,F=q,q=H,H=V,V=Q+Y>>>0;$.h0=$.h0+V|0,$.h1=$.h1+H|0,$.h2=$.h2+q|0,$.h3=$.h3+F|0,$.h4=$.h4+K|0,$.h5=$.h5+A|0,$.h6=$.h6+L|0,$.h7=$.h7+R|0,I-=64}}});var X8=O$((VF,oG)=>{var X0=z$();w$();var IY=null;if(X0.util.isNodejs&&!X0.options.usePureJavaScript&&!process.versions["node-webkit"])IY=OX("crypto");var EM=oG.exports=X0.prng=X0.prng||{};EM.create=function($){var J={plugin:$,key:null,seed:null,time:null,reseeds:0,generated:0,keyBytes:""},X=$.md,Q=Array(32);for(var Y=0;Y<32;++Y)Q[Y]=X.create();J.pools=Q,J.pool=0,J.generate=function(O,V){if(!V)return J.generateSync(O);var H=J.plugin.cipher,q=J.plugin.increment,F=J.plugin.formatKey,K=J.plugin.formatSeed,A=X0.util.createBuffer();J.key=null,L();function L(R){if(R)return V(R);if(A.length()>=O)return V(null,A.getBytes(O));if(J.generated>1048575)J.key=null;if(J.key===null)return X0.util.nextTick(function(){G(L)});var I=H(J.key,J.seed);J.generated+=I.length,A.putBytes(I),J.key=F(H(J.key,q(J.seed))),J.seed=K(H(J.key,J.seed)),X0.util.setImmediate(L)}},J.generateSync=function(O){var V=J.plugin.cipher,H=J.plugin.increment,q=J.plugin.formatKey,F=J.plugin.formatSeed;J.key=null;var K=X0.util.createBuffer();while(K.length()<O){if(J.generated>1048575)J.key=null;if(J.key===null)W();var A=V(J.key,J.seed);J.generated+=A.length,K.putBytes(A),J.key=q(V(J.key,H(J.seed))),J.seed=F(V(J.key,J.seed))}return K.getBytes(O)};function G(O){if(J.pools[0].messageLength>=32)return U(),O();var V=32-J.pools[0].messageLength<<5;J.seedFile(V,function(H,q){if(H)return O(H);J.collect(q),U(),O()})}function W(){if(J.pools[0].messageLength>=32)return U();var O=32-J.pools[0].messageLength<<5;J.collect(J.seedFileSync(O)),U()}function U(){J.reseeds=J.reseeds===4294967295?0:J.reseeds+1;var O=J.plugin.md.create();O.update(J.keyBytes);var V=1;for(var H=0;H<32;++H){if(J.reseeds%V===0)O.update(J.pools[H].digest().getBytes()),J.pools[H].start();V=V<<1}J.keyBytes=O.digest().getBytes(),O.start(),O.update(J.keyBytes);var q=O.digest().getBytes();J.key=J.plugin.formatKey(J.keyBytes),J.seed=J.plugin.formatSeed(q),J.generated=0}function M(O){var V=null,H=X0.util.globalScope,q=H.crypto||H.msCrypto;if(q&&q.getRandomValues)V=function(w){return q.getRandomValues(w)};var F=X0.util.createBuffer();if(V)while(F.length()<O){var K=Math.max(1,Math.min(O-F.length(),65536)/4),A=new Uint32Array(Math.floor(K));try{V(A);for(var L=0;L<A.length;++L)F.putInt32(A[L])}catch(w){if(!(typeof QuotaExceededError<"u"&&w instanceof QuotaExceededError))throw w}}if(F.length()<O){var R,I,T,C=Math.floor(Math.random()*65536);while(F.length()<O){I=16807*(C&65535),R=16807*(C>>16),I+=(R&32767)<<16,I+=R>>15,I=(I&2147483647)+(I>>31),C=I&4294967295;for(var L=0;L<3;++L)T=C>>>(L<<3),T^=Math.floor(Math.random()*256),F.putByte(T&255)}}return F.getBytes(O)}if(IY)J.seedFile=function(O,V){IY.randomBytes(O,function(H,q){if(H)return V(H);V(null,q.toString())})},J.seedFileSync=function(O){return IY.randomBytes(O).toString()};else J.seedFile=function(O,V){try{V(null,M(O))}catch(H){V(H)}},J.seedFileSync=M;return J.collect=function(O){var V=O.length;for(var H=0;H<V;++H)J.pools[J.pool].update(O.substr(H,1)),J.pool=J.pool===31?0:J.pool+1},J.collectInt=function(O,V){var H="";for(var q=0;q<V;q+=8)H+=String.fromCharCode(O>>q&255);J.collect(H)},J.registerWorker=function(O){if(O===self)J.seedFile=function(H,q){function F(K){var A=K.data;if(A.forge&&A.forge.prng)self.removeEventListener("message",F),q(A.forge.prng.err,A.forge.prng.bytes)}self.addEventListener("message",F),self.postMessage({forge:{prng:{needed:H}}})};else{var V=function(H){var q=H.data;if(q.forge&&q.forge.prng)J.seedFile(q.forge.prng.needed,function(F,K){O.postMessage({forge:{prng:{err:F,bytes:K}}})})};O.addEventListener("message",V)}},J}});var _J=O$((HF,Y8)=>{var VJ=z$();w0();Q8();X8();w$();(function(){if(VJ.random&&VJ.random.getBytes){Y8.exports=VJ.random;return}(function($){var J={},X=[,,,,],Q=VJ.util.createBuffer();J.formatKey=function(H){var q=VJ.util.createBuffer(H);return H=[,,,,],H[0]=q.getInt32(),H[1]=q.getInt32(),H[2]=q.getInt32(),H[3]=q.getInt32(),VJ.aes._expandKey(H,!1)},J.formatSeed=function(H){var q=VJ.util.createBuffer(H);return H=[,,,,],H[0]=q.getInt32(),H[1]=q.getInt32(),H[2]=q.getInt32(),H[3]=q.getInt32(),H},J.cipher=function(H,q){return VJ.aes._updateBlock(H,q,X,!1),Q.putInt32(X[0]),Q.putInt32(X[1]),Q.putInt32(X[2]),Q.putInt32(X[3]),Q.getBytes()},J.increment=function(H){return++H[3],H},J.md=VJ.md.sha256;function Y(){var H=VJ.prng.create(J);return H.getBytes=function(q,F){return H.generate(q,F)},H.getBytesSync=function(q){return H.generate(q)},H}var G=Y(),W=null,U=VJ.util.globalScope,M=U.crypto||U.msCrypto;if(M&&M.getRandomValues)W=function(H){return M.getRandomValues(H)};if(VJ.options.usePureJavaScript||!VJ.util.isNodejs&&!W){if(typeof window>"u"||window.document===void 0);if(G.collectInt(+new Date,32),typeof navigator<"u"){var O="";for(var V in navigator)try{if(typeof navigator[V]=="string")O+=navigator[V]}catch(H){}G.collect(O),O=null}if($)$().mousemove(function(H){G.collectInt(H.clientX,16),G.collectInt(H.clientY,16)}),$().keypress(function(H){G.collectInt(H.charCode,8)})}if(!VJ.random)VJ.random=G;else for(var V in G)VJ.random[V]=G[V];VJ.random.createInstance=Y,Y8.exports=VJ.random})(typeof jQuery<"u"?jQuery:null)})()});var W8=O$((qF,rG)=>{var ZJ=z$();w$();var G8=[217,120,249,196,25,221,181,237,40,233,253,121,74,160,216,157,198,126,55,131,43,118,83,142,98,76,100,136,68,139,251,162,23,154,89,245,135,179,79,19,97,69,109,141,9,129,125,50,189,143,64,235,134,183,123,11,240,149,33,34,92,107,78,130,84,214,101,147,206,96,178,28,115,86,192,20,167,140,241,220,18,117,202,31,59,190,228,209,66,61,212,48,163,60,182,38,111,191,14,218,70,105,7,87,39,242,29,155,188,148,67,3,248,17,199,246,144,239,62,231,6,195,213,47,200,102,30,215,8,232,234,222,128,82,238,247,132,170,114,172,53,77,106,42,150,26,210,113,90,21,73,116,75,159,208,94,4,24,164,236,194,224,65,110,15,81,203,204,36,145,175,80,161,244,112,57,153,124,58,133,35,184,180,122,252,2,54,91,37,85,151,49,45,93,250,152,227,138,146,174,5,223,41,16,103,108,186,201,211,0,230,207,225,158,168,44,99,22,1,63,88,226,137,169,13,56,52,27,171,51,255,176,187,72,12,95,185,177,205,46,197,243,219,71,229,165,156,119,10,166,32,104,254,127,193,173],aG=[1,2,3,5],FM=function($,J){return $<<J&65535|($&65535)>>16-J},NM=function($,J){return($&65535)>>J|$<<16-J&65535};rG.exports=ZJ.rc2=ZJ.rc2||{};ZJ.rc2.expandKey=function($,J){if(typeof $==="string")$=ZJ.util.createBuffer($);J=J||128;var X=$,Q=$.length(),Y=J,G=Math.ceil(Y/8),W=255>>(Y&7),U;for(U=Q;U<128;U++)X.putByte(G8[X.at(U-1)+X.at(U-Q)&255]);X.setAt(128-G,G8[X.at(128-G)&W]);for(U=127-G;U>=0;U--)X.setAt(U,G8[X.at(U+1)^X.at(U+G)]);return X};var sG=function($,J,X){var Q=!1,Y=null,G=null,W=null,U,M,O,V,H=[];$=ZJ.rc2.expandKey($,J);for(O=0;O<64;O++)H.push($.getInt16Le());if(X)U=function(K){for(O=0;O<4;O++)K[O]+=H[V]+(K[(O+3)%4]&K[(O+2)%4])+(~K[(O+3)%4]&K[(O+1)%4]),K[O]=FM(K[O],aG[O]),V++},M=function(K){for(O=0;O<4;O++)K[O]+=H[K[(O+3)%4]&63]};else U=function(K){for(O=3;O>=0;O--)K[O]=NM(K[O],aG[O]),K[O]-=H[V]+(K[(O+3)%4]&K[(O+2)%4])+(~K[(O+3)%4]&K[(O+1)%4]),V--},M=function(K){for(O=3;O>=0;O--)K[O]-=H[K[(O+3)%4]&63]};var q=function(K){var A=[];for(O=0;O<4;O++){var L=Y.getInt16Le();if(W!==null)if(X)L^=W.getInt16Le();else W.putInt16Le(L);A.push(L&65535)}V=X?0:63;for(var R=0;R<K.length;R++)for(var I=0;I<K[R][0];I++)K[R][1](A);for(O=0;O<4;O++){if(W!==null)if(X)W.putInt16Le(A[O]);else A[O]^=W.getInt16Le();G.putInt16Le(A[O])}},F=null;return F={start:function(K,A){if(K){if(typeof K==="string")K=ZJ.util.createBuffer(K)}Q=!1,Y=ZJ.util.createBuffer(),G=A||new ZJ.util.createBuffer,W=K,F.output=G},update:function(K){if(!Q)Y.putBuffer(K);while(Y.length()>=8)q([[5,U],[1,M],[6,U],[1,M],[5,U]])},finish:function(K){var A=!0;if(X)if(K)A=K(8,Y,!X);else{var L=Y.length()===8?8:8-Y.length();Y.fillWithByte(L,L)}if(A)Q=!0,F.update();if(!X){if(A=Y.length()===0,A)if(K)A=K(8,G,!X);else{var R=G.length(),I=G.at(R-1);if(I>R)A=!1;else G.truncate(I)}}return A}},F};ZJ.rc2.startEncrypting=function($,J,X){var Q=ZJ.rc2.createEncryptionCipher($,128);return Q.start(J,X),Q};ZJ.rc2.createEncryptionCipher=function($,J){return sG($,J,!0)};ZJ.rc2.startDecrypting=function($,J,X){var Q=ZJ.rc2.createDecryptionCipher($,128);return Q.start(J,X),Q};ZJ.rc2.createDecryptionCipher=function($,J){return sG($,J,!1)}});var DX=O$((KF,G1)=>{var U8=z$();G1.exports=U8.jsbn=U8.jsbn||{};var L0,LM=244837814094590,tG=(LM&16777215)==15715070;function f($,J,X){if(this.data=[],$!=null)if(typeof $=="number")this.fromNumber($,J,X);else if(J==null&&typeof $!="string")this.fromString($,256);else this.fromString($,J)}U8.jsbn.BigInteger=f;function I$(){return new f(null)}function AM($,J,X,Q,Y,G){while(--G>=0){var W=J*this.data[$++]+X.data[Q]+Y;Y=Math.floor(W/67108864),X.data[Q++]=W&67108863}return Y}function RM($,J,X,Q,Y,G){var W=J&32767,U=J>>15;while(--G>=0){var M=this.data[$]&32767,O=this.data[$++]>>15,V=U*M+O*W;M=W*M+((V&32767)<<15)+X.data[Q]+(Y&1073741823),Y=(M>>>30)+(V>>>15)+U*O+(Y>>>30),X.data[Q++]=M&1073741823}return Y}function eG($,J,X,Q,Y,G){var W=J&16383,U=J>>14;while(--G>=0){var M=this.data[$]&16383,O=this.data[$++]>>14,V=U*M+O*W;M=W*M+((V&16383)<<14)+X.data[Q]+Y,Y=(M>>28)+(V>>14)+U*O,X.data[Q++]=M&268435455}return Y}if(typeof navigator>"u")f.prototype.am=eG,L0=28;else if(tG&&navigator.appName=="Microsoft Internet Explorer")f.prototype.am=RM,L0=30;else if(tG&&navigator.appName!="Netscape")f.prototype.am=AM,L0=26;else f.prototype.am=eG,L0=28;f.prototype.DB=L0;f.prototype.DM=(1<<L0)-1;f.prototype.DV=1<<L0;var M8=52;f.prototype.FV=Math.pow(2,M8);f.prototype.F1=M8-L0;f.prototype.F2=2*L0-M8;var DM="0123456789abcdefghijklmnopqrstuvwxyz",CY=[],IQ,xJ;IQ=48;for(xJ=0;xJ<=9;++xJ)CY[IQ++]=xJ;IQ=97;for(xJ=10;xJ<36;++xJ)CY[IQ++]=xJ;IQ=65;for(xJ=10;xJ<36;++xJ)CY[IQ++]=xJ;function $1($){return DM.charAt($)}function J1($,J){var X=CY[$.charCodeAt(J)];return X==null?-1:X}function ZM($){for(var J=this.t-1;J>=0;--J)$.data[J]=this.data[J];$.t=this.t,$.s=this.s}function BM($){if(this.t=1,this.s=$<0?-1:0,$>0)this.data[0]=$;else if($<-1)this.data[0]=$+this.DV;else this.t=0}function _0($){var J=I$();return J.fromInt($),J}function jM($,J){var X;if(J==16)X=4;else if(J==8)X=3;else if(J==256)X=8;else if(J==2)X=1;else if(J==32)X=5;else if(J==4)X=2;else{this.fromRadix($,J);return}this.t=0,this.s=0;var Q=$.length,Y=!1,G=0;while(--Q>=0){var W=X==8?$[Q]&255:J1($,Q);if(W<0){if($.charAt(Q)=="-")Y=!0;continue}if(Y=!1,G==0)this.data[this.t++]=W;else if(G+X>this.DB)this.data[this.t-1]|=(W&(1<<this.DB-G)-1)<<G,this.data[this.t++]=W>>this.DB-G;else this.data[this.t-1]|=W<<G;if(G+=X,G>=this.DB)G-=this.DB}if(X==8&&($[0]&128)!=0){if(this.s=-1,G>0)this.data[this.t-1]|=(1<<this.DB-G)-1<<G}if(this.clamp(),Y)f.ZERO.subTo(this,this)}function TM(){var $=this.s&this.DM;while(this.t>0&&this.data[this.t-1]==$)--this.t}function SM($){if(this.s<0)return"-"+this.negate().toString($);var J;if($==16)J=4;else if($==8)J=3;else if($==2)J=1;else if($==32)J=5;else if($==4)J=2;else return this.toRadix($);var X=(1<<J)-1,Q,Y=!1,G="",W=this.t,U=this.DB-W*this.DB%J;if(W-- >0){if(U<this.DB&&(Q=this.data[W]>>U)>0)Y=!0,G=$1(Q);while(W>=0){if(U<J)Q=(this.data[W]&(1<<U)-1)<<J-U,Q|=this.data[--W]>>(U+=this.DB-J);else if(Q=this.data[W]>>(U-=J)&X,U<=0)U+=this.DB,--W;if(Q>0)Y=!0;if(Y)G+=$1(Q)}}return Y?G:"0"}function IM(){var $=I$();return f.ZERO.subTo(this,$),$}function CM(){return this.s<0?this.negate():this}function wM($){var J=this.s-$.s;if(J!=0)return J;var X=this.t;if(J=X-$.t,J!=0)return this.s<0?-J:J;while(--X>=0)if((J=this.data[X]-$.data[X])!=0)return J;return 0}function wY($){var J=1,X;if((X=$>>>16)!=0)$=X,J+=16;if((X=$>>8)!=0)$=X,J+=8;if((X=$>>4)!=0)$=X,J+=4;if((X=$>>2)!=0)$=X,J+=2;if((X=$>>1)!=0)$=X,J+=1;return J}function PM(){if(this.t<=0)return 0;return this.DB*(this.t-1)+wY(this.data[this.t-1]^this.s&this.DM)}function _M($,J){var X;for(X=this.t-1;X>=0;--X)J.data[X+$]=this.data[X];for(X=$-1;X>=0;--X)J.data[X]=0;J.t=this.t+$,J.s=this.s}function xM($,J){for(var X=$;X<this.t;++X)J.data[X-$]=this.data[X];J.t=Math.max(this.t-$,0),J.s=this.s}function vM($,J){var X=$%this.DB,Q=this.DB-X,Y=(1<<Q)-1,G=Math.floor($/this.DB),W=this.s<<X&this.DM,U;for(U=this.t-1;U>=0;--U)J.data[U+G+1]=this.data[U]>>Q|W,W=(this.data[U]&Y)<<X;for(U=G-1;U>=0;--U)J.data[U]=0;J.data[G]=W,J.t=this.t+G+1,J.s=this.s,J.clamp()}function kM($,J){J.s=this.s;var X=Math.floor($/this.DB);if(X>=this.t){J.t=0;return}var Q=$%this.DB,Y=this.DB-Q,G=(1<<Q)-1;J.data[0]=this.data[X]>>Q;for(var W=X+1;W<this.t;++W)J.data[W-X-1]|=(this.data[W]&G)<<Y,J.data[W-X]=this.data[W]>>Q;if(Q>0)J.data[this.t-X-1]|=(this.s&G)<<Y;J.t=this.t-X,J.clamp()}function fM($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]-$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q-=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q-=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q-=$.s}if(J.s=Q<0?-1:0,Q<-1)J.data[X++]=this.DV+Q;else if(Q>0)J.data[X++]=Q;J.t=X,J.clamp()}function yM($,J){var X=this.abs(),Q=$.abs(),Y=X.t;J.t=Y+Q.t;while(--Y>=0)J.data[Y]=0;for(Y=0;Y<Q.t;++Y)J.data[Y+X.t]=X.am(0,Q.data[Y],J,Y,0,X.t);if(J.s=0,J.clamp(),this.s!=$.s)f.ZERO.subTo(J,J)}function bM($){var J=this.abs(),X=$.t=2*J.t;while(--X>=0)$.data[X]=0;for(X=0;X<J.t-1;++X){var Q=J.am(X,J.data[X],$,2*X,0,1);if(($.data[X+J.t]+=J.am(X+1,2*J.data[X],$,2*X+1,Q,J.t-X-1))>=J.DV)$.data[X+J.t]-=J.DV,$.data[X+J.t+1]=1}if($.t>0)$.data[$.t-1]+=J.am(X,J.data[X],$,2*X,0,1);$.s=0,$.clamp()}function hM($,J,X){var Q=$.abs();if(Q.t<=0)return;var Y=this.abs();if(Y.t<Q.t){if(J!=null)J.fromInt(0);if(X!=null)this.copyTo(X);return}if(X==null)X=I$();var G=I$(),W=this.s,U=$.s,M=this.DB-wY(Q.data[Q.t-1]);if(M>0)Q.lShiftTo(M,G),Y.lShiftTo(M,X);else Q.copyTo(G),Y.copyTo(X);var O=G.t,V=G.data[O-1];if(V==0)return;var H=V*(1<<this.F1)+(O>1?G.data[O-2]>>this.F2:0),q=this.FV/H,F=(1<<this.F1)/H,K=1<<this.F2,A=X.t,L=A-O,R=J==null?I$():J;if(G.dlShiftTo(L,R),X.compareTo(R)>=0)X.data[X.t++]=1,X.subTo(R,X);f.ONE.dlShiftTo(O,R),R.subTo(G,G);while(G.t<O)G.data[G.t++]=0;while(--L>=0){var I=X.data[--A]==V?this.DM:Math.floor(X.data[A]*q+(X.data[A-1]+K)*F);if((X.data[A]+=G.am(0,I,X,L,0,O))<I){G.dlShiftTo(L,R),X.subTo(R,X);while(X.data[A]<--I)X.subTo(R,X)}}if(J!=null){if(X.drShiftTo(O,J),W!=U)f.ZERO.subTo(J,J)}if(X.t=O,X.clamp(),M>0)X.rShiftTo(M,X);if(W<0)f.ZERO.subTo(X,X)}function uM($){var J=I$();if(this.abs().divRemTo($,null,J),this.s<0&&J.compareTo(f.ZERO)>0)$.subTo(J,J);return J}function QQ($){this.m=$}function gM($){if($.s<0||$.compareTo(this.m)>=0)return $.mod(this.m);else return $}function mM($){return $}function lM($){$.divRemTo(this.m,null,$)}function pM($,J,X){$.multiplyTo(J,X),this.reduce(X)}function dM($,J){$.squareTo(J),this.reduce(J)}QQ.prototype.convert=gM;QQ.prototype.revert=mM;QQ.prototype.reduce=lM;QQ.prototype.mulTo=pM;QQ.prototype.sqrTo=dM;function cM(){if(this.t<1)return 0;var $=this.data[0];if(($&1)==0)return 0;var J=$&3;return J=J*(2-($&15)*J)&15,J=J*(2-($&255)*J)&255,J=J*(2-(($&65535)*J&65535))&65535,J=J*(2-$*J%this.DV)%this.DV,J>0?this.DV-J:-J}function XQ($){this.m=$,this.mp=$.invDigit(),this.mpl=this.mp&32767,this.mph=this.mp>>15,this.um=(1<<$.DB-15)-1,this.mt2=2*$.t}function nM($){var J=I$();if($.abs().dlShiftTo(this.m.t,J),J.divRemTo(this.m,null,J),$.s<0&&J.compareTo(f.ZERO)>0)this.m.subTo(J,J);return J}function iM($){var J=I$();return $.copyTo(J),this.reduce(J),J}function oM($){while($.t<=this.mt2)$.data[$.t++]=0;for(var J=0;J<this.m.t;++J){var X=$.data[J]&32767,Q=X*this.mpl+((X*this.mph+($.data[J]>>15)*this.mpl&this.um)<<15)&$.DM;X=J+this.m.t,$.data[X]+=this.m.am(0,Q,$,J,0,this.m.t);while($.data[X]>=$.DV)$.data[X]-=$.DV,$.data[++X]++}if($.clamp(),$.drShiftTo(this.m.t,$),$.compareTo(this.m)>=0)$.subTo(this.m,$)}function aM($,J){$.squareTo(J),this.reduce(J)}function sM($,J,X){$.multiplyTo(J,X),this.reduce(X)}XQ.prototype.convert=nM;XQ.prototype.revert=iM;XQ.prototype.reduce=oM;XQ.prototype.mulTo=sM;XQ.prototype.sqrTo=aM;function rM(){return(this.t>0?this.data[0]&1:this.s)==0}function tM($,J){if($>4294967295||$<1)return f.ONE;var X=I$(),Q=I$(),Y=J.convert(this),G=wY($)-1;Y.copyTo(X);while(--G>=0)if(J.sqrTo(X,Q),($&1<<G)>0)J.mulTo(Q,Y,X);else{var W=X;X=Q,Q=W}return J.revert(X)}function eM($,J){var X;if($<256||J.isEven())X=new QQ(J);else X=new XQ(J);return this.exp($,X)}f.prototype.copyTo=ZM;f.prototype.fromInt=BM;f.prototype.fromString=jM;f.prototype.clamp=TM;f.prototype.dlShiftTo=_M;f.prototype.drShiftTo=xM;f.prototype.lShiftTo=vM;f.prototype.rShiftTo=kM;f.prototype.subTo=fM;f.prototype.multiplyTo=yM;f.prototype.squareTo=bM;f.prototype.divRemTo=hM;f.prototype.invDigit=cM;f.prototype.isEven=rM;f.prototype.exp=tM;f.prototype.toString=SM;f.prototype.negate=IM;f.prototype.abs=CM;f.prototype.compareTo=wM;f.prototype.bitLength=PM;f.prototype.mod=uM;f.prototype.modPowInt=eM;f.ZERO=_0(0);f.ONE=_0(1);function $O(){var $=I$();return this.copyTo($),$}function JO(){if(this.s<0){if(this.t==1)return this.data[0]-this.DV;else if(this.t==0)return-1}else if(this.t==1)return this.data[0];else if(this.t==0)return 0;return(this.data[1]&(1<<32-this.DB)-1)<<this.DB|this.data[0]}function QO(){return this.t==0?this.s:this.data[0]<<24>>24}function XO(){return this.t==0?this.s:this.data[0]<<16>>16}function YO($){return Math.floor(Math.LN2*this.DB/Math.log($))}function GO(){if(this.s<0)return-1;else if(this.t<=0||this.t==1&&this.data[0]<=0)return 0;else return 1}function WO($){if($==null)$=10;if(this.signum()==0||$<2||$>36)return"0";var J=this.chunkSize($),X=Math.pow($,J),Q=_0(X),Y=I$(),G=I$(),W="";this.divRemTo(Q,Y,G);while(Y.signum()>0)W=(X+G.intValue()).toString($).substr(1)+W,Y.divRemTo(Q,Y,G);return G.intValue().toString($)+W}function UO($,J){if(this.fromInt(0),J==null)J=10;var X=this.chunkSize(J),Q=Math.pow(J,X),Y=!1,G=0,W=0;for(var U=0;U<$.length;++U){var M=J1($,U);if(M<0){if($.charAt(U)=="-"&&this.signum()==0)Y=!0;continue}if(W=J*W+M,++G>=X)this.dMultiply(Q),this.dAddOffset(W,0),G=0,W=0}if(G>0)this.dMultiply(Math.pow(J,G)),this.dAddOffset(W,0);if(Y)f.ZERO.subTo(this,this)}function MO($,J,X){if(typeof J=="number")if($<2)this.fromInt(1);else{if(this.fromNumber($,X),!this.testBit($-1))this.bitwiseTo(f.ONE.shiftLeft($-1),O8,this);if(this.isEven())this.dAddOffset(1,0);while(!this.isProbablePrime(J))if(this.dAddOffset(2,0),this.bitLength()>$)this.subTo(f.ONE.shiftLeft($-1),this)}else{var Q=[],Y=$&7;if(Q.length=($>>3)+1,J.nextBytes(Q),Y>0)Q[0]&=(1<<Y)-1;else Q[0]=0;this.fromString(Q,256)}}function OO(){var $=this.t,J=[];J[0]=this.s;var X=this.DB-$*this.DB%8,Q,Y=0;if($-- >0){if(X<this.DB&&(Q=this.data[$]>>X)!=(this.s&this.DM)>>X)J[Y++]=Q|this.s<<this.DB-X;while($>=0){if(X<8)Q=(this.data[$]&(1<<X)-1)<<8-X,Q|=this.data[--$]>>(X+=this.DB-8);else if(Q=this.data[$]>>(X-=8)&255,X<=0)X+=this.DB,--$;if((Q&128)!=0)Q|=-256;if(Y==0&&(this.s&128)!=(Q&128))++Y;if(Y>0||Q!=this.s)J[Y++]=Q}}return J}function VO($){return this.compareTo($)==0}function HO($){return this.compareTo($)<0?this:$}function qO($){return this.compareTo($)>0?this:$}function KO($,J,X){var Q,Y,G=Math.min($.t,this.t);for(Q=0;Q<G;++Q)X.data[Q]=J(this.data[Q],$.data[Q]);if($.t<this.t){Y=$.s&this.DM;for(Q=G;Q<this.t;++Q)X.data[Q]=J(this.data[Q],Y);X.t=this.t}else{Y=this.s&this.DM;for(Q=G;Q<$.t;++Q)X.data[Q]=J(Y,$.data[Q]);X.t=$.t}X.s=J(this.s,$.s),X.clamp()}function zO($,J){return $&J}function EO($){var J=I$();return this.bitwiseTo($,zO,J),J}function O8($,J){return $|J}function FO($){var J=I$();return this.bitwiseTo($,O8,J),J}function Q1($,J){return $^J}function NO($){var J=I$();return this.bitwiseTo($,Q1,J),J}function X1($,J){return $&~J}function LO($){var J=I$();return this.bitwiseTo($,X1,J),J}function AO(){var $=I$();for(var J=0;J<this.t;++J)$.data[J]=this.DM&~this.data[J];return $.t=this.t,$.s=~this.s,$}function RO($){var J=I$();if($<0)this.rShiftTo(-$,J);else this.lShiftTo($,J);return J}function DO($){var J=I$();if($<0)this.lShiftTo(-$,J);else this.rShiftTo($,J);return J}function ZO($){if($==0)return-1;var J=0;if(($&65535)==0)$>>=16,J+=16;if(($&255)==0)$>>=8,J+=8;if(($&15)==0)$>>=4,J+=4;if(($&3)==0)$>>=2,J+=2;if(($&1)==0)++J;return J}function BO(){for(var $=0;$<this.t;++$)if(this.data[$]!=0)return $*this.DB+ZO(this.data[$]);if(this.s<0)return this.t*this.DB;return-1}function jO($){var J=0;while($!=0)$&=$-1,++J;return J}function TO(){var $=0,J=this.s&this.DM;for(var X=0;X<this.t;++X)$+=jO(this.data[X]^J);return $}function SO($){var J=Math.floor($/this.DB);if(J>=this.t)return this.s!=0;return(this.data[J]&1<<$%this.DB)!=0}function IO($,J){var X=f.ONE.shiftLeft($);return this.bitwiseTo(X,J,X),X}function CO($){return this.changeBit($,O8)}function wO($){return this.changeBit($,X1)}function PO($){return this.changeBit($,Q1)}function _O($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]+$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q+=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q+=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=$.s}if(J.s=Q<0?-1:0,Q>0)J.data[X++]=Q;else if(Q<-1)J.data[X++]=this.DV+Q;J.t=X,J.clamp()}function xO($){var J=I$();return this.addTo($,J),J}function vO($){var J=I$();return this.subTo($,J),J}function kO($){var J=I$();return this.multiplyTo($,J),J}function fO(){var $=I$();return this.squareTo($),$}function yO($){var J=I$();return this.divRemTo($,J,null),J}function bO($){var J=I$();return this.divRemTo($,null,J),J}function hO($){var J=I$(),X=I$();return this.divRemTo($,J,X),[J,X]}function uO($){this.data[this.t]=this.am(0,$-1,this,0,0,this.t),++this.t,this.clamp()}function gO($,J){if($==0)return;while(this.t<=J)this.data[this.t++]=0;this.data[J]+=$;while(this.data[J]>=this.DV){if(this.data[J]-=this.DV,++J>=this.t)this.data[this.t++]=0;++this.data[J]}}function RX(){}function Y1($){return $}function mO($,J,X){$.multiplyTo(J,X)}function lO($,J){$.squareTo(J)}RX.prototype.convert=Y1;RX.prototype.revert=Y1;RX.prototype.mulTo=mO;RX.prototype.sqrTo=lO;function pO($){return this.exp($,new RX)}function dO($,J,X){var Q=Math.min(this.t+$.t,J);X.s=0,X.t=Q;while(Q>0)X.data[--Q]=0;var Y;for(Y=X.t-this.t;Q<Y;++Q)X.data[Q+this.t]=this.am(0,$.data[Q],X,Q,0,this.t);for(Y=Math.min($.t,J);Q<Y;++Q)this.am(0,$.data[Q],X,Q,0,J-Q);X.clamp()}function cO($,J,X){--J;var Q=X.t=this.t+$.t-J;X.s=0;while(--Q>=0)X.data[Q]=0;for(Q=Math.max(J-this.t,0);Q<$.t;++Q)X.data[this.t+Q-J]=this.am(J-Q,$.data[Q],X,0,0,this.t+Q-J);X.clamp(),X.drShiftTo(1,X)}function CQ($){this.r2=I$(),this.q3=I$(),f.ONE.dlShiftTo(2*$.t,this.r2),this.mu=this.r2.divide($),this.m=$}function nO($){if($.s<0||$.t>2*this.m.t)return $.mod(this.m);else if($.compareTo(this.m)<0)return $;else{var J=I$();return $.copyTo(J),this.reduce(J),J}}function iO($){return $}function oO($){if($.drShiftTo(this.m.t-1,this.r2),$.t>this.m.t+1)$.t=this.m.t+1,$.clamp();this.mu.multiplyUpperTo(this.r2,this.m.t+1,this.q3),this.m.multiplyLowerTo(this.q3,this.m.t+1,this.r2);while($.compareTo(this.r2)<0)$.dAddOffset(1,this.m.t+1);$.subTo(this.r2,$);while($.compareTo(this.m)>=0)$.subTo(this.m,$)}function aO($,J){$.squareTo(J),this.reduce(J)}function sO($,J,X){$.multiplyTo(J,X),this.reduce(X)}CQ.prototype.convert=nO;CQ.prototype.revert=iO;CQ.prototype.reduce=oO;CQ.prototype.mulTo=sO;CQ.prototype.sqrTo=aO;function rO($,J){var X=$.bitLength(),Q,Y=_0(1),G;if(X<=0)return Y;else if(X<18)Q=1;else if(X<48)Q=3;else if(X<144)Q=4;else if(X<768)Q=5;else Q=6;if(X<8)G=new QQ(J);else if(J.isEven())G=new CQ(J);else G=new XQ(J);var W=[],U=3,M=Q-1,O=(1<<Q)-1;if(W[1]=G.convert(this),Q>1){var V=I$();G.sqrTo(W[1],V);while(U<=O)W[U]=I$(),G.mulTo(V,W[U-2],W[U]),U+=2}var H=$.t-1,q,F=!0,K=I$(),A;X=wY($.data[H])-1;while(H>=0){if(X>=M)q=$.data[H]>>X-M&O;else if(q=($.data[H]&(1<<X+1)-1)<<M-X,H>0)q|=$.data[H-1]>>this.DB+X-M;U=Q;while((q&1)==0)q>>=1,--U;if((X-=U)<0)X+=this.DB,--H;if(F)W[q].copyTo(Y),F=!1;else{while(U>1)G.sqrTo(Y,K),G.sqrTo(K,Y),U-=2;if(U>0)G.sqrTo(Y,K);else A=Y,Y=K,K=A;G.mulTo(K,W[q],Y)}while(H>=0&&($.data[H]&1<<X)==0)if(G.sqrTo(Y,K),A=Y,Y=K,K=A,--X<0)X=this.DB-1,--H}return G.revert(Y)}function tO($){var J=this.s<0?this.negate():this.clone(),X=$.s<0?$.negate():$.clone();if(J.compareTo(X)<0){var Q=J;J=X,X=Q}var Y=J.getLowestSetBit(),G=X.getLowestSetBit();if(G<0)return J;if(Y<G)G=Y;if(G>0)J.rShiftTo(G,J),X.rShiftTo(G,X);while(J.signum()>0){if((Y=J.getLowestSetBit())>0)J.rShiftTo(Y,J);if((Y=X.getLowestSetBit())>0)X.rShiftTo(Y,X);if(J.compareTo(X)>=0)J.subTo(X,J),J.rShiftTo(1,J);else X.subTo(J,X),X.rShiftTo(1,X)}if(G>0)X.lShiftTo(G,X);return X}function eO($){if($<=0)return 0;var J=this.DV%$,X=this.s<0?$-1:0;if(this.t>0)if(J==0)X=this.data[0]%$;else for(var Q=this.t-1;Q>=0;--Q)X=(J*X+this.data[Q])%$;return X}function $V($){if(this.signum()==0)return f.ZERO;var J=$.isEven();if(this.isEven()&&J||$.signum()==0)return f.ZERO;var X=$.clone(),Q=this.clone(),Y=_0(1),G=_0(0),W=_0(0),U=_0(1);while(X.signum()!=0){while(X.isEven()){if(X.rShiftTo(1,X),J){if(!Y.isEven()||!G.isEven())Y.addTo(this,Y),G.subTo($,G);Y.rShiftTo(1,Y)}else if(!G.isEven())G.subTo($,G);G.rShiftTo(1,G)}while(Q.isEven()){if(Q.rShiftTo(1,Q),J){if(!W.isEven()||!U.isEven())W.addTo(this,W),U.subTo($,U);W.rShiftTo(1,W)}else if(!U.isEven())U.subTo($,U);U.rShiftTo(1,U)}if(X.compareTo(Q)>=0){if(X.subTo(Q,X),J)Y.subTo(W,Y);G.subTo(U,G)}else{if(Q.subTo(X,Q),J)W.subTo(Y,W);U.subTo(G,U)}}if(Q.compareTo(f.ONE)!=0)return f.ZERO;if(U.compareTo($)>=0)return U.subtract($);if(U.signum()<0)U.addTo($,U);else return U;if(U.signum()<0)return U.add($);else return U}var lJ=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997],JV=67108864/lJ[lJ.length-1];function QV($){var J,X=this.abs();if(X.t==1&&X.data[0]<=lJ[lJ.length-1]){for(J=0;J<lJ.length;++J)if(X.data[0]==lJ[J])return!0;return!1}if(X.isEven())return!1;J=1;while(J<lJ.length){var Q=lJ[J],Y=J+1;while(Y<lJ.length&&Q<JV)Q*=lJ[Y++];Q=X.modInt(Q);while(J<Y)if(Q%lJ[J++]==0)return!1}return X.millerRabin($)}function XV($){var J=this.subtract(f.ONE),X=J.getLowestSetBit();if(X<=0)return!1;var Q=J.shiftRight(X),Y=YV(),G;for(var W=0;W<$;++W){do G=new f(this.bitLength(),Y);while(G.compareTo(f.ONE)<=0||G.compareTo(J)>=0);var U=G.modPow(Q,this);if(U.compareTo(f.ONE)!=0&&U.compareTo(J)!=0){var M=1;while(M++<X&&U.compareTo(J)!=0)if(U=U.modPowInt(2,this),U.compareTo(f.ONE)==0)return!1;if(U.compareTo(J)!=0)return!1}}return!0}function YV(){return{nextBytes:function($){for(var J=0;J<$.length;++J)$[J]=Math.floor(Math.random()*256)}}}f.prototype.chunkSize=YO;f.prototype.toRadix=WO;f.prototype.fromRadix=UO;f.prototype.fromNumber=MO;f.prototype.bitwiseTo=KO;f.prototype.changeBit=IO;f.prototype.addTo=_O;f.prototype.dMultiply=uO;f.prototype.dAddOffset=gO;f.prototype.multiplyLowerTo=dO;f.prototype.multiplyUpperTo=cO;f.prototype.modInt=eO;f.prototype.millerRabin=XV;f.prototype.clone=$O;f.prototype.intValue=JO;f.prototype.byteValue=QO;f.prototype.shortValue=XO;f.prototype.signum=GO;f.prototype.toByteArray=OO;f.prototype.equals=VO;f.prototype.min=HO;f.prototype.max=qO;f.prototype.and=EO;f.prototype.or=FO;f.prototype.xor=NO;f.prototype.andNot=LO;f.prototype.not=AO;f.prototype.shiftLeft=RO;f.prototype.shiftRight=DO;f.prototype.getLowestSetBit=BO;f.prototype.bitCount=TO;f.prototype.testBit=SO;f.prototype.setBit=CO;f.prototype.clearBit=wO;f.prototype.flipBit=PO;f.prototype.add=xO;f.prototype.subtract=vO;f.prototype.multiply=kO;f.prototype.divide=yO;f.prototype.remainder=bO;f.prototype.divideAndRemainder=hO;f.prototype.modPow=rO;f.prototype.modInverse=$V;f.prototype.pow=pO;f.prototype.gcd=tO;f.prototype.isProbablePrime=QV;f.prototype.square=fO});var wQ=O$((zF,O1)=>{var Y0=z$();eJ();w$();var U1=O1.exports=Y0.sha1=Y0.sha1||{};Y0.md.sha1=Y0.md.algorithms.sha1=U1;U1.create=function(){if(!M1)GV();var $=null,J=Y0.util.createBuffer(),X=Array(80),Q={algorithm:"sha1",blockLength:64,digestLength:20,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=Y0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878,h4:3285377520},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=Y0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),W1($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=Y0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(V8.substr(0,Q.blockLength-W));var U,M,O=Q.fullMessageLength[0]*8;for(var V=0;V<Q.fullMessageLength.length-1;++V)U=Q.fullMessageLength[V+1]*8,M=U/4294967296>>>0,O+=M,Y.putInt32(O>>>0),O=U>>>0;Y.putInt32(O);var H={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4};W1(H,X,Y);var q=Y0.util.createBuffer();return q.putInt32(H.h0),q.putInt32(H.h1),q.putInt32(H.h2),q.putInt32(H.h3),q.putInt32(H.h4),q},Q};var V8=null,M1=!1;function GV(){V8=String.fromCharCode(128),V8+=Y0.util.fillString(String.fromCharCode(0),64),M1=!0}function W1($,J,X){var Q,Y,G,W,U,M,O,V,H=X.length();while(H>=64){Y=$.h0,G=$.h1,W=$.h2,U=$.h3,M=$.h4;for(V=0;V<16;++V)Q=X.getInt32(),J[V]=Q,O=U^G&(W^U),Q=(Y<<5|Y>>>27)+O+M+1518500249+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<20;++V)Q=J[V-3]^J[V-8]^J[V-14]^J[V-16],Q=Q<<1|Q>>>31,J[V]=Q,O=U^G&(W^U),Q=(Y<<5|Y>>>27)+O+M+1518500249+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<32;++V)Q=J[V-3]^J[V-8]^J[V-14]^J[V-16],Q=Q<<1|Q>>>31,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+1859775393+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<40;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+1859775393+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<60;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G&W|U&(G^W),Q=(Y<<5|Y>>>27)+O+M+2400959708+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<80;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+3395469782+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+U|0,$.h4=$.h4+M|0,H-=64}}});var H8=O$((EF,H1)=>{var G0=z$();w$();_J();wQ();var V1=H1.exports=G0.pkcs1=G0.pkcs1||{};V1.encode_rsa_oaep=function($,J,X){var Q,Y,G,W;if(typeof X==="string")Q=X,Y=arguments[3]||void 0,G=arguments[4]||void 0;else if(X){if(Q=X.label||void 0,Y=X.seed||void 0,G=X.md||void 0,X.mgf1&&X.mgf1.md)W=X.mgf1.md}if(!G)G=G0.md.sha1.create();else G.start();if(!W)W=G;var U=Math.ceil($.n.bitLength()/8),M=U-2*G.digestLength-2;if(J.length>M){var O=Error("RSAES-OAEP input message length is too long.");throw O.length=J.length,O.maxLength=M,O}if(!Q)Q="";G.update(Q,"raw");var V=G.digest(),H="",q=M-J.length;for(var F=0;F<q;F++)H+="\x00";var K=V.getBytes()+H+"\x01"+J;if(!Y)Y=G0.random.getBytes(G.digestLength);else if(Y.length!==G.digestLength){var O=Error("Invalid RSAES-OAEP seed. The seed length must match the digest length.");throw O.seedLength=Y.length,O.digestLength=G.digestLength,O}var A=PY(Y,U-G.digestLength-1,W),L=G0.util.xorBytes(K,A,K.length),R=PY(L,G.digestLength,W),I=G0.util.xorBytes(Y,R,Y.length);return"\x00"+I+L};V1.decode_rsa_oaep=function($,J,X){var Q,Y,G;if(typeof X==="string")Q=X,Y=arguments[3]||void 0;else if(X){if(Q=X.label||void 0,Y=X.md||void 0,X.mgf1&&X.mgf1.md)G=X.mgf1.md}var W=Math.ceil($.n.bitLength()/8);if(J.length!==W){var L=Error("RSAES-OAEP encoded message length is invalid.");throw L.length=J.length,L.expectedLength=W,L}if(Y===void 0)Y=G0.md.sha1.create();else Y.start();if(!G)G=Y;if(W<2*Y.digestLength+2)throw Error("RSAES-OAEP key is too short for the hash function.");if(!Q)Q="";Y.update(Q,"raw");var U=Y.digest().getBytes(),M=J.charAt(0),O=J.substring(1,Y.digestLength+1),V=J.substring(1+Y.digestLength),H=PY(V,Y.digestLength,G),q=G0.util.xorBytes(O,H,O.length),F=PY(q,W-Y.digestLength-1,G),K=G0.util.xorBytes(V,F,V.length),A=K.substring(0,Y.digestLength),L=M!=="\x00";for(var R=0;R<Y.digestLength;++R)L|=U.charAt(R)!==A.charAt(R);var I=1,T=Y.digestLength;for(var C=Y.digestLength;C<K.length;C++){var w=K.charCodeAt(C),P=w&1^1,l=I?65534:0;L|=w&l,I=I&P,T+=I}if(L||K.charCodeAt(T)!==1)throw Error("Invalid RSAES-OAEP padding.");return K.substring(T+1)};function PY($,J,X){if(!X)X=G0.md.sha1.create();var Q="",Y=Math.ceil(J/X.digestLength);for(var G=0;G<Y;++G){var W=String.fromCharCode(G>>24&255,G>>16&255,G>>8&255,G&255);X.start(),X.update($+W),Q+=X.digest().getBytes()}return Q.substring(0,J)}});var K8=O$((FF,q8)=>{var x0=z$();w$();DX();_J();(function(){if(x0.prime){q8.exports=x0.prime;return}var $=q8.exports=x0.prime=x0.prime||{},J=x0.jsbn.BigInteger,X=[6,4,2,4,2,4,6,2],Q=new J(null);Q.fromInt(30);var Y=function(H,q){return H|q};$.generateProbablePrime=function(H,q,F){if(typeof q==="function")F=q,q={};q=q||{};var K=q.algorithm||"PRIMEINC";if(typeof K==="string")K={name:K};K.options=K.options||{};var A=q.prng||x0.random,L={nextBytes:function(R){var I=A.getBytesSync(R.length);for(var T=0;T<R.length;++T)R[T]=I.charCodeAt(T)}};if(K.name==="PRIMEINC")return G(H,L,K.options,F);throw Error("Invalid prime generation algorithm: "+K.name)};function G(H,q,F,K){if("workers"in F)return M(H,q,F,K);return W(H,q,F,K)}function W(H,q,F,K){var A=O(H,q),L=0,R=V(A.bitLength());if("millerRabinTests"in F)R=F.millerRabinTests;var I=10;if("maxBlockTime"in F)I=F.maxBlockTime;U(A,H,q,L,R,I,K)}function U(H,q,F,K,A,L,R){var I=+new Date;do{if(H.bitLength()>q)H=O(q,F);if(H.isProbablePrime(A))return R(null,H);H.dAddOffset(X[K++%8],0)}while(L<0||+new Date-I<L);x0.util.setImmediate(function(){U(H,q,F,K,A,L,R)})}function M(H,q,F,K){if(typeof Worker>"u")return W(H,q,F,K);var A=O(H,q),L=F.workers,R=F.workLoad||100,I=R*30/8,T=F.workerScript||"forge/prime.worker.js";if(L===-1)return x0.util.estimateCores(function(w,P){if(w)P=2;L=P-1,C()});C();function C(){L=Math.max(1,L);var w=[];for(var P=0;P<L;++P)w[P]=new Worker(T);var l=L;for(var P=0;P<L;++P)w[P].addEventListener("message",p);var k=!1;function p($$){if(k)return;--l;var N$=$$.data;if(N$.found){for(var M$=0;M$<w.length;++M$)w[M$].terminate();return k=!0,K(null,new J(N$.prime,16))}if(A.bitLength()>H)A=O(H,q);var b$=A.toString(16);$$.target.postMessage({hex:b$,workLoad:R}),A.dAddOffset(I,0)}}}function O(H,q){var F=new J(H,q),K=H-1;if(!F.testBit(K))F.bitwiseTo(J.ONE.shiftLeft(K),Y,F);return F.dAddOffset(31-F.mod(Q).byteValue(),0),F}function V(H){if(H<=100)return 27;if(H<=150)return 18;if(H<=200)return 15;if(H<=250)return 12;if(H<=300)return 9;if(H<=350)return 8;if(H<=400)return 7;if(H<=500)return 6;if(H<=600)return 5;if(H<=800)return 4;if(H<=1250)return 3;return 2}})()});var ZX=O$((NF,L1)=>{var Q$=z$();mJ();DX();P0();H8();K8();_J();w$();if(typeof T$>"u")T$=Q$.jsbn.BigInteger;var T$,z8=Q$.util.isNodejs?OX("crypto"):null,S=Q$.asn1,vJ=Q$.util;Q$.pki=Q$.pki||{};L1.exports=Q$.pki.rsa=Q$.rsa=Q$.rsa||{};var V$=Q$.pki,WV=[6,4,2,4,2,4,6,2],UV={name:"PrivateKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]},MV={name:"RSAPrivateKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPrivateKey.version",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"RSAPrivateKey.modulus",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyModulus"},{name:"RSAPrivateKey.publicExponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPublicExponent"},{name:"RSAPrivateKey.privateExponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrivateExponent"},{name:"RSAPrivateKey.prime1",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrime1"},{name:"RSAPrivateKey.prime2",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrime2"},{name:"RSAPrivateKey.exponent1",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyExponent1"},{name:"RSAPrivateKey.exponent2",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyExponent2"},{name:"RSAPrivateKey.coefficient",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyCoefficient"}]},OV={name:"RSAPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPublicKey.modulus",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"publicKeyModulus"},{name:"RSAPublicKey.exponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"publicKeyExponent"}]},VV=Q$.pki.rsa.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{name:"SubjectPublicKeyInfo.subjectPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.BITSTRING,constructed:!1,value:[{name:"SubjectPublicKeyInfo.subjectPublicKey.RSAPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"rsaPublicKey"}]}]},HV={name:"DigestInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm.algorithmIdentifier",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"algorithmIdentifier"},{name:"DigestInfo.DigestAlgorithm.parameters",tagClass:S.Class.UNIVERSAL,type:S.Type.NULL,capture:"parameters",optional:!0,constructed:!1}]},{name:"DigestInfo.digest",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"digest"}]},qV=function($){var J;if($.algorithm in V$.oids)J=V$.oids[$.algorithm];else{var X=Error("Unknown message digest algorithm.");throw X.algorithm=$.algorithm,X}var Q=S.oidToDer(J).getBytes(),Y=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[]),G=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[]);G.value.push(S.create(S.Class.UNIVERSAL,S.Type.OID,!1,Q)),G.value.push(S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,""));var W=S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,$.digest().getBytes());return Y.value.push(G),Y.value.push(W),S.toDer(Y).getBytes()},F1=function($,J,X){if(X)return $.modPow(J.e,J.n);if(!J.p||!J.q)return $.modPow(J.d,J.n);if(!J.dP)J.dP=J.d.mod(J.p.subtract(T$.ONE));if(!J.dQ)J.dQ=J.d.mod(J.q.subtract(T$.ONE));if(!J.qInv)J.qInv=J.q.modInverse(J.p);var Q;do Q=new T$(Q$.util.bytesToHex(Q$.random.getBytes(J.n.bitLength()/8)),16);while(Q.compareTo(J.n)>=0||!Q.gcd(J.n).equals(T$.ONE));$=$.multiply(Q.modPow(J.e,J.n)).mod(J.n);var Y=$.mod(J.p).modPow(J.dP,J.p),G=$.mod(J.q).modPow(J.dQ,J.q);while(Y.compareTo(G)<0)Y=Y.add(J.p);var W=Y.subtract(G).multiply(J.qInv).mod(J.p).multiply(J.q).add(G);return W=W.multiply(Q.modInverse(J.n)).mod(J.n),W};V$.rsa.encrypt=function($,J,X){var Q=X,Y,G=Math.ceil(J.n.bitLength()/8);if(X!==!1&&X!==!0)Q=X===2,Y=N1($,J,X);else Y=Q$.util.createBuffer(),Y.putBytes($);var W=new T$(Y.toHex(),16),U=F1(W,J,Q),M=U.toString(16),O=Q$.util.createBuffer(),V=G-Math.ceil(M.length/2);while(V>0)O.putByte(0),--V;return O.putBytes(Q$.util.hexToBytes(M)),O.getBytes()};V$.rsa.decrypt=function($,J,X,Q){var Y=Math.ceil(J.n.bitLength()/8);if($.length!==Y){var G=Error("Encrypted message length is invalid.");throw G.length=$.length,G.expected=Y,G}var W=new T$(Q$.util.createBuffer($).toHex(),16);if(W.compareTo(J.n)>=0)throw Error("Encrypted message is invalid.");var U=F1(W,J,X),M=U.toString(16),O=Q$.util.createBuffer(),V=Y-Math.ceil(M.length/2);while(V>0)O.putByte(0),--V;if(O.putBytes(Q$.util.hexToBytes(M)),Q!==!1)return _Y(O.getBytes(),J,X);return O.getBytes()};V$.rsa.createKeyPairGenerationState=function($,J,X){if(typeof $==="string")$=parseInt($,10);$=$||2048,X=X||{};var Q=X.prng||Q$.random,Y={nextBytes:function(U){var M=Q.getBytesSync(U.length);for(var O=0;O<U.length;++O)U[O]=M.charCodeAt(O)}},G=X.algorithm||"PRIMEINC",W;if(G==="PRIMEINC")W={algorithm:G,state:0,bits:$,rng:Y,eInt:J||65537,e:new T$(null),p:null,q:null,qBits:$>>1,pBits:$-($>>1),pqState:0,num:null,keys:null},W.e.fromInt(W.eInt);else throw Error("Invalid key generation algorithm: "+G);return W};V$.rsa.stepKeyPairGenerationState=function($,J){if(!("algorithm"in $))$.algorithm="PRIMEINC";var X=new T$(null);X.fromInt(30);var Q=0,Y=function(H,q){return H|q},G=+new Date,W,U=0;while($.keys===null&&(J<=0||U<J)){if($.state===0){var M=$.p===null?$.pBits:$.qBits,O=M-1;if($.pqState===0){if($.num=new T$(M,$.rng),!$.num.testBit(O))$.num.bitwiseTo(T$.ONE.shiftLeft(O),Y,$.num);$.num.dAddOffset(31-$.num.mod(X).byteValue(),0),Q=0,++$.pqState}else if($.pqState===1)if($.num.bitLength()>M)$.pqState=0;else if($.num.isProbablePrime(zV($.num.bitLength())))++$.pqState;else $.num.dAddOffset(WV[Q++%8],0);else if($.pqState===2)$.pqState=$.num.subtract(T$.ONE).gcd($.e).compareTo(T$.ONE)===0?3:0;else if($.pqState===3){if($.pqState=0,$.p===null)$.p=$.num;else $.q=$.num;if($.p!==null&&$.q!==null)++$.state;$.num=null}}else if($.state===1){if($.p.compareTo($.q)<0)$.num=$.p,$.p=$.q,$.q=$.num;++$.state}else if($.state===2)$.p1=$.p.subtract(T$.ONE),$.q1=$.q.subtract(T$.ONE),$.phi=$.p1.multiply($.q1),++$.state;else if($.state===3)if($.phi.gcd($.e).compareTo(T$.ONE)===0)++$.state;else $.p=null,$.q=null,$.state=0;else if($.state===4)if($.n=$.p.multiply($.q),$.n.bitLength()===$.bits)++$.state;else $.q=null,$.state=0;else if($.state===5){var V=$.e.modInverse($.phi);$.keys={privateKey:V$.rsa.setPrivateKey($.n,$.e,V,$.p,$.q,V.mod($.p1),V.mod($.q1),$.q.modInverse($.p)),publicKey:V$.rsa.setPublicKey($.n,$.e)}}W=+new Date,U+=W-G,G=W}return $.keys!==null};V$.rsa.generateKeyPair=function($,J,X,Q){if(arguments.length===1){if(typeof $==="object")X=$,$=void 0;else if(typeof $==="function")Q=$,$=void 0}else if(arguments.length===2)if(typeof $==="number"){if(typeof J==="function")Q=J,J=void 0;else if(typeof J!=="number")X=J,J=void 0}else X=$,Q=J,$=void 0,J=void 0;else if(arguments.length===3)if(typeof J==="number"){if(typeof X==="function")Q=X,X=void 0}else Q=X,X=J,J=void 0;if(X=X||{},$===void 0)$=X.bits||2048;if(J===void 0)J=X.e||65537;if(!Q$.options.usePureJavaScript&&!X.prng&&$>=256&&$<=16384&&(J===65537||J===3)){if(Q){if(q1("generateKeyPair"))return z8.generateKeyPair("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}},function(U,M,O){if(U)return Q(U);Q(null,{privateKey:V$.privateKeyFromPem(O),publicKey:V$.publicKeyFromPem(M)})});if(K1("generateKey")&&K1("exportKey"))return vJ.globalScope.crypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:E1(J),hash:{name:"SHA-256"}},!0,["sign","verify"]).then(function(U){return vJ.globalScope.crypto.subtle.exportKey("pkcs8",U.privateKey)}).then(void 0,function(U){Q(U)}).then(function(U){if(U){var M=V$.privateKeyFromAsn1(S.fromDer(Q$.util.createBuffer(U)));Q(null,{privateKey:M,publicKey:V$.setRsaPublicKey(M.n,M.e)})}});if(z1("generateKey")&&z1("exportKey")){var Y=vJ.globalScope.msCrypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:E1(J),hash:{name:"SHA-256"}},!0,["sign","verify"]);Y.oncomplete=function(U){var M=U.target.result,O=vJ.globalScope.msCrypto.subtle.exportKey("pkcs8",M.privateKey);O.oncomplete=function(V){var H=V.target.result,q=V$.privateKeyFromAsn1(S.fromDer(Q$.util.createBuffer(H)));Q(null,{privateKey:q,publicKey:V$.setRsaPublicKey(q.n,q.e)})},O.onerror=function(V){Q(V)}},Y.onerror=function(U){Q(U)};return}}else if(q1("generateKeyPairSync")){var G=z8.generateKeyPairSync("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{privateKey:V$.privateKeyFromPem(G.privateKey),publicKey:V$.publicKeyFromPem(G.publicKey)}}}var W=V$.rsa.createKeyPairGenerationState($,J,X);if(!Q)return V$.rsa.stepKeyPairGenerationState(W,0),W.keys;KV(W,X,Q)};V$.setRsaPublicKey=V$.rsa.setPublicKey=function($,J){var X={n:$,e:J};return X.encrypt=function(Q,Y,G){if(typeof Y==="string")Y=Y.toUpperCase();else if(Y===void 0)Y="RSAES-PKCS1-V1_5";if(Y==="RSAES-PKCS1-V1_5")Y={encode:function(U,M,O){return N1(U,M,2).getBytes()}};else if(Y==="RSA-OAEP"||Y==="RSAES-OAEP")Y={encode:function(U,M){return Q$.pkcs1.encode_rsa_oaep(M,U,G)}};else if(["RAW","NONE","NULL",null].indexOf(Y)!==-1)Y={encode:function(U){return U}};else if(typeof Y==="string")throw Error('Unsupported encryption scheme: "'+Y+'".');var W=Y.encode(Q,X,!0);return V$.rsa.encrypt(W,X,!0)},X.verify=function(Q,Y,G,W){if(typeof G==="string")G=G.toUpperCase();else if(G===void 0)G="RSASSA-PKCS1-V1_5";if(W===void 0)W={_parseAllDigestBytes:!0,_skipPaddingChecks:!1};if(!("_parseAllDigestBytes"in W))W._parseAllDigestBytes=!0;if(!("_skipPaddingChecks"in W))W._skipPaddingChecks=!1;if(G==="RSASSA-PKCS1-V1_5")G={verify:function(M,O){O=_Y(O,X,!0,void 0,W);var V=S.fromDer(O,{parseAllBytes:W._parseAllDigestBytes}),H={},q=[];if(!S.validate(V,HV,H,q)||V.value.length!==2){var F=Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.");throw F.errors=q,F}var K=S.derToOid(H.algorithmIdentifier);if(!(K===Q$.oids.md2||K===Q$.oids.md5||K===Q$.oids.sha1||K===Q$.oids.sha224||K===Q$.oids.sha256||K===Q$.oids.sha384||K===Q$.oids.sha512||K===Q$.oids["sha512-224"]||K===Q$.oids["sha512-256"])){var F=Error("Unknown RSASSA-PKCS1-v1_5 DigestAlgorithm identifier.");throw F.oid=K,F}if(K===Q$.oids.md2||K===Q$.oids.md5){if(!("parameters"in H))throw Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value. Missing algorithm identifier NULL parameters.")}return M===H.digest}};else if(G==="NONE"||G==="NULL"||G===null)G={verify:function(M,O){return O=_Y(O,X,!0,void 0,W),M===O}};var U=V$.rsa.decrypt(Y,X,!0,!1);return G.verify(Q,U,X.n.bitLength())},X};V$.setRsaPrivateKey=V$.rsa.setPrivateKey=function($,J,X,Q,Y,G,W,U){var M={n:$,e:J,d:X,p:Q,q:Y,dP:G,dQ:W,qInv:U};return M.decrypt=function(O,V,H){if(typeof V==="string")V=V.toUpperCase();else if(V===void 0)V="RSAES-PKCS1-V1_5";var q=V$.rsa.decrypt(O,M,!1,!1);if(V==="RSAES-PKCS1-V1_5")V={decode:_Y};else if(V==="RSA-OAEP"||V==="RSAES-OAEP")V={decode:function(F,K){return Q$.pkcs1.decode_rsa_oaep(K,F,H)}};else if(["RAW","NONE","NULL",null].indexOf(V)!==-1)V={decode:function(F){return F}};else throw Error('Unsupported encryption scheme: "'+V+'".');return V.decode(q,M,!1)},M.sign=function(O,V){var H=!1;if(typeof V==="string")V=V.toUpperCase();if(V===void 0||V==="RSASSA-PKCS1-V1_5")V={encode:qV},H=1;else if(V==="NONE"||V==="NULL"||V===null)V={encode:function(){return O}},H=1;var q=V.encode(O,M.n.bitLength());return V$.rsa.encrypt(q,M,H)},M};V$.wrapRsaPrivateKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(0).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(V$.oids.rsaEncryption).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,"")]),S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer($).getBytes())])};V$.privateKeyFromAsn1=function($){var J={},X=[];if(S.validate($,UV,J,X))$=S.fromDer(Q$.util.createBuffer(J.privateKey));if(J={},X=[],!S.validate($,MV,J,X)){var Q=Error("Cannot read private key. ASN.1 object does not contain an RSAPrivateKey.");throw Q.errors=X,Q}var Y,G,W,U,M,O,V,H;return Y=Q$.util.createBuffer(J.privateKeyModulus).toHex(),G=Q$.util.createBuffer(J.privateKeyPublicExponent).toHex(),W=Q$.util.createBuffer(J.privateKeyPrivateExponent).toHex(),U=Q$.util.createBuffer(J.privateKeyPrime1).toHex(),M=Q$.util.createBuffer(J.privateKeyPrime2).toHex(),O=Q$.util.createBuffer(J.privateKeyExponent1).toHex(),V=Q$.util.createBuffer(J.privateKeyExponent2).toHex(),H=Q$.util.createBuffer(J.privateKeyCoefficient).toHex(),V$.setRsaPrivateKey(new T$(Y,16),new T$(G,16),new T$(W,16),new T$(U,16),new T$(M,16),new T$(O,16),new T$(V,16),new T$(H,16))};V$.privateKeyToAsn1=V$.privateKeyToRSAPrivateKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(0).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.n)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.e)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.d)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.p)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.q)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.dP)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.dQ)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.qInv))])};V$.publicKeyFromAsn1=function($){var J={},X=[];if(S.validate($,VV,J,X)){var Q=S.derToOid(J.publicKeyOid);if(Q!==V$.oids.rsaEncryption){var Y=Error("Cannot read public key. Unknown OID.");throw Y.oid=Q,Y}$=J.rsaPublicKey}if(X=[],!S.validate($,OV,J,X)){var Y=Error("Cannot read public key. ASN.1 object does not contain an RSAPublicKey.");throw Y.errors=X,Y}var G=Q$.util.createBuffer(J.publicKeyModulus).toHex(),W=Q$.util.createBuffer(J.publicKeyExponent).toHex();return V$.setRsaPublicKey(new T$(G,16),new T$(W,16))};V$.publicKeyToAsn1=V$.publicKeyToSubjectPublicKeyInfo=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(V$.oids.rsaEncryption).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,"")]),S.create(S.Class.UNIVERSAL,S.Type.BITSTRING,!1,[V$.publicKeyToRSAPublicKey($)])])};V$.publicKeyToRSAPublicKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.n)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.e))])};function N1($,J,X){var Q=Q$.util.createBuffer(),Y=Math.ceil(J.n.bitLength()/8);if($.length>Y-11){var G=Error("Message is too long for PKCS#1 v1.5 padding.");throw G.length=$.length,G.max=Y-11,G}Q.putByte(0),Q.putByte(X);var W=Y-3-$.length,U;if(X===0||X===1){U=X===0?0:255;for(var M=0;M<W;++M)Q.putByte(U)}else while(W>0){var O=0,V=Q$.random.getBytes(W);for(var M=0;M<W;++M)if(U=V.charCodeAt(M),U===0)++O;else Q.putByte(U);W=O}return Q.putByte(0),Q.putBytes($),Q}function _Y($,J,X,Q,Y){var G=Math.ceil(J.n.bitLength()/8),W=Q$.util.createBuffer($),U=W.getByte(),M=W.getByte();if(U!==0||X&&M!==0&&M!==1||!X&&M!==2||X&&M===0&&typeof Q>"u")throw Error("Encryption block is invalid.");var O=0;if(M===0){O=G-3-Q;for(var V=0;V<O;++V)if(W.getByte()!==0)throw Error("Encryption block is invalid.")}else if(M===1){O=0;while(W.length()>1){if(W.getByte()!==255){--W.read;break}++O}if(O<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}else if(M===2){O=0;while(W.length()>1){if(W.getByte()===0){--W.read;break}++O}if(O<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}var H=W.getByte();if(H!==0||O!==G-3-W.length())throw Error("Encryption block is invalid.");return W.getBytes()}function KV($,J,X){if(typeof J==="function")X=J,J={};J=J||{};var Q={algorithm:{name:J.algorithm||"PRIMEINC",options:{workers:J.workers||2,workLoad:J.workLoad||100,workerScript:J.workerScript}}};if("prng"in J)Q.prng=J.prng;Y();function Y(){G($.pBits,function(U,M){if(U)return X(U);if($.p=M,$.q!==null)return W(U,$.q);G($.qBits,W)})}function G(U,M){Q$.prime.generateProbablePrime(U,Q,M)}function W(U,M){if(U)return X(U);if($.q=M,$.p.compareTo($.q)<0){var O=$.p;$.p=$.q,$.q=O}if($.p.subtract(T$.ONE).gcd($.e).compareTo(T$.ONE)!==0){$.p=null,Y();return}if($.q.subtract(T$.ONE).gcd($.e).compareTo(T$.ONE)!==0){$.q=null,G($.qBits,W);return}if($.p1=$.p.subtract(T$.ONE),$.q1=$.q.subtract(T$.ONE),$.phi=$.p1.multiply($.q1),$.phi.gcd($.e).compareTo(T$.ONE)!==0){$.p=$.q=null,Y();return}if($.n=$.p.multiply($.q),$.n.bitLength()!==$.bits){$.q=null,G($.qBits,W);return}var V=$.e.modInverse($.phi);$.keys={privateKey:V$.rsa.setPrivateKey($.n,$.e,V,$.p,$.q,V.mod($.p1),V.mod($.q1),$.q.modInverse($.p)),publicKey:V$.rsa.setPublicKey($.n,$.e)},X(null,$.keys)}}function W0($){var J=$.toString(16);if(J[0]>="8")J="00"+J;var X=Q$.util.hexToBytes(J);if(X.length>1&&(X.charCodeAt(0)===0&&(X.charCodeAt(1)&128)===0||X.charCodeAt(0)===255&&(X.charCodeAt(1)&128)===128))return X.substr(1);return X}function zV($){if($<=100)return 27;if($<=150)return 18;if($<=200)return 15;if($<=250)return 12;if($<=300)return 9;if($<=350)return 8;if($<=400)return 7;if($<=500)return 6;if($<=600)return 5;if($<=800)return 4;if($<=1250)return 3;return 2}function q1($){return Q$.util.isNodejs&&typeof z8[$]==="function"}function K1($){return typeof vJ.globalScope<"u"&&typeof vJ.globalScope.crypto==="object"&&typeof vJ.globalScope.crypto.subtle==="object"&&typeof vJ.globalScope.crypto.subtle[$]==="function"}function z1($){return typeof vJ.globalScope<"u"&&typeof vJ.globalScope.msCrypto==="object"&&typeof vJ.globalScope.msCrypto.subtle==="object"&&typeof vJ.globalScope.msCrypto.subtle[$]==="function"}function E1($){var J=Q$.util.hexToBytes($.toString(16)),X=new Uint8Array(J.length);for(var Q=0;Q<J.length;++Q)X[Q]=J.charCodeAt(Q);return X}});var F8=O$((LF,Z1)=>{var o=z$();w0();mJ();AX();eJ();P0();SY();JQ();_J();W8();ZX();w$();if(typeof E8>"u")E8=o.jsbn.BigInteger;var E8,_=o.asn1,q$=o.pki=o.pki||{};Z1.exports=q$.pbe=o.pbe=o.pbe||{};var YQ=q$.oids,EV={name:"EncryptedPrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedPrivateKeyInfo.encryptionAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encryptionOid"},{name:"AlgorithmIdentifier.parameters",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,captureAsn1:"encryptionParams"}]},{name:"EncryptedPrivateKeyInfo.encryptedData",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encryptedData"}]},FV={name:"PBES2Algorithms",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"kdfOid"},{name:"PBES2Algorithms.params",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.params.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"kdfSalt"},{name:"PBES2Algorithms.params.iterationCount",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"kdfIterationCount"},{name:"PBES2Algorithms.params.keyLength",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,optional:!0,capture:"keyLength"},{name:"PBES2Algorithms.params.prf",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,optional:!0,value:[{name:"PBES2Algorithms.params.prf.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"prfOid"}]}]}]},{name:"PBES2Algorithms.encryptionScheme",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.encryptionScheme.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encOid"},{name:"PBES2Algorithms.encryptionScheme.iv",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encIv"}]}]},NV={name:"pkcs-12PbeParams",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"pkcs-12PbeParams.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"salt"},{name:"pkcs-12PbeParams.iterations",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"iterations"}]};q$.encryptPrivateKeyInfo=function($,J,X){X=X||{},X.saltSize=X.saltSize||8,X.count=X.count||2048,X.algorithm=X.algorithm||"aes128",X.prfAlgorithm=X.prfAlgorithm||"sha1";var Q=o.random.getBytesSync(X.saltSize),Y=X.count,G=_.integerToDer(Y),W,U,M;if(X.algorithm.indexOf("aes")===0||X.algorithm==="des"){var O,V,H;switch(X.algorithm){case"aes128":W=16,O=16,V=YQ["aes128-CBC"],H=o.aes.createEncryptionCipher;break;case"aes192":W=24,O=16,V=YQ["aes192-CBC"],H=o.aes.createEncryptionCipher;break;case"aes256":W=32,O=16,V=YQ["aes256-CBC"],H=o.aes.createEncryptionCipher;break;case"des":W=8,O=8,V=YQ.desCBC,H=o.des.createEncryptionCipher;break;default:var q=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw q.algorithm=X.algorithm,q}var F="hmacWith"+X.prfAlgorithm.toUpperCase(),K=D1(F),A=o.pkcs5.pbkdf2(J,Q,Y,W,K),L=o.random.getBytesSync(O),R=H(A);R.start(L),R.update(_.toDer($)),R.finish(),M=R.output.getBytes();var I=LV(Q,G,W,F);U=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(YQ.pkcs5PBES2).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(YQ.pkcs5PBKDF2).getBytes()),I]),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(V).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,L)])])])}else if(X.algorithm==="3des"){W=24;var T=new o.util.ByteBuffer(Q),A=q$.pbe.generatePkcs12Key(J,T,1,Y,W),L=q$.pbe.generatePkcs12Key(J,T,2,Y,W),R=o.des.createEncryptionCipher(A);R.start(L),R.update(_.toDer($)),R.finish(),M=R.output.getBytes(),U=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(YQ["pbeWithSHAAnd3-KeyTripleDES-CBC"]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,Q),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,G.getBytes())])])}else{var q=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw q.algorithm=X.algorithm,q}var C=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[U,_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,M)]);return C};q$.decryptPrivateKeyInfo=function($,J){var X=null,Q={},Y=[];if(!_.validate($,EV,Q,Y)){var G=Error("Cannot read encrypted private key. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=_.derToOid(Q.encryptionOid),U=q$.pbe.getCipher(W,Q.encryptionParams,J),M=o.util.createBuffer(Q.encryptedData);if(U.update(M),U.finish())X=_.fromDer(U.output);return X};q$.encryptedPrivateKeyToPem=function($,J){var X={type:"ENCRYPTED PRIVATE KEY",body:_.toDer($).getBytes()};return o.pem.encode(X,{maxline:J})};q$.encryptedPrivateKeyFromPem=function($){var J=o.pem.decode($)[0];if(J.type!=="ENCRYPTED PRIVATE KEY"){var X=Error('Could not convert encrypted private key from PEM; PEM header type is "ENCRYPTED PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert encrypted private key from PEM; PEM is encrypted.");return _.fromDer(J.body)};q$.encryptRsaPrivateKey=function($,J,X){if(X=X||{},!X.legacy){var Q=q$.wrapRsaPrivateKey(q$.privateKeyToAsn1($));return Q=q$.encryptPrivateKeyInfo(Q,J,X),q$.encryptedPrivateKeyToPem(Q)}var Y,G,W,U;switch(X.algorithm){case"aes128":Y="AES-128-CBC",W=16,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"aes192":Y="AES-192-CBC",W=24,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"aes256":Y="AES-256-CBC",W=32,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"3des":Y="DES-EDE3-CBC",W=24,G=o.random.getBytesSync(8),U=o.des.createEncryptionCipher;break;case"des":Y="DES-CBC",W=8,G=o.random.getBytesSync(8),U=o.des.createEncryptionCipher;break;default:var M=Error('Could not encrypt RSA private key; unsupported encryption algorithm "'+X.algorithm+'".');throw M.algorithm=X.algorithm,M}var O=o.pbe.opensslDeriveBytes(J,G.substr(0,8),W),V=U(O);V.start(G),V.update(_.toDer(q$.privateKeyToAsn1($))),V.finish();var H={type:"RSA PRIVATE KEY",procType:{version:"4",type:"ENCRYPTED"},dekInfo:{algorithm:Y,parameters:o.util.bytesToHex(G).toUpperCase()},body:V.output.getBytes()};return o.pem.encode(H)};q$.decryptRsaPrivateKey=function($,J){var X=null,Q=o.pem.decode($)[0];if(Q.type!=="ENCRYPTED PRIVATE KEY"&&Q.type!=="PRIVATE KEY"&&Q.type!=="RSA PRIVATE KEY"){var Y=Error('Could not convert private key from PEM; PEM header type is not "ENCRYPTED PRIVATE KEY", "PRIVATE KEY", or "RSA PRIVATE KEY".');throw Y.headerType=Y,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED"){var G,W;switch(Q.dekInfo.algorithm){case"DES-CBC":G=8,W=o.des.createDecryptionCipher;break;case"DES-EDE3-CBC":G=24,W=o.des.createDecryptionCipher;break;case"AES-128-CBC":G=16,W=o.aes.createDecryptionCipher;break;case"AES-192-CBC":G=24,W=o.aes.createDecryptionCipher;break;case"AES-256-CBC":G=32,W=o.aes.createDecryptionCipher;break;case"RC2-40-CBC":G=5,W=function(H){return o.rc2.createDecryptionCipher(H,40)};break;case"RC2-64-CBC":G=8,W=function(H){return o.rc2.createDecryptionCipher(H,64)};break;case"RC2-128-CBC":G=16,W=function(H){return o.rc2.createDecryptionCipher(H,128)};break;default:var Y=Error('Could not decrypt private key; unsupported encryption algorithm "'+Q.dekInfo.algorithm+'".');throw Y.algorithm=Q.dekInfo.algorithm,Y}var U=o.util.hexToBytes(Q.dekInfo.parameters),M=o.pbe.opensslDeriveBytes(J,U.substr(0,8),G),O=W(M);if(O.start(U),O.update(o.util.createBuffer(Q.body)),O.finish())X=O.output.getBytes();else return X}else X=Q.body;if(Q.type==="ENCRYPTED PRIVATE KEY")X=q$.decryptPrivateKeyInfo(_.fromDer(X),J);else X=_.fromDer(X);if(X!==null)X=q$.privateKeyFromAsn1(X);return X};q$.pbe.generatePkcs12Key=function($,J,X,Q,Y,G){var W,U;if(typeof G>"u"||G===null){if(!("sha1"in o.md))throw Error('"sha1" hash algorithm unavailable.');G=o.md.sha1.create()}var{digestLength:M,blockLength:O}=G,V=new o.util.ByteBuffer,H=new o.util.ByteBuffer;if($!==null&&$!==void 0){for(U=0;U<$.length;U++)H.putInt16($.charCodeAt(U));H.putInt16(0)}var q=H.length(),F=J.length(),K=new o.util.ByteBuffer;K.fillWithByte(X,O);var A=O*Math.ceil(F/O),L=new o.util.ByteBuffer;for(U=0;U<A;U++)L.putByte(J.at(U%F));var R=O*Math.ceil(q/O),I=new o.util.ByteBuffer;for(U=0;U<R;U++)I.putByte(H.at(U%q));var T=L;T.putBuffer(I);var C=Math.ceil(Y/M);for(var w=1;w<=C;w++){var P=new o.util.ByteBuffer;P.putBytes(K.bytes()),P.putBytes(T.bytes());for(var l=0;l<Q;l++)G.start(),G.update(P.getBytes()),P=G.digest();var k=new o.util.ByteBuffer;for(U=0;U<O;U++)k.putByte(P.at(U%M));var p=Math.ceil(F/O)+Math.ceil(q/O),$$=new o.util.ByteBuffer;for(W=0;W<p;W++){var N$=new o.util.ByteBuffer(T.getBytes(O)),M$=511;for(U=k.length()-1;U>=0;U--)M$=M$>>8,M$+=k.at(U)+N$.at(U),N$.setAt(U,M$&255);$$.putBuffer(N$)}T=$$,V.putBuffer(P)}return V.truncate(V.length()-Y),V};q$.pbe.getCipher=function($,J,X){switch($){case q$.oids.pkcs5PBES2:return q$.pbe.getCipherForPBES2($,J,X);case q$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:case q$.oids["pbewithSHAAnd40BitRC2-CBC"]:return q$.pbe.getCipherForPKCS12PBE($,J,X);default:var Q=Error("Cannot read encrypted PBE data block. Unsupported OID.");throw Q.oid=$,Q.supportedOids=["pkcs5PBES2","pbeWithSHAAnd3-KeyTripleDES-CBC","pbewithSHAAnd40BitRC2-CBC"],Q}};q$.pbe.getCipherForPBES2=function($,J,X){var Q={},Y=[];if(!_.validate(J,FV,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}if($=_.derToOid(Q.kdfOid),$!==q$.oids.pkcs5PBKDF2){var G=Error("Cannot read encrypted private key. Unsupported key derivation function OID.");throw G.oid=$,G.supportedOids=["pkcs5PBKDF2"],G}if($=_.derToOid(Q.encOid),$!==q$.oids["aes128-CBC"]&&$!==q$.oids["aes192-CBC"]&&$!==q$.oids["aes256-CBC"]&&$!==q$.oids["des-EDE3-CBC"]&&$!==q$.oids.desCBC){var G=Error("Cannot read encrypted private key. Unsupported encryption scheme OID.");throw G.oid=$,G.supportedOids=["aes128-CBC","aes192-CBC","aes256-CBC","des-EDE3-CBC","desCBC"],G}var W=Q.kdfSalt,U=o.util.createBuffer(Q.kdfIterationCount);U=U.getInt(U.length()<<3);var M,O;switch(q$.oids[$]){case"aes128-CBC":M=16,O=o.aes.createDecryptionCipher;break;case"aes192-CBC":M=24,O=o.aes.createDecryptionCipher;break;case"aes256-CBC":M=32,O=o.aes.createDecryptionCipher;break;case"des-EDE3-CBC":M=24,O=o.des.createDecryptionCipher;break;case"desCBC":M=8,O=o.des.createDecryptionCipher;break}var V=R1(Q.prfOid),H=o.pkcs5.pbkdf2(X,W,U,M,V),q=Q.encIv,F=O(H);return F.start(q),F};q$.pbe.getCipherForPKCS12PBE=function($,J,X){var Q={},Y=[];if(!_.validate(J,NV,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=o.util.createBuffer(Q.salt),U=o.util.createBuffer(Q.iterations);U=U.getInt(U.length()<<3);var M,O,V;switch($){case q$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:M=24,O=8,V=o.des.startDecrypting;break;case q$.oids["pbewithSHAAnd40BitRC2-CBC"]:M=5,O=8,V=function(A,L){var R=o.rc2.createDecryptionCipher(A,40);return R.start(L,null),R};break;default:var G=Error("Cannot read PKCS #12 PBE data block. Unsupported OID.");throw G.oid=$,G}var H=R1(Q.prfOid),q=q$.pbe.generatePkcs12Key(X,W,1,U,M,H);H.start();var F=q$.pbe.generatePkcs12Key(X,W,2,U,O,H);return V(q,F)};q$.pbe.opensslDeriveBytes=function($,J,X,Q){if(typeof Q>"u"||Q===null){if(!("md5"in o.md))throw Error('"md5" hash algorithm unavailable.');Q=o.md.md5.create()}if(J===null)J="";var Y=[A1(Q,$+J)];for(var G=16,W=1;G<X;++W,G+=16)Y.push(A1(Q,Y[W-1]+$+J));return Y.join("").substr(0,X)};function A1($,J){return $.start().update(J).digest().getBytes()}function R1($){var J;if(!$)J="hmacWithSHA1";else if(J=q$.oids[_.derToOid($)],!J){var X=Error("Unsupported PRF OID.");throw X.oid=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}return D1(J)}function D1($){var J=o.md;switch($){case"hmacWithSHA224":J=o.md.sha512;case"hmacWithSHA1":case"hmacWithSHA256":case"hmacWithSHA384":case"hmacWithSHA512":$=$.substr(8).toLowerCase();break;default:var X=Error("Unsupported PRF algorithm.");throw X.algorithm=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}if(!J||!($ in J))throw Error("Unknown hash algorithm: "+$);return J[$].create()}function LV($,J,X,Q){var Y=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,$),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,J.getBytes())]);if(Q!=="hmacWithSHA1")Y.value.push(_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,o.util.hexToBytes(X.toString(16))),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(q$.oids[Q]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]));return Y}});var N8=O$((AF,T1)=>{var PQ=z$();mJ();w$();var i=PQ.asn1,_Q=T1.exports=PQ.pkcs7asn1=PQ.pkcs7asn1||{};PQ.pkcs7=PQ.pkcs7||{};PQ.pkcs7.asn1=_Q;var B1={name:"ContentInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.ContentType",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,captureAsn1:"content"}]};_Q.contentInfoValidator=B1;var j1={name:"EncryptedContentInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentType",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"contentType"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentEncryptionAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,captureAsn1:"encParameter"}]},{name:"EncryptedContentInfo.encryptedContent",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,capture:"encryptedContent",captureAsn1:"encryptedContentAsn1"}]};_Q.envelopedDataValidator={name:"EnvelopedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EnvelopedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"EnvelopedData.RecipientInfos",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,constructed:!0,captureAsn1:"recipientInfos"}].concat(j1)};_Q.encryptedDataValidator={name:"EncryptedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"}].concat(j1)};var AV={name:"SignerInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1},{name:"SignerInfo.issuerAndSerialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.issuerAndSerialNumber.issuer",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"SignerInfo.issuerAndSerialNumber.serialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"SignerInfo.digestAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.digestAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"digestAlgorithm"},{name:"SignerInfo.digestAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,constructed:!1,captureAsn1:"digestParameter",optional:!0}]},{name:"SignerInfo.authenticatedAttributes",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"authenticatedAttributes"},{name:"SignerInfo.digestEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,capture:"signatureAlgorithm"},{name:"SignerInfo.encryptedDigest",tagClass:i.Class.UNIVERSAL,type:i.Type.OCTETSTRING,constructed:!1,capture:"signature"},{name:"SignerInfo.unauthenticatedAttributes",tagClass:i.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,capture:"unauthenticatedAttributes"}]};_Q.signedDataValidator={name:"SignedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"SignedData.DigestAlgorithms",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,constructed:!0,captureAsn1:"digestAlgorithms"},B1,{name:"SignedData.Certificates",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,optional:!0,captureAsn1:"certificates"},{name:"SignedData.CertificateRevocationLists",tagClass:i.Class.CONTEXT_SPECIFIC,type:1,optional:!0,captureAsn1:"crls"},{name:"SignedData.SignerInfos",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,capture:"signerInfos",optional:!0,value:[AV]}]};_Q.recipientInfoValidator={name:"RecipientInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"RecipientInfo.issuerAndSerial",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.issuerAndSerial.issuer",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"RecipientInfo.issuerAndSerial.serialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"RecipientInfo.keyEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.keyEncryptionAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"RecipientInfo.keyEncryptionAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,constructed:!1,captureAsn1:"encParameter",optional:!0}]},{name:"RecipientInfo.encryptedKey",tagClass:i.Class.UNIVERSAL,type:i.Type.OCTETSTRING,constructed:!1,capture:"encKey"}]}});var L8=O$((RF,S1)=>{var GQ=z$();w$();GQ.mgf=GQ.mgf||{};var RV=S1.exports=GQ.mgf.mgf1=GQ.mgf1=GQ.mgf1||{};RV.create=function($){var J={generate:function(X,Q){var Y=new GQ.util.ByteBuffer,G=Math.ceil(Q/$.digestLength);for(var W=0;W<G;W++){var U=new GQ.util.ByteBuffer;U.putInt32(W),$.start(),$.update(X+U.getBytes()),Y.putBuffer($.digest())}return Y.truncate(Y.length()-Q),Y.getBytes()}};return J}});var C1=O$((DF,I1)=>{var xY=z$();L8();I1.exports=xY.mgf=xY.mgf||{};xY.mgf.mgf1=xY.mgf1});var vY=O$((ZF,w1)=>{var WQ=z$();_J();w$();var DV=w1.exports=WQ.pss=WQ.pss||{};DV.create=function($){if(arguments.length===3)$={md:arguments[0],mgf:arguments[1],saltLength:arguments[2]};var{md:J,mgf:X}=$,Q=J.digestLength,Y=$.salt||null;if(typeof Y==="string")Y=WQ.util.createBuffer(Y);var G;if("saltLength"in $)G=$.saltLength;else if(Y!==null)G=Y.length();else throw Error("Salt length not specified or specific salt not given.");if(Y!==null&&Y.length()!==G)throw Error("Given salt length does not match length of given salt.");var W=$.prng||WQ.random,U={};return U.encode=function(M,O){var V,H=O-1,q=Math.ceil(H/8),F=M.digest().getBytes();if(q<Q+G+2)throw Error("Message is too long to encrypt.");var K;if(Y===null)K=W.getBytesSync(G);else K=Y.bytes();var A=new WQ.util.ByteBuffer;A.fillWithByte(0,8),A.putBytes(F),A.putBytes(K),J.start(),J.update(A.getBytes());var L=J.digest().getBytes(),R=new WQ.util.ByteBuffer;R.fillWithByte(0,q-G-Q-2),R.putByte(1),R.putBytes(K);var I=R.getBytes(),T=q-Q-1,C=X.generate(L,T),w="";for(V=0;V<T;V++)w+=String.fromCharCode(I.charCodeAt(V)^C.charCodeAt(V));var P=65280>>8*q-H&255;return w=String.fromCharCode(w.charCodeAt(0)&~P)+w.substr(1),w+L+String.fromCharCode(188)},U.verify=function(M,O,V){var H,q=V-1,F=Math.ceil(q/8);if(O=O.substr(-F),F<Q+G+2)throw Error("Inconsistent parameters to PSS signature verification.");if(O.charCodeAt(F-1)!==188)throw Error("Encoded message does not end in 0xBC.");var K=F-Q-1,A=O.substr(0,K),L=O.substr(K,Q),R=65280>>8*F-q&255;if((A.charCodeAt(0)&R)!==0)throw Error("Bits beyond keysize not zero as expected.");var I=X.generate(L,K),T="";for(H=0;H<K;H++)T+=String.fromCharCode(A.charCodeAt(H)^I.charCodeAt(H));T=String.fromCharCode(T.charCodeAt(0)&~R)+T.substr(1);var C=F-Q-G-2;for(H=0;H<C;H++)if(T.charCodeAt(H)!==0)throw Error("Leftmost octets not zero as expected");if(T.charCodeAt(C)!==1)throw Error("Inconsistent PSS signature, 0x01 marker not found");var w=T.substr(-G),P=new WQ.util.ByteBuffer;P.fillWithByte(0,8),P.putBytes(M),P.putBytes(w),J.start(),J.update(P.getBytes());var l=J.digest().getBytes();return L===l},U}});var yY=O$((BF,k1)=>{var X$=z$();w0();mJ();AX();eJ();C1();P0();JQ();vY();ZX();w$();var z=X$.asn1,g=k1.exports=X$.pki=X$.pki||{},C$=g.oids,s$={};s$.CN=C$.commonName;s$.commonName="CN";s$.C=C$.countryName;s$.countryName="C";s$.L=C$.localityName;s$.localityName="L";s$.ST=C$.stateOrProvinceName;s$.stateOrProvinceName="ST";s$.O=C$.organizationName;s$.organizationName="O";s$.OU=C$.organizationalUnitName;s$.organizationalUnitName="OU";s$.E=C$.emailAddress;s$.emailAddress="E";var _1=X$.pki.rsa.publicKeyValidator,ZV={name:"Certificate",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"tbsCertificate",value:[{name:"Certificate.TBSCertificate.version",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.version.integer",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certVersion"}]},{name:"Certificate.TBSCertificate.serialNumber",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certSerialNumber"},{name:"Certificate.TBSCertificate.signature",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.signature.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"certinfoSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"certinfoSignatureParams"}]},{name:"Certificate.TBSCertificate.issuer",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certIssuer"},{name:"Certificate.TBSCertificate.validity",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.validity.notBefore (utc)",tagClass:z.Class.UNIVERSAL,type:z.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity1UTCTime"},{name:"Certificate.TBSCertificate.validity.notBefore (generalized)",tagClass:z.Class.UNIVERSAL,type:z.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity2GeneralizedTime"},{name:"Certificate.TBSCertificate.validity.notAfter (utc)",tagClass:z.Class.UNIVERSAL,type:z.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity3UTCTime"},{name:"Certificate.TBSCertificate.validity.notAfter (generalized)",tagClass:z.Class.UNIVERSAL,type:z.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity4GeneralizedTime"}]},{name:"Certificate.TBSCertificate.subject",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certSubject"},_1,{name:"Certificate.TBSCertificate.issuerUniqueID",tagClass:z.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.issuerUniqueID.id",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certIssuerUniqueId"}]},{name:"Certificate.TBSCertificate.subjectUniqueID",tagClass:z.Class.CONTEXT_SPECIFIC,type:2,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.subjectUniqueID.id",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSubjectUniqueId"}]},{name:"Certificate.TBSCertificate.extensions",tagClass:z.Class.CONTEXT_SPECIFIC,type:3,constructed:!0,captureAsn1:"certExtensions",optional:!0}]},{name:"Certificate.signatureAlgorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.signatureAlgorithm.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"certSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"certSignatureParams"}]},{name:"Certificate.signatureValue",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSignature"}]},BV={name:"rsapss",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.hashAlgorithm",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier",tagClass:z.Class.UNIVERSAL,type:z.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"hashOid"}]}]},{name:"rsapss.maskGenAlgorithm",tagClass:z.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier",tagClass:z.Class.UNIVERSAL,type:z.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"maskGenOid"},{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"maskGenHashOid"}]}]}]},{name:"rsapss.saltLength",tagClass:z.Class.CONTEXT_SPECIFIC,type:2,optional:!0,value:[{name:"rsapss.saltLength.saltLength",tagClass:z.Class.UNIVERSAL,type:z.Class.INTEGER,constructed:!1,capture:"saltLength"}]},{name:"rsapss.trailerField",tagClass:z.Class.CONTEXT_SPECIFIC,type:3,optional:!0,value:[{name:"rsapss.trailer.trailer",tagClass:z.Class.UNIVERSAL,type:z.Class.INTEGER,constructed:!1,capture:"trailer"}]}]},jV={name:"CertificationRequestInfo",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfo",value:[{name:"CertificationRequestInfo.integer",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certificationRequestInfoVersion"},{name:"CertificationRequestInfo.subject",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfoSubject"},_1,{name:"CertificationRequestInfo.attributes",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"certificationRequestInfoAttributes",value:[{name:"CertificationRequestInfo.attributes",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequestInfo.attributes.type",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1},{name:"CertificationRequestInfo.attributes.value",tagClass:z.Class.UNIVERSAL,type:z.Type.SET,constructed:!0}]}]}]},TV={name:"CertificationRequest",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"csr",value:[jV,{name:"CertificationRequest.signatureAlgorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequest.signatureAlgorithm.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"csrSignatureOid"},{name:"CertificationRequest.signatureAlgorithm.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"csrSignatureParams"}]},{name:"CertificationRequest.signature",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"csrSignature"}]};g.RDNAttributesAsArray=function($,J){var X=[],Q,Y,G;for(var W=0;W<$.value.length;++W){Q=$.value[W];for(var U=0;U<Q.value.length;++U){if(G={},Y=Q.value[U],G.type=z.derToOid(Y.value[0].value),G.value=Y.value[1].value,G.valueTagClass=Y.value[1].type,G.type in C$){if(G.name=C$[G.type],G.name in s$)G.shortName=s$[G.name]}if(J)J.update(G.type),J.update(G.value);X.push(G)}}return X};g.CRIAttributesAsArray=function($){var J=[];for(var X=0;X<$.length;++X){var Q=$[X],Y=z.derToOid(Q.value[0].value),G=Q.value[1].value;for(var W=0;W<G.length;++W){var U={};if(U.type=Y,U.value=G[W].value,U.valueTagClass=G[W].type,U.type in C$){if(U.name=C$[U.type],U.name in s$)U.shortName=s$[U.name]}if(U.type===C$.extensionRequest){U.extensions=[];for(var M=0;M<U.value.length;++M)U.extensions.push(g.certificateExtensionFromAsn1(U.value[M]))}J.push(U)}}return J};function v0($,J){if(typeof J==="string")J={shortName:J};var X=null,Q;for(var Y=0;X===null&&Y<$.attributes.length;++Y)if(Q=$.attributes[Y],J.type&&J.type===Q.type)X=Q;else if(J.name&&J.name===Q.name)X=Q;else if(J.shortName&&J.shortName===Q.shortName)X=Q;return X}var kY=function($,J,X){var Q={};if($!==C$["RSASSA-PSS"])return Q;if(X)Q={hash:{algorithmOid:C$.sha1},mgf:{algorithmOid:C$.mgf1,hash:{algorithmOid:C$.sha1}},saltLength:20};var Y={},G=[];if(!z.validate(J,BV,Y,G)){var W=Error("Cannot read RSASSA-PSS parameter block.");throw W.errors=G,W}if(Y.hashOid!==void 0)Q.hash=Q.hash||{},Q.hash.algorithmOid=z.derToOid(Y.hashOid);if(Y.maskGenOid!==void 0)Q.mgf=Q.mgf||{},Q.mgf.algorithmOid=z.derToOid(Y.maskGenOid),Q.mgf.hash=Q.mgf.hash||{},Q.mgf.hash.algorithmOid=z.derToOid(Y.maskGenHashOid);if(Y.saltLength!==void 0)Q.saltLength=Y.saltLength.charCodeAt(0);return Q},fY=function($){switch(C$[$.signatureOid]){case"sha1WithRSAEncryption":case"sha1WithRSASignature":return X$.md.sha1.create();case"md5WithRSAEncryption":return X$.md.md5.create();case"sha256WithRSAEncryption":return X$.md.sha256.create();case"sha384WithRSAEncryption":return X$.md.sha384.create();case"sha512WithRSAEncryption":return X$.md.sha512.create();case"RSASSA-PSS":return X$.md.sha256.create();default:var J=Error("Could not compute "+$.type+" digest. Unknown signature OID.");throw J.signatureOid=$.signatureOid,J}},x1=function($){var J=$.certificate,X;switch(J.signatureOid){case C$.sha1WithRSAEncryption:case C$.sha1WithRSASignature:break;case C$["RSASSA-PSS"]:var Q,Y;if(Q=C$[J.signatureParameters.mgf.hash.algorithmOid],Q===void 0||X$.md[Q]===void 0){var G=Error("Unsupported MGF hash function.");throw G.oid=J.signatureParameters.mgf.hash.algorithmOid,G.name=Q,G}if(Y=C$[J.signatureParameters.mgf.algorithmOid],Y===void 0||X$.mgf[Y]===void 0){var G=Error("Unsupported MGF function.");throw G.oid=J.signatureParameters.mgf.algorithmOid,G.name=Y,G}if(Y=X$.mgf[Y].create(X$.md[Q].create()),Q=C$[J.signatureParameters.hash.algorithmOid],Q===void 0||X$.md[Q]===void 0){var G=Error("Unsupported RSASSA-PSS hash function.");throw G.oid=J.signatureParameters.hash.algorithmOid,G.name=Q,G}X=X$.pss.create(X$.md[Q].create(),Y,J.signatureParameters.saltLength);break}return J.publicKey.verify($.md.digest().getBytes(),$.signature,X)};g.certificateFromPem=function($,J,X){var Q=X$.pem.decode($)[0];if(Q.type!=="CERTIFICATE"&&Q.type!=="X509 CERTIFICATE"&&Q.type!=="TRUSTED CERTIFICATE"){var Y=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var G=z.fromDer(Q.body,X);return g.certificateFromAsn1(G,J)};g.certificateToPem=function($,J){var X={type:"CERTIFICATE",body:z.toDer(g.certificateToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.publicKeyFromPem=function($){var J=X$.pem.decode($)[0];if(J.type!=="PUBLIC KEY"&&J.type!=="RSA PUBLIC KEY"){var X=Error('Could not convert public key from PEM; PEM header type is not "PUBLIC KEY" or "RSA PUBLIC KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert public key from PEM; PEM is encrypted.");var Q=z.fromDer(J.body);return g.publicKeyFromAsn1(Q)};g.publicKeyToPem=function($,J){var X={type:"PUBLIC KEY",body:z.toDer(g.publicKeyToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.publicKeyToRSAPublicKeyPem=function($,J){var X={type:"RSA PUBLIC KEY",body:z.toDer(g.publicKeyToRSAPublicKey($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||X$.md.sha1.create(),Q=J.type||"RSAPublicKey",Y;switch(Q){case"RSAPublicKey":Y=z.toDer(g.publicKeyToRSAPublicKey($)).getBytes();break;case"SubjectPublicKeyInfo":Y=z.toDer(g.publicKeyToAsn1($)).getBytes();break;default:throw Error('Unknown fingerprint type "'+J.type+'".')}X.start(),X.update(Y);var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};g.certificationRequestFromPem=function($,J,X){var Q=X$.pem.decode($)[0];if(Q.type!=="CERTIFICATE REQUEST"){var Y=Error('Could not convert certification request from PEM; PEM header type is not "CERTIFICATE REQUEST".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certification request from PEM; PEM is encrypted.");var G=z.fromDer(Q.body,X);return g.certificationRequestFromAsn1(G,J)};g.certificationRequestToPem=function($,J){var X={type:"CERTIFICATE REQUEST",body:z.toDer(g.certificationRequestToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.createCertificate=function(){var $={};return $.version=2,$.serialNumber="00",$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.validity={},$.validity.notBefore=new Date,$.validity.notAfter=new Date,$.issuer={},$.issuer.getField=function(J){return v0($.issuer,J)},$.issuer.addField=function(J){kJ([J]),$.issuer.attributes.push(J)},$.issuer.attributes=[],$.issuer.hash=null,$.subject={},$.subject.getField=function(J){return v0($.subject,J)},$.subject.addField=function(J){kJ([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.extensions=[],$.publicKey=null,$.md=null,$.setSubject=function(J,X){if(kJ(J),$.subject.attributes=J,delete $.subject.uniqueId,X)$.subject.uniqueId=X;$.subject.hash=null},$.setIssuer=function(J,X){if(kJ(J),$.issuer.attributes=J,delete $.issuer.uniqueId,X)$.issuer.uniqueId=X;$.issuer.hash=null},$.setExtensions=function(J){for(var X=0;X<J.length;++X)v1(J[X],{cert:$});$.extensions=J},$.getExtension=function(J){if(typeof J==="string")J={name:J};var X=null,Q;for(var Y=0;X===null&&Y<$.extensions.length;++Y)if(Q=$.extensions[Y],J.id&&Q.id===J.id)X=Q;else if(J.name&&Q.name===J.name)X=Q;return X},$.sign=function(J,X){$.md=X||X$.md.sha1.create();var Q=C$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certificate digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.tbsCertificate=g.getTBSCertificate($);var G=z.toDer($.tbsCertificate);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(J){var X=!1;if(!$.issued(J)){var Q=J.issuer,Y=$.subject,G=Error("The parent certificate did not issue the given child certificate; the child certificate's issuer does not match the parent's subject.");throw G.expectedIssuer=Y.attributes,G.actualIssuer=Q.attributes,G}var W=J.md;if(W===null){W=fY({signatureOid:J.signatureOid,type:"certificate"});var U=J.tbsCertificate||g.getTBSCertificate(J),M=z.toDer(U);W.update(M.getBytes())}if(W!==null)X=x1({certificate:$,md:W,signature:J.signature});return X},$.isIssuer=function(J){var X=!1,Q=$.issuer,Y=J.subject;if(Q.hash&&Y.hash)X=Q.hash===Y.hash;else if(Q.attributes.length===Y.attributes.length){X=!0;var G,W;for(var U=0;X&&U<Q.attributes.length;++U)if(G=Q.attributes[U],W=Y.attributes[U],G.type!==W.type||G.value!==W.value)X=!1}return X},$.issued=function(J){return J.isIssuer($)},$.generateSubjectKeyIdentifier=function(){return g.getPublicKeyFingerprint($.publicKey,{type:"RSAPublicKey"})},$.verifySubjectKeyIdentifier=function(){var J=C$.subjectKeyIdentifier;for(var X=0;X<$.extensions.length;++X){var Q=$.extensions[X];if(Q.id===J){var Y=$.generateSubjectKeyIdentifier().getBytes();return X$.util.hexToBytes(Q.subjectKeyIdentifier)===Y}}return!1},$};g.certificateFromAsn1=function($,J){var X={},Q=[];if(!z.validate($,ZV,X,Q)){var Y=Error("Cannot read X.509 certificate. ASN.1 object is not an X509v3 Certificate.");throw Y.errors=Q,Y}var G=z.derToOid(X.publicKeyOid);if(G!==g.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=g.createCertificate();W.version=X.certVersion?X.certVersion.charCodeAt(0):0;var U=X$.util.createBuffer(X.certSerialNumber);W.serialNumber=U.toHex(),W.signatureOid=X$.asn1.derToOid(X.certSignatureOid),W.signatureParameters=kY(W.signatureOid,X.certSignatureParams,!0),W.siginfo.algorithmOid=X$.asn1.derToOid(X.certinfoSignatureOid),W.siginfo.parameters=kY(W.siginfo.algorithmOid,X.certinfoSignatureParams,!1),W.signature=X.certSignature;var M=[];if(X.certValidity1UTCTime!==void 0)M.push(z.utcTimeToDate(X.certValidity1UTCTime));if(X.certValidity2GeneralizedTime!==void 0)M.push(z.generalizedTimeToDate(X.certValidity2GeneralizedTime));if(X.certValidity3UTCTime!==void 0)M.push(z.utcTimeToDate(X.certValidity3UTCTime));if(X.certValidity4GeneralizedTime!==void 0)M.push(z.generalizedTimeToDate(X.certValidity4GeneralizedTime));if(M.length>2)throw Error("Cannot read notBefore/notAfter validity times; more than two times were provided in the certificate.");if(M.length<2)throw Error("Cannot read notBefore/notAfter validity times; they were not provided as either UTCTime or GeneralizedTime.");if(W.validity.notBefore=M[0],W.validity.notAfter=M[1],W.tbsCertificate=X.tbsCertificate,J){W.md=fY({signatureOid:W.signatureOid,type:"certificate"});var O=z.toDer(W.tbsCertificate);W.md.update(O.getBytes())}var V=X$.md.sha1.create(),H=z.toDer(X.certIssuer);if(V.update(H.getBytes()),W.issuer.getField=function(K){return v0(W.issuer,K)},W.issuer.addField=function(K){kJ([K]),W.issuer.attributes.push(K)},W.issuer.attributes=g.RDNAttributesAsArray(X.certIssuer),X.certIssuerUniqueId)W.issuer.uniqueId=X.certIssuerUniqueId;W.issuer.hash=V.digest().toHex();var q=X$.md.sha1.create(),F=z.toDer(X.certSubject);if(q.update(F.getBytes()),W.subject.getField=function(K){return v0(W.subject,K)},W.subject.addField=function(K){kJ([K]),W.subject.attributes.push(K)},W.subject.attributes=g.RDNAttributesAsArray(X.certSubject),X.certSubjectUniqueId)W.subject.uniqueId=X.certSubjectUniqueId;if(W.subject.hash=q.digest().toHex(),X.certExtensions)W.extensions=g.certificateExtensionsFromAsn1(X.certExtensions);else W.extensions=[];return W.publicKey=g.publicKeyFromAsn1(X.subjectPublicKeyInfo),W};g.certificateExtensionsFromAsn1=function($){var J=[];for(var X=0;X<$.value.length;++X){var Q=$.value[X];for(var Y=0;Y<Q.value.length;++Y)J.push(g.certificateExtensionFromAsn1(Q.value[Y]))}return J};g.certificateExtensionFromAsn1=function($){var J={};if(J.id=z.derToOid($.value[0].value),J.critical=!1,$.value[1].type===z.Type.BOOLEAN)J.critical=$.value[1].value.charCodeAt(0)!==0,J.value=$.value[2].value;else J.value=$.value[1].value;if(J.id in C$){if(J.name=C$[J.id],J.name==="keyUsage"){var X=z.fromDer(J.value),Q=0,Y=0;if(X.value.length>1)Q=X.value.charCodeAt(1),Y=X.value.length>2?X.value.charCodeAt(2):0;J.digitalSignature=(Q&128)===128,J.nonRepudiation=(Q&64)===64,J.keyEncipherment=(Q&32)===32,J.dataEncipherment=(Q&16)===16,J.keyAgreement=(Q&8)===8,J.keyCertSign=(Q&4)===4,J.cRLSign=(Q&2)===2,J.encipherOnly=(Q&1)===1,J.decipherOnly=(Y&128)===128}else if(J.name==="basicConstraints"){var X=z.fromDer(J.value);if(X.value.length>0&&X.value[0].type===z.Type.BOOLEAN)J.cA=X.value[0].value.charCodeAt(0)!==0;else J.cA=!1;var G=null;if(X.value.length>0&&X.value[0].type===z.Type.INTEGER)G=X.value[0].value;else if(X.value.length>1)G=X.value[1].value;if(G!==null)J.pathLenConstraint=z.derToInteger(G)}else if(J.name==="extKeyUsage"){var X=z.fromDer(J.value);for(var W=0;W<X.value.length;++W){var U=z.derToOid(X.value[W].value);if(U in C$)J[C$[U]]=!0;else J[U]=!0}}else if(J.name==="nsCertType"){var X=z.fromDer(J.value),Q=0;if(X.value.length>1)Q=X.value.charCodeAt(1);J.client=(Q&128)===128,J.server=(Q&64)===64,J.email=(Q&32)===32,J.objsign=(Q&16)===16,J.reserved=(Q&8)===8,J.sslCA=(Q&4)===4,J.emailCA=(Q&2)===2,J.objCA=(Q&1)===1}else if(J.name==="subjectAltName"||J.name==="issuerAltName"){J.altNames=[];var M,X=z.fromDer(J.value);for(var O=0;O<X.value.length;++O){M=X.value[O];var V={type:M.type,value:M.value};switch(J.altNames.push(V),M.type){case 1:case 2:case 6:break;case 7:V.ip=X$.util.bytesToIP(M.value);break;case 8:V.oid=z.derToOid(M.value);break;default:}}}else if(J.name==="subjectKeyIdentifier"){var X=z.fromDer(J.value);J.subjectKeyIdentifier=X$.util.bytesToHex(X.value)}}return J};g.certificationRequestFromAsn1=function($,J){var X={},Q=[];if(!z.validate($,TV,X,Q)){var Y=Error("Cannot read PKCS#10 certificate request. ASN.1 object is not a PKCS#10 CertificationRequest.");throw Y.errors=Q,Y}var G=z.derToOid(X.publicKeyOid);if(G!==g.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=g.createCertificationRequest();if(W.version=X.csrVersion?X.csrVersion.charCodeAt(0):0,W.signatureOid=X$.asn1.derToOid(X.csrSignatureOid),W.signatureParameters=kY(W.signatureOid,X.csrSignatureParams,!0),W.siginfo.algorithmOid=X$.asn1.derToOid(X.csrSignatureOid),W.siginfo.parameters=kY(W.siginfo.algorithmOid,X.csrSignatureParams,!1),W.signature=X.csrSignature,W.certificationRequestInfo=X.certificationRequestInfo,J){W.md=fY({signatureOid:W.signatureOid,type:"certification request"});var U=z.toDer(W.certificationRequestInfo);W.md.update(U.getBytes())}var M=X$.md.sha1.create();return W.subject.getField=function(O){return v0(W.subject,O)},W.subject.addField=function(O){kJ([O]),W.subject.attributes.push(O)},W.subject.attributes=g.RDNAttributesAsArray(X.certificationRequestInfoSubject,M),W.subject.hash=M.digest().toHex(),W.publicKey=g.publicKeyFromAsn1(X.subjectPublicKeyInfo),W.getAttribute=function(O){return v0(W,O)},W.addAttribute=function(O){kJ([O]),W.attributes.push(O)},W.attributes=g.CRIAttributesAsArray(X.certificationRequestInfoAttributes||[]),W};g.createCertificationRequest=function(){var $={};return $.version=0,$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.subject={},$.subject.getField=function(J){return v0($.subject,J)},$.subject.addField=function(J){kJ([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.publicKey=null,$.attributes=[],$.getAttribute=function(J){return v0($,J)},$.addAttribute=function(J){kJ([J]),$.attributes.push(J)},$.md=null,$.setSubject=function(J){kJ(J),$.subject.attributes=J,$.subject.hash=null},$.setAttributes=function(J){kJ(J),$.attributes=J},$.sign=function(J,X){$.md=X||X$.md.sha1.create();var Q=C$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certification request digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.certificationRequestInfo=g.getCertificationRequestInfo($);var G=z.toDer($.certificationRequestInfo);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(){var J=!1,X=$.md;if(X===null){X=fY({signatureOid:$.signatureOid,type:"certification request"});var Q=$.certificationRequestInfo||g.getCertificationRequestInfo($),Y=z.toDer(Q);X.update(Y.getBytes())}if(X!==null)J=x1({certificate:$,md:X,signature:$.signature});return J},$};function xQ($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),X,Q,Y=$.attributes;for(var G=0;G<Y.length;++G){X=Y[G];var W=X.value,U=z.Type.PRINTABLESTRING;if("valueTagClass"in X){if(U=X.valueTagClass,U===z.Type.UTF8)W=X$.util.encodeUtf8(W)}Q=z.create(z.Class.UNIVERSAL,z.Type.SET,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(X.type).getBytes()),z.create(z.Class.UNIVERSAL,U,!1,W)])]),J.value.push(Q)}return J}function kJ($){var J;for(var X=0;X<$.length;++X){if(J=$[X],typeof J.name>"u"){if(J.type&&J.type in g.oids)J.name=g.oids[J.type];else if(J.shortName&&J.shortName in s$)J.name=g.oids[s$[J.shortName]]}if(typeof J.type>"u")if(J.name&&J.name in g.oids)J.type=g.oids[J.name];else{var Q=Error("Attribute type not specified.");throw Q.attribute=J,Q}if(typeof J.shortName>"u"){if(J.name&&J.name in s$)J.shortName=s$[J.name]}if(J.type===C$.extensionRequest){if(J.valueConstructed=!0,J.valueTagClass=z.Type.SEQUENCE,!J.value&&J.extensions){J.value=[];for(var Y=0;Y<J.extensions.length;++Y)J.value.push(g.certificateExtensionToAsn1(v1(J.extensions[Y])))}}if(typeof J.value>"u"){var Q=Error("Attribute value not specified.");throw Q.attribute=J,Q}}}function v1($,J){if(J=J||{},typeof $.name>"u"){if($.id&&$.id in g.oids)$.name=g.oids[$.id]}if(typeof $.id>"u")if($.name&&$.name in g.oids)$.id=g.oids[$.name];else{var X=Error("Extension ID not specified.");throw X.extension=$,X}if(typeof $.value<"u")return $;if($.name==="keyUsage"){var Q=0,Y=0,G=0;if($.digitalSignature)Y|=128,Q=7;if($.nonRepudiation)Y|=64,Q=6;if($.keyEncipherment)Y|=32,Q=5;if($.dataEncipherment)Y|=16,Q=4;if($.keyAgreement)Y|=8,Q=3;if($.keyCertSign)Y|=4,Q=2;if($.cRLSign)Y|=2,Q=1;if($.encipherOnly)Y|=1,Q=0;if($.decipherOnly)G|=128,Q=7;var W=String.fromCharCode(Q);if(G!==0)W+=String.fromCharCode(Y)+String.fromCharCode(G);else if(Y!==0)W+=String.fromCharCode(Y);$.value=z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,W)}else if($.name==="basicConstraints"){if($.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),$.cA)$.value.value.push(z.create(z.Class.UNIVERSAL,z.Type.BOOLEAN,!1,String.fromCharCode(255)));if("pathLenConstraint"in $)$.value.value.push(z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.pathLenConstraint).getBytes()))}else if($.name==="extKeyUsage"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value;for(var M in $){if($[M]!==!0)continue;if(M in C$)U.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(C$[M]).getBytes()));else if(M.indexOf(".")!==-1)U.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(M).getBytes()))}}else if($.name==="nsCertType"){var Q=0,Y=0;if($.client)Y|=128,Q=7;if($.server)Y|=64,Q=6;if($.email)Y|=32,Q=5;if($.objsign)Y|=16,Q=4;if($.reserved)Y|=8,Q=3;if($.sslCA)Y|=4,Q=2;if($.emailCA)Y|=2,Q=1;if($.objCA)Y|=1,Q=0;var W=String.fromCharCode(Q);if(Y!==0)W+=String.fromCharCode(Y);$.value=z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,W)}else if($.name==="subjectAltName"||$.name==="issuerAltName"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var O;for(var V=0;V<$.altNames.length;++V){O=$.altNames[V];var W=O.value;if(O.type===7&&O.ip){if(W=X$.util.bytesFromIP(O.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(O.type===8)if(O.oid)W=z.oidToDer(z.oidToDer(O.oid));else W=z.oidToDer(W);$.value.value.push(z.create(z.Class.CONTEXT_SPECIFIC,O.type,!1,W))}}else if($.name==="nsComment"&&J.cert){if(!/^[\x00-\x7F]*$/.test($.comment)||$.comment.length<1||$.comment.length>128)throw Error('Invalid "nsComment" content.');$.value=z.create(z.Class.UNIVERSAL,z.Type.IA5STRING,!1,$.comment)}else if($.name==="subjectKeyIdentifier"&&J.cert){var H=J.cert.generateSubjectKeyIdentifier();$.subjectKeyIdentifier=H.toHex(),$.value=z.create(z.Class.UNIVERSAL,z.Type.OCTETSTRING,!1,H.getBytes())}else if($.name==="authorityKeyIdentifier"&&J.cert){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value;if($.keyIdentifier){var q=$.keyIdentifier===!0?J.cert.generateSubjectKeyIdentifier().getBytes():$.keyIdentifier;U.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!1,q))}if($.authorityCertIssuer){var F=[z.create(z.Class.CONTEXT_SPECIFIC,4,!0,[xQ($.authorityCertIssuer===!0?J.cert.issuer:$.authorityCertIssuer)])];U.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,F))}if($.serialNumber){var K=X$.util.hexToBytes($.serialNumber===!0?J.cert.serialNumber:$.serialNumber);U.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!1,K))}}else if($.name==="cRLDistributionPoints"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value,A=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),L=z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[]),O;for(var V=0;V<$.altNames.length;++V){O=$.altNames[V];var W=O.value;if(O.type===7&&O.ip){if(W=X$.util.bytesFromIP(O.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(O.type===8)if(O.oid)W=z.oidToDer(z.oidToDer(O.oid));else W=z.oidToDer(W);L.value.push(z.create(z.Class.CONTEXT_SPECIFIC,O.type,!1,W))}A.value.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[L])),U.push(A)}if(typeof $.value>"u"){var X=Error("Extension value not specified.");throw X.extension=$,X}return $}function A8($,J){switch($){case C$["RSASSA-PSS"]:var X=[];if(J.hash.algorithmOid!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.hash.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")])]));if(J.mgf.algorithmOid!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.mgf.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.mgf.hash.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")])])]));if(J.saltLength!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer(J.saltLength).getBytes())]));return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,X);default:return z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")}}function SV($){var J=z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[]);if($.attributes.length===0)return J;var X=$.attributes;for(var Q=0;Q<X.length;++Q){var Y=X[Q],G=Y.value,W=z.Type.UTF8;if("valueTagClass"in Y)W=Y.valueTagClass;if(W===z.Type.UTF8)G=X$.util.encodeUtf8(G);var U=!1;if("valueConstructed"in Y)U=Y.valueConstructed;var M=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(Y.type).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.SET,!0,[z.create(z.Class.UNIVERSAL,W,U,G)])]);J.value.push(M)}return J}var IV=new Date("1950-01-01T00:00:00Z"),CV=new Date("2050-01-01T00:00:00Z");function P1($){if($>=IV&&$<CV)return z.create(z.Class.UNIVERSAL,z.Type.UTCTIME,!1,z.dateToUtcTime($));else return z.create(z.Class.UNIVERSAL,z.Type.GENERALIZEDTIME,!1,z.dateToGeneralizedTime($))}g.getTBSCertificate=function($){var J=P1($.validity.notBefore),X=P1($.validity.notAfter),Q=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.version).getBytes())]),z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,X$.util.hexToBytes($.serialNumber)),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.siginfo.algorithmOid).getBytes()),A8($.siginfo.algorithmOid,$.siginfo.parameters)]),xQ($.issuer),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,X]),xQ($.subject),g.publicKeyToAsn1($.publicKey)]);if($.issuer.uniqueId)Q.value.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,[z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.issuer.uniqueId)]));if($.subject.uniqueId)Q.value.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!0,[z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.subject.uniqueId)]));if($.extensions.length>0)Q.value.push(g.certificateExtensionsToAsn1($.extensions));return Q};g.getCertificationRequestInfo=function($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.version).getBytes()),xQ($.subject),g.publicKeyToAsn1($.publicKey),SV($)]);return J};g.distinguishedNameToAsn1=function($){return xQ($)};g.certificateToAsn1=function($){var J=$.tbsCertificate||g.getTBSCertificate($);return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.signatureOid).getBytes()),A8($.signatureOid,$.signatureParameters)]),z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};g.certificateExtensionsToAsn1=function($){var J=z.create(z.Class.CONTEXT_SPECIFIC,3,!0,[]),X=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);J.value.push(X);for(var Q=0;Q<$.length;++Q)X.value.push(g.certificateExtensionToAsn1($[Q]));return J};g.certificateExtensionToAsn1=function($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);if(J.value.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.id).getBytes())),$.critical)J.value.push(z.create(z.Class.UNIVERSAL,z.Type.BOOLEAN,!1,String.fromCharCode(255)));var X=$.value;if(typeof $.value!=="string")X=z.toDer(X).getBytes();return J.value.push(z.create(z.Class.UNIVERSAL,z.Type.OCTETSTRING,!1,X)),J};g.certificationRequestToAsn1=function($){var J=$.certificationRequestInfo||g.getCertificationRequestInfo($);return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.signatureOid).getBytes()),A8($.signatureOid,$.signatureParameters)]),z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};g.createCaStore=function($){var J={certs:{}};J.getIssuer=function(W){var U=X(W.issuer);return U},J.addCertificate=function(W){if(typeof W==="string")W=X$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))if(W.subject.hash in J.certs){var U=J.certs[W.subject.hash];if(!X$.util.isArray(U))U=[U];U.push(W),J.certs[W.subject.hash]=U}else J.certs[W.subject.hash]=W},J.hasCertificate=function(W){if(typeof W==="string")W=X$.pki.certificateFromPem(W);var U=X(W.subject);if(!U)return!1;if(!X$.util.isArray(U))U=[U];var M=z.toDer(g.certificateToAsn1(W)).getBytes();for(var O=0;O<U.length;++O){var V=z.toDer(g.certificateToAsn1(U[O])).getBytes();if(M===V)return!0}return!1},J.listAllCertificates=function(){var W=[];for(var U in J.certs)if(J.certs.hasOwnProperty(U)){var M=J.certs[U];if(!X$.util.isArray(M))W.push(M);else for(var O=0;O<M.length;++O)W.push(M[O])}return W},J.removeCertificate=function(W){var U;if(typeof W==="string")W=X$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))return null;var M=X(W.subject);if(!X$.util.isArray(M))return U=J.certs[W.subject.hash],delete J.certs[W.subject.hash],U;var O=z.toDer(g.certificateToAsn1(W)).getBytes();for(var V=0;V<M.length;++V){var H=z.toDer(g.certificateToAsn1(M[V])).getBytes();if(O===H)U=M[V],M.splice(V,1)}if(M.length===0)delete J.certs[W.subject.hash];return U};function X(W){return Q(W),J.certs[W.hash]||null}function Q(W){if(!W.hash){var U=X$.md.sha1.create();W.attributes=g.RDNAttributesAsArray(xQ(W),U),W.hash=U.digest().toHex()}}if($)for(var Y=0;Y<$.length;++Y){var G=$[Y];J.addCertificate(G)}return J};g.certificateError={bad_certificate:"forge.pki.BadCertificate",unsupported_certificate:"forge.pki.UnsupportedCertificate",certificate_revoked:"forge.pki.CertificateRevoked",certificate_expired:"forge.pki.CertificateExpired",certificate_unknown:"forge.pki.CertificateUnknown",unknown_ca:"forge.pki.UnknownCertificateAuthority"};g.verifyCertificateChain=function($,J,X){if(typeof X==="function")X={verify:X};X=X||{},J=J.slice(0);var Q=J.slice(0),Y=X.validityCheckDate;if(typeof Y>"u")Y=new Date;var G=!0,W=null,U=0;do{var M=J.shift(),O=null,V=!1;if(Y){if(Y<M.validity.notBefore||Y>M.validity.notAfter)W={message:"Certificate is not valid yet or has expired.",error:g.certificateError.certificate_expired,notBefore:M.validity.notBefore,notAfter:M.validity.notAfter,now:Y}}if(W===null){if(O=J[0]||$.getIssuer(M),O===null){if(M.isIssuer(M))V=!0,O=M}if(O){var H=O;if(!X$.util.isArray(H))H=[H];var q=!1;while(!q&&H.length>0){O=H.shift();try{q=O.verify(M)}catch(w){}}if(!q)W={message:"Certificate signature is invalid.",error:g.certificateError.bad_certificate}}if(W===null&&(!O||V)&&!$.hasCertificate(M))W={message:"Certificate is not trusted.",error:g.certificateError.unknown_ca}}if(W===null&&O&&!M.isIssuer(O))W={message:"Certificate issuer is invalid.",error:g.certificateError.bad_certificate};if(W===null){var F={keyUsage:!0,basicConstraints:!0};for(var K=0;W===null&&K<M.extensions.length;++K){var A=M.extensions[K];if(A.critical&&!(A.name in F))W={message:"Certificate has an unsupported critical extension.",error:g.certificateError.unsupported_certificate}}}if(W===null&&(!G||J.length===0&&(!O||V))){var L=M.getExtension("basicConstraints"),R=M.getExtension("keyUsage");if(R!==null){if(!R.keyCertSign||L===null)W={message:"Certificate keyUsage or basicConstraints conflict or indicate that the certificate is not a CA. If the certificate is the only one in the chain or isn't the first then the certificate must be a valid CA.",error:g.certificateError.bad_certificate}}if(W===null&&L===null)W={message:"Certificate is missing basicConstraints extension and cannot be used as a CA.",error:g.certificateError.bad_certificate};if(W===null&&L!==null&&!L.cA)W={message:"Certificate basicConstraints indicates the certificate is not a CA.",error:g.certificateError.bad_certificate};if(W===null&&R!==null&&"pathLenConstraint"in L){var I=U-1;if(I>L.pathLenConstraint)W={message:"Certificate basicConstraints pathLenConstraint violated.",error:g.certificateError.bad_certificate}}}var T=W===null?!0:W.error,C=X.verify?X.verify(T,U,Q):T;if(C===!0)W=null;else{if(T===!0)W={message:"The application rejected the certificate.",error:g.certificateError.bad_certificate};if(C||C===0){if(typeof C==="object"&&!X$.util.isArray(C)){if(C.message)W.message=C.message;if(C.error)W.error=C.error}else if(typeof C==="string")W.error=C}throw W}G=!1,++U}while(J.length>0);return!0}});var D8=O$((jF,y1)=>{var l$=z$();mJ();TQ();P0();N8();F8();_J();ZX();wQ();w$();yY();var{asn1:D,pki:R$}=l$,jX=y1.exports=l$.pkcs12=l$.pkcs12||{},f1={name:"ContentInfo",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.contentType",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"content"}]},wV={name:"PFX",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.version",tagClass:D.Class.UNIVERSAL,type:D.Type.INTEGER,constructed:!1,capture:"version"},f1,{name:"PFX.macData",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"mac",value:[{name:"PFX.macData.mac",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm.algorithm",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"macAlgorithm"},{name:"PFX.macData.mac.digestAlgorithm.parameters",optional:!0,tagClass:D.Class.UNIVERSAL,captureAsn1:"macAlgorithmParameters"}]},{name:"PFX.macData.mac.digest",tagClass:D.Class.UNIVERSAL,type:D.Type.OCTETSTRING,constructed:!1,capture:"macDigest"}]},{name:"PFX.macData.macSalt",tagClass:D.Class.UNIVERSAL,type:D.Type.OCTETSTRING,constructed:!1,capture:"macSalt"},{name:"PFX.macData.iterations",tagClass:D.Class.UNIVERSAL,type:D.Type.INTEGER,constructed:!1,optional:!0,capture:"macIterations"}]}]},PV={name:"SafeBag",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"SafeBag.bagId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"bagId"},{name:"SafeBag.bagValue",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"bagValue"},{name:"SafeBag.bagAttributes",tagClass:D.Class.UNIVERSAL,type:D.Type.SET,constructed:!0,optional:!0,capture:"bagAttributes"}]},_V={name:"Attribute",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"Attribute.attrId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"oid"},{name:"Attribute.attrValues",tagClass:D.Class.UNIVERSAL,type:D.Type.SET,constructed:!0,capture:"values"}]},xV={name:"CertBag",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"CertBag.certId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"certId"},{name:"CertBag.certValue",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,value:[{name:"CertBag.certValue[0]",tagClass:D.Class.UNIVERSAL,type:D.Class.OCTETSTRING,constructed:!1,capture:"cert"}]}]};function BX($,J,X,Q){var Y=[];for(var G=0;G<$.length;G++)for(var W=0;W<$[G].safeBags.length;W++){var U=$[G].safeBags[W];if(Q!==void 0&&U.type!==Q)continue;if(J===null){Y.push(U);continue}if(U.attributes[J]!==void 0&&U.attributes[J].indexOf(X)>=0)Y.push(U)}return Y}jX.pkcs12FromAsn1=function($,J,X){if(typeof J==="string")X=J,J=!0;else if(J===void 0)J=!0;var Q={},Y=[];if(!D.validate($,wV,Q,Y)){var G=Error("Cannot read PKCS#12 PFX. ASN.1 object is not an PKCS#12 PFX.");throw G.errors=G,G}var W={version:Q.version.charCodeAt(0),safeContents:[],getBags:function(L){var R={},I;if("localKeyId"in L)I=L.localKeyId;else if("localKeyIdHex"in L)I=l$.util.hexToBytes(L.localKeyIdHex);if(I===void 0&&!("friendlyName"in L)&&"bagType"in L)R[L.bagType]=BX(W.safeContents,null,null,L.bagType);if(I!==void 0)R.localKeyId=BX(W.safeContents,"localKeyId",I,L.bagType);if("friendlyName"in L)R.friendlyName=BX(W.safeContents,"friendlyName",L.friendlyName,L.bagType);return R},getBagsByFriendlyName:function(L,R){return BX(W.safeContents,"friendlyName",L,R)},getBagsByLocalKeyId:function(L,R){return BX(W.safeContents,"localKeyId",L,R)}};if(Q.version.charCodeAt(0)!==3){var G=Error("PKCS#12 PFX of version other than 3 not supported.");throw G.version=Q.version.charCodeAt(0),G}if(D.derToOid(Q.contentType)!==R$.oids.data){var G=Error("Only PKCS#12 PFX in password integrity mode supported.");throw G.oid=D.derToOid(Q.contentType),G}var U=Q.content.value[0];if(U.tagClass!==D.Class.UNIVERSAL||U.type!==D.Type.OCTETSTRING)throw Error("PKCS#12 authSafe content data is not an OCTET STRING.");if(U=R8(U),Q.mac){var M=null,O=0,V=D.derToOid(Q.macAlgorithm);switch(V){case R$.oids.sha1:M=l$.md.sha1.create(),O=20;break;case R$.oids.sha256:M=l$.md.sha256.create(),O=32;break;case R$.oids.sha384:M=l$.md.sha384.create(),O=48;break;case R$.oids.sha512:M=l$.md.sha512.create(),O=64;break;case R$.oids.md5:M=l$.md.md5.create(),O=16;break}if(M===null)throw Error("PKCS#12 uses unsupported MAC algorithm: "+V);var H=new l$.util.ByteBuffer(Q.macSalt),q="macIterations"in Q?parseInt(l$.util.bytesToHex(Q.macIterations),16):1,F=jX.generateKey(X,H,3,q,O,M),K=l$.hmac.create();K.start(M,F),K.update(U.value);var A=K.getMac();if(A.getBytes()!==Q.macDigest)throw Error("PKCS#12 MAC could not be verified. Invalid password?")}else if(Array.isArray($.value)&&$.value.length>2)throw Error("Invalid PKCS#12. macData field present but MAC was not validated.");return vV(W,U.value,J,X),W};function R8($){if($.composed||$.constructed){var J=l$.util.createBuffer();for(var X=0;X<$.value.length;++X)J.putBytes($.value[X].value);$.composed=$.constructed=!1,$.value=J.getBytes()}return $}function vV($,J,X,Q){if(J=D.fromDer(J,X),J.tagClass!==D.Class.UNIVERSAL||J.type!==D.Type.SEQUENCE||J.constructed!==!0)throw Error("PKCS#12 AuthenticatedSafe expected to be a SEQUENCE OF ContentInfo");for(var Y=0;Y<J.value.length;Y++){var G=J.value[Y],W={},U=[];if(!D.validate(G,f1,W,U)){var M=Error("Cannot read ContentInfo.");throw M.errors=U,M}var O={encrypted:!1},V=null,H=W.content.value[0];switch(D.derToOid(W.contentType)){case R$.oids.data:if(H.tagClass!==D.Class.UNIVERSAL||H.type!==D.Type.OCTETSTRING)throw Error("PKCS#12 SafeContents Data is not an OCTET STRING.");V=R8(H).value;break;case R$.oids.encryptedData:V=kV(H,Q),O.encrypted=!0;break;default:var M=Error("Unsupported PKCS#12 contentType.");throw M.contentType=D.derToOid(W.contentType),M}O.safeBags=fV(V,X,Q),$.safeContents.push(O)}}function kV($,J){var X={},Q=[];if(!D.validate($,l$.pkcs7.asn1.encryptedDataValidator,X,Q)){var Y=Error("Cannot read EncryptedContentInfo.");throw Y.errors=Q,Y}var G=D.derToOid(X.contentType);if(G!==R$.oids.data){var Y=Error("PKCS#12 EncryptedContentInfo ContentType is not Data.");throw Y.oid=G,Y}G=D.derToOid(X.encAlgorithm);var W=R$.pbe.getCipher(G,X.encParameter,J),U=R8(X.encryptedContentAsn1),M=l$.util.createBuffer(U.value);if(W.update(M),!W.finish())throw Error("Failed to decrypt PKCS#12 SafeContents.");return W.output.getBytes()}function fV($,J,X){if(!J&&$.length===0)return[];if($=D.fromDer($,J),$.tagClass!==D.Class.UNIVERSAL||$.type!==D.Type.SEQUENCE||$.constructed!==!0)throw Error("PKCS#12 SafeContents expected to be a SEQUENCE OF SafeBag.");var Q=[];for(var Y=0;Y<$.value.length;Y++){var G=$.value[Y],W={},U=[];if(!D.validate(G,PV,W,U)){var M=Error("Cannot read SafeBag.");throw M.errors=U,M}var O={type:D.derToOid(W.bagId),attributes:yV(W.bagAttributes)};Q.push(O);var V,H,q=W.bagValue.value[0];switch(O.type){case R$.oids.pkcs8ShroudedKeyBag:if(q=R$.decryptPrivateKeyInfo(q,X),q===null)throw Error("Unable to decrypt PKCS#8 ShroudedKeyBag, wrong password?");case R$.oids.keyBag:try{O.key=R$.privateKeyFromAsn1(q)}catch(K){O.key=null,O.asn1=q}continue;case R$.oids.certBag:V=xV,H=function(){if(D.derToOid(W.certId)!==R$.oids.x509Certificate){var K=Error("Unsupported certificate type, only X.509 supported.");throw K.oid=D.derToOid(W.certId),K}var A=D.fromDer(W.cert,J);try{O.cert=R$.certificateFromAsn1(A,!0)}catch(L){O.cert=null,O.asn1=A}};break;default:var M=Error("Unsupported PKCS#12 SafeBag type.");throw M.oid=O.type,M}if(V!==void 0&&!D.validate(q,V,W,U)){var M=Error("Cannot read PKCS#12 "+V.name);throw M.errors=U,M}H()}return Q}function yV($){var J={};if($!==void 0)for(var X=0;X<$.length;++X){var Q={},Y=[];if(!D.validate($[X],_V,Q,Y)){var G=Error("Cannot read PKCS#12 BagAttribute.");throw G.errors=Y,G}var W=D.derToOid(Q.oid);if(R$.oids[W]===void 0)continue;J[R$.oids[W]]=[];for(var U=0;U<Q.values.length;++U)J[R$.oids[W]].push(Q.values[U].value)}return J}jX.toPkcs12Asn1=function($,J,X,Q){if(Q=Q||{},Q.saltSize=Q.saltSize||8,Q.count=Q.count||2048,Q.algorithm=Q.algorithm||Q.encAlgorithm||"aes128",!("useMac"in Q))Q.useMac=!0;if(!("localKeyId"in Q))Q.localKeyId=null;if(!("generateLocalKeyId"in Q))Q.generateLocalKeyId=!0;var Y=Q.localKeyId,G;if(Y!==null)Y=l$.util.hexToBytes(Y);else if(Q.generateLocalKeyId)if(J){var W=l$.util.isArray(J)?J[0]:J;if(typeof W==="string")W=R$.certificateFromPem(W);var U=l$.md.sha1.create();U.update(D.toDer(R$.certificateToAsn1(W)).getBytes()),Y=U.digest().getBytes()}else Y=l$.random.getBytes(20);var M=[];if(Y!==null)M.push(D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.localKeyId).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SET,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,Y)])]));if("friendlyName"in Q)M.push(D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.friendlyName).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SET,!0,[D.create(D.Class.UNIVERSAL,D.Type.BMPSTRING,!1,Q.friendlyName)])]));if(M.length>0)G=D.create(D.Class.UNIVERSAL,D.Type.SET,!0,M);var O=[],V=[];if(J!==null)if(l$.util.isArray(J))V=J;else V=[J];var H=[];for(var q=0;q<V.length;++q){if(J=V[q],typeof J==="string")J=R$.certificateFromPem(J);var F=q===0?G:void 0,K=R$.certificateToAsn1(J),A=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.certBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.x509Certificate).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(K).getBytes())])])]),F]);H.push(A)}if(H.length>0){var L=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,H),R=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(L).getBytes())])]);O.push(R)}var I=null;if($!==null){var T=R$.wrapRsaPrivateKey(R$.privateKeyToAsn1($));if(X===null)I=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.keyBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[T]),G]);else I=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.pkcs8ShroudedKeyBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[R$.encryptPrivateKeyInfo(T,X,Q)]),G]);var C=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[I]),w=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(C).getBytes())])]);O.push(w)}var P=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,O),l;if(Q.useMac){var U=l$.md.sha1.create(),k=new l$.util.ByteBuffer(l$.random.getBytes(Q.saltSize)),p=Q.count,$=jX.generateKey(X,k,3,p,20),$$=l$.hmac.create();$$.start(U,$),$$.update(D.toDer(P).getBytes());var N$=$$.getMac();l=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.sha1).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.NULL,!1,"")]),D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,N$.getBytes())]),D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,k.getBytes()),D.create(D.Class.UNIVERSAL,D.Type.INTEGER,!1,D.integerToDer(p).getBytes())])}return D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.INTEGER,!1,D.integerToDer(3).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(R$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(P).getBytes())])]),l])};jX.generateKey=l$.pbe.generatePkcs12Key});var B8=O$((TF,b1)=>{var k0=z$();mJ();P0();F8();JQ();SY();D8();vY();ZX();w$();yY();var Z8=k0.asn1,vQ=b1.exports=k0.pki=k0.pki||{};vQ.pemToDer=function($){var J=k0.pem.decode($)[0];if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PEM to DER; PEM is encrypted.");return k0.util.createBuffer(J.body)};vQ.privateKeyFromPem=function($){var J=k0.pem.decode($)[0];if(J.type!=="PRIVATE KEY"&&J.type!=="RSA PRIVATE KEY"){var X=Error('Could not convert private key from PEM; PEM header type is not "PRIVATE KEY" or "RSA PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert private key from PEM; PEM is encrypted.");var Q=Z8.fromDer(J.body);return vQ.privateKeyFromAsn1(Q)};vQ.privateKeyToPem=function($,J){var X={type:"RSA PRIVATE KEY",body:Z8.toDer(vQ.privateKeyToAsn1($)).getBytes()};return k0.pem.encode(X,{maxline:J})};vQ.privateKeyInfoToPem=function($,J){var X={type:"PRIVATE KEY",body:Z8.toDer($).getBytes()};return k0.pem.encode(X,{maxline:J})}});var w8=O$((SF,c1)=>{var y=z$();mJ();TQ();ZY();JQ();B8();_J();wQ();w$();var uY=function($,J,X,Q){var Y=y.util.createBuffer(),G=$.length>>1,W=G+($.length&1),U=$.substr(0,W),M=$.substr(G,W),O=y.util.createBuffer(),V=y.hmac.create();X=J+X;var H=Math.ceil(Q/16),q=Math.ceil(Q/20);V.start("MD5",U);var F=y.util.createBuffer();O.putBytes(X);for(var K=0;K<H;++K)V.start(null,null),V.update(O.getBytes()),O.putBuffer(V.digest()),V.start(null,null),V.update(O.bytes()+X),F.putBuffer(V.digest());V.start("SHA1",M);var A=y.util.createBuffer();O.clear(),O.putBytes(X);for(var K=0;K<q;++K)V.start(null,null),V.update(O.getBytes()),O.putBuffer(V.digest()),V.start(null,null),V.update(O.bytes()+X),A.putBuffer(V.digest());return Y.putBytes(y.util.xorBytes(F.getBytes(),A.getBytes(),Q)),Y},bV=function($,J,X){var Q=y.hmac.create();Q.start("SHA1",$);var Y=y.util.createBuffer();return Y.putInt32(J[0]),Y.putInt32(J[1]),Y.putByte(X.type),Y.putByte(X.version.major),Y.putByte(X.version.minor),Y.putInt16(X.length),Y.putBytes(X.fragment.bytes()),Q.update(Y.getBytes()),Q.digest().getBytes()},hV=function($,J,X){var Q=!1;try{var Y=$.deflate(J.fragment.getBytes());J.fragment=y.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},uV=function($,J,X){var Q=!1;try{var Y=$.inflate(J.fragment.getBytes());J.fragment=y.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},SJ=function($,J){var X=0;switch(J){case 1:X=$.getByte();break;case 2:X=$.getInt16();break;case 3:X=$.getInt24();break;case 4:X=$.getInt32();break}return y.util.createBuffer($.getBytes(X))},fJ=function($,J,X){$.putInt(X.length(),J<<3),$.putBuffer(X)},N={};N.Versions={TLS_1_0:{major:3,minor:1},TLS_1_1:{major:3,minor:2},TLS_1_2:{major:3,minor:3}};N.SupportedVersions=[N.Versions.TLS_1_1,N.Versions.TLS_1_0];N.Version=N.SupportedVersions[0];N.MaxFragment=15360;N.ConnectionEnd={server:0,client:1};N.PRFAlgorithm={tls_prf_sha256:0};N.BulkCipherAlgorithm={none:null,rc4:0,des3:1,aes:2};N.CipherType={stream:0,block:1,aead:2};N.MACAlgorithm={none:null,hmac_md5:0,hmac_sha1:1,hmac_sha256:2,hmac_sha384:3,hmac_sha512:4};N.CompressionMethod={none:0,deflate:1};N.ContentType={change_cipher_spec:20,alert:21,handshake:22,application_data:23,heartbeat:24};N.HandshakeType={hello_request:0,client_hello:1,server_hello:2,certificate:11,server_key_exchange:12,certificate_request:13,server_hello_done:14,certificate_verify:15,client_key_exchange:16,finished:20};N.Alert={};N.Alert.Level={warning:1,fatal:2};N.Alert.Description={close_notify:0,unexpected_message:10,bad_record_mac:20,decryption_failed:21,record_overflow:22,decompression_failure:30,handshake_failure:40,bad_certificate:42,unsupported_certificate:43,certificate_revoked:44,certificate_expired:45,certificate_unknown:46,illegal_parameter:47,unknown_ca:48,access_denied:49,decode_error:50,decrypt_error:51,export_restriction:60,protocol_version:70,insufficient_security:71,internal_error:80,user_canceled:90,no_renegotiation:100};N.HeartbeatMessageType={heartbeat_request:1,heartbeat_response:2};N.CipherSuites={};N.getCipherSuite=function($){var J=null;for(var X in N.CipherSuites){var Q=N.CipherSuites[X];if(Q.id[0]===$.charCodeAt(0)&&Q.id[1]===$.charCodeAt(1)){J=Q;break}}return J};N.handleUnexpected=function($,J){var X=!$.open&&$.entity===N.ConnectionEnd.client;if(!X)$.error($,{message:"Unexpected message. Received TLS record out of order.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unexpected_message}})};N.handleHelloRequest=function($,J,X){if(!$.handshaking&&$.handshakes>0)N.queue($,N.createAlert($,{level:N.Alert.Level.warning,description:N.Alert.Description.no_renegotiation})),N.flush($);$.process()};N.parseHelloMessage=function($,J,X){var Q=null,Y=$.entity===N.ConnectionEnd.client;if(X<38)$.error($,{message:Y?"Invalid ServerHello message. Message too short.":"Invalid ClientHello message. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});else{var G=J.fragment,W=G.length();if(Q={version:{major:G.getByte(),minor:G.getByte()},random:y.util.createBuffer(G.getBytes(32)),session_id:SJ(G,1),extensions:[]},Y)Q.cipher_suite=G.getBytes(2),Q.compression_method=G.getByte();else Q.cipher_suites=SJ(G,2),Q.compression_methods=SJ(G,1);if(W=X-(W-G.length()),W>0){var U=SJ(G,2);while(U.length()>0)Q.extensions.push({type:[U.getByte(),U.getByte()],data:SJ(U,2)});if(!Y)for(var M=0;M<Q.extensions.length;++M){var O=Q.extensions[M];if(O.type[0]===0&&O.type[1]===0){var V=SJ(O.data,2);while(V.length()>0){var H=V.getByte();if(H!==0)break;$.session.extensions.server_name.serverNameList.push(SJ(V,2).getBytes())}}}}if($.session.version){if(Q.version.major!==$.session.version.major||Q.version.minor!==$.session.version.minor)return $.error($,{message:"TLS version change is disallowed during renegotiation.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}})}if(Y)$.session.cipherSuite=N.getCipherSuite(Q.cipher_suite);else{var q=y.util.createBuffer(Q.cipher_suites.bytes());while(q.length()>0)if($.session.cipherSuite=N.getCipherSuite(q.getBytes(2)),$.session.cipherSuite!==null)break}if($.session.cipherSuite===null)return $.error($,{message:"No cipher suites in common.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.handshake_failure},cipherSuite:y.util.bytesToHex(Q.cipher_suite)});if(Y)$.session.compressionMethod=Q.compression_method;else $.session.compressionMethod=N.CompressionMethod.none}return Q};N.createSecurityParameters=function($,J){var X=$.entity===N.ConnectionEnd.client,Q=J.random.bytes(),Y=X?$.session.sp.client_random:Q,G=X?Q:N.createRandom().getBytes();$.session.sp={entity:$.entity,prf_algorithm:N.PRFAlgorithm.tls_prf_sha256,bulk_cipher_algorithm:null,cipher_type:null,enc_key_length:null,block_length:null,fixed_iv_length:null,record_iv_length:null,mac_algorithm:null,mac_length:null,mac_key_length:null,compression_algorithm:$.session.compressionMethod,pre_master_secret:null,master_secret:null,client_random:Y,server_random:G}};N.handleServerHello=function($,J,X){var Q=N.parseHelloMessage($,J,X);if($.fail)return;if(Q.version.minor<=$.version.minor)$.version.minor=Q.version.minor;else return $.error($,{message:"Incompatible TLS version.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}});$.session.version=$.version;var Y=Q.session_id.bytes();if(Y.length>0&&Y===$.session.id)$.expect=g1,$.session.resuming=!0,$.session.sp.server_random=Q.random.bytes();else $.expect=mV,$.session.resuming=!1,N.createSecurityParameters($,Q);$.session.id=Y,$.process()};N.handleClientHello=function($,J,X){var Q=N.parseHelloMessage($,J,X);if($.fail)return;var Y=Q.session_id.bytes(),G=null;if($.sessionCache){if(G=$.sessionCache.getSession(Y),G===null)Y="";else if(G.version.major!==Q.version.major||G.version.minor>Q.version.minor)G=null,Y=""}if(Y.length===0)Y=y.random.getBytes(32);if($.session.id=Y,$.session.clientHelloVersion=Q.version,$.session.sp={},G)$.version=$.session.version=G.version,$.session.sp=G.sp;else{var W;for(var U=1;U<N.SupportedVersions.length;++U)if(W=N.SupportedVersions[U],W.minor<=Q.version.minor)break;$.version={major:W.major,minor:W.minor},$.session.version=$.version}if(G!==null)$.expect=I8,$.session.resuming=!0,$.session.sp.client_random=Q.random.bytes();else $.expect=$.verifyClient!==!1?oV:S8,$.session.resuming=!1,N.createSecurityParameters($,Q);if($.open=!0,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerHello($)})),$.session.resuming)N.queue($,N.createRecord($,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),$.state.pending=N.createConnectionState($),$.state.current.write=$.state.pending.write,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createFinished($)}));else if(N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificate($)})),!$.fail){if(N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerKeyExchange($)})),$.verifyClient!==!1)N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificateRequest($)}));N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerHelloDone($)}))}N.flush($),$.process()};N.handleCertificate=function($,J,X){if(X<3)return $.error($,{message:"Invalid Certificate message. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_list:SJ(Q,3)},G,W,U=[];try{while(Y.certificate_list.length()>0)G=SJ(Y.certificate_list,3),W=y.asn1.fromDer(G),G=y.pki.certificateFromAsn1(W,!0),U.push(G)}catch(O){return $.error($,{message:"Could not parse certificate list.",cause:O,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate}})}var M=$.entity===N.ConnectionEnd.client;if((M||$.verifyClient===!0)&&U.length===0)$.error($,{message:M?"No server certificate provided.":"No client certificate provided.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});else if(U.length===0)$.expect=M?h1:S8;else{if(M)$.session.serverCertificate=U[0];else $.session.clientCertificate=U[0];if(N.verifyCertificateChain($,U))$.expect=M?h1:S8}$.process()};N.handleServerKeyExchange=function($,J,X){if(X>0)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unsupported_certificate}});$.expect=lV,$.process()};N.handleClientKeyExchange=function($,J,X){if(X<48)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unsupported_certificate}});var Q=J.fragment,Y={enc_pre_master_secret:SJ(Q,2).getBytes()},G=null;if($.getPrivateKey)try{G=$.getPrivateKey($,$.session.serverCertificate),G=y.pki.privateKeyFromPem(G)}catch(M){$.error($,{message:"Could not get private key.",cause:M,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}})}if(G===null)return $.error($,{message:"No private key set.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});try{var W=$.session.sp;W.pre_master_secret=G.decrypt(Y.enc_pre_master_secret);var U=$.session.clientHelloVersion;if(U.major!==W.pre_master_secret.charCodeAt(0)||U.minor!==W.pre_master_secret.charCodeAt(1))throw Error("TLS version rollback attack detected.")}catch(M){W.pre_master_secret=y.random.getBytes(48)}if($.expect=I8,$.session.clientCertificate!==null)$.expect=aV;$.process()};N.handleCertificateRequest=function($,J,X){if(X<3)return $.error($,{message:"Invalid CertificateRequest. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_types:SJ(Q,1),certificate_authorities:SJ(Q,2)};$.session.certificateRequest=Y,$.expect=pV,$.process()};N.handleCertificateVerify=function($,J,X){if(X<2)return $.error($,{message:"Invalid CertificateVerify. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G={signature:SJ(Q,2).getBytes()},W=y.util.createBuffer();W.putBuffer($.session.md5.digest()),W.putBuffer($.session.sha1.digest()),W=W.getBytes();try{var U=$.session.clientCertificate;if(!U.publicKey.verify(W,G.signature,"NONE"))throw Error("CertificateVerify signature does not match.");$.session.md5.update(Y),$.session.sha1.update(Y)}catch(M){return $.error($,{message:"Bad signature in CertificateVerify.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.handshake_failure}})}$.expect=I8,$.process()};N.handleServerHelloDone=function($,J,X){if(X>0)return $.error($,{message:"Invalid ServerHelloDone message. Invalid length.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.record_overflow}});if($.serverCertificate===null){var Q={message:"No server certificate provided. Not enough security.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.insufficient_security}},Y=0,G=$.verify($,Q.alert.description,Y,[]);if(G!==!0){if(G||G===0){if(typeof G==="object"&&!y.util.isArray(G)){if(G.message)Q.message=G.message;if(G.alert)Q.alert.description=G.alert}else if(typeof G==="number")Q.alert.description=G}return $.error($,Q)}}if($.session.certificateRequest!==null)J=N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificate($)}),N.queue($,J);J=N.createRecord($,{type:N.ContentType.handshake,data:N.createClientKeyExchange($)}),N.queue($,J),$.expect=nV;var W=function(U,M){if(U.session.certificateRequest!==null&&U.session.clientCertificate!==null)N.queue(U,N.createRecord(U,{type:N.ContentType.handshake,data:N.createCertificateVerify(U,M)}));N.queue(U,N.createRecord(U,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),U.state.pending=N.createConnectionState(U),U.state.current.write=U.state.pending.write,N.queue(U,N.createRecord(U,{type:N.ContentType.handshake,data:N.createFinished(U)})),U.expect=g1,N.flush(U),U.process()};if($.session.certificateRequest===null||$.session.clientCertificate===null)return W($,null);N.getClientSignature($,W)};N.handleChangeCipherSpec=function($,J){if(J.fragment.getByte()!==1)return $.error($,{message:"Invalid ChangeCipherSpec message received.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var X=$.entity===N.ConnectionEnd.client;if($.session.resuming&&X||!$.session.resuming&&!X)$.state.pending=N.createConnectionState($);if($.state.current.read=$.state.pending.read,!$.session.resuming&&X||$.session.resuming&&!X)$.state.pending=null;$.expect=X?dV:sV,$.process()};N.handleFinished=function($,J,X){var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G=J.fragment.getBytes();Q=y.util.createBuffer(),Q.putBuffer($.session.md5.digest()),Q.putBuffer($.session.sha1.digest());var W=$.entity===N.ConnectionEnd.client,U=W?"server finished":"client finished",M=$.session.sp,O=12,V=uY;if(Q=V(M.master_secret,U,Q.getBytes(),O),Q.getBytes()!==G)return $.error($,{message:"Invalid verify_data in Finished message.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.decrypt_error}});if($.session.md5.update(Y),$.session.sha1.update(Y),$.session.resuming&&W||!$.session.resuming&&!W)N.queue($,N.createRecord($,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),$.state.current.write=$.state.pending.write,$.state.pending=null,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createFinished($)}));$.expect=W?cV:rV,$.handshaking=!1,++$.handshakes,$.peerCertificate=W?$.session.serverCertificate:$.session.clientCertificate,N.flush($),$.isConnected=!0,$.connected($),$.process()};N.handleAlert=function($,J){var X=J.fragment,Q={level:X.getByte(),description:X.getByte()},Y;switch(Q.description){case N.Alert.Description.close_notify:Y="Connection closed.";break;case N.Alert.Description.unexpected_message:Y="Unexpected message.";break;case N.Alert.Description.bad_record_mac:Y="Bad record MAC.";break;case N.Alert.Description.decryption_failed:Y="Decryption failed.";break;case N.Alert.Description.record_overflow:Y="Record overflow.";break;case N.Alert.Description.decompression_failure:Y="Decompression failed.";break;case N.Alert.Description.handshake_failure:Y="Handshake failure.";break;case N.Alert.Description.bad_certificate:Y="Bad certificate.";break;case N.Alert.Description.unsupported_certificate:Y="Unsupported certificate.";break;case N.Alert.Description.certificate_revoked:Y="Certificate revoked.";break;case N.Alert.Description.certificate_expired:Y="Certificate expired.";break;case N.Alert.Description.certificate_unknown:Y="Certificate unknown.";break;case N.Alert.Description.illegal_parameter:Y="Illegal parameter.";break;case N.Alert.Description.unknown_ca:Y="Unknown certificate authority.";break;case N.Alert.Description.access_denied:Y="Access denied.";break;case N.Alert.Description.decode_error:Y="Decode error.";break;case N.Alert.Description.decrypt_error:Y="Decrypt error.";break;case N.Alert.Description.export_restriction:Y="Export restriction.";break;case N.Alert.Description.protocol_version:Y="Unsupported protocol version.";break;case N.Alert.Description.insufficient_security:Y="Insufficient security.";break;case N.Alert.Description.internal_error:Y="Internal error.";break;case N.Alert.Description.user_canceled:Y="User canceled.";break;case N.Alert.Description.no_renegotiation:Y="Renegotiation not supported.";break;default:Y="Unknown error.";break}if(Q.description===N.Alert.Description.close_notify)return $.close();$.error($,{message:Y,send:!1,origin:$.entity===N.ConnectionEnd.client?"server":"client",alert:Q}),$.process()};N.handleHandshake=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt24();if(Y>X.length())return $.fragmented=J,J.fragment=y.util.createBuffer(),X.read-=4,$.process();$.fragmented=null,X.read-=4;var G=X.bytes(Y+4);if(X.read+=4,Q in hY[$.entity][$.expect]){if($.entity===N.ConnectionEnd.server&&!$.open&&!$.fail)$.handshaking=!0,$.session={version:null,extensions:{server_name:{serverNameList:[]}},cipherSuite:null,compressionMethod:null,serverCertificate:null,clientCertificate:null,md5:y.md.md5.create(),sha1:y.md.sha1.create()};if(Q!==N.HandshakeType.hello_request&&Q!==N.HandshakeType.certificate_verify&&Q!==N.HandshakeType.finished)$.session.md5.update(G),$.session.sha1.update(G);hY[$.entity][$.expect][Q]($,J,Y)}else N.handleUnexpected($,J)};N.handleApplicationData=function($,J){$.data.putBuffer(J.fragment),$.dataReady($),$.process()};N.handleHeartbeat=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt16(),G=X.getBytes(Y);if(Q===N.HeartbeatMessageType.heartbeat_request){if($.handshaking||Y>G.length)return $.process();N.queue($,N.createRecord($,{type:N.ContentType.heartbeat,data:N.createHeartbeat(N.HeartbeatMessageType.heartbeat_response,G)})),N.flush($)}else if(Q===N.HeartbeatMessageType.heartbeat_response){if(G!==$.expectedHeartbeatPayload)return $.process();if($.heartbeatReceived)$.heartbeatReceived($,y.util.createBuffer(G))}$.process()};var gV=0,mV=1,h1=2,lV=3,pV=4,g1=5,dV=6,cV=7,nV=8,iV=0,oV=1,S8=2,aV=3,I8=4,sV=5,rV=6,E=N.handleUnexpected,m1=N.handleChangeCipherSpec,qJ=N.handleAlert,RJ=N.handleHandshake,l1=N.handleApplicationData,KJ=N.handleHeartbeat,C8=[];C8[N.ConnectionEnd.client]=[[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[m1,qJ,E,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,l1,KJ],[E,qJ,RJ,E,KJ]];C8[N.ConnectionEnd.server]=[[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[m1,qJ,E,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,l1,KJ],[E,qJ,RJ,E,KJ]];var{handleHelloRequest:f0,handleServerHello:tV,handleCertificate:p1,handleServerKeyExchange:u1,handleCertificateRequest:j8,handleServerHelloDone:bY,handleFinished:d1}=N,hY=[];hY[N.ConnectionEnd.client]=[[E,E,tV,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,p1,u1,j8,bY,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,u1,j8,bY,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,j8,bY,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,bY,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,d1],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E]];var{handleClientHello:eV,handleClientKeyExchange:$H,handleCertificateVerify:JH}=N;hY[N.ConnectionEnd.server]=[[E,eV,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,p1,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,$H,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,JH,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,d1],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E]];N.generateKeys=function($,J){var X=uY,Q=J.client_random+J.server_random;if(!$.session.resuming)J.master_secret=X(J.pre_master_secret,"master secret",Q,48).bytes(),J.pre_master_secret=null;Q=J.server_random+J.client_random;var Y=2*J.mac_key_length+2*J.enc_key_length,G=$.version.major===N.Versions.TLS_1_0.major&&$.version.minor===N.Versions.TLS_1_0.minor;if(G)Y+=2*J.fixed_iv_length;var W=X(J.master_secret,"key expansion",Q,Y),U={client_write_MAC_key:W.getBytes(J.mac_key_length),server_write_MAC_key:W.getBytes(J.mac_key_length),client_write_key:W.getBytes(J.enc_key_length),server_write_key:W.getBytes(J.enc_key_length)};if(G)U.client_write_IV=W.getBytes(J.fixed_iv_length),U.server_write_IV=W.getBytes(J.fixed_iv_length);return U};N.createConnectionState=function($){var J=$.entity===N.ConnectionEnd.client,X=function(){var G={sequenceNumber:[0,0],macKey:null,macLength:0,macFunction:null,cipherState:null,cipherFunction:function(W){return!0},compressionState:null,compressFunction:function(W){return!0},updateSequenceNumber:function(){if(G.sequenceNumber[1]===4294967295)G.sequenceNumber[1]=0,++G.sequenceNumber[0];else++G.sequenceNumber[1]}};return G},Q={read:X(),write:X()};if(Q.read.update=function(G,W){if(!Q.read.cipherFunction(W,Q.read))G.error(G,{message:"Could not decrypt record or bad MAC.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_record_mac}});else if(!Q.read.compressFunction(G,W,Q.read))G.error(G,{message:"Could not decompress record.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.decompression_failure}});return!G.fail},Q.write.update=function(G,W){if(!Q.write.compressFunction(G,W,Q.write))G.error(G,{message:"Could not compress record.",send:!1,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});else if(!Q.write.cipherFunction(W,Q.write))G.error(G,{message:"Could not encrypt record.",send:!1,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});return!G.fail},$.session){var Y=$.session.sp;switch($.session.cipherSuite.initSecurityParameters(Y),Y.keys=N.generateKeys($,Y),Q.read.macKey=J?Y.keys.server_write_MAC_key:Y.keys.client_write_MAC_key,Q.write.macKey=J?Y.keys.client_write_MAC_key:Y.keys.server_write_MAC_key,$.session.cipherSuite.initConnectionState(Q,$,Y),Y.compression_algorithm){case N.CompressionMethod.none:break;case N.CompressionMethod.deflate:Q.read.compressFunction=uV,Q.write.compressFunction=hV;break;default:throw Error("Unsupported compression algorithm.")}}return Q};N.createRandom=function(){var $=new Date,J=+$+$.getTimezoneOffset()*60000,X=y.util.createBuffer();return X.putInt32(J),X.putBytes(y.random.getBytes(28)),X};N.createRecord=function($,J){if(!J.data)return null;var X={type:J.type,version:{major:$.version.major,minor:$.version.minor},length:J.data.length(),fragment:J.data};return X};N.createAlert=function($,J){var X=y.util.createBuffer();return X.putByte(J.level),X.putByte(J.description),N.createRecord($,{type:N.ContentType.alert,data:X})};N.createClientHello=function($){$.session.clientHelloVersion={major:$.version.major,minor:$.version.minor};var J=y.util.createBuffer();for(var X=0;X<$.cipherSuites.length;++X){var Q=$.cipherSuites[X];J.putByte(Q.id[0]),J.putByte(Q.id[1])}var Y=J.length(),G=y.util.createBuffer();G.putByte(N.CompressionMethod.none);var W=G.length(),U=y.util.createBuffer();if($.virtualHost){var M=y.util.createBuffer();M.putByte(0),M.putByte(0);var O=y.util.createBuffer();O.putByte(0),fJ(O,2,y.util.createBuffer($.virtualHost));var V=y.util.createBuffer();fJ(V,2,O),fJ(M,2,V),U.putBuffer(M)}var H=U.length();if(H>0)H+=2;var q=$.session.id,F=q.length+1+2+4+28+2+Y+1+W+H,K=y.util.createBuffer();if(K.putByte(N.HandshakeType.client_hello),K.putInt24(F),K.putByte($.version.major),K.putByte($.version.minor),K.putBytes($.session.sp.client_random),fJ(K,1,y.util.createBuffer(q)),fJ(K,2,J),fJ(K,1,G),H>0)fJ(K,2,U);return K};N.createServerHello=function($){var J=$.session.id,X=J.length+1+2+4+28+2+1,Q=y.util.createBuffer();return Q.putByte(N.HandshakeType.server_hello),Q.putInt24(X),Q.putByte($.version.major),Q.putByte($.version.minor),Q.putBytes($.session.sp.server_random),fJ(Q,1,y.util.createBuffer(J)),Q.putByte($.session.cipherSuite.id[0]),Q.putByte($.session.cipherSuite.id[1]),Q.putByte($.session.compressionMethod),Q};N.createCertificate=function($){var J=$.entity===N.ConnectionEnd.client,X=null;if($.getCertificate){var Q;if(J)Q=$.session.certificateRequest;else Q=$.session.extensions.server_name.serverNameList;X=$.getCertificate($,Q)}var Y=y.util.createBuffer();if(X!==null)try{if(!y.util.isArray(X))X=[X];var G=null;for(var W=0;W<X.length;++W){var U=y.pem.decode(X[W])[0];if(U.type!=="CERTIFICATE"&&U.type!=="X509 CERTIFICATE"&&U.type!=="TRUSTED CERTIFICATE"){var M=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw M.headerType=U.type,M}if(U.procType&&U.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var O=y.util.createBuffer(U.body);if(G===null)G=y.asn1.fromDer(O.bytes(),!1);var V=y.util.createBuffer();fJ(V,3,O),Y.putBuffer(V)}if(X=y.pki.certificateFromAsn1(G),J)$.session.clientCertificate=X;else $.session.serverCertificate=X}catch(F){return $.error($,{message:"Could not send certificate list.",cause:F,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate}})}var H=3+Y.length(),q=y.util.createBuffer();return q.putByte(N.HandshakeType.certificate),q.putInt24(H),fJ(q,3,Y),q};N.createClientKeyExchange=function($){var J=y.util.createBuffer();J.putByte($.session.clientHelloVersion.major),J.putByte($.session.clientHelloVersion.minor),J.putBytes(y.random.getBytes(46));var X=$.session.sp;X.pre_master_secret=J.getBytes();var Q=$.session.serverCertificate.publicKey;J=Q.encrypt(X.pre_master_secret);var Y=J.length+2,G=y.util.createBuffer();return G.putByte(N.HandshakeType.client_key_exchange),G.putInt24(Y),G.putInt16(J.length),G.putBytes(J),G};N.createServerKeyExchange=function($){var J=0,X=y.util.createBuffer();if(J>0)X.putByte(N.HandshakeType.server_key_exchange),X.putInt24(J);return X};N.getClientSignature=function($,J){var X=y.util.createBuffer();X.putBuffer($.session.md5.digest()),X.putBuffer($.session.sha1.digest()),X=X.getBytes(),$.getSignature=$.getSignature||function(Q,Y,G){var W=null;if(Q.getPrivateKey)try{W=Q.getPrivateKey(Q,Q.session.clientCertificate),W=y.pki.privateKeyFromPem(W)}catch(U){Q.error(Q,{message:"Could not get private key.",cause:U,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}})}if(W===null)Q.error(Q,{message:"No private key set.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});else Y=W.sign(Y,null);G(Q,Y)},$.getSignature($,X,J)};N.createCertificateVerify=function($,J){var X=J.length+2,Q=y.util.createBuffer();return Q.putByte(N.HandshakeType.certificate_verify),Q.putInt24(X),Q.putInt16(J.length),Q.putBytes(J),Q};N.createCertificateRequest=function($){var J=y.util.createBuffer();J.putByte(1);var X=y.util.createBuffer();for(var Q in $.caStore.certs){var Y=$.caStore.certs[Q],G=y.pki.distinguishedNameToAsn1(Y.subject),W=y.asn1.toDer(G);X.putInt16(W.length()),X.putBuffer(W)}var U=1+J.length()+2+X.length(),M=y.util.createBuffer();return M.putByte(N.HandshakeType.certificate_request),M.putInt24(U),fJ(M,1,J),fJ(M,2,X),M};N.createServerHelloDone=function($){var J=y.util.createBuffer();return J.putByte(N.HandshakeType.server_hello_done),J.putInt24(0),J};N.createChangeCipherSpec=function(){var $=y.util.createBuffer();return $.putByte(1),$};N.createFinished=function($){var J=y.util.createBuffer();J.putBuffer($.session.md5.digest()),J.putBuffer($.session.sha1.digest());var X=$.entity===N.ConnectionEnd.client,Q=$.session.sp,Y=12,G=uY,W=X?"client finished":"server finished";J=G(Q.master_secret,W,J.getBytes(),Y);var U=y.util.createBuffer();return U.putByte(N.HandshakeType.finished),U.putInt24(J.length()),U.putBuffer(J),U};N.createHeartbeat=function($,J,X){if(typeof X>"u")X=J.length;var Q=y.util.createBuffer();Q.putByte($),Q.putInt16(X),Q.putBytes(J);var Y=Q.length(),G=Math.max(16,Y-X-3);return Q.putBytes(y.random.getBytes(G)),Q};N.queue=function($,J){if(!J)return;if(J.fragment.length()===0){if(J.type===N.ContentType.handshake||J.type===N.ContentType.alert||J.type===N.ContentType.change_cipher_spec)return}if(J.type===N.ContentType.handshake){var X=J.fragment.bytes();$.session.md5.update(X),$.session.sha1.update(X),X=null}var Q;if(J.fragment.length()<=N.MaxFragment)Q=[J];else{Q=[];var Y=J.fragment.bytes();while(Y.length>N.MaxFragment)Q.push(N.createRecord($,{type:J.type,data:y.util.createBuffer(Y.slice(0,N.MaxFragment))})),Y=Y.slice(N.MaxFragment);if(Y.length>0)Q.push(N.createRecord($,{type:J.type,data:y.util.createBuffer(Y)}))}for(var G=0;G<Q.length&&!$.fail;++G){var W=Q[G],U=$.state.current.write;if(U.update($,W))$.records.push(W)}};N.flush=function($){for(var J=0;J<$.records.length;++J){var X=$.records[J];$.tlsData.putByte(X.type),$.tlsData.putByte(X.version.major),$.tlsData.putByte(X.version.minor),$.tlsData.putInt16(X.fragment.length()),$.tlsData.putBuffer($.records[J].fragment)}return $.records=[],$.tlsDataReady($)};var T8=function($){switch($){case!0:return!0;case y.pki.certificateError.bad_certificate:return N.Alert.Description.bad_certificate;case y.pki.certificateError.unsupported_certificate:return N.Alert.Description.unsupported_certificate;case y.pki.certificateError.certificate_revoked:return N.Alert.Description.certificate_revoked;case y.pki.certificateError.certificate_expired:return N.Alert.Description.certificate_expired;case y.pki.certificateError.certificate_unknown:return N.Alert.Description.certificate_unknown;case y.pki.certificateError.unknown_ca:return N.Alert.Description.unknown_ca;default:return N.Alert.Description.bad_certificate}},QH=function($){switch($){case!0:return!0;case N.Alert.Description.bad_certificate:return y.pki.certificateError.bad_certificate;case N.Alert.Description.unsupported_certificate:return y.pki.certificateError.unsupported_certificate;case N.Alert.Description.certificate_revoked:return y.pki.certificateError.certificate_revoked;case N.Alert.Description.certificate_expired:return y.pki.certificateError.certificate_expired;case N.Alert.Description.certificate_unknown:return y.pki.certificateError.certificate_unknown;case N.Alert.Description.unknown_ca:return y.pki.certificateError.unknown_ca;default:return y.pki.certificateError.bad_certificate}};N.verifyCertificateChain=function($,J){try{var X={};for(var Q in $.verifyOptions)X[Q]=$.verifyOptions[Q];X.verify=function(G,W,U){var M=T8(G),O=$.verify($,G,W,U);if(O!==!0){if(typeof O==="object"&&!y.util.isArray(O)){var V=Error("The application rejected the certificate.");if(V.send=!0,V.alert={level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate},O.message)V.message=O.message;if(O.alert)V.alert.description=O.alert;throw V}if(O!==G)O=QH(O)}return O},y.pki.verifyCertificateChain($.caStore,J,X)}catch(G){var Y=G;if(typeof Y!=="object"||y.util.isArray(Y))Y={send:!0,alert:{level:N.Alert.Level.fatal,description:T8(G)}};if(!("send"in Y))Y.send=!0;if(!("alert"in Y))Y.alert={level:N.Alert.Level.fatal,description:T8(Y.error)};$.error($,Y)}return!$.fail};N.createSessionCache=function($,J){var X=null;if($&&$.getSession&&$.setSession&&$.order)X=$;else{X={},X.cache=$||{},X.capacity=Math.max(J||100,1),X.order=[];for(var Q in $)if(X.order.length<=J)X.order.push(Q);else delete $[Q];X.getSession=function(Y){var G=null,W=null;if(Y)W=y.util.bytesToHex(Y);else if(X.order.length>0)W=X.order[0];if(W!==null&&W in X.cache){G=X.cache[W],delete X.cache[W];for(var U in X.order)if(X.order[U]===W){X.order.splice(U,1);break}}return G},X.setSession=function(Y,G){if(X.order.length===X.capacity){var W=X.order.shift();delete X.cache[W]}var W=y.util.bytesToHex(Y);X.order.push(W),X.cache[W]=G}}return X};N.createConnection=function($){var J=null;if($.caStore)if(y.util.isArray($.caStore))J=y.pki.createCaStore($.caStore);else J=$.caStore;else J=y.pki.createCaStore();var X=$.cipherSuites||null;if(X===null){X=[];for(var Q in N.CipherSuites)X.push(N.CipherSuites[Q])}var Y=$.server?N.ConnectionEnd.server:N.ConnectionEnd.client,G=$.sessionCache?N.createSessionCache($.sessionCache):null,W={version:{major:N.Version.major,minor:N.Version.minor},entity:Y,sessionId:$.sessionId,caStore:J,sessionCache:G,cipherSuites:X,connected:$.connected,virtualHost:$.virtualHost||null,verifyClient:$.verifyClient||!1,verify:$.verify||function(V,H,q,F){return H},verifyOptions:$.verifyOptions||{},getCertificate:$.getCertificate||null,getPrivateKey:$.getPrivateKey||null,getSignature:$.getSignature||null,input:y.util.createBuffer(),tlsData:y.util.createBuffer(),data:y.util.createBuffer(),tlsDataReady:$.tlsDataReady,dataReady:$.dataReady,heartbeatReceived:$.heartbeatReceived,closed:$.closed,error:function(V,H){if(H.origin=H.origin||(V.entity===N.ConnectionEnd.client?"client":"server"),H.send)N.queue(V,N.createAlert(V,H.alert)),N.flush(V);var q=H.fatal!==!1;if(q)V.fail=!0;if($.error(V,H),q)V.close(!1)},deflate:$.deflate||null,inflate:$.inflate||null};W.reset=function(V){W.version={major:N.Version.major,minor:N.Version.minor},W.record=null,W.session=null,W.peerCertificate=null,W.state={pending:null,current:null},W.expect=W.entity===N.ConnectionEnd.client?gV:iV,W.fragmented=null,W.records=[],W.open=!1,W.handshakes=0,W.handshaking=!1,W.isConnected=!1,W.fail=!(V||typeof V>"u"),W.input.clear(),W.tlsData.clear(),W.data.clear(),W.state.current=N.createConnectionState(W)},W.reset();var U=function(V,H){var q=H.type-N.ContentType.change_cipher_spec,F=C8[V.entity][V.expect];if(q in F)F[q](V,H);else N.handleUnexpected(V,H)},M=function(V){var H=0,q=V.input,F=q.length();if(F<5)H=5-F;else{V.record={type:q.getByte(),version:{major:q.getByte(),minor:q.getByte()},length:q.getInt16(),fragment:y.util.createBuffer(),ready:!1};var K=V.record.version.major===V.version.major;if(K&&V.session&&V.session.version)K=V.record.version.minor===V.version.minor;if(!K)V.error(V,{message:"Incompatible TLS version.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}})}return H},O=function(V){var H=0,q=V.input,F=q.length();if(F<V.record.length)H=V.record.length-F;else{V.record.fragment.putBytes(q.getBytes(V.record.length)),q.compact();var K=V.state.current.read;if(K.update(V,V.record)){if(V.fragmented!==null)if(V.fragmented.type===V.record.type)V.fragmented.fragment.putBuffer(V.record.fragment),V.record=V.fragmented;else V.error(V,{message:"Invalid fragmented record.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unexpected_message}});V.record.ready=!0}}return H};return W.handshake=function(V){if(W.entity!==N.ConnectionEnd.client)W.error(W,{message:"Cannot initiate handshake as a server.",fatal:!1});else if(W.handshaking)W.error(W,{message:"Handshake already in progress.",fatal:!1});else{if(W.fail&&!W.open&&W.handshakes===0)W.fail=!1;W.handshaking=!0,V=V||"";var H=null;if(V.length>0){if(W.sessionCache)H=W.sessionCache.getSession(V);if(H===null)V=""}if(V.length===0&&W.sessionCache){if(H=W.sessionCache.getSession(),H!==null)V=H.id}if(W.session={id:V,version:null,cipherSuite:null,compressionMethod:null,serverCertificate:null,certificateRequest:null,clientCertificate:null,sp:{},md5:y.md.md5.create(),sha1:y.md.sha1.create()},H)W.version=H.version,W.session.sp=H.sp;W.session.sp.client_random=N.createRandom().getBytes(),W.open=!0,N.queue(W,N.createRecord(W,{type:N.ContentType.handshake,data:N.createClientHello(W)})),N.flush(W)}},W.process=function(V){var H=0;if(V)W.input.putBytes(V);if(!W.fail){if(W.record!==null&&W.record.ready&&W.record.fragment.isEmpty())W.record=null;if(W.record===null)H=M(W);if(!W.fail&&W.record!==null&&!W.record.ready)H=O(W);if(!W.fail&&W.record!==null&&W.record.ready)U(W,W.record)}return H},W.prepare=function(V){return N.queue(W,N.createRecord(W,{type:N.ContentType.application_data,data:y.util.createBuffer(V)})),N.flush(W)},W.prepareHeartbeatRequest=function(V,H){if(V instanceof y.util.ByteBuffer)V=V.bytes();if(typeof H>"u")H=V.length;return W.expectedHeartbeatPayload=V,N.queue(W,N.createRecord(W,{type:N.ContentType.heartbeat,data:N.createHeartbeat(N.HeartbeatMessageType.heartbeat_request,V,H)})),N.flush(W)},W.close=function(V){if(!W.fail&&W.sessionCache&&W.session){var H={id:W.session.id,version:W.session.version,sp:W.session.sp};H.sp.keys=null,W.sessionCache.setSession(H.id,H)}if(W.open){if(W.open=!1,W.input.clear(),W.isConnected||W.handshaking)W.isConnected=W.handshaking=!1,N.queue(W,N.createAlert(W,{level:N.Alert.Level.warning,description:N.Alert.Description.close_notify})),N.flush(W);W.closed(W)}W.reset(V)},W};c1.exports=y.tls=y.tls||{};for(TX in N)if(typeof N[TX]!=="function")y.tls[TX]=N[TX];var TX;y.tls.prf_tls1=uY;y.tls.hmac_sha1=bV;y.tls.createSessionCache=N.createSessionCache;y.tls.createConnection=N.createConnection});var o1=O$((IF,i1)=>{var y0=z$();w0();w8();var yJ=i1.exports=y0.tls;yJ.CipherSuites.TLS_RSA_WITH_AES_128_CBC_SHA={id:[0,47],name:"TLS_RSA_WITH_AES_128_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=yJ.BulkCipherAlgorithm.aes,$.cipher_type=yJ.CipherType.block,$.enc_key_length=16,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=yJ.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:n1};yJ.CipherSuites.TLS_RSA_WITH_AES_256_CBC_SHA={id:[0,53],name:"TLS_RSA_WITH_AES_256_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=yJ.BulkCipherAlgorithm.aes,$.cipher_type=yJ.CipherType.block,$.enc_key_length=32,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=yJ.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:n1};function n1($,J,X){var Q=J.entity===y0.tls.ConnectionEnd.client;$.read.cipherState={init:!1,cipher:y0.cipher.createDecipher("AES-CBC",Q?X.keys.server_write_key:X.keys.client_write_key),iv:Q?X.keys.server_write_IV:X.keys.client_write_IV},$.write.cipherState={init:!1,cipher:y0.cipher.createCipher("AES-CBC",Q?X.keys.client_write_key:X.keys.server_write_key),iv:Q?X.keys.client_write_IV:X.keys.server_write_IV},$.read.cipherFunction=WH,$.write.cipherFunction=XH,$.read.macLength=$.write.macLength=X.mac_length,$.read.macFunction=$.write.macFunction=yJ.hmac_sha1}function XH($,J){var X=!1,Q=J.macFunction(J.macKey,J.sequenceNumber,$);$.fragment.putBytes(Q),J.updateSequenceNumber();var Y;if($.version.minor===yJ.Versions.TLS_1_0.minor)Y=J.cipherState.init?null:J.cipherState.iv;else Y=y0.random.getBytesSync(16);J.cipherState.init=!0;var G=J.cipherState.cipher;if(G.start({iv:Y}),$.version.minor>=yJ.Versions.TLS_1_1.minor)G.output.putBytes(Y);if(G.update($.fragment),G.finish(YH))$.fragment=G.output,$.length=$.fragment.length(),X=!0;return X}function YH($,J,X){if(!X){var Q=$-J.length()%$;J.fillWithByte(Q-1,Q)}return!0}function GH($,J,X){var Q=!0;if(X){var Y=J.length(),G=J.last();for(var W=Y-1-G;W<Y-1;++W)Q=Q&&J.at(W)==G;if(Q)J.truncate(G+1)}return Q}function WH($,J){var X=!1,Q;if($.version.minor===yJ.Versions.TLS_1_0.minor)Q=J.cipherState.init?null:J.cipherState.iv;else Q=$.fragment.getBytes(16);J.cipherState.init=!0;var Y=J.cipherState.cipher;Y.start({iv:Q}),Y.update($.fragment),X=Y.finish(GH);var G=J.macLength,W=y0.random.getBytesSync(G),U=Y.output.length();if(U>=G)$.fragment=Y.output.getBytes(U-G),W=Y.output.getBytes(G);else $.fragment=Y.output.getBytes();$.fragment=y0.util.createBuffer($.fragment),$.length=$.fragment.length();var M=J.macFunction(J.macKey,J.sequenceNumber,$);return J.updateSequenceNumber(),X=UH(J.macKey,W,M)&&X,X}function UH($,J,X){var Q=y0.hmac.create();return Q.start("SHA1",$),Q.update(J),J=Q.digest().getBytes(),Q.start(null,null),Q.update(X),X=Q.digest().getBytes(),J===X}});var x8=O$((CF,t1)=>{var d$=z$();eJ();w$();var SX=t1.exports=d$.sha512=d$.sha512||{};d$.md.sha512=d$.md.algorithms.sha512=SX;var s1=d$.sha384=d$.sha512.sha384=d$.sha512.sha384||{};s1.create=function(){return SX.create("SHA-384")};d$.md.sha384=d$.md.algorithms.sha384=s1;d$.sha512.sha256=d$.sha512.sha256||{create:function(){return SX.create("SHA-512/256")}};d$.md["sha512/256"]=d$.md.algorithms["sha512/256"]=d$.sha512.sha256;d$.sha512.sha224=d$.sha512.sha224||{create:function(){return SX.create("SHA-512/224")}};d$.md["sha512/224"]=d$.md.algorithms["sha512/224"]=d$.sha512.sha224;SX.create=function($){if(!r1)MH();if(typeof $>"u")$="SHA-512";if(!($ in UQ))throw Error("Invalid SHA-512 algorithm: "+$);var J=UQ[$],X=null,Q=d$.util.createBuffer(),Y=Array(80);for(var G=0;G<80;++G)Y[G]=[,,];var W=64;switch($){case"SHA-384":W=48;break;case"SHA-512/256":W=32;break;case"SHA-512/224":W=28;break}var U={algorithm:$.replace("-","").toLowerCase(),blockLength:128,digestLength:W,messageLength:0,fullMessageLength:null,messageLengthSize:16};return U.start=function(){U.messageLength=0,U.fullMessageLength=U.messageLength128=[];var M=U.messageLengthSize/4;for(var O=0;O<M;++O)U.fullMessageLength.push(0);Q=d$.util.createBuffer(),X=Array(J.length);for(var O=0;O<J.length;++O)X[O]=J[O].slice(0);return U},U.start(),U.update=function(M,O){if(O==="utf8")M=d$.util.encodeUtf8(M);var V=M.length;U.messageLength+=V,V=[V/4294967296>>>0,V>>>0];for(var H=U.fullMessageLength.length-1;H>=0;--H)U.fullMessageLength[H]+=V[1],V[1]=V[0]+(U.fullMessageLength[H]/4294967296>>>0),U.fullMessageLength[H]=U.fullMessageLength[H]>>>0,V[0]=V[1]/4294967296>>>0;if(Q.putBytes(M),a1(X,Y,Q),Q.read>2048||Q.length()===0)Q.compact();return U},U.digest=function(){var M=d$.util.createBuffer();M.putBytes(Q.bytes());var O=U.fullMessageLength[U.fullMessageLength.length-1]+U.messageLengthSize,V=O&U.blockLength-1;M.putBytes(P8.substr(0,U.blockLength-V));var H,q,F=U.fullMessageLength[0]*8;for(var K=0;K<U.fullMessageLength.length-1;++K)H=U.fullMessageLength[K+1]*8,q=H/4294967296>>>0,F+=q,M.putInt32(F>>>0),F=H>>>0;M.putInt32(F);var A=Array(X.length);for(var K=0;K<X.length;++K)A[K]=X[K].slice(0);a1(A,Y,M);var L=d$.util.createBuffer(),R;if($==="SHA-512")R=A.length;else if($==="SHA-384")R=A.length-2;else R=A.length-4;for(var K=0;K<R;++K)if(L.putInt32(A[K][0]),K!==R-1||$!=="SHA-512/224")L.putInt32(A[K][1]);return L},U};var P8=null,r1=!1,_8=null,UQ=null;function MH(){P8=String.fromCharCode(128),P8+=d$.util.fillString(String.fromCharCode(0),128),_8=[[1116352408,3609767458],[1899447441,602891725],[3049323471,3964484399],[3921009573,2173295548],[961987163,4081628472],[1508970993,3053834265],[2453635748,2937671579],[2870763221,3664609560],[3624381080,2734883394],[310598401,1164996542],[607225278,1323610764],[1426881987,3590304994],[1925078388,4068182383],[2162078206,991336113],[2614888103,633803317],[3248222580,3479774868],[3835390401,2666613458],[4022224774,944711139],[264347078,2341262773],[604807628,2007800933],[770255983,1495990901],[1249150122,1856431235],[1555081692,3175218132],[1996064986,2198950837],[2554220882,3999719339],[2821834349,766784016],[2952996808,2566594879],[3210313671,3203337956],[3336571891,1034457026],[3584528711,2466948901],[113926993,3758326383],[338241895,168717936],[666307205,1188179964],[773529912,1546045734],[1294757372,1522805485],[1396182291,2643833823],[1695183700,2343527390],[1986661051,1014477480],[2177026350,1206759142],[2456956037,344077627],[2730485921,1290863460],[2820302411,3158454273],[3259730800,3505952657],[3345764771,106217008],[3516065817,3606008344],[3600352804,1432725776],[4094571909,1467031594],[275423344,851169720],[430227734,3100823752],[506948616,1363258195],[659060556,3750685593],[883997877,3785050280],[958139571,3318307427],[1322822218,3812723403],[1537002063,2003034995],[1747873779,3602036899],[1955562222,1575990012],[2024104815,1125592928],[2227730452,2716904306],[2361852424,442776044],[2428436474,593698344],[2756734187,3733110249],[3204031479,2999351573],[3329325298,3815920427],[3391569614,3928383900],[3515267271,566280711],[3940187606,3454069534],[4118630271,4000239992],[116418474,1914138554],[174292421,2731055270],[289380356,3203993006],[460393269,320620315],[685471733,587496836],[852142971,1086792851],[1017036298,365543100],[1126000580,2618297676],[1288033470,3409855158],[1501505948,4234509866],[1607167915,987167468],[1816402316,1246189591]],UQ={},UQ["SHA-512"]=[[1779033703,4089235720],[3144134277,2227873595],[1013904242,4271175723],[2773480762,1595750129],[1359893119,2917565137],[2600822924,725511199],[528734635,4215389547],[1541459225,327033209]],UQ["SHA-384"]=[[3418070365,3238371032],[1654270250,914150663],[2438529370,812702999],[355462360,4144912697],[1731405415,4290775857],[2394180231,1750603025],[3675008525,1694076839],[1203062813,3204075428]],UQ["SHA-512/256"]=[[573645204,4230739756],[2673172387,3360449730],[596883563,1867755857],[2520282905,1497426621],[2519219938,2827943907],[3193839141,1401305490],[721525244,746961066],[246885852,2177182882]],UQ["SHA-512/224"]=[[2352822216,424955298],[1944164710,2312950998],[502970286,855612546],[1738396948,1479516111],[258812777,2077511080],[2011393907,79989058],[1067287976,1780299464],[286451373,2446758561]],r1=!0}function a1($,J,X){var Q,Y,G,W,U,M,O,V,H,q,F,K,A,L,R,I,T,C,w,P,l,k,p,$$,N$,M$,b$,XJ,j$,U$,v,a,P$,E$,s,S$=X.length();while(S$>=128){for(j$=0;j$<16;++j$)J[j$][0]=X.getInt32()>>>0,J[j$][1]=X.getInt32()>>>0;for(;j$<80;++j$)a=J[j$-2],U$=a[0],v=a[1],Q=((U$>>>19|v<<13)^(v>>>29|U$<<3)^U$>>>6)>>>0,Y=((U$<<13|v>>>19)^(v<<3|U$>>>29)^(U$<<26|v>>>6))>>>0,E$=J[j$-15],U$=E$[0],v=E$[1],G=((U$>>>1|v<<31)^(U$>>>8|v<<24)^U$>>>7)>>>0,W=((U$<<31|v>>>1)^(U$<<24|v>>>8)^(U$<<25|v>>>7))>>>0,P$=J[j$-7],s=J[j$-16],v=Y+P$[1]+W+s[1],J[j$][0]=Q+P$[0]+G+s[0]+(v/4294967296>>>0)>>>0,J[j$][1]=v>>>0;A=$[0][0],L=$[0][1],R=$[1][0],I=$[1][1],T=$[2][0],C=$[2][1],w=$[3][0],P=$[3][1],l=$[4][0],k=$[4][1],p=$[5][0],$$=$[5][1],N$=$[6][0],M$=$[6][1],b$=$[7][0],XJ=$[7][1];for(j$=0;j$<80;++j$)O=((l>>>14|k<<18)^(l>>>18|k<<14)^(k>>>9|l<<23))>>>0,V=((l<<18|k>>>14)^(l<<14|k>>>18)^(k<<23|l>>>9))>>>0,H=(N$^l&(p^N$))>>>0,q=(M$^k&($$^M$))>>>0,U=((A>>>28|L<<4)^(L>>>2|A<<30)^(L>>>7|A<<25))>>>0,M=((A<<4|L>>>28)^(L<<30|A>>>2)^(L<<25|A>>>7))>>>0,F=(A&R|T&(A^R))>>>0,K=(L&I|C&(L^I))>>>0,v=XJ+V+q+_8[j$][1]+J[j$][1],Q=b$+O+H+_8[j$][0]+J[j$][0]+(v/4294967296>>>0)>>>0,Y=v>>>0,v=M+K,G=U+F+(v/4294967296>>>0)>>>0,W=v>>>0,b$=N$,XJ=M$,N$=p,M$=$$,p=l,$$=k,v=P+Y,l=w+Q+(v/4294967296>>>0)>>>0,k=v>>>0,w=T,P=C,T=R,C=I,R=A,I=L,v=Y+W,A=Q+G+(v/4294967296>>>0)>>>0,L=v>>>0;v=$[0][1]+L,$[0][0]=$[0][0]+A+(v/4294967296>>>0)>>>0,$[0][1]=v>>>0,v=$[1][1]+I,$[1][0]=$[1][0]+R+(v/4294967296>>>0)>>>0,$[1][1]=v>>>0,v=$[2][1]+C,$[2][0]=$[2][0]+T+(v/4294967296>>>0)>>>0,$[2][1]=v>>>0,v=$[3][1]+P,$[3][0]=$[3][0]+w+(v/4294967296>>>0)>>>0,$[3][1]=v>>>0,v=$[4][1]+k,$[4][0]=$[4][0]+l+(v/4294967296>>>0)>>>0,$[4][1]=v>>>0,v=$[5][1]+$$,$[5][0]=$[5][0]+p+(v/4294967296>>>0)>>>0,$[5][1]=v>>>0,v=$[6][1]+M$,$[6][0]=$[6][0]+N$+(v/4294967296>>>0)>>>0,$[6][1]=v>>>0,v=$[7][1]+XJ,$[7][0]=$[7][0]+b$+(v/4294967296>>>0)>>>0,$[7][1]=v>>>0,S$-=128}}});var e1=O$((VH)=>{var OH=z$();mJ();var HJ=OH.asn1;VH.privateKeyValidator={name:"PrivateKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]};VH.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.BITSTRING,constructed:!1,composed:!0,captureBitStringValue:"ed25519PublicKey"}]}});var HW=O$((PF,VW)=>{var zJ=z$();DX();_J();x8();w$();var YW=e1(),KH=YW.publicKeyValidator,zH=YW.privateKeyValidator;if(typeof k8>"u")k8=zJ.jsbn.BigInteger;var k8,f8=zJ.util.ByteBuffer,BJ=typeof Buffer>"u"?Uint8Array:Buffer;zJ.pki=zJ.pki||{};VW.exports=zJ.pki.ed25519=zJ.ed25519=zJ.ed25519||{};var D$=zJ.ed25519;D$.constants={};D$.constants.PUBLIC_KEY_BYTE_LENGTH=32;D$.constants.PRIVATE_KEY_BYTE_LENGTH=64;D$.constants.SEED_BYTE_LENGTH=32;D$.constants.SIGN_BYTE_LENGTH=64;D$.constants.HASH_BYTE_LENGTH=64;D$.generateKeyPair=function($){$=$||{};var J=$.seed;if(J===void 0)J=zJ.random.getBytesSync(D$.constants.SEED_BYTE_LENGTH);else if(typeof J==="string"){if(J.length!==D$.constants.SEED_BYTE_LENGTH)throw TypeError('"seed" must be '+D$.constants.SEED_BYTE_LENGTH+" bytes in length.")}else if(!(J instanceof Uint8Array))throw TypeError('"seed" must be a node.js Buffer, Uint8Array, or a binary string.');J=A0({message:J,encoding:"binary"});var X=new BJ(D$.constants.PUBLIC_KEY_BYTE_LENGTH),Q=new BJ(D$.constants.PRIVATE_KEY_BYTE_LENGTH);for(var Y=0;Y<32;++Y)Q[Y]=J[Y];return LH(X,Q),{publicKey:X,privateKey:Q}};D$.privateKeyFromAsn1=function($){var J={},X=[],Q=zJ.asn1.validate($,zH,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=zJ.asn1.derToOid(J.privateKeyOid),W=zJ.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var U=J.privateKey,M=A0({message:zJ.asn1.fromDer(U).value,encoding:"binary"});return{privateKeyBytes:M}};D$.publicKeyFromAsn1=function($){var J={},X=[],Q=zJ.asn1.validate($,KH,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=zJ.asn1.derToOid(J.publicKeyOid),W=zJ.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var U=J.ed25519PublicKey;if(U.length!==D$.constants.PUBLIC_KEY_BYTE_LENGTH)throw Error("Key length is invalid.");return A0({message:U,encoding:"binary"})};D$.publicKeyFromPrivateKey=function($){$=$||{};var J=A0({message:$.privateKey,encoding:"binary"});if(J.length!==D$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+D$.constants.PRIVATE_KEY_BYTE_LENGTH);var X=new BJ(D$.constants.PUBLIC_KEY_BYTE_LENGTH);for(var Q=0;Q<X.length;++Q)X[Q]=J[32+Q];return X};D$.sign=function($){$=$||{};var J=A0($),X=A0({message:$.privateKey,encoding:"binary"});if(X.length===D$.constants.SEED_BYTE_LENGTH){var Q=D$.generateKeyPair({seed:X});X=Q.privateKey}else if(X.length!==D$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+D$.constants.SEED_BYTE_LENGTH+" or "+D$.constants.PRIVATE_KEY_BYTE_LENGTH);var Y=new BJ(D$.constants.SIGN_BYTE_LENGTH+J.length);AH(Y,J,J.length,X);var G=new BJ(D$.constants.SIGN_BYTE_LENGTH);for(var W=0;W<G.length;++W)G[W]=Y[W];return G};D$.verify=function($){$=$||{};var J=A0($);if($.signature===void 0)throw TypeError('"options.signature" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a binary string.');var X=A0({message:$.signature,encoding:"binary"});if(X.length!==D$.constants.SIGN_BYTE_LENGTH)throw TypeError('"options.signature" must have a byte length of '+D$.constants.SIGN_BYTE_LENGTH);var Q=A0({message:$.publicKey,encoding:"binary"});if(Q.length!==D$.constants.PUBLIC_KEY_BYTE_LENGTH)throw TypeError('"options.publicKey" must have a byte length of '+D$.constants.PUBLIC_KEY_BYTE_LENGTH);var Y=new BJ(D$.constants.SIGN_BYTE_LENGTH+J.length),G=new BJ(D$.constants.SIGN_BYTE_LENGTH+J.length),W;for(W=0;W<D$.constants.SIGN_BYTE_LENGTH;++W)Y[W]=X[W];for(W=0;W<J.length;++W)Y[W+D$.constants.SIGN_BYTE_LENGTH]=J[W];return RH(G,Y,Y.length,Q)>=0};function A0($){var J=$.message;if(J instanceof Uint8Array||J instanceof BJ)return J;var X=$.encoding;if(J===void 0)if($.md)J=$.md.digest().getBytes(),X="binary";else throw TypeError('"options.message" or "options.md" not specified.');if(typeof J==="string"&&!X)throw TypeError('"options.encoding" must be "binary" or "utf8".');if(typeof J==="string"){if(typeof Buffer<"u")return Buffer.from(J,X);J=new f8(J,X)}else if(!(J instanceof f8))throw TypeError('"options.message" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a string with "options.encoding" specifying its encoding.');var Q=new BJ(J.length());for(var Y=0;Y<Q.length;++Y)Q[Y]=J.at(Y);return Q}var y8=G$(),gY=G$([1]),EH=G$([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),FH=G$([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),$W=G$([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),JW=G$([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),IX=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]),NH=G$([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function CX($,J){var X=zJ.md.sha512.create(),Q=new f8($);X.update(Q.getBytes(J),"binary");var Y=X.digest().getBytes();if(typeof Buffer<"u")return Buffer.from(Y,"binary");var G=new BJ(D$.constants.HASH_BYTE_LENGTH);for(var W=0;W<64;++W)G[W]=Y.charCodeAt(W);return G}function LH($,J){var X=[G$(),G$(),G$(),G$()],Q,Y=CX(J,32);Y[0]&=248,Y[31]&=127,Y[31]|=64,g8(X,Y),u8($,X);for(Q=0;Q<32;++Q)J[Q+32]=$[Q];return 0}function AH($,J,X,Q){var Y,G,W=new Float64Array(64),U=[G$(),G$(),G$(),G$()],M=CX(Q,32);M[0]&=248,M[31]&=127,M[31]|=64;var O=X+64;for(Y=0;Y<X;++Y)$[64+Y]=J[Y];for(Y=0;Y<32;++Y)$[32+Y]=M[32+Y];var V=CX($.subarray(32),X+32);b8(V),g8(U,V),u8($,U);for(Y=32;Y<64;++Y)$[Y]=Q[Y];var H=CX($,X+64);b8(H);for(Y=32;Y<64;++Y)W[Y]=0;for(Y=0;Y<32;++Y)W[Y]=V[Y];for(Y=0;Y<32;++Y)for(G=0;G<32;G++)W[Y+G]+=H[Y]*M[G];return GW($.subarray(32),W),O}function RH($,J,X,Q){var Y,G,W=new BJ(32),U=[G$(),G$(),G$(),G$()],M=[G$(),G$(),G$(),G$()];if(G=-1,X<64)return-1;if(ZH(M,Q))return-1;if(!DH(J,32))return-1;for(Y=0;Y<X;++Y)$[Y]=J[Y];for(Y=0;Y<32;++Y)$[Y+32]=Q[Y];var O=CX($,X);if(b8(O),MW(U,M,O),g8(M,J.subarray(32)),h8(U,M),u8(W,U),X-=64,WW(J,0,W,0)){for(Y=0;Y<X;++Y)$[Y]=0;return-1}for(Y=0;Y<X;++Y)$[Y]=J[Y+64];return G=X,G}function DH($,J){var X;for(X=31;X>=0;--X){if($[J+X]<IX[X])return!0;if($[J+X]>IX[X])return!1}return!1}function GW($,J){var X,Q,Y,G;for(Q=63;Q>=32;--Q){X=0;for(Y=Q-32,G=Q-12;Y<G;++Y)J[Y]+=X-16*J[Q]*IX[Y-(Q-32)],X=J[Y]+128>>8,J[Y]-=X*256;J[Y]+=X,J[Q]=0}X=0;for(Y=0;Y<32;++Y)J[Y]+=X-(J[31]>>4)*IX[Y],X=J[Y]>>8,J[Y]&=255;for(Y=0;Y<32;++Y)J[Y]-=X*IX[Y];for(Q=0;Q<32;++Q)J[Q+1]+=J[Q]>>8,$[Q]=J[Q]&255}function b8($){var J=new Float64Array(64);for(var X=0;X<64;++X)J[X]=$[X],$[X]=0;GW($,J)}function h8($,J){var X=G$(),Q=G$(),Y=G$(),G=G$(),W=G$(),U=G$(),M=G$(),O=G$(),V=G$();fQ(X,$[1],$[0]),fQ(V,J[1],J[0]),h$(X,X,V),kQ(Q,$[0],$[1]),kQ(V,J[0],J[1]),h$(Q,Q,V),h$(Y,$[3],J[3]),h$(Y,Y,FH),h$(G,$[2],J[2]),kQ(G,G,G),fQ(W,Q,X),fQ(U,G,Y),kQ(M,G,Y),kQ(O,Q,X),h$($[0],W,U),h$($[1],O,M),h$($[2],M,U),h$($[3],W,O)}function QW($,J,X){for(var Q=0;Q<4;++Q)OW($[Q],J[Q],X)}function u8($,J){var X=G$(),Q=G$(),Y=G$();SH(Y,J[2]),h$(X,J[0],Y),h$(Q,J[1],Y),mY($,Q),$[31]^=UW(X)<<7}function mY($,J){var X,Q,Y,G=G$(),W=G$();for(X=0;X<16;++X)W[X]=J[X];v8(W),v8(W),v8(W);for(Q=0;Q<2;++Q){G[0]=W[0]-65517;for(X=1;X<15;++X)G[X]=W[X]-65535-(G[X-1]>>16&1),G[X-1]&=65535;G[15]=W[15]-32767-(G[14]>>16&1),Y=G[15]>>16&1,G[14]&=65535,OW(W,G,1-Y)}for(X=0;X<16;X++)$[2*X]=W[X]&255,$[2*X+1]=W[X]>>8}function ZH($,J){var X=G$(),Q=G$(),Y=G$(),G=G$(),W=G$(),U=G$(),M=G$();if(b0($[2],gY),BH($[1],J),MQ(Y,$[1]),h$(G,Y,EH),fQ(Y,Y,$[2]),kQ(G,$[2],G),MQ(W,G),MQ(U,W),h$(M,U,W),h$(X,M,Y),h$(X,X,G),jH(X,X),h$(X,X,Y),h$(X,X,G),h$(X,X,G),h$($[0],X,G),MQ(Q,$[0]),h$(Q,Q,G),XW(Q,Y))h$($[0],$[0],NH);if(MQ(Q,$[0]),h$(Q,Q,G),XW(Q,Y))return-1;if(UW($[0])===J[31]>>7)fQ($[0],y8,$[0]);return h$($[3],$[0],$[1]),0}function BH($,J){var X;for(X=0;X<16;++X)$[X]=J[2*X]+(J[2*X+1]<<8);$[15]&=32767}function jH($,J){var X=G$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=250;Q>=0;--Q)if(MQ(X,X),Q!==1)h$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function XW($,J){var X=new BJ(32),Q=new BJ(32);return mY(X,$),mY(Q,J),WW(X,0,Q,0)}function WW($,J,X,Q){return TH($,J,X,Q,32)}function TH($,J,X,Q,Y){var G,W=0;for(G=0;G<Y;++G)W|=$[J+G]^X[Q+G];return(1&W-1>>>8)-1}function UW($){var J=new BJ(32);return mY(J,$),J[0]&1}function MW($,J,X){var Q,Y;b0($[0],y8),b0($[1],gY),b0($[2],gY),b0($[3],y8);for(Y=255;Y>=0;--Y)Q=X[Y/8|0]>>(Y&7)&1,QW($,J,Q),h8(J,$),h8($,$),QW($,J,Q)}function g8($,J){var X=[G$(),G$(),G$(),G$()];b0(X[0],$W),b0(X[1],JW),b0(X[2],gY),h$(X[3],$W,JW),MW($,X,J)}function b0($,J){var X;for(X=0;X<16;X++)$[X]=J[X]|0}function SH($,J){var X=G$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=253;Q>=0;--Q)if(MQ(X,X),Q!==2&&Q!==4)h$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function v8($){var J,X,Q=1;for(J=0;J<16;++J)X=$[J]+Q+65535,Q=Math.floor(X/65536),$[J]=X-Q*65536;$[0]+=Q-1+37*(Q-1)}function OW($,J,X){var Q,Y=~(X-1);for(var G=0;G<16;++G)Q=Y&($[G]^J[G]),$[G]^=Q,J[G]^=Q}function G$($){var J,X=new Float64Array(16);if($)for(J=0;J<$.length;++J)X[J]=$[J];return X}function kQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]+X[Q]}function fQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]-X[Q]}function MQ($,J){h$($,J,J)}function h$($,J,X){var Q,Y,G=0,W=0,U=0,M=0,O=0,V=0,H=0,q=0,F=0,K=0,A=0,L=0,R=0,I=0,T=0,C=0,w=0,P=0,l=0,k=0,p=0,$$=0,N$=0,M$=0,b$=0,XJ=0,j$=0,U$=0,v=0,a=0,P$=0,E$=X[0],s=X[1],S$=X[2],J$=X[3],g$=X[4],_$=X[5],K$=X[6],c$=X[7],v$=X[8],YJ=X[9],GJ=X[10],a$=X[11],y$=X[12],n$=X[13],t$=X[14],WJ=X[15];Q=J[0],G+=Q*E$,W+=Q*s,U+=Q*S$,M+=Q*J$,O+=Q*g$,V+=Q*_$,H+=Q*K$,q+=Q*c$,F+=Q*v$,K+=Q*YJ,A+=Q*GJ,L+=Q*a$,R+=Q*y$,I+=Q*n$,T+=Q*t$,C+=Q*WJ,Q=J[1],W+=Q*E$,U+=Q*s,M+=Q*S$,O+=Q*J$,V+=Q*g$,H+=Q*_$,q+=Q*K$,F+=Q*c$,K+=Q*v$,A+=Q*YJ,L+=Q*GJ,R+=Q*a$,I+=Q*y$,T+=Q*n$,C+=Q*t$,w+=Q*WJ,Q=J[2],U+=Q*E$,M+=Q*s,O+=Q*S$,V+=Q*J$,H+=Q*g$,q+=Q*_$,F+=Q*K$,K+=Q*c$,A+=Q*v$,L+=Q*YJ,R+=Q*GJ,I+=Q*a$,T+=Q*y$,C+=Q*n$,w+=Q*t$,P+=Q*WJ,Q=J[3],M+=Q*E$,O+=Q*s,V+=Q*S$,H+=Q*J$,q+=Q*g$,F+=Q*_$,K+=Q*K$,A+=Q*c$,L+=Q*v$,R+=Q*YJ,I+=Q*GJ,T+=Q*a$,C+=Q*y$,w+=Q*n$,P+=Q*t$,l+=Q*WJ,Q=J[4],O+=Q*E$,V+=Q*s,H+=Q*S$,q+=Q*J$,F+=Q*g$,K+=Q*_$,A+=Q*K$,L+=Q*c$,R+=Q*v$,I+=Q*YJ,T+=Q*GJ,C+=Q*a$,w+=Q*y$,P+=Q*n$,l+=Q*t$,k+=Q*WJ,Q=J[5],V+=Q*E$,H+=Q*s,q+=Q*S$,F+=Q*J$,K+=Q*g$,A+=Q*_$,L+=Q*K$,R+=Q*c$,I+=Q*v$,T+=Q*YJ,C+=Q*GJ,w+=Q*a$,P+=Q*y$,l+=Q*n$,k+=Q*t$,p+=Q*WJ,Q=J[6],H+=Q*E$,q+=Q*s,F+=Q*S$,K+=Q*J$,A+=Q*g$,L+=Q*_$,R+=Q*K$,I+=Q*c$,T+=Q*v$,C+=Q*YJ,w+=Q*GJ,P+=Q*a$,l+=Q*y$,k+=Q*n$,p+=Q*t$,$$+=Q*WJ,Q=J[7],q+=Q*E$,F+=Q*s,K+=Q*S$,A+=Q*J$,L+=Q*g$,R+=Q*_$,I+=Q*K$,T+=Q*c$,C+=Q*v$,w+=Q*YJ,P+=Q*GJ,l+=Q*a$,k+=Q*y$,p+=Q*n$,$$+=Q*t$,N$+=Q*WJ,Q=J[8],F+=Q*E$,K+=Q*s,A+=Q*S$,L+=Q*J$,R+=Q*g$,I+=Q*_$,T+=Q*K$,C+=Q*c$,w+=Q*v$,P+=Q*YJ,l+=Q*GJ,k+=Q*a$,p+=Q*y$,$$+=Q*n$,N$+=Q*t$,M$+=Q*WJ,Q=J[9],K+=Q*E$,A+=Q*s,L+=Q*S$,R+=Q*J$,I+=Q*g$,T+=Q*_$,C+=Q*K$,w+=Q*c$,P+=Q*v$,l+=Q*YJ,k+=Q*GJ,p+=Q*a$,$$+=Q*y$,N$+=Q*n$,M$+=Q*t$,b$+=Q*WJ,Q=J[10],A+=Q*E$,L+=Q*s,R+=Q*S$,I+=Q*J$,T+=Q*g$,C+=Q*_$,w+=Q*K$,P+=Q*c$,l+=Q*v$,k+=Q*YJ,p+=Q*GJ,$$+=Q*a$,N$+=Q*y$,M$+=Q*n$,b$+=Q*t$,XJ+=Q*WJ,Q=J[11],L+=Q*E$,R+=Q*s,I+=Q*S$,T+=Q*J$,C+=Q*g$,w+=Q*_$,P+=Q*K$,l+=Q*c$,k+=Q*v$,p+=Q*YJ,$$+=Q*GJ,N$+=Q*a$,M$+=Q*y$,b$+=Q*n$,XJ+=Q*t$,j$+=Q*WJ,Q=J[12],R+=Q*E$,I+=Q*s,T+=Q*S$,C+=Q*J$,w+=Q*g$,P+=Q*_$,l+=Q*K$,k+=Q*c$,p+=Q*v$,$$+=Q*YJ,N$+=Q*GJ,M$+=Q*a$,b$+=Q*y$,XJ+=Q*n$,j$+=Q*t$,U$+=Q*WJ,Q=J[13],I+=Q*E$,T+=Q*s,C+=Q*S$,w+=Q*J$,P+=Q*g$,l+=Q*_$,k+=Q*K$,p+=Q*c$,$$+=Q*v$,N$+=Q*YJ,M$+=Q*GJ,b$+=Q*a$,XJ+=Q*y$,j$+=Q*n$,U$+=Q*t$,v+=Q*WJ,Q=J[14],T+=Q*E$,C+=Q*s,w+=Q*S$,P+=Q*J$,l+=Q*g$,k+=Q*_$,p+=Q*K$,$$+=Q*c$,N$+=Q*v$,M$+=Q*YJ,b$+=Q*GJ,XJ+=Q*a$,j$+=Q*y$,U$+=Q*n$,v+=Q*t$,a+=Q*WJ,Q=J[15],C+=Q*E$,w+=Q*s,P+=Q*S$,l+=Q*J$,k+=Q*g$,p+=Q*_$,$$+=Q*K$,N$+=Q*c$,M$+=Q*v$,b$+=Q*YJ,XJ+=Q*GJ,j$+=Q*a$,U$+=Q*y$,v+=Q*n$,a+=Q*t$,P$+=Q*WJ,G+=38*w,W+=38*P,U+=38*l,M+=38*k,O+=38*p,V+=38*$$,H+=38*N$,q+=38*M$,F+=38*b$,K+=38*XJ,A+=38*j$,L+=38*U$,R+=38*v,I+=38*a,T+=38*P$,Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=F+Y+65535,Y=Math.floor(Q/65536),F=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=R+Y+65535,Y=Math.floor(Q/65536),R=Q-Y*65536,Q=I+Y+65535,Y=Math.floor(Q/65536),I=Q-Y*65536,Q=T+Y+65535,Y=Math.floor(Q/65536),T=Q-Y*65536,Q=C+Y+65535,Y=Math.floor(Q/65536),C=Q-Y*65536,G+=Y-1+37*(Y-1),Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=F+Y+65535,Y=Math.floor(Q/65536),F=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=R+Y+65535,Y=Math.floor(Q/65536),R=Q-Y*65536,Q=I+Y+65535,Y=Math.floor(Q/65536),I=Q-Y*65536,Q=T+Y+65535,Y=Math.floor(Q/65536),T=Q-Y*65536,Q=C+Y+65535,Y=Math.floor(Q/65536),C=Q-Y*65536,G+=Y-1+37*(Y-1),$[0]=G,$[1]=W,$[2]=U,$[3]=M,$[4]=O,$[5]=V,$[6]=H,$[7]=q,$[8]=F,$[9]=K,$[10]=A,$[11]=L,$[12]=R,$[13]=I,$[14]=T,$[15]=C}});var EW=O$((_F,zW)=>{var IJ=z$();w$();_J();DX();zW.exports=IJ.kem=IJ.kem||{};var qW=IJ.jsbn.BigInteger;IJ.kem.rsa={};IJ.kem.rsa.create=function($,J){J=J||{};var X=J.prng||IJ.random,Q={};return Q.encrypt=function(Y,G){var W=Math.ceil(Y.n.bitLength()/8),U;do U=new qW(IJ.util.bytesToHex(X.getBytesSync(W)),16).mod(Y.n);while(U.compareTo(qW.ONE)<=0);U=IJ.util.hexToBytes(U.toString(16));var M=W-U.length;if(M>0)U=IJ.util.fillString(String.fromCharCode(0),M)+U;var O=Y.encrypt(U,"NONE"),V=$.generate(U,G);return{encapsulation:O,key:V}},Q.decrypt=function(Y,G,W){var U=Y.decrypt(G,"NONE");return $.generate(U,W)},Q};IJ.kem.kdf1=function($,J){KW(this,$,0,J||$.digestLength)};IJ.kem.kdf2=function($,J){KW(this,$,1,J||$.digestLength)};function KW($,J,X,Q){$.generate=function(Y,G){var W=new IJ.util.ByteBuffer,U=Math.ceil(G/Q)+X,M=new IJ.util.ByteBuffer;for(var O=X;O<U;++O){M.putInt32(O),J.start(),J.update(Y+M.getBytes());var V=J.digest();W.putBytes(V.getBytes(Q))}return W.truncate(W.length()-G),W.getBytes()}}});var NW=O$((xF,FW)=>{var B$=z$();w$();FW.exports=B$.log=B$.log||{};B$.log.levels=["none","error","warning","info","debug","verbose","max"];var dY={},m8=[],wX=null;B$.log.LEVEL_LOCKED=2;B$.log.NO_LEVEL_CHECK=4;B$.log.INTERPOLATE=8;for(bJ=0;bJ<B$.log.levels.length;++bJ)lY=B$.log.levels[bJ],dY[lY]={index:bJ,name:lY.toUpperCase()};var lY,bJ;B$.log.logMessage=function($){var J=dY[$.level].index;for(var X=0;X<m8.length;++X){var Q=m8[X];if(Q.flags&B$.log.NO_LEVEL_CHECK)Q.f($);else{var Y=dY[Q.level].index;if(J<=Y)Q.f(Q,$)}}};B$.log.prepareStandard=function($){if(!("standard"in $))$.standard=dY[$.level].name+" ["+$.category+"] "+$.message};B$.log.prepareFull=function($){if(!("full"in $)){var J=[$.message];J=J.concat([]),$.full=B$.util.format.apply(this,J)}};B$.log.prepareStandardFull=function($){if(!("standardFull"in $))B$.log.prepareStandard($),$.standardFull=$.standard};pY=["error","warning","info","debug","verbose"];for(bJ=0;bJ<pY.length;++bJ)(function(J){B$.log[J]=function(X,Q){var Y=Array.prototype.slice.call(arguments).slice(2),G={timestamp:new Date,level:J,category:X,message:Q,arguments:Y};B$.log.logMessage(G)}})(pY[bJ]);var pY,bJ;B$.log.makeLogger=function($){var J={flags:0,f:$};return B$.log.setLevel(J,"none"),J};B$.log.setLevel=function($,J){var X=!1;if($&&!($.flags&B$.log.LEVEL_LOCKED))for(var Q=0;Q<B$.log.levels.length;++Q){var Y=B$.log.levels[Q];if(J==Y){$.level=J,X=!0;break}}return X};B$.log.lock=function($,J){if(typeof J>"u"||J)$.flags|=B$.log.LEVEL_LOCKED;else $.flags&=~B$.log.LEVEL_LOCKED};B$.log.addLogger=function($){m8.push($)};if(typeof console<"u"&&"log"in console){if(console.error&&console.warn&&console.info&&console.debug)l8={error:console.error,warning:console.warn,info:console.info,debug:console.debug,verbose:console.debug},bQ=function($,J){B$.log.prepareStandard(J);var X=l8[J.level],Q=[J.standard];Q=Q.concat(J.arguments.slice()),X.apply(console,Q)},OQ=B$.log.makeLogger(bQ);else bQ=function(J,X){B$.log.prepareStandardFull(X),console.log(X.standardFull)},OQ=B$.log.makeLogger(bQ);B$.log.setLevel(OQ,"debug"),B$.log.addLogger(OQ),wX=OQ}else console={log:function(){}};var OQ,l8,bQ;if(wX!==null&&typeof window<"u"&&window.location){if(yQ=new URL(window.location.href).searchParams,yQ.has("console.level"))B$.log.setLevel(wX,yQ.get("console.level").slice(-1)[0]);if(yQ.has("console.lock")){if(p8=yQ.get("console.lock").slice(-1)[0],p8=="true")B$.log.lock(wX)}}var yQ,p8;B$.log.consoleLogger=wX});var AW=O$((vF,LW)=>{LW.exports=eJ();ZY();wQ();Q8();x8()});var ZW=O$((kF,DW)=>{var d=z$();w0();mJ();AX();P0();JQ();N8();_J();w$();yY();var B=d.asn1,DJ=DW.exports=d.pkcs7=d.pkcs7||{};DJ.messageFromPem=function($){var J=d.pem.decode($)[0];if(J.type!=="PKCS7"){var X=Error('Could not convert PKCS#7 message from PEM; PEM header type is not "PKCS#7".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PKCS#7 message from PEM; PEM is encrypted.");var Q=B.fromDer(J.body);return DJ.messageFromAsn1(Q)};DJ.messageToPem=function($,J){var X={type:"PKCS7",body:B.toDer($.toAsn1()).getBytes()};return d.pem.encode(X,{maxline:J})};DJ.messageFromAsn1=function($){var J={},X=[];if(!B.validate($,DJ.asn1.contentInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 message. ASN.1 object is not an PKCS#7 ContentInfo.");throw Q.errors=X,Q}var Y=B.derToOid(J.contentType),G;switch(Y){case d.pki.oids.envelopedData:G=DJ.createEnvelopedData();break;case d.pki.oids.encryptedData:G=DJ.createEncryptedData();break;case d.pki.oids.signedData:G=DJ.createSignedData();break;default:throw Error("Cannot read PKCS#7 message. ContentType with OID "+Y+" is not (yet) supported.")}return G.fromAsn1(J.content.value[0]),G};DJ.createSignedData=function(){var $=null;return $={type:d.pki.oids.signedData,version:1,certificates:[],crls:[],signers:[],digestAlgorithmIdentifiers:[],contentInfo:null,signerInfos:[],fromAsn1:function(Q){if(c8($,Q,DJ.asn1.signedDataValidator),$.certificates=[],$.crls=[],$.digestAlgorithmIdentifiers=[],$.contentInfo=null,$.signerInfos=[],$.rawCapture.certificates){var Y=$.rawCapture.certificates.value;for(var G=0;G<Y.length;++G)$.certificates.push(d.pki.certificateFromAsn1(Y[G]))}},toAsn1:function(){if(!$.contentInfo)$.sign();var Q=[];for(var Y=0;Y<$.certificates.length;++Y)Q.push(d.pki.certificateToAsn1($.certificates[Y]));var G=[],W=B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,$.digestAlgorithmIdentifiers),$.contentInfo])]);if(Q.length>0)W.value[0].value.push(B.create(B.Class.CONTEXT_SPECIFIC,0,!0,Q));if(G.length>0)W.value[0].value.push(B.create(B.Class.CONTEXT_SPECIFIC,1,!0,G));return W.value[0].value.push(B.create(B.Class.UNIVERSAL,B.Type.SET,!0,$.signerInfos)),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),W])},addSigner:function(Q){var{issuer:Y,serialNumber:G}=Q;if(Q.certificate){var W=Q.certificate;if(typeof W==="string")W=d.pki.certificateFromPem(W);Y=W.issuer.attributes,G=W.serialNumber}var U=Q.key;if(!U)throw Error("Could not add PKCS#7 signer; no private key specified.");if(typeof U==="string")U=d.pki.privateKeyFromPem(U);var M=Q.digestAlgorithm||d.pki.oids.sha1;switch(M){case d.pki.oids.sha1:case d.pki.oids.sha256:case d.pki.oids.sha384:case d.pki.oids.sha512:case d.pki.oids.md5:break;default:throw Error("Could not add PKCS#7 signer; unknown message digest algorithm: "+M)}var O=Q.authenticatedAttributes||[];if(O.length>0){var V=!1,H=!1;for(var q=0;q<O.length;++q){var F=O[q];if(!V&&F.type===d.pki.oids.contentType){if(V=!0,H)break;continue}if(!H&&F.type===d.pki.oids.messageDigest){if(H=!0,V)break;continue}}if(!V||!H)throw Error("Invalid signer.authenticatedAttributes. If signer.authenticatedAttributes is specified, then it must contain at least two attributes, PKCS #9 content-type and PKCS #9 message-digest.")}$.signers.push({key:U,version:1,issuer:Y,serialNumber:G,digestAlgorithm:M,signatureAlgorithm:d.pki.oids.rsaEncryption,signature:null,authenticatedAttributes:O,unauthenticatedAttributes:[]})},sign:function(Q){if(Q=Q||{},typeof $.content!=="object"||$.contentInfo===null){if($.contentInfo=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(d.pki.oids.data).getBytes())]),"content"in $){var Y;if($.content instanceof d.util.ByteBuffer)Y=$.content.bytes();else if(typeof $.content==="string")Y=d.util.encodeUtf8($.content);if(Q.detached)$.detachedContent=B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,Y);else $.contentInfo.value.push(B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,Y)]))}}if($.signers.length===0)return;var G=J();X(G)},verify:function(){throw Error("PKCS#7 signature verification not yet implemented.")},addCertificate:function(Q){if(typeof Q==="string")Q=d.pki.certificateFromPem(Q);$.certificates.push(Q)},addCertificateRevokationList:function(Q){throw Error("PKCS#7 CRL support not yet implemented.")}},$;function J(){var Q={};for(var Y=0;Y<$.signers.length;++Y){var G=$.signers[Y],W=G.digestAlgorithm;if(!(W in Q))Q[W]=d.md[d.pki.oids[W]].create();if(G.authenticatedAttributes.length===0)G.md=Q[W];else G.md=d.md[d.pki.oids[W]].create()}$.digestAlgorithmIdentifiers=[];for(var W in Q)$.digestAlgorithmIdentifiers.push(B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(W).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]));return Q}function X(Q){var Y;if($.detachedContent)Y=$.detachedContent;else Y=$.contentInfo.value[1],Y=Y.value[0];if(!Y)throw Error("Could not sign PKCS#7 message; there is no content to sign.");var G=B.derToOid($.contentInfo.value[0].value),W=B.toDer(Y);W.getByte(),B.getBerValueLength(W),W=W.getBytes();for(var U in Q)Q[U].start().update(W);var M=new Date;for(var O=0;O<$.signers.length;++O){var V=$.signers[O];if(V.authenticatedAttributes.length===0){if(G!==d.pki.oids.data)throw Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.")}else{V.authenticatedAttributesAsn1=B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[]);var H=B.create(B.Class.UNIVERSAL,B.Type.SET,!0,[]);for(var q=0;q<V.authenticatedAttributes.length;++q){var F=V.authenticatedAttributes[q];if(F.type===d.pki.oids.messageDigest)F.value=Q[V.digestAlgorithm].digest();else if(F.type===d.pki.oids.signingTime){if(!F.value)F.value=M}H.value.push(d8(F)),V.authenticatedAttributesAsn1.value.push(d8(F))}W=B.toDer(H).getBytes(),V.md.start().update(W)}V.signature=V.key.sign(V.md,"RSASSA-PKCS1-V1_5")}$.signerInfos=xH($.signers)}};DJ.createEncryptedData=function(){var $=null;return $={type:d.pki.oids.encryptedData,version:0,encryptedContent:{algorithm:d.pki.oids["aes256-CBC"]},fromAsn1:function(J){c8($,J,DJ.asn1.encryptedDataValidator)},decrypt:function(J){if(J!==void 0)$.encryptedContent.key=J;RW($)}},$};DJ.createEnvelopedData=function(){var $=null;return $={type:d.pki.oids.envelopedData,version:0,recipients:[],encryptedContent:{algorithm:d.pki.oids["aes256-CBC"]},fromAsn1:function(J){var X=c8($,J,DJ.asn1.envelopedDataValidator);$.recipients=wH(X.recipientInfos.value)},toAsn1:function(){return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,PH($.recipients)),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,vH($.encryptedContent))])])])},findRecipient:function(J){var X=J.issuer.attributes;for(var Q=0;Q<$.recipients.length;++Q){var Y=$.recipients[Q],G=Y.issuer;if(Y.serialNumber!==J.serialNumber)continue;if(G.length!==X.length)continue;var W=!0;for(var U=0;U<X.length;++U)if(G[U].type!==X[U].type||G[U].value!==X[U].value){W=!1;break}if(W)return Y}return null},decrypt:function(J,X){if($.encryptedContent.key===void 0&&J!==void 0&&X!==void 0)switch(J.encryptedContent.algorithm){case d.pki.oids.rsaEncryption:case d.pki.oids.desCBC:var Q=X.decrypt(J.encryptedContent.content);$.encryptedContent.key=d.util.createBuffer(Q);break;default:throw Error("Unsupported asymmetric cipher, OID "+J.encryptedContent.algorithm)}RW($)},addRecipient:function(J){$.recipients.push({version:0,issuer:J.issuer.attributes,serialNumber:J.serialNumber,encryptedContent:{algorithm:d.pki.oids.rsaEncryption,key:J.publicKey}})},encrypt:function(J,X){if($.encryptedContent.content===void 0){X=X||$.encryptedContent.algorithm,J=J||$.encryptedContent.key;var Q,Y,G;switch(X){case d.pki.oids["aes128-CBC"]:Q=16,Y=16,G=d.aes.createEncryptionCipher;break;case d.pki.oids["aes192-CBC"]:Q=24,Y=16,G=d.aes.createEncryptionCipher;break;case d.pki.oids["aes256-CBC"]:Q=32,Y=16,G=d.aes.createEncryptionCipher;break;case d.pki.oids["des-EDE3-CBC"]:Q=24,Y=8,G=d.des.createEncryptionCipher;break;default:throw Error("Unsupported symmetric cipher, OID "+X)}if(J===void 0)J=d.util.createBuffer(d.random.getBytes(Q));else if(J.length()!=Q)throw Error("Symmetric key has wrong length; got "+J.length()+" bytes, expected "+Q+".");$.encryptedContent.algorithm=X,$.encryptedContent.key=J,$.encryptedContent.parameter=d.util.createBuffer(d.random.getBytes(Y));var W=G(J);if(W.start($.encryptedContent.parameter.copy()),W.update($.content),!W.finish())throw Error("Symmetric encryption failed.");$.encryptedContent.content=W.output}for(var U=0;U<$.recipients.length;++U){var M=$.recipients[U];if(M.encryptedContent.content!==void 0)continue;switch(M.encryptedContent.algorithm){case d.pki.oids.rsaEncryption:M.encryptedContent.content=M.encryptedContent.key.encrypt($.encryptedContent.key.data);break;default:throw Error("Unsupported asymmetric cipher, OID "+M.encryptedContent.algorithm)}}}},$};function IH($){var J={},X=[];if(!B.validate($,DJ.asn1.recipientInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 RecipientInfo. ASN.1 object is not an PKCS#7 RecipientInfo.");throw Q.errors=X,Q}return{version:J.version.charCodeAt(0),issuer:d.pki.RDNAttributesAsArray(J.issuer),serialNumber:d.util.createBuffer(J.serial).toHex(),encryptedContent:{algorithm:B.derToOid(J.encAlgorithm),parameter:J.encParameter?J.encParameter.value:void 0,content:J.encKey}}}function CH($){return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[d.pki.distinguishedNameToAsn1({attributes:$.issuer}),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,d.util.hexToBytes($.serialNumber))]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.encryptedContent.algorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]),B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.encryptedContent.content)])}function wH($){var J=[];for(var X=0;X<$.length;++X)J.push(IH($[X]));return J}function PH($){var J=[];for(var X=0;X<$.length;++X)J.push(CH($[X]));return J}function _H($){var J=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[d.pki.distinguishedNameToAsn1({attributes:$.issuer}),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,d.util.hexToBytes($.serialNumber))]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.digestAlgorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")])]);if($.authenticatedAttributesAsn1)J.value.push($.authenticatedAttributesAsn1);if(J.value.push(B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.signatureAlgorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")])),J.value.push(B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.signature)),$.unauthenticatedAttributes.length>0){var X=B.create(B.Class.CONTEXT_SPECIFIC,1,!0,[]);for(var Q=0;Q<$.unauthenticatedAttributes.length;++Q){var Y=$.unauthenticatedAttributes[Q];X.values.push(d8(Y))}J.value.push(X)}return J}function xH($){var J=[];for(var X=0;X<$.length;++X)J.push(_H($[X]));return J}function d8($){var J;if($.type===d.pki.oids.contentType)J=B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.value).getBytes());else if($.type===d.pki.oids.messageDigest)J=B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.value.bytes());else if($.type===d.pki.oids.signingTime){var X=new Date("1950-01-01T00:00:00Z"),Q=new Date("2050-01-01T00:00:00Z"),Y=$.value;if(typeof Y==="string"){var G=Date.parse(Y);if(!isNaN(G))Y=new Date(G);else if(Y.length===13)Y=B.utcTimeToDate(Y);else Y=B.generalizedTimeToDate(Y)}if(Y>=X&&Y<Q)J=B.create(B.Class.UNIVERSAL,B.Type.UTCTIME,!1,B.dateToUtcTime(Y));else J=B.create(B.Class.UNIVERSAL,B.Type.GENERALIZEDTIME,!1,B.dateToGeneralizedTime(Y))}return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,[J])])}function vH($){return[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(d.pki.oids.data).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.algorithm).getBytes()),!$.parameter?void 0:B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.parameter.getBytes())]),B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.content.getBytes())])]}function c8($,J,X){var Q={},Y=[];if(!B.validate(J,X,Q,Y)){var G=Error("Cannot read PKCS#7 message. ASN.1 object is not a supported PKCS#7 message.");throw G.errors=G,G}var W=B.derToOid(Q.contentType);if(W!==d.pki.oids.data)throw Error("Unsupported PKCS#7 message. Only wrapped ContentType Data supported.");if(Q.encryptedContent){var U="";if(d.util.isArray(Q.encryptedContent))for(var M=0;M<Q.encryptedContent.length;++M){if(Q.encryptedContent[M].type!==B.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting encrypted content constructed of only OCTET STRING objects.");U+=Q.encryptedContent[M].value}else U=Q.encryptedContent;$.encryptedContent={algorithm:B.derToOid(Q.encAlgorithm),parameter:d.util.createBuffer(Q.encParameter.value),content:d.util.createBuffer(U)}}if(Q.content){var U="";if(d.util.isArray(Q.content))for(var M=0;M<Q.content.length;++M){if(Q.content[M].type!==B.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting content constructed of only OCTET STRING objects.");U+=Q.content[M].value}else U=Q.content;$.content=d.util.createBuffer(U)}return $.version=Q.version.charCodeAt(0),$.rawCapture=Q,Q}function RW($){if($.encryptedContent.key===void 0)throw Error("Symmetric key not available.");if($.content===void 0){var J;switch($.encryptedContent.algorithm){case d.pki.oids["aes128-CBC"]:case d.pki.oids["aes192-CBC"]:case d.pki.oids["aes256-CBC"]:J=d.aes.createDecryptionCipher($.encryptedContent.key);break;case d.pki.oids.desCBC:case d.pki.oids["des-EDE3-CBC"]:J=d.des.createDecryptionCipher($.encryptedContent.key);break;default:throw Error("Unsupported symmetric cipher, OID "+$.encryptedContent.algorithm)}if(J.start($.encryptedContent.parameter),J.update($.encryptedContent.content),!J.finish())throw Error("Symmetric decryption failed.");$.content=J.output}}});var jW=O$((fF,BW)=>{var QJ=z$();w0();TQ();ZY();wQ();w$();var nY=BW.exports=QJ.ssh=QJ.ssh||{};nY.privateKeyToPutty=function($,J,X){X=X||"",J=J||"";var Q="ssh-rsa",Y=J===""?"none":"aes256-cbc",G="PuTTY-User-Key-File-2: "+Q+`\r
15
+ `+U+J.substr(W+1);G=Y-W-1,W=-1,++Y}else if(J[Y]===" "||J[Y]==="\t"||J[Y]===",")W=Y;return J}function GM($){return $.replace(/^\s+/,"")}});var AX=H$((qF,lG)=>{var o$=F$();FY();s9();_$();lG.exports=o$.des=o$.des||{};o$.des.startEncrypting=function($,J,X,Q){var Y=SY({key:$,output:X,decrypt:!1,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};o$.des.createEncryptionCipher=function($,J){return SY({key:$,output:null,decrypt:!1,mode:J})};o$.des.startDecrypting=function($,J,X,Q){var Y=SY({key:$,output:X,decrypt:!0,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};o$.des.createDecryptionCipher=function($,J){return SY({key:$,output:null,decrypt:!0,mode:J})};o$.des.Algorithm=function($,J){var X=this;X.name=$,X.mode=new J({blockSize:8,cipher:{encrypt:function(Q,Y){return mG(X._keys,Q,Y,!1)},decrypt:function(Q,Y){return mG(X._keys,Q,Y,!0)}}}),X._init=!1};o$.des.Algorithm.prototype.initialize=function($){if(this._init)return;var J=o$.util.createBuffer($.key);if(this.name.indexOf("3DES")===0){if(J.length()!==24)throw Error("Invalid Triple-DES key size: "+J.length()*8)}this._keys=zM(J),this._init=!0};J0("DES-ECB",o$.cipher.modes.ecb);J0("DES-CBC",o$.cipher.modes.cbc);J0("DES-CFB",o$.cipher.modes.cfb);J0("DES-OFB",o$.cipher.modes.ofb);J0("DES-CTR",o$.cipher.modes.ctr);J0("3DES-ECB",o$.cipher.modes.ecb);J0("3DES-CBC",o$.cipher.modes.cbc);J0("3DES-CFB",o$.cipher.modes.cfb);J0("3DES-OFB",o$.cipher.modes.ofb);J0("3DES-CTR",o$.cipher.modes.ctr);function J0($,J){var X=function(){return new o$.des.Algorithm($,J)};o$.cipher.registerAlgorithm($,X)}var WM=[16843776,0,65536,16843780,16842756,66564,4,65536,1024,16843776,16843780,1024,16778244,16842756,16777216,4,1028,16778240,16778240,66560,66560,16842752,16842752,16778244,65540,16777220,16777220,65540,0,1028,66564,16777216,65536,16843780,4,16842752,16843776,16777216,16777216,1024,16842756,65536,66560,16777220,1024,4,16778244,66564,16843780,65540,16842752,16778244,16777220,1028,66564,16843776,1028,16778240,16778240,0,65540,66560,0,16842756],UM=[-2146402272,-2147450880,32768,1081376,1048576,32,-2146435040,-2147450848,-2147483616,-2146402272,-2146402304,-2147483648,-2147450880,1048576,32,-2146435040,1081344,1048608,-2147450848,0,-2147483648,32768,1081376,-2146435072,1048608,-2147483616,0,1081344,32800,-2146402304,-2146435072,32800,0,1081376,-2146435040,1048576,-2147450848,-2146435072,-2146402304,32768,-2146435072,-2147450880,32,-2146402272,1081376,32,32768,-2147483648,32800,-2146402304,1048576,-2147483616,1048608,-2147450848,-2147483616,1048608,1081344,0,-2147450880,32800,-2147483648,-2146435040,-2146402272,1081344],MM=[520,134349312,0,134348808,134218240,0,131592,134218240,131080,134217736,134217736,131072,134349320,131080,134348800,520,134217728,8,134349312,512,131584,134348800,134348808,131592,134218248,131584,131072,134218248,8,134349320,512,134217728,134349312,134217728,131080,520,131072,134349312,134218240,0,512,131080,134349320,134218240,134217736,512,0,134348808,134218248,131072,134217728,134349320,8,131592,131584,134217736,134348800,134218248,520,134348800,131592,8,134348808,131584],OM=[8396801,8321,8321,128,8396928,8388737,8388609,8193,0,8396800,8396800,8396929,129,0,8388736,8388609,1,8192,8388608,8396801,128,8388608,8193,8320,8388737,1,8320,8388736,8192,8396928,8396929,129,8388736,8388609,8396800,8396929,129,0,0,8396800,8320,8388736,8388737,1,8396801,8321,8321,128,8396929,129,1,8192,8388609,8193,8396928,8388737,8193,8320,8388608,8396801,128,8388608,8192,8396928],VM=[256,34078976,34078720,1107296512,524288,256,1073741824,34078720,1074266368,524288,33554688,1074266368,1107296512,1107820544,524544,1073741824,33554432,1074266112,1074266112,0,1073742080,1107820800,1107820800,33554688,1107820544,1073742080,0,1107296256,34078976,33554432,1107296256,524544,524288,1107296512,256,33554432,1073741824,34078720,1107296512,1074266368,33554688,1073741824,1107820544,34078976,1074266368,256,33554432,1107820544,1107820800,524544,1107296256,1107820800,34078720,0,1074266112,1107296256,524544,33554688,1073742080,524288,0,1074266112,34078976,1073742080],HM=[536870928,541065216,16384,541081616,541065216,16,541081616,4194304,536887296,4210704,4194304,536870928,4194320,536887296,536870912,16400,0,4194320,536887312,16384,4210688,536887312,16,541065232,541065232,0,4210704,541081600,16400,4210688,541081600,536870912,536887296,16,541065232,4210688,541081616,4194304,16400,536870928,4194304,536887296,536870912,16400,536870928,541081616,4210688,541065216,4210704,541081600,0,541065232,16,16384,541065216,4210704,16384,4194320,536887312,0,541081600,536870912,4194320,536887312],qM=[2097152,69206018,67110914,0,2048,67110914,2099202,69208064,69208066,2097152,0,67108866,2,67108864,69206018,2050,67110912,2099202,2097154,67110912,67108866,69206016,69208064,2097154,69206016,2048,2050,69208066,2099200,2,67108864,2099200,67108864,2099200,2097152,67110914,67110914,69206018,69206018,2,2097154,67108864,67110912,2097152,69208064,2050,2099202,69208064,2050,67108866,69208066,69206016,2099200,0,2,69208066,0,2099202,69206016,2048,67108866,67110912,2048,2097154],KM=[268439616,4096,262144,268701760,268435456,268439616,64,268435456,262208,268697600,268701760,266240,268701696,266304,4096,64,268697600,268435520,268439552,4160,266240,262208,268697664,268701696,4160,0,0,268697664,268435520,268439552,266304,262144,266304,262144,268701696,4096,64,268697664,4096,266304,268439552,64,268435520,268697600,268697664,268435456,262144,268439616,0,268701760,262208,268435520,268697600,268439552,268439616,0,268701760,266240,266240,4160,4160,262208,268435456,268701696];function zM($){var J=[0,4,536870912,536870916,65536,65540,536936448,536936452,512,516,536871424,536871428,66048,66052,536936960,536936964],X=[0,1,1048576,1048577,67108864,67108865,68157440,68157441,256,257,1048832,1048833,67109120,67109121,68157696,68157697],Q=[0,8,2048,2056,16777216,16777224,16779264,16779272,0,8,2048,2056,16777216,16777224,16779264,16779272],Y=[0,2097152,134217728,136314880,8192,2105344,134225920,136323072,131072,2228224,134348800,136445952,139264,2236416,134356992,136454144],G=[0,262144,16,262160,0,262144,16,262160,4096,266240,4112,266256,4096,266240,4112,266256],W=[0,1024,32,1056,0,1024,32,1056,33554432,33555456,33554464,33555488,33554432,33555456,33554464,33555488],U=[0,268435456,524288,268959744,2,268435458,524290,268959746,0,268435456,524288,268959744,2,268435458,524290,268959746],M=[0,65536,2048,67584,536870912,536936448,536872960,536938496,131072,196608,133120,198656,537001984,537067520,537004032,537069568],O=[0,262144,0,262144,2,262146,2,262146,33554432,33816576,33554432,33816576,33554434,33816578,33554434,33816578],V=[0,268435456,8,268435464,0,268435456,8,268435464,1024,268436480,1032,268436488,1024,268436480,1032,268436488],H=[0,32,0,32,1048576,1048608,1048576,1048608,8192,8224,8192,8224,1056768,1056800,1056768,1056800],q=[0,16777216,512,16777728,2097152,18874368,2097664,18874880,67108864,83886080,67109376,83886592,69206016,85983232,69206528,85983744],F=[0,4096,134217728,134221824,524288,528384,134742016,134746112,16,4112,134217744,134221840,524304,528400,134742032,134746128],K=[0,4,256,260,0,4,256,260,1,5,257,261,1,5,257,261],A=$.length()>8?3:1,L=[],R=[0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0],I=0,j;for(var C=0;C<A;C++){var w=$.getInt32(),P=$.getInt32();j=(w>>>4^P)&252645135,P^=j,w^=j<<4,j=(P>>>-16^w)&65535,w^=j,P^=j<<-16,j=(w>>>2^P)&858993459,P^=j,w^=j<<2,j=(P>>>-16^w)&65535,w^=j,P^=j<<-16,j=(w>>>1^P)&1431655765,P^=j,w^=j<<1,j=(P>>>8^w)&16711935,w^=j,P^=j<<8,j=(w>>>1^P)&1431655765,P^=j,w^=j<<1,j=w<<8|P>>>20&240,w=P<<24|P<<8&16711680|P>>>8&65280|P>>>24&240,P=j;for(var l=0;l<R.length;++l){if(R[l])w=w<<2|w>>>26,P=P<<2|P>>>26;else w=w<<1|w>>>27,P=P<<1|P>>>27;w&=-15,P&=-15;var e=J[w>>>28]|X[w>>>24&15]|Q[w>>>20&15]|Y[w>>>16&15]|G[w>>>12&15]|W[w>>>8&15]|U[w>>>4&15],y=M[P>>>28]|O[P>>>24&15]|V[P>>>20&15]|H[P>>>16&15]|q[P>>>12&15]|F[P>>>8&15]|K[P>>>4&15];j=(y>>>16^e)&65535,L[I++]=e^j,L[I++]=y^j<<16}}return L}function mG($,J,X,Q){var Y=$.length===32?3:9,G;if(Y===3)G=Q?[30,-2,-2]:[0,32,2];else G=Q?[94,62,-2,32,64,2,30,-2,-2]:[0,32,2,62,30,-2,64,96,2];var W,U=J[0],M=J[1];W=(U>>>4^M)&252645135,M^=W,U^=W<<4,W=(U>>>16^M)&65535,M^=W,U^=W<<16,W=(M>>>2^U)&858993459,U^=W,M^=W<<2,W=(M>>>8^U)&16711935,U^=W,M^=W<<8,W=(U>>>1^M)&1431655765,M^=W,U^=W<<1,U=U<<1|U>>>31,M=M<<1|M>>>31;for(var O=0;O<Y;O+=3){var V=G[O+1],H=G[O+2];for(var q=G[O];q!=V;q+=H){var F=M^$[q],K=(M>>>4|M<<28)^$[q+1];W=U,U=M,M=W^(UM[F>>>24&63]|OM[F>>>16&63]|HM[F>>>8&63]|KM[F&63]|WM[K>>>24&63]|MM[K>>>16&63]|VM[K>>>8&63]|qM[K&63])}W=U,U=M,M=W}U=U>>>1|U<<31,M=M>>>1|M<<31,W=(U>>>1^M)&1431655765,M^=W,U^=W<<1,W=(M>>>8^U)&16711935,U^=W,M^=W<<8,W=(M>>>2^U)&858993459,U^=W,M^=W<<2,W=(U>>>16^M)&65535,M^=W,U^=W<<16,W=(U>>>4^M)&252645135,M^=W,U^=W<<4,X[0]=U,X[1]=M}function SY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="DES-"+J,Q;if($.decrypt)Q=o$.cipher.createDecipher(X,$.key);else Q=o$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var U=null;if(W instanceof o$.util.ByteBuffer)U=W,W={};W=W||{},W.output=U,W.iv=G,Y.call(Q,W)},Q}});var IY=H$((KF,pG)=>{var AJ=F$();TQ();eJ();_$();var EM=AJ.pkcs5=AJ.pkcs5||{},N0;if(AJ.util.isNodejs&&!AJ.options.usePureJavaScript)N0=OX("crypto");pG.exports=AJ.pbkdf2=EM.pbkdf2=function($,J,X,Q,Y,G){if(typeof Y==="function")G=Y,Y=null;if(AJ.util.isNodejs&&!AJ.options.usePureJavaScript&&N0.pbkdf2&&(Y===null||typeof Y!=="object")&&(N0.pbkdf2Sync.length>4||(!Y||Y==="sha1"))){if(typeof Y!=="string")Y="sha1";if($=Buffer.from($,"binary"),J=Buffer.from(J,"binary"),!G){if(N0.pbkdf2Sync.length===4)return N0.pbkdf2Sync($,J,X,Q).toString("binary");return N0.pbkdf2Sync($,J,X,Q,Y).toString("binary")}if(N0.pbkdf2Sync.length===4)return N0.pbkdf2($,J,X,Q,function(j,C){if(j)return G(j);G(null,C.toString("binary"))});return N0.pbkdf2($,J,X,Q,Y,function(j,C){if(j)return G(j);G(null,C.toString("binary"))})}if(typeof Y>"u"||Y===null)Y="sha1";if(typeof Y==="string"){if(!(Y in AJ.md.algorithms))throw Error("Unknown hash algorithm: "+Y);Y=AJ.md[Y].create()}var W=Y.digestLength;if(Q>4294967295*W){var U=Error("Derived key is too long.");if(G)return G(U);throw U}var M=Math.ceil(Q/W),O=Q-(M-1)*W,V=AJ.hmac.create();V.start(Y,$);var H="",q,F,K;if(!G){for(var A=1;A<=M;++A){V.start(null,null),V.update(J),V.update(AJ.util.int32ToBytes(A)),q=K=V.digest().getBytes();for(var L=2;L<=X;++L)V.start(null,null),V.update(K),F=V.digest().getBytes(),q=AJ.util.xorBytes(q,F,W),K=F;H+=A<M?q:q.substr(0,O)}return H}var A=1,L;function R(){if(A>M)return G(null,H);V.start(null,null),V.update(J),V.update(AJ.util.int32ToBytes(A)),q=K=V.digest().getBytes(),L=2,I()}function I(){if(L<=X)return V.start(null,null),V.update(K),F=V.digest().getBytes(),q=AJ.util.xorBytes(q,F,W),K=F,++L,AJ.util.setImmediate(I);H+=A<M?q:q.substr(0,O),++A,R()}R()}});var X8=H$((zF,oG)=>{var Q0=F$();eJ();_$();var cG=oG.exports=Q0.sha256=Q0.sha256||{};Q0.md.sha256=Q0.md.algorithms.sha256=cG;cG.create=function(){if(!nG)FM();var $=null,J=Q0.util.createBuffer(),X=Array(64),Q={algorithm:"sha256",blockLength:64,digestLength:32,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=Q0.util.createBuffer(),$={h0:1779033703,h1:3144134277,h2:1013904242,h3:2773480762,h4:1359893119,h5:2600822924,h6:528734635,h7:1541459225},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=Q0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),dG($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=Q0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(Q8.substr(0,Q.blockLength-W));var U,M,O=Q.fullMessageLength[0]*8;for(var V=0;V<Q.fullMessageLength.length-1;++V)U=Q.fullMessageLength[V+1]*8,M=U/4294967296>>>0,O+=M,Y.putInt32(O>>>0),O=U>>>0;Y.putInt32(O);var H={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4,h5:$.h5,h6:$.h6,h7:$.h7};dG(H,X,Y);var q=Q0.util.createBuffer();return q.putInt32(H.h0),q.putInt32(H.h1),q.putInt32(H.h2),q.putInt32(H.h3),q.putInt32(H.h4),q.putInt32(H.h5),q.putInt32(H.h6),q.putInt32(H.h7),q},Q};var Q8=null,nG=!1,iG=null;function FM(){Q8=String.fromCharCode(128),Q8+=Q0.util.fillString(String.fromCharCode(0),64),iG=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],nG=!0}function dG($,J,X){var Q,Y,G,W,U,M,O,V,H,q,F,K,A,L,R,I=X.length();while(I>=64){for(O=0;O<16;++O)J[O]=X.getInt32();for(;O<64;++O)Q=J[O-2],Q=(Q>>>17|Q<<15)^(Q>>>19|Q<<13)^Q>>>10,Y=J[O-15],Y=(Y>>>7|Y<<25)^(Y>>>18|Y<<14)^Y>>>3,J[O]=Q+J[O-7]+Y+J[O-16]|0;V=$.h0,H=$.h1,q=$.h2,F=$.h3,K=$.h4,A=$.h5,L=$.h6,R=$.h7;for(O=0;O<64;++O)W=(K>>>6|K<<26)^(K>>>11|K<<21)^(K>>>25|K<<7),U=L^K&(A^L),G=(V>>>2|V<<30)^(V>>>13|V<<19)^(V>>>22|V<<10),M=V&H|q&(V^H),Q=R+W+U+iG[O]+J[O],Y=G+M,R=L,L=A,A=K,K=F+Q>>>0,F=q,q=H,H=V,V=Q+Y>>>0;$.h0=$.h0+V|0,$.h1=$.h1+H|0,$.h2=$.h2+q|0,$.h3=$.h3+F|0,$.h4=$.h4+K|0,$.h5=$.h5+A|0,$.h6=$.h6+L|0,$.h7=$.h7+R|0,I-=64}}});var Y8=H$((EF,aG)=>{var X0=F$();_$();var CY=null;if(X0.util.isNodejs&&!X0.options.usePureJavaScript&&!process.versions["node-webkit"])CY=OX("crypto");var NM=aG.exports=X0.prng=X0.prng||{};NM.create=function($){var J={plugin:$,key:null,seed:null,time:null,reseeds:0,generated:0,keyBytes:""},X=$.md,Q=Array(32);for(var Y=0;Y<32;++Y)Q[Y]=X.create();J.pools=Q,J.pool=0,J.generate=function(O,V){if(!V)return J.generateSync(O);var H=J.plugin.cipher,q=J.plugin.increment,F=J.plugin.formatKey,K=J.plugin.formatSeed,A=X0.util.createBuffer();J.key=null,L();function L(R){if(R)return V(R);if(A.length()>=O)return V(null,A.getBytes(O));if(J.generated>1048575)J.key=null;if(J.key===null)return X0.util.nextTick(function(){G(L)});var I=H(J.key,J.seed);J.generated+=I.length,A.putBytes(I),J.key=F(H(J.key,q(J.seed))),J.seed=K(H(J.key,J.seed)),X0.util.setImmediate(L)}},J.generateSync=function(O){var V=J.plugin.cipher,H=J.plugin.increment,q=J.plugin.formatKey,F=J.plugin.formatSeed;J.key=null;var K=X0.util.createBuffer();while(K.length()<O){if(J.generated>1048575)J.key=null;if(J.key===null)W();var A=V(J.key,J.seed);J.generated+=A.length,K.putBytes(A),J.key=q(V(J.key,H(J.seed))),J.seed=F(V(J.key,J.seed))}return K.getBytes(O)};function G(O){if(J.pools[0].messageLength>=32)return U(),O();var V=32-J.pools[0].messageLength<<5;J.seedFile(V,function(H,q){if(H)return O(H);J.collect(q),U(),O()})}function W(){if(J.pools[0].messageLength>=32)return U();var O=32-J.pools[0].messageLength<<5;J.collect(J.seedFileSync(O)),U()}function U(){J.reseeds=J.reseeds===4294967295?0:J.reseeds+1;var O=J.plugin.md.create();O.update(J.keyBytes);var V=1;for(var H=0;H<32;++H){if(J.reseeds%V===0)O.update(J.pools[H].digest().getBytes()),J.pools[H].start();V=V<<1}J.keyBytes=O.digest().getBytes(),O.start(),O.update(J.keyBytes);var q=O.digest().getBytes();J.key=J.plugin.formatKey(J.keyBytes),J.seed=J.plugin.formatSeed(q),J.generated=0}function M(O){var V=null,H=X0.util.globalScope,q=H.crypto||H.msCrypto;if(q&&q.getRandomValues)V=function(w){return q.getRandomValues(w)};var F=X0.util.createBuffer();if(V)while(F.length()<O){var K=Math.max(1,Math.min(O-F.length(),65536)/4),A=new Uint32Array(Math.floor(K));try{V(A);for(var L=0;L<A.length;++L)F.putInt32(A[L])}catch(w){if(!(typeof QuotaExceededError<"u"&&w instanceof QuotaExceededError))throw w}}if(F.length()<O){var R,I,j,C=Math.floor(Math.random()*65536);while(F.length()<O){I=16807*(C&65535),R=16807*(C>>16),I+=(R&32767)<<16,I+=R>>15,I=(I&2147483647)+(I>>31),C=I&4294967295;for(var L=0;L<3;++L)j=C>>>(L<<3),j^=Math.floor(Math.random()*256),F.putByte(j&255)}}return F.getBytes(O)}if(CY)J.seedFile=function(O,V){CY.randomBytes(O,function(H,q){if(H)return V(H);V(null,q.toString())})},J.seedFileSync=function(O){return CY.randomBytes(O).toString()};else J.seedFile=function(O,V){try{V(null,M(O))}catch(H){V(H)}},J.seedFileSync=M;return J.collect=function(O){var V=O.length;for(var H=0;H<V;++H)J.pools[J.pool].update(O.substr(H,1)),J.pool=J.pool===31?0:J.pool+1},J.collectInt=function(O,V){var H="";for(var q=0;q<V;q+=8)H+=String.fromCharCode(O>>q&255);J.collect(H)},J.registerWorker=function(O){if(O===self)J.seedFile=function(H,q){function F(K){var A=K.data;if(A.forge&&A.forge.prng)self.removeEventListener("message",F),q(A.forge.prng.err,A.forge.prng.bytes)}self.addEventListener("message",F),self.postMessage({forge:{prng:{needed:H}}})};else{var V=function(H){var q=H.data;if(q.forge&&q.forge.prng)J.seedFile(q.forge.prng.needed,function(F,K){O.postMessage({forge:{prng:{err:F,bytes:K}}})})};O.addEventListener("message",V)}},J}});var _J=H$((FF,G8)=>{var VJ=F$();w0();X8();Y8();_$();(function(){if(VJ.random&&VJ.random.getBytes){G8.exports=VJ.random;return}(function($){var J={},X=[,,,,],Q=VJ.util.createBuffer();J.formatKey=function(H){var q=VJ.util.createBuffer(H);return H=[,,,,],H[0]=q.getInt32(),H[1]=q.getInt32(),H[2]=q.getInt32(),H[3]=q.getInt32(),VJ.aes._expandKey(H,!1)},J.formatSeed=function(H){var q=VJ.util.createBuffer(H);return H=[,,,,],H[0]=q.getInt32(),H[1]=q.getInt32(),H[2]=q.getInt32(),H[3]=q.getInt32(),H},J.cipher=function(H,q){return VJ.aes._updateBlock(H,q,X,!1),Q.putInt32(X[0]),Q.putInt32(X[1]),Q.putInt32(X[2]),Q.putInt32(X[3]),Q.getBytes()},J.increment=function(H){return++H[3],H},J.md=VJ.md.sha256;function Y(){var H=VJ.prng.create(J);return H.getBytes=function(q,F){return H.generate(q,F)},H.getBytesSync=function(q){return H.generate(q)},H}var G=Y(),W=null,U=VJ.util.globalScope,M=U.crypto||U.msCrypto;if(M&&M.getRandomValues)W=function(H){return M.getRandomValues(H)};if(VJ.options.usePureJavaScript||!VJ.util.isNodejs&&!W){if(typeof window>"u"||window.document===void 0);if(G.collectInt(+new Date,32),typeof navigator<"u"){var O="";for(var V in navigator)try{if(typeof navigator[V]=="string")O+=navigator[V]}catch(H){}G.collect(O),O=null}if($)$().mousemove(function(H){G.collectInt(H.clientX,16),G.collectInt(H.clientY,16)}),$().keypress(function(H){G.collectInt(H.charCode,8)})}if(!VJ.random)VJ.random=G;else for(var V in G)VJ.random[V]=G[V];VJ.random.createInstance=Y,G8.exports=VJ.random})(typeof jQuery<"u"?jQuery:null)})()});var U8=H$((NF,tG)=>{var ZJ=F$();_$();var W8=[217,120,249,196,25,221,181,237,40,233,253,121,74,160,216,157,198,126,55,131,43,118,83,142,98,76,100,136,68,139,251,162,23,154,89,245,135,179,79,19,97,69,109,141,9,129,125,50,189,143,64,235,134,183,123,11,240,149,33,34,92,107,78,130,84,214,101,147,206,96,178,28,115,86,192,20,167,140,241,220,18,117,202,31,59,190,228,209,66,61,212,48,163,60,182,38,111,191,14,218,70,105,7,87,39,242,29,155,188,148,67,3,248,17,199,246,144,239,62,231,6,195,213,47,200,102,30,215,8,232,234,222,128,82,238,247,132,170,114,172,53,77,106,42,150,26,210,113,90,21,73,116,75,159,208,94,4,24,164,236,194,224,65,110,15,81,203,204,36,145,175,80,161,244,112,57,153,124,58,133,35,184,180,122,252,2,54,91,37,85,151,49,45,93,250,152,227,138,146,174,5,223,41,16,103,108,186,201,211,0,230,207,225,158,168,44,99,22,1,63,88,226,137,169,13,56,52,27,171,51,255,176,187,72,12,95,185,177,205,46,197,243,219,71,229,165,156,119,10,166,32,104,254,127,193,173],sG=[1,2,3,5],LM=function($,J){return $<<J&65535|($&65535)>>16-J},AM=function($,J){return($&65535)>>J|$<<16-J&65535};tG.exports=ZJ.rc2=ZJ.rc2||{};ZJ.rc2.expandKey=function($,J){if(typeof $==="string")$=ZJ.util.createBuffer($);J=J||128;var X=$,Q=$.length(),Y=J,G=Math.ceil(Y/8),W=255>>(Y&7),U;for(U=Q;U<128;U++)X.putByte(W8[X.at(U-1)+X.at(U-Q)&255]);X.setAt(128-G,W8[X.at(128-G)&W]);for(U=127-G;U>=0;U--)X.setAt(U,W8[X.at(U+1)^X.at(U+G)]);return X};var rG=function($,J,X){var Q=!1,Y=null,G=null,W=null,U,M,O,V,H=[];$=ZJ.rc2.expandKey($,J);for(O=0;O<64;O++)H.push($.getInt16Le());if(X)U=function(K){for(O=0;O<4;O++)K[O]+=H[V]+(K[(O+3)%4]&K[(O+2)%4])+(~K[(O+3)%4]&K[(O+1)%4]),K[O]=LM(K[O],sG[O]),V++},M=function(K){for(O=0;O<4;O++)K[O]+=H[K[(O+3)%4]&63]};else U=function(K){for(O=3;O>=0;O--)K[O]=AM(K[O],sG[O]),K[O]-=H[V]+(K[(O+3)%4]&K[(O+2)%4])+(~K[(O+3)%4]&K[(O+1)%4]),V--},M=function(K){for(O=3;O>=0;O--)K[O]-=H[K[(O+3)%4]&63]};var q=function(K){var A=[];for(O=0;O<4;O++){var L=Y.getInt16Le();if(W!==null)if(X)L^=W.getInt16Le();else W.putInt16Le(L);A.push(L&65535)}V=X?0:63;for(var R=0;R<K.length;R++)for(var I=0;I<K[R][0];I++)K[R][1](A);for(O=0;O<4;O++){if(W!==null)if(X)W.putInt16Le(A[O]);else A[O]^=W.getInt16Le();G.putInt16Le(A[O])}},F=null;return F={start:function(K,A){if(K){if(typeof K==="string")K=ZJ.util.createBuffer(K)}Q=!1,Y=ZJ.util.createBuffer(),G=A||new ZJ.util.createBuffer,W=K,F.output=G},update:function(K){if(!Q)Y.putBuffer(K);while(Y.length()>=8)q([[5,U],[1,M],[6,U],[1,M],[5,U]])},finish:function(K){var A=!0;if(X)if(K)A=K(8,Y,!X);else{var L=Y.length()===8?8:8-Y.length();Y.fillWithByte(L,L)}if(A)Q=!0,F.update();if(!X){if(A=Y.length()===0,A)if(K)A=K(8,G,!X);else{var R=G.length(),I=G.at(R-1);if(I>R)A=!1;else G.truncate(I)}}return A}},F};ZJ.rc2.startEncrypting=function($,J,X){var Q=ZJ.rc2.createEncryptionCipher($,128);return Q.start(J,X),Q};ZJ.rc2.createEncryptionCipher=function($,J){return rG($,J,!0)};ZJ.rc2.startDecrypting=function($,J,X){var Q=ZJ.rc2.createDecryptionCipher($,128);return Q.start(J,X),Q};ZJ.rc2.createDecryptionCipher=function($,J){return rG($,J,!1)}});var DX=H$((LF,W1)=>{var M8=F$();W1.exports=M8.jsbn=M8.jsbn||{};var L0,RM=244837814094590,eG=(RM&16777215)==15715070;function v($,J,X){if(this.data=[],$!=null)if(typeof $=="number")this.fromNumber($,J,X);else if(J==null&&typeof $!="string")this.fromString($,256);else this.fromString($,J)}M8.jsbn.BigInteger=v;function C$(){return new v(null)}function DM($,J,X,Q,Y,G){while(--G>=0){var W=J*this.data[$++]+X.data[Q]+Y;Y=Math.floor(W/67108864),X.data[Q++]=W&67108863}return Y}function ZM($,J,X,Q,Y,G){var W=J&32767,U=J>>15;while(--G>=0){var M=this.data[$]&32767,O=this.data[$++]>>15,V=U*M+O*W;M=W*M+((V&32767)<<15)+X.data[Q]+(Y&1073741823),Y=(M>>>30)+(V>>>15)+U*O+(Y>>>30),X.data[Q++]=M&1073741823}return Y}function $1($,J,X,Q,Y,G){var W=J&16383,U=J>>14;while(--G>=0){var M=this.data[$]&16383,O=this.data[$++]>>14,V=U*M+O*W;M=W*M+((V&16383)<<14)+X.data[Q]+Y,Y=(M>>28)+(V>>14)+U*O,X.data[Q++]=M&268435455}return Y}if(typeof navigator>"u")v.prototype.am=$1,L0=28;else if(eG&&navigator.appName=="Microsoft Internet Explorer")v.prototype.am=ZM,L0=30;else if(eG&&navigator.appName!="Netscape")v.prototype.am=DM,L0=26;else v.prototype.am=$1,L0=28;v.prototype.DB=L0;v.prototype.DM=(1<<L0)-1;v.prototype.DV=1<<L0;var O8=52;v.prototype.FV=Math.pow(2,O8);v.prototype.F1=O8-L0;v.prototype.F2=2*L0-O8;var BM="0123456789abcdefghijklmnopqrstuvwxyz",wY=[],IQ,xJ;IQ=48;for(xJ=0;xJ<=9;++xJ)wY[IQ++]=xJ;IQ=97;for(xJ=10;xJ<36;++xJ)wY[IQ++]=xJ;IQ=65;for(xJ=10;xJ<36;++xJ)wY[IQ++]=xJ;function J1($){return BM.charAt($)}function Q1($,J){var X=wY[$.charCodeAt(J)];return X==null?-1:X}function jM($){for(var J=this.t-1;J>=0;--J)$.data[J]=this.data[J];$.t=this.t,$.s=this.s}function TM($){if(this.t=1,this.s=$<0?-1:0,$>0)this.data[0]=$;else if($<-1)this.data[0]=$+this.DV;else this.t=0}function _0($){var J=C$();return J.fromInt($),J}function SM($,J){var X;if(J==16)X=4;else if(J==8)X=3;else if(J==256)X=8;else if(J==2)X=1;else if(J==32)X=5;else if(J==4)X=2;else{this.fromRadix($,J);return}this.t=0,this.s=0;var Q=$.length,Y=!1,G=0;while(--Q>=0){var W=X==8?$[Q]&255:Q1($,Q);if(W<0){if($.charAt(Q)=="-")Y=!0;continue}if(Y=!1,G==0)this.data[this.t++]=W;else if(G+X>this.DB)this.data[this.t-1]|=(W&(1<<this.DB-G)-1)<<G,this.data[this.t++]=W>>this.DB-G;else this.data[this.t-1]|=W<<G;if(G+=X,G>=this.DB)G-=this.DB}if(X==8&&($[0]&128)!=0){if(this.s=-1,G>0)this.data[this.t-1]|=(1<<this.DB-G)-1<<G}if(this.clamp(),Y)v.ZERO.subTo(this,this)}function IM(){var $=this.s&this.DM;while(this.t>0&&this.data[this.t-1]==$)--this.t}function CM($){if(this.s<0)return"-"+this.negate().toString($);var J;if($==16)J=4;else if($==8)J=3;else if($==2)J=1;else if($==32)J=5;else if($==4)J=2;else return this.toRadix($);var X=(1<<J)-1,Q,Y=!1,G="",W=this.t,U=this.DB-W*this.DB%J;if(W-- >0){if(U<this.DB&&(Q=this.data[W]>>U)>0)Y=!0,G=J1(Q);while(W>=0){if(U<J)Q=(this.data[W]&(1<<U)-1)<<J-U,Q|=this.data[--W]>>(U+=this.DB-J);else if(Q=this.data[W]>>(U-=J)&X,U<=0)U+=this.DB,--W;if(Q>0)Y=!0;if(Y)G+=J1(Q)}}return Y?G:"0"}function wM(){var $=C$();return v.ZERO.subTo(this,$),$}function PM(){return this.s<0?this.negate():this}function _M($){var J=this.s-$.s;if(J!=0)return J;var X=this.t;if(J=X-$.t,J!=0)return this.s<0?-J:J;while(--X>=0)if((J=this.data[X]-$.data[X])!=0)return J;return 0}function PY($){var J=1,X;if((X=$>>>16)!=0)$=X,J+=16;if((X=$>>8)!=0)$=X,J+=8;if((X=$>>4)!=0)$=X,J+=4;if((X=$>>2)!=0)$=X,J+=2;if((X=$>>1)!=0)$=X,J+=1;return J}function xM(){if(this.t<=0)return 0;return this.DB*(this.t-1)+PY(this.data[this.t-1]^this.s&this.DM)}function vM($,J){var X;for(X=this.t-1;X>=0;--X)J.data[X+$]=this.data[X];for(X=$-1;X>=0;--X)J.data[X]=0;J.t=this.t+$,J.s=this.s}function kM($,J){for(var X=$;X<this.t;++X)J.data[X-$]=this.data[X];J.t=Math.max(this.t-$,0),J.s=this.s}function fM($,J){var X=$%this.DB,Q=this.DB-X,Y=(1<<Q)-1,G=Math.floor($/this.DB),W=this.s<<X&this.DM,U;for(U=this.t-1;U>=0;--U)J.data[U+G+1]=this.data[U]>>Q|W,W=(this.data[U]&Y)<<X;for(U=G-1;U>=0;--U)J.data[U]=0;J.data[G]=W,J.t=this.t+G+1,J.s=this.s,J.clamp()}function yM($,J){J.s=this.s;var X=Math.floor($/this.DB);if(X>=this.t){J.t=0;return}var Q=$%this.DB,Y=this.DB-Q,G=(1<<Q)-1;J.data[0]=this.data[X]>>Q;for(var W=X+1;W<this.t;++W)J.data[W-X-1]|=(this.data[W]&G)<<Y,J.data[W-X]=this.data[W]>>Q;if(Q>0)J.data[this.t-X-1]|=(this.s&G)<<Y;J.t=this.t-X,J.clamp()}function bM($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]-$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q-=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q-=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q-=$.s}if(J.s=Q<0?-1:0,Q<-1)J.data[X++]=this.DV+Q;else if(Q>0)J.data[X++]=Q;J.t=X,J.clamp()}function hM($,J){var X=this.abs(),Q=$.abs(),Y=X.t;J.t=Y+Q.t;while(--Y>=0)J.data[Y]=0;for(Y=0;Y<Q.t;++Y)J.data[Y+X.t]=X.am(0,Q.data[Y],J,Y,0,X.t);if(J.s=0,J.clamp(),this.s!=$.s)v.ZERO.subTo(J,J)}function uM($){var J=this.abs(),X=$.t=2*J.t;while(--X>=0)$.data[X]=0;for(X=0;X<J.t-1;++X){var Q=J.am(X,J.data[X],$,2*X,0,1);if(($.data[X+J.t]+=J.am(X+1,2*J.data[X],$,2*X+1,Q,J.t-X-1))>=J.DV)$.data[X+J.t]-=J.DV,$.data[X+J.t+1]=1}if($.t>0)$.data[$.t-1]+=J.am(X,J.data[X],$,2*X,0,1);$.s=0,$.clamp()}function gM($,J,X){var Q=$.abs();if(Q.t<=0)return;var Y=this.abs();if(Y.t<Q.t){if(J!=null)J.fromInt(0);if(X!=null)this.copyTo(X);return}if(X==null)X=C$();var G=C$(),W=this.s,U=$.s,M=this.DB-PY(Q.data[Q.t-1]);if(M>0)Q.lShiftTo(M,G),Y.lShiftTo(M,X);else Q.copyTo(G),Y.copyTo(X);var O=G.t,V=G.data[O-1];if(V==0)return;var H=V*(1<<this.F1)+(O>1?G.data[O-2]>>this.F2:0),q=this.FV/H,F=(1<<this.F1)/H,K=1<<this.F2,A=X.t,L=A-O,R=J==null?C$():J;if(G.dlShiftTo(L,R),X.compareTo(R)>=0)X.data[X.t++]=1,X.subTo(R,X);v.ONE.dlShiftTo(O,R),R.subTo(G,G);while(G.t<O)G.data[G.t++]=0;while(--L>=0){var I=X.data[--A]==V?this.DM:Math.floor(X.data[A]*q+(X.data[A-1]+K)*F);if((X.data[A]+=G.am(0,I,X,L,0,O))<I){G.dlShiftTo(L,R),X.subTo(R,X);while(X.data[A]<--I)X.subTo(R,X)}}if(J!=null){if(X.drShiftTo(O,J),W!=U)v.ZERO.subTo(J,J)}if(X.t=O,X.clamp(),M>0)X.rShiftTo(M,X);if(W<0)v.ZERO.subTo(X,X)}function mM($){var J=C$();if(this.abs().divRemTo($,null,J),this.s<0&&J.compareTo(v.ZERO)>0)$.subTo(J,J);return J}function QQ($){this.m=$}function lM($){if($.s<0||$.compareTo(this.m)>=0)return $.mod(this.m);else return $}function pM($){return $}function dM($){$.divRemTo(this.m,null,$)}function cM($,J,X){$.multiplyTo(J,X),this.reduce(X)}function nM($,J){$.squareTo(J),this.reduce(J)}QQ.prototype.convert=lM;QQ.prototype.revert=pM;QQ.prototype.reduce=dM;QQ.prototype.mulTo=cM;QQ.prototype.sqrTo=nM;function iM(){if(this.t<1)return 0;var $=this.data[0];if(($&1)==0)return 0;var J=$&3;return J=J*(2-($&15)*J)&15,J=J*(2-($&255)*J)&255,J=J*(2-(($&65535)*J&65535))&65535,J=J*(2-$*J%this.DV)%this.DV,J>0?this.DV-J:-J}function XQ($){this.m=$,this.mp=$.invDigit(),this.mpl=this.mp&32767,this.mph=this.mp>>15,this.um=(1<<$.DB-15)-1,this.mt2=2*$.t}function oM($){var J=C$();if($.abs().dlShiftTo(this.m.t,J),J.divRemTo(this.m,null,J),$.s<0&&J.compareTo(v.ZERO)>0)this.m.subTo(J,J);return J}function aM($){var J=C$();return $.copyTo(J),this.reduce(J),J}function sM($){while($.t<=this.mt2)$.data[$.t++]=0;for(var J=0;J<this.m.t;++J){var X=$.data[J]&32767,Q=X*this.mpl+((X*this.mph+($.data[J]>>15)*this.mpl&this.um)<<15)&$.DM;X=J+this.m.t,$.data[X]+=this.m.am(0,Q,$,J,0,this.m.t);while($.data[X]>=$.DV)$.data[X]-=$.DV,$.data[++X]++}if($.clamp(),$.drShiftTo(this.m.t,$),$.compareTo(this.m)>=0)$.subTo(this.m,$)}function rM($,J){$.squareTo(J),this.reduce(J)}function tM($,J,X){$.multiplyTo(J,X),this.reduce(X)}XQ.prototype.convert=oM;XQ.prototype.revert=aM;XQ.prototype.reduce=sM;XQ.prototype.mulTo=tM;XQ.prototype.sqrTo=rM;function eM(){return(this.t>0?this.data[0]&1:this.s)==0}function $O($,J){if($>4294967295||$<1)return v.ONE;var X=C$(),Q=C$(),Y=J.convert(this),G=PY($)-1;Y.copyTo(X);while(--G>=0)if(J.sqrTo(X,Q),($&1<<G)>0)J.mulTo(Q,Y,X);else{var W=X;X=Q,Q=W}return J.revert(X)}function JO($,J){var X;if($<256||J.isEven())X=new QQ(J);else X=new XQ(J);return this.exp($,X)}v.prototype.copyTo=jM;v.prototype.fromInt=TM;v.prototype.fromString=SM;v.prototype.clamp=IM;v.prototype.dlShiftTo=vM;v.prototype.drShiftTo=kM;v.prototype.lShiftTo=fM;v.prototype.rShiftTo=yM;v.prototype.subTo=bM;v.prototype.multiplyTo=hM;v.prototype.squareTo=uM;v.prototype.divRemTo=gM;v.prototype.invDigit=iM;v.prototype.isEven=eM;v.prototype.exp=$O;v.prototype.toString=CM;v.prototype.negate=wM;v.prototype.abs=PM;v.prototype.compareTo=_M;v.prototype.bitLength=xM;v.prototype.mod=mM;v.prototype.modPowInt=JO;v.ZERO=_0(0);v.ONE=_0(1);function QO(){var $=C$();return this.copyTo($),$}function XO(){if(this.s<0){if(this.t==1)return this.data[0]-this.DV;else if(this.t==0)return-1}else if(this.t==1)return this.data[0];else if(this.t==0)return 0;return(this.data[1]&(1<<32-this.DB)-1)<<this.DB|this.data[0]}function YO(){return this.t==0?this.s:this.data[0]<<24>>24}function GO(){return this.t==0?this.s:this.data[0]<<16>>16}function WO($){return Math.floor(Math.LN2*this.DB/Math.log($))}function UO(){if(this.s<0)return-1;else if(this.t<=0||this.t==1&&this.data[0]<=0)return 0;else return 1}function MO($){if($==null)$=10;if(this.signum()==0||$<2||$>36)return"0";var J=this.chunkSize($),X=Math.pow($,J),Q=_0(X),Y=C$(),G=C$(),W="";this.divRemTo(Q,Y,G);while(Y.signum()>0)W=(X+G.intValue()).toString($).substr(1)+W,Y.divRemTo(Q,Y,G);return G.intValue().toString($)+W}function OO($,J){if(this.fromInt(0),J==null)J=10;var X=this.chunkSize(J),Q=Math.pow(J,X),Y=!1,G=0,W=0;for(var U=0;U<$.length;++U){var M=Q1($,U);if(M<0){if($.charAt(U)=="-"&&this.signum()==0)Y=!0;continue}if(W=J*W+M,++G>=X)this.dMultiply(Q),this.dAddOffset(W,0),G=0,W=0}if(G>0)this.dMultiply(Math.pow(J,G)),this.dAddOffset(W,0);if(Y)v.ZERO.subTo(this,this)}function VO($,J,X){if(typeof J=="number")if($<2)this.fromInt(1);else{if(this.fromNumber($,X),!this.testBit($-1))this.bitwiseTo(v.ONE.shiftLeft($-1),V8,this);if(this.isEven())this.dAddOffset(1,0);while(!this.isProbablePrime(J))if(this.dAddOffset(2,0),this.bitLength()>$)this.subTo(v.ONE.shiftLeft($-1),this)}else{var Q=[],Y=$&7;if(Q.length=($>>3)+1,J.nextBytes(Q),Y>0)Q[0]&=(1<<Y)-1;else Q[0]=0;this.fromString(Q,256)}}function HO(){var $=this.t,J=[];J[0]=this.s;var X=this.DB-$*this.DB%8,Q,Y=0;if($-- >0){if(X<this.DB&&(Q=this.data[$]>>X)!=(this.s&this.DM)>>X)J[Y++]=Q|this.s<<this.DB-X;while($>=0){if(X<8)Q=(this.data[$]&(1<<X)-1)<<8-X,Q|=this.data[--$]>>(X+=this.DB-8);else if(Q=this.data[$]>>(X-=8)&255,X<=0)X+=this.DB,--$;if((Q&128)!=0)Q|=-256;if(Y==0&&(this.s&128)!=(Q&128))++Y;if(Y>0||Q!=this.s)J[Y++]=Q}}return J}function qO($){return this.compareTo($)==0}function KO($){return this.compareTo($)<0?this:$}function zO($){return this.compareTo($)>0?this:$}function EO($,J,X){var Q,Y,G=Math.min($.t,this.t);for(Q=0;Q<G;++Q)X.data[Q]=J(this.data[Q],$.data[Q]);if($.t<this.t){Y=$.s&this.DM;for(Q=G;Q<this.t;++Q)X.data[Q]=J(this.data[Q],Y);X.t=this.t}else{Y=this.s&this.DM;for(Q=G;Q<$.t;++Q)X.data[Q]=J(Y,$.data[Q]);X.t=$.t}X.s=J(this.s,$.s),X.clamp()}function FO($,J){return $&J}function NO($){var J=C$();return this.bitwiseTo($,FO,J),J}function V8($,J){return $|J}function LO($){var J=C$();return this.bitwiseTo($,V8,J),J}function X1($,J){return $^J}function AO($){var J=C$();return this.bitwiseTo($,X1,J),J}function Y1($,J){return $&~J}function RO($){var J=C$();return this.bitwiseTo($,Y1,J),J}function DO(){var $=C$();for(var J=0;J<this.t;++J)$.data[J]=this.DM&~this.data[J];return $.t=this.t,$.s=~this.s,$}function ZO($){var J=C$();if($<0)this.rShiftTo(-$,J);else this.lShiftTo($,J);return J}function BO($){var J=C$();if($<0)this.lShiftTo(-$,J);else this.rShiftTo($,J);return J}function jO($){if($==0)return-1;var J=0;if(($&65535)==0)$>>=16,J+=16;if(($&255)==0)$>>=8,J+=8;if(($&15)==0)$>>=4,J+=4;if(($&3)==0)$>>=2,J+=2;if(($&1)==0)++J;return J}function TO(){for(var $=0;$<this.t;++$)if(this.data[$]!=0)return $*this.DB+jO(this.data[$]);if(this.s<0)return this.t*this.DB;return-1}function SO($){var J=0;while($!=0)$&=$-1,++J;return J}function IO(){var $=0,J=this.s&this.DM;for(var X=0;X<this.t;++X)$+=SO(this.data[X]^J);return $}function CO($){var J=Math.floor($/this.DB);if(J>=this.t)return this.s!=0;return(this.data[J]&1<<$%this.DB)!=0}function wO($,J){var X=v.ONE.shiftLeft($);return this.bitwiseTo(X,J,X),X}function PO($){return this.changeBit($,V8)}function _O($){return this.changeBit($,Y1)}function xO($){return this.changeBit($,X1)}function vO($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]+$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q+=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q+=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=$.s}if(J.s=Q<0?-1:0,Q>0)J.data[X++]=Q;else if(Q<-1)J.data[X++]=this.DV+Q;J.t=X,J.clamp()}function kO($){var J=C$();return this.addTo($,J),J}function fO($){var J=C$();return this.subTo($,J),J}function yO($){var J=C$();return this.multiplyTo($,J),J}function bO(){var $=C$();return this.squareTo($),$}function hO($){var J=C$();return this.divRemTo($,J,null),J}function uO($){var J=C$();return this.divRemTo($,null,J),J}function gO($){var J=C$(),X=C$();return this.divRemTo($,J,X),[J,X]}function mO($){this.data[this.t]=this.am(0,$-1,this,0,0,this.t),++this.t,this.clamp()}function lO($,J){if($==0)return;while(this.t<=J)this.data[this.t++]=0;this.data[J]+=$;while(this.data[J]>=this.DV){if(this.data[J]-=this.DV,++J>=this.t)this.data[this.t++]=0;++this.data[J]}}function RX(){}function G1($){return $}function pO($,J,X){$.multiplyTo(J,X)}function dO($,J){$.squareTo(J)}RX.prototype.convert=G1;RX.prototype.revert=G1;RX.prototype.mulTo=pO;RX.prototype.sqrTo=dO;function cO($){return this.exp($,new RX)}function nO($,J,X){var Q=Math.min(this.t+$.t,J);X.s=0,X.t=Q;while(Q>0)X.data[--Q]=0;var Y;for(Y=X.t-this.t;Q<Y;++Q)X.data[Q+this.t]=this.am(0,$.data[Q],X,Q,0,this.t);for(Y=Math.min($.t,J);Q<Y;++Q)this.am(0,$.data[Q],X,Q,0,J-Q);X.clamp()}function iO($,J,X){--J;var Q=X.t=this.t+$.t-J;X.s=0;while(--Q>=0)X.data[Q]=0;for(Q=Math.max(J-this.t,0);Q<$.t;++Q)X.data[this.t+Q-J]=this.am(J-Q,$.data[Q],X,0,0,this.t+Q-J);X.clamp(),X.drShiftTo(1,X)}function CQ($){this.r2=C$(),this.q3=C$(),v.ONE.dlShiftTo(2*$.t,this.r2),this.mu=this.r2.divide($),this.m=$}function oO($){if($.s<0||$.t>2*this.m.t)return $.mod(this.m);else if($.compareTo(this.m)<0)return $;else{var J=C$();return $.copyTo(J),this.reduce(J),J}}function aO($){return $}function sO($){if($.drShiftTo(this.m.t-1,this.r2),$.t>this.m.t+1)$.t=this.m.t+1,$.clamp();this.mu.multiplyUpperTo(this.r2,this.m.t+1,this.q3),this.m.multiplyLowerTo(this.q3,this.m.t+1,this.r2);while($.compareTo(this.r2)<0)$.dAddOffset(1,this.m.t+1);$.subTo(this.r2,$);while($.compareTo(this.m)>=0)$.subTo(this.m,$)}function rO($,J){$.squareTo(J),this.reduce(J)}function tO($,J,X){$.multiplyTo(J,X),this.reduce(X)}CQ.prototype.convert=oO;CQ.prototype.revert=aO;CQ.prototype.reduce=sO;CQ.prototype.mulTo=tO;CQ.prototype.sqrTo=rO;function eO($,J){var X=$.bitLength(),Q,Y=_0(1),G;if(X<=0)return Y;else if(X<18)Q=1;else if(X<48)Q=3;else if(X<144)Q=4;else if(X<768)Q=5;else Q=6;if(X<8)G=new QQ(J);else if(J.isEven())G=new CQ(J);else G=new XQ(J);var W=[],U=3,M=Q-1,O=(1<<Q)-1;if(W[1]=G.convert(this),Q>1){var V=C$();G.sqrTo(W[1],V);while(U<=O)W[U]=C$(),G.mulTo(V,W[U-2],W[U]),U+=2}var H=$.t-1,q,F=!0,K=C$(),A;X=PY($.data[H])-1;while(H>=0){if(X>=M)q=$.data[H]>>X-M&O;else if(q=($.data[H]&(1<<X+1)-1)<<M-X,H>0)q|=$.data[H-1]>>this.DB+X-M;U=Q;while((q&1)==0)q>>=1,--U;if((X-=U)<0)X+=this.DB,--H;if(F)W[q].copyTo(Y),F=!1;else{while(U>1)G.sqrTo(Y,K),G.sqrTo(K,Y),U-=2;if(U>0)G.sqrTo(Y,K);else A=Y,Y=K,K=A;G.mulTo(K,W[q],Y)}while(H>=0&&($.data[H]&1<<X)==0)if(G.sqrTo(Y,K),A=Y,Y=K,K=A,--X<0)X=this.DB-1,--H}return G.revert(Y)}function $V($){var J=this.s<0?this.negate():this.clone(),X=$.s<0?$.negate():$.clone();if(J.compareTo(X)<0){var Q=J;J=X,X=Q}var Y=J.getLowestSetBit(),G=X.getLowestSetBit();if(G<0)return J;if(Y<G)G=Y;if(G>0)J.rShiftTo(G,J),X.rShiftTo(G,X);while(J.signum()>0){if((Y=J.getLowestSetBit())>0)J.rShiftTo(Y,J);if((Y=X.getLowestSetBit())>0)X.rShiftTo(Y,X);if(J.compareTo(X)>=0)J.subTo(X,J),J.rShiftTo(1,J);else X.subTo(J,X),X.rShiftTo(1,X)}if(G>0)X.lShiftTo(G,X);return X}function JV($){if($<=0)return 0;var J=this.DV%$,X=this.s<0?$-1:0;if(this.t>0)if(J==0)X=this.data[0]%$;else for(var Q=this.t-1;Q>=0;--Q)X=(J*X+this.data[Q])%$;return X}function QV($){if(this.signum()==0)return v.ZERO;var J=$.isEven();if(this.isEven()&&J||$.signum()==0)return v.ZERO;var X=$.clone(),Q=this.clone(),Y=_0(1),G=_0(0),W=_0(0),U=_0(1);while(X.signum()!=0){while(X.isEven()){if(X.rShiftTo(1,X),J){if(!Y.isEven()||!G.isEven())Y.addTo(this,Y),G.subTo($,G);Y.rShiftTo(1,Y)}else if(!G.isEven())G.subTo($,G);G.rShiftTo(1,G)}while(Q.isEven()){if(Q.rShiftTo(1,Q),J){if(!W.isEven()||!U.isEven())W.addTo(this,W),U.subTo($,U);W.rShiftTo(1,W)}else if(!U.isEven())U.subTo($,U);U.rShiftTo(1,U)}if(X.compareTo(Q)>=0){if(X.subTo(Q,X),J)Y.subTo(W,Y);G.subTo(U,G)}else{if(Q.subTo(X,Q),J)W.subTo(Y,W);U.subTo(G,U)}}if(Q.compareTo(v.ONE)!=0)return v.ZERO;if(U.compareTo($)>=0)return U.subtract($);if(U.signum()<0)U.addTo($,U);else return U;if(U.signum()<0)return U.add($);else return U}var lJ=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997],XV=67108864/lJ[lJ.length-1];function YV($){var J,X=this.abs();if(X.t==1&&X.data[0]<=lJ[lJ.length-1]){for(J=0;J<lJ.length;++J)if(X.data[0]==lJ[J])return!0;return!1}if(X.isEven())return!1;J=1;while(J<lJ.length){var Q=lJ[J],Y=J+1;while(Y<lJ.length&&Q<XV)Q*=lJ[Y++];Q=X.modInt(Q);while(J<Y)if(Q%lJ[J++]==0)return!1}return X.millerRabin($)}function GV($){var J=this.subtract(v.ONE),X=J.getLowestSetBit();if(X<=0)return!1;var Q=J.shiftRight(X),Y=WV(),G;for(var W=0;W<$;++W){do G=new v(this.bitLength(),Y);while(G.compareTo(v.ONE)<=0||G.compareTo(J)>=0);var U=G.modPow(Q,this);if(U.compareTo(v.ONE)!=0&&U.compareTo(J)!=0){var M=1;while(M++<X&&U.compareTo(J)!=0)if(U=U.modPowInt(2,this),U.compareTo(v.ONE)==0)return!1;if(U.compareTo(J)!=0)return!1}}return!0}function WV(){return{nextBytes:function($){for(var J=0;J<$.length;++J)$[J]=Math.floor(Math.random()*256)}}}v.prototype.chunkSize=WO;v.prototype.toRadix=MO;v.prototype.fromRadix=OO;v.prototype.fromNumber=VO;v.prototype.bitwiseTo=EO;v.prototype.changeBit=wO;v.prototype.addTo=vO;v.prototype.dMultiply=mO;v.prototype.dAddOffset=lO;v.prototype.multiplyLowerTo=nO;v.prototype.multiplyUpperTo=iO;v.prototype.modInt=JV;v.prototype.millerRabin=GV;v.prototype.clone=QO;v.prototype.intValue=XO;v.prototype.byteValue=YO;v.prototype.shortValue=GO;v.prototype.signum=UO;v.prototype.toByteArray=HO;v.prototype.equals=qO;v.prototype.min=KO;v.prototype.max=zO;v.prototype.and=NO;v.prototype.or=LO;v.prototype.xor=AO;v.prototype.andNot=RO;v.prototype.not=DO;v.prototype.shiftLeft=ZO;v.prototype.shiftRight=BO;v.prototype.getLowestSetBit=TO;v.prototype.bitCount=IO;v.prototype.testBit=CO;v.prototype.setBit=PO;v.prototype.clearBit=_O;v.prototype.flipBit=xO;v.prototype.add=kO;v.prototype.subtract=fO;v.prototype.multiply=yO;v.prototype.divide=hO;v.prototype.remainder=uO;v.prototype.divideAndRemainder=gO;v.prototype.modPow=eO;v.prototype.modInverse=QV;v.prototype.pow=cO;v.prototype.gcd=$V;v.prototype.isProbablePrime=YV;v.prototype.square=bO});var wQ=H$((AF,V1)=>{var Y0=F$();eJ();_$();var M1=V1.exports=Y0.sha1=Y0.sha1||{};Y0.md.sha1=Y0.md.algorithms.sha1=M1;M1.create=function(){if(!O1)UV();var $=null,J=Y0.util.createBuffer(),X=Array(80),Q={algorithm:"sha1",blockLength:64,digestLength:20,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=Y0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878,h4:3285377520},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=Y0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),U1($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=Y0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(H8.substr(0,Q.blockLength-W));var U,M,O=Q.fullMessageLength[0]*8;for(var V=0;V<Q.fullMessageLength.length-1;++V)U=Q.fullMessageLength[V+1]*8,M=U/4294967296>>>0,O+=M,Y.putInt32(O>>>0),O=U>>>0;Y.putInt32(O);var H={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4};U1(H,X,Y);var q=Y0.util.createBuffer();return q.putInt32(H.h0),q.putInt32(H.h1),q.putInt32(H.h2),q.putInt32(H.h3),q.putInt32(H.h4),q},Q};var H8=null,O1=!1;function UV(){H8=String.fromCharCode(128),H8+=Y0.util.fillString(String.fromCharCode(0),64),O1=!0}function U1($,J,X){var Q,Y,G,W,U,M,O,V,H=X.length();while(H>=64){Y=$.h0,G=$.h1,W=$.h2,U=$.h3,M=$.h4;for(V=0;V<16;++V)Q=X.getInt32(),J[V]=Q,O=U^G&(W^U),Q=(Y<<5|Y>>>27)+O+M+1518500249+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<20;++V)Q=J[V-3]^J[V-8]^J[V-14]^J[V-16],Q=Q<<1|Q>>>31,J[V]=Q,O=U^G&(W^U),Q=(Y<<5|Y>>>27)+O+M+1518500249+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<32;++V)Q=J[V-3]^J[V-8]^J[V-14]^J[V-16],Q=Q<<1|Q>>>31,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+1859775393+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<40;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+1859775393+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<60;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G&W|U&(G^W),Q=(Y<<5|Y>>>27)+O+M+2400959708+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<80;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+3395469782+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+U|0,$.h4=$.h4+M|0,H-=64}}});var q8=H$((RF,q1)=>{var G0=F$();_$();_J();wQ();var H1=q1.exports=G0.pkcs1=G0.pkcs1||{};H1.encode_rsa_oaep=function($,J,X){var Q,Y,G,W;if(typeof X==="string")Q=X,Y=arguments[3]||void 0,G=arguments[4]||void 0;else if(X){if(Q=X.label||void 0,Y=X.seed||void 0,G=X.md||void 0,X.mgf1&&X.mgf1.md)W=X.mgf1.md}if(!G)G=G0.md.sha1.create();else G.start();if(!W)W=G;var U=Math.ceil($.n.bitLength()/8),M=U-2*G.digestLength-2;if(J.length>M){var O=Error("RSAES-OAEP input message length is too long.");throw O.length=J.length,O.maxLength=M,O}if(!Q)Q="";G.update(Q,"raw");var V=G.digest(),H="",q=M-J.length;for(var F=0;F<q;F++)H+="\x00";var K=V.getBytes()+H+"\x01"+J;if(!Y)Y=G0.random.getBytes(G.digestLength);else if(Y.length!==G.digestLength){var O=Error("Invalid RSAES-OAEP seed. The seed length must match the digest length.");throw O.seedLength=Y.length,O.digestLength=G.digestLength,O}var A=_Y(Y,U-G.digestLength-1,W),L=G0.util.xorBytes(K,A,K.length),R=_Y(L,G.digestLength,W),I=G0.util.xorBytes(Y,R,Y.length);return"\x00"+I+L};H1.decode_rsa_oaep=function($,J,X){var Q,Y,G;if(typeof X==="string")Q=X,Y=arguments[3]||void 0;else if(X){if(Q=X.label||void 0,Y=X.md||void 0,X.mgf1&&X.mgf1.md)G=X.mgf1.md}var W=Math.ceil($.n.bitLength()/8);if(J.length!==W){var L=Error("RSAES-OAEP encoded message length is invalid.");throw L.length=J.length,L.expectedLength=W,L}if(Y===void 0)Y=G0.md.sha1.create();else Y.start();if(!G)G=Y;if(W<2*Y.digestLength+2)throw Error("RSAES-OAEP key is too short for the hash function.");if(!Q)Q="";Y.update(Q,"raw");var U=Y.digest().getBytes(),M=J.charAt(0),O=J.substring(1,Y.digestLength+1),V=J.substring(1+Y.digestLength),H=_Y(V,Y.digestLength,G),q=G0.util.xorBytes(O,H,O.length),F=_Y(q,W-Y.digestLength-1,G),K=G0.util.xorBytes(V,F,V.length),A=K.substring(0,Y.digestLength),L=M!=="\x00";for(var R=0;R<Y.digestLength;++R)L|=U.charAt(R)!==A.charAt(R);var I=1,j=Y.digestLength;for(var C=Y.digestLength;C<K.length;C++){var w=K.charCodeAt(C),P=w&1^1,l=I?65534:0;L|=w&l,I=I&P,j+=I}if(L||K.charCodeAt(j)!==1)throw Error("Invalid RSAES-OAEP padding.");return K.substring(j+1)};function _Y($,J,X){if(!X)X=G0.md.sha1.create();var Q="",Y=Math.ceil(J/X.digestLength);for(var G=0;G<Y;++G){var W=String.fromCharCode(G>>24&255,G>>16&255,G>>8&255,G&255);X.start(),X.update($+W),Q+=X.digest().getBytes()}return Q.substring(0,J)}});var z8=H$((DF,K8)=>{var x0=F$();_$();DX();_J();(function(){if(x0.prime){K8.exports=x0.prime;return}var $=K8.exports=x0.prime=x0.prime||{},J=x0.jsbn.BigInteger,X=[6,4,2,4,2,4,6,2],Q=new J(null);Q.fromInt(30);var Y=function(H,q){return H|q};$.generateProbablePrime=function(H,q,F){if(typeof q==="function")F=q,q={};q=q||{};var K=q.algorithm||"PRIMEINC";if(typeof K==="string")K={name:K};K.options=K.options||{};var A=q.prng||x0.random,L={nextBytes:function(R){var I=A.getBytesSync(R.length);for(var j=0;j<R.length;++j)R[j]=I.charCodeAt(j)}};if(K.name==="PRIMEINC")return G(H,L,K.options,F);throw Error("Invalid prime generation algorithm: "+K.name)};function G(H,q,F,K){if("workers"in F)return M(H,q,F,K);return W(H,q,F,K)}function W(H,q,F,K){var A=O(H,q),L=0,R=V(A.bitLength());if("millerRabinTests"in F)R=F.millerRabinTests;var I=10;if("maxBlockTime"in F)I=F.maxBlockTime;U(A,H,q,L,R,I,K)}function U(H,q,F,K,A,L,R){var I=+new Date;do{if(H.bitLength()>q)H=O(q,F);if(H.isProbablePrime(A))return R(null,H);H.dAddOffset(X[K++%8],0)}while(L<0||+new Date-I<L);x0.util.setImmediate(function(){U(H,q,F,K,A,L,R)})}function M(H,q,F,K){if(typeof Worker>"u")return W(H,q,F,K);var A=O(H,q),L=F.workers,R=F.workLoad||100,I=R*30/8,j=F.workerScript||"forge/prime.worker.js";if(L===-1)return x0.util.estimateCores(function(w,P){if(w)P=2;L=P-1,C()});C();function C(){L=Math.max(1,L);var w=[];for(var P=0;P<L;++P)w[P]=new Worker(j);var l=L;for(var P=0;P<L;++P)w[P].addEventListener("message",y);var e=!1;function y(n){if(e)return;--l;var Y$=n.data;if(Y$.found){for(var L$=0;L$<w.length;++L$)w[L$].terminate();return e=!0,K(null,new J(Y$.prime,16))}if(A.bitLength()>H)A=O(H,q);var j$=A.toString(16);n.target.postMessage({hex:j$,workLoad:R}),A.dAddOffset(I,0)}}}function O(H,q){var F=new J(H,q),K=H-1;if(!F.testBit(K))F.bitwiseTo(J.ONE.shiftLeft(K),Y,F);return F.dAddOffset(31-F.mod(Q).byteValue(),0),F}function V(H){if(H<=100)return 27;if(H<=150)return 18;if(H<=200)return 15;if(H<=250)return 12;if(H<=300)return 9;if(H<=350)return 8;if(H<=400)return 7;if(H<=500)return 6;if(H<=600)return 5;if(H<=800)return 4;if(H<=1250)return 3;return 2}})()});var ZX=H$((ZF,A1)=>{var Q$=F$();mJ();DX();P0();q8();z8();_J();_$();if(typeof I$>"u")I$=Q$.jsbn.BigInteger;var I$,E8=Q$.util.isNodejs?OX("crypto"):null,S=Q$.asn1,vJ=Q$.util;Q$.pki=Q$.pki||{};A1.exports=Q$.pki.rsa=Q$.rsa=Q$.rsa||{};var q$=Q$.pki,MV=[6,4,2,4,2,4,6,2],OV={name:"PrivateKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]},VV={name:"RSAPrivateKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPrivateKey.version",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"RSAPrivateKey.modulus",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyModulus"},{name:"RSAPrivateKey.publicExponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPublicExponent"},{name:"RSAPrivateKey.privateExponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrivateExponent"},{name:"RSAPrivateKey.prime1",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrime1"},{name:"RSAPrivateKey.prime2",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrime2"},{name:"RSAPrivateKey.exponent1",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyExponent1"},{name:"RSAPrivateKey.exponent2",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyExponent2"},{name:"RSAPrivateKey.coefficient",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyCoefficient"}]},HV={name:"RSAPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPublicKey.modulus",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"publicKeyModulus"},{name:"RSAPublicKey.exponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"publicKeyExponent"}]},qV=Q$.pki.rsa.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{name:"SubjectPublicKeyInfo.subjectPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.BITSTRING,constructed:!1,value:[{name:"SubjectPublicKeyInfo.subjectPublicKey.RSAPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"rsaPublicKey"}]}]},KV={name:"DigestInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm.algorithmIdentifier",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"algorithmIdentifier"},{name:"DigestInfo.DigestAlgorithm.parameters",tagClass:S.Class.UNIVERSAL,type:S.Type.NULL,capture:"parameters",optional:!0,constructed:!1}]},{name:"DigestInfo.digest",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"digest"}]},zV=function($){var J;if($.algorithm in q$.oids)J=q$.oids[$.algorithm];else{var X=Error("Unknown message digest algorithm.");throw X.algorithm=$.algorithm,X}var Q=S.oidToDer(J).getBytes(),Y=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[]),G=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[]);G.value.push(S.create(S.Class.UNIVERSAL,S.Type.OID,!1,Q)),G.value.push(S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,""));var W=S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,$.digest().getBytes());return Y.value.push(G),Y.value.push(W),S.toDer(Y).getBytes()},N1=function($,J,X){if(X)return $.modPow(J.e,J.n);if(!J.p||!J.q)return $.modPow(J.d,J.n);if(!J.dP)J.dP=J.d.mod(J.p.subtract(I$.ONE));if(!J.dQ)J.dQ=J.d.mod(J.q.subtract(I$.ONE));if(!J.qInv)J.qInv=J.q.modInverse(J.p);var Q;do Q=new I$(Q$.util.bytesToHex(Q$.random.getBytes(J.n.bitLength()/8)),16);while(Q.compareTo(J.n)>=0||!Q.gcd(J.n).equals(I$.ONE));$=$.multiply(Q.modPow(J.e,J.n)).mod(J.n);var Y=$.mod(J.p).modPow(J.dP,J.p),G=$.mod(J.q).modPow(J.dQ,J.q);while(Y.compareTo(G)<0)Y=Y.add(J.p);var W=Y.subtract(G).multiply(J.qInv).mod(J.p).multiply(J.q).add(G);return W=W.multiply(Q.modInverse(J.n)).mod(J.n),W};q$.rsa.encrypt=function($,J,X){var Q=X,Y,G=Math.ceil(J.n.bitLength()/8);if(X!==!1&&X!==!0)Q=X===2,Y=L1($,J,X);else Y=Q$.util.createBuffer(),Y.putBytes($);var W=new I$(Y.toHex(),16),U=N1(W,J,Q),M=U.toString(16),O=Q$.util.createBuffer(),V=G-Math.ceil(M.length/2);while(V>0)O.putByte(0),--V;return O.putBytes(Q$.util.hexToBytes(M)),O.getBytes()};q$.rsa.decrypt=function($,J,X,Q){var Y=Math.ceil(J.n.bitLength()/8);if($.length!==Y){var G=Error("Encrypted message length is invalid.");throw G.length=$.length,G.expected=Y,G}var W=new I$(Q$.util.createBuffer($).toHex(),16);if(W.compareTo(J.n)>=0)throw Error("Encrypted message is invalid.");var U=N1(W,J,X),M=U.toString(16),O=Q$.util.createBuffer(),V=Y-Math.ceil(M.length/2);while(V>0)O.putByte(0),--V;if(O.putBytes(Q$.util.hexToBytes(M)),Q!==!1)return xY(O.getBytes(),J,X);return O.getBytes()};q$.rsa.createKeyPairGenerationState=function($,J,X){if(typeof $==="string")$=parseInt($,10);$=$||2048,X=X||{};var Q=X.prng||Q$.random,Y={nextBytes:function(U){var M=Q.getBytesSync(U.length);for(var O=0;O<U.length;++O)U[O]=M.charCodeAt(O)}},G=X.algorithm||"PRIMEINC",W;if(G==="PRIMEINC")W={algorithm:G,state:0,bits:$,rng:Y,eInt:J||65537,e:new I$(null),p:null,q:null,qBits:$>>1,pBits:$-($>>1),pqState:0,num:null,keys:null},W.e.fromInt(W.eInt);else throw Error("Invalid key generation algorithm: "+G);return W};q$.rsa.stepKeyPairGenerationState=function($,J){if(!("algorithm"in $))$.algorithm="PRIMEINC";var X=new I$(null);X.fromInt(30);var Q=0,Y=function(H,q){return H|q},G=+new Date,W,U=0;while($.keys===null&&(J<=0||U<J)){if($.state===0){var M=$.p===null?$.pBits:$.qBits,O=M-1;if($.pqState===0){if($.num=new I$(M,$.rng),!$.num.testBit(O))$.num.bitwiseTo(I$.ONE.shiftLeft(O),Y,$.num);$.num.dAddOffset(31-$.num.mod(X).byteValue(),0),Q=0,++$.pqState}else if($.pqState===1)if($.num.bitLength()>M)$.pqState=0;else if($.num.isProbablePrime(FV($.num.bitLength())))++$.pqState;else $.num.dAddOffset(MV[Q++%8],0);else if($.pqState===2)$.pqState=$.num.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)===0?3:0;else if($.pqState===3){if($.pqState=0,$.p===null)$.p=$.num;else $.q=$.num;if($.p!==null&&$.q!==null)++$.state;$.num=null}}else if($.state===1){if($.p.compareTo($.q)<0)$.num=$.p,$.p=$.q,$.q=$.num;++$.state}else if($.state===2)$.p1=$.p.subtract(I$.ONE),$.q1=$.q.subtract(I$.ONE),$.phi=$.p1.multiply($.q1),++$.state;else if($.state===3)if($.phi.gcd($.e).compareTo(I$.ONE)===0)++$.state;else $.p=null,$.q=null,$.state=0;else if($.state===4)if($.n=$.p.multiply($.q),$.n.bitLength()===$.bits)++$.state;else $.q=null,$.state=0;else if($.state===5){var V=$.e.modInverse($.phi);$.keys={privateKey:q$.rsa.setPrivateKey($.n,$.e,V,$.p,$.q,V.mod($.p1),V.mod($.q1),$.q.modInverse($.p)),publicKey:q$.rsa.setPublicKey($.n,$.e)}}W=+new Date,U+=W-G,G=W}return $.keys!==null};q$.rsa.generateKeyPair=function($,J,X,Q){if(arguments.length===1){if(typeof $==="object")X=$,$=void 0;else if(typeof $==="function")Q=$,$=void 0}else if(arguments.length===2)if(typeof $==="number"){if(typeof J==="function")Q=J,J=void 0;else if(typeof J!=="number")X=J,J=void 0}else X=$,Q=J,$=void 0,J=void 0;else if(arguments.length===3)if(typeof J==="number"){if(typeof X==="function")Q=X,X=void 0}else Q=X,X=J,J=void 0;if(X=X||{},$===void 0)$=X.bits||2048;if(J===void 0)J=X.e||65537;if(!Q$.options.usePureJavaScript&&!X.prng&&$>=256&&$<=16384&&(J===65537||J===3)){if(Q){if(K1("generateKeyPair"))return E8.generateKeyPair("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}},function(U,M,O){if(U)return Q(U);Q(null,{privateKey:q$.privateKeyFromPem(O),publicKey:q$.publicKeyFromPem(M)})});if(z1("generateKey")&&z1("exportKey"))return vJ.globalScope.crypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:F1(J),hash:{name:"SHA-256"}},!0,["sign","verify"]).then(function(U){return vJ.globalScope.crypto.subtle.exportKey("pkcs8",U.privateKey)}).then(void 0,function(U){Q(U)}).then(function(U){if(U){var M=q$.privateKeyFromAsn1(S.fromDer(Q$.util.createBuffer(U)));Q(null,{privateKey:M,publicKey:q$.setRsaPublicKey(M.n,M.e)})}});if(E1("generateKey")&&E1("exportKey")){var Y=vJ.globalScope.msCrypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:F1(J),hash:{name:"SHA-256"}},!0,["sign","verify"]);Y.oncomplete=function(U){var M=U.target.result,O=vJ.globalScope.msCrypto.subtle.exportKey("pkcs8",M.privateKey);O.oncomplete=function(V){var H=V.target.result,q=q$.privateKeyFromAsn1(S.fromDer(Q$.util.createBuffer(H)));Q(null,{privateKey:q,publicKey:q$.setRsaPublicKey(q.n,q.e)})},O.onerror=function(V){Q(V)}},Y.onerror=function(U){Q(U)};return}}else if(K1("generateKeyPairSync")){var G=E8.generateKeyPairSync("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{privateKey:q$.privateKeyFromPem(G.privateKey),publicKey:q$.publicKeyFromPem(G.publicKey)}}}var W=q$.rsa.createKeyPairGenerationState($,J,X);if(!Q)return q$.rsa.stepKeyPairGenerationState(W,0),W.keys;EV(W,X,Q)};q$.setRsaPublicKey=q$.rsa.setPublicKey=function($,J){var X={n:$,e:J};return X.encrypt=function(Q,Y,G){if(typeof Y==="string")Y=Y.toUpperCase();else if(Y===void 0)Y="RSAES-PKCS1-V1_5";if(Y==="RSAES-PKCS1-V1_5")Y={encode:function(U,M,O){return L1(U,M,2).getBytes()}};else if(Y==="RSA-OAEP"||Y==="RSAES-OAEP")Y={encode:function(U,M){return Q$.pkcs1.encode_rsa_oaep(M,U,G)}};else if(["RAW","NONE","NULL",null].indexOf(Y)!==-1)Y={encode:function(U){return U}};else if(typeof Y==="string")throw Error('Unsupported encryption scheme: "'+Y+'".');var W=Y.encode(Q,X,!0);return q$.rsa.encrypt(W,X,!0)},X.verify=function(Q,Y,G,W){if(typeof G==="string")G=G.toUpperCase();else if(G===void 0)G="RSASSA-PKCS1-V1_5";if(W===void 0)W={_parseAllDigestBytes:!0,_skipPaddingChecks:!1};if(!("_parseAllDigestBytes"in W))W._parseAllDigestBytes=!0;if(!("_skipPaddingChecks"in W))W._skipPaddingChecks=!1;if(G==="RSASSA-PKCS1-V1_5")G={verify:function(M,O){O=xY(O,X,!0,void 0,W);var V=S.fromDer(O,{parseAllBytes:W._parseAllDigestBytes}),H={},q=[];if(!S.validate(V,KV,H,q)||V.value.length!==2){var F=Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.");throw F.errors=q,F}var K=S.derToOid(H.algorithmIdentifier);if(!(K===Q$.oids.md2||K===Q$.oids.md5||K===Q$.oids.sha1||K===Q$.oids.sha224||K===Q$.oids.sha256||K===Q$.oids.sha384||K===Q$.oids.sha512||K===Q$.oids["sha512-224"]||K===Q$.oids["sha512-256"])){var F=Error("Unknown RSASSA-PKCS1-v1_5 DigestAlgorithm identifier.");throw F.oid=K,F}if(K===Q$.oids.md2||K===Q$.oids.md5){if(!("parameters"in H))throw Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value. Missing algorithm identifier NULL parameters.")}return M===H.digest}};else if(G==="NONE"||G==="NULL"||G===null)G={verify:function(M,O){return O=xY(O,X,!0,void 0,W),M===O}};var U=q$.rsa.decrypt(Y,X,!0,!1);return G.verify(Q,U,X.n.bitLength())},X};q$.setRsaPrivateKey=q$.rsa.setPrivateKey=function($,J,X,Q,Y,G,W,U){var M={n:$,e:J,d:X,p:Q,q:Y,dP:G,dQ:W,qInv:U};return M.decrypt=function(O,V,H){if(typeof V==="string")V=V.toUpperCase();else if(V===void 0)V="RSAES-PKCS1-V1_5";var q=q$.rsa.decrypt(O,M,!1,!1);if(V==="RSAES-PKCS1-V1_5")V={decode:xY};else if(V==="RSA-OAEP"||V==="RSAES-OAEP")V={decode:function(F,K){return Q$.pkcs1.decode_rsa_oaep(K,F,H)}};else if(["RAW","NONE","NULL",null].indexOf(V)!==-1)V={decode:function(F){return F}};else throw Error('Unsupported encryption scheme: "'+V+'".');return V.decode(q,M,!1)},M.sign=function(O,V){var H=!1;if(typeof V==="string")V=V.toUpperCase();if(V===void 0||V==="RSASSA-PKCS1-V1_5")V={encode:zV},H=1;else if(V==="NONE"||V==="NULL"||V===null)V={encode:function(){return O}},H=1;var q=V.encode(O,M.n.bitLength());return q$.rsa.encrypt(q,M,H)},M};q$.wrapRsaPrivateKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(0).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(q$.oids.rsaEncryption).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,"")]),S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer($).getBytes())])};q$.privateKeyFromAsn1=function($){var J={},X=[];if(S.validate($,OV,J,X))$=S.fromDer(Q$.util.createBuffer(J.privateKey));if(J={},X=[],!S.validate($,VV,J,X)){var Q=Error("Cannot read private key. ASN.1 object does not contain an RSAPrivateKey.");throw Q.errors=X,Q}var Y,G,W,U,M,O,V,H;return Y=Q$.util.createBuffer(J.privateKeyModulus).toHex(),G=Q$.util.createBuffer(J.privateKeyPublicExponent).toHex(),W=Q$.util.createBuffer(J.privateKeyPrivateExponent).toHex(),U=Q$.util.createBuffer(J.privateKeyPrime1).toHex(),M=Q$.util.createBuffer(J.privateKeyPrime2).toHex(),O=Q$.util.createBuffer(J.privateKeyExponent1).toHex(),V=Q$.util.createBuffer(J.privateKeyExponent2).toHex(),H=Q$.util.createBuffer(J.privateKeyCoefficient).toHex(),q$.setRsaPrivateKey(new I$(Y,16),new I$(G,16),new I$(W,16),new I$(U,16),new I$(M,16),new I$(O,16),new I$(V,16),new I$(H,16))};q$.privateKeyToAsn1=q$.privateKeyToRSAPrivateKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(0).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.n)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.e)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.d)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.p)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.q)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.dP)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.dQ)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.qInv))])};q$.publicKeyFromAsn1=function($){var J={},X=[];if(S.validate($,qV,J,X)){var Q=S.derToOid(J.publicKeyOid);if(Q!==q$.oids.rsaEncryption){var Y=Error("Cannot read public key. Unknown OID.");throw Y.oid=Q,Y}$=J.rsaPublicKey}if(X=[],!S.validate($,HV,J,X)){var Y=Error("Cannot read public key. ASN.1 object does not contain an RSAPublicKey.");throw Y.errors=X,Y}var G=Q$.util.createBuffer(J.publicKeyModulus).toHex(),W=Q$.util.createBuffer(J.publicKeyExponent).toHex();return q$.setRsaPublicKey(new I$(G,16),new I$(W,16))};q$.publicKeyToAsn1=q$.publicKeyToSubjectPublicKeyInfo=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(q$.oids.rsaEncryption).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,"")]),S.create(S.Class.UNIVERSAL,S.Type.BITSTRING,!1,[q$.publicKeyToRSAPublicKey($)])])};q$.publicKeyToRSAPublicKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.n)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,W0($.e))])};function L1($,J,X){var Q=Q$.util.createBuffer(),Y=Math.ceil(J.n.bitLength()/8);if($.length>Y-11){var G=Error("Message is too long for PKCS#1 v1.5 padding.");throw G.length=$.length,G.max=Y-11,G}Q.putByte(0),Q.putByte(X);var W=Y-3-$.length,U;if(X===0||X===1){U=X===0?0:255;for(var M=0;M<W;++M)Q.putByte(U)}else while(W>0){var O=0,V=Q$.random.getBytes(W);for(var M=0;M<W;++M)if(U=V.charCodeAt(M),U===0)++O;else Q.putByte(U);W=O}return Q.putByte(0),Q.putBytes($),Q}function xY($,J,X,Q,Y){var G=Math.ceil(J.n.bitLength()/8),W=Q$.util.createBuffer($),U=W.getByte(),M=W.getByte();if(U!==0||X&&M!==0&&M!==1||!X&&M!==2||X&&M===0&&typeof Q>"u")throw Error("Encryption block is invalid.");var O=0;if(M===0){O=G-3-Q;for(var V=0;V<O;++V)if(W.getByte()!==0)throw Error("Encryption block is invalid.")}else if(M===1){O=0;while(W.length()>1){if(W.getByte()!==255){--W.read;break}++O}if(O<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}else if(M===2){O=0;while(W.length()>1){if(W.getByte()===0){--W.read;break}++O}if(O<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}var H=W.getByte();if(H!==0||O!==G-3-W.length())throw Error("Encryption block is invalid.");return W.getBytes()}function EV($,J,X){if(typeof J==="function")X=J,J={};J=J||{};var Q={algorithm:{name:J.algorithm||"PRIMEINC",options:{workers:J.workers||2,workLoad:J.workLoad||100,workerScript:J.workerScript}}};if("prng"in J)Q.prng=J.prng;Y();function Y(){G($.pBits,function(U,M){if(U)return X(U);if($.p=M,$.q!==null)return W(U,$.q);G($.qBits,W)})}function G(U,M){Q$.prime.generateProbablePrime(U,Q,M)}function W(U,M){if(U)return X(U);if($.q=M,$.p.compareTo($.q)<0){var O=$.p;$.p=$.q,$.q=O}if($.p.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)!==0){$.p=null,Y();return}if($.q.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)!==0){$.q=null,G($.qBits,W);return}if($.p1=$.p.subtract(I$.ONE),$.q1=$.q.subtract(I$.ONE),$.phi=$.p1.multiply($.q1),$.phi.gcd($.e).compareTo(I$.ONE)!==0){$.p=$.q=null,Y();return}if($.n=$.p.multiply($.q),$.n.bitLength()!==$.bits){$.q=null,G($.qBits,W);return}var V=$.e.modInverse($.phi);$.keys={privateKey:q$.rsa.setPrivateKey($.n,$.e,V,$.p,$.q,V.mod($.p1),V.mod($.q1),$.q.modInverse($.p)),publicKey:q$.rsa.setPublicKey($.n,$.e)},X(null,$.keys)}}function W0($){var J=$.toString(16);if(J[0]>="8")J="00"+J;var X=Q$.util.hexToBytes(J);if(X.length>1&&(X.charCodeAt(0)===0&&(X.charCodeAt(1)&128)===0||X.charCodeAt(0)===255&&(X.charCodeAt(1)&128)===128))return X.substr(1);return X}function FV($){if($<=100)return 27;if($<=150)return 18;if($<=200)return 15;if($<=250)return 12;if($<=300)return 9;if($<=350)return 8;if($<=400)return 7;if($<=500)return 6;if($<=600)return 5;if($<=800)return 4;if($<=1250)return 3;return 2}function K1($){return Q$.util.isNodejs&&typeof E8[$]==="function"}function z1($){return typeof vJ.globalScope<"u"&&typeof vJ.globalScope.crypto==="object"&&typeof vJ.globalScope.crypto.subtle==="object"&&typeof vJ.globalScope.crypto.subtle[$]==="function"}function E1($){return typeof vJ.globalScope<"u"&&typeof vJ.globalScope.msCrypto==="object"&&typeof vJ.globalScope.msCrypto.subtle==="object"&&typeof vJ.globalScope.msCrypto.subtle[$]==="function"}function F1($){var J=Q$.util.hexToBytes($.toString(16)),X=new Uint8Array(J.length);for(var Q=0;Q<J.length;++Q)X[Q]=J.charCodeAt(Q);return X}});var N8=H$((BF,B1)=>{var o=F$();w0();mJ();AX();eJ();P0();IY();JQ();_J();U8();ZX();_$();if(typeof F8>"u")F8=o.jsbn.BigInteger;var F8,_=o.asn1,z$=o.pki=o.pki||{};B1.exports=z$.pbe=o.pbe=o.pbe||{};var YQ=z$.oids,NV={name:"EncryptedPrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedPrivateKeyInfo.encryptionAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encryptionOid"},{name:"AlgorithmIdentifier.parameters",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,captureAsn1:"encryptionParams"}]},{name:"EncryptedPrivateKeyInfo.encryptedData",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encryptedData"}]},LV={name:"PBES2Algorithms",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"kdfOid"},{name:"PBES2Algorithms.params",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.params.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"kdfSalt"},{name:"PBES2Algorithms.params.iterationCount",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"kdfIterationCount"},{name:"PBES2Algorithms.params.keyLength",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,optional:!0,capture:"keyLength"},{name:"PBES2Algorithms.params.prf",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,optional:!0,value:[{name:"PBES2Algorithms.params.prf.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"prfOid"}]}]}]},{name:"PBES2Algorithms.encryptionScheme",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.encryptionScheme.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encOid"},{name:"PBES2Algorithms.encryptionScheme.iv",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encIv"}]}]},AV={name:"pkcs-12PbeParams",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"pkcs-12PbeParams.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"salt"},{name:"pkcs-12PbeParams.iterations",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"iterations"}]};z$.encryptPrivateKeyInfo=function($,J,X){X=X||{},X.saltSize=X.saltSize||8,X.count=X.count||2048,X.algorithm=X.algorithm||"aes128",X.prfAlgorithm=X.prfAlgorithm||"sha1";var Q=o.random.getBytesSync(X.saltSize),Y=X.count,G=_.integerToDer(Y),W,U,M;if(X.algorithm.indexOf("aes")===0||X.algorithm==="des"){var O,V,H;switch(X.algorithm){case"aes128":W=16,O=16,V=YQ["aes128-CBC"],H=o.aes.createEncryptionCipher;break;case"aes192":W=24,O=16,V=YQ["aes192-CBC"],H=o.aes.createEncryptionCipher;break;case"aes256":W=32,O=16,V=YQ["aes256-CBC"],H=o.aes.createEncryptionCipher;break;case"des":W=8,O=8,V=YQ.desCBC,H=o.des.createEncryptionCipher;break;default:var q=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw q.algorithm=X.algorithm,q}var F="hmacWith"+X.prfAlgorithm.toUpperCase(),K=Z1(F),A=o.pkcs5.pbkdf2(J,Q,Y,W,K),L=o.random.getBytesSync(O),R=H(A);R.start(L),R.update(_.toDer($)),R.finish(),M=R.output.getBytes();var I=RV(Q,G,W,F);U=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(YQ.pkcs5PBES2).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(YQ.pkcs5PBKDF2).getBytes()),I]),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(V).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,L)])])])}else if(X.algorithm==="3des"){W=24;var j=new o.util.ByteBuffer(Q),A=z$.pbe.generatePkcs12Key(J,j,1,Y,W),L=z$.pbe.generatePkcs12Key(J,j,2,Y,W),R=o.des.createEncryptionCipher(A);R.start(L),R.update(_.toDer($)),R.finish(),M=R.output.getBytes(),U=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(YQ["pbeWithSHAAnd3-KeyTripleDES-CBC"]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,Q),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,G.getBytes())])])}else{var q=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw q.algorithm=X.algorithm,q}var C=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[U,_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,M)]);return C};z$.decryptPrivateKeyInfo=function($,J){var X=null,Q={},Y=[];if(!_.validate($,NV,Q,Y)){var G=Error("Cannot read encrypted private key. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=_.derToOid(Q.encryptionOid),U=z$.pbe.getCipher(W,Q.encryptionParams,J),M=o.util.createBuffer(Q.encryptedData);if(U.update(M),U.finish())X=_.fromDer(U.output);return X};z$.encryptedPrivateKeyToPem=function($,J){var X={type:"ENCRYPTED PRIVATE KEY",body:_.toDer($).getBytes()};return o.pem.encode(X,{maxline:J})};z$.encryptedPrivateKeyFromPem=function($){var J=o.pem.decode($)[0];if(J.type!=="ENCRYPTED PRIVATE KEY"){var X=Error('Could not convert encrypted private key from PEM; PEM header type is "ENCRYPTED PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert encrypted private key from PEM; PEM is encrypted.");return _.fromDer(J.body)};z$.encryptRsaPrivateKey=function($,J,X){if(X=X||{},!X.legacy){var Q=z$.wrapRsaPrivateKey(z$.privateKeyToAsn1($));return Q=z$.encryptPrivateKeyInfo(Q,J,X),z$.encryptedPrivateKeyToPem(Q)}var Y,G,W,U;switch(X.algorithm){case"aes128":Y="AES-128-CBC",W=16,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"aes192":Y="AES-192-CBC",W=24,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"aes256":Y="AES-256-CBC",W=32,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"3des":Y="DES-EDE3-CBC",W=24,G=o.random.getBytesSync(8),U=o.des.createEncryptionCipher;break;case"des":Y="DES-CBC",W=8,G=o.random.getBytesSync(8),U=o.des.createEncryptionCipher;break;default:var M=Error('Could not encrypt RSA private key; unsupported encryption algorithm "'+X.algorithm+'".');throw M.algorithm=X.algorithm,M}var O=o.pbe.opensslDeriveBytes(J,G.substr(0,8),W),V=U(O);V.start(G),V.update(_.toDer(z$.privateKeyToAsn1($))),V.finish();var H={type:"RSA PRIVATE KEY",procType:{version:"4",type:"ENCRYPTED"},dekInfo:{algorithm:Y,parameters:o.util.bytesToHex(G).toUpperCase()},body:V.output.getBytes()};return o.pem.encode(H)};z$.decryptRsaPrivateKey=function($,J){var X=null,Q=o.pem.decode($)[0];if(Q.type!=="ENCRYPTED PRIVATE KEY"&&Q.type!=="PRIVATE KEY"&&Q.type!=="RSA PRIVATE KEY"){var Y=Error('Could not convert private key from PEM; PEM header type is not "ENCRYPTED PRIVATE KEY", "PRIVATE KEY", or "RSA PRIVATE KEY".');throw Y.headerType=Y,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED"){var G,W;switch(Q.dekInfo.algorithm){case"DES-CBC":G=8,W=o.des.createDecryptionCipher;break;case"DES-EDE3-CBC":G=24,W=o.des.createDecryptionCipher;break;case"AES-128-CBC":G=16,W=o.aes.createDecryptionCipher;break;case"AES-192-CBC":G=24,W=o.aes.createDecryptionCipher;break;case"AES-256-CBC":G=32,W=o.aes.createDecryptionCipher;break;case"RC2-40-CBC":G=5,W=function(H){return o.rc2.createDecryptionCipher(H,40)};break;case"RC2-64-CBC":G=8,W=function(H){return o.rc2.createDecryptionCipher(H,64)};break;case"RC2-128-CBC":G=16,W=function(H){return o.rc2.createDecryptionCipher(H,128)};break;default:var Y=Error('Could not decrypt private key; unsupported encryption algorithm "'+Q.dekInfo.algorithm+'".');throw Y.algorithm=Q.dekInfo.algorithm,Y}var U=o.util.hexToBytes(Q.dekInfo.parameters),M=o.pbe.opensslDeriveBytes(J,U.substr(0,8),G),O=W(M);if(O.start(U),O.update(o.util.createBuffer(Q.body)),O.finish())X=O.output.getBytes();else return X}else X=Q.body;if(Q.type==="ENCRYPTED PRIVATE KEY")X=z$.decryptPrivateKeyInfo(_.fromDer(X),J);else X=_.fromDer(X);if(X!==null)X=z$.privateKeyFromAsn1(X);return X};z$.pbe.generatePkcs12Key=function($,J,X,Q,Y,G){var W,U;if(typeof G>"u"||G===null){if(!("sha1"in o.md))throw Error('"sha1" hash algorithm unavailable.');G=o.md.sha1.create()}var{digestLength:M,blockLength:O}=G,V=new o.util.ByteBuffer,H=new o.util.ByteBuffer;if($!==null&&$!==void 0){for(U=0;U<$.length;U++)H.putInt16($.charCodeAt(U));H.putInt16(0)}var q=H.length(),F=J.length(),K=new o.util.ByteBuffer;K.fillWithByte(X,O);var A=O*Math.ceil(F/O),L=new o.util.ByteBuffer;for(U=0;U<A;U++)L.putByte(J.at(U%F));var R=O*Math.ceil(q/O),I=new o.util.ByteBuffer;for(U=0;U<R;U++)I.putByte(H.at(U%q));var j=L;j.putBuffer(I);var C=Math.ceil(Y/M);for(var w=1;w<=C;w++){var P=new o.util.ByteBuffer;P.putBytes(K.bytes()),P.putBytes(j.bytes());for(var l=0;l<Q;l++)G.start(),G.update(P.getBytes()),P=G.digest();var e=new o.util.ByteBuffer;for(U=0;U<O;U++)e.putByte(P.at(U%M));var y=Math.ceil(F/O)+Math.ceil(q/O),n=new o.util.ByteBuffer;for(W=0;W<y;W++){var Y$=new o.util.ByteBuffer(j.getBytes(O)),L$=511;for(U=e.length()-1;U>=0;U--)L$=L$>>8,L$+=e.at(U)+Y$.at(U),Y$.setAt(U,L$&255);n.putBuffer(Y$)}j=n,V.putBuffer(P)}return V.truncate(V.length()-Y),V};z$.pbe.getCipher=function($,J,X){switch($){case z$.oids.pkcs5PBES2:return z$.pbe.getCipherForPBES2($,J,X);case z$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:case z$.oids["pbewithSHAAnd40BitRC2-CBC"]:return z$.pbe.getCipherForPKCS12PBE($,J,X);default:var Q=Error("Cannot read encrypted PBE data block. Unsupported OID.");throw Q.oid=$,Q.supportedOids=["pkcs5PBES2","pbeWithSHAAnd3-KeyTripleDES-CBC","pbewithSHAAnd40BitRC2-CBC"],Q}};z$.pbe.getCipherForPBES2=function($,J,X){var Q={},Y=[];if(!_.validate(J,LV,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}if($=_.derToOid(Q.kdfOid),$!==z$.oids.pkcs5PBKDF2){var G=Error("Cannot read encrypted private key. Unsupported key derivation function OID.");throw G.oid=$,G.supportedOids=["pkcs5PBKDF2"],G}if($=_.derToOid(Q.encOid),$!==z$.oids["aes128-CBC"]&&$!==z$.oids["aes192-CBC"]&&$!==z$.oids["aes256-CBC"]&&$!==z$.oids["des-EDE3-CBC"]&&$!==z$.oids.desCBC){var G=Error("Cannot read encrypted private key. Unsupported encryption scheme OID.");throw G.oid=$,G.supportedOids=["aes128-CBC","aes192-CBC","aes256-CBC","des-EDE3-CBC","desCBC"],G}var W=Q.kdfSalt,U=o.util.createBuffer(Q.kdfIterationCount);U=U.getInt(U.length()<<3);var M,O;switch(z$.oids[$]){case"aes128-CBC":M=16,O=o.aes.createDecryptionCipher;break;case"aes192-CBC":M=24,O=o.aes.createDecryptionCipher;break;case"aes256-CBC":M=32,O=o.aes.createDecryptionCipher;break;case"des-EDE3-CBC":M=24,O=o.des.createDecryptionCipher;break;case"desCBC":M=8,O=o.des.createDecryptionCipher;break}var V=D1(Q.prfOid),H=o.pkcs5.pbkdf2(X,W,U,M,V),q=Q.encIv,F=O(H);return F.start(q),F};z$.pbe.getCipherForPKCS12PBE=function($,J,X){var Q={},Y=[];if(!_.validate(J,AV,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=o.util.createBuffer(Q.salt),U=o.util.createBuffer(Q.iterations);U=U.getInt(U.length()<<3);var M,O,V;switch($){case z$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:M=24,O=8,V=o.des.startDecrypting;break;case z$.oids["pbewithSHAAnd40BitRC2-CBC"]:M=5,O=8,V=function(A,L){var R=o.rc2.createDecryptionCipher(A,40);return R.start(L,null),R};break;default:var G=Error("Cannot read PKCS #12 PBE data block. Unsupported OID.");throw G.oid=$,G}var H=D1(Q.prfOid),q=z$.pbe.generatePkcs12Key(X,W,1,U,M,H);H.start();var F=z$.pbe.generatePkcs12Key(X,W,2,U,O,H);return V(q,F)};z$.pbe.opensslDeriveBytes=function($,J,X,Q){if(typeof Q>"u"||Q===null){if(!("md5"in o.md))throw Error('"md5" hash algorithm unavailable.');Q=o.md.md5.create()}if(J===null)J="";var Y=[R1(Q,$+J)];for(var G=16,W=1;G<X;++W,G+=16)Y.push(R1(Q,Y[W-1]+$+J));return Y.join("").substr(0,X)};function R1($,J){return $.start().update(J).digest().getBytes()}function D1($){var J;if(!$)J="hmacWithSHA1";else if(J=z$.oids[_.derToOid($)],!J){var X=Error("Unsupported PRF OID.");throw X.oid=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}return Z1(J)}function Z1($){var J=o.md;switch($){case"hmacWithSHA224":J=o.md.sha512;case"hmacWithSHA1":case"hmacWithSHA256":case"hmacWithSHA384":case"hmacWithSHA512":$=$.substr(8).toLowerCase();break;default:var X=Error("Unsupported PRF algorithm.");throw X.algorithm=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}if(!J||!($ in J))throw Error("Unknown hash algorithm: "+$);return J[$].create()}function RV($,J,X,Q){var Y=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,$),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,J.getBytes())]);if(Q!=="hmacWithSHA1")Y.value.push(_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,o.util.hexToBytes(X.toString(16))),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(z$.oids[Q]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]));return Y}});var L8=H$((jF,S1)=>{var PQ=F$();mJ();_$();var i=PQ.asn1,_Q=S1.exports=PQ.pkcs7asn1=PQ.pkcs7asn1||{};PQ.pkcs7=PQ.pkcs7||{};PQ.pkcs7.asn1=_Q;var j1={name:"ContentInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.ContentType",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,captureAsn1:"content"}]};_Q.contentInfoValidator=j1;var T1={name:"EncryptedContentInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentType",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"contentType"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentEncryptionAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,captureAsn1:"encParameter"}]},{name:"EncryptedContentInfo.encryptedContent",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,capture:"encryptedContent",captureAsn1:"encryptedContentAsn1"}]};_Q.envelopedDataValidator={name:"EnvelopedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EnvelopedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"EnvelopedData.RecipientInfos",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,constructed:!0,captureAsn1:"recipientInfos"}].concat(T1)};_Q.encryptedDataValidator={name:"EncryptedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"}].concat(T1)};var DV={name:"SignerInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1},{name:"SignerInfo.issuerAndSerialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.issuerAndSerialNumber.issuer",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"SignerInfo.issuerAndSerialNumber.serialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"SignerInfo.digestAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.digestAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"digestAlgorithm"},{name:"SignerInfo.digestAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,constructed:!1,captureAsn1:"digestParameter",optional:!0}]},{name:"SignerInfo.authenticatedAttributes",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"authenticatedAttributes"},{name:"SignerInfo.digestEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,capture:"signatureAlgorithm"},{name:"SignerInfo.encryptedDigest",tagClass:i.Class.UNIVERSAL,type:i.Type.OCTETSTRING,constructed:!1,capture:"signature"},{name:"SignerInfo.unauthenticatedAttributes",tagClass:i.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,capture:"unauthenticatedAttributes"}]};_Q.signedDataValidator={name:"SignedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"SignedData.DigestAlgorithms",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,constructed:!0,captureAsn1:"digestAlgorithms"},j1,{name:"SignedData.Certificates",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,optional:!0,captureAsn1:"certificates"},{name:"SignedData.CertificateRevocationLists",tagClass:i.Class.CONTEXT_SPECIFIC,type:1,optional:!0,captureAsn1:"crls"},{name:"SignedData.SignerInfos",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,capture:"signerInfos",optional:!0,value:[DV]}]};_Q.recipientInfoValidator={name:"RecipientInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"RecipientInfo.issuerAndSerial",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.issuerAndSerial.issuer",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"RecipientInfo.issuerAndSerial.serialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"RecipientInfo.keyEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.keyEncryptionAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"RecipientInfo.keyEncryptionAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,constructed:!1,captureAsn1:"encParameter",optional:!0}]},{name:"RecipientInfo.encryptedKey",tagClass:i.Class.UNIVERSAL,type:i.Type.OCTETSTRING,constructed:!1,capture:"encKey"}]}});var A8=H$((TF,I1)=>{var GQ=F$();_$();GQ.mgf=GQ.mgf||{};var ZV=I1.exports=GQ.mgf.mgf1=GQ.mgf1=GQ.mgf1||{};ZV.create=function($){var J={generate:function(X,Q){var Y=new GQ.util.ByteBuffer,G=Math.ceil(Q/$.digestLength);for(var W=0;W<G;W++){var U=new GQ.util.ByteBuffer;U.putInt32(W),$.start(),$.update(X+U.getBytes()),Y.putBuffer($.digest())}return Y.truncate(Y.length()-Q),Y.getBytes()}};return J}});var w1=H$((SF,C1)=>{var vY=F$();A8();C1.exports=vY.mgf=vY.mgf||{};vY.mgf.mgf1=vY.mgf1});var kY=H$((IF,P1)=>{var WQ=F$();_J();_$();var BV=P1.exports=WQ.pss=WQ.pss||{};BV.create=function($){if(arguments.length===3)$={md:arguments[0],mgf:arguments[1],saltLength:arguments[2]};var{md:J,mgf:X}=$,Q=J.digestLength,Y=$.salt||null;if(typeof Y==="string")Y=WQ.util.createBuffer(Y);var G;if("saltLength"in $)G=$.saltLength;else if(Y!==null)G=Y.length();else throw Error("Salt length not specified or specific salt not given.");if(Y!==null&&Y.length()!==G)throw Error("Given salt length does not match length of given salt.");var W=$.prng||WQ.random,U={};return U.encode=function(M,O){var V,H=O-1,q=Math.ceil(H/8),F=M.digest().getBytes();if(q<Q+G+2)throw Error("Message is too long to encrypt.");var K;if(Y===null)K=W.getBytesSync(G);else K=Y.bytes();var A=new WQ.util.ByteBuffer;A.fillWithByte(0,8),A.putBytes(F),A.putBytes(K),J.start(),J.update(A.getBytes());var L=J.digest().getBytes(),R=new WQ.util.ByteBuffer;R.fillWithByte(0,q-G-Q-2),R.putByte(1),R.putBytes(K);var I=R.getBytes(),j=q-Q-1,C=X.generate(L,j),w="";for(V=0;V<j;V++)w+=String.fromCharCode(I.charCodeAt(V)^C.charCodeAt(V));var P=65280>>8*q-H&255;return w=String.fromCharCode(w.charCodeAt(0)&~P)+w.substr(1),w+L+String.fromCharCode(188)},U.verify=function(M,O,V){var H,q=V-1,F=Math.ceil(q/8);if(O=O.substr(-F),F<Q+G+2)throw Error("Inconsistent parameters to PSS signature verification.");if(O.charCodeAt(F-1)!==188)throw Error("Encoded message does not end in 0xBC.");var K=F-Q-1,A=O.substr(0,K),L=O.substr(K,Q),R=65280>>8*F-q&255;if((A.charCodeAt(0)&R)!==0)throw Error("Bits beyond keysize not zero as expected.");var I=X.generate(L,K),j="";for(H=0;H<K;H++)j+=String.fromCharCode(A.charCodeAt(H)^I.charCodeAt(H));j=String.fromCharCode(j.charCodeAt(0)&~R)+j.substr(1);var C=F-Q-G-2;for(H=0;H<C;H++)if(j.charCodeAt(H)!==0)throw Error("Leftmost octets not zero as expected");if(j.charCodeAt(C)!==1)throw Error("Inconsistent PSS signature, 0x01 marker not found");var w=j.substr(-G),P=new WQ.util.ByteBuffer;P.fillWithByte(0,8),P.putBytes(M),P.putBytes(w),J.start(),J.update(P.getBytes());var l=J.digest().getBytes();return L===l},U}});var bY=H$((CF,f1)=>{var X$=F$();w0();mJ();AX();eJ();w1();P0();JQ();kY();ZX();_$();var z=X$.asn1,g=f1.exports=X$.pki=X$.pki||{},w$=g.oids,r$={};r$.CN=w$.commonName;r$.commonName="CN";r$.C=w$.countryName;r$.countryName="C";r$.L=w$.localityName;r$.localityName="L";r$.ST=w$.stateOrProvinceName;r$.stateOrProvinceName="ST";r$.O=w$.organizationName;r$.organizationName="O";r$.OU=w$.organizationalUnitName;r$.organizationalUnitName="OU";r$.E=w$.emailAddress;r$.emailAddress="E";var x1=X$.pki.rsa.publicKeyValidator,jV={name:"Certificate",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"tbsCertificate",value:[{name:"Certificate.TBSCertificate.version",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.version.integer",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certVersion"}]},{name:"Certificate.TBSCertificate.serialNumber",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certSerialNumber"},{name:"Certificate.TBSCertificate.signature",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.signature.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"certinfoSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"certinfoSignatureParams"}]},{name:"Certificate.TBSCertificate.issuer",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certIssuer"},{name:"Certificate.TBSCertificate.validity",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.validity.notBefore (utc)",tagClass:z.Class.UNIVERSAL,type:z.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity1UTCTime"},{name:"Certificate.TBSCertificate.validity.notBefore (generalized)",tagClass:z.Class.UNIVERSAL,type:z.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity2GeneralizedTime"},{name:"Certificate.TBSCertificate.validity.notAfter (utc)",tagClass:z.Class.UNIVERSAL,type:z.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity3UTCTime"},{name:"Certificate.TBSCertificate.validity.notAfter (generalized)",tagClass:z.Class.UNIVERSAL,type:z.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity4GeneralizedTime"}]},{name:"Certificate.TBSCertificate.subject",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certSubject"},x1,{name:"Certificate.TBSCertificate.issuerUniqueID",tagClass:z.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.issuerUniqueID.id",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certIssuerUniqueId"}]},{name:"Certificate.TBSCertificate.subjectUniqueID",tagClass:z.Class.CONTEXT_SPECIFIC,type:2,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.subjectUniqueID.id",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSubjectUniqueId"}]},{name:"Certificate.TBSCertificate.extensions",tagClass:z.Class.CONTEXT_SPECIFIC,type:3,constructed:!0,captureAsn1:"certExtensions",optional:!0}]},{name:"Certificate.signatureAlgorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.signatureAlgorithm.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"certSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"certSignatureParams"}]},{name:"Certificate.signatureValue",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSignature"}]},TV={name:"rsapss",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.hashAlgorithm",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier",tagClass:z.Class.UNIVERSAL,type:z.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"hashOid"}]}]},{name:"rsapss.maskGenAlgorithm",tagClass:z.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier",tagClass:z.Class.UNIVERSAL,type:z.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"maskGenOid"},{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"maskGenHashOid"}]}]}]},{name:"rsapss.saltLength",tagClass:z.Class.CONTEXT_SPECIFIC,type:2,optional:!0,value:[{name:"rsapss.saltLength.saltLength",tagClass:z.Class.UNIVERSAL,type:z.Class.INTEGER,constructed:!1,capture:"saltLength"}]},{name:"rsapss.trailerField",tagClass:z.Class.CONTEXT_SPECIFIC,type:3,optional:!0,value:[{name:"rsapss.trailer.trailer",tagClass:z.Class.UNIVERSAL,type:z.Class.INTEGER,constructed:!1,capture:"trailer"}]}]},SV={name:"CertificationRequestInfo",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfo",value:[{name:"CertificationRequestInfo.integer",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certificationRequestInfoVersion"},{name:"CertificationRequestInfo.subject",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfoSubject"},x1,{name:"CertificationRequestInfo.attributes",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"certificationRequestInfoAttributes",value:[{name:"CertificationRequestInfo.attributes",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequestInfo.attributes.type",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1},{name:"CertificationRequestInfo.attributes.value",tagClass:z.Class.UNIVERSAL,type:z.Type.SET,constructed:!0}]}]}]},IV={name:"CertificationRequest",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"csr",value:[SV,{name:"CertificationRequest.signatureAlgorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequest.signatureAlgorithm.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"csrSignatureOid"},{name:"CertificationRequest.signatureAlgorithm.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"csrSignatureParams"}]},{name:"CertificationRequest.signature",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"csrSignature"}]};g.RDNAttributesAsArray=function($,J){var X=[],Q,Y,G;for(var W=0;W<$.value.length;++W){Q=$.value[W];for(var U=0;U<Q.value.length;++U){if(G={},Y=Q.value[U],G.type=z.derToOid(Y.value[0].value),G.value=Y.value[1].value,G.valueTagClass=Y.value[1].type,G.type in w$){if(G.name=w$[G.type],G.name in r$)G.shortName=r$[G.name]}if(J)J.update(G.type),J.update(G.value);X.push(G)}}return X};g.CRIAttributesAsArray=function($){var J=[];for(var X=0;X<$.length;++X){var Q=$[X],Y=z.derToOid(Q.value[0].value),G=Q.value[1].value;for(var W=0;W<G.length;++W){var U={};if(U.type=Y,U.value=G[W].value,U.valueTagClass=G[W].type,U.type in w$){if(U.name=w$[U.type],U.name in r$)U.shortName=r$[U.name]}if(U.type===w$.extensionRequest){U.extensions=[];for(var M=0;M<U.value.length;++M)U.extensions.push(g.certificateExtensionFromAsn1(U.value[M]))}J.push(U)}}return J};function v0($,J){if(typeof J==="string")J={shortName:J};var X=null,Q;for(var Y=0;X===null&&Y<$.attributes.length;++Y)if(Q=$.attributes[Y],J.type&&J.type===Q.type)X=Q;else if(J.name&&J.name===Q.name)X=Q;else if(J.shortName&&J.shortName===Q.shortName)X=Q;return X}var fY=function($,J,X){var Q={};if($!==w$["RSASSA-PSS"])return Q;if(X)Q={hash:{algorithmOid:w$.sha1},mgf:{algorithmOid:w$.mgf1,hash:{algorithmOid:w$.sha1}},saltLength:20};var Y={},G=[];if(!z.validate(J,TV,Y,G)){var W=Error("Cannot read RSASSA-PSS parameter block.");throw W.errors=G,W}if(Y.hashOid!==void 0)Q.hash=Q.hash||{},Q.hash.algorithmOid=z.derToOid(Y.hashOid);if(Y.maskGenOid!==void 0)Q.mgf=Q.mgf||{},Q.mgf.algorithmOid=z.derToOid(Y.maskGenOid),Q.mgf.hash=Q.mgf.hash||{},Q.mgf.hash.algorithmOid=z.derToOid(Y.maskGenHashOid);if(Y.saltLength!==void 0)Q.saltLength=Y.saltLength.charCodeAt(0);return Q},yY=function($){switch(w$[$.signatureOid]){case"sha1WithRSAEncryption":case"sha1WithRSASignature":return X$.md.sha1.create();case"md5WithRSAEncryption":return X$.md.md5.create();case"sha256WithRSAEncryption":return X$.md.sha256.create();case"sha384WithRSAEncryption":return X$.md.sha384.create();case"sha512WithRSAEncryption":return X$.md.sha512.create();case"RSASSA-PSS":return X$.md.sha256.create();default:var J=Error("Could not compute "+$.type+" digest. Unknown signature OID.");throw J.signatureOid=$.signatureOid,J}},v1=function($){var J=$.certificate,X;switch(J.signatureOid){case w$.sha1WithRSAEncryption:case w$.sha1WithRSASignature:break;case w$["RSASSA-PSS"]:var Q,Y;if(Q=w$[J.signatureParameters.mgf.hash.algorithmOid],Q===void 0||X$.md[Q]===void 0){var G=Error("Unsupported MGF hash function.");throw G.oid=J.signatureParameters.mgf.hash.algorithmOid,G.name=Q,G}if(Y=w$[J.signatureParameters.mgf.algorithmOid],Y===void 0||X$.mgf[Y]===void 0){var G=Error("Unsupported MGF function.");throw G.oid=J.signatureParameters.mgf.algorithmOid,G.name=Y,G}if(Y=X$.mgf[Y].create(X$.md[Q].create()),Q=w$[J.signatureParameters.hash.algorithmOid],Q===void 0||X$.md[Q]===void 0){var G=Error("Unsupported RSASSA-PSS hash function.");throw G.oid=J.signatureParameters.hash.algorithmOid,G.name=Q,G}X=X$.pss.create(X$.md[Q].create(),Y,J.signatureParameters.saltLength);break}return J.publicKey.verify($.md.digest().getBytes(),$.signature,X)};g.certificateFromPem=function($,J,X){var Q=X$.pem.decode($)[0];if(Q.type!=="CERTIFICATE"&&Q.type!=="X509 CERTIFICATE"&&Q.type!=="TRUSTED CERTIFICATE"){var Y=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var G=z.fromDer(Q.body,X);return g.certificateFromAsn1(G,J)};g.certificateToPem=function($,J){var X={type:"CERTIFICATE",body:z.toDer(g.certificateToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.publicKeyFromPem=function($){var J=X$.pem.decode($)[0];if(J.type!=="PUBLIC KEY"&&J.type!=="RSA PUBLIC KEY"){var X=Error('Could not convert public key from PEM; PEM header type is not "PUBLIC KEY" or "RSA PUBLIC KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert public key from PEM; PEM is encrypted.");var Q=z.fromDer(J.body);return g.publicKeyFromAsn1(Q)};g.publicKeyToPem=function($,J){var X={type:"PUBLIC KEY",body:z.toDer(g.publicKeyToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.publicKeyToRSAPublicKeyPem=function($,J){var X={type:"RSA PUBLIC KEY",body:z.toDer(g.publicKeyToRSAPublicKey($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||X$.md.sha1.create(),Q=J.type||"RSAPublicKey",Y;switch(Q){case"RSAPublicKey":Y=z.toDer(g.publicKeyToRSAPublicKey($)).getBytes();break;case"SubjectPublicKeyInfo":Y=z.toDer(g.publicKeyToAsn1($)).getBytes();break;default:throw Error('Unknown fingerprint type "'+J.type+'".')}X.start(),X.update(Y);var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};g.certificationRequestFromPem=function($,J,X){var Q=X$.pem.decode($)[0];if(Q.type!=="CERTIFICATE REQUEST"){var Y=Error('Could not convert certification request from PEM; PEM header type is not "CERTIFICATE REQUEST".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certification request from PEM; PEM is encrypted.");var G=z.fromDer(Q.body,X);return g.certificationRequestFromAsn1(G,J)};g.certificationRequestToPem=function($,J){var X={type:"CERTIFICATE REQUEST",body:z.toDer(g.certificationRequestToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.createCertificate=function(){var $={};return $.version=2,$.serialNumber="00",$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.validity={},$.validity.notBefore=new Date,$.validity.notAfter=new Date,$.issuer={},$.issuer.getField=function(J){return v0($.issuer,J)},$.issuer.addField=function(J){kJ([J]),$.issuer.attributes.push(J)},$.issuer.attributes=[],$.issuer.hash=null,$.subject={},$.subject.getField=function(J){return v0($.subject,J)},$.subject.addField=function(J){kJ([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.extensions=[],$.publicKey=null,$.md=null,$.setSubject=function(J,X){if(kJ(J),$.subject.attributes=J,delete $.subject.uniqueId,X)$.subject.uniqueId=X;$.subject.hash=null},$.setIssuer=function(J,X){if(kJ(J),$.issuer.attributes=J,delete $.issuer.uniqueId,X)$.issuer.uniqueId=X;$.issuer.hash=null},$.setExtensions=function(J){for(var X=0;X<J.length;++X)k1(J[X],{cert:$});$.extensions=J},$.getExtension=function(J){if(typeof J==="string")J={name:J};var X=null,Q;for(var Y=0;X===null&&Y<$.extensions.length;++Y)if(Q=$.extensions[Y],J.id&&Q.id===J.id)X=Q;else if(J.name&&Q.name===J.name)X=Q;return X},$.sign=function(J,X){$.md=X||X$.md.sha1.create();var Q=w$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certificate digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.tbsCertificate=g.getTBSCertificate($);var G=z.toDer($.tbsCertificate);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(J){var X=!1;if(!$.issued(J)){var Q=J.issuer,Y=$.subject,G=Error("The parent certificate did not issue the given child certificate; the child certificate's issuer does not match the parent's subject.");throw G.expectedIssuer=Y.attributes,G.actualIssuer=Q.attributes,G}var W=J.md;if(W===null){W=yY({signatureOid:J.signatureOid,type:"certificate"});var U=J.tbsCertificate||g.getTBSCertificate(J),M=z.toDer(U);W.update(M.getBytes())}if(W!==null)X=v1({certificate:$,md:W,signature:J.signature});return X},$.isIssuer=function(J){var X=!1,Q=$.issuer,Y=J.subject;if(Q.hash&&Y.hash)X=Q.hash===Y.hash;else if(Q.attributes.length===Y.attributes.length){X=!0;var G,W;for(var U=0;X&&U<Q.attributes.length;++U)if(G=Q.attributes[U],W=Y.attributes[U],G.type!==W.type||G.value!==W.value)X=!1}return X},$.issued=function(J){return J.isIssuer($)},$.generateSubjectKeyIdentifier=function(){return g.getPublicKeyFingerprint($.publicKey,{type:"RSAPublicKey"})},$.verifySubjectKeyIdentifier=function(){var J=w$.subjectKeyIdentifier;for(var X=0;X<$.extensions.length;++X){var Q=$.extensions[X];if(Q.id===J){var Y=$.generateSubjectKeyIdentifier().getBytes();return X$.util.hexToBytes(Q.subjectKeyIdentifier)===Y}}return!1},$};g.certificateFromAsn1=function($,J){var X={},Q=[];if(!z.validate($,jV,X,Q)){var Y=Error("Cannot read X.509 certificate. ASN.1 object is not an X509v3 Certificate.");throw Y.errors=Q,Y}var G=z.derToOid(X.publicKeyOid);if(G!==g.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=g.createCertificate();W.version=X.certVersion?X.certVersion.charCodeAt(0):0;var U=X$.util.createBuffer(X.certSerialNumber);W.serialNumber=U.toHex(),W.signatureOid=X$.asn1.derToOid(X.certSignatureOid),W.signatureParameters=fY(W.signatureOid,X.certSignatureParams,!0),W.siginfo.algorithmOid=X$.asn1.derToOid(X.certinfoSignatureOid),W.siginfo.parameters=fY(W.siginfo.algorithmOid,X.certinfoSignatureParams,!1),W.signature=X.certSignature;var M=[];if(X.certValidity1UTCTime!==void 0)M.push(z.utcTimeToDate(X.certValidity1UTCTime));if(X.certValidity2GeneralizedTime!==void 0)M.push(z.generalizedTimeToDate(X.certValidity2GeneralizedTime));if(X.certValidity3UTCTime!==void 0)M.push(z.utcTimeToDate(X.certValidity3UTCTime));if(X.certValidity4GeneralizedTime!==void 0)M.push(z.generalizedTimeToDate(X.certValidity4GeneralizedTime));if(M.length>2)throw Error("Cannot read notBefore/notAfter validity times; more than two times were provided in the certificate.");if(M.length<2)throw Error("Cannot read notBefore/notAfter validity times; they were not provided as either UTCTime or GeneralizedTime.");if(W.validity.notBefore=M[0],W.validity.notAfter=M[1],W.tbsCertificate=X.tbsCertificate,J){W.md=yY({signatureOid:W.signatureOid,type:"certificate"});var O=z.toDer(W.tbsCertificate);W.md.update(O.getBytes())}var V=X$.md.sha1.create(),H=z.toDer(X.certIssuer);if(V.update(H.getBytes()),W.issuer.getField=function(K){return v0(W.issuer,K)},W.issuer.addField=function(K){kJ([K]),W.issuer.attributes.push(K)},W.issuer.attributes=g.RDNAttributesAsArray(X.certIssuer),X.certIssuerUniqueId)W.issuer.uniqueId=X.certIssuerUniqueId;W.issuer.hash=V.digest().toHex();var q=X$.md.sha1.create(),F=z.toDer(X.certSubject);if(q.update(F.getBytes()),W.subject.getField=function(K){return v0(W.subject,K)},W.subject.addField=function(K){kJ([K]),W.subject.attributes.push(K)},W.subject.attributes=g.RDNAttributesAsArray(X.certSubject),X.certSubjectUniqueId)W.subject.uniqueId=X.certSubjectUniqueId;if(W.subject.hash=q.digest().toHex(),X.certExtensions)W.extensions=g.certificateExtensionsFromAsn1(X.certExtensions);else W.extensions=[];return W.publicKey=g.publicKeyFromAsn1(X.subjectPublicKeyInfo),W};g.certificateExtensionsFromAsn1=function($){var J=[];for(var X=0;X<$.value.length;++X){var Q=$.value[X];for(var Y=0;Y<Q.value.length;++Y)J.push(g.certificateExtensionFromAsn1(Q.value[Y]))}return J};g.certificateExtensionFromAsn1=function($){var J={};if(J.id=z.derToOid($.value[0].value),J.critical=!1,$.value[1].type===z.Type.BOOLEAN)J.critical=$.value[1].value.charCodeAt(0)!==0,J.value=$.value[2].value;else J.value=$.value[1].value;if(J.id in w$){if(J.name=w$[J.id],J.name==="keyUsage"){var X=z.fromDer(J.value),Q=0,Y=0;if(X.value.length>1)Q=X.value.charCodeAt(1),Y=X.value.length>2?X.value.charCodeAt(2):0;J.digitalSignature=(Q&128)===128,J.nonRepudiation=(Q&64)===64,J.keyEncipherment=(Q&32)===32,J.dataEncipherment=(Q&16)===16,J.keyAgreement=(Q&8)===8,J.keyCertSign=(Q&4)===4,J.cRLSign=(Q&2)===2,J.encipherOnly=(Q&1)===1,J.decipherOnly=(Y&128)===128}else if(J.name==="basicConstraints"){var X=z.fromDer(J.value);if(X.value.length>0&&X.value[0].type===z.Type.BOOLEAN)J.cA=X.value[0].value.charCodeAt(0)!==0;else J.cA=!1;var G=null;if(X.value.length>0&&X.value[0].type===z.Type.INTEGER)G=X.value[0].value;else if(X.value.length>1)G=X.value[1].value;if(G!==null)J.pathLenConstraint=z.derToInteger(G)}else if(J.name==="extKeyUsage"){var X=z.fromDer(J.value);for(var W=0;W<X.value.length;++W){var U=z.derToOid(X.value[W].value);if(U in w$)J[w$[U]]=!0;else J[U]=!0}}else if(J.name==="nsCertType"){var X=z.fromDer(J.value),Q=0;if(X.value.length>1)Q=X.value.charCodeAt(1);J.client=(Q&128)===128,J.server=(Q&64)===64,J.email=(Q&32)===32,J.objsign=(Q&16)===16,J.reserved=(Q&8)===8,J.sslCA=(Q&4)===4,J.emailCA=(Q&2)===2,J.objCA=(Q&1)===1}else if(J.name==="subjectAltName"||J.name==="issuerAltName"){J.altNames=[];var M,X=z.fromDer(J.value);for(var O=0;O<X.value.length;++O){M=X.value[O];var V={type:M.type,value:M.value};switch(J.altNames.push(V),M.type){case 1:case 2:case 6:break;case 7:V.ip=X$.util.bytesToIP(M.value);break;case 8:V.oid=z.derToOid(M.value);break;default:}}}else if(J.name==="subjectKeyIdentifier"){var X=z.fromDer(J.value);J.subjectKeyIdentifier=X$.util.bytesToHex(X.value)}}return J};g.certificationRequestFromAsn1=function($,J){var X={},Q=[];if(!z.validate($,IV,X,Q)){var Y=Error("Cannot read PKCS#10 certificate request. ASN.1 object is not a PKCS#10 CertificationRequest.");throw Y.errors=Q,Y}var G=z.derToOid(X.publicKeyOid);if(G!==g.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=g.createCertificationRequest();if(W.version=X.csrVersion?X.csrVersion.charCodeAt(0):0,W.signatureOid=X$.asn1.derToOid(X.csrSignatureOid),W.signatureParameters=fY(W.signatureOid,X.csrSignatureParams,!0),W.siginfo.algorithmOid=X$.asn1.derToOid(X.csrSignatureOid),W.siginfo.parameters=fY(W.siginfo.algorithmOid,X.csrSignatureParams,!1),W.signature=X.csrSignature,W.certificationRequestInfo=X.certificationRequestInfo,J){W.md=yY({signatureOid:W.signatureOid,type:"certification request"});var U=z.toDer(W.certificationRequestInfo);W.md.update(U.getBytes())}var M=X$.md.sha1.create();return W.subject.getField=function(O){return v0(W.subject,O)},W.subject.addField=function(O){kJ([O]),W.subject.attributes.push(O)},W.subject.attributes=g.RDNAttributesAsArray(X.certificationRequestInfoSubject,M),W.subject.hash=M.digest().toHex(),W.publicKey=g.publicKeyFromAsn1(X.subjectPublicKeyInfo),W.getAttribute=function(O){return v0(W,O)},W.addAttribute=function(O){kJ([O]),W.attributes.push(O)},W.attributes=g.CRIAttributesAsArray(X.certificationRequestInfoAttributes||[]),W};g.createCertificationRequest=function(){var $={};return $.version=0,$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.subject={},$.subject.getField=function(J){return v0($.subject,J)},$.subject.addField=function(J){kJ([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.publicKey=null,$.attributes=[],$.getAttribute=function(J){return v0($,J)},$.addAttribute=function(J){kJ([J]),$.attributes.push(J)},$.md=null,$.setSubject=function(J){kJ(J),$.subject.attributes=J,$.subject.hash=null},$.setAttributes=function(J){kJ(J),$.attributes=J},$.sign=function(J,X){$.md=X||X$.md.sha1.create();var Q=w$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certification request digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.certificationRequestInfo=g.getCertificationRequestInfo($);var G=z.toDer($.certificationRequestInfo);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(){var J=!1,X=$.md;if(X===null){X=yY({signatureOid:$.signatureOid,type:"certification request"});var Q=$.certificationRequestInfo||g.getCertificationRequestInfo($),Y=z.toDer(Q);X.update(Y.getBytes())}if(X!==null)J=v1({certificate:$,md:X,signature:$.signature});return J},$};function xQ($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),X,Q,Y=$.attributes;for(var G=0;G<Y.length;++G){X=Y[G];var W=X.value,U=z.Type.PRINTABLESTRING;if("valueTagClass"in X){if(U=X.valueTagClass,U===z.Type.UTF8)W=X$.util.encodeUtf8(W)}Q=z.create(z.Class.UNIVERSAL,z.Type.SET,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(X.type).getBytes()),z.create(z.Class.UNIVERSAL,U,!1,W)])]),J.value.push(Q)}return J}function kJ($){var J;for(var X=0;X<$.length;++X){if(J=$[X],typeof J.name>"u"){if(J.type&&J.type in g.oids)J.name=g.oids[J.type];else if(J.shortName&&J.shortName in r$)J.name=g.oids[r$[J.shortName]]}if(typeof J.type>"u")if(J.name&&J.name in g.oids)J.type=g.oids[J.name];else{var Q=Error("Attribute type not specified.");throw Q.attribute=J,Q}if(typeof J.shortName>"u"){if(J.name&&J.name in r$)J.shortName=r$[J.name]}if(J.type===w$.extensionRequest){if(J.valueConstructed=!0,J.valueTagClass=z.Type.SEQUENCE,!J.value&&J.extensions){J.value=[];for(var Y=0;Y<J.extensions.length;++Y)J.value.push(g.certificateExtensionToAsn1(k1(J.extensions[Y])))}}if(typeof J.value>"u"){var Q=Error("Attribute value not specified.");throw Q.attribute=J,Q}}}function k1($,J){if(J=J||{},typeof $.name>"u"){if($.id&&$.id in g.oids)$.name=g.oids[$.id]}if(typeof $.id>"u")if($.name&&$.name in g.oids)$.id=g.oids[$.name];else{var X=Error("Extension ID not specified.");throw X.extension=$,X}if(typeof $.value<"u")return $;if($.name==="keyUsage"){var Q=0,Y=0,G=0;if($.digitalSignature)Y|=128,Q=7;if($.nonRepudiation)Y|=64,Q=6;if($.keyEncipherment)Y|=32,Q=5;if($.dataEncipherment)Y|=16,Q=4;if($.keyAgreement)Y|=8,Q=3;if($.keyCertSign)Y|=4,Q=2;if($.cRLSign)Y|=2,Q=1;if($.encipherOnly)Y|=1,Q=0;if($.decipherOnly)G|=128,Q=7;var W=String.fromCharCode(Q);if(G!==0)W+=String.fromCharCode(Y)+String.fromCharCode(G);else if(Y!==0)W+=String.fromCharCode(Y);$.value=z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,W)}else if($.name==="basicConstraints"){if($.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),$.cA)$.value.value.push(z.create(z.Class.UNIVERSAL,z.Type.BOOLEAN,!1,String.fromCharCode(255)));if("pathLenConstraint"in $)$.value.value.push(z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.pathLenConstraint).getBytes()))}else if($.name==="extKeyUsage"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value;for(var M in $){if($[M]!==!0)continue;if(M in w$)U.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(w$[M]).getBytes()));else if(M.indexOf(".")!==-1)U.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(M).getBytes()))}}else if($.name==="nsCertType"){var Q=0,Y=0;if($.client)Y|=128,Q=7;if($.server)Y|=64,Q=6;if($.email)Y|=32,Q=5;if($.objsign)Y|=16,Q=4;if($.reserved)Y|=8,Q=3;if($.sslCA)Y|=4,Q=2;if($.emailCA)Y|=2,Q=1;if($.objCA)Y|=1,Q=0;var W=String.fromCharCode(Q);if(Y!==0)W+=String.fromCharCode(Y);$.value=z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,W)}else if($.name==="subjectAltName"||$.name==="issuerAltName"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var O;for(var V=0;V<$.altNames.length;++V){O=$.altNames[V];var W=O.value;if(O.type===7&&O.ip){if(W=X$.util.bytesFromIP(O.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(O.type===8)if(O.oid)W=z.oidToDer(z.oidToDer(O.oid));else W=z.oidToDer(W);$.value.value.push(z.create(z.Class.CONTEXT_SPECIFIC,O.type,!1,W))}}else if($.name==="nsComment"&&J.cert){if(!/^[\x00-\x7F]*$/.test($.comment)||$.comment.length<1||$.comment.length>128)throw Error('Invalid "nsComment" content.');$.value=z.create(z.Class.UNIVERSAL,z.Type.IA5STRING,!1,$.comment)}else if($.name==="subjectKeyIdentifier"&&J.cert){var H=J.cert.generateSubjectKeyIdentifier();$.subjectKeyIdentifier=H.toHex(),$.value=z.create(z.Class.UNIVERSAL,z.Type.OCTETSTRING,!1,H.getBytes())}else if($.name==="authorityKeyIdentifier"&&J.cert){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value;if($.keyIdentifier){var q=$.keyIdentifier===!0?J.cert.generateSubjectKeyIdentifier().getBytes():$.keyIdentifier;U.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!1,q))}if($.authorityCertIssuer){var F=[z.create(z.Class.CONTEXT_SPECIFIC,4,!0,[xQ($.authorityCertIssuer===!0?J.cert.issuer:$.authorityCertIssuer)])];U.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,F))}if($.serialNumber){var K=X$.util.hexToBytes($.serialNumber===!0?J.cert.serialNumber:$.serialNumber);U.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!1,K))}}else if($.name==="cRLDistributionPoints"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value,A=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),L=z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[]),O;for(var V=0;V<$.altNames.length;++V){O=$.altNames[V];var W=O.value;if(O.type===7&&O.ip){if(W=X$.util.bytesFromIP(O.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(O.type===8)if(O.oid)W=z.oidToDer(z.oidToDer(O.oid));else W=z.oidToDer(W);L.value.push(z.create(z.Class.CONTEXT_SPECIFIC,O.type,!1,W))}A.value.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[L])),U.push(A)}if(typeof $.value>"u"){var X=Error("Extension value not specified.");throw X.extension=$,X}return $}function R8($,J){switch($){case w$["RSASSA-PSS"]:var X=[];if(J.hash.algorithmOid!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.hash.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")])]));if(J.mgf.algorithmOid!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.mgf.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.mgf.hash.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")])])]));if(J.saltLength!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer(J.saltLength).getBytes())]));return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,X);default:return z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")}}function CV($){var J=z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[]);if($.attributes.length===0)return J;var X=$.attributes;for(var Q=0;Q<X.length;++Q){var Y=X[Q],G=Y.value,W=z.Type.UTF8;if("valueTagClass"in Y)W=Y.valueTagClass;if(W===z.Type.UTF8)G=X$.util.encodeUtf8(G);var U=!1;if("valueConstructed"in Y)U=Y.valueConstructed;var M=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(Y.type).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.SET,!0,[z.create(z.Class.UNIVERSAL,W,U,G)])]);J.value.push(M)}return J}var wV=new Date("1950-01-01T00:00:00Z"),PV=new Date("2050-01-01T00:00:00Z");function _1($){if($>=wV&&$<PV)return z.create(z.Class.UNIVERSAL,z.Type.UTCTIME,!1,z.dateToUtcTime($));else return z.create(z.Class.UNIVERSAL,z.Type.GENERALIZEDTIME,!1,z.dateToGeneralizedTime($))}g.getTBSCertificate=function($){var J=_1($.validity.notBefore),X=_1($.validity.notAfter),Q=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.version).getBytes())]),z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,X$.util.hexToBytes($.serialNumber)),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.siginfo.algorithmOid).getBytes()),R8($.siginfo.algorithmOid,$.siginfo.parameters)]),xQ($.issuer),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,X]),xQ($.subject),g.publicKeyToAsn1($.publicKey)]);if($.issuer.uniqueId)Q.value.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,[z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.issuer.uniqueId)]));if($.subject.uniqueId)Q.value.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!0,[z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.subject.uniqueId)]));if($.extensions.length>0)Q.value.push(g.certificateExtensionsToAsn1($.extensions));return Q};g.getCertificationRequestInfo=function($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.version).getBytes()),xQ($.subject),g.publicKeyToAsn1($.publicKey),CV($)]);return J};g.distinguishedNameToAsn1=function($){return xQ($)};g.certificateToAsn1=function($){var J=$.tbsCertificate||g.getTBSCertificate($);return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.signatureOid).getBytes()),R8($.signatureOid,$.signatureParameters)]),z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};g.certificateExtensionsToAsn1=function($){var J=z.create(z.Class.CONTEXT_SPECIFIC,3,!0,[]),X=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);J.value.push(X);for(var Q=0;Q<$.length;++Q)X.value.push(g.certificateExtensionToAsn1($[Q]));return J};g.certificateExtensionToAsn1=function($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);if(J.value.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.id).getBytes())),$.critical)J.value.push(z.create(z.Class.UNIVERSAL,z.Type.BOOLEAN,!1,String.fromCharCode(255)));var X=$.value;if(typeof $.value!=="string")X=z.toDer(X).getBytes();return J.value.push(z.create(z.Class.UNIVERSAL,z.Type.OCTETSTRING,!1,X)),J};g.certificationRequestToAsn1=function($){var J=$.certificationRequestInfo||g.getCertificationRequestInfo($);return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.signatureOid).getBytes()),R8($.signatureOid,$.signatureParameters)]),z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};g.createCaStore=function($){var J={certs:{}};J.getIssuer=function(W){var U=X(W.issuer);return U},J.addCertificate=function(W){if(typeof W==="string")W=X$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))if(W.subject.hash in J.certs){var U=J.certs[W.subject.hash];if(!X$.util.isArray(U))U=[U];U.push(W),J.certs[W.subject.hash]=U}else J.certs[W.subject.hash]=W},J.hasCertificate=function(W){if(typeof W==="string")W=X$.pki.certificateFromPem(W);var U=X(W.subject);if(!U)return!1;if(!X$.util.isArray(U))U=[U];var M=z.toDer(g.certificateToAsn1(W)).getBytes();for(var O=0;O<U.length;++O){var V=z.toDer(g.certificateToAsn1(U[O])).getBytes();if(M===V)return!0}return!1},J.listAllCertificates=function(){var W=[];for(var U in J.certs)if(J.certs.hasOwnProperty(U)){var M=J.certs[U];if(!X$.util.isArray(M))W.push(M);else for(var O=0;O<M.length;++O)W.push(M[O])}return W},J.removeCertificate=function(W){var U;if(typeof W==="string")W=X$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))return null;var M=X(W.subject);if(!X$.util.isArray(M))return U=J.certs[W.subject.hash],delete J.certs[W.subject.hash],U;var O=z.toDer(g.certificateToAsn1(W)).getBytes();for(var V=0;V<M.length;++V){var H=z.toDer(g.certificateToAsn1(M[V])).getBytes();if(O===H)U=M[V],M.splice(V,1)}if(M.length===0)delete J.certs[W.subject.hash];return U};function X(W){return Q(W),J.certs[W.hash]||null}function Q(W){if(!W.hash){var U=X$.md.sha1.create();W.attributes=g.RDNAttributesAsArray(xQ(W),U),W.hash=U.digest().toHex()}}if($)for(var Y=0;Y<$.length;++Y){var G=$[Y];J.addCertificate(G)}return J};g.certificateError={bad_certificate:"forge.pki.BadCertificate",unsupported_certificate:"forge.pki.UnsupportedCertificate",certificate_revoked:"forge.pki.CertificateRevoked",certificate_expired:"forge.pki.CertificateExpired",certificate_unknown:"forge.pki.CertificateUnknown",unknown_ca:"forge.pki.UnknownCertificateAuthority"};g.verifyCertificateChain=function($,J,X){if(typeof X==="function")X={verify:X};X=X||{},J=J.slice(0);var Q=J.slice(0),Y=X.validityCheckDate;if(typeof Y>"u")Y=new Date;var G=!0,W=null,U=0;do{var M=J.shift(),O=null,V=!1;if(Y){if(Y<M.validity.notBefore||Y>M.validity.notAfter)W={message:"Certificate is not valid yet or has expired.",error:g.certificateError.certificate_expired,notBefore:M.validity.notBefore,notAfter:M.validity.notAfter,now:Y}}if(W===null){if(O=J[0]||$.getIssuer(M),O===null){if(M.isIssuer(M))V=!0,O=M}if(O){var H=O;if(!X$.util.isArray(H))H=[H];var q=!1;while(!q&&H.length>0){O=H.shift();try{q=O.verify(M)}catch(w){}}if(!q)W={message:"Certificate signature is invalid.",error:g.certificateError.bad_certificate}}if(W===null&&(!O||V)&&!$.hasCertificate(M))W={message:"Certificate is not trusted.",error:g.certificateError.unknown_ca}}if(W===null&&O&&!M.isIssuer(O))W={message:"Certificate issuer is invalid.",error:g.certificateError.bad_certificate};if(W===null){var F={keyUsage:!0,basicConstraints:!0};for(var K=0;W===null&&K<M.extensions.length;++K){var A=M.extensions[K];if(A.critical&&!(A.name in F))W={message:"Certificate has an unsupported critical extension.",error:g.certificateError.unsupported_certificate}}}if(W===null&&(!G||J.length===0&&(!O||V))){var L=M.getExtension("basicConstraints"),R=M.getExtension("keyUsage");if(R!==null){if(!R.keyCertSign||L===null)W={message:"Certificate keyUsage or basicConstraints conflict or indicate that the certificate is not a CA. If the certificate is the only one in the chain or isn't the first then the certificate must be a valid CA.",error:g.certificateError.bad_certificate}}if(W===null&&L===null)W={message:"Certificate is missing basicConstraints extension and cannot be used as a CA.",error:g.certificateError.bad_certificate};if(W===null&&L!==null&&!L.cA)W={message:"Certificate basicConstraints indicates the certificate is not a CA.",error:g.certificateError.bad_certificate};if(W===null&&R!==null&&"pathLenConstraint"in L){var I=U-1;if(I>L.pathLenConstraint)W={message:"Certificate basicConstraints pathLenConstraint violated.",error:g.certificateError.bad_certificate}}}var j=W===null?!0:W.error,C=X.verify?X.verify(j,U,Q):j;if(C===!0)W=null;else{if(j===!0)W={message:"The application rejected the certificate.",error:g.certificateError.bad_certificate};if(C||C===0){if(typeof C==="object"&&!X$.util.isArray(C)){if(C.message)W.message=C.message;if(C.error)W.error=C.error}else if(typeof C==="string")W.error=C}throw W}G=!1,++U}while(J.length>0);return!0}});var Z8=H$((wF,b1)=>{var l$=F$();mJ();TQ();P0();L8();N8();_J();ZX();wQ();_$();bY();var{asn1:D,pki:D$}=l$,jX=b1.exports=l$.pkcs12=l$.pkcs12||{},y1={name:"ContentInfo",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.contentType",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"content"}]},_V={name:"PFX",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.version",tagClass:D.Class.UNIVERSAL,type:D.Type.INTEGER,constructed:!1,capture:"version"},y1,{name:"PFX.macData",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"mac",value:[{name:"PFX.macData.mac",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm.algorithm",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"macAlgorithm"},{name:"PFX.macData.mac.digestAlgorithm.parameters",optional:!0,tagClass:D.Class.UNIVERSAL,captureAsn1:"macAlgorithmParameters"}]},{name:"PFX.macData.mac.digest",tagClass:D.Class.UNIVERSAL,type:D.Type.OCTETSTRING,constructed:!1,capture:"macDigest"}]},{name:"PFX.macData.macSalt",tagClass:D.Class.UNIVERSAL,type:D.Type.OCTETSTRING,constructed:!1,capture:"macSalt"},{name:"PFX.macData.iterations",tagClass:D.Class.UNIVERSAL,type:D.Type.INTEGER,constructed:!1,optional:!0,capture:"macIterations"}]}]},xV={name:"SafeBag",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"SafeBag.bagId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"bagId"},{name:"SafeBag.bagValue",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"bagValue"},{name:"SafeBag.bagAttributes",tagClass:D.Class.UNIVERSAL,type:D.Type.SET,constructed:!0,optional:!0,capture:"bagAttributes"}]},vV={name:"Attribute",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"Attribute.attrId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"oid"},{name:"Attribute.attrValues",tagClass:D.Class.UNIVERSAL,type:D.Type.SET,constructed:!0,capture:"values"}]},kV={name:"CertBag",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"CertBag.certId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"certId"},{name:"CertBag.certValue",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,value:[{name:"CertBag.certValue[0]",tagClass:D.Class.UNIVERSAL,type:D.Class.OCTETSTRING,constructed:!1,capture:"cert"}]}]};function BX($,J,X,Q){var Y=[];for(var G=0;G<$.length;G++)for(var W=0;W<$[G].safeBags.length;W++){var U=$[G].safeBags[W];if(Q!==void 0&&U.type!==Q)continue;if(J===null){Y.push(U);continue}if(U.attributes[J]!==void 0&&U.attributes[J].indexOf(X)>=0)Y.push(U)}return Y}jX.pkcs12FromAsn1=function($,J,X){if(typeof J==="string")X=J,J=!0;else if(J===void 0)J=!0;var Q={},Y=[];if(!D.validate($,_V,Q,Y)){var G=Error("Cannot read PKCS#12 PFX. ASN.1 object is not an PKCS#12 PFX.");throw G.errors=G,G}var W={version:Q.version.charCodeAt(0),safeContents:[],getBags:function(L){var R={},I;if("localKeyId"in L)I=L.localKeyId;else if("localKeyIdHex"in L)I=l$.util.hexToBytes(L.localKeyIdHex);if(I===void 0&&!("friendlyName"in L)&&"bagType"in L)R[L.bagType]=BX(W.safeContents,null,null,L.bagType);if(I!==void 0)R.localKeyId=BX(W.safeContents,"localKeyId",I,L.bagType);if("friendlyName"in L)R.friendlyName=BX(W.safeContents,"friendlyName",L.friendlyName,L.bagType);return R},getBagsByFriendlyName:function(L,R){return BX(W.safeContents,"friendlyName",L,R)},getBagsByLocalKeyId:function(L,R){return BX(W.safeContents,"localKeyId",L,R)}};if(Q.version.charCodeAt(0)!==3){var G=Error("PKCS#12 PFX of version other than 3 not supported.");throw G.version=Q.version.charCodeAt(0),G}if(D.derToOid(Q.contentType)!==D$.oids.data){var G=Error("Only PKCS#12 PFX in password integrity mode supported.");throw G.oid=D.derToOid(Q.contentType),G}var U=Q.content.value[0];if(U.tagClass!==D.Class.UNIVERSAL||U.type!==D.Type.OCTETSTRING)throw Error("PKCS#12 authSafe content data is not an OCTET STRING.");if(U=D8(U),Q.mac){var M=null,O=0,V=D.derToOid(Q.macAlgorithm);switch(V){case D$.oids.sha1:M=l$.md.sha1.create(),O=20;break;case D$.oids.sha256:M=l$.md.sha256.create(),O=32;break;case D$.oids.sha384:M=l$.md.sha384.create(),O=48;break;case D$.oids.sha512:M=l$.md.sha512.create(),O=64;break;case D$.oids.md5:M=l$.md.md5.create(),O=16;break}if(M===null)throw Error("PKCS#12 uses unsupported MAC algorithm: "+V);var H=new l$.util.ByteBuffer(Q.macSalt),q="macIterations"in Q?parseInt(l$.util.bytesToHex(Q.macIterations),16):1,F=jX.generateKey(X,H,3,q,O,M),K=l$.hmac.create();K.start(M,F),K.update(U.value);var A=K.getMac();if(A.getBytes()!==Q.macDigest)throw Error("PKCS#12 MAC could not be verified. Invalid password?")}else if(Array.isArray($.value)&&$.value.length>2)throw Error("Invalid PKCS#12. macData field present but MAC was not validated.");return fV(W,U.value,J,X),W};function D8($){if($.composed||$.constructed){var J=l$.util.createBuffer();for(var X=0;X<$.value.length;++X)J.putBytes($.value[X].value);$.composed=$.constructed=!1,$.value=J.getBytes()}return $}function fV($,J,X,Q){if(J=D.fromDer(J,X),J.tagClass!==D.Class.UNIVERSAL||J.type!==D.Type.SEQUENCE||J.constructed!==!0)throw Error("PKCS#12 AuthenticatedSafe expected to be a SEQUENCE OF ContentInfo");for(var Y=0;Y<J.value.length;Y++){var G=J.value[Y],W={},U=[];if(!D.validate(G,y1,W,U)){var M=Error("Cannot read ContentInfo.");throw M.errors=U,M}var O={encrypted:!1},V=null,H=W.content.value[0];switch(D.derToOid(W.contentType)){case D$.oids.data:if(H.tagClass!==D.Class.UNIVERSAL||H.type!==D.Type.OCTETSTRING)throw Error("PKCS#12 SafeContents Data is not an OCTET STRING.");V=D8(H).value;break;case D$.oids.encryptedData:V=yV(H,Q),O.encrypted=!0;break;default:var M=Error("Unsupported PKCS#12 contentType.");throw M.contentType=D.derToOid(W.contentType),M}O.safeBags=bV(V,X,Q),$.safeContents.push(O)}}function yV($,J){var X={},Q=[];if(!D.validate($,l$.pkcs7.asn1.encryptedDataValidator,X,Q)){var Y=Error("Cannot read EncryptedContentInfo.");throw Y.errors=Q,Y}var G=D.derToOid(X.contentType);if(G!==D$.oids.data){var Y=Error("PKCS#12 EncryptedContentInfo ContentType is not Data.");throw Y.oid=G,Y}G=D.derToOid(X.encAlgorithm);var W=D$.pbe.getCipher(G,X.encParameter,J),U=D8(X.encryptedContentAsn1),M=l$.util.createBuffer(U.value);if(W.update(M),!W.finish())throw Error("Failed to decrypt PKCS#12 SafeContents.");return W.output.getBytes()}function bV($,J,X){if(!J&&$.length===0)return[];if($=D.fromDer($,J),$.tagClass!==D.Class.UNIVERSAL||$.type!==D.Type.SEQUENCE||$.constructed!==!0)throw Error("PKCS#12 SafeContents expected to be a SEQUENCE OF SafeBag.");var Q=[];for(var Y=0;Y<$.value.length;Y++){var G=$.value[Y],W={},U=[];if(!D.validate(G,xV,W,U)){var M=Error("Cannot read SafeBag.");throw M.errors=U,M}var O={type:D.derToOid(W.bagId),attributes:hV(W.bagAttributes)};Q.push(O);var V,H,q=W.bagValue.value[0];switch(O.type){case D$.oids.pkcs8ShroudedKeyBag:if(q=D$.decryptPrivateKeyInfo(q,X),q===null)throw Error("Unable to decrypt PKCS#8 ShroudedKeyBag, wrong password?");case D$.oids.keyBag:try{O.key=D$.privateKeyFromAsn1(q)}catch(K){O.key=null,O.asn1=q}continue;case D$.oids.certBag:V=kV,H=function(){if(D.derToOid(W.certId)!==D$.oids.x509Certificate){var K=Error("Unsupported certificate type, only X.509 supported.");throw K.oid=D.derToOid(W.certId),K}var A=D.fromDer(W.cert,J);try{O.cert=D$.certificateFromAsn1(A,!0)}catch(L){O.cert=null,O.asn1=A}};break;default:var M=Error("Unsupported PKCS#12 SafeBag type.");throw M.oid=O.type,M}if(V!==void 0&&!D.validate(q,V,W,U)){var M=Error("Cannot read PKCS#12 "+V.name);throw M.errors=U,M}H()}return Q}function hV($){var J={};if($!==void 0)for(var X=0;X<$.length;++X){var Q={},Y=[];if(!D.validate($[X],vV,Q,Y)){var G=Error("Cannot read PKCS#12 BagAttribute.");throw G.errors=Y,G}var W=D.derToOid(Q.oid);if(D$.oids[W]===void 0)continue;J[D$.oids[W]]=[];for(var U=0;U<Q.values.length;++U)J[D$.oids[W]].push(Q.values[U].value)}return J}jX.toPkcs12Asn1=function($,J,X,Q){if(Q=Q||{},Q.saltSize=Q.saltSize||8,Q.count=Q.count||2048,Q.algorithm=Q.algorithm||Q.encAlgorithm||"aes128",!("useMac"in Q))Q.useMac=!0;if(!("localKeyId"in Q))Q.localKeyId=null;if(!("generateLocalKeyId"in Q))Q.generateLocalKeyId=!0;var Y=Q.localKeyId,G;if(Y!==null)Y=l$.util.hexToBytes(Y);else if(Q.generateLocalKeyId)if(J){var W=l$.util.isArray(J)?J[0]:J;if(typeof W==="string")W=D$.certificateFromPem(W);var U=l$.md.sha1.create();U.update(D.toDer(D$.certificateToAsn1(W)).getBytes()),Y=U.digest().getBytes()}else Y=l$.random.getBytes(20);var M=[];if(Y!==null)M.push(D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.localKeyId).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SET,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,Y)])]));if("friendlyName"in Q)M.push(D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.friendlyName).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SET,!0,[D.create(D.Class.UNIVERSAL,D.Type.BMPSTRING,!1,Q.friendlyName)])]));if(M.length>0)G=D.create(D.Class.UNIVERSAL,D.Type.SET,!0,M);var O=[],V=[];if(J!==null)if(l$.util.isArray(J))V=J;else V=[J];var H=[];for(var q=0;q<V.length;++q){if(J=V[q],typeof J==="string")J=D$.certificateFromPem(J);var F=q===0?G:void 0,K=D$.certificateToAsn1(J),A=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.certBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.x509Certificate).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(K).getBytes())])])]),F]);H.push(A)}if(H.length>0){var L=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,H),R=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(L).getBytes())])]);O.push(R)}var I=null;if($!==null){var j=D$.wrapRsaPrivateKey(D$.privateKeyToAsn1($));if(X===null)I=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.keyBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[j]),G]);else I=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.pkcs8ShroudedKeyBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D$.encryptPrivateKeyInfo(j,X,Q)]),G]);var C=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[I]),w=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(C).getBytes())])]);O.push(w)}var P=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,O),l;if(Q.useMac){var U=l$.md.sha1.create(),e=new l$.util.ByteBuffer(l$.random.getBytes(Q.saltSize)),y=Q.count,$=jX.generateKey(X,e,3,y,20),n=l$.hmac.create();n.start(U,$),n.update(D.toDer(P).getBytes());var Y$=n.getMac();l=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.sha1).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.NULL,!1,"")]),D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,Y$.getBytes())]),D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,e.getBytes()),D.create(D.Class.UNIVERSAL,D.Type.INTEGER,!1,D.integerToDer(y).getBytes())])}return D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.INTEGER,!1,D.integerToDer(3).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(P).getBytes())])]),l])};jX.generateKey=l$.pbe.generatePkcs12Key});var j8=H$((PF,h1)=>{var k0=F$();mJ();P0();N8();JQ();IY();Z8();kY();ZX();_$();bY();var B8=k0.asn1,vQ=h1.exports=k0.pki=k0.pki||{};vQ.pemToDer=function($){var J=k0.pem.decode($)[0];if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PEM to DER; PEM is encrypted.");return k0.util.createBuffer(J.body)};vQ.privateKeyFromPem=function($){var J=k0.pem.decode($)[0];if(J.type!=="PRIVATE KEY"&&J.type!=="RSA PRIVATE KEY"){var X=Error('Could not convert private key from PEM; PEM header type is not "PRIVATE KEY" or "RSA PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert private key from PEM; PEM is encrypted.");var Q=B8.fromDer(J.body);return vQ.privateKeyFromAsn1(Q)};vQ.privateKeyToPem=function($,J){var X={type:"RSA PRIVATE KEY",body:B8.toDer(vQ.privateKeyToAsn1($)).getBytes()};return k0.pem.encode(X,{maxline:J})};vQ.privateKeyInfoToPem=function($,J){var X={type:"PRIVATE KEY",body:B8.toDer($).getBytes()};return k0.pem.encode(X,{maxline:J})}});var P8=H$((_F,n1)=>{var k=F$();mJ();TQ();BY();JQ();j8();_J();wQ();_$();var gY=function($,J,X,Q){var Y=k.util.createBuffer(),G=$.length>>1,W=G+($.length&1),U=$.substr(0,W),M=$.substr(G,W),O=k.util.createBuffer(),V=k.hmac.create();X=J+X;var H=Math.ceil(Q/16),q=Math.ceil(Q/20);V.start("MD5",U);var F=k.util.createBuffer();O.putBytes(X);for(var K=0;K<H;++K)V.start(null,null),V.update(O.getBytes()),O.putBuffer(V.digest()),V.start(null,null),V.update(O.bytes()+X),F.putBuffer(V.digest());V.start("SHA1",M);var A=k.util.createBuffer();O.clear(),O.putBytes(X);for(var K=0;K<q;++K)V.start(null,null),V.update(O.getBytes()),O.putBuffer(V.digest()),V.start(null,null),V.update(O.bytes()+X),A.putBuffer(V.digest());return Y.putBytes(k.util.xorBytes(F.getBytes(),A.getBytes(),Q)),Y},uV=function($,J,X){var Q=k.hmac.create();Q.start("SHA1",$);var Y=k.util.createBuffer();return Y.putInt32(J[0]),Y.putInt32(J[1]),Y.putByte(X.type),Y.putByte(X.version.major),Y.putByte(X.version.minor),Y.putInt16(X.length),Y.putBytes(X.fragment.bytes()),Q.update(Y.getBytes()),Q.digest().getBytes()},gV=function($,J,X){var Q=!1;try{var Y=$.deflate(J.fragment.getBytes());J.fragment=k.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},mV=function($,J,X){var Q=!1;try{var Y=$.inflate(J.fragment.getBytes());J.fragment=k.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},SJ=function($,J){var X=0;switch(J){case 1:X=$.getByte();break;case 2:X=$.getInt16();break;case 3:X=$.getInt24();break;case 4:X=$.getInt32();break}return k.util.createBuffer($.getBytes(X))},fJ=function($,J,X){$.putInt(X.length(),J<<3),$.putBuffer(X)},N={};N.Versions={TLS_1_0:{major:3,minor:1},TLS_1_1:{major:3,minor:2},TLS_1_2:{major:3,minor:3}};N.SupportedVersions=[N.Versions.TLS_1_1,N.Versions.TLS_1_0];N.Version=N.SupportedVersions[0];N.MaxFragment=15360;N.ConnectionEnd={server:0,client:1};N.PRFAlgorithm={tls_prf_sha256:0};N.BulkCipherAlgorithm={none:null,rc4:0,des3:1,aes:2};N.CipherType={stream:0,block:1,aead:2};N.MACAlgorithm={none:null,hmac_md5:0,hmac_sha1:1,hmac_sha256:2,hmac_sha384:3,hmac_sha512:4};N.CompressionMethod={none:0,deflate:1};N.ContentType={change_cipher_spec:20,alert:21,handshake:22,application_data:23,heartbeat:24};N.HandshakeType={hello_request:0,client_hello:1,server_hello:2,certificate:11,server_key_exchange:12,certificate_request:13,server_hello_done:14,certificate_verify:15,client_key_exchange:16,finished:20};N.Alert={};N.Alert.Level={warning:1,fatal:2};N.Alert.Description={close_notify:0,unexpected_message:10,bad_record_mac:20,decryption_failed:21,record_overflow:22,decompression_failure:30,handshake_failure:40,bad_certificate:42,unsupported_certificate:43,certificate_revoked:44,certificate_expired:45,certificate_unknown:46,illegal_parameter:47,unknown_ca:48,access_denied:49,decode_error:50,decrypt_error:51,export_restriction:60,protocol_version:70,insufficient_security:71,internal_error:80,user_canceled:90,no_renegotiation:100};N.HeartbeatMessageType={heartbeat_request:1,heartbeat_response:2};N.CipherSuites={};N.getCipherSuite=function($){var J=null;for(var X in N.CipherSuites){var Q=N.CipherSuites[X];if(Q.id[0]===$.charCodeAt(0)&&Q.id[1]===$.charCodeAt(1)){J=Q;break}}return J};N.handleUnexpected=function($,J){var X=!$.open&&$.entity===N.ConnectionEnd.client;if(!X)$.error($,{message:"Unexpected message. Received TLS record out of order.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unexpected_message}})};N.handleHelloRequest=function($,J,X){if(!$.handshaking&&$.handshakes>0)N.queue($,N.createAlert($,{level:N.Alert.Level.warning,description:N.Alert.Description.no_renegotiation})),N.flush($);$.process()};N.parseHelloMessage=function($,J,X){var Q=null,Y=$.entity===N.ConnectionEnd.client;if(X<38)$.error($,{message:Y?"Invalid ServerHello message. Message too short.":"Invalid ClientHello message. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});else{var G=J.fragment,W=G.length();if(Q={version:{major:G.getByte(),minor:G.getByte()},random:k.util.createBuffer(G.getBytes(32)),session_id:SJ(G,1),extensions:[]},Y)Q.cipher_suite=G.getBytes(2),Q.compression_method=G.getByte();else Q.cipher_suites=SJ(G,2),Q.compression_methods=SJ(G,1);if(W=X-(W-G.length()),W>0){var U=SJ(G,2);while(U.length()>0)Q.extensions.push({type:[U.getByte(),U.getByte()],data:SJ(U,2)});if(!Y)for(var M=0;M<Q.extensions.length;++M){var O=Q.extensions[M];if(O.type[0]===0&&O.type[1]===0){var V=SJ(O.data,2);while(V.length()>0){var H=V.getByte();if(H!==0)break;$.session.extensions.server_name.serverNameList.push(SJ(V,2).getBytes())}}}}if($.session.version){if(Q.version.major!==$.session.version.major||Q.version.minor!==$.session.version.minor)return $.error($,{message:"TLS version change is disallowed during renegotiation.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}})}if(Y)$.session.cipherSuite=N.getCipherSuite(Q.cipher_suite);else{var q=k.util.createBuffer(Q.cipher_suites.bytes());while(q.length()>0)if($.session.cipherSuite=N.getCipherSuite(q.getBytes(2)),$.session.cipherSuite!==null)break}if($.session.cipherSuite===null)return $.error($,{message:"No cipher suites in common.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.handshake_failure},cipherSuite:k.util.bytesToHex(Q.cipher_suite)});if(Y)$.session.compressionMethod=Q.compression_method;else $.session.compressionMethod=N.CompressionMethod.none}return Q};N.createSecurityParameters=function($,J){var X=$.entity===N.ConnectionEnd.client,Q=J.random.bytes(),Y=X?$.session.sp.client_random:Q,G=X?Q:N.createRandom().getBytes();$.session.sp={entity:$.entity,prf_algorithm:N.PRFAlgorithm.tls_prf_sha256,bulk_cipher_algorithm:null,cipher_type:null,enc_key_length:null,block_length:null,fixed_iv_length:null,record_iv_length:null,mac_algorithm:null,mac_length:null,mac_key_length:null,compression_algorithm:$.session.compressionMethod,pre_master_secret:null,master_secret:null,client_random:Y,server_random:G}};N.handleServerHello=function($,J,X){var Q=N.parseHelloMessage($,J,X);if($.fail)return;if(Q.version.minor<=$.version.minor)$.version.minor=Q.version.minor;else return $.error($,{message:"Incompatible TLS version.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}});$.session.version=$.version;var Y=Q.session_id.bytes();if(Y.length>0&&Y===$.session.id)$.expect=m1,$.session.resuming=!0,$.session.sp.server_random=Q.random.bytes();else $.expect=pV,$.session.resuming=!1,N.createSecurityParameters($,Q);$.session.id=Y,$.process()};N.handleClientHello=function($,J,X){var Q=N.parseHelloMessage($,J,X);if($.fail)return;var Y=Q.session_id.bytes(),G=null;if($.sessionCache){if(G=$.sessionCache.getSession(Y),G===null)Y="";else if(G.version.major!==Q.version.major||G.version.minor>Q.version.minor)G=null,Y=""}if(Y.length===0)Y=k.random.getBytes(32);if($.session.id=Y,$.session.clientHelloVersion=Q.version,$.session.sp={},G)$.version=$.session.version=G.version,$.session.sp=G.sp;else{var W;for(var U=1;U<N.SupportedVersions.length;++U)if(W=N.SupportedVersions[U],W.minor<=Q.version.minor)break;$.version={major:W.major,minor:W.minor},$.session.version=$.version}if(G!==null)$.expect=C8,$.session.resuming=!0,$.session.sp.client_random=Q.random.bytes();else $.expect=$.verifyClient!==!1?sV:I8,$.session.resuming=!1,N.createSecurityParameters($,Q);if($.open=!0,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerHello($)})),$.session.resuming)N.queue($,N.createRecord($,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),$.state.pending=N.createConnectionState($),$.state.current.write=$.state.pending.write,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createFinished($)}));else if(N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificate($)})),!$.fail){if(N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerKeyExchange($)})),$.verifyClient!==!1)N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificateRequest($)}));N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerHelloDone($)}))}N.flush($),$.process()};N.handleCertificate=function($,J,X){if(X<3)return $.error($,{message:"Invalid Certificate message. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_list:SJ(Q,3)},G,W,U=[];try{while(Y.certificate_list.length()>0)G=SJ(Y.certificate_list,3),W=k.asn1.fromDer(G),G=k.pki.certificateFromAsn1(W,!0),U.push(G)}catch(O){return $.error($,{message:"Could not parse certificate list.",cause:O,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate}})}var M=$.entity===N.ConnectionEnd.client;if((M||$.verifyClient===!0)&&U.length===0)$.error($,{message:M?"No server certificate provided.":"No client certificate provided.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});else if(U.length===0)$.expect=M?u1:I8;else{if(M)$.session.serverCertificate=U[0];else $.session.clientCertificate=U[0];if(N.verifyCertificateChain($,U))$.expect=M?u1:I8}$.process()};N.handleServerKeyExchange=function($,J,X){if(X>0)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unsupported_certificate}});$.expect=dV,$.process()};N.handleClientKeyExchange=function($,J,X){if(X<48)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unsupported_certificate}});var Q=J.fragment,Y={enc_pre_master_secret:SJ(Q,2).getBytes()},G=null;if($.getPrivateKey)try{G=$.getPrivateKey($,$.session.serverCertificate),G=k.pki.privateKeyFromPem(G)}catch(M){$.error($,{message:"Could not get private key.",cause:M,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}})}if(G===null)return $.error($,{message:"No private key set.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});try{var W=$.session.sp;W.pre_master_secret=G.decrypt(Y.enc_pre_master_secret);var U=$.session.clientHelloVersion;if(U.major!==W.pre_master_secret.charCodeAt(0)||U.minor!==W.pre_master_secret.charCodeAt(1))throw Error("TLS version rollback attack detected.")}catch(M){W.pre_master_secret=k.random.getBytes(48)}if($.expect=C8,$.session.clientCertificate!==null)$.expect=rV;$.process()};N.handleCertificateRequest=function($,J,X){if(X<3)return $.error($,{message:"Invalid CertificateRequest. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_types:SJ(Q,1),certificate_authorities:SJ(Q,2)};$.session.certificateRequest=Y,$.expect=cV,$.process()};N.handleCertificateVerify=function($,J,X){if(X<2)return $.error($,{message:"Invalid CertificateVerify. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G={signature:SJ(Q,2).getBytes()},W=k.util.createBuffer();W.putBuffer($.session.md5.digest()),W.putBuffer($.session.sha1.digest()),W=W.getBytes();try{var U=$.session.clientCertificate;if(!U.publicKey.verify(W,G.signature,"NONE"))throw Error("CertificateVerify signature does not match.");$.session.md5.update(Y),$.session.sha1.update(Y)}catch(M){return $.error($,{message:"Bad signature in CertificateVerify.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.handshake_failure}})}$.expect=C8,$.process()};N.handleServerHelloDone=function($,J,X){if(X>0)return $.error($,{message:"Invalid ServerHelloDone message. Invalid length.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.record_overflow}});if($.serverCertificate===null){var Q={message:"No server certificate provided. Not enough security.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.insufficient_security}},Y=0,G=$.verify($,Q.alert.description,Y,[]);if(G!==!0){if(G||G===0){if(typeof G==="object"&&!k.util.isArray(G)){if(G.message)Q.message=G.message;if(G.alert)Q.alert.description=G.alert}else if(typeof G==="number")Q.alert.description=G}return $.error($,Q)}}if($.session.certificateRequest!==null)J=N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificate($)}),N.queue($,J);J=N.createRecord($,{type:N.ContentType.handshake,data:N.createClientKeyExchange($)}),N.queue($,J),$.expect=oV;var W=function(U,M){if(U.session.certificateRequest!==null&&U.session.clientCertificate!==null)N.queue(U,N.createRecord(U,{type:N.ContentType.handshake,data:N.createCertificateVerify(U,M)}));N.queue(U,N.createRecord(U,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),U.state.pending=N.createConnectionState(U),U.state.current.write=U.state.pending.write,N.queue(U,N.createRecord(U,{type:N.ContentType.handshake,data:N.createFinished(U)})),U.expect=m1,N.flush(U),U.process()};if($.session.certificateRequest===null||$.session.clientCertificate===null)return W($,null);N.getClientSignature($,W)};N.handleChangeCipherSpec=function($,J){if(J.fragment.getByte()!==1)return $.error($,{message:"Invalid ChangeCipherSpec message received.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var X=$.entity===N.ConnectionEnd.client;if($.session.resuming&&X||!$.session.resuming&&!X)$.state.pending=N.createConnectionState($);if($.state.current.read=$.state.pending.read,!$.session.resuming&&X||$.session.resuming&&!X)$.state.pending=null;$.expect=X?nV:tV,$.process()};N.handleFinished=function($,J,X){var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G=J.fragment.getBytes();Q=k.util.createBuffer(),Q.putBuffer($.session.md5.digest()),Q.putBuffer($.session.sha1.digest());var W=$.entity===N.ConnectionEnd.client,U=W?"server finished":"client finished",M=$.session.sp,O=12,V=gY;if(Q=V(M.master_secret,U,Q.getBytes(),O),Q.getBytes()!==G)return $.error($,{message:"Invalid verify_data in Finished message.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.decrypt_error}});if($.session.md5.update(Y),$.session.sha1.update(Y),$.session.resuming&&W||!$.session.resuming&&!W)N.queue($,N.createRecord($,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),$.state.current.write=$.state.pending.write,$.state.pending=null,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createFinished($)}));$.expect=W?iV:eV,$.handshaking=!1,++$.handshakes,$.peerCertificate=W?$.session.serverCertificate:$.session.clientCertificate,N.flush($),$.isConnected=!0,$.connected($),$.process()};N.handleAlert=function($,J){var X=J.fragment,Q={level:X.getByte(),description:X.getByte()},Y;switch(Q.description){case N.Alert.Description.close_notify:Y="Connection closed.";break;case N.Alert.Description.unexpected_message:Y="Unexpected message.";break;case N.Alert.Description.bad_record_mac:Y="Bad record MAC.";break;case N.Alert.Description.decryption_failed:Y="Decryption failed.";break;case N.Alert.Description.record_overflow:Y="Record overflow.";break;case N.Alert.Description.decompression_failure:Y="Decompression failed.";break;case N.Alert.Description.handshake_failure:Y="Handshake failure.";break;case N.Alert.Description.bad_certificate:Y="Bad certificate.";break;case N.Alert.Description.unsupported_certificate:Y="Unsupported certificate.";break;case N.Alert.Description.certificate_revoked:Y="Certificate revoked.";break;case N.Alert.Description.certificate_expired:Y="Certificate expired.";break;case N.Alert.Description.certificate_unknown:Y="Certificate unknown.";break;case N.Alert.Description.illegal_parameter:Y="Illegal parameter.";break;case N.Alert.Description.unknown_ca:Y="Unknown certificate authority.";break;case N.Alert.Description.access_denied:Y="Access denied.";break;case N.Alert.Description.decode_error:Y="Decode error.";break;case N.Alert.Description.decrypt_error:Y="Decrypt error.";break;case N.Alert.Description.export_restriction:Y="Export restriction.";break;case N.Alert.Description.protocol_version:Y="Unsupported protocol version.";break;case N.Alert.Description.insufficient_security:Y="Insufficient security.";break;case N.Alert.Description.internal_error:Y="Internal error.";break;case N.Alert.Description.user_canceled:Y="User canceled.";break;case N.Alert.Description.no_renegotiation:Y="Renegotiation not supported.";break;default:Y="Unknown error.";break}if(Q.description===N.Alert.Description.close_notify)return $.close();$.error($,{message:Y,send:!1,origin:$.entity===N.ConnectionEnd.client?"server":"client",alert:Q}),$.process()};N.handleHandshake=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt24();if(Y>X.length())return $.fragmented=J,J.fragment=k.util.createBuffer(),X.read-=4,$.process();$.fragmented=null,X.read-=4;var G=X.bytes(Y+4);if(X.read+=4,Q in uY[$.entity][$.expect]){if($.entity===N.ConnectionEnd.server&&!$.open&&!$.fail)$.handshaking=!0,$.session={version:null,extensions:{server_name:{serverNameList:[]}},cipherSuite:null,compressionMethod:null,serverCertificate:null,clientCertificate:null,md5:k.md.md5.create(),sha1:k.md.sha1.create()};if(Q!==N.HandshakeType.hello_request&&Q!==N.HandshakeType.certificate_verify&&Q!==N.HandshakeType.finished)$.session.md5.update(G),$.session.sha1.update(G);uY[$.entity][$.expect][Q]($,J,Y)}else N.handleUnexpected($,J)};N.handleApplicationData=function($,J){$.data.putBuffer(J.fragment),$.dataReady($),$.process()};N.handleHeartbeat=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt16(),G=X.getBytes(Y);if(Q===N.HeartbeatMessageType.heartbeat_request){if($.handshaking||Y>G.length)return $.process();N.queue($,N.createRecord($,{type:N.ContentType.heartbeat,data:N.createHeartbeat(N.HeartbeatMessageType.heartbeat_response,G)})),N.flush($)}else if(Q===N.HeartbeatMessageType.heartbeat_response){if(G!==$.expectedHeartbeatPayload)return $.process();if($.heartbeatReceived)$.heartbeatReceived($,k.util.createBuffer(G))}$.process()};var lV=0,pV=1,u1=2,dV=3,cV=4,m1=5,nV=6,iV=7,oV=8,aV=0,sV=1,I8=2,rV=3,C8=4,tV=5,eV=6,E=N.handleUnexpected,l1=N.handleChangeCipherSpec,qJ=N.handleAlert,RJ=N.handleHandshake,p1=N.handleApplicationData,KJ=N.handleHeartbeat,w8=[];w8[N.ConnectionEnd.client]=[[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[l1,qJ,E,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,p1,KJ],[E,qJ,RJ,E,KJ]];w8[N.ConnectionEnd.server]=[[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[l1,qJ,E,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,p1,KJ],[E,qJ,RJ,E,KJ]];var{handleHelloRequest:f0,handleServerHello:$H,handleCertificate:d1,handleServerKeyExchange:g1,handleCertificateRequest:T8,handleServerHelloDone:hY,handleFinished:c1}=N,uY=[];uY[N.ConnectionEnd.client]=[[E,E,$H,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,d1,g1,T8,hY,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,g1,T8,hY,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,T8,hY,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,hY,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,c1],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[f0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E]];var{handleClientHello:JH,handleClientKeyExchange:QH,handleCertificateVerify:XH}=N;uY[N.ConnectionEnd.server]=[[E,JH,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,d1,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,QH,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,XH,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,c1],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E]];N.generateKeys=function($,J){var X=gY,Q=J.client_random+J.server_random;if(!$.session.resuming)J.master_secret=X(J.pre_master_secret,"master secret",Q,48).bytes(),J.pre_master_secret=null;Q=J.server_random+J.client_random;var Y=2*J.mac_key_length+2*J.enc_key_length,G=$.version.major===N.Versions.TLS_1_0.major&&$.version.minor===N.Versions.TLS_1_0.minor;if(G)Y+=2*J.fixed_iv_length;var W=X(J.master_secret,"key expansion",Q,Y),U={client_write_MAC_key:W.getBytes(J.mac_key_length),server_write_MAC_key:W.getBytes(J.mac_key_length),client_write_key:W.getBytes(J.enc_key_length),server_write_key:W.getBytes(J.enc_key_length)};if(G)U.client_write_IV=W.getBytes(J.fixed_iv_length),U.server_write_IV=W.getBytes(J.fixed_iv_length);return U};N.createConnectionState=function($){var J=$.entity===N.ConnectionEnd.client,X=function(){var G={sequenceNumber:[0,0],macKey:null,macLength:0,macFunction:null,cipherState:null,cipherFunction:function(W){return!0},compressionState:null,compressFunction:function(W){return!0},updateSequenceNumber:function(){if(G.sequenceNumber[1]===4294967295)G.sequenceNumber[1]=0,++G.sequenceNumber[0];else++G.sequenceNumber[1]}};return G},Q={read:X(),write:X()};if(Q.read.update=function(G,W){if(!Q.read.cipherFunction(W,Q.read))G.error(G,{message:"Could not decrypt record or bad MAC.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_record_mac}});else if(!Q.read.compressFunction(G,W,Q.read))G.error(G,{message:"Could not decompress record.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.decompression_failure}});return!G.fail},Q.write.update=function(G,W){if(!Q.write.compressFunction(G,W,Q.write))G.error(G,{message:"Could not compress record.",send:!1,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});else if(!Q.write.cipherFunction(W,Q.write))G.error(G,{message:"Could not encrypt record.",send:!1,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});return!G.fail},$.session){var Y=$.session.sp;switch($.session.cipherSuite.initSecurityParameters(Y),Y.keys=N.generateKeys($,Y),Q.read.macKey=J?Y.keys.server_write_MAC_key:Y.keys.client_write_MAC_key,Q.write.macKey=J?Y.keys.client_write_MAC_key:Y.keys.server_write_MAC_key,$.session.cipherSuite.initConnectionState(Q,$,Y),Y.compression_algorithm){case N.CompressionMethod.none:break;case N.CompressionMethod.deflate:Q.read.compressFunction=mV,Q.write.compressFunction=gV;break;default:throw Error("Unsupported compression algorithm.")}}return Q};N.createRandom=function(){var $=new Date,J=+$+$.getTimezoneOffset()*60000,X=k.util.createBuffer();return X.putInt32(J),X.putBytes(k.random.getBytes(28)),X};N.createRecord=function($,J){if(!J.data)return null;var X={type:J.type,version:{major:$.version.major,minor:$.version.minor},length:J.data.length(),fragment:J.data};return X};N.createAlert=function($,J){var X=k.util.createBuffer();return X.putByte(J.level),X.putByte(J.description),N.createRecord($,{type:N.ContentType.alert,data:X})};N.createClientHello=function($){$.session.clientHelloVersion={major:$.version.major,minor:$.version.minor};var J=k.util.createBuffer();for(var X=0;X<$.cipherSuites.length;++X){var Q=$.cipherSuites[X];J.putByte(Q.id[0]),J.putByte(Q.id[1])}var Y=J.length(),G=k.util.createBuffer();G.putByte(N.CompressionMethod.none);var W=G.length(),U=k.util.createBuffer();if($.virtualHost){var M=k.util.createBuffer();M.putByte(0),M.putByte(0);var O=k.util.createBuffer();O.putByte(0),fJ(O,2,k.util.createBuffer($.virtualHost));var V=k.util.createBuffer();fJ(V,2,O),fJ(M,2,V),U.putBuffer(M)}var H=U.length();if(H>0)H+=2;var q=$.session.id,F=q.length+1+2+4+28+2+Y+1+W+H,K=k.util.createBuffer();if(K.putByte(N.HandshakeType.client_hello),K.putInt24(F),K.putByte($.version.major),K.putByte($.version.minor),K.putBytes($.session.sp.client_random),fJ(K,1,k.util.createBuffer(q)),fJ(K,2,J),fJ(K,1,G),H>0)fJ(K,2,U);return K};N.createServerHello=function($){var J=$.session.id,X=J.length+1+2+4+28+2+1,Q=k.util.createBuffer();return Q.putByte(N.HandshakeType.server_hello),Q.putInt24(X),Q.putByte($.version.major),Q.putByte($.version.minor),Q.putBytes($.session.sp.server_random),fJ(Q,1,k.util.createBuffer(J)),Q.putByte($.session.cipherSuite.id[0]),Q.putByte($.session.cipherSuite.id[1]),Q.putByte($.session.compressionMethod),Q};N.createCertificate=function($){var J=$.entity===N.ConnectionEnd.client,X=null;if($.getCertificate){var Q;if(J)Q=$.session.certificateRequest;else Q=$.session.extensions.server_name.serverNameList;X=$.getCertificate($,Q)}var Y=k.util.createBuffer();if(X!==null)try{if(!k.util.isArray(X))X=[X];var G=null;for(var W=0;W<X.length;++W){var U=k.pem.decode(X[W])[0];if(U.type!=="CERTIFICATE"&&U.type!=="X509 CERTIFICATE"&&U.type!=="TRUSTED CERTIFICATE"){var M=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw M.headerType=U.type,M}if(U.procType&&U.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var O=k.util.createBuffer(U.body);if(G===null)G=k.asn1.fromDer(O.bytes(),!1);var V=k.util.createBuffer();fJ(V,3,O),Y.putBuffer(V)}if(X=k.pki.certificateFromAsn1(G),J)$.session.clientCertificate=X;else $.session.serverCertificate=X}catch(F){return $.error($,{message:"Could not send certificate list.",cause:F,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate}})}var H=3+Y.length(),q=k.util.createBuffer();return q.putByte(N.HandshakeType.certificate),q.putInt24(H),fJ(q,3,Y),q};N.createClientKeyExchange=function($){var J=k.util.createBuffer();J.putByte($.session.clientHelloVersion.major),J.putByte($.session.clientHelloVersion.minor),J.putBytes(k.random.getBytes(46));var X=$.session.sp;X.pre_master_secret=J.getBytes();var Q=$.session.serverCertificate.publicKey;J=Q.encrypt(X.pre_master_secret);var Y=J.length+2,G=k.util.createBuffer();return G.putByte(N.HandshakeType.client_key_exchange),G.putInt24(Y),G.putInt16(J.length),G.putBytes(J),G};N.createServerKeyExchange=function($){var J=0,X=k.util.createBuffer();if(J>0)X.putByte(N.HandshakeType.server_key_exchange),X.putInt24(J);return X};N.getClientSignature=function($,J){var X=k.util.createBuffer();X.putBuffer($.session.md5.digest()),X.putBuffer($.session.sha1.digest()),X=X.getBytes(),$.getSignature=$.getSignature||function(Q,Y,G){var W=null;if(Q.getPrivateKey)try{W=Q.getPrivateKey(Q,Q.session.clientCertificate),W=k.pki.privateKeyFromPem(W)}catch(U){Q.error(Q,{message:"Could not get private key.",cause:U,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}})}if(W===null)Q.error(Q,{message:"No private key set.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});else Y=W.sign(Y,null);G(Q,Y)},$.getSignature($,X,J)};N.createCertificateVerify=function($,J){var X=J.length+2,Q=k.util.createBuffer();return Q.putByte(N.HandshakeType.certificate_verify),Q.putInt24(X),Q.putInt16(J.length),Q.putBytes(J),Q};N.createCertificateRequest=function($){var J=k.util.createBuffer();J.putByte(1);var X=k.util.createBuffer();for(var Q in $.caStore.certs){var Y=$.caStore.certs[Q],G=k.pki.distinguishedNameToAsn1(Y.subject),W=k.asn1.toDer(G);X.putInt16(W.length()),X.putBuffer(W)}var U=1+J.length()+2+X.length(),M=k.util.createBuffer();return M.putByte(N.HandshakeType.certificate_request),M.putInt24(U),fJ(M,1,J),fJ(M,2,X),M};N.createServerHelloDone=function($){var J=k.util.createBuffer();return J.putByte(N.HandshakeType.server_hello_done),J.putInt24(0),J};N.createChangeCipherSpec=function(){var $=k.util.createBuffer();return $.putByte(1),$};N.createFinished=function($){var J=k.util.createBuffer();J.putBuffer($.session.md5.digest()),J.putBuffer($.session.sha1.digest());var X=$.entity===N.ConnectionEnd.client,Q=$.session.sp,Y=12,G=gY,W=X?"client finished":"server finished";J=G(Q.master_secret,W,J.getBytes(),Y);var U=k.util.createBuffer();return U.putByte(N.HandshakeType.finished),U.putInt24(J.length()),U.putBuffer(J),U};N.createHeartbeat=function($,J,X){if(typeof X>"u")X=J.length;var Q=k.util.createBuffer();Q.putByte($),Q.putInt16(X),Q.putBytes(J);var Y=Q.length(),G=Math.max(16,Y-X-3);return Q.putBytes(k.random.getBytes(G)),Q};N.queue=function($,J){if(!J)return;if(J.fragment.length()===0){if(J.type===N.ContentType.handshake||J.type===N.ContentType.alert||J.type===N.ContentType.change_cipher_spec)return}if(J.type===N.ContentType.handshake){var X=J.fragment.bytes();$.session.md5.update(X),$.session.sha1.update(X),X=null}var Q;if(J.fragment.length()<=N.MaxFragment)Q=[J];else{Q=[];var Y=J.fragment.bytes();while(Y.length>N.MaxFragment)Q.push(N.createRecord($,{type:J.type,data:k.util.createBuffer(Y.slice(0,N.MaxFragment))})),Y=Y.slice(N.MaxFragment);if(Y.length>0)Q.push(N.createRecord($,{type:J.type,data:k.util.createBuffer(Y)}))}for(var G=0;G<Q.length&&!$.fail;++G){var W=Q[G],U=$.state.current.write;if(U.update($,W))$.records.push(W)}};N.flush=function($){for(var J=0;J<$.records.length;++J){var X=$.records[J];$.tlsData.putByte(X.type),$.tlsData.putByte(X.version.major),$.tlsData.putByte(X.version.minor),$.tlsData.putInt16(X.fragment.length()),$.tlsData.putBuffer($.records[J].fragment)}return $.records=[],$.tlsDataReady($)};var S8=function($){switch($){case!0:return!0;case k.pki.certificateError.bad_certificate:return N.Alert.Description.bad_certificate;case k.pki.certificateError.unsupported_certificate:return N.Alert.Description.unsupported_certificate;case k.pki.certificateError.certificate_revoked:return N.Alert.Description.certificate_revoked;case k.pki.certificateError.certificate_expired:return N.Alert.Description.certificate_expired;case k.pki.certificateError.certificate_unknown:return N.Alert.Description.certificate_unknown;case k.pki.certificateError.unknown_ca:return N.Alert.Description.unknown_ca;default:return N.Alert.Description.bad_certificate}},YH=function($){switch($){case!0:return!0;case N.Alert.Description.bad_certificate:return k.pki.certificateError.bad_certificate;case N.Alert.Description.unsupported_certificate:return k.pki.certificateError.unsupported_certificate;case N.Alert.Description.certificate_revoked:return k.pki.certificateError.certificate_revoked;case N.Alert.Description.certificate_expired:return k.pki.certificateError.certificate_expired;case N.Alert.Description.certificate_unknown:return k.pki.certificateError.certificate_unknown;case N.Alert.Description.unknown_ca:return k.pki.certificateError.unknown_ca;default:return k.pki.certificateError.bad_certificate}};N.verifyCertificateChain=function($,J){try{var X={};for(var Q in $.verifyOptions)X[Q]=$.verifyOptions[Q];X.verify=function(G,W,U){var M=S8(G),O=$.verify($,G,W,U);if(O!==!0){if(typeof O==="object"&&!k.util.isArray(O)){var V=Error("The application rejected the certificate.");if(V.send=!0,V.alert={level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate},O.message)V.message=O.message;if(O.alert)V.alert.description=O.alert;throw V}if(O!==G)O=YH(O)}return O},k.pki.verifyCertificateChain($.caStore,J,X)}catch(G){var Y=G;if(typeof Y!=="object"||k.util.isArray(Y))Y={send:!0,alert:{level:N.Alert.Level.fatal,description:S8(G)}};if(!("send"in Y))Y.send=!0;if(!("alert"in Y))Y.alert={level:N.Alert.Level.fatal,description:S8(Y.error)};$.error($,Y)}return!$.fail};N.createSessionCache=function($,J){var X=null;if($&&$.getSession&&$.setSession&&$.order)X=$;else{X={},X.cache=$||{},X.capacity=Math.max(J||100,1),X.order=[];for(var Q in $)if(X.order.length<=J)X.order.push(Q);else delete $[Q];X.getSession=function(Y){var G=null,W=null;if(Y)W=k.util.bytesToHex(Y);else if(X.order.length>0)W=X.order[0];if(W!==null&&W in X.cache){G=X.cache[W],delete X.cache[W];for(var U in X.order)if(X.order[U]===W){X.order.splice(U,1);break}}return G},X.setSession=function(Y,G){if(X.order.length===X.capacity){var W=X.order.shift();delete X.cache[W]}var W=k.util.bytesToHex(Y);X.order.push(W),X.cache[W]=G}}return X};N.createConnection=function($){var J=null;if($.caStore)if(k.util.isArray($.caStore))J=k.pki.createCaStore($.caStore);else J=$.caStore;else J=k.pki.createCaStore();var X=$.cipherSuites||null;if(X===null){X=[];for(var Q in N.CipherSuites)X.push(N.CipherSuites[Q])}var Y=$.server?N.ConnectionEnd.server:N.ConnectionEnd.client,G=$.sessionCache?N.createSessionCache($.sessionCache):null,W={version:{major:N.Version.major,minor:N.Version.minor},entity:Y,sessionId:$.sessionId,caStore:J,sessionCache:G,cipherSuites:X,connected:$.connected,virtualHost:$.virtualHost||null,verifyClient:$.verifyClient||!1,verify:$.verify||function(V,H,q,F){return H},verifyOptions:$.verifyOptions||{},getCertificate:$.getCertificate||null,getPrivateKey:$.getPrivateKey||null,getSignature:$.getSignature||null,input:k.util.createBuffer(),tlsData:k.util.createBuffer(),data:k.util.createBuffer(),tlsDataReady:$.tlsDataReady,dataReady:$.dataReady,heartbeatReceived:$.heartbeatReceived,closed:$.closed,error:function(V,H){if(H.origin=H.origin||(V.entity===N.ConnectionEnd.client?"client":"server"),H.send)N.queue(V,N.createAlert(V,H.alert)),N.flush(V);var q=H.fatal!==!1;if(q)V.fail=!0;if($.error(V,H),q)V.close(!1)},deflate:$.deflate||null,inflate:$.inflate||null};W.reset=function(V){W.version={major:N.Version.major,minor:N.Version.minor},W.record=null,W.session=null,W.peerCertificate=null,W.state={pending:null,current:null},W.expect=W.entity===N.ConnectionEnd.client?lV:aV,W.fragmented=null,W.records=[],W.open=!1,W.handshakes=0,W.handshaking=!1,W.isConnected=!1,W.fail=!(V||typeof V>"u"),W.input.clear(),W.tlsData.clear(),W.data.clear(),W.state.current=N.createConnectionState(W)},W.reset();var U=function(V,H){var q=H.type-N.ContentType.change_cipher_spec,F=w8[V.entity][V.expect];if(q in F)F[q](V,H);else N.handleUnexpected(V,H)},M=function(V){var H=0,q=V.input,F=q.length();if(F<5)H=5-F;else{V.record={type:q.getByte(),version:{major:q.getByte(),minor:q.getByte()},length:q.getInt16(),fragment:k.util.createBuffer(),ready:!1};var K=V.record.version.major===V.version.major;if(K&&V.session&&V.session.version)K=V.record.version.minor===V.version.minor;if(!K)V.error(V,{message:"Incompatible TLS version.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}})}return H},O=function(V){var H=0,q=V.input,F=q.length();if(F<V.record.length)H=V.record.length-F;else{V.record.fragment.putBytes(q.getBytes(V.record.length)),q.compact();var K=V.state.current.read;if(K.update(V,V.record)){if(V.fragmented!==null)if(V.fragmented.type===V.record.type)V.fragmented.fragment.putBuffer(V.record.fragment),V.record=V.fragmented;else V.error(V,{message:"Invalid fragmented record.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unexpected_message}});V.record.ready=!0}}return H};return W.handshake=function(V){if(W.entity!==N.ConnectionEnd.client)W.error(W,{message:"Cannot initiate handshake as a server.",fatal:!1});else if(W.handshaking)W.error(W,{message:"Handshake already in progress.",fatal:!1});else{if(W.fail&&!W.open&&W.handshakes===0)W.fail=!1;W.handshaking=!0,V=V||"";var H=null;if(V.length>0){if(W.sessionCache)H=W.sessionCache.getSession(V);if(H===null)V=""}if(V.length===0&&W.sessionCache){if(H=W.sessionCache.getSession(),H!==null)V=H.id}if(W.session={id:V,version:null,cipherSuite:null,compressionMethod:null,serverCertificate:null,certificateRequest:null,clientCertificate:null,sp:{},md5:k.md.md5.create(),sha1:k.md.sha1.create()},H)W.version=H.version,W.session.sp=H.sp;W.session.sp.client_random=N.createRandom().getBytes(),W.open=!0,N.queue(W,N.createRecord(W,{type:N.ContentType.handshake,data:N.createClientHello(W)})),N.flush(W)}},W.process=function(V){var H=0;if(V)W.input.putBytes(V);if(!W.fail){if(W.record!==null&&W.record.ready&&W.record.fragment.isEmpty())W.record=null;if(W.record===null)H=M(W);if(!W.fail&&W.record!==null&&!W.record.ready)H=O(W);if(!W.fail&&W.record!==null&&W.record.ready)U(W,W.record)}return H},W.prepare=function(V){return N.queue(W,N.createRecord(W,{type:N.ContentType.application_data,data:k.util.createBuffer(V)})),N.flush(W)},W.prepareHeartbeatRequest=function(V,H){if(V instanceof k.util.ByteBuffer)V=V.bytes();if(typeof H>"u")H=V.length;return W.expectedHeartbeatPayload=V,N.queue(W,N.createRecord(W,{type:N.ContentType.heartbeat,data:N.createHeartbeat(N.HeartbeatMessageType.heartbeat_request,V,H)})),N.flush(W)},W.close=function(V){if(!W.fail&&W.sessionCache&&W.session){var H={id:W.session.id,version:W.session.version,sp:W.session.sp};H.sp.keys=null,W.sessionCache.setSession(H.id,H)}if(W.open){if(W.open=!1,W.input.clear(),W.isConnected||W.handshaking)W.isConnected=W.handshaking=!1,N.queue(W,N.createAlert(W,{level:N.Alert.Level.warning,description:N.Alert.Description.close_notify})),N.flush(W);W.closed(W)}W.reset(V)},W};n1.exports=k.tls=k.tls||{};for(TX in N)if(typeof N[TX]!=="function")k.tls[TX]=N[TX];var TX;k.tls.prf_tls1=gY;k.tls.hmac_sha1=uV;k.tls.createSessionCache=N.createSessionCache;k.tls.createConnection=N.createConnection});var a1=H$((xF,o1)=>{var y0=F$();w0();P8();var yJ=o1.exports=y0.tls;yJ.CipherSuites.TLS_RSA_WITH_AES_128_CBC_SHA={id:[0,47],name:"TLS_RSA_WITH_AES_128_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=yJ.BulkCipherAlgorithm.aes,$.cipher_type=yJ.CipherType.block,$.enc_key_length=16,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=yJ.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:i1};yJ.CipherSuites.TLS_RSA_WITH_AES_256_CBC_SHA={id:[0,53],name:"TLS_RSA_WITH_AES_256_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=yJ.BulkCipherAlgorithm.aes,$.cipher_type=yJ.CipherType.block,$.enc_key_length=32,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=yJ.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:i1};function i1($,J,X){var Q=J.entity===y0.tls.ConnectionEnd.client;$.read.cipherState={init:!1,cipher:y0.cipher.createDecipher("AES-CBC",Q?X.keys.server_write_key:X.keys.client_write_key),iv:Q?X.keys.server_write_IV:X.keys.client_write_IV},$.write.cipherState={init:!1,cipher:y0.cipher.createCipher("AES-CBC",Q?X.keys.client_write_key:X.keys.server_write_key),iv:Q?X.keys.client_write_IV:X.keys.server_write_IV},$.read.cipherFunction=MH,$.write.cipherFunction=GH,$.read.macLength=$.write.macLength=X.mac_length,$.read.macFunction=$.write.macFunction=yJ.hmac_sha1}function GH($,J){var X=!1,Q=J.macFunction(J.macKey,J.sequenceNumber,$);$.fragment.putBytes(Q),J.updateSequenceNumber();var Y;if($.version.minor===yJ.Versions.TLS_1_0.minor)Y=J.cipherState.init?null:J.cipherState.iv;else Y=y0.random.getBytesSync(16);J.cipherState.init=!0;var G=J.cipherState.cipher;if(G.start({iv:Y}),$.version.minor>=yJ.Versions.TLS_1_1.minor)G.output.putBytes(Y);if(G.update($.fragment),G.finish(WH))$.fragment=G.output,$.length=$.fragment.length(),X=!0;return X}function WH($,J,X){if(!X){var Q=$-J.length()%$;J.fillWithByte(Q-1,Q)}return!0}function UH($,J,X){var Q=!0;if(X){var Y=J.length(),G=J.last();for(var W=Y-1-G;W<Y-1;++W)Q=Q&&J.at(W)==G;if(Q)J.truncate(G+1)}return Q}function MH($,J){var X=!1,Q;if($.version.minor===yJ.Versions.TLS_1_0.minor)Q=J.cipherState.init?null:J.cipherState.iv;else Q=$.fragment.getBytes(16);J.cipherState.init=!0;var Y=J.cipherState.cipher;Y.start({iv:Q}),Y.update($.fragment),X=Y.finish(UH);var G=J.macLength,W=y0.random.getBytesSync(G),U=Y.output.length();if(U>=G)$.fragment=Y.output.getBytes(U-G),W=Y.output.getBytes(G);else $.fragment=Y.output.getBytes();$.fragment=y0.util.createBuffer($.fragment),$.length=$.fragment.length();var M=J.macFunction(J.macKey,J.sequenceNumber,$);return J.updateSequenceNumber(),X=OH(J.macKey,W,M)&&X,X}function OH($,J,X){var Q=y0.hmac.create();return Q.start("SHA1",$),Q.update(J),J=Q.digest().getBytes(),Q.start(null,null),Q.update(X),X=Q.digest().getBytes(),J===X}});var v8=H$((vF,e1)=>{var d$=F$();eJ();_$();var SX=e1.exports=d$.sha512=d$.sha512||{};d$.md.sha512=d$.md.algorithms.sha512=SX;var r1=d$.sha384=d$.sha512.sha384=d$.sha512.sha384||{};r1.create=function(){return SX.create("SHA-384")};d$.md.sha384=d$.md.algorithms.sha384=r1;d$.sha512.sha256=d$.sha512.sha256||{create:function(){return SX.create("SHA-512/256")}};d$.md["sha512/256"]=d$.md.algorithms["sha512/256"]=d$.sha512.sha256;d$.sha512.sha224=d$.sha512.sha224||{create:function(){return SX.create("SHA-512/224")}};d$.md["sha512/224"]=d$.md.algorithms["sha512/224"]=d$.sha512.sha224;SX.create=function($){if(!t1)VH();if(typeof $>"u")$="SHA-512";if(!($ in UQ))throw Error("Invalid SHA-512 algorithm: "+$);var J=UQ[$],X=null,Q=d$.util.createBuffer(),Y=Array(80);for(var G=0;G<80;++G)Y[G]=[,,];var W=64;switch($){case"SHA-384":W=48;break;case"SHA-512/256":W=32;break;case"SHA-512/224":W=28;break}var U={algorithm:$.replace("-","").toLowerCase(),blockLength:128,digestLength:W,messageLength:0,fullMessageLength:null,messageLengthSize:16};return U.start=function(){U.messageLength=0,U.fullMessageLength=U.messageLength128=[];var M=U.messageLengthSize/4;for(var O=0;O<M;++O)U.fullMessageLength.push(0);Q=d$.util.createBuffer(),X=Array(J.length);for(var O=0;O<J.length;++O)X[O]=J[O].slice(0);return U},U.start(),U.update=function(M,O){if(O==="utf8")M=d$.util.encodeUtf8(M);var V=M.length;U.messageLength+=V,V=[V/4294967296>>>0,V>>>0];for(var H=U.fullMessageLength.length-1;H>=0;--H)U.fullMessageLength[H]+=V[1],V[1]=V[0]+(U.fullMessageLength[H]/4294967296>>>0),U.fullMessageLength[H]=U.fullMessageLength[H]>>>0,V[0]=V[1]/4294967296>>>0;if(Q.putBytes(M),s1(X,Y,Q),Q.read>2048||Q.length()===0)Q.compact();return U},U.digest=function(){var M=d$.util.createBuffer();M.putBytes(Q.bytes());var O=U.fullMessageLength[U.fullMessageLength.length-1]+U.messageLengthSize,V=O&U.blockLength-1;M.putBytes(_8.substr(0,U.blockLength-V));var H,q,F=U.fullMessageLength[0]*8;for(var K=0;K<U.fullMessageLength.length-1;++K)H=U.fullMessageLength[K+1]*8,q=H/4294967296>>>0,F+=q,M.putInt32(F>>>0),F=H>>>0;M.putInt32(F);var A=Array(X.length);for(var K=0;K<X.length;++K)A[K]=X[K].slice(0);s1(A,Y,M);var L=d$.util.createBuffer(),R;if($==="SHA-512")R=A.length;else if($==="SHA-384")R=A.length-2;else R=A.length-4;for(var K=0;K<R;++K)if(L.putInt32(A[K][0]),K!==R-1||$!=="SHA-512/224")L.putInt32(A[K][1]);return L},U};var _8=null,t1=!1,x8=null,UQ=null;function VH(){_8=String.fromCharCode(128),_8+=d$.util.fillString(String.fromCharCode(0),128),x8=[[1116352408,3609767458],[1899447441,602891725],[3049323471,3964484399],[3921009573,2173295548],[961987163,4081628472],[1508970993,3053834265],[2453635748,2937671579],[2870763221,3664609560],[3624381080,2734883394],[310598401,1164996542],[607225278,1323610764],[1426881987,3590304994],[1925078388,4068182383],[2162078206,991336113],[2614888103,633803317],[3248222580,3479774868],[3835390401,2666613458],[4022224774,944711139],[264347078,2341262773],[604807628,2007800933],[770255983,1495990901],[1249150122,1856431235],[1555081692,3175218132],[1996064986,2198950837],[2554220882,3999719339],[2821834349,766784016],[2952996808,2566594879],[3210313671,3203337956],[3336571891,1034457026],[3584528711,2466948901],[113926993,3758326383],[338241895,168717936],[666307205,1188179964],[773529912,1546045734],[1294757372,1522805485],[1396182291,2643833823],[1695183700,2343527390],[1986661051,1014477480],[2177026350,1206759142],[2456956037,344077627],[2730485921,1290863460],[2820302411,3158454273],[3259730800,3505952657],[3345764771,106217008],[3516065817,3606008344],[3600352804,1432725776],[4094571909,1467031594],[275423344,851169720],[430227734,3100823752],[506948616,1363258195],[659060556,3750685593],[883997877,3785050280],[958139571,3318307427],[1322822218,3812723403],[1537002063,2003034995],[1747873779,3602036899],[1955562222,1575990012],[2024104815,1125592928],[2227730452,2716904306],[2361852424,442776044],[2428436474,593698344],[2756734187,3733110249],[3204031479,2999351573],[3329325298,3815920427],[3391569614,3928383900],[3515267271,566280711],[3940187606,3454069534],[4118630271,4000239992],[116418474,1914138554],[174292421,2731055270],[289380356,3203993006],[460393269,320620315],[685471733,587496836],[852142971,1086792851],[1017036298,365543100],[1126000580,2618297676],[1288033470,3409855158],[1501505948,4234509866],[1607167915,987167468],[1816402316,1246189591]],UQ={},UQ["SHA-512"]=[[1779033703,4089235720],[3144134277,2227873595],[1013904242,4271175723],[2773480762,1595750129],[1359893119,2917565137],[2600822924,725511199],[528734635,4215389547],[1541459225,327033209]],UQ["SHA-384"]=[[3418070365,3238371032],[1654270250,914150663],[2438529370,812702999],[355462360,4144912697],[1731405415,4290775857],[2394180231,1750603025],[3675008525,1694076839],[1203062813,3204075428]],UQ["SHA-512/256"]=[[573645204,4230739756],[2673172387,3360449730],[596883563,1867755857],[2520282905,1497426621],[2519219938,2827943907],[3193839141,1401305490],[721525244,746961066],[246885852,2177182882]],UQ["SHA-512/224"]=[[2352822216,424955298],[1944164710,2312950998],[502970286,855612546],[1738396948,1479516111],[258812777,2077511080],[2011393907,79989058],[1067287976,1780299464],[286451373,2446758561]],t1=!0}function s1($,J,X){var Q,Y,G,W,U,M,O,V,H,q,F,K,A,L,R,I,j,C,w,P,l,e,y,n,Y$,L$,j$,QJ,S$,h$,u,J$,a,V$,O$,$$=X.length();while($$>=128){for(S$=0;S$<16;++S$)J[S$][0]=X.getInt32()>>>0,J[S$][1]=X.getInt32()>>>0;for(;S$<80;++S$)J$=J[S$-2],h$=J$[0],u=J$[1],Q=((h$>>>19|u<<13)^(u>>>29|h$<<3)^h$>>>6)>>>0,Y=((h$<<13|u>>>19)^(u<<3|h$>>>29)^(h$<<26|u>>>6))>>>0,V$=J[S$-15],h$=V$[0],u=V$[1],G=((h$>>>1|u<<31)^(h$>>>8|u<<24)^h$>>>7)>>>0,W=((h$<<31|u>>>1)^(h$<<24|u>>>8)^(h$<<25|u>>>7))>>>0,a=J[S$-7],O$=J[S$-16],u=Y+a[1]+W+O$[1],J[S$][0]=Q+a[0]+G+O$[0]+(u/4294967296>>>0)>>>0,J[S$][1]=u>>>0;A=$[0][0],L=$[0][1],R=$[1][0],I=$[1][1],j=$[2][0],C=$[2][1],w=$[3][0],P=$[3][1],l=$[4][0],e=$[4][1],y=$[5][0],n=$[5][1],Y$=$[6][0],L$=$[6][1],j$=$[7][0],QJ=$[7][1];for(S$=0;S$<80;++S$)O=((l>>>14|e<<18)^(l>>>18|e<<14)^(e>>>9|l<<23))>>>0,V=((l<<18|e>>>14)^(l<<14|e>>>18)^(e<<23|l>>>9))>>>0,H=(Y$^l&(y^Y$))>>>0,q=(L$^e&(n^L$))>>>0,U=((A>>>28|L<<4)^(L>>>2|A<<30)^(L>>>7|A<<25))>>>0,M=((A<<4|L>>>28)^(L<<30|A>>>2)^(L<<25|A>>>7))>>>0,F=(A&R|j&(A^R))>>>0,K=(L&I|C&(L^I))>>>0,u=QJ+V+q+x8[S$][1]+J[S$][1],Q=j$+O+H+x8[S$][0]+J[S$][0]+(u/4294967296>>>0)>>>0,Y=u>>>0,u=M+K,G=U+F+(u/4294967296>>>0)>>>0,W=u>>>0,j$=Y$,QJ=L$,Y$=y,L$=n,y=l,n=e,u=P+Y,l=w+Q+(u/4294967296>>>0)>>>0,e=u>>>0,w=j,P=C,j=R,C=I,R=A,I=L,u=Y+W,A=Q+G+(u/4294967296>>>0)>>>0,L=u>>>0;u=$[0][1]+L,$[0][0]=$[0][0]+A+(u/4294967296>>>0)>>>0,$[0][1]=u>>>0,u=$[1][1]+I,$[1][0]=$[1][0]+R+(u/4294967296>>>0)>>>0,$[1][1]=u>>>0,u=$[2][1]+C,$[2][0]=$[2][0]+j+(u/4294967296>>>0)>>>0,$[2][1]=u>>>0,u=$[3][1]+P,$[3][0]=$[3][0]+w+(u/4294967296>>>0)>>>0,$[3][1]=u>>>0,u=$[4][1]+e,$[4][0]=$[4][0]+l+(u/4294967296>>>0)>>>0,$[4][1]=u>>>0,u=$[5][1]+n,$[5][0]=$[5][0]+y+(u/4294967296>>>0)>>>0,$[5][1]=u>>>0,u=$[6][1]+L$,$[6][0]=$[6][0]+Y$+(u/4294967296>>>0)>>>0,$[6][1]=u>>>0,u=$[7][1]+QJ,$[7][0]=$[7][0]+j$+(u/4294967296>>>0)>>>0,$[7][1]=u>>>0,$$-=128}}});var $W=H$((qH)=>{var HH=F$();mJ();var HJ=HH.asn1;qH.privateKeyValidator={name:"PrivateKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]};qH.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.BITSTRING,constructed:!1,composed:!0,captureBitStringValue:"ed25519PublicKey"}]}});var qW=H$((fF,HW)=>{var zJ=F$();DX();_J();v8();_$();var GW=$W(),EH=GW.publicKeyValidator,FH=GW.privateKeyValidator;if(typeof f8>"u")f8=zJ.jsbn.BigInteger;var f8,y8=zJ.util.ByteBuffer,BJ=typeof Buffer>"u"?Uint8Array:Buffer;zJ.pki=zJ.pki||{};HW.exports=zJ.pki.ed25519=zJ.ed25519=zJ.ed25519||{};var Z$=zJ.ed25519;Z$.constants={};Z$.constants.PUBLIC_KEY_BYTE_LENGTH=32;Z$.constants.PRIVATE_KEY_BYTE_LENGTH=64;Z$.constants.SEED_BYTE_LENGTH=32;Z$.constants.SIGN_BYTE_LENGTH=64;Z$.constants.HASH_BYTE_LENGTH=64;Z$.generateKeyPair=function($){$=$||{};var J=$.seed;if(J===void 0)J=zJ.random.getBytesSync(Z$.constants.SEED_BYTE_LENGTH);else if(typeof J==="string"){if(J.length!==Z$.constants.SEED_BYTE_LENGTH)throw TypeError('"seed" must be '+Z$.constants.SEED_BYTE_LENGTH+" bytes in length.")}else if(!(J instanceof Uint8Array))throw TypeError('"seed" must be a node.js Buffer, Uint8Array, or a binary string.');J=A0({message:J,encoding:"binary"});var X=new BJ(Z$.constants.PUBLIC_KEY_BYTE_LENGTH),Q=new BJ(Z$.constants.PRIVATE_KEY_BYTE_LENGTH);for(var Y=0;Y<32;++Y)Q[Y]=J[Y];return RH(X,Q),{publicKey:X,privateKey:Q}};Z$.privateKeyFromAsn1=function($){var J={},X=[],Q=zJ.asn1.validate($,FH,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=zJ.asn1.derToOid(J.privateKeyOid),W=zJ.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var U=J.privateKey,M=A0({message:zJ.asn1.fromDer(U).value,encoding:"binary"});return{privateKeyBytes:M}};Z$.publicKeyFromAsn1=function($){var J={},X=[],Q=zJ.asn1.validate($,EH,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=zJ.asn1.derToOid(J.publicKeyOid),W=zJ.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var U=J.ed25519PublicKey;if(U.length!==Z$.constants.PUBLIC_KEY_BYTE_LENGTH)throw Error("Key length is invalid.");return A0({message:U,encoding:"binary"})};Z$.publicKeyFromPrivateKey=function($){$=$||{};var J=A0({message:$.privateKey,encoding:"binary"});if(J.length!==Z$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Z$.constants.PRIVATE_KEY_BYTE_LENGTH);var X=new BJ(Z$.constants.PUBLIC_KEY_BYTE_LENGTH);for(var Q=0;Q<X.length;++Q)X[Q]=J[32+Q];return X};Z$.sign=function($){$=$||{};var J=A0($),X=A0({message:$.privateKey,encoding:"binary"});if(X.length===Z$.constants.SEED_BYTE_LENGTH){var Q=Z$.generateKeyPair({seed:X});X=Q.privateKey}else if(X.length!==Z$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Z$.constants.SEED_BYTE_LENGTH+" or "+Z$.constants.PRIVATE_KEY_BYTE_LENGTH);var Y=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length);DH(Y,J,J.length,X);var G=new BJ(Z$.constants.SIGN_BYTE_LENGTH);for(var W=0;W<G.length;++W)G[W]=Y[W];return G};Z$.verify=function($){$=$||{};var J=A0($);if($.signature===void 0)throw TypeError('"options.signature" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a binary string.');var X=A0({message:$.signature,encoding:"binary"});if(X.length!==Z$.constants.SIGN_BYTE_LENGTH)throw TypeError('"options.signature" must have a byte length of '+Z$.constants.SIGN_BYTE_LENGTH);var Q=A0({message:$.publicKey,encoding:"binary"});if(Q.length!==Z$.constants.PUBLIC_KEY_BYTE_LENGTH)throw TypeError('"options.publicKey" must have a byte length of '+Z$.constants.PUBLIC_KEY_BYTE_LENGTH);var Y=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length),G=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length),W;for(W=0;W<Z$.constants.SIGN_BYTE_LENGTH;++W)Y[W]=X[W];for(W=0;W<J.length;++W)Y[W+Z$.constants.SIGN_BYTE_LENGTH]=J[W];return ZH(G,Y,Y.length,Q)>=0};function A0($){var J=$.message;if(J instanceof Uint8Array||J instanceof BJ)return J;var X=$.encoding;if(J===void 0)if($.md)J=$.md.digest().getBytes(),X="binary";else throw TypeError('"options.message" or "options.md" not specified.');if(typeof J==="string"&&!X)throw TypeError('"options.encoding" must be "binary" or "utf8".');if(typeof J==="string"){if(typeof Buffer<"u")return Buffer.from(J,X);J=new y8(J,X)}else if(!(J instanceof y8))throw TypeError('"options.message" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a string with "options.encoding" specifying its encoding.');var Q=new BJ(J.length());for(var Y=0;Y<Q.length;++Y)Q[Y]=J.at(Y);return Q}var b8=U$(),mY=U$([1]),NH=U$([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),LH=U$([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),JW=U$([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),QW=U$([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),IX=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]),AH=U$([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function CX($,J){var X=zJ.md.sha512.create(),Q=new y8($);X.update(Q.getBytes(J),"binary");var Y=X.digest().getBytes();if(typeof Buffer<"u")return Buffer.from(Y,"binary");var G=new BJ(Z$.constants.HASH_BYTE_LENGTH);for(var W=0;W<64;++W)G[W]=Y.charCodeAt(W);return G}function RH($,J){var X=[U$(),U$(),U$(),U$()],Q,Y=CX(J,32);Y[0]&=248,Y[31]&=127,Y[31]|=64,m8(X,Y),g8($,X);for(Q=0;Q<32;++Q)J[Q+32]=$[Q];return 0}function DH($,J,X,Q){var Y,G,W=new Float64Array(64),U=[U$(),U$(),U$(),U$()],M=CX(Q,32);M[0]&=248,M[31]&=127,M[31]|=64;var O=X+64;for(Y=0;Y<X;++Y)$[64+Y]=J[Y];for(Y=0;Y<32;++Y)$[32+Y]=M[32+Y];var V=CX($.subarray(32),X+32);h8(V),m8(U,V),g8($,U);for(Y=32;Y<64;++Y)$[Y]=Q[Y];var H=CX($,X+64);h8(H);for(Y=32;Y<64;++Y)W[Y]=0;for(Y=0;Y<32;++Y)W[Y]=V[Y];for(Y=0;Y<32;++Y)for(G=0;G<32;G++)W[Y+G]+=H[Y]*M[G];return WW($.subarray(32),W),O}function ZH($,J,X,Q){var Y,G,W=new BJ(32),U=[U$(),U$(),U$(),U$()],M=[U$(),U$(),U$(),U$()];if(G=-1,X<64)return-1;if(jH(M,Q))return-1;if(!BH(J,32))return-1;for(Y=0;Y<X;++Y)$[Y]=J[Y];for(Y=0;Y<32;++Y)$[Y+32]=Q[Y];var O=CX($,X);if(h8(O),OW(U,M,O),m8(M,J.subarray(32)),u8(U,M),g8(W,U),X-=64,UW(J,0,W,0)){for(Y=0;Y<X;++Y)$[Y]=0;return-1}for(Y=0;Y<X;++Y)$[Y]=J[Y+64];return G=X,G}function BH($,J){var X;for(X=31;X>=0;--X){if($[J+X]<IX[X])return!0;if($[J+X]>IX[X])return!1}return!1}function WW($,J){var X,Q,Y,G;for(Q=63;Q>=32;--Q){X=0;for(Y=Q-32,G=Q-12;Y<G;++Y)J[Y]+=X-16*J[Q]*IX[Y-(Q-32)],X=J[Y]+128>>8,J[Y]-=X*256;J[Y]+=X,J[Q]=0}X=0;for(Y=0;Y<32;++Y)J[Y]+=X-(J[31]>>4)*IX[Y],X=J[Y]>>8,J[Y]&=255;for(Y=0;Y<32;++Y)J[Y]-=X*IX[Y];for(Q=0;Q<32;++Q)J[Q+1]+=J[Q]>>8,$[Q]=J[Q]&255}function h8($){var J=new Float64Array(64);for(var X=0;X<64;++X)J[X]=$[X],$[X]=0;WW($,J)}function u8($,J){var X=U$(),Q=U$(),Y=U$(),G=U$(),W=U$(),U=U$(),M=U$(),O=U$(),V=U$();fQ(X,$[1],$[0]),fQ(V,J[1],J[0]),u$(X,X,V),kQ(Q,$[0],$[1]),kQ(V,J[0],J[1]),u$(Q,Q,V),u$(Y,$[3],J[3]),u$(Y,Y,LH),u$(G,$[2],J[2]),kQ(G,G,G),fQ(W,Q,X),fQ(U,G,Y),kQ(M,G,Y),kQ(O,Q,X),u$($[0],W,U),u$($[1],O,M),u$($[2],M,U),u$($[3],W,O)}function XW($,J,X){for(var Q=0;Q<4;++Q)VW($[Q],J[Q],X)}function g8($,J){var X=U$(),Q=U$(),Y=U$();CH(Y,J[2]),u$(X,J[0],Y),u$(Q,J[1],Y),lY($,Q),$[31]^=MW(X)<<7}function lY($,J){var X,Q,Y,G=U$(),W=U$();for(X=0;X<16;++X)W[X]=J[X];k8(W),k8(W),k8(W);for(Q=0;Q<2;++Q){G[0]=W[0]-65517;for(X=1;X<15;++X)G[X]=W[X]-65535-(G[X-1]>>16&1),G[X-1]&=65535;G[15]=W[15]-32767-(G[14]>>16&1),Y=G[15]>>16&1,G[14]&=65535,VW(W,G,1-Y)}for(X=0;X<16;X++)$[2*X]=W[X]&255,$[2*X+1]=W[X]>>8}function jH($,J){var X=U$(),Q=U$(),Y=U$(),G=U$(),W=U$(),U=U$(),M=U$();if(b0($[2],mY),TH($[1],J),MQ(Y,$[1]),u$(G,Y,NH),fQ(Y,Y,$[2]),kQ(G,$[2],G),MQ(W,G),MQ(U,W),u$(M,U,W),u$(X,M,Y),u$(X,X,G),SH(X,X),u$(X,X,Y),u$(X,X,G),u$(X,X,G),u$($[0],X,G),MQ(Q,$[0]),u$(Q,Q,G),YW(Q,Y))u$($[0],$[0],AH);if(MQ(Q,$[0]),u$(Q,Q,G),YW(Q,Y))return-1;if(MW($[0])===J[31]>>7)fQ($[0],b8,$[0]);return u$($[3],$[0],$[1]),0}function TH($,J){var X;for(X=0;X<16;++X)$[X]=J[2*X]+(J[2*X+1]<<8);$[15]&=32767}function SH($,J){var X=U$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=250;Q>=0;--Q)if(MQ(X,X),Q!==1)u$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function YW($,J){var X=new BJ(32),Q=new BJ(32);return lY(X,$),lY(Q,J),UW(X,0,Q,0)}function UW($,J,X,Q){return IH($,J,X,Q,32)}function IH($,J,X,Q,Y){var G,W=0;for(G=0;G<Y;++G)W|=$[J+G]^X[Q+G];return(1&W-1>>>8)-1}function MW($){var J=new BJ(32);return lY(J,$),J[0]&1}function OW($,J,X){var Q,Y;b0($[0],b8),b0($[1],mY),b0($[2],mY),b0($[3],b8);for(Y=255;Y>=0;--Y)Q=X[Y/8|0]>>(Y&7)&1,XW($,J,Q),u8(J,$),u8($,$),XW($,J,Q)}function m8($,J){var X=[U$(),U$(),U$(),U$()];b0(X[0],JW),b0(X[1],QW),b0(X[2],mY),u$(X[3],JW,QW),OW($,X,J)}function b0($,J){var X;for(X=0;X<16;X++)$[X]=J[X]|0}function CH($,J){var X=U$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=253;Q>=0;--Q)if(MQ(X,X),Q!==2&&Q!==4)u$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function k8($){var J,X,Q=1;for(J=0;J<16;++J)X=$[J]+Q+65535,Q=Math.floor(X/65536),$[J]=X-Q*65536;$[0]+=Q-1+37*(Q-1)}function VW($,J,X){var Q,Y=~(X-1);for(var G=0;G<16;++G)Q=Y&($[G]^J[G]),$[G]^=Q,J[G]^=Q}function U$($){var J,X=new Float64Array(16);if($)for(J=0;J<$.length;++J)X[J]=$[J];return X}function kQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]+X[Q]}function fQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]-X[Q]}function MQ($,J){u$($,J,J)}function u$($,J,X){var Q,Y,G=0,W=0,U=0,M=0,O=0,V=0,H=0,q=0,F=0,K=0,A=0,L=0,R=0,I=0,j=0,C=0,w=0,P=0,l=0,e=0,y=0,n=0,Y$=0,L$=0,j$=0,QJ=0,S$=0,h$=0,u=0,J$=0,a=0,V$=X[0],O$=X[1],$$=X[2],P$=X[3],G$=X[4],c$=X[5],x$=X[6],E$=X[7],n$=X[8],y$=X[9],e$=X[10],GJ=X[11],WJ=X[12],s$=X[13],b$=X[14],i$=X[15];Q=J[0],G+=Q*V$,W+=Q*O$,U+=Q*$$,M+=Q*P$,O+=Q*G$,V+=Q*c$,H+=Q*x$,q+=Q*E$,F+=Q*n$,K+=Q*y$,A+=Q*e$,L+=Q*GJ,R+=Q*WJ,I+=Q*s$,j+=Q*b$,C+=Q*i$,Q=J[1],W+=Q*V$,U+=Q*O$,M+=Q*$$,O+=Q*P$,V+=Q*G$,H+=Q*c$,q+=Q*x$,F+=Q*E$,K+=Q*n$,A+=Q*y$,L+=Q*e$,R+=Q*GJ,I+=Q*WJ,j+=Q*s$,C+=Q*b$,w+=Q*i$,Q=J[2],U+=Q*V$,M+=Q*O$,O+=Q*$$,V+=Q*P$,H+=Q*G$,q+=Q*c$,F+=Q*x$,K+=Q*E$,A+=Q*n$,L+=Q*y$,R+=Q*e$,I+=Q*GJ,j+=Q*WJ,C+=Q*s$,w+=Q*b$,P+=Q*i$,Q=J[3],M+=Q*V$,O+=Q*O$,V+=Q*$$,H+=Q*P$,q+=Q*G$,F+=Q*c$,K+=Q*x$,A+=Q*E$,L+=Q*n$,R+=Q*y$,I+=Q*e$,j+=Q*GJ,C+=Q*WJ,w+=Q*s$,P+=Q*b$,l+=Q*i$,Q=J[4],O+=Q*V$,V+=Q*O$,H+=Q*$$,q+=Q*P$,F+=Q*G$,K+=Q*c$,A+=Q*x$,L+=Q*E$,R+=Q*n$,I+=Q*y$,j+=Q*e$,C+=Q*GJ,w+=Q*WJ,P+=Q*s$,l+=Q*b$,e+=Q*i$,Q=J[5],V+=Q*V$,H+=Q*O$,q+=Q*$$,F+=Q*P$,K+=Q*G$,A+=Q*c$,L+=Q*x$,R+=Q*E$,I+=Q*n$,j+=Q*y$,C+=Q*e$,w+=Q*GJ,P+=Q*WJ,l+=Q*s$,e+=Q*b$,y+=Q*i$,Q=J[6],H+=Q*V$,q+=Q*O$,F+=Q*$$,K+=Q*P$,A+=Q*G$,L+=Q*c$,R+=Q*x$,I+=Q*E$,j+=Q*n$,C+=Q*y$,w+=Q*e$,P+=Q*GJ,l+=Q*WJ,e+=Q*s$,y+=Q*b$,n+=Q*i$,Q=J[7],q+=Q*V$,F+=Q*O$,K+=Q*$$,A+=Q*P$,L+=Q*G$,R+=Q*c$,I+=Q*x$,j+=Q*E$,C+=Q*n$,w+=Q*y$,P+=Q*e$,l+=Q*GJ,e+=Q*WJ,y+=Q*s$,n+=Q*b$,Y$+=Q*i$,Q=J[8],F+=Q*V$,K+=Q*O$,A+=Q*$$,L+=Q*P$,R+=Q*G$,I+=Q*c$,j+=Q*x$,C+=Q*E$,w+=Q*n$,P+=Q*y$,l+=Q*e$,e+=Q*GJ,y+=Q*WJ,n+=Q*s$,Y$+=Q*b$,L$+=Q*i$,Q=J[9],K+=Q*V$,A+=Q*O$,L+=Q*$$,R+=Q*P$,I+=Q*G$,j+=Q*c$,C+=Q*x$,w+=Q*E$,P+=Q*n$,l+=Q*y$,e+=Q*e$,y+=Q*GJ,n+=Q*WJ,Y$+=Q*s$,L$+=Q*b$,j$+=Q*i$,Q=J[10],A+=Q*V$,L+=Q*O$,R+=Q*$$,I+=Q*P$,j+=Q*G$,C+=Q*c$,w+=Q*x$,P+=Q*E$,l+=Q*n$,e+=Q*y$,y+=Q*e$,n+=Q*GJ,Y$+=Q*WJ,L$+=Q*s$,j$+=Q*b$,QJ+=Q*i$,Q=J[11],L+=Q*V$,R+=Q*O$,I+=Q*$$,j+=Q*P$,C+=Q*G$,w+=Q*c$,P+=Q*x$,l+=Q*E$,e+=Q*n$,y+=Q*y$,n+=Q*e$,Y$+=Q*GJ,L$+=Q*WJ,j$+=Q*s$,QJ+=Q*b$,S$+=Q*i$,Q=J[12],R+=Q*V$,I+=Q*O$,j+=Q*$$,C+=Q*P$,w+=Q*G$,P+=Q*c$,l+=Q*x$,e+=Q*E$,y+=Q*n$,n+=Q*y$,Y$+=Q*e$,L$+=Q*GJ,j$+=Q*WJ,QJ+=Q*s$,S$+=Q*b$,h$+=Q*i$,Q=J[13],I+=Q*V$,j+=Q*O$,C+=Q*$$,w+=Q*P$,P+=Q*G$,l+=Q*c$,e+=Q*x$,y+=Q*E$,n+=Q*n$,Y$+=Q*y$,L$+=Q*e$,j$+=Q*GJ,QJ+=Q*WJ,S$+=Q*s$,h$+=Q*b$,u+=Q*i$,Q=J[14],j+=Q*V$,C+=Q*O$,w+=Q*$$,P+=Q*P$,l+=Q*G$,e+=Q*c$,y+=Q*x$,n+=Q*E$,Y$+=Q*n$,L$+=Q*y$,j$+=Q*e$,QJ+=Q*GJ,S$+=Q*WJ,h$+=Q*s$,u+=Q*b$,J$+=Q*i$,Q=J[15],C+=Q*V$,w+=Q*O$,P+=Q*$$,l+=Q*P$,e+=Q*G$,y+=Q*c$,n+=Q*x$,Y$+=Q*E$,L$+=Q*n$,j$+=Q*y$,QJ+=Q*e$,S$+=Q*GJ,h$+=Q*WJ,u+=Q*s$,J$+=Q*b$,a+=Q*i$,G+=38*w,W+=38*P,U+=38*l,M+=38*e,O+=38*y,V+=38*n,H+=38*Y$,q+=38*L$,F+=38*j$,K+=38*QJ,A+=38*S$,L+=38*h$,R+=38*u,I+=38*J$,j+=38*a,Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=F+Y+65535,Y=Math.floor(Q/65536),F=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=R+Y+65535,Y=Math.floor(Q/65536),R=Q-Y*65536,Q=I+Y+65535,Y=Math.floor(Q/65536),I=Q-Y*65536,Q=j+Y+65535,Y=Math.floor(Q/65536),j=Q-Y*65536,Q=C+Y+65535,Y=Math.floor(Q/65536),C=Q-Y*65536,G+=Y-1+37*(Y-1),Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=F+Y+65535,Y=Math.floor(Q/65536),F=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=R+Y+65535,Y=Math.floor(Q/65536),R=Q-Y*65536,Q=I+Y+65535,Y=Math.floor(Q/65536),I=Q-Y*65536,Q=j+Y+65535,Y=Math.floor(Q/65536),j=Q-Y*65536,Q=C+Y+65535,Y=Math.floor(Q/65536),C=Q-Y*65536,G+=Y-1+37*(Y-1),$[0]=G,$[1]=W,$[2]=U,$[3]=M,$[4]=O,$[5]=V,$[6]=H,$[7]=q,$[8]=F,$[9]=K,$[10]=A,$[11]=L,$[12]=R,$[13]=I,$[14]=j,$[15]=C}});var FW=H$((yF,EW)=>{var IJ=F$();_$();_J();DX();EW.exports=IJ.kem=IJ.kem||{};var KW=IJ.jsbn.BigInteger;IJ.kem.rsa={};IJ.kem.rsa.create=function($,J){J=J||{};var X=J.prng||IJ.random,Q={};return Q.encrypt=function(Y,G){var W=Math.ceil(Y.n.bitLength()/8),U;do U=new KW(IJ.util.bytesToHex(X.getBytesSync(W)),16).mod(Y.n);while(U.compareTo(KW.ONE)<=0);U=IJ.util.hexToBytes(U.toString(16));var M=W-U.length;if(M>0)U=IJ.util.fillString(String.fromCharCode(0),M)+U;var O=Y.encrypt(U,"NONE"),V=$.generate(U,G);return{encapsulation:O,key:V}},Q.decrypt=function(Y,G,W){var U=Y.decrypt(G,"NONE");return $.generate(U,W)},Q};IJ.kem.kdf1=function($,J){zW(this,$,0,J||$.digestLength)};IJ.kem.kdf2=function($,J){zW(this,$,1,J||$.digestLength)};function zW($,J,X,Q){$.generate=function(Y,G){var W=new IJ.util.ByteBuffer,U=Math.ceil(G/Q)+X,M=new IJ.util.ByteBuffer;for(var O=X;O<U;++O){M.putInt32(O),J.start(),J.update(Y+M.getBytes());var V=J.digest();W.putBytes(V.getBytes(Q))}return W.truncate(W.length()-G),W.getBytes()}}});var LW=H$((bF,NW)=>{var T$=F$();_$();NW.exports=T$.log=T$.log||{};T$.log.levels=["none","error","warning","info","debug","verbose","max"];var cY={},l8=[],wX=null;T$.log.LEVEL_LOCKED=2;T$.log.NO_LEVEL_CHECK=4;T$.log.INTERPOLATE=8;for(bJ=0;bJ<T$.log.levels.length;++bJ)pY=T$.log.levels[bJ],cY[pY]={index:bJ,name:pY.toUpperCase()};var pY,bJ;T$.log.logMessage=function($){var J=cY[$.level].index;for(var X=0;X<l8.length;++X){var Q=l8[X];if(Q.flags&T$.log.NO_LEVEL_CHECK)Q.f($);else{var Y=cY[Q.level].index;if(J<=Y)Q.f(Q,$)}}};T$.log.prepareStandard=function($){if(!("standard"in $))$.standard=cY[$.level].name+" ["+$.category+"] "+$.message};T$.log.prepareFull=function($){if(!("full"in $)){var J=[$.message];J=J.concat([]),$.full=T$.util.format.apply(this,J)}};T$.log.prepareStandardFull=function($){if(!("standardFull"in $))T$.log.prepareStandard($),$.standardFull=$.standard};dY=["error","warning","info","debug","verbose"];for(bJ=0;bJ<dY.length;++bJ)(function(J){T$.log[J]=function(X,Q){var Y=Array.prototype.slice.call(arguments).slice(2),G={timestamp:new Date,level:J,category:X,message:Q,arguments:Y};T$.log.logMessage(G)}})(dY[bJ]);var dY,bJ;T$.log.makeLogger=function($){var J={flags:0,f:$};return T$.log.setLevel(J,"none"),J};T$.log.setLevel=function($,J){var X=!1;if($&&!($.flags&T$.log.LEVEL_LOCKED))for(var Q=0;Q<T$.log.levels.length;++Q){var Y=T$.log.levels[Q];if(J==Y){$.level=J,X=!0;break}}return X};T$.log.lock=function($,J){if(typeof J>"u"||J)$.flags|=T$.log.LEVEL_LOCKED;else $.flags&=~T$.log.LEVEL_LOCKED};T$.log.addLogger=function($){l8.push($)};if(typeof console<"u"&&"log"in console){if(console.error&&console.warn&&console.info&&console.debug)p8={error:console.error,warning:console.warn,info:console.info,debug:console.debug,verbose:console.debug},bQ=function($,J){T$.log.prepareStandard(J);var X=p8[J.level],Q=[J.standard];Q=Q.concat(J.arguments.slice()),X.apply(console,Q)},OQ=T$.log.makeLogger(bQ);else bQ=function(J,X){T$.log.prepareStandardFull(X),console.log(X.standardFull)},OQ=T$.log.makeLogger(bQ);T$.log.setLevel(OQ,"debug"),T$.log.addLogger(OQ),wX=OQ}else console={log:function(){}};var OQ,p8,bQ;if(wX!==null&&typeof window<"u"&&window.location){if(yQ=new URL(window.location.href).searchParams,yQ.has("console.level"))T$.log.setLevel(wX,yQ.get("console.level").slice(-1)[0]);if(yQ.has("console.lock")){if(d8=yQ.get("console.lock").slice(-1)[0],d8=="true")T$.log.lock(wX)}}var yQ,d8;T$.log.consoleLogger=wX});var RW=H$((hF,AW)=>{AW.exports=eJ();BY();wQ();X8();v8()});var BW=H$((uF,ZW)=>{var p=F$();w0();mJ();AX();P0();JQ();L8();_J();_$();bY();var B=p.asn1,DJ=ZW.exports=p.pkcs7=p.pkcs7||{};DJ.messageFromPem=function($){var J=p.pem.decode($)[0];if(J.type!=="PKCS7"){var X=Error('Could not convert PKCS#7 message from PEM; PEM header type is not "PKCS#7".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PKCS#7 message from PEM; PEM is encrypted.");var Q=B.fromDer(J.body);return DJ.messageFromAsn1(Q)};DJ.messageToPem=function($,J){var X={type:"PKCS7",body:B.toDer($.toAsn1()).getBytes()};return p.pem.encode(X,{maxline:J})};DJ.messageFromAsn1=function($){var J={},X=[];if(!B.validate($,DJ.asn1.contentInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 message. ASN.1 object is not an PKCS#7 ContentInfo.");throw Q.errors=X,Q}var Y=B.derToOid(J.contentType),G;switch(Y){case p.pki.oids.envelopedData:G=DJ.createEnvelopedData();break;case p.pki.oids.encryptedData:G=DJ.createEncryptedData();break;case p.pki.oids.signedData:G=DJ.createSignedData();break;default:throw Error("Cannot read PKCS#7 message. ContentType with OID "+Y+" is not (yet) supported.")}return G.fromAsn1(J.content.value[0]),G};DJ.createSignedData=function(){var $=null;return $={type:p.pki.oids.signedData,version:1,certificates:[],crls:[],signers:[],digestAlgorithmIdentifiers:[],contentInfo:null,signerInfos:[],fromAsn1:function(Q){if(n8($,Q,DJ.asn1.signedDataValidator),$.certificates=[],$.crls=[],$.digestAlgorithmIdentifiers=[],$.contentInfo=null,$.signerInfos=[],$.rawCapture.certificates){var Y=$.rawCapture.certificates.value;for(var G=0;G<Y.length;++G)$.certificates.push(p.pki.certificateFromAsn1(Y[G]))}},toAsn1:function(){if(!$.contentInfo)$.sign();var Q=[];for(var Y=0;Y<$.certificates.length;++Y)Q.push(p.pki.certificateToAsn1($.certificates[Y]));var G=[],W=B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,$.digestAlgorithmIdentifiers),$.contentInfo])]);if(Q.length>0)W.value[0].value.push(B.create(B.Class.CONTEXT_SPECIFIC,0,!0,Q));if(G.length>0)W.value[0].value.push(B.create(B.Class.CONTEXT_SPECIFIC,1,!0,G));return W.value[0].value.push(B.create(B.Class.UNIVERSAL,B.Type.SET,!0,$.signerInfos)),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),W])},addSigner:function(Q){var{issuer:Y,serialNumber:G}=Q;if(Q.certificate){var W=Q.certificate;if(typeof W==="string")W=p.pki.certificateFromPem(W);Y=W.issuer.attributes,G=W.serialNumber}var U=Q.key;if(!U)throw Error("Could not add PKCS#7 signer; no private key specified.");if(typeof U==="string")U=p.pki.privateKeyFromPem(U);var M=Q.digestAlgorithm||p.pki.oids.sha1;switch(M){case p.pki.oids.sha1:case p.pki.oids.sha256:case p.pki.oids.sha384:case p.pki.oids.sha512:case p.pki.oids.md5:break;default:throw Error("Could not add PKCS#7 signer; unknown message digest algorithm: "+M)}var O=Q.authenticatedAttributes||[];if(O.length>0){var V=!1,H=!1;for(var q=0;q<O.length;++q){var F=O[q];if(!V&&F.type===p.pki.oids.contentType){if(V=!0,H)break;continue}if(!H&&F.type===p.pki.oids.messageDigest){if(H=!0,V)break;continue}}if(!V||!H)throw Error("Invalid signer.authenticatedAttributes. If signer.authenticatedAttributes is specified, then it must contain at least two attributes, PKCS #9 content-type and PKCS #9 message-digest.")}$.signers.push({key:U,version:1,issuer:Y,serialNumber:G,digestAlgorithm:M,signatureAlgorithm:p.pki.oids.rsaEncryption,signature:null,authenticatedAttributes:O,unauthenticatedAttributes:[]})},sign:function(Q){if(Q=Q||{},typeof $.content!=="object"||$.contentInfo===null){if($.contentInfo=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(p.pki.oids.data).getBytes())]),"content"in $){var Y;if($.content instanceof p.util.ByteBuffer)Y=$.content.bytes();else if(typeof $.content==="string")Y=p.util.encodeUtf8($.content);if(Q.detached)$.detachedContent=B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,Y);else $.contentInfo.value.push(B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,Y)]))}}if($.signers.length===0)return;var G=J();X(G)},verify:function(){throw Error("PKCS#7 signature verification not yet implemented.")},addCertificate:function(Q){if(typeof Q==="string")Q=p.pki.certificateFromPem(Q);$.certificates.push(Q)},addCertificateRevokationList:function(Q){throw Error("PKCS#7 CRL support not yet implemented.")}},$;function J(){var Q={};for(var Y=0;Y<$.signers.length;++Y){var G=$.signers[Y],W=G.digestAlgorithm;if(!(W in Q))Q[W]=p.md[p.pki.oids[W]].create();if(G.authenticatedAttributes.length===0)G.md=Q[W];else G.md=p.md[p.pki.oids[W]].create()}$.digestAlgorithmIdentifiers=[];for(var W in Q)$.digestAlgorithmIdentifiers.push(B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(W).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]));return Q}function X(Q){var Y;if($.detachedContent)Y=$.detachedContent;else Y=$.contentInfo.value[1],Y=Y.value[0];if(!Y)throw Error("Could not sign PKCS#7 message; there is no content to sign.");var G=B.derToOid($.contentInfo.value[0].value),W=B.toDer(Y);W.getByte(),B.getBerValueLength(W),W=W.getBytes();for(var U in Q)Q[U].start().update(W);var M=new Date;for(var O=0;O<$.signers.length;++O){var V=$.signers[O];if(V.authenticatedAttributes.length===0){if(G!==p.pki.oids.data)throw Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.")}else{V.authenticatedAttributesAsn1=B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[]);var H=B.create(B.Class.UNIVERSAL,B.Type.SET,!0,[]);for(var q=0;q<V.authenticatedAttributes.length;++q){var F=V.authenticatedAttributes[q];if(F.type===p.pki.oids.messageDigest)F.value=Q[V.digestAlgorithm].digest();else if(F.type===p.pki.oids.signingTime){if(!F.value)F.value=M}H.value.push(c8(F)),V.authenticatedAttributesAsn1.value.push(c8(F))}W=B.toDer(H).getBytes(),V.md.start().update(W)}V.signature=V.key.sign(V.md,"RSASSA-PKCS1-V1_5")}$.signerInfos=kH($.signers)}};DJ.createEncryptedData=function(){var $=null;return $={type:p.pki.oids.encryptedData,version:0,encryptedContent:{algorithm:p.pki.oids["aes256-CBC"]},fromAsn1:function(J){n8($,J,DJ.asn1.encryptedDataValidator)},decrypt:function(J){if(J!==void 0)$.encryptedContent.key=J;DW($)}},$};DJ.createEnvelopedData=function(){var $=null;return $={type:p.pki.oids.envelopedData,version:0,recipients:[],encryptedContent:{algorithm:p.pki.oids["aes256-CBC"]},fromAsn1:function(J){var X=n8($,J,DJ.asn1.envelopedDataValidator);$.recipients=_H(X.recipientInfos.value)},toAsn1:function(){return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,xH($.recipients)),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,fH($.encryptedContent))])])])},findRecipient:function(J){var X=J.issuer.attributes;for(var Q=0;Q<$.recipients.length;++Q){var Y=$.recipients[Q],G=Y.issuer;if(Y.serialNumber!==J.serialNumber)continue;if(G.length!==X.length)continue;var W=!0;for(var U=0;U<X.length;++U)if(G[U].type!==X[U].type||G[U].value!==X[U].value){W=!1;break}if(W)return Y}return null},decrypt:function(J,X){if($.encryptedContent.key===void 0&&J!==void 0&&X!==void 0)switch(J.encryptedContent.algorithm){case p.pki.oids.rsaEncryption:case p.pki.oids.desCBC:var Q=X.decrypt(J.encryptedContent.content);$.encryptedContent.key=p.util.createBuffer(Q);break;default:throw Error("Unsupported asymmetric cipher, OID "+J.encryptedContent.algorithm)}DW($)},addRecipient:function(J){$.recipients.push({version:0,issuer:J.issuer.attributes,serialNumber:J.serialNumber,encryptedContent:{algorithm:p.pki.oids.rsaEncryption,key:J.publicKey}})},encrypt:function(J,X){if($.encryptedContent.content===void 0){X=X||$.encryptedContent.algorithm,J=J||$.encryptedContent.key;var Q,Y,G;switch(X){case p.pki.oids["aes128-CBC"]:Q=16,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["aes192-CBC"]:Q=24,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["aes256-CBC"]:Q=32,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["des-EDE3-CBC"]:Q=24,Y=8,G=p.des.createEncryptionCipher;break;default:throw Error("Unsupported symmetric cipher, OID "+X)}if(J===void 0)J=p.util.createBuffer(p.random.getBytes(Q));else if(J.length()!=Q)throw Error("Symmetric key has wrong length; got "+J.length()+" bytes, expected "+Q+".");$.encryptedContent.algorithm=X,$.encryptedContent.key=J,$.encryptedContent.parameter=p.util.createBuffer(p.random.getBytes(Y));var W=G(J);if(W.start($.encryptedContent.parameter.copy()),W.update($.content),!W.finish())throw Error("Symmetric encryption failed.");$.encryptedContent.content=W.output}for(var U=0;U<$.recipients.length;++U){var M=$.recipients[U];if(M.encryptedContent.content!==void 0)continue;switch(M.encryptedContent.algorithm){case p.pki.oids.rsaEncryption:M.encryptedContent.content=M.encryptedContent.key.encrypt($.encryptedContent.key.data);break;default:throw Error("Unsupported asymmetric cipher, OID "+M.encryptedContent.algorithm)}}}},$};function wH($){var J={},X=[];if(!B.validate($,DJ.asn1.recipientInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 RecipientInfo. ASN.1 object is not an PKCS#7 RecipientInfo.");throw Q.errors=X,Q}return{version:J.version.charCodeAt(0),issuer:p.pki.RDNAttributesAsArray(J.issuer),serialNumber:p.util.createBuffer(J.serial).toHex(),encryptedContent:{algorithm:B.derToOid(J.encAlgorithm),parameter:J.encParameter?J.encParameter.value:void 0,content:J.encKey}}}function PH($){return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[p.pki.distinguishedNameToAsn1({attributes:$.issuer}),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,p.util.hexToBytes($.serialNumber))]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.encryptedContent.algorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]),B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.encryptedContent.content)])}function _H($){var J=[];for(var X=0;X<$.length;++X)J.push(wH($[X]));return J}function xH($){var J=[];for(var X=0;X<$.length;++X)J.push(PH($[X]));return J}function vH($){var J=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[p.pki.distinguishedNameToAsn1({attributes:$.issuer}),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,p.util.hexToBytes($.serialNumber))]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.digestAlgorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")])]);if($.authenticatedAttributesAsn1)J.value.push($.authenticatedAttributesAsn1);if(J.value.push(B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.signatureAlgorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")])),J.value.push(B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.signature)),$.unauthenticatedAttributes.length>0){var X=B.create(B.Class.CONTEXT_SPECIFIC,1,!0,[]);for(var Q=0;Q<$.unauthenticatedAttributes.length;++Q){var Y=$.unauthenticatedAttributes[Q];X.values.push(c8(Y))}J.value.push(X)}return J}function kH($){var J=[];for(var X=0;X<$.length;++X)J.push(vH($[X]));return J}function c8($){var J;if($.type===p.pki.oids.contentType)J=B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.value).getBytes());else if($.type===p.pki.oids.messageDigest)J=B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.value.bytes());else if($.type===p.pki.oids.signingTime){var X=new Date("1950-01-01T00:00:00Z"),Q=new Date("2050-01-01T00:00:00Z"),Y=$.value;if(typeof Y==="string"){var G=Date.parse(Y);if(!isNaN(G))Y=new Date(G);else if(Y.length===13)Y=B.utcTimeToDate(Y);else Y=B.generalizedTimeToDate(Y)}if(Y>=X&&Y<Q)J=B.create(B.Class.UNIVERSAL,B.Type.UTCTIME,!1,B.dateToUtcTime(Y));else J=B.create(B.Class.UNIVERSAL,B.Type.GENERALIZEDTIME,!1,B.dateToGeneralizedTime(Y))}return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,[J])])}function fH($){return[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(p.pki.oids.data).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.algorithm).getBytes()),!$.parameter?void 0:B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.parameter.getBytes())]),B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.content.getBytes())])]}function n8($,J,X){var Q={},Y=[];if(!B.validate(J,X,Q,Y)){var G=Error("Cannot read PKCS#7 message. ASN.1 object is not a supported PKCS#7 message.");throw G.errors=G,G}var W=B.derToOid(Q.contentType);if(W!==p.pki.oids.data)throw Error("Unsupported PKCS#7 message. Only wrapped ContentType Data supported.");if(Q.encryptedContent){var U="";if(p.util.isArray(Q.encryptedContent))for(var M=0;M<Q.encryptedContent.length;++M){if(Q.encryptedContent[M].type!==B.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting encrypted content constructed of only OCTET STRING objects.");U+=Q.encryptedContent[M].value}else U=Q.encryptedContent;$.encryptedContent={algorithm:B.derToOid(Q.encAlgorithm),parameter:p.util.createBuffer(Q.encParameter.value),content:p.util.createBuffer(U)}}if(Q.content){var U="";if(p.util.isArray(Q.content))for(var M=0;M<Q.content.length;++M){if(Q.content[M].type!==B.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting content constructed of only OCTET STRING objects.");U+=Q.content[M].value}else U=Q.content;$.content=p.util.createBuffer(U)}return $.version=Q.version.charCodeAt(0),$.rawCapture=Q,Q}function DW($){if($.encryptedContent.key===void 0)throw Error("Symmetric key not available.");if($.content===void 0){var J;switch($.encryptedContent.algorithm){case p.pki.oids["aes128-CBC"]:case p.pki.oids["aes192-CBC"]:case p.pki.oids["aes256-CBC"]:J=p.aes.createDecryptionCipher($.encryptedContent.key);break;case p.pki.oids.desCBC:case p.pki.oids["des-EDE3-CBC"]:J=p.des.createDecryptionCipher($.encryptedContent.key);break;default:throw Error("Unsupported symmetric cipher, OID "+$.encryptedContent.algorithm)}if(J.start($.encryptedContent.parameter),J.update($.encryptedContent.content),!J.finish())throw Error("Symmetric decryption failed.");$.content=J.output}}});var TW=H$((gF,jW)=>{var YJ=F$();w0();TQ();BY();wQ();_$();var iY=jW.exports=YJ.ssh=YJ.ssh||{};iY.privateKeyToPutty=function($,J,X){X=X||"",J=J||"";var Q="ssh-rsa",Y=J===""?"none":"aes256-cbc",G="PuTTY-User-Key-File-2: "+Q+`\r
16
16
  `;G+="Encryption: "+Y+`\r
17
17
  `,G+="Comment: "+X+`\r
18
- `;var W=QJ.util.createBuffer();hQ(W,Q),U0(W,$.e),U0(W,$.n);var U=QJ.util.encode64(W.bytes(),64),M=Math.floor(U.length/66)+1;G+="Public-Lines: "+M+`\r
19
- `,G+=U;var O=QJ.util.createBuffer();U0(O,$.d),U0(O,$.p),U0(O,$.q),U0(O,$.qInv);var V;if(!J)V=QJ.util.encode64(O.bytes(),64);else{var H=O.length()+16-1;H-=H%16;var q=cY(O.bytes());q.truncate(q.length()-H+O.length()),O.putBuffer(q);var F=QJ.util.createBuffer();F.putBuffer(cY("\x00\x00\x00\x00",J)),F.putBuffer(cY("\x00\x00\x00\x01",J));var K=QJ.aes.createEncryptionCipher(F.truncate(8),"CBC");K.start(QJ.util.createBuffer().fillWithByte(0,16)),K.update(O.copy()),K.finish();var A=K.output;A.truncate(16),V=QJ.util.encode64(A.bytes(),64)}M=Math.floor(V.length/66)+1,G+=`\r
18
+ `;var W=YJ.util.createBuffer();hQ(W,Q),U0(W,$.e),U0(W,$.n);var U=YJ.util.encode64(W.bytes(),64),M=Math.floor(U.length/66)+1;G+="Public-Lines: "+M+`\r
19
+ `,G+=U;var O=YJ.util.createBuffer();U0(O,$.d),U0(O,$.p),U0(O,$.q),U0(O,$.qInv);var V;if(!J)V=YJ.util.encode64(O.bytes(),64);else{var H=O.length()+16-1;H-=H%16;var q=nY(O.bytes());q.truncate(q.length()-H+O.length()),O.putBuffer(q);var F=YJ.util.createBuffer();F.putBuffer(nY("\x00\x00\x00\x00",J)),F.putBuffer(nY("\x00\x00\x00\x01",J));var K=YJ.aes.createEncryptionCipher(F.truncate(8),"CBC");K.start(YJ.util.createBuffer().fillWithByte(0,16)),K.update(O.copy()),K.finish();var A=K.output;A.truncate(16),V=YJ.util.encode64(A.bytes(),64)}M=Math.floor(V.length/66)+1,G+=`\r
20
20
  Private-Lines: `+M+`\r
21
- `,G+=V;var L=cY("putty-private-key-file-mac-key",J),R=QJ.util.createBuffer();hQ(R,Q),hQ(R,Y),hQ(R,X),R.putInt32(W.length()),R.putBuffer(W),R.putInt32(O.length()),R.putBuffer(O);var I=QJ.hmac.create();return I.start("sha1",L),I.update(R.bytes()),G+=`\r
21
+ `,G+=V;var L=nY("putty-private-key-file-mac-key",J),R=YJ.util.createBuffer();hQ(R,Q),hQ(R,Y),hQ(R,X),R.putInt32(W.length()),R.putBuffer(W),R.putInt32(O.length()),R.putBuffer(O);var I=YJ.hmac.create();return I.start("sha1",L),I.update(R.bytes()),G+=`\r
22
22
  Private-MAC: `+I.digest().toHex()+`\r
23
- `,G};nY.publicKeyToOpenSSH=function($,J){var X="ssh-rsa";J=J||"";var Q=QJ.util.createBuffer();return hQ(Q,X),U0(Q,$.e),U0(Q,$.n),X+" "+QJ.util.encode64(Q.bytes())+" "+J};nY.privateKeyToOpenSSH=function($,J){if(!J)return QJ.pki.privateKeyToPem($);return QJ.pki.encryptRsaPrivateKey($,J,{legacy:!0,algorithm:"aes128"})};nY.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||QJ.md.md5.create(),Q="ssh-rsa",Y=QJ.util.createBuffer();hQ(Y,Q),U0(Y,$.e),U0(Y,$.n),X.start(),X.update(Y.getBytes());var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};function U0($,J){var X=J.toString(16);if(X[0]>="8")X="00"+X;var Q=QJ.util.hexToBytes(X);$.putInt32(Q.length),$.putBytes(Q)}function hQ($,J){$.putInt32(J.length),$.putString(J)}function cY(){var $=QJ.md.sha1.create(),J=arguments.length;for(var X=0;X<J;++X)$.update(arguments[X]);return $.digest()}});var n8=O$((yF,TW)=>{TW.exports=z$();w0();o1();mJ();EY();AX();HW();TQ();EW();NW();AW();L8();SY();JQ();H8();D8();ZW();B8();K8();X8();vY();_J();W8();jW();w8();w$()});var q4=O$((yN,H4)=>{var{create:vq,defineProperty:Q9,getOwnPropertyDescriptor:kq,getOwnPropertyNames:fq,getPrototypeOf:yq}=Object,bq=Object.prototype.hasOwnProperty,hq=($,J)=>{for(var X in J)Q9($,X,{get:J[X],enumerable:!0})},W4=($,J,X,Q)=>{if(J&&typeof J==="object"||typeof J==="function"){for(let Y of fq(J))if(!bq.call($,Y)&&Y!==X)Q9($,Y,{get:()=>J[Y],enumerable:!(Q=kq(J,Y))||Q.enumerable})}return $},U4=($,J,X)=>(X=$!=null?vq(yq($)):{},W4(J||!$||!$.__esModule?Q9(X,"default",{value:$,enumerable:!0}):X,$)),uq=($)=>W4(Q9({},"__esModule",{value:!0}),$),M4={};hq(M4,{Socks5Server:()=>V4,createServer:()=>pq,defaultConnectionHandler:()=>q7});H4.exports=uq(M4);var gq=U4(OX("net")),O4=(($)=>{return $[$.connect=1]="connect",$[$.bind=2]="bind",$[$.udp=3]="udp",$})(O4||{}),H7=(($)=>{return $[$.REQUEST_GRANTED=0]="REQUEST_GRANTED",$[$.GENERAL_FAILURE=1]="GENERAL_FAILURE",$[$.CONNECTION_NOT_ALLOWED=2]="CONNECTION_NOT_ALLOWED",$[$.NETWORK_UNREACHABLE=3]="NETWORK_UNREACHABLE",$[$.HOST_UNREACHABLE=4]="HOST_UNREACHABLE",$[$.CONNECTION_REFUSED=5]="CONNECTION_REFUSED",$[$.TTL_EXPIRED=6]="TTL_EXPIRED",$[$.COMMAND_NOT_SUPPORTED=7]="COMMAND_NOT_SUPPORTED",$[$.ADDRESS_TYPE_NOT_SUPPORTED=8]="ADDRESS_TYPE_NOT_SUPPORTED",$})(H7||{}),mq=class{constructor($,J){this.errorHandler=()=>{},this.metadata={},this.socket=J,this.server=$,J.on("error",this.errorHandler),J.pause(),this.handleGreeting()}readBytes($){return new Promise((J)=>{let X=Buffer.allocUnsafe($),Q=0,Y=(G)=>{let W=Math.min(G.length,$-Q);if(G.copy(X,Q,0,W),Q+=W,Q<$)return;this.socket.removeListener("data",Y),this.socket.push(G.subarray(W)),J(X),this.socket.pause()};this.socket.on("data",Y),this.socket.resume()})}async handleGreeting(){if((await this.readBytes(1)).readUInt8()!==5)return this.socket.destroy();let J=(await this.readBytes(1)).readUInt8();if(J>128||J===0)return this.socket.destroy();let X=await this.readBytes(J),Q=this.server.authHandler?2:0;if(!X.includes(Q))return this.socket.write(Buffer.from([5,255])),this.socket.destroy();if(this.socket.write(Buffer.from([5,Q])),this.server.authHandler)this.handleUserPassword();else this.handleConnectionRequest()}async handleUserPassword(){await this.readBytes(1);let $=(await this.readBytes(1)).readUint8(),J=(await this.readBytes($)).toString(),X=(await this.readBytes(1)).readUint8(),Q=(await this.readBytes(X)).toString();this.username=J,this.password=Q;let Y=!1,G=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,0])),this.handleConnectionRequest()},W=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,1])),this.socket.destroy()},U=await this.server.authHandler(this,G,W);if(U===!0)G();else if(U===!1)W()}async handleConnectionRequest(){await this.readBytes(1);let $=(await this.readBytes(1))[0],J=O4[$];if(!J)return this.socket.destroy();this.command=J,await this.readBytes(1);let X=(await this.readBytes(1)).readUInt8(),Q="";switch(X){case 1:Q=(await this.readBytes(4)).join(".");break;case 3:let O=(await this.readBytes(1)).readUInt8();Q=(await this.readBytes(O)).toString();break;case 4:let V=await this.readBytes(16);for(let H=0;H<16;H++){if(H%2===0&&H>0)Q+=":";Q+=`${V[H]<16?"0":""}${V[H].toString(16)}`}break;default:this.socket.destroy();return}let Y=(await this.readBytes(2)).readUInt16BE();if(!this.server.supportedCommands.has(J))return this.socket.write(Buffer.from([5,7])),this.socket.destroy();this.destAddress=Q,this.destPort=Y;let G=!1,W=()=>{if(G)return;G=!0,this.connect()};if(!this.server.rulesetValidator)return W();let U=()=>{if(G)return;G=!0,this.socket.write(Buffer.from([5,2,0,1,0,0,0,0,0,0])),this.socket.destroy()},M=await this.server.rulesetValidator(this,W,U);if(M===!0)W();else if(M===!1)U()}connect(){this.socket.removeListener("error",this.errorHandler),this.server.connectionHandler(this,($)=>{if(H7[$]===void 0)throw Error(`"${$}" is not a valid status.`);if(this.socket.write(Buffer.from([5,H7[$],0,1,0,0,0,0,0,0])),$!=="REQUEST_GRANTED")this.socket.destroy()}),this.socket.resume()}},lq=U4(OX("net"));function q7($,J){if($.command!=="connect")return J("COMMAND_NOT_SUPPORTED");$.socket.on("error",()=>{});let X=lq.default.createConnection({host:$.destAddress,port:$.destPort});X.setNoDelay();let Q=!1;return X.on("error",(Y)=>{if(!Q)switch(Y.code){case"EINVAL":case"ENOENT":case"ENOTFOUND":case"ETIMEDOUT":case"EADDRNOTAVAIL":case"EHOSTUNREACH":J("HOST_UNREACHABLE");break;case"ENETUNREACH":J("NETWORK_UNREACHABLE");break;case"ECONNREFUSED":J("CONNECTION_REFUSED");break;default:J("GENERAL_FAILURE")}}),X.on("ready",()=>{Q=!0,J("REQUEST_GRANTED"),$.socket.pipe(X).pipe($.socket)}),$.socket.on("close",()=>X.destroy()),X}var V4=class{constructor(){this.supportedCommands=new Set(["connect"]),this.connectionHandler=q7,this.server=gq.default.createServer(($)=>{$.setNoDelay(),this._handleConnection($)})}listen(...$){return this.server.listen(...$),this}close($){return this.server.close($),this}setAuthHandler($){return this.authHandler=$,this}disableAuthHandler(){return this.authHandler=void 0,this}setRulesetValidator($){return this.rulesetValidator=$,this}disableRulesetValidator(){return this.rulesetValidator=void 0,this}setConnectionHandler($){return this.connectionHandler=$,this}useDefaultConnectionHandler(){return this.connectionHandler=q7,this}_handleConnection($){return new mq(this,$),this}};function pq($){let J=new V4;if($?.auth)J.setAuthHandler((X)=>{return X.username===$.auth.username&&X.password===$.auth.password});if($?.port)J.listen($.port,$.hostname);return J}});import{Agent as Iq,createServer as Cq}from"http";import{request as V7}from"http";import{request as X4}from"https";import{connect as wq,isIP as Pq}from"net";import{URL as Y4}from"url";function Z($,J){if(!process.env.SRT_DEBUG)return;let X=J?.level||"info",Q="[SandboxDebug]";switch(X){case"error":console.error(`${Q} ${$}`);break;case"warn":console.warn(`${Q} ${$}`);break;default:console.error(`${Q} ${$}`)}}import{timingSafeEqual as gU}from"crypto";function MY($,J){let X=Buffer.from($),Q=Buffer.from(J);if(X.length!==Q.length)return!1;return gU(X,Q)}import{homedir as OY}from"os";import*as UJ from"path";import*as r0 from"fs";import*as qG from"fs";function m9(){if(process.platform!=="linux")return;try{let $=qG.readFileSync("/proc/version",{encoding:"utf8"}),J=$.match(/WSL(\d+)/i);if(J&&J[1])return J[1];if($.toLowerCase().includes("microsoft"))return"1";return}catch{return}}function x$(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"unknown"}}var VX=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json"],mU=[".git",".vscode",".idea"];function HY(){return[...mU.filter(($)=>$!==".git"),".claude/commands",".claude/agents"]}function l9($){return $.toLowerCase()}function NJ($){return $.includes("*")||$.includes("?")||$.includes("[")||$.includes("]")}function HX($){return $.includes("*")||$.includes("?")}function KG($){return x$()==="windows"?HX($):NJ($)}function zG($){if(/^\\\\\?\\unc\\/i.test($))return"\\\\"+$.slice(8);if($.startsWith("\\\\?\\"))return $.slice(4);return $}function qX($){let J=UJ.win32.toNamespacedPath($);return/^[\\/]{2}[?.][\\/]unc[\\/]/i.test(J)}function E0($){return $.replace(/\/\*\*$/,"")||"/"}function VY($,J){let X=UJ.normalize($),Q=UJ.normalize(J);if(Q===X)return!1;if(X.startsWith("/tmp/")&&Q==="/private"+X)return!1;if(X.startsWith("/var/")&&Q==="/private"+X)return!1;if(X.startsWith("/private/tmp/")&&Q===X)return!1;if(X.startsWith("/private/var/")&&Q===X)return!1;if(Q==="/")return!0;if(Q.split("/").filter(Boolean).length<=1)return!0;if(X.startsWith(Q+"/"))return!0;let G=X;if(X.startsWith("/tmp/"))G="/private"+X;else if(X.startsWith("/var/"))G="/private"+X;if(G!==X&&G.startsWith(Q+"/"))return!0;let W=Q.startsWith(X+"/"),U=G!==X&&Q.startsWith(G+"/");if(Q!==X&&!(G!==X&&Q===G)&&!W&&!U)return!0;return!1}function lU($){if($==="~")return OY();if($.startsWith("~/")||process.platform==="win32"&&$.startsWith("~\\"))return OY()+$.slice(1);return $}function pU($){let J=OY(),X=/^[A-Za-z]:/.test(J)?J.slice(0,2):"",Q=X?J.slice(2):J;return $.replace(/%USERPROFILE%/gi,J).replace(/%HOMEDRIVE%/gi,X).replace(/%HOMEPATH%/gi,Q)}function JJ($){let J=process.cwd();if(x$()==="windows"){if($=zG(pU($)),/^[a-z]:/.test($))$=$[0].toUpperCase()+$.slice(1);if(qX($)&&!HX($))return UJ.win32.normalize($)}if(x$()!=="windows"&&$.endsWith("/")&&$!=="/"&&!KG($))$=$.replace(/\/+$/,"")||"/";let X=lU($);if(X!==$);else if($.startsWith("./")||$.startsWith("../"))X=UJ.resolve(J,$);else if(!UJ.isAbsolute($))X=UJ.resolve(J,$);if(KG(X)){let Q=x$()==="windows"?/[*?]/:/[*?[\]]/,Y=X.split(Q)[0];if(Y&&Y!=="/"){let G=Y.endsWith("/")?Y.slice(0,-1):UJ.dirname(Y);try{let W=r0.realpathSync(G);if(!VY(G,W)){let U=X.slice(G.length);return W+U}}catch{}}return X}try{let Q=r0.realpathSync(X);if(VY(X,Q));else X=Q}catch{}return X}function DQ($){let J=$??OY();return["/dev/stdout","/dev/stderr","/dev/null","/dev/tty","/dev/dtracehelper","/dev/autofs_nowait","/tmp/claude","/private/tmp/claude",UJ.join(J,".npm/_logs"),UJ.join(J,".claude/debug")]}var dU=["NODE_EXTRA_CA_CERTS","SSL_CERT_FILE","CURL_CA_BUNDLE","REQUESTS_CA_BUNDLE","PIP_CERT","GIT_SSL_CAINFO","AWS_CA_BUNDLE","CARGO_HTTP_CAINFO","DENO_CERT","CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","NIX_SSL_CERT_FILE"];function ZQ($,J,X,Q,Y,G){let W=nU(G),U=W===z0?W:encodeURIComponent(W),M=Q?`${U}:${Q}@`:"",O=x$()==="linux"?"127.0.0.1":"localhost",V=["SANDBOX_RUNTIME=1"];if(!Y){let F=process.env.CLAUDE_CODE_TMPDIR||process.env.CLAUDE_TMPDIR||"/tmp/claude";V.push(`TMPDIR=${F}`)}if(X)for(let F of dU)V.push(`${F}=${X}`);if(!$&&!J)return V;let H=["localhost","127.0.0.1","::1","169.254.0.0/16","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"].join(",");if(V.push(`NO_PROXY=${H}`),V.push(`no_proxy=${H}`),$){if(V.push(`HTTP_PROXY=http://${M}${O}:${$}`),V.push(`HTTPS_PROXY=http://${M}${O}:${$}`),V.push(`http_proxy=http://${M}${O}:${$}`),V.push(`https_proxy=http://${M}${O}:${$}`),Q)V.push("GIT_CONFIG_PARAMETERS='http.proxyAuthMethod=basic'")}let q=$?`http://${M}${O}:${$}`:`socks5h://${M}${O}:${J}`;if(V.push(`ALL_PROXY=${q}`),V.push(`all_proxy=${q}`),V.push(`GRPC_PROXY=${q}`),V.push(`grpc_proxy=${q}`),J){let K=x$();if(K==="macos")V.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:${J} %h %p'`);else if(K==="linux"&&$){let A=Q?`,proxyauth=${W}:${Q}`:"";V.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='socat - PROXY:${O}:%h:%p,proxyport=${$}${A}'`)}if(V.push(`FTP_PROXY=socks5h://${M}${O}:${J}`),V.push(`ftp_proxy=socks5h://${M}${O}:${J}`),V.push(`RSYNC_PROXY=${O}:${J}`),V.push(`DOCKER_HTTP_PROXY=http://${M}${O}:${$||J}`),V.push(`DOCKER_HTTPS_PROXY=http://${M}${O}:${$||J}`),$){if(V.push("CLOUDSDK_PROXY_TYPE=http"),V.push(`CLOUDSDK_PROXY_ADDRESS=${O}`),V.push(`CLOUDSDK_PROXY_PORT=${$}`),Q)V.push(`CLOUDSDK_PROXY_USERNAME=${W}`),V.push(`CLOUDSDK_PROXY_PASSWORD=${Q}`)}}return V}var cU=8;function KX($){if($.baseEnv?.GIT_CONFIG_COUNT==="0")return{};let J=Number.parseInt($.baseEnv?.GIT_CONFIG_COUNT??"",10),X=Number.isFinite(J)&&J>=0?J:0,Q=X,Y={},G=(U,M)=>{Y[`GIT_CONFIG_KEY_${Q}`]=U,Y[`GIT_CONFIG_VALUE_${Q}`]=M,Q++},W=[...new Set($.safeDirs.filter((U)=>!!U).map((U)=>{let O=U.replace(/\\/g,"/").replace(/\/+$/,"");if(O===""||/^[A-Za-z]:$/.test(O))return`${O}/`;return O}))];if(W.length>cU)G("safe.directory","*");else for(let U of W)G("safe.directory",U),G("safe.directory",U.endsWith("/")?`${U}*`:`${U}/*`);if($.schannelCa)G("http.schannelUseSSLCAInfo","true"),G("http.schannelCheckRevoke","false");if(Q===X)return{};return Y.GIT_CONFIG_COUNT=String(Q),Y}function qY($){let J={GIT_CONFIG_COUNT:process.env.GIT_CONFIG_COUNT};for(let X of $.unsetEnvVars??[])delete J[X];return Object.assign(J,$.setEnvVars??{}),KX({safeDirs:$.safeDirs,baseEnv:J})}function PJ($){let J=$.slice(0,100);return Buffer.from(J).toString("base64")}function t0($){return Buffer.from($,"base64").toString("utf8")}var z0="srt";function nU($){if(!$)return z0;let J=`${z0}.${$}`;return Buffer.byteLength(J)<=255?J:z0}function KY($){if(!$||!$.startsWith(`${z0}.`))return;return $.slice(z0.length+1)||void 0}function zX($){return"^"+$.replace(/[.^$+{}()|\\]/g,"\\$&").replace(/\[([^\]]*?)$/g,"\\[$1").replace(/\*\*\//g,"__GLOBSTAR_SLASH__").replace(/\*\*/g,"__GLOBSTAR__").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/__GLOBSTAR_SLASH__/g,"(.*/)?").replace(/__GLOBSTAR__/g,".*")+"$"}function e0($,J={}){let X=(M)=>process.platform==="win32"?M.replace(/\\/g,"/"):M,Q=X(JJ($)),Y=Q.split(/[*?[\]]/)[0];if(!Y||Y==="/")return Z(`[Sandbox] Glob pattern too broad, skipping: ${$}`),[];let G=Y.endsWith("/")?Y.slice(0,-1):UJ.dirname(Y);if(!r0.existsSync(G))return Z(`[Sandbox] Base directory for glob does not exist: ${G}`),[];let W=new RegExp(zX(Q),J.caseInsensitive?"i":""),U=[];try{let M=r0.readdirSync(G,{recursive:!0,withFileTypes:!0});for(let O of M){let V=O.parentPath??O.path??G,H=UJ.join(V,O.name);if(W.test(X(H)))U.push(H)}}catch(M){Z(`[Sandbox] Error expanding glob pattern ${$}: ${M}`)}return U}var wW=g9(n8(),1);import{sign as kH,X509Certificate as fH}from"crypto";import{mkdtempSync as PW,readFileSync as i8,writeFileSync as o8}from"fs";import{rm as yH}from"fs/promises";import{tmpdir as _W}from"os";import{join as PX,dirname as SW}from"path";import{rootCertificates as bH}from"tls";var{asn1:r$,pki:pJ,md:hH,random:uH,util:xW}=wW.default,gH=pJ.getTBSCertificate,mH=/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g,iY="/srt.crl";function a8($){let J=$.getExtension("subjectKeyIdentifier");return J?.subjectKeyIdentifier?xW.hexToBytes(J.subjectKeyIdentifier):$.generateSubjectKeyIdentifier().getBytes()}function s8($,J){let X=pJ.oids.sha256WithRSAEncryption;$.siginfo.algorithmOid=X,$.signatureOid=X,$.tbsCertificate=gH($);let Q=r$.toDer($.tbsCertificate).getBytes();$.signature=vW(Q,J),$.md=hH.sha256.create(),$.md.update(Q)}function vW($,J){return kH("sha256",Buffer.from($,"binary"),J).toString("binary")}function r8($){if($.caCertPem&&$.caKeyPem){let J=xX($.caCertPem,$.caKeyPem);if(!J.ok)throw Error(`tlsTerminate: CA PEM pair: ${J.reason}`);return t8($.caCertPem,$.caKeyPem,J.cert,J.key,{certPath:$.caCertPath??"",keyPath:$.caKeyPath??"",extraCaCertPaths:$.extraCaCertPaths})}if($.caCertPath&&$.caKeyPath)return dH($.caCertPath,$.caKeyPath,$.extraCaCertPaths);if($.caCertPath||$.caKeyPath)throw Error("tlsTerminate: caCertPath and caKeyPath must be provided together");return cH($.extraCaCertPaths)}async function kW($){let J=new Set([SW($.trustBundlePath)]);if($.ephemeral)J.add(SW($.certPath));for(let X of J)try{await yH(X,{recursive:!0,force:!0})}catch(Q){Z(`[mitm-ca] cleanup failed: ${Q.message}`,{level:"warn"})}}function lH($,J,X){let Q=[J.trim(),...bH],Y=process.env.NODE_EXTRA_CA_CERTS;if(Y)try{Q.push(i8(Y,"utf8").trim())}catch{}for(let W of X??[]){let U;try{U=i8(W,"utf8")}catch(O){let V=O.code??String(O);Z(`[mitm-ca] extraCaCertPaths: cannot read ${W} (${V}); skipping`,{level:"warn"});continue}let M=U.match(mH);if(!M){Z(`[mitm-ca] extraCaCertPaths: ${W} has no PEM CERTIFICATE block; skipping`,{level:"warn"});continue}Q.push(...M)}let G=PX($,"trust-bundle.crt");return o8(G,Q.join(`
23
+ `,G};iY.publicKeyToOpenSSH=function($,J){var X="ssh-rsa";J=J||"";var Q=YJ.util.createBuffer();return hQ(Q,X),U0(Q,$.e),U0(Q,$.n),X+" "+YJ.util.encode64(Q.bytes())+" "+J};iY.privateKeyToOpenSSH=function($,J){if(!J)return YJ.pki.privateKeyToPem($);return YJ.pki.encryptRsaPrivateKey($,J,{legacy:!0,algorithm:"aes128"})};iY.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||YJ.md.md5.create(),Q="ssh-rsa",Y=YJ.util.createBuffer();hQ(Y,Q),U0(Y,$.e),U0(Y,$.n),X.start(),X.update(Y.getBytes());var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};function U0($,J){var X=J.toString(16);if(X[0]>="8")X="00"+X;var Q=YJ.util.hexToBytes(X);$.putInt32(Q.length),$.putBytes(Q)}function hQ($,J){$.putInt32(J.length),$.putString(J)}function nY(){var $=YJ.md.sha1.create(),J=arguments.length;for(var X=0;X<J;++X)$.update(arguments[X]);return $.digest()}});var i8=H$((mF,SW)=>{SW.exports=F$();w0();a1();mJ();FY();AX();qW();TQ();FW();LW();RW();A8();IY();JQ();q8();Z8();BW();j8();z8();Y8();kY();_J();U8();TW();P8();_$()});var K4=H$((mN,q4)=>{var{create:fq,defineProperty:X9,getOwnPropertyDescriptor:yq,getOwnPropertyNames:bq,getPrototypeOf:hq}=Object,uq=Object.prototype.hasOwnProperty,gq=($,J)=>{for(var X in J)X9($,X,{get:J[X],enumerable:!0})},U4=($,J,X,Q)=>{if(J&&typeof J==="object"||typeof J==="function"){for(let Y of bq(J))if(!uq.call($,Y)&&Y!==X)X9($,Y,{get:()=>J[Y],enumerable:!(Q=yq(J,Y))||Q.enumerable})}return $},M4=($,J,X)=>(X=$!=null?fq(hq($)):{},U4(J||!$||!$.__esModule?X9(X,"default",{value:$,enumerable:!0}):X,$)),mq=($)=>U4(X9({},"__esModule",{value:!0}),$),O4={};gq(O4,{Socks5Server:()=>H4,createServer:()=>cq,defaultConnectionHandler:()=>K7});q4.exports=mq(O4);var lq=M4(OX("net")),V4=(($)=>{return $[$.connect=1]="connect",$[$.bind=2]="bind",$[$.udp=3]="udp",$})(V4||{}),q7=(($)=>{return $[$.REQUEST_GRANTED=0]="REQUEST_GRANTED",$[$.GENERAL_FAILURE=1]="GENERAL_FAILURE",$[$.CONNECTION_NOT_ALLOWED=2]="CONNECTION_NOT_ALLOWED",$[$.NETWORK_UNREACHABLE=3]="NETWORK_UNREACHABLE",$[$.HOST_UNREACHABLE=4]="HOST_UNREACHABLE",$[$.CONNECTION_REFUSED=5]="CONNECTION_REFUSED",$[$.TTL_EXPIRED=6]="TTL_EXPIRED",$[$.COMMAND_NOT_SUPPORTED=7]="COMMAND_NOT_SUPPORTED",$[$.ADDRESS_TYPE_NOT_SUPPORTED=8]="ADDRESS_TYPE_NOT_SUPPORTED",$})(q7||{}),pq=class{constructor($,J){this.errorHandler=()=>{},this.metadata={},this.socket=J,this.server=$,J.on("error",this.errorHandler),J.pause(),this.handleGreeting()}readBytes($){return new Promise((J)=>{let X=Buffer.allocUnsafe($),Q=0,Y=(G)=>{let W=Math.min(G.length,$-Q);if(G.copy(X,Q,0,W),Q+=W,Q<$)return;this.socket.removeListener("data",Y),this.socket.push(G.subarray(W)),J(X),this.socket.pause()};this.socket.on("data",Y),this.socket.resume()})}async handleGreeting(){if((await this.readBytes(1)).readUInt8()!==5)return this.socket.destroy();let J=(await this.readBytes(1)).readUInt8();if(J>128||J===0)return this.socket.destroy();let X=await this.readBytes(J),Q=this.server.authHandler?2:0;if(!X.includes(Q))return this.socket.write(Buffer.from([5,255])),this.socket.destroy();if(this.socket.write(Buffer.from([5,Q])),this.server.authHandler)this.handleUserPassword();else this.handleConnectionRequest()}async handleUserPassword(){await this.readBytes(1);let $=(await this.readBytes(1)).readUint8(),J=(await this.readBytes($)).toString(),X=(await this.readBytes(1)).readUint8(),Q=(await this.readBytes(X)).toString();this.username=J,this.password=Q;let Y=!1,G=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,0])),this.handleConnectionRequest()},W=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,1])),this.socket.destroy()},U=await this.server.authHandler(this,G,W);if(U===!0)G();else if(U===!1)W()}async handleConnectionRequest(){await this.readBytes(1);let $=(await this.readBytes(1))[0],J=V4[$];if(!J)return this.socket.destroy();this.command=J,await this.readBytes(1);let X=(await this.readBytes(1)).readUInt8(),Q="";switch(X){case 1:Q=(await this.readBytes(4)).join(".");break;case 3:let O=(await this.readBytes(1)).readUInt8();Q=(await this.readBytes(O)).toString();break;case 4:let V=await this.readBytes(16);for(let H=0;H<16;H++){if(H%2===0&&H>0)Q+=":";Q+=`${V[H]<16?"0":""}${V[H].toString(16)}`}break;default:this.socket.destroy();return}let Y=(await this.readBytes(2)).readUInt16BE();if(!this.server.supportedCommands.has(J))return this.socket.write(Buffer.from([5,7])),this.socket.destroy();this.destAddress=Q,this.destPort=Y;let G=!1,W=()=>{if(G)return;G=!0,this.connect()};if(!this.server.rulesetValidator)return W();let U=()=>{if(G)return;G=!0,this.socket.write(Buffer.from([5,2,0,1,0,0,0,0,0,0])),this.socket.destroy()},M=await this.server.rulesetValidator(this,W,U);if(M===!0)W();else if(M===!1)U()}connect(){this.socket.removeListener("error",this.errorHandler),this.server.connectionHandler(this,($)=>{if(q7[$]===void 0)throw Error(`"${$}" is not a valid status.`);if(this.socket.write(Buffer.from([5,q7[$],0,1,0,0,0,0,0,0])),$!=="REQUEST_GRANTED")this.socket.destroy()}),this.socket.resume()}},dq=M4(OX("net"));function K7($,J){if($.command!=="connect")return J("COMMAND_NOT_SUPPORTED");$.socket.on("error",()=>{});let X=dq.default.createConnection({host:$.destAddress,port:$.destPort});X.setNoDelay();let Q=!1;return X.on("error",(Y)=>{if(!Q)switch(Y.code){case"EINVAL":case"ENOENT":case"ENOTFOUND":case"ETIMEDOUT":case"EADDRNOTAVAIL":case"EHOSTUNREACH":J("HOST_UNREACHABLE");break;case"ENETUNREACH":J("NETWORK_UNREACHABLE");break;case"ECONNREFUSED":J("CONNECTION_REFUSED");break;default:J("GENERAL_FAILURE")}}),X.on("ready",()=>{Q=!0,J("REQUEST_GRANTED"),$.socket.pipe(X).pipe($.socket)}),$.socket.on("close",()=>X.destroy()),X}var H4=class{constructor(){this.supportedCommands=new Set(["connect"]),this.connectionHandler=K7,this.server=lq.default.createServer(($)=>{$.setNoDelay(),this._handleConnection($)})}listen(...$){return this.server.listen(...$),this}close($){return this.server.close($),this}setAuthHandler($){return this.authHandler=$,this}disableAuthHandler(){return this.authHandler=void 0,this}setRulesetValidator($){return this.rulesetValidator=$,this}disableRulesetValidator(){return this.rulesetValidator=void 0,this}setConnectionHandler($){return this.connectionHandler=$,this}useDefaultConnectionHandler(){return this.connectionHandler=K7,this}_handleConnection($){return new pq(this,$),this}};function cq($){let J=new H4;if($?.auth)J.setAuthHandler((X)=>{return X.username===$.auth.username&&X.password===$.auth.password});if($?.port)J.listen($.port,$.hostname);return J}});import{Agent as wq,createServer as Pq}from"http";import{request as H7}from"http";import{request as Y4}from"https";import{connect as _q,isIP as xq}from"net";import{URL as G4}from"url";function Z($,J){if(!process.env.SRT_DEBUG)return;let X=J?.level||"info",Q="[SandboxDebug]";switch(X){case"error":console.error(`${Q} ${$}`);break;case"warn":console.warn(`${Q} ${$}`);break;default:console.error(`${Q} ${$}`)}}import{timingSafeEqual as lU}from"crypto";function OY($,J){let X=Buffer.from($),Q=Buffer.from(J);if(X.length!==Q.length)return!1;return lU(X,Q)}import{homedir as VY}from"os";import*as UJ from"path";import*as r0 from"fs";import*as KG from"fs";function l9(){if(process.platform!=="linux")return;try{let $=KG.readFileSync("/proc/version",{encoding:"utf8"}),J=$.match(/WSL(\d+)/i);if(J&&J[1])return J[1];if($.toLowerCase().includes("microsoft"))return"1";return}catch{return}}function v$(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"unknown"}}var VX=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json"],pU=[".git",".vscode",".idea"];function qY(){return[...pU.filter(($)=>$!==".git"),".claude/commands",".claude/agents"]}function p9($){return $.toLowerCase()}function NJ($){return $.includes("*")||$.includes("?")||$.includes("[")||$.includes("]")}function HX($){return $.includes("*")||$.includes("?")}function zG($){return v$()==="windows"?HX($):NJ($)}function EG($){if(/^\\\\\?\\unc\\/i.test($))return"\\\\"+$.slice(8);if($.startsWith("\\\\?\\"))return $.slice(4);return $}function qX($){let J=UJ.win32.toNamespacedPath($);return/^[\\/]{2}[?.][\\/]unc[\\/]/i.test(J)}function E0($){return $.replace(/\/\*\*$/,"")||"/"}function HY($,J){let X=UJ.normalize($),Q=UJ.normalize(J);if(Q===X)return!1;if(X.startsWith("/tmp/")&&Q==="/private"+X)return!1;if(X.startsWith("/var/")&&Q==="/private"+X)return!1;if(X.startsWith("/private/tmp/")&&Q===X)return!1;if(X.startsWith("/private/var/")&&Q===X)return!1;if(Q==="/")return!0;if(Q.split("/").filter(Boolean).length<=1)return!0;if(X.startsWith(Q+"/"))return!0;let G=X;if(X.startsWith("/tmp/"))G="/private"+X;else if(X.startsWith("/var/"))G="/private"+X;if(G!==X&&G.startsWith(Q+"/"))return!0;let W=Q.startsWith(X+"/"),U=G!==X&&Q.startsWith(G+"/");if(Q!==X&&!(G!==X&&Q===G)&&!W&&!U)return!0;return!1}function dU($){if($==="~")return VY();if($.startsWith("~/")||process.platform==="win32"&&$.startsWith("~\\"))return VY()+$.slice(1);return $}function cU($){let J=VY(),X=/^[A-Za-z]:/.test(J)?J.slice(0,2):"",Q=X?J.slice(2):J;return $.replace(/%USERPROFILE%/gi,J).replace(/%HOMEDRIVE%/gi,X).replace(/%HOMEPATH%/gi,Q)}function XJ($){let J=process.cwd();if(v$()==="windows"){if($=EG(cU($)),/^[a-z]:/.test($))$=$[0].toUpperCase()+$.slice(1);if(qX($)&&!HX($))return UJ.win32.normalize($)}if(v$()!=="windows"&&$.endsWith("/")&&$!=="/"&&!zG($))$=$.replace(/\/+$/,"")||"/";let X=dU($);if(X!==$);else if($.startsWith("./")||$.startsWith("../"))X=UJ.resolve(J,$);else if(!UJ.isAbsolute($))X=UJ.resolve(J,$);if(zG(X)){let Q=v$()==="windows"?/[*?]/:/[*?[\]]/,Y=X.split(Q)[0];if(Y&&Y!=="/"){let G=Y.endsWith("/")?Y.slice(0,-1):UJ.dirname(Y);try{let W=r0.realpathSync(G);if(!HY(G,W)){let U=X.slice(G.length);return W+U}}catch{}}return X}try{let Q=r0.realpathSync(X);if(HY(X,Q));else X=Q}catch{}return X}function DQ($){let J=$??VY();return["/dev/stdout","/dev/stderr","/dev/null","/dev/tty","/dev/dtracehelper","/dev/autofs_nowait","/tmp/claude","/private/tmp/claude",UJ.join(J,".npm/_logs"),UJ.join(J,".claude/debug")]}var nU=["NODE_EXTRA_CA_CERTS","SSL_CERT_FILE","CURL_CA_BUNDLE","REQUESTS_CA_BUNDLE","PIP_CERT","GIT_SSL_CAINFO","AWS_CA_BUNDLE","CARGO_HTTP_CAINFO","DENO_CERT","CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","NIX_SSL_CERT_FILE"];function ZQ($,J,X,Q,Y,G){let W=oU(G),U=W===z0?W:encodeURIComponent(W),M=Q?`${U}:${Q}@`:"",O=v$()==="linux"?"127.0.0.1":"localhost",V=["SANDBOX_RUNTIME=1"];if(!Y){let F=process.env.CLAUDE_CODE_TMPDIR||process.env.CLAUDE_TMPDIR||"/tmp/claude";V.push(`TMPDIR=${F}`)}if(X)for(let F of nU)V.push(`${F}=${X}`);if(!$&&!J)return V;let H=["localhost","127.0.0.1","::1","169.254.0.0/16","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"].join(",");if(V.push(`NO_PROXY=${H}`),V.push(`no_proxy=${H}`),$){if(V.push(`HTTP_PROXY=http://${M}${O}:${$}`),V.push(`HTTPS_PROXY=http://${M}${O}:${$}`),V.push(`http_proxy=http://${M}${O}:${$}`),V.push(`https_proxy=http://${M}${O}:${$}`),Q)V.push("GIT_CONFIG_PARAMETERS='http.proxyAuthMethod=basic'")}let q=$?`http://${M}${O}:${$}`:`socks5h://${M}${O}:${J}`;if(V.push(`ALL_PROXY=${q}`),V.push(`all_proxy=${q}`),V.push(`GRPC_PROXY=${q}`),V.push(`grpc_proxy=${q}`),J){let K=v$();if(K==="macos")V.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:${J} %h %p'`);else if(K==="linux"&&$){let A=Q?`,proxyauth=${W}:${Q}`:"";V.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='socat - PROXY:${O}:%h:%p,proxyport=${$}${A}'`)}if(V.push(`FTP_PROXY=socks5h://${M}${O}:${J}`),V.push(`ftp_proxy=socks5h://${M}${O}:${J}`),V.push(`RSYNC_PROXY=${O}:${J}`),V.push(`DOCKER_HTTP_PROXY=http://${M}${O}:${$||J}`),V.push(`DOCKER_HTTPS_PROXY=http://${M}${O}:${$||J}`),$){if(V.push("CLOUDSDK_PROXY_TYPE=http"),V.push(`CLOUDSDK_PROXY_ADDRESS=${O}`),V.push(`CLOUDSDK_PROXY_PORT=${$}`),Q)V.push(`CLOUDSDK_PROXY_USERNAME=${W}`),V.push(`CLOUDSDK_PROXY_PASSWORD=${Q}`)}}return V}var iU=8;function KX($){if($.baseEnv?.GIT_CONFIG_COUNT==="0")return{};let J=Number.parseInt($.baseEnv?.GIT_CONFIG_COUNT??"",10),X=Number.isFinite(J)&&J>=0?J:0,Q=X,Y={},G=(U,M)=>{Y[`GIT_CONFIG_KEY_${Q}`]=U,Y[`GIT_CONFIG_VALUE_${Q}`]=M,Q++},W=[...new Set($.safeDirs.filter((U)=>!!U).map((U)=>{let O=U.replace(/\\/g,"/").replace(/\/+$/,"");if(O===""||/^[A-Za-z]:$/.test(O))return`${O}/`;return O}))];if(W.length>iU)G("safe.directory","*");else for(let U of W)G("safe.directory",U),G("safe.directory",U.endsWith("/")?`${U}*`:`${U}/*`);if($.schannelCa)G("http.schannelUseSSLCAInfo","true"),G("http.schannelCheckRevoke","false");if(Q===X)return{};return Y.GIT_CONFIG_COUNT=String(Q),Y}function KY($){let J={GIT_CONFIG_COUNT:process.env.GIT_CONFIG_COUNT};for(let X of $.unsetEnvVars??[])delete J[X];return Object.assign(J,$.setEnvVars??{}),KX({safeDirs:$.safeDirs,baseEnv:J})}function PJ($){let J=$.slice(0,100);return Buffer.from(J).toString("base64")}function t0($){return Buffer.from($,"base64").toString("utf8")}var z0="srt";function oU($){if(!$)return z0;let J=`${z0}.${$}`;return Buffer.byteLength(J)<=255?J:z0}function zY($){if(!$||!$.startsWith(`${z0}.`))return;return $.slice(z0.length+1)||void 0}function zX($){return"^"+$.replace(/[.^$+{}()|\\]/g,"\\$&").replace(/\[([^\]]*?)$/g,"\\[$1").replace(/\*\*\//g,"__GLOBSTAR_SLASH__").replace(/\*\*/g,"__GLOBSTAR__").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/__GLOBSTAR_SLASH__/g,"(.*/)?").replace(/__GLOBSTAR__/g,".*")+"$"}function e0($,J={}){let X=(M)=>process.platform==="win32"?M.replace(/\\/g,"/"):M,Q=X(XJ($)),Y=Q.split(/[*?[\]]/)[0];if(!Y||Y==="/")return Z(`[Sandbox] Glob pattern too broad, skipping: ${$}`),[];let G=Y.endsWith("/")?Y.slice(0,-1):UJ.dirname(Y);if(!r0.existsSync(G))return Z(`[Sandbox] Base directory for glob does not exist: ${G}`),[];let W=new RegExp(zX(Q),J.caseInsensitive?"i":""),U=[];try{let M=r0.readdirSync(G,{recursive:!0,withFileTypes:!0});for(let O of M){let V=O.parentPath??O.path??G,H=UJ.join(V,O.name);if(W.test(X(H)))U.push(H)}}catch(M){Z(`[Sandbox] Error expanding glob pattern ${$}: ${M}`)}return U}var PW=m9(i8(),1);import{sign as yH,X509Certificate as bH}from"crypto";import{mkdtempSync as _W,readFileSync as o8,writeFileSync as a8}from"fs";import{rm as hH}from"fs/promises";import{tmpdir as xW}from"os";import{join as PX,dirname as IW}from"path";import{rootCertificates as uH}from"tls";var{asn1:t$,pki:pJ,md:gH,random:mH,util:vW}=PW.default,lH=pJ.getTBSCertificate,pH=/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g,oY="/srt.crl";function s8($){let J=$.getExtension("subjectKeyIdentifier");return J?.subjectKeyIdentifier?vW.hexToBytes(J.subjectKeyIdentifier):$.generateSubjectKeyIdentifier().getBytes()}function r8($,J){let X=pJ.oids.sha256WithRSAEncryption;$.siginfo.algorithmOid=X,$.signatureOid=X,$.tbsCertificate=lH($);let Q=t$.toDer($.tbsCertificate).getBytes();$.signature=kW(Q,J),$.md=gH.sha256.create(),$.md.update(Q)}function kW($,J){return yH("sha256",Buffer.from($,"binary"),J).toString("binary")}function t8($){if($.caCertPem&&$.caKeyPem){let J=xX($.caCertPem,$.caKeyPem);if(!J.ok)throw Error(`tlsTerminate: CA PEM pair: ${J.reason}`);return e8($.caCertPem,$.caKeyPem,J.cert,J.key,{certPath:$.caCertPath??"",keyPath:$.caKeyPath??"",extraCaCertPaths:$.extraCaCertPaths})}if($.caCertPath&&$.caKeyPath)return nH($.caCertPath,$.caKeyPath,$.extraCaCertPaths);if($.caCertPath||$.caKeyPath)throw Error("tlsTerminate: caCertPath and caKeyPath must be provided together");return iH($.extraCaCertPaths)}async function fW($){let J=new Set([IW($.trustBundlePath)]);if($.ephemeral)J.add(IW($.certPath));for(let X of J)try{await hH(X,{recursive:!0,force:!0})}catch(Q){Z(`[mitm-ca] cleanup failed: ${Q.message}`,{level:"warn"})}}function dH($,J,X){let Q=[J.trim(),...uH],Y=process.env.NODE_EXTRA_CA_CERTS;if(Y)try{Q.push(o8(Y,"utf8").trim())}catch{}for(let W of X??[]){let U;try{U=o8(W,"utf8")}catch(O){let V=O.code??String(O);Z(`[mitm-ca] extraCaCertPaths: cannot read ${W} (${V}); skipping`,{level:"warn"});continue}let M=U.match(pH);if(!M){Z(`[mitm-ca] extraCaCertPaths: ${W} has no PEM CERTIFICATE block; skipping`,{level:"warn"});continue}Q.push(...M)}let G=PX($,"trust-bundle.crt");return a8(G,Q.join(`
24
24
  `)+`
25
- `,{mode:420}),G}function pH($,J){let X=pJ.oids.sha256WithRSAEncryption,Q=()=>uQ([r$.create(hJ.UNIVERSAL,M0.OID,!1,r$.oidToDer(X).getBytes()),r$.create(hJ.UNIVERSAL,M0.NULL,!1,"")]),Y=(q,F)=>uQ([r$.create(hJ.UNIVERSAL,M0.OID,!1,r$.oidToDer(q).getBytes()),r$.create(hJ.UNIVERSAL,M0.OCTETSTRING,!1,r$.toDer(F).getBytes())]),G=r$.create(hJ.CONTEXT_SPECIFIC,0,!0,[uQ([Y(pJ.oids.authorityKeyIdentifier,uQ([r$.create(hJ.CONTEXT_SPECIFIC,0,!1,a8($))])),Y("2.5.29.20",r$.create(hJ.UNIVERSAL,M0.INTEGER,!1,"\x01"))])]),W=new Date,U=$.validity.notAfter,M=U>W?U:_X(1),O=uQ([r$.create(hJ.UNIVERSAL,M0.INTEGER,!1,"\x01"),Q(),pJ.distinguishedNameToAsn1($.subject),IW(W),IW(M),G]),V=vW(r$.toDer(O).getBytes(),J),H=uQ([O,Q(),r$.create(hJ.UNIVERSAL,M0.BITSTRING,!1,"\x00"+V)]);return Buffer.from(r$.toDer(H).getBytes(),"binary")}var{Class:hJ,Type:M0}=r$;function uQ($){return r$.create(hJ.UNIVERSAL,M0.SEQUENCE,!0,$)}function IW($){return $.getUTCFullYear()<2050?r$.create(hJ.UNIVERSAL,M0.UTCTIME,!1,r$.dateToUtcTime($)):r$.create(hJ.UNIVERSAL,M0.GENERALIZEDTIME,!1,r$.dateToGeneralizedTime($))}function dH($,J,X){let Q=CW($,"CERTIFICATE","tlsTerminate.caCertPath"),Y=CW(J,"PRIVATE KEY","tlsTerminate.caKeyPath"),G=xX(Q,Y);if(!G.ok)throw Error(`tlsTerminate: CA at ${$}: ${G.reason}`);return Z(`[mitm-ca] loaded CA from ${$}`),t8(Q,Y,G.cert,G.key,{certPath:$,keyPath:J,extraCaCertPaths:X})}function t8($,J,X,Q,Y){let G=PW(PX(_W(),"srt-ca-"));return{certPath:Y.certPath,keyPath:Y.keyPath,trustBundlePath:lH(G,$,Y.extraCaCertPaths),certPem:$,keyPem:J,cert:X,key:Q,leafCerts:new Map,secureContexts:new Map,crlDer:pH(X,J),ephemeral:Y.ephemeral??!1}}function oY($={}){let J=pJ.rsa.generateKeyPair(2048),X=pJ.createCertificate();X.publicKey=J.publicKey,X.serialNumber=e8(),X.validity.notBefore=_X(-1),X.validity.notAfter=_X($.validityDays??825);let Q=[{name:"commonName",value:$.cn??"sandbox-runtime ephemeral CA"},{name:"organizationName",value:"sandbox-runtime"}];X.setSubject(Q),X.setIssuer(Q),X.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",critical:!0,keyCertSign:!0,cRLSign:!0,digitalSignature:!0},{name:"subjectKeyIdentifier"}]);let Y=pJ.privateKeyToPem(J.privateKey);return s8(X,Y),{certPem:pJ.certificateToPem(X),keyPem:Y,cert:X,key:J.privateKey}}function gQ($){return new fH($).fingerprint.replace(/:/g,"").toUpperCase()}function xX($,J){let X,Q;try{X=pJ.certificateFromPem($),Q=pJ.privateKeyFromPem(J)}catch(W){return{ok:!1,reason:`parse: ${W.message}`}}if(!("n"in Q)||!("d"in Q))return{ok:!1,reason:"key is not RSA"};if(X.validity.notBefore.getTime()>Date.now())return{ok:!1,reason:`notBefore ${X.validity.notBefore.toISOString()} is in the future (clock skew?)`};let Y=X.publicKey;if(!("n"in Y)||Y.n.compareTo(Q.n))return{ok:!1,reason:"key does not match certificate public key"};let G;try{G=gQ($)}catch(W){return{ok:!1,reason:`thumbprint: ${W.message}`}}return{ok:!0,thumbprint:G,notAfter:X.validity.notAfter,cert:X,key:Q}}function cH($){let{certPem:J,keyPem:X,cert:Q,key:Y}=oY(),G=PW(PX(_W(),"srt-ca-")),W=PX(G,"ca.crt"),U=PX(G,"ca.key");return o8(W,J,{mode:420}),o8(U,X,{mode:384}),Z(`[mitm-ca] generated ephemeral CA at ${W}`),t8(J,X,Q,Y,{certPath:W,keyPath:U,extraCaCertPaths:$,ephemeral:!0})}function CW($,J,X){let Q;try{Q=i8($,"utf8")}catch(Y){let G=Y.code??String(Y);throw Error(`${X}: cannot read ${$} (${G})`)}if(!new RegExp(`-----BEGIN [A-Z ]*${J}-----`).test(Q))throw Error(`${X}: ${$} is not a PEM ${J}`);return Q}function e8(){let $=uH.getBytesSync(16),J=xW.bytesToHex($);return(parseInt(J[0],16)&7).toString(16)+J.slice(1)}function _X($){let J=new Date;return J.setDate(J.getDate()+$),J}import{PassThrough as nH,Readable as fW}from"stream";var $7=new Set(["GET","HEAD","OPTIONS"]),hW="denied by sandbox policy";function yW($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}async function aY($,J,X,Q,Y,G){let W=J.method??"GET",U,M=J,O=Boolean(J.headers["content-length"]||J.headers["transfer-encoding"]),V=$7.has(W);if(!V||O){let F=new nH;F.on("error",()=>{}),J.pipe(F);let K=fW.toWeb(F),[A,L]=K.tee();U=A,M=fW.fromWeb(L);let R=M;R.on("error",()=>{}),J.on("error",(I)=>{F.end(),R.destroy(I)})}let H;try{if(U&&!(U instanceof ReadableStream))throw TypeError("Unexpected request body stream");let F=U&&!V?{body:U,duplex:"half"}:{};H=new Request(Q,{method:W,headers:iH(J),signal:Y,...F})}catch(F){let K=`malformed request: ${F.message}`;if(G?.(W,Q,K),bW(X,{action:"deny",reason:K}),U?.cancel().catch(()=>{}),M.destroy(),M!==J)yW(J,X);return null}let q;try{q=await $(H)}catch(F){q={action:"deny",reason:`sandbox policy check failed: ${F.message}`}}if(U&&!H.bodyUsed)U.cancel().catch(()=>{});if(q.action==="allow")return Z(`[request-filter] allow ${W} ${Q}`),M;if(G?.(W,Q,q.reason??hW),bW(X,q),M.destroy(),M!==J)yW(J,X);return null}function bW($,J){vX($,J.reason??hW)}function vX($,J){if(Z(`[request-filter] deny: ${J}`),$.headersSent){$.destroy();return}$.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-sandbox-runtime"}),$.end(J+`
26
- `)}function iH($){let J=new Headers;for(let[X,Q]of Object.entries($.headers)){if(Q===void 0)continue;if(Array.isArray(Q))for(let Y of Q)J.append(X,Y);else J.append(X,Q)}return J}import{createServer as zq,request as Eq}from"https";import{connect as Fq,isIP as rW}from"net";import{unlink as Nq}from"fs";import{tmpdir as Lq}from"os";import{join as Aq}from"path";import{Transform as oH}from"stream";function aH($){return $.every((J)=>J.sentinel.length===J.realValue.length)}function sY($,J,X,Q){if($===void 0)return;let Y=J.headers["content-length"]!==void 0||J.headers["transfer-encoding"]!==void 0;if($7.has(J.method??"GET")&&!Y)return;let G=$(Q);if(!G?.length)return;if(J.headers["content-encoding"]!==void 0){Z(`[body-substitution] ${Q}: request body has Content-Encoding "${String(J.headers["content-encoding"])}"; masked-credential `+"substitution skipped \u2014 a sentinel in this body reaches the "+"upstream as the fake value",{level:"warn"});return}if(!aH(G))delete X["content-length"];return sH(G)}function sH($){let J=Math.max(...$.map((Q)=>Q.sentinel.length)),X;return new oH({transform(Q,Y,G){let W=Buffer.isBuffer(Q)?Q:Buffer.from(Q,Y),U=X?.length?Buffer.concat([X,W]):W,{out:M,tail:O}=rH(U,$,J);X=O,G(null,M)},flush(Q){Q(null,X?.length?X:void 0)}})}function rH($,J,X){let Q=[],Y=0;for(;;){let W=-1,U;for(let M of J){let O=$.indexOf(M.sentinel,Y);if(O!==-1&&(W===-1||O<W))W=O,U=M}if(U===void 0)break;Q.push($.subarray(Y,W),U.realValue),Y=W+U.sentinel.length}let G=Math.max(Y,$.length-(X-1));return Q.push($.subarray(Y,G)),{out:Buffer.concat(Q),tail:Buffer.from($.subarray(G))}}var uW=g9(n8(),1);import{isIP as tH}from"net";import{createSecureContext as eH}from"tls";var{pki:rY}=uW.default;function J7($,J){let X=$.leafCerts.get(J);if(X)return X;let Q=rY.rsa.generateKeyPair(2048),Y=rY.createCertificate();Y.publicKey=Q.publicKey,Y.serialNumber=e8();let G=_X(-1);Y.validity.notBefore=G,Y.validity.notAfter=Jq($.cert,G),Y.setSubject([{name:"commonName",value:J}]),Y.setIssuer($.cert.subject.attributes),Y.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",critical:!0,digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[$q(J)]},{name:"subjectKeyIdentifier"},{name:"authorityKeyIdentifier",keyIdentifier:a8($.cert)},...$.crlUrl?[{name:"cRLDistributionPoints",altNames:[{type:6,value:$.crlUrl}]}]:[]]),s8(Y,$.keyPem);let W={certPem:rY.certificateToPem(Y)+$.certPem,keyPem:rY.privateKeyToPem(Q.privateKey)};return $.leafCerts.set(J,W),Z(`[mitm-leaf] minted RSA leaf for ${J}`),W}function gW($,J){let X=$.secureContexts.get(J);if(X)return X;let{certPem:Q,keyPem:Y}=J7($,J),G=eH({cert:Q,key:Y});return $.secureContexts.set(J,G),G}function $q($){return tH($)!==0?{type:7,ip:$}:{type:2,value:$}}function Jq($,J){let X=$.validity.notAfter,Q=new Date(J);return Q.setDate(Q.getDate()+99),X<Q?new Date(X):Q}import{BlockList as mW,connect as lW,isIP as VQ}from"net";import{connect as Qq}from"tls";import{URL as Q7}from"url";var pW=30000,Xq=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);function X7($){let J=$?.http??process.env.HTTP_PROXY??process.env.http_proxy??void 0,X=$?.https??process.env.HTTPS_PROXY??process.env.https_proxy??J,Q=$?.noProxy??process.env.NO_PROXY??process.env.no_proxy??"";if(!J&&!X)return;let Y=(U)=>{if(!U)return;let O=/^[a-z][a-z0-9+.-]*:\/\//i.test(U)?U:`http://${U}`;try{let V=new Q7(O);if(V.protocol!=="http:"&&V.protocol!=="https:"||!V.hostname)throw Error("unsupported scheme or empty host");return V}catch{Z(`Invalid parent proxy URL, ignoring: ${Wq(U)}`,{level:"error"});return}},G=Y(J),W=Y(X);if(!G&&!W)return;return{httpUrl:G,httpsUrl:W,noProxy:Yq(Q)}}function Yq($){let J={all:!1,suffixes:[],cidr:new mW};for(let X of $.split(",")){if(X=X.trim(),!X)continue;if(X==="*"){J.all=!0;continue}let Q=X.indexOf("/");if(Q!==-1){let U=X.slice(0,Q),M=X.slice(Q+1),O=VQ(U);if(O&&M!==""&&/^\d+$/.test(M)){let V=Number(M),H=O===6?128:32;if(V>=0&&V<=H){try{J.cidr.addSubnet(U,V,O===6?"ipv6":"ipv4")}catch{}continue}}continue}let Y=X.toLowerCase(),G=/^\[([^\]]+)\](?::\d+)?$/.exec(Y);if(G)Y=G[1];if(Y.startsWith("*."))Y=Y.slice(1);let W=VQ(Y);if(!W){let U=Y.lastIndexOf(":");if(U!==-1&&/^\d+$/.test(Y.slice(U+1)))Y=Y.slice(0,U)}else try{J.cidr.addAddress(Y,W===6?"ipv6":"ipv4");continue}catch{}J.suffixes.push(Y)}return J}function kX($,J){let X=dJ(J.toLowerCase().replace(/\.$/,""));if(X==="localhost")return!0;let Q=VQ(X);if(Q){if(Gq.check(X,Q===6?"ipv6":"ipv4"))return!0}if($.noProxy.all)return!0;if(Q){if($.noProxy.cidr.check(X,Q===6?"ipv6":"ipv4"))return!0}for(let Y of $.noProxy.suffixes)if(Y.startsWith(".")){if(X===Y.slice(1)||X.endsWith(Y))return!0}else if(X===Y||X.endsWith("."+Y))return!0;return!1}var Gq=(()=>{let $=new mW;return $.addSubnet("127.0.0.0",8,"ipv4"),$.addAddress("::1","ipv6"),$.addSubnet("::ffff:127.0.0.0",104,"ipv6"),$})();function fX($,J){if(J.isHttps)return $.httpsUrl??$.httpUrl;return $.httpUrl}function Y7($){let{destHost:J,destPort:X}=$,Q=dJ(J);if(!mQ(Q))return Promise.reject(Error(`Invalid destination host for CONNECT: ${JSON.stringify(J)}`));if(!Number.isInteger(X)||X<1||X>65535)return Promise.reject(Error(`Invalid destination port: ${X}`));let Y=VQ(Q)===6?`[${Q}]:${X}`:`${Q}:${X}`;return new Promise((G,W)=>{let U=$.dial(),M=!1,O=(H)=>{if(M)return;M=!0,U.destroy(),W(H)},V=()=>O(Error("Proxy closed during CONNECT handshake"));U.setTimeout($.timeoutMs??pW,()=>O(Error("CONNECT handshake timed out"))),U.once("error",O),U.once("close",V),U.once($.readyEvent,()=>{U.write(`CONNECT ${Y} HTTP/1.1\r
25
+ `,{mode:420}),G}function cH($,J){let X=pJ.oids.sha256WithRSAEncryption,Q=()=>uQ([t$.create(hJ.UNIVERSAL,M0.OID,!1,t$.oidToDer(X).getBytes()),t$.create(hJ.UNIVERSAL,M0.NULL,!1,"")]),Y=(q,F)=>uQ([t$.create(hJ.UNIVERSAL,M0.OID,!1,t$.oidToDer(q).getBytes()),t$.create(hJ.UNIVERSAL,M0.OCTETSTRING,!1,t$.toDer(F).getBytes())]),G=t$.create(hJ.CONTEXT_SPECIFIC,0,!0,[uQ([Y(pJ.oids.authorityKeyIdentifier,uQ([t$.create(hJ.CONTEXT_SPECIFIC,0,!1,s8($))])),Y("2.5.29.20",t$.create(hJ.UNIVERSAL,M0.INTEGER,!1,"\x01"))])]),W=new Date,U=$.validity.notAfter,M=U>W?U:_X(1),O=uQ([t$.create(hJ.UNIVERSAL,M0.INTEGER,!1,"\x01"),Q(),pJ.distinguishedNameToAsn1($.subject),CW(W),CW(M),G]),V=kW(t$.toDer(O).getBytes(),J),H=uQ([O,Q(),t$.create(hJ.UNIVERSAL,M0.BITSTRING,!1,"\x00"+V)]);return Buffer.from(t$.toDer(H).getBytes(),"binary")}var{Class:hJ,Type:M0}=t$;function uQ($){return t$.create(hJ.UNIVERSAL,M0.SEQUENCE,!0,$)}function CW($){return $.getUTCFullYear()<2050?t$.create(hJ.UNIVERSAL,M0.UTCTIME,!1,t$.dateToUtcTime($)):t$.create(hJ.UNIVERSAL,M0.GENERALIZEDTIME,!1,t$.dateToGeneralizedTime($))}function nH($,J,X){let Q=wW($,"CERTIFICATE","tlsTerminate.caCertPath"),Y=wW(J,"PRIVATE KEY","tlsTerminate.caKeyPath"),G=xX(Q,Y);if(!G.ok)throw Error(`tlsTerminate: CA at ${$}: ${G.reason}`);return Z(`[mitm-ca] loaded CA from ${$}`),e8(Q,Y,G.cert,G.key,{certPath:$,keyPath:J,extraCaCertPaths:X})}function e8($,J,X,Q,Y){let G=_W(PX(xW(),"srt-ca-"));return{certPath:Y.certPath,keyPath:Y.keyPath,trustBundlePath:dH(G,$,Y.extraCaCertPaths),certPem:$,keyPem:J,cert:X,key:Q,leafCerts:new Map,secureContexts:new Map,crlDer:cH(X,J),ephemeral:Y.ephemeral??!1}}function aY($={}){let J=pJ.rsa.generateKeyPair(2048),X=pJ.createCertificate();X.publicKey=J.publicKey,X.serialNumber=$7(),X.validity.notBefore=_X(-1),X.validity.notAfter=_X($.validityDays??825);let Q=[{name:"commonName",value:$.cn??"sandbox-runtime ephemeral CA"},{name:"organizationName",value:"sandbox-runtime"}];X.setSubject(Q),X.setIssuer(Q),X.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",critical:!0,keyCertSign:!0,cRLSign:!0,digitalSignature:!0},{name:"subjectKeyIdentifier"}]);let Y=pJ.privateKeyToPem(J.privateKey);return r8(X,Y),{certPem:pJ.certificateToPem(X),keyPem:Y,cert:X,key:J.privateKey}}function gQ($){return new bH($).fingerprint.replace(/:/g,"").toUpperCase()}function xX($,J){let X,Q;try{X=pJ.certificateFromPem($),Q=pJ.privateKeyFromPem(J)}catch(W){return{ok:!1,reason:`parse: ${W.message}`}}if(!("n"in Q)||!("d"in Q))return{ok:!1,reason:"key is not RSA"};if(X.validity.notBefore.getTime()>Date.now())return{ok:!1,reason:`notBefore ${X.validity.notBefore.toISOString()} is in the future (clock skew?)`};let Y=X.publicKey;if(!("n"in Y)||Y.n.compareTo(Q.n))return{ok:!1,reason:"key does not match certificate public key"};let G;try{G=gQ($)}catch(W){return{ok:!1,reason:`thumbprint: ${W.message}`}}return{ok:!0,thumbprint:G,notAfter:X.validity.notAfter,cert:X,key:Q}}function iH($){let{certPem:J,keyPem:X,cert:Q,key:Y}=aY(),G=_W(PX(xW(),"srt-ca-")),W=PX(G,"ca.crt"),U=PX(G,"ca.key");return a8(W,J,{mode:420}),a8(U,X,{mode:384}),Z(`[mitm-ca] generated ephemeral CA at ${W}`),e8(J,X,Q,Y,{certPath:W,keyPath:U,extraCaCertPaths:$,ephemeral:!0})}function wW($,J,X){let Q;try{Q=o8($,"utf8")}catch(Y){let G=Y.code??String(Y);throw Error(`${X}: cannot read ${$} (${G})`)}if(!new RegExp(`-----BEGIN [A-Z ]*${J}-----`).test(Q))throw Error(`${X}: ${$} is not a PEM ${J}`);return Q}function $7(){let $=mH.getBytesSync(16),J=vW.bytesToHex($);return(parseInt(J[0],16)&7).toString(16)+J.slice(1)}function _X($){let J=new Date;return J.setDate(J.getDate()+$),J}import{PassThrough as oH,Readable as yW}from"stream";var J7=new Set(["GET","HEAD","OPTIONS"]),uW="denied by sandbox policy";function bW($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}async function sY($,J,X,Q,Y,G){let W=J.method??"GET",U,M=J,O=Boolean(J.headers["content-length"]||J.headers["transfer-encoding"]),V=J7.has(W);if(!V||O){let F=new oH;F.on("error",()=>{}),J.pipe(F);let K=yW.toWeb(F),[A,L]=K.tee();U=A,M=yW.fromWeb(L);let R=M;R.on("error",()=>{}),J.on("error",(I)=>{F.end(),R.destroy(I)})}let H;try{if(U&&!(U instanceof ReadableStream))throw TypeError("Unexpected request body stream");let F=U&&!V?{body:U,duplex:"half"}:{};H=new Request(Q,{method:W,headers:aH(J),signal:Y,...F})}catch(F){let K=`malformed request: ${F.message}`;if(G?.(W,Q,K),hW(X,{action:"deny",reason:K}),U?.cancel().catch(()=>{}),M.destroy(),M!==J)bW(J,X);return null}let q;try{q=await $(H)}catch(F){q={action:"deny",reason:`sandbox policy check failed: ${F.message}`}}if(U&&!H.bodyUsed)U.cancel().catch(()=>{});if(q.action==="allow")return Z(`[request-filter] allow ${W} ${Q}`),M;if(G?.(W,Q,q.reason??uW),hW(X,q),M.destroy(),M!==J)bW(J,X);return null}function hW($,J){vX($,J.reason??uW)}function vX($,J){if(Z(`[request-filter] deny: ${J}`),$.headersSent){$.destroy();return}$.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-sandbox-runtime"}),$.end(J+`
26
+ `)}function aH($){let J=new Headers;for(let[X,Q]of Object.entries($.headers)){if(Q===void 0)continue;if(Array.isArray(Q))for(let Y of Q)J.append(X,Y);else J.append(X,Q)}return J}import{createServer as Fq,request as Nq}from"https";import{connect as Lq,isIP as tW}from"net";import{unlink as Aq}from"fs";import{tmpdir as Rq}from"os";import{join as Dq}from"path";import{Transform as sH}from"stream";function rH($){return $.every((J)=>J.sentinel.length===J.realValue.length)}function rY($,J,X,Q){if($===void 0)return;let Y=J.headers["content-length"]!==void 0||J.headers["transfer-encoding"]!==void 0;if(J7.has(J.method??"GET")&&!Y)return;let G=$(Q);if(!G?.length)return;if(J.headers["content-encoding"]!==void 0){Z(`[body-substitution] ${Q}: request body has Content-Encoding "${String(J.headers["content-encoding"])}"; masked-credential `+"substitution skipped \u2014 a sentinel in this body reaches the "+"upstream as the fake value",{level:"warn"});return}if(!rH(G))delete X["content-length"];return tH(G)}function tH($){let J=Math.max(...$.map((Q)=>Q.sentinel.length)),X;return new sH({transform(Q,Y,G){let W=Buffer.isBuffer(Q)?Q:Buffer.from(Q,Y),U=X?.length?Buffer.concat([X,W]):W,{out:M,tail:O}=eH(U,$,J);X=O,G(null,M)},flush(Q){Q(null,X?.length?X:void 0)}})}function eH($,J,X){let Q=[],Y=0;for(;;){let W=-1,U;for(let M of J){let O=$.indexOf(M.sentinel,Y);if(O!==-1&&(W===-1||O<W))W=O,U=M}if(U===void 0)break;Q.push($.subarray(Y,W),U.realValue),Y=W+U.sentinel.length}let G=Math.max(Y,$.length-(X-1));return Q.push($.subarray(Y,G)),{out:Buffer.concat(Q),tail:Buffer.from($.subarray(G))}}var gW=m9(i8(),1);import{isIP as $q}from"net";import{createSecureContext as Jq}from"tls";var{pki:tY}=gW.default;function Q7($,J){let X=$.leafCerts.get(J);if(X)return X;let Q=tY.rsa.generateKeyPair(2048),Y=tY.createCertificate();Y.publicKey=Q.publicKey,Y.serialNumber=$7();let G=_X(-1);Y.validity.notBefore=G,Y.validity.notAfter=Xq($.cert,G),Y.setSubject([{name:"commonName",value:J}]),Y.setIssuer($.cert.subject.attributes),Y.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",critical:!0,digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[Qq(J)]},{name:"subjectKeyIdentifier"},{name:"authorityKeyIdentifier",keyIdentifier:s8($.cert)},...$.crlUrl?[{name:"cRLDistributionPoints",altNames:[{type:6,value:$.crlUrl}]}]:[]]),r8(Y,$.keyPem);let W={certPem:tY.certificateToPem(Y)+$.certPem,keyPem:tY.privateKeyToPem(Q.privateKey)};return $.leafCerts.set(J,W),Z(`[mitm-leaf] minted RSA leaf for ${J}`),W}function mW($,J){let X=$.secureContexts.get(J);if(X)return X;let{certPem:Q,keyPem:Y}=Q7($,J),G=Jq({cert:Q,key:Y});return $.secureContexts.set(J,G),G}function Qq($){return $q($)!==0?{type:7,ip:$}:{type:2,value:$}}function Xq($,J){let X=$.validity.notAfter,Q=new Date(J);return Q.setDate(Q.getDate()+99),X<Q?new Date(X):Q}import{BlockList as lW,connect as pW,isIP as VQ}from"net";import{connect as Yq}from"tls";import{URL as X7}from"url";var dW=30000,Gq=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);function Y7($){let J=$?.http??process.env.HTTP_PROXY??process.env.http_proxy??void 0,X=$?.https??process.env.HTTPS_PROXY??process.env.https_proxy??J,Q=$?.noProxy??process.env.NO_PROXY??process.env.no_proxy??"";if(!J&&!X)return;let Y=(U)=>{if(!U)return;let O=/^[a-z][a-z0-9+.-]*:\/\//i.test(U)?U:`http://${U}`;try{let V=new X7(O);if(V.protocol!=="http:"&&V.protocol!=="https:"||!V.hostname)throw Error("unsupported scheme or empty host");return V}catch{Z(`Invalid parent proxy URL, ignoring: ${Mq(U)}`,{level:"error"});return}},G=Y(J),W=Y(X);if(!G&&!W)return;return{httpUrl:G,httpsUrl:W,noProxy:Wq(Q)}}function Wq($){let J={all:!1,suffixes:[],cidr:new lW};for(let X of $.split(",")){if(X=X.trim(),!X)continue;if(X==="*"){J.all=!0;continue}let Q=X.indexOf("/");if(Q!==-1){let U=X.slice(0,Q),M=X.slice(Q+1),O=VQ(U);if(O&&M!==""&&/^\d+$/.test(M)){let V=Number(M),H=O===6?128:32;if(V>=0&&V<=H){try{J.cidr.addSubnet(U,V,O===6?"ipv6":"ipv4")}catch{}continue}}continue}let Y=X.toLowerCase(),G=/^\[([^\]]+)\](?::\d+)?$/.exec(Y);if(G)Y=G[1];if(Y.startsWith("*."))Y=Y.slice(1);let W=VQ(Y);if(!W){let U=Y.lastIndexOf(":");if(U!==-1&&/^\d+$/.test(Y.slice(U+1)))Y=Y.slice(0,U)}else try{J.cidr.addAddress(Y,W===6?"ipv6":"ipv4");continue}catch{}J.suffixes.push(Y)}return J}function kX($,J){let X=dJ(J.toLowerCase().replace(/\.$/,""));if(X==="localhost")return!0;let Q=VQ(X);if(Q){if(Uq.check(X,Q===6?"ipv6":"ipv4"))return!0}if($.noProxy.all)return!0;if(Q){if($.noProxy.cidr.check(X,Q===6?"ipv6":"ipv4"))return!0}for(let Y of $.noProxy.suffixes)if(Y.startsWith(".")){if(X===Y.slice(1)||X.endsWith(Y))return!0}else if(X===Y||X.endsWith("."+Y))return!0;return!1}var Uq=(()=>{let $=new lW;return $.addSubnet("127.0.0.0",8,"ipv4"),$.addAddress("::1","ipv6"),$.addSubnet("::ffff:127.0.0.0",104,"ipv6"),$})();function fX($,J){if(J.isHttps)return $.httpsUrl??$.httpUrl;return $.httpUrl}function G7($){let{destHost:J,destPort:X}=$,Q=dJ(J);if(!mQ(Q))return Promise.reject(Error(`Invalid destination host for CONNECT: ${JSON.stringify(J)}`));if(!Number.isInteger(X)||X<1||X>65535)return Promise.reject(Error(`Invalid destination port: ${X}`));let Y=VQ(Q)===6?`[${Q}]:${X}`:`${Q}:${X}`;return new Promise((G,W)=>{let U=$.dial(),M=!1,O=(H)=>{if(M)return;M=!0,U.destroy(),W(H)},V=()=>O(Error("Proxy closed during CONNECT handshake"));U.setTimeout($.timeoutMs??dW,()=>O(Error("CONNECT handshake timed out"))),U.once("error",O),U.once("close",V),U.once($.readyEvent,()=>{U.write(`CONNECT ${Y} HTTP/1.1\r
27
27
  Host: ${Y}\r
28
28
  `+($.authHeader?`Proxy-Authorization: ${$.authHeader}\r
29
29
  `:"")+`\r
30
30
  `);let H="",q=(F)=>{H+=F.toString("latin1");let K=H.indexOf(`\r
31
31
  \r
32
32
  `);if(K===-1){if(H.length>16384)O(Error("CONNECT response header too large"));return}U.pause(),U.removeListener("data",q);let A=H.slice(0,H.indexOf(`\r
33
- `));if(!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(A))return O(Error(`Proxy refused CONNECT: ${A.trim()}`));let L=H.slice(K+4);if(L.length)U.unshift(Buffer.from(L,"latin1"));M=!0,U.setTimeout(0),U.removeListener("error",O),U.removeListener("close",V),G(U)};U.on("data",q)})})}function tY($,J,X){let Q=dJ($.hostname),Y=Number($.port)||($.protocol==="https:"?443:80),G=$.protocol==="https:";return Y7({destHost:J,destPort:X,authHeader:G7($),readyEvent:G?"secureConnect":"connect",dial:()=>G?Qq({host:Q,port:Y,...VQ(Q)?{}:{servername:Q}}):lW(Y,Q)})}function G7($){if(!$.username&&!$.password)return;try{let J=`${decodeURIComponent($.username)}:${decodeURIComponent($.password)}`;return`Basic ${Buffer.from(J).toString("base64")}`}catch{let J=`${$.username}:${$.password}`;return`Basic ${Buffer.from(J).toString("base64")}`}}function h0($){let J=new Set,X=$.connection;if(X)for(let Y of String(X).split(","))J.add(Y.trim().toLowerCase());let Q={};for(let[Y,G]of Object.entries($)){let W=Y.toLowerCase();if(!Xq.has(W)&&!J.has(W))Q[Y]=G}return Q}function dJ($){return $.startsWith("[")&&$.endsWith("]")?$.slice(1,-1):$}function W7($){if(!$)return"-";if(!$.username&&!$.password)return $.href;let J=new Q7($.href);return J.username="***",J.password="***",J.href}function Wq($){return $.replace(/\/\/[^@/]*@/,"//***:***@")}function mQ($){if(!$||$.length>255)return!1;let J=dJ($);if(J.includes("%"))return!1;if(VQ(J))return!0;return/^[A-Za-z0-9._-]+$/.test(J)}function jJ($){try{let J=dJ($),X=VQ(J)===6?`[${J}]`:J,Q=new Q7(`http://${X}/`).hostname;return dJ(Q).replace(/\.$/,"")}catch{return}}function eY($,J,X=pW){return new Promise((Q,Y)=>{let G=lW(J,$),W=!1,U=(M)=>{if(W)return;if(W=!0,G.setTimeout(0),M)G.destroy(),Y(M);else Q(G)};G.setTimeout(X,()=>U(Error("connect timed out"))),G.once("connect",()=>U()),G.once("error",U),G.once("close",()=>U(Error("socket closed before connect")))})}import{createHash as Uq,createHmac as iW}from"crypto";var yX="AWS4-HMAC-SHA256",Mq="AWS4-ECDSA-P256-SHA256",J9="UNSIGNED-PAYLOAD";function oW($,J){let X=lQ($.authorization);if(X!==void 0&&X.startsWith(Mq)){let U=dW(X);if(U!==void 0)return{kind:"sigv4a",accessKeyId:U}}else if(X!==void 0&&X.startsWith(yX)){let U=dW(X);if(U!==void 0)return{kind:lQ($["x-amz-content-sha256"])?.startsWith("STREAMING-")?"streaming":"header-sigv4",accessKeyId:U}}let Q=J.indexOf("?");if(Q===-1)return null;let Y=new URLSearchParams(J.slice(Q+1));if(Y.get("X-Amz-Algorithm")!==yX)return null;if(!Y.has("X-Amz-Signature"))return null;let G=Y.get("X-Amz-Credential");if(!G)return null;let W=G.split("/")[0];return W?{kind:"presigned",accessKeyId:W}:null}function dW($){return/Credential=([^/,\s]+)\//.exec($)?.[1]}function aW($){if(!$.startsWith(yX))return null;let J=/Credential=([^,\s]+)/.exec($)?.[1],X=/SignedHeaders=([^,\s]+)/.exec($)?.[1],Q=/Signature=([0-9a-fA-F]+)/.exec($)?.[1];if(!J||!X||!Q)return null;let Y=J.split("/");if(Y.length!==5||Y[4]!=="aws4_request")return null;let[G,W,U,M]=Y;if(!G||!W||!U||!M)return null;return{accessKeyId:G,date:W,region:U,service:M,signedHeaders:X.split(";").map((O)=>O.toLowerCase()),signature:Q}}function U7($){return encodeURIComponent($).replace(/[!'()*]/g,(J)=>"%"+J.charCodeAt(0).toString(16).toUpperCase())}function Oq($,J){if($==="")return"/";if(J==="s3")return $;let X=[];for(let G of $.split("/")){if(G===""||G===".")continue;if(G==="..")X.pop();else X.push(G)}let Q=X.length>0&&$.endsWith("/")?"/":"",Y=`/${X.join("/")}${Q}`;return U7(Y).replace(/%2F/gi,"/")}function Vq($){if($==="")return"";let J=[];for(let X of $.split("&")){if(X==="")continue;let Q=X.indexOf("="),Y=Q===-1?X:X.slice(0,Q),G=Q===-1?"":X.slice(Q+1);J.push([U7(cW(Y)),U7(cW(G))])}return J.sort(([X,Q],[Y,G])=>X<Y?-1:X>Y?1:Q<G?-1:Q>G?1:0),J.map(([X,Q])=>`${X}=${Q}`).join("&")}function cW($){try{return decodeURIComponent($)}catch{return $}}function nW($){return $.trim().replace(/[ \t]+/g," ")}function Hq($){let J=$.requestTarget.indexOf("?"),X=J===-1?$.requestTarget:$.requestTarget.slice(0,J),Q=J===-1?"":$.requestTarget.slice(J+1),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=[];for(let W of Y){let U=W==="host"?$.hostHeader:$.headers[W];if(U===void 0)throw Error(`signed header "${W}" is missing from the request`);let M=Array.isArray(U)?U.map(nW).join(","):nW(String(U));G.push(`${W}:${M}`)}return[$.method.toUpperCase(),Oq(X,$.scope.service),Vq(Q),G.join(`
33
+ `));if(!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(A))return O(Error(`Proxy refused CONNECT: ${A.trim()}`));let L=H.slice(K+4);if(L.length)U.unshift(Buffer.from(L,"latin1"));M=!0,U.setTimeout(0),U.removeListener("error",O),U.removeListener("close",V),G(U)};U.on("data",q)})})}function eY($,J,X){let Q=dJ($.hostname),Y=Number($.port)||($.protocol==="https:"?443:80),G=$.protocol==="https:";return G7({destHost:J,destPort:X,authHeader:W7($),readyEvent:G?"secureConnect":"connect",dial:()=>G?Yq({host:Q,port:Y,...VQ(Q)?{}:{servername:Q}}):pW(Y,Q)})}function W7($){if(!$.username&&!$.password)return;try{let J=`${decodeURIComponent($.username)}:${decodeURIComponent($.password)}`;return`Basic ${Buffer.from(J).toString("base64")}`}catch{let J=`${$.username}:${$.password}`;return`Basic ${Buffer.from(J).toString("base64")}`}}function h0($){let J=new Set,X=$.connection;if(X)for(let Y of String(X).split(","))J.add(Y.trim().toLowerCase());let Q={};for(let[Y,G]of Object.entries($)){let W=Y.toLowerCase();if(!Gq.has(W)&&!J.has(W))Q[Y]=G}return Q}function dJ($){return $.startsWith("[")&&$.endsWith("]")?$.slice(1,-1):$}function U7($){if(!$)return"-";if(!$.username&&!$.password)return $.href;let J=new X7($.href);return J.username="***",J.password="***",J.href}function Mq($){return $.replace(/\/\/[^@/]*@/,"//***:***@")}function mQ($){if(!$||$.length>255)return!1;let J=dJ($);if(J.includes("%"))return!1;if(VQ(J))return!0;return/^[A-Za-z0-9._-]+$/.test(J)}function jJ($){try{let J=dJ($),X=VQ(J)===6?`[${J}]`:J,Q=new X7(`http://${X}/`).hostname;return dJ(Q).replace(/\.$/,"")}catch{return}}function $9($,J,X=dW){return new Promise((Q,Y)=>{let G=pW(J,$),W=!1,U=(M)=>{if(W)return;if(W=!0,G.setTimeout(0),M)G.destroy(),Y(M);else Q(G)};G.setTimeout(X,()=>U(Error("connect timed out"))),G.once("connect",()=>U()),G.once("error",U),G.once("close",()=>U(Error("socket closed before connect")))})}import{createHash as Oq,createHmac as oW}from"crypto";var yX="AWS4-HMAC-SHA256",Vq="AWS4-ECDSA-P256-SHA256",Q9="UNSIGNED-PAYLOAD";function aW($,J){let X=lQ($.authorization);if(X!==void 0&&X.startsWith(Vq)){let U=cW(X);if(U!==void 0)return{kind:"sigv4a",accessKeyId:U}}else if(X!==void 0&&X.startsWith(yX)){let U=cW(X);if(U!==void 0)return{kind:lQ($["x-amz-content-sha256"])?.startsWith("STREAMING-")?"streaming":"header-sigv4",accessKeyId:U}}let Q=J.indexOf("?");if(Q===-1)return null;let Y=new URLSearchParams(J.slice(Q+1));if(Y.get("X-Amz-Algorithm")!==yX)return null;if(!Y.has("X-Amz-Signature"))return null;let G=Y.get("X-Amz-Credential");if(!G)return null;let W=G.split("/")[0];return W?{kind:"presigned",accessKeyId:W}:null}function cW($){return/Credential=([^/,\s]+)\//.exec($)?.[1]}function sW($){if(!$.startsWith(yX))return null;let J=/Credential=([^,\s]+)/.exec($)?.[1],X=/SignedHeaders=([^,\s]+)/.exec($)?.[1],Q=/Signature=([0-9a-fA-F]+)/.exec($)?.[1];if(!J||!X||!Q)return null;let Y=J.split("/");if(Y.length!==5||Y[4]!=="aws4_request")return null;let[G,W,U,M]=Y;if(!G||!W||!U||!M)return null;return{accessKeyId:G,date:W,region:U,service:M,signedHeaders:X.split(";").map((O)=>O.toLowerCase()),signature:Q}}function M7($){return encodeURIComponent($).replace(/[!'()*]/g,(J)=>"%"+J.charCodeAt(0).toString(16).toUpperCase())}function Hq($,J){if($==="")return"/";if(J==="s3")return $;let X=[];for(let G of $.split("/")){if(G===""||G===".")continue;if(G==="..")X.pop();else X.push(G)}let Q=X.length>0&&$.endsWith("/")?"/":"",Y=`/${X.join("/")}${Q}`;return M7(Y).replace(/%2F/gi,"/")}function qq($){if($==="")return"";let J=[];for(let X of $.split("&")){if(X==="")continue;let Q=X.indexOf("="),Y=Q===-1?X:X.slice(0,Q),G=Q===-1?"":X.slice(Q+1);J.push([M7(nW(Y)),M7(nW(G))])}return J.sort(([X,Q],[Y,G])=>X<Y?-1:X>Y?1:Q<G?-1:Q>G?1:0),J.map(([X,Q])=>`${X}=${Q}`).join("&")}function nW($){try{return decodeURIComponent($)}catch{return $}}function iW($){return $.trim().replace(/[ \t]+/g," ")}function Kq($){let J=$.requestTarget.indexOf("?"),X=J===-1?$.requestTarget:$.requestTarget.slice(0,J),Q=J===-1?"":$.requestTarget.slice(J+1),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=[];for(let W of Y){let U=W==="host"?$.hostHeader:$.headers[W];if(U===void 0)throw Error(`signed header "${W}" is missing from the request`);let M=Array.isArray(U)?U.map(iW).join(","):iW(String(U));G.push(`${W}:${M}`)}return[$.method.toUpperCase(),Hq(X,$.scope.service),qq(Q),G.join(`
34
34
  `)+`
35
35
  `,Y.join(";"),$.payloadHash].join(`
36
- `)}function qq($,J,X){return[yX,J,`${X.date}/${X.region}/${X.service}/aws4_request`,M7($)].join(`
37
- `)}function Kq($,J){let X=$9(`AWS4${$}`,J.date),Q=$9(X,J.region),Y=$9(Q,J.service);return $9(Y,"aws4_request")}function sW($){let J=Hq($),X=qq(J,$.amzDate,$.scope),Q=iW("sha256",Kq($.secretAccessKey,$.scope)).update(X,"utf8").digest("hex"),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=`${$.scope.date}/${$.scope.region}/${$.scope.service}/aws4_request`;return{authorization:`${yX} Credential=${$.accessKeyId}/${G}, SignedHeaders=${Y.join(";")}, Signature=${Q}`,signature:Q,canonicalRequest:J,stringToSign:X}}function M7($){return Uq("sha256").update($).digest("hex")}function $9($,J){return iW("sha256",$).update(J,"utf8").digest()}function lQ($){return Array.isArray($)?$[0]:$}var $4=67108864;class O7 extends Error{}function tW($){return $.length>=3&&$[0]===22&&$[1]===3&&$[2]<=3}function J4($,J){if(J.length>=3)return Promise.resolve({isTLS:tW(J),head:J});return new Promise((X)=>{let Q=J,Y=()=>{$.removeListener("data",G),$.removeListener("close",Y),X({isTLS:tW(Q),head:Q})},G=(W)=>{if($.pause(),Q=Q.length?Buffer.concat([Q,W]):W,Q.length>=3)return Y();$.resume()};$.on("data",G),$.once("close",Y)})}function Rq($,J){let X=()=>{let Q;while((Q=$.read())!==null)if(!J.write(Q)){J.once("drain",X);return}$.once("readable",X)};X(),$.once("end",()=>J.end())}function Q4($,J,X,Q,Y,G,W,U,M=$4){let O=J7($,W.hostname),V=zq({ALPNProtocols:["http/1.1"],cert:O.certPem,key:O.keyPem,SNICallback:(F,K)=>{try{K(null,gW($,F||W.hostname))}catch(A){K(A)}}});V.on("request",(F,K)=>{F.on("error",(A)=>{Z(`[tls-terminate] client request error: ${A.message}`,{level:"error"})}),K.on("error",(A)=>{Z(`[tls-terminate] client response error: ${A.message}`,{level:"error"})}),Dq(J,X,Q,F,K,W,U,M)}),V.on("clientError",(F,K)=>{Z(`[tls-terminate] client connection error for ${W.hostname}: ${F.message}`,{level:"error"}),K.destroy()}),V.on("tlsClientError",(F,K)=>{Z(`[tls-terminate] client TLS error for ${W.hostname}: ${F.message}`,{level:"error"}),K.destroy()}),V.on("upgrade",(F,K)=>{Z("[tls-terminate] upgrade request refused",{level:"warn"}),K.destroy()});let H=Sq(),q=()=>{V.close(),Nq(H,()=>{})};V.on("error",(F)=>{Z(`[tls-terminate] inner server listen failed: ${F.message}`,{level:"error"}),Y.destroy(),q()}),V.listen(H,()=>{let F=Fq({path:H});F.on("error",(K)=>{Z(`[tls-terminate] inner loopback failed: ${K.message}`,{level:"error"}),Y.destroy(),q()}),F.once("connect",()=>{if(G.length)F.write(G);Rq(Y,F),F.pipe(Y)}),Y.on("error",()=>F.destroy()),Y.once("close",()=>{F.destroy(),q()}),F.once("close",()=>Y.destroy())}),V.unref()}function eW($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}function Dq(...$){Zq(...$).catch((J)=>{Z(`[tls-terminate] forwardUpstream failed: ${J.message}`,{level:"error"})})}async function Zq($,J,X,Q,Y,G,W,U=$4){let M=jq(Q.url),O=Q;if($){let L=new AbortController;Y.once("close",()=>L.abort());let R=G.port===443?G.hostname:`${G.hostname}:${G.port}`,I=await aY($,Q,Y,`https://${R}${M}`,L.signal,G.onFilterRequestDeny);if(I===null)return;if(O=I,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||O.destroyed){O.destroy();return}}let V=h0(Q.headers);delete V.host;let H=W?.(Q.method??"GET",M,V,G.hostname);J?.(V,G.hostname);let q=sY(X,Q,V,G.hostname),F;if(H?.action==="deny"){if(vX(Y,H.reason),O.destroy(),O!==Q)eW(Q,Y);return}if(H?.action==="resign"){let L=H.payloadHash;if(L===void 0){let T=q?O.pipe(q):O;if(q)O.on("error",(C)=>q.destroy(C));try{F=await Bq(T,U)}catch(C){if(C instanceof O7){vX(Y,`AWS SigV4 request uses a masked credential and signs a literal body hash, so the proxy must buffer the body to re-sign it, but the body exceeds the ${U}-byte buffering limit; denied. Sign the payload as UNSIGNED-PAYLOAD to stream it without buffering, or use an unmasked credential to have the request forwarded untouched.`),T.resume();return}Z(`[tls-terminate] failed to buffer body for SigV4 re-sign: ${C.message}`,{level:"error"}),Y.destroy();return}L=M7(F),V["content-length"]=String(F.length)}let R=rW(G.hostname)===6?`[${G.hostname}]`:G.hostname,I=G.port===443?R:`${R}:${G.port}`;try{H.apply(V,I,L)}catch(T){if(vX(Y,`AWS SigV4 re-signing failed: ${T.message}`),O.destroy(),O!==Q)eW(Q,Y);return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&F===void 0&&V["content-length"]===void 0&&V["transfer-encoding"]===void 0)V["transfer-encoding"]="chunked";let A=Eq({host:G.hostname,port:G.port,path:M,method:Q.method,headers:V,...rW(G.hostname)?{}:{servername:G.hostname},...G.upstreamCA?{ca:G.upstreamCA}:{},agent:!1},(L)=>{L.on("error",(R)=>{Z(`[tls-terminate] upstream response error: ${R.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(L.statusCode??502,h0(L.headers)),L.pipe(Y)});if(A.on("error",(L)=>{if(Z(`[tls-terminate] upstream ${G.hostname}:${G.port} failed: ${L.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>A.destroy()),F!==void 0)A.end(F);else if(q)q.on("error",(L)=>A.destroy(L)),O.on("error",(L)=>q.destroy(L)),Y.on("close",()=>q.destroy()),O.pipe(q).pipe(A);else O.on("error",(L)=>A.destroy(L)),O.pipe(A)}function Bq($,J){return new Promise((X,Q)=>{let Y=[],G=0,W=(U)=>{if(G+=U.length,G>J){Y.length=0,$.removeListener("data",W),Q(new O7(`request body exceeds ${J} bytes`));return}Y.push(U)};$.on("data",W),$.once("end",()=>X(Buffer.concat(Y))),$.once("error",Q)})}function jq($){let J=$??"/";if(J.startsWith("/"))return J;try{let X=new URL(J);return`${X.pathname}${X.search}`||"/"}catch{return J}}var Tq=0;function Sq(){return Aq(Lq(),`srt-tt-${process.pid}-${(Tq++).toString(36)}.sock`)}function _q($,J){if(!J)return{ok:!0};let X=/^basic\s+([a-z0-9+/=]+)\s*$/i.exec($??"");if(!X)return{ok:!1};let Q=Buffer.from(X[1],"base64").toString("utf8"),Y=Q.indexOf(":");if(Y<=0||!MY(Q.slice(Y+1),J))return{ok:!1};return{ok:!0,encodedCommand:KY(Q.slice(0,Y))}}function G4($){let J=Cq();J.on("clientError",(Q,Y)=>{if(Z(`Client connection error: ${Q.message}`,{level:"error"}),Y.on("error",()=>{}),Q.code!=="ECONNRESET"&&Y.writable){let G=Q.code==="HPE_HEADER_OVERFLOW"?"431 Request Header Fields Too Large":"400 Bad Request";Y.end(`HTTP/1.1 ${G}\r
36
+ `)}function zq($,J,X){return[yX,J,`${X.date}/${X.region}/${X.service}/aws4_request`,O7($)].join(`
37
+ `)}function Eq($,J){let X=J9(`AWS4${$}`,J.date),Q=J9(X,J.region),Y=J9(Q,J.service);return J9(Y,"aws4_request")}function rW($){let J=Kq($),X=zq(J,$.amzDate,$.scope),Q=oW("sha256",Eq($.secretAccessKey,$.scope)).update(X,"utf8").digest("hex"),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=`${$.scope.date}/${$.scope.region}/${$.scope.service}/aws4_request`;return{authorization:`${yX} Credential=${$.accessKeyId}/${G}, SignedHeaders=${Y.join(";")}, Signature=${Q}`,signature:Q,canonicalRequest:J,stringToSign:X}}function O7($){return Oq("sha256").update($).digest("hex")}function J9($,J){return oW("sha256",$).update(J,"utf8").digest()}function lQ($){return Array.isArray($)?$[0]:$}var J4=67108864;class V7 extends Error{}function eW($){return $.length>=3&&$[0]===22&&$[1]===3&&$[2]<=3}function Q4($,J){if(J.length>=3)return Promise.resolve({isTLS:eW(J),head:J});return new Promise((X)=>{let Q=J,Y=()=>{$.removeListener("data",G),$.removeListener("close",Y),X({isTLS:eW(Q),head:Q})},G=(W)=>{if($.pause(),Q=Q.length?Buffer.concat([Q,W]):W,Q.length>=3)return Y();$.resume()};$.on("data",G),$.once("close",Y)})}function Zq($,J){let X=()=>{let Q;while((Q=$.read())!==null)if(!J.write(Q)){J.once("drain",X);return}$.once("readable",X)};X(),$.once("end",()=>J.end())}function X4($,J,X,Q,Y,G,W,U,M=J4){let O=Q7($,W.hostname),V=Fq({ALPNProtocols:["http/1.1"],cert:O.certPem,key:O.keyPem,SNICallback:(F,K)=>{try{K(null,mW($,F||W.hostname))}catch(A){K(A)}}});V.on("request",(F,K)=>{F.on("error",(A)=>{Z(`[tls-terminate] client request error: ${A.message}`,{level:"error"})}),K.on("error",(A)=>{Z(`[tls-terminate] client response error: ${A.message}`,{level:"error"})}),Bq(J,X,Q,F,K,W,U,M)}),V.on("clientError",(F,K)=>{Z(`[tls-terminate] client connection error for ${W.hostname}: ${F.message}`,{level:"error"}),K.destroy()}),V.on("tlsClientError",(F,K)=>{Z(`[tls-terminate] client TLS error for ${W.hostname}: ${F.message}`,{level:"error"}),K.destroy()}),V.on("upgrade",(F,K)=>{Z("[tls-terminate] upgrade request refused",{level:"warn"}),K.destroy()});let H=Cq(),q=()=>{V.close(),Aq(H,()=>{})};V.on("error",(F)=>{Z(`[tls-terminate] inner server listen failed: ${F.message}`,{level:"error"}),Y.destroy(),q()}),V.listen(H,()=>{let F=Lq({path:H});F.on("error",(K)=>{Z(`[tls-terminate] inner loopback failed: ${K.message}`,{level:"error"}),Y.destroy(),q()}),F.once("connect",()=>{if(G.length)F.write(G);Zq(Y,F),F.pipe(Y)}),Y.on("error",()=>F.destroy()),Y.once("close",()=>{F.destroy(),q()}),F.once("close",()=>Y.destroy())}),V.unref()}function $4($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}function Bq(...$){jq(...$).catch((J)=>{Z(`[tls-terminate] forwardUpstream failed: ${J.message}`,{level:"error"})})}async function jq($,J,X,Q,Y,G,W,U=J4){let M=Sq(Q.url),O=Q;if($){let L=new AbortController;Y.once("close",()=>L.abort());let R=G.port===443?G.hostname:`${G.hostname}:${G.port}`,I=await sY($,Q,Y,`https://${R}${M}`,L.signal,G.onFilterRequestDeny);if(I===null)return;if(O=I,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||O.destroyed){O.destroy();return}}let V=h0(Q.headers);delete V.host;let H=W?.(Q.method??"GET",M,V,G.hostname);J?.(V,G.hostname);let q=rY(X,Q,V,G.hostname),F;if(H?.action==="deny"){if(vX(Y,H.reason),O.destroy(),O!==Q)$4(Q,Y);return}if(H?.action==="resign"){let L=H.payloadHash;if(L===void 0){let j=q?O.pipe(q):O;if(q)O.on("error",(C)=>q.destroy(C));try{F=await Tq(j,U)}catch(C){if(C instanceof V7){vX(Y,`AWS SigV4 request uses a masked credential and signs a literal body hash, so the proxy must buffer the body to re-sign it, but the body exceeds the ${U}-byte buffering limit; denied. Sign the payload as UNSIGNED-PAYLOAD to stream it without buffering, or use an unmasked credential to have the request forwarded untouched.`),j.resume();return}Z(`[tls-terminate] failed to buffer body for SigV4 re-sign: ${C.message}`,{level:"error"}),Y.destroy();return}L=O7(F),V["content-length"]=String(F.length)}let R=tW(G.hostname)===6?`[${G.hostname}]`:G.hostname,I=G.port===443?R:`${R}:${G.port}`;try{H.apply(V,I,L)}catch(j){if(vX(Y,`AWS SigV4 re-signing failed: ${j.message}`),O.destroy(),O!==Q)$4(Q,Y);return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&F===void 0&&V["content-length"]===void 0&&V["transfer-encoding"]===void 0)V["transfer-encoding"]="chunked";let A=Nq({host:G.hostname,port:G.port,path:M,method:Q.method,headers:V,...tW(G.hostname)?{}:{servername:G.hostname},...G.upstreamCA?{ca:G.upstreamCA}:{},agent:!1},(L)=>{L.on("error",(R)=>{Z(`[tls-terminate] upstream response error: ${R.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(L.statusCode??502,h0(L.headers)),L.pipe(Y)});if(A.on("error",(L)=>{if(Z(`[tls-terminate] upstream ${G.hostname}:${G.port} failed: ${L.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>A.destroy()),F!==void 0)A.end(F);else if(q)q.on("error",(L)=>A.destroy(L)),O.on("error",(L)=>q.destroy(L)),Y.on("close",()=>q.destroy()),O.pipe(q).pipe(A);else O.on("error",(L)=>A.destroy(L)),O.pipe(A)}function Tq($,J){return new Promise((X,Q)=>{let Y=[],G=0,W=(U)=>{if(G+=U.length,G>J){Y.length=0,$.removeListener("data",W),Q(new V7(`request body exceeds ${J} bytes`));return}Y.push(U)};$.on("data",W),$.once("end",()=>X(Buffer.concat(Y))),$.once("error",Q)})}function Sq($){let J=$??"/";if(J.startsWith("/"))return J;try{let X=new URL(J);return`${X.pathname}${X.search}`||"/"}catch{return J}}var Iq=0;function Cq(){return Dq(Rq(),`srt-tt-${process.pid}-${(Iq++).toString(36)}.sock`)}function vq($,J){if(!J)return{ok:!0};let X=/^basic\s+([a-z0-9+/=]+)\s*$/i.exec($??"");if(!X)return{ok:!1};let Q=Buffer.from(X[1],"base64").toString("utf8"),Y=Q.indexOf(":");if(Y<=0||!OY(Q.slice(Y+1),J))return{ok:!1};return{ok:!0,encodedCommand:zY(Q.slice(0,Y))}}function W4($){let J=Pq();J.on("clientError",(Q,Y)=>{if(Z(`Client connection error: ${Q.message}`,{level:"error"}),Y.on("error",()=>{}),Q.code!=="ECONNRESET"&&Y.writable){let G=Q.code==="HPE_HEADER_OVERFLOW"?"431 Request Header Fields Too Large":"400 Bad Request";Y.end(`HTTP/1.1 ${G}\r
38
38
  \r
39
- `,()=>Y.destroy()),setTimeout(()=>Y.destroy(),1000).unref?.();return}Y.destroy()});let X=(Q)=>_q(Q,$.proxyAuthToken);return J.on("connect",async(Q,Y,G)=>{Y.on("error",(R)=>{Z(`Client socket error: ${R.message}`,{level:"error"}),Y.destroy()});let W=!1;Y.once("close",()=>{W=!0});let U=()=>{W=!0,Y.destroy()},M=65536,O=0,V=!1,H=[],q=(R)=>{if(!V)return;if(O+=R.length,O>M){Z("CONNECT client exceeded pre-establishment capture cap; destroying",{level:"error"}),U();return}H.push(R)};if(!$.mitmCA)V=!0,Y.on("data",q);if(Y.readableEnded)U();else Y.once("end",U);let F=()=>{if(V=!1,H.length)G=Buffer.concat([G,...H]),H.length=0},K=()=>{Y.removeListener("end",U),F()},A=(R)=>{if(W||Y.destroyed||Y.readableEnded||!Y.writable){Z("CONNECT client gone before status write; dropping verdict and destroying socket"),Y.destroy();return}K(),Y.end(R)};if(W||Y.destroyed)return;let L=!1;try{let R=X(Q.headers["proxy-authorization"]);if(!R.ok){A(`HTTP/1.1 407 Proxy Authentication Required\r
39
+ `,()=>Y.destroy()),setTimeout(()=>Y.destroy(),1000).unref?.();return}Y.destroy()});let X=(Q)=>vq(Q,$.proxyAuthToken);return J.on("connect",async(Q,Y,G)=>{Y.on("error",(R)=>{Z(`Client socket error: ${R.message}`,{level:"error"}),Y.destroy()});let W=!1;Y.once("close",()=>{W=!0});let U=()=>{W=!0,Y.destroy()},M=65536,O=0,V=!1,H=[],q=(R)=>{if(!V)return;if(O+=R.length,O>M){Z("CONNECT client exceeded pre-establishment capture cap; destroying",{level:"error"}),U();return}H.push(R)};if(!$.mitmCA)V=!0,Y.on("data",q);if(Y.readableEnded)U();else Y.once("end",U);let F=()=>{if(V=!1,H.length)G=Buffer.concat([G,...H]),H.length=0},K=()=>{Y.removeListener("end",U),F()},A=(R)=>{if(W||Y.destroyed||Y.readableEnded||!Y.writable){Z("CONNECT client gone before status write; dropping verdict and destroying socket"),Y.destroy();return}K(),Y.end(R)};if(W||Y.destroyed)return;let L=!1;try{let R=X(Q.headers["proxy-authorization"]);if(!R.ok){A(`HTTP/1.1 407 Proxy Authentication Required\r
40
40
  Proxy-Authenticate: Basic realm="srt"\r
41
41
  \r
42
- `);return}let I=xq(Q.url);if(!I){Z(`Invalid CONNECT request: ${Q.url}`,{level:"error"}),A(`HTTP/1.1 400 Bad Request\r
42
+ `);return}let I=kq(Q.url);if(!I){Z(`Invalid CONNECT request: ${Q.url}`,{level:"error"}),A(`HTTP/1.1 400 Bad Request\r
43
43
  \r
44
- `);return}let{hostname:T,port:C}=I;if(!await $.filter(C,T,Y,R.encodedCommand)){Z(`Connection blocked to ${T}:${C}`,{level:"error"}),A(`HTTP/1.1 403 Forbidden\r
44
+ `);return}let{hostname:j,port:C}=I;if(!await $.filter(C,j,Y,R.encodedCommand)){Z(`Connection blocked to ${j}:${C}`,{level:"error"}),A(`HTTP/1.1 403 Forbidden\r
45
45
  Content-Type: text/plain\r
46
46
  X-Proxy-Error: blocked-by-allowlist\r
47
47
  \r
48
- Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(T)??T;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connection Established\r
48
+ Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(j)??j;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connection Established\r
49
49
  \r
50
- `),L=!0;let $$=await J4(Y,G);if(W||Y.destroyed){Y.destroy();return}if($$.isTLS){K(),Q4($.mitmCA,$.filterRequest,$.mutateHeaders,$.getBodySubstitutions,Y,$$.head,{hostname:P,port:C,upstreamCA:$.tlsTerminateUpstreamCA,onFilterRequestDeny:$.onFilterRequestDenied?(N$,M$,b$)=>$.onFilterRequestDenied({method:N$,url:M$,reason:b$,encodedCommand:R.encodedCommand}):void 0},$.planSigv4,$.maxSigv4ResignBodyBytes);return}Z(`[tls-terminate] non-TLS bytes on CONNECT ${P}:${C}; opaque-tunnelling`),G=$$.head}else if($.mitmCA)Z(`[tls-terminate] policy exempts ${P}:${C}; opaque-tunnelling`);let l=$.getMitmSocketPath?.(P),k=!l&&$.parentProxy&&!kX($.parentProxy,P)?fX($.parentProxy,{isHttps:!0}):void 0,p;try{if(l)Z(`Routing CONNECT ${P}:${C} through MITM proxy at ${l}`),p=await Y7({dial:()=>wq({path:l}),readyEvent:"connect",destHost:P,destPort:C});else if(k)p=await tY(k,P,C);else p=await eY(P,C)}catch($$){if(Z(`CONNECT tunnel failed: ${$$.message}`,{level:"error"}),L)Y.destroy();else A(`HTTP/1.1 502 Bad Gateway\r
50
+ `),L=!0;let n=await Q4(Y,G);if(W||Y.destroyed){Y.destroy();return}if(n.isTLS){K(),X4($.mitmCA,$.filterRequest,$.mutateHeaders,$.getBodySubstitutions,Y,n.head,{hostname:P,port:C,upstreamCA:$.tlsTerminateUpstreamCA,onFilterRequestDeny:$.onFilterRequestDenied?(Y$,L$,j$)=>$.onFilterRequestDenied({method:Y$,url:L$,reason:j$,encodedCommand:R.encodedCommand}):void 0},$.planSigv4,$.maxSigv4ResignBodyBytes);return}Z(`[tls-terminate] non-TLS bytes on CONNECT ${P}:${C}; opaque-tunnelling`),G=n.head}else if($.mitmCA)Z(`[tls-terminate] policy exempts ${P}:${C}; opaque-tunnelling`);let l=$.getMitmSocketPath?.(P),e=!l&&$.parentProxy&&!kX($.parentProxy,P)?fX($.parentProxy,{isHttps:!0}):void 0,y;try{if(l)Z(`Routing CONNECT ${P}:${C} through MITM proxy at ${l}`),y=await G7({dial:()=>_q({path:l}),readyEvent:"connect",destHost:P,destPort:C});else if(e)y=await eY(e,P,C);else y=await $9(P,C)}catch(n){if(Z(`CONNECT tunnel failed: ${n.message}`,{level:"error"}),L)Y.destroy();else A(`HTTP/1.1 502 Bad Gateway\r
51
51
  \r
52
- `);return}if(W||Y.destroyed){p.on("error",()=>{}),p.destroy(),Y.destroy();return}if(!L)Y.write(`HTTP/1.1 200 Connection Established\r
52
+ `);return}if(W||Y.destroyed){y.on("error",()=>{}),y.destroy(),Y.destroy();return}if(!L)Y.write(`HTTP/1.1 200 Connection Established\r
53
53
  \r
54
- `);if(K(),Y.allowHalfOpen=!0,G.length)p.write(G);p.pipe(Y),Y.pipe(p),p.on("error",($$)=>{Z(`CONNECT tunnel failed: ${$$.message}`,{level:"error"}),Y.destroy()}),Y.on("close",()=>p.destroy()),p.on("close",()=>Y.destroy())}catch(R){if(Z(`Error handling CONNECT: ${R}`,{level:"error"}),L)Y.destroy();else A(`HTTP/1.1 500 Internal Server Error\r
54
+ `);if(K(),Y.allowHalfOpen=!0,G.length)y.write(G);y.pipe(Y),Y.pipe(y),y.on("error",(n)=>{Z(`CONNECT tunnel failed: ${n.message}`,{level:"error"}),Y.destroy()}),Y.on("close",()=>y.destroy()),y.on("close",()=>Y.destroy())}catch(R){if(Z(`Error handling CONNECT: ${R}`,{level:"error"}),L)Y.destroy();else A(`HTTP/1.1 500 Internal Server Error\r
55
55
  \r
56
- `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"error"}),Y.socket?.destroy()});try{if($.mitmCA&&Q.method==="GET"&&new Y4(Q.url??"","http://x").pathname===iY){Y.writeHead(200,{"Content-Type":"application/pkix-crl","Content-Length":$.mitmCA.crlDer.length}),Y.end($.mitmCA.crlDer);return}let G=X(Q.headers["proxy-authorization"]);if(!G.ok){Y.writeHead(407,{"Proxy-Authenticate":'Basic realm="srt"'}),Y.end();return}let W=new Y4(Q.url),U=dJ(W.hostname),M=W.port?parseInt(W.port,10):W.protocol==="https:"?443:80;if(!await $.filter(M,U,Q.socket,G.encodedCommand)){if(Z(`HTTP request blocked to ${U}:${M}`,{level:"error"}),Q.socket.destroyed||Y.destroyed){Y.destroy();return}Y.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-allowlist"}),Y.end("Connection blocked by network allowlist");return}if(Q.socket.destroyed)return;let V=jJ(U)??U,H=(Pq(V)===6?`[${V}]`:V)+(W.port?`:${W.port}`:""),q={...h0(Q.headers),host:H};$.mutateHeadersPlaintext?.(q,V);let F=sY($.getBodySubstitutionsPlaintext,Q,q,V),K=$.getMitmSocketPath?.(V),A=!K&&$.parentProxy&&!kX($.parentProxy,V)?fX($.parentProxy,{isHttps:W.protocol==="https:"}):void 0,L=`${W.protocol}//${H}${W.pathname}${W.search}`,R=Q;if($.filterRequest){let C=new AbortController;Y.once("close",()=>C.abort());let w=await aY($.filterRequest,Q,Y,L,C.signal,$.onFilterRequestDenied?(P,l,k)=>$.onFilterRequestDenied({method:P,url:l,reason:k,encodedCommand:G.encodedCommand}):void 0);if(w===null)return;if(R=w,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||R.destroyed){R.destroy();return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&q["content-length"]===void 0&&q["transfer-encoding"]===void 0)q["transfer-encoding"]="chunked";let T;if(K){Z(`Routing HTTP ${Q.method} ${V}:${M} through MITM proxy at ${K}`);let C=new Iq({socketPath:K});T=V7({agent:C,path:L,method:Q.method,headers:q},(w)=>{w.on("error",(P)=>{Z(`Upstream response error: ${P.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(w.statusCode,h0(w.headers)),w.pipe(Y)})}else if(A){let C=dJ(A.hostname),w=Number(A.port)||(A.protocol==="https:"?443:80),P=G7(A);T=(A.protocol==="https:"?X4:V7)({hostname:C,port:w,path:L,method:Q.method,headers:P?{...q,"proxy-authorization":P}:q},(k)=>{k.on("error",(p)=>{Z(`Upstream response error: ${p.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(k.statusCode,h0(k.headers)),k.pipe(Y)})}else T=(W.protocol==="https:"?X4:V7)({hostname:V,port:M,path:W.pathname+W.search,method:Q.method,headers:q},(w)=>{w.on("error",(P)=>{Z(`Upstream response error: ${P.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(w.statusCode,h0(w.headers)),w.pipe(Y)});if(T.on("error",(C)=>{if(Z(`Proxy request failed: ${C.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>T.destroy()),F)F.on("error",(C)=>T.destroy(C)),R.on("error",(C)=>F.destroy(C)),Y.on("close",()=>F.destroy()),R.pipe(F).pipe(T);else R.on("error",(C)=>T.destroy(C)),R.pipe(T)}catch(G){if(Z(`Error handling HTTP request: ${G}`,{level:"error"}),!Y.headersSent)Y.writeHead(500,{"Content-Type":"text/plain"}),Y.end("Internal Server Error");else Y.destroy()}}),J}function xq($){let J=/^\[([^\]]+)\]:(\d+)$/.exec($)??/^([^:]+):(\d+)$/.exec($);if(!J)return;let X=Number(J[2]);if(!Number.isInteger(X)||X<1||X>65535)return;return{hostname:J[1],port:X}}var K4=g9(q4(),1);function dq($,J,X){if(!X||J===void 0)return!1;return $!==void 0&&($===z0||$.startsWith(`${z0}.`))&&MY(J,X)}function z4($){let J=K4.createServer();if($.proxyAuthToken)J.setAuthHandler((Q,Y,G)=>{if(dq(Q.username,Q.password,$.proxyAuthToken))Y();else Z("SOCKS auth rejected",{level:"error"}),G()});J.setRulesetValidator(async(Q)=>{try{let{destAddress:Y,destPort:G}=Q;if(!mQ(Y))return Z(`Rejecting malformed SOCKS host: ${JSON.stringify(Y)}`,{level:"error"}),!1;if(Z(`Connection request to ${Y}:${G}`),!await $.filter(G,Y,KY(Q.username)))return Z(`Connection blocked to ${Y}:${G}`,{level:"error"}),!1;return Z(`Connection allowed to ${Y}:${G}`),!0}catch(Y){return Z(`Error validating connection: ${Y}`,{level:"error"}),!1}}),J.setConnectionHandler((Q,Y)=>{let G=jJ(Q.destAddress)??Q.destAddress,W=Q.destPort,U=!1,M;Q.socket.once("close",()=>{U=!0,M?.destroy()}),Q.socket.on("error",()=>M?.destroy());let O=$.parentProxy&&!kX($.parentProxy,G)?fX($.parentProxy,{isHttps:!0}):void 0;(O?tY(O,G,W):eY(G,W)).then((H)=>{if(M=H,H.on("error",()=>Q.socket.destroy()),U){H.destroy();return}Y("REQUEST_GRANTED"),H.pipe(Q.socket),Q.socket.pipe(H),H.on("close",()=>Q.socket.destroy())}).catch((H)=>{if(Z(`SOCKS connect to ${G}:${W} failed: ${H.message}`,{level:"error"}),!U)try{Y("HOST_UNREACHABLE")}catch{}})});let X=new Set;return{handleConnection(Q){if(Q.setNoDelay(),X.add(Q),Q.once("close",()=>X.delete(Q)),!$.proxyAuthToken){J._handleConnection(Q);return}iq(Q,(Y)=>{if(Y){J._handleConnection(Q);return}oq(Q,$).catch(()=>Q.destroy())})},async close(){for(let Q of X)Q.destroy();X.clear()}}}var cq=0,nq=2;function iq($,J){let X=Buffer.alloc(0),Q=(Y)=>{if(X=Buffer.concat([X,Y]),X.length<2)return;if(X[0]!==5){$.off("data",Q),$.destroy();return}let G=X[1];if(X.length<2+G)return;$.off("data",Q),$.pause();let U=X.subarray(2,2+G).includes(nq),M=U?X:X.subarray(2+G);if(M.length>0)$.unshift(M);J(U)};$.on("data",Q),$.once("error",()=>$.off("data",Q))}async function oq($,J){$.write(Buffer.from([5,cq]));let X=await aq($);if(X===void 0){$.destroy();return}let{host:Q,port:Y}=X;if(!mQ(Q)){$.end(K7(2));return}let G=J.probeUnauthenticated?await J.probeUnauthenticated(Y,Q):{};if(Z(`SOCKS unauthenticated client refused for ${Q}:${Y}`+(G.deniedReason!==void 0?" (denied by policy)":"")),Y!==22){$.end(K7(2));return}let W=G.deniedReason??"This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.";$.write(K7(0)),$.write(Buffer.from(`SSH-2.0-policy_refusal\r
57
- `)),$.end(sq(W))}function K7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function aq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)},Y=setTimeout(()=>Q(void 0),5000),G=(W)=>{if(X=Buffer.concat([X,W]),X.length<4)return;if(X[0]!==5||X[1]!==1){Q(void 0);return}let U=X[3];if(U===1){if(X.length<10)return;let M=Array.from(X.subarray(4,8)).join(".");Q({host:M,port:X.readUInt16BE(8)})}else if(U===3){if(X.length<5)return;let M=X[4];if(X.length<5+M+2)return;Q({host:X.subarray(5,5+M).toString("utf8"),port:X.readUInt16BE(5+M)})}else if(U===4){if(X.length<22)return;let M=[];for(let O=0;O<16;O+=2)M.push(X.readUInt16BE(4+O).toString(16));Q({host:M.join(":"),port:X.readUInt16BE(20)})}else Q(void 0)};$.on("data",G),$.resume(),$.once("error",()=>Q(void 0)),$.once("close",()=>Q(void 0))})}function sq($){let J=$.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").slice(0,1000),X=Buffer.from(J,"utf8"),Q=Buffer.alloc(0),Y=Buffer.concat([Buffer.from([1]),X9(1),X9(X.length),X,X9(Q.length),Q]),G=8-(5+Y.length)%8;if(G<4)G+=8;return Buffer.concat([X9(1+Y.length+G),Buffer.from([G]),Y,Buffer.alloc(G)])}function X9($){let J=Buffer.alloc(4);return J.writeUInt32BE($,0),J}import{createServer as rq,connect as E4}from"net";import{join as tq}from"path";import{tmpdir as eq}from"os";import{unlink as F4}from"fs/promises";function Y9($,J,X,Q){return new Promise((Y,G)=>{let[W,U]=X??[0,0],M=W,O=()=>{while(Q.has(M)&&M<=U)M++;if(M>U){G(Error(`No free port in range ${W}-${U} (excluding ${[...Q].join(",")})`));return}let V=()=>{$.removeListener("error",H),Y()},H=(q)=>{if($.removeListener("listening",V),X&&q?.code==="EADDRINUSE"&&M<U){M++,O();return}G(q??Error("listen error"))};$.once("error",H),$.once("listening",V),J(X?M:0)};O()})}var $6=new Set([4,5]),J6=1e4,Q6=0;function X6(){return tq(eq(),`srt-mux-${process.pid}-${(Q6++).toString(36)}.sock`)}function N4($){let J=$.firstByteTimeoutMs??J6,X=x$()==="windows",Q,Y,G=new Set;function W(M){if(Q===void 0&&Y===void 0){Z("mux: HTTP dispatch before backend bound; dropping",{level:"error"}),M.destroy();return}let O=Q?E4(Q):E4(Y,"127.0.0.1");O.on("error",(V)=>{let H=V.code??"ERR";if(Z(`mux: HTTP backend dial failed: ${V.message}`,{level:"error"}),!M.destroyed)M.end(`HTTP/1.1 502 Bad Gateway\r
56
+ `)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"error"}),Y.socket?.destroy()});try{if($.mitmCA&&Q.method==="GET"&&new G4(Q.url??"","http://x").pathname===oY){Y.writeHead(200,{"Content-Type":"application/pkix-crl","Content-Length":$.mitmCA.crlDer.length}),Y.end($.mitmCA.crlDer);return}let G=X(Q.headers["proxy-authorization"]);if(!G.ok){Y.writeHead(407,{"Proxy-Authenticate":'Basic realm="srt"'}),Y.end();return}let W=new G4(Q.url),U=dJ(W.hostname),M=W.port?parseInt(W.port,10):W.protocol==="https:"?443:80;if(!await $.filter(M,U,Q.socket,G.encodedCommand)){if(Z(`HTTP request blocked to ${U}:${M}`,{level:"error"}),Q.socket.destroyed||Y.destroyed){Y.destroy();return}Y.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-allowlist"}),Y.end("Connection blocked by network allowlist");return}if(Q.socket.destroyed)return;let V=jJ(U)??U,H=(xq(V)===6?`[${V}]`:V)+(W.port?`:${W.port}`:""),q={...h0(Q.headers),host:H};$.mutateHeadersPlaintext?.(q,V);let F=rY($.getBodySubstitutionsPlaintext,Q,q,V),K=$.getMitmSocketPath?.(V),A=!K&&$.parentProxy&&!kX($.parentProxy,V)?fX($.parentProxy,{isHttps:W.protocol==="https:"}):void 0,L=`${W.protocol}//${H}${W.pathname}${W.search}`,R=Q;if($.filterRequest){let C=new AbortController;Y.once("close",()=>C.abort());let w=await sY($.filterRequest,Q,Y,L,C.signal,$.onFilterRequestDenied?(P,l,e)=>$.onFilterRequestDenied({method:P,url:l,reason:e,encodedCommand:G.encodedCommand}):void 0);if(w===null)return;if(R=w,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||R.destroyed){R.destroy();return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&q["content-length"]===void 0&&q["transfer-encoding"]===void 0)q["transfer-encoding"]="chunked";let j;if(K){Z(`Routing HTTP ${Q.method} ${V}:${M} through MITM proxy at ${K}`);let C=new wq({socketPath:K});j=H7({agent:C,path:L,method:Q.method,headers:q},(w)=>{w.on("error",(P)=>{Z(`Upstream response error: ${P.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(w.statusCode,h0(w.headers)),w.pipe(Y)})}else if(A){let C=dJ(A.hostname),w=Number(A.port)||(A.protocol==="https:"?443:80),P=W7(A);j=(A.protocol==="https:"?Y4:H7)({hostname:C,port:w,path:L,method:Q.method,headers:P?{...q,"proxy-authorization":P}:q},(e)=>{e.on("error",(y)=>{Z(`Upstream response error: ${y.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(e.statusCode,h0(e.headers)),e.pipe(Y)})}else j=(W.protocol==="https:"?Y4:H7)({hostname:V,port:M,path:W.pathname+W.search,method:Q.method,headers:q},(w)=>{w.on("error",(P)=>{Z(`Upstream response error: ${P.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(w.statusCode,h0(w.headers)),w.pipe(Y)});if(j.on("error",(C)=>{if(Z(`Proxy request failed: ${C.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>j.destroy()),F)F.on("error",(C)=>j.destroy(C)),R.on("error",(C)=>F.destroy(C)),Y.on("close",()=>F.destroy()),R.pipe(F).pipe(j);else R.on("error",(C)=>j.destroy(C)),R.pipe(j)}catch(G){if(Z(`Error handling HTTP request: ${G}`,{level:"error"}),!Y.headersSent)Y.writeHead(500,{"Content-Type":"text/plain"}),Y.end("Internal Server Error");else Y.destroy()}}),J}function kq($){let J=/^\[([^\]]+)\]:(\d+)$/.exec($)??/^([^:]+):(\d+)$/.exec($);if(!J)return;let X=Number(J[2]);if(!Number.isInteger(X)||X<1||X>65535)return;return{hostname:J[1],port:X}}var z4=m9(K4(),1);function nq($,J,X){if(!X||J===void 0)return!1;return $!==void 0&&($===z0||$.startsWith(`${z0}.`))&&OY(J,X)}function E4($){let J=z4.createServer();if($.proxyAuthToken)J.setAuthHandler((Q,Y,G)=>{if(nq(Q.username,Q.password,$.proxyAuthToken))Y();else Z("SOCKS auth rejected",{level:"error"}),G()});J.setRulesetValidator(async(Q)=>{try{let{destAddress:Y,destPort:G}=Q;if(!mQ(Y))return Z(`Rejecting malformed SOCKS host: ${JSON.stringify(Y)}`,{level:"error"}),!1;if(Z(`Connection request to ${Y}:${G}`),!await $.filter(G,Y,zY(Q.username)))return Z(`Connection blocked to ${Y}:${G}`,{level:"error"}),!1;return Z(`Connection allowed to ${Y}:${G}`),!0}catch(Y){return Z(`Error validating connection: ${Y}`,{level:"error"}),!1}}),J.setConnectionHandler((Q,Y)=>{let G=jJ(Q.destAddress)??Q.destAddress,W=Q.destPort,U=!1,M;Q.socket.once("close",()=>{U=!0,M?.destroy()}),Q.socket.on("error",()=>M?.destroy());let O=$.parentProxy&&!kX($.parentProxy,G)?fX($.parentProxy,{isHttps:!0}):void 0;(O?eY(O,G,W):$9(G,W)).then((H)=>{if(M=H,H.on("error",()=>Q.socket.destroy()),U){H.destroy();return}Y("REQUEST_GRANTED"),H.pipe(Q.socket),Q.socket.pipe(H),H.on("close",()=>Q.socket.destroy())}).catch((H)=>{if(Z(`SOCKS connect to ${G}:${W} failed: ${H.message}`,{level:"error"}),!U)try{Y("HOST_UNREACHABLE")}catch{}})});let X=new Set;return{handleConnection(Q){if(Q.setNoDelay(),X.add(Q),Q.once("close",()=>X.delete(Q)),!$.proxyAuthToken){J._handleConnection(Q);return}aq(Q,(Y)=>{if(Y){J._handleConnection(Q);return}sq(Q,$).catch(()=>Q.destroy())})},async close(){for(let Q of X)Q.destroy();X.clear()}}}var iq=0,oq=2;function aq($,J){let X=Buffer.alloc(0),Q=(Y)=>{if(X=Buffer.concat([X,Y]),X.length<2)return;if(X[0]!==5){$.off("data",Q),$.destroy();return}let G=X[1];if(X.length<2+G)return;$.off("data",Q),$.pause();let U=X.subarray(2,2+G).includes(oq),M=U?X:X.subarray(2+G);if(M.length>0)$.unshift(M);J(U)};$.on("data",Q),$.once("error",()=>$.off("data",Q))}async function sq($,J){$.write(Buffer.from([5,iq]));let X=await rq($);if(X===void 0){$.destroy();return}let{host:Q,port:Y}=X;if(!mQ(Q)){$.end(z7(2));return}let G=J.probeUnauthenticated?await J.probeUnauthenticated(Y,Q):{};if(Z(`SOCKS unauthenticated client refused for ${Q}:${Y}`+(G.deniedReason!==void 0?" (denied by policy)":"")),Y!==22){$.end(z7(2));return}let W=G.deniedReason??"This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.";$.write(z7(0)),$.write(Buffer.from(`SSH-2.0-policy_refusal\r
57
+ `)),$.end(tq(W))}function z7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function rq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)},Y=setTimeout(()=>Q(void 0),5000),G=(W)=>{if(X=Buffer.concat([X,W]),X.length<4)return;if(X[0]!==5||X[1]!==1){Q(void 0);return}let U=X[3];if(U===1){if(X.length<10)return;let M=Array.from(X.subarray(4,8)).join(".");Q({host:M,port:X.readUInt16BE(8)})}else if(U===3){if(X.length<5)return;let M=X[4];if(X.length<5+M+2)return;Q({host:X.subarray(5,5+M).toString("utf8"),port:X.readUInt16BE(5+M)})}else if(U===4){if(X.length<22)return;let M=[];for(let O=0;O<16;O+=2)M.push(X.readUInt16BE(4+O).toString(16));Q({host:M.join(":"),port:X.readUInt16BE(20)})}else Q(void 0)};$.on("data",G),$.resume(),$.once("error",()=>Q(void 0)),$.once("close",()=>Q(void 0))})}function tq($){let J=$.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").slice(0,1000),X=Buffer.from(J,"utf8"),Q=Buffer.alloc(0),Y=Buffer.concat([Buffer.from([1]),Y9(1),Y9(X.length),X,Y9(Q.length),Q]),G=8-(5+Y.length)%8;if(G<4)G+=8;return Buffer.concat([Y9(1+Y.length+G),Buffer.from([G]),Y,Buffer.alloc(G)])}function Y9($){let J=Buffer.alloc(4);return J.writeUInt32BE($,0),J}import{createServer as eq,connect as F4}from"net";import{join as $6}from"path";import{tmpdir as J6}from"os";import{unlink as N4}from"fs/promises";function G9($,J,X,Q){return new Promise((Y,G)=>{let[W,U]=X??[0,0],M=W,O=()=>{while(Q.has(M)&&M<=U)M++;if(M>U){G(Error(`No free port in range ${W}-${U} (excluding ${[...Q].join(",")})`));return}let V=()=>{$.removeListener("error",H),Y()},H=(q)=>{if($.removeListener("listening",V),X&&q?.code==="EADDRINUSE"&&M<U){M++,O();return}G(q??Error("listen error"))};$.once("error",H),$.once("listening",V),J(X?M:0)};O()})}var Q6=new Set([4,5]),X6=1e4,Y6=0;function G6(){return $6(J6(),`srt-mux-${process.pid}-${(Y6++).toString(36)}.sock`)}function L4($){let J=$.firstByteTimeoutMs??X6,X=v$()==="windows",Q,Y,G=new Set;function W(M){if(Q===void 0&&Y===void 0){Z("mux: HTTP dispatch before backend bound; dropping",{level:"error"}),M.destroy();return}let O=Q?F4(Q):F4(Y,"127.0.0.1");O.on("error",(V)=>{let H=V.code??"ERR";if(Z(`mux: HTTP backend dial failed: ${V.message}`,{level:"error"}),!M.destroyed)M.end(`HTTP/1.1 502 Bad Gateway\r
58
58
  Connection: close\r
59
59
  \r
60
60
  mux backend dial failed (${H})
61
- `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=rq((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on("error",(V)=>Z(`mux: client socket error: ${V.message}`));let O=setTimeout(()=>{Z("mux: first-byte timeout; destroying connection"),M.destroy()},J);if(typeof O.unref==="function")O.unref();M.once("readable",()=>{clearTimeout(O);let V=M.read(1);if(!V||V.length===0){M.destroy();return}if(M.unshift(V),$6.has(V[0]))$.handleSocksConnection(M);else W(M)})});return{server:U,getPort(){let M=U.address();return M&&typeof M==="object"?M.port:void 0},async listenHttpBackend(){if(!X){let O=X6();await F4(O).catch(()=>{}),await new Promise((V,H)=>{$.httpServer.once("error",H),$.httpServer.listen(O,()=>{$.httpServer.removeListener("error",H),V()})}),Q=O,Z(`mux: HTTP backend listening on ${O}`);return}await Y9($.httpServer,(O)=>$.httpServer.listen(O,"127.0.0.1"),$.httpBackendPortRange,new Set);let M=$.httpServer.address();return Y=M&&typeof M==="object"?M.port:void 0,Z(`mux: HTTP backend listening on 127.0.0.1:${Y}`),Y},async close(){for(let M of G)M.destroy();if(G.clear(),await new Promise((M)=>U.close(()=>M())),await new Promise((M)=>$.httpServer.close(()=>M())),Q)await F4(Q).catch(()=>{}),Q=void 0;Y=void 0},unref(){U.unref(),$.httpServer.unref()}}}import{randomBytes as Y6,randomUUID as G6}from"crypto";var bX="fake_value_",L4="abcdefghijklmnopqrstuvwxyz0123456789_-";function W6($){let J=bX+G6(),X=Buffer.byteLength($)-J.length;if(X<=0)return J;let Q=J;for(let Y of Y6(X))Q+=L4[Y%L4.length];return Q}class z7{byName=new Map;bySentinel=new Map;allSentinelsPrefixed=!0;register($,J,X){return this.registerWithSentinel($,W6(J),J,X)}registerWithSentinel($,J,X,Q){let Y=this.byName.get($);if(Y!==void 0)return Y.realValue=X,Y.injectHosts=Q,Y.sentinel;if(!J.startsWith(bX))this.allSentinelsPrefixed=!1;let G={name:$,sentinel:J,realValue:X,injectHosts:Q};return this.byName.set($,G),this.bySentinel.set(J,G),J}lookupReal($){return this.bySentinel.get($)?.realValue}namesInjectableAt($,J){let X=[];for(let Q of this.byName.values())if(Q.injectHosts.some((Y)=>J($,Y)))X.push(Q.name);return X}sentinelsForHost($,J){let X=[];for(let Q of this.bySentinel.values()){if(!Q.injectHosts.some((Y)=>J($,Y)))continue;X.push({sentinel:Buffer.from(Q.sentinel),realValue:Buffer.from(Q.realValue)})}return X}*entries(){for(let $ of this.bySentinel.values())yield[$.sentinel,$.realValue]}get size(){return this.bySentinel.size}clear(){this.byName.clear(),this.bySentinel.clear(),this.allSentinelsPrefixed=!0}substituteInHeaders($,J,X){if(this.bySentinel.size===0)return;for(let[Q,Y]of Object.entries($)){if(Y===void 0)continue;if(Array.isArray(Y))for(let G=0;G<Y.length;G++)Y[G]=this.substituteInHeaderValue(Q,Y[G],J,X);else $[Q]=this.substituteInHeaderValue(Q,Y,J,X)}}substituteInHeaderValue($,J,X,Q){let Y=this.substituteInString(J,X,Q);if($.toLowerCase()!=="authorization")return Y;let G=/^(\s*basic\s+)([a-z0-9+/]+={0,2})(\s*)$/i.exec(Y);if(G===null)return Y;let W=G[2],U=Buffer.from(W,"base64");if(W.length%4!==0||U.toString("base64")!==W)return Y;let M=U.toString("utf8");if(!Buffer.from(M,"utf8").equals(U))return Y;let O=this.substituteInString(M,X,Q);if(O===M)return Y;return`${G[1]}${Buffer.from(O,"utf8").toString("base64")}${G[3]}`}substituteInString($,J,X){if(this.allSentinelsPrefixed&&!$.includes(bX))return $;let Q=$;for(let Y of this.bySentinel.values()){if(!Q.includes(Y.sentinel))continue;if(!Y.injectHosts.some((G)=>X(J,G)))continue;Q=Q.split(Y.sentinel).join(Y.realValue)}return Q}}import{randomUUID as z6}from"crypto";import*as cJ from"fs";import{tmpdir as E6}from"os";import{join as Z4}from"path";function U6($,J){let X=!1;for(let Q=J+1;Q<$.length;Q++){let Y=$[Q];if(X){X=!1;continue}if(Y==="\\")X=!0;else if(Y==="]")return Q+1}return $.length}function M6($){switch($){case"s":return{kind:"whitespace"};case"S":return{kind:"non-whitespace"};case"d":return{kind:"digit"};case"D":return{kind:"non-digit"};case"w":return{kind:"word"};case"W":return{kind:"non-word"};default:return{kind:"unknown"}}}function A4($,J){if($===null||J===null)return!0;if($.kind==="literal"&&J.kind==="literal")return $.value===J.value;if($.kind==="whitespace"&&J.kind==="non-whitespace"||$.kind==="non-whitespace"&&J.kind==="whitespace"||$.kind==="digit"&&J.kind==="non-digit"||$.kind==="non-digit"&&J.kind==="digit"||$.kind==="word"&&J.kind==="non-word"||$.kind==="non-word"&&J.kind==="word")return!1;return!0}function O6($,J){if($[J+1]!=="?")return{next:J+1,capturing:!0};if($[J+2]==="<"){let Q=$[J+3];if(Q==="="||Q==="!")return{next:J+4,capturing:!1};let Y=$.indexOf(">",J+3);return{next:Y===-1?J+3:Y+1,capturing:!0}}return{next:J+3,capturing:!1}}function V6($,J){let X=$[J];if(X==="*"||X==="+")return{next:$[J+1]==="?"?J+2:J+1,unbounded:!0};if(X==="?")return{next:$[J+1]==="?"?J+2:J+1,unbounded:!1};if(X!=="{")return null;let Q=J+1,Y=Q;while(/[0-9]/.test($[Q]??""))Q++;if(Q===Y)return null;let G=Number($.slice(Y,Q)),W=G,U=!1;if($[Q]===","){Q++;let M=Q;while(/[0-9]/.test($[Q]??""))Q++;if(Q===M)U=!0,W=void 0;else W=Number($.slice(M,Q))}if($[Q]!=="}")return null;if(!Number.isFinite(G)||G>4096||W!==void 0&&(!Number.isFinite(W)||W>4096))return{next:Q+1,unbounded:U,error:"finite repetitions must be at most 4096"};if(Q++,$[Q]==="?")Q++;return{next:Q,unbounded:U}}function H6($){let J=[{previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}],X=0,Q=()=>J[J.length-1],Y=(G)=>{let W=Q();if(W.lastAtom?.hasUnboundedQuantifier&&G.hasUnboundedQuantifier&&W.lastAtom.repeatClass!==null&&G.repeatClass!==null&&A4(W.lastAtom.repeatClass,G.repeatClass))W.error="adjacent unbounded repetition with overlapping input is not supported";if(W.previousAtom=W.lastAtom,W.lastAtom=G,W.atomCount===0)W.simpleClass=G.repeatClass;else W.simpleClass=null;if(W.atomCount++,G.kind==="group")W.containsQuantifier||=G.containsQuantifier,W.containsAlternation||=G.containsAlternation;W.hasUnboundedQuantifier||=G.hasUnboundedQuantifier};for(let G=0;G<$.length;){if(Q().error!==void 0)return{groupCount:X,error:Q().error};let W=$[G];if(W==="\\"){let M=$[G+1];if(M!==void 0&&/[1-9]/.test(M)||M==="k"&&$[G+2]==="<")return{groupCount:X,error:"backreferences are not supported by the safe extractor"};let O=M==="b"||M==="B";if(Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:M6(M)}),G+=M===void 0?1:2,O)Q().previousAtom=null,Q().lastAtom=null;continue}if(W==="["){Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:{kind:"unknown"}}),G=U6($,G);continue}if(W==="("){let M=O6($,G);if(M.capturing)X++;J.push({previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}),G=M.next;continue}if(W===")"){if(J.length>1){let M=J.pop();if(M.error!==void 0)return{groupCount:X,error:M.error};Y({kind:"group",containsQuantifier:M.containsQuantifier,containsAlternation:M.containsAlternation,hasUnboundedQuantifier:M.hasUnboundedQuantifier,repeatClass:M.atomCount===1&&!M.containsAlternation?M.simpleClass:null})}G++;continue}if(W==="|"){Q().containsAlternation=!0,Q().previousAtom=null,Q().lastAtom=null,G++;continue}let U=V6($,G);if(U!==null){if(U.error)return{groupCount:X,error:U.error};let M=Q(),O=M.lastAtom;if(U.unbounded&&O?.kind==="group"&&(O.containsQuantifier||O.containsAlternation))return{groupCount:X,error:"nested unbounded repetition or unbounded alternation is not supported"};if(U.unbounded&&M.previousAtom?.hasUnboundedQuantifier&&O!==null&&M.previousAtom.repeatClass!==null&&O.repeatClass!==null&&A4(M.previousAtom.repeatClass,O.repeatClass))return{groupCount:X,error:"adjacent unbounded repetition with overlapping input is not supported"};if(M.containsQuantifier=!0,O!==null)M.lastAtom={...O,containsQuantifier:!0,hasUnboundedQuantifier:O.hasUnboundedQuantifier||U.unbounded};M.hasUnboundedQuantifier||=U.unbounded,G=U.next;continue}if(W!=="^"&&W!=="$")Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:W==="."?{kind:"any"}:{kind:"literal",value:W}});else Q().previousAtom=null,Q().lastAtom=null;G++}return{groupCount:X,error:Q().error}}function E7($){if($.length>2048)throw Error("Credential extract pattern exceeds the 2048-character limit");let J;try{J=new RegExp($)}catch{throw Error("Credential extract pattern is not a valid regular expression")}let X=H6($);if(X.error!==void 0)throw Error(`Credential extract pattern rejected: ${X.error}`);return{regex:J,groupCount:X.groupCount}}function q6($,J=""){E7($);try{return new RegExp($,J)}catch{throw Error("Credential extract pattern is not supported by this runtime")}}function G9($,J,X,Q={}){if($.length>1048576)throw Error("Credential extraction input exceeds the 1048576-character limit");let Y=q6(J,"gd"),G=new Map,W=new Map,U=[],M=0;for(let H of $.matchAll(Y)){if(M++,M>4096)throw Error("Credential extraction exceeds the 4096-match limit");let q=H[1];if(q===void 0)throw Error(`Credential extraction matched at offset ${H.index} without a group-1 capture; group 1 must capture the credential value on every match.`);if(q.length===0)continue;let F=G.get(q);if(F===void 0)G.set(q,F=G.size);let[K,A]=H.indices[1],L=X(q,F);if(!W.has(q))W.set(q,L);U.push({start:K,end:A,sentinel:L})}if(G.size===0)return null;if(Q.maskDuplicates){let H=[...G.keys()].sort((q,F)=>F.length-q.length);for(let q of H){let F=W.get(q);if(F===q)continue;for(let K=$.indexOf(q);K!==-1;K=$.indexOf(q,K+1)){let A=K+q.length;if(U.some((L)=>K<L.end&&L.start<A))continue;U.push({start:K,end:A,sentinel:F})}}U.sort((q,F)=>q.start-F.start)}let O="",V=0;for(let H of U)O+=$.slice(V,H.start)+H.sentinel,V=H.end;return{fakeContent:O+$.slice(V),captures:[...G.keys()]}}var R4="(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";function F7($){try{return JSON.parse(Buffer.from($,"base64url").toString("utf8"))}catch{return}}function W9($){let J=$.split(".");if(J.length!==3)return!1;let X=F7(J[0]);if(typeof X!=="object"||X===null||!("alg"in X))return!1;return F7(J[1])!==void 0}var K6=9999999999,D4="c3J0LWZha2U";function N7($){return Buffer.from($,"utf8").toString("base64url")}function U9($){let J=N7(JSON.stringify({alg:"HS256",typ:"JWT"})),X=N7(JSON.stringify({sub:bX+$,exp:K6}));return`${J}.${X}.${D4}`}function M9($,J,X){let[Q,Y]=$.split("."),G=F7(Y??"");if(typeof G!=="object"||G===null||Array.isArray(G))return null;let W=G,U=[];for(let O of J){let V=W[O];if(typeof V==="string")U.push([O,V])}if(U.length===0)return null;let M=new Map;for(let[O,V]of U){let H=X(O,V);W[O]=H,M.set(O,H)}return{fakeToken:`${Q}.${N7(JSON.stringify(W))}.${D4}`,claimSentinels:M}}var F6="file:";class L7{dir;byKey=new Map;write($,J){if(this.dir===void 0)this.dir=cJ.mkdtempSync(Z4(E6(),"srt-credmask-"));let X=this.byKey.get($);if(X===void 0)X=Z4(this.dir,`${this.byKey.size}.fake`),this.byKey.set($,X);return cJ.rmSync(X,{force:!0}),cJ.writeFileSync(X,J,{mode:384}),X}dispose(){if(this.dir!==void 0)try{cJ.rmSync(this.dir,{recursive:!0,force:!0})}catch($){Z(`MaskedFileStore cleanup failed: ${$}`,{level:"error"})}this.dir=void 0,this.byKey.clear()}get dirPath(){return this.dir}}function B4($,J,X,Q){let Y=[],G=[];for(let W of $){if(W.mode!=="mask")continue;let U=JJ(W.path),M;try{if(cJ.statSync(U).isDirectory()){Z(`[credential-mask] Skipping masked file entry that resolves to a directory: ${W.path} \u2014 use mode "deny" for directories.`,{level:"warn"});continue}let K=cJ.readFileSync(U);if(M=K.toString("utf8"),Buffer.byteLength(M,"utf8")!==K.length){Z(`[credential-mask] Skipping masked file with non-UTF-8 content (binary credential files are not supported in mask mode): ${W.path}`,{level:"warn"});continue}}catch(F){Z(`[credential-mask] Skipping masked file (unreadable on host): ${W.path} \u2014 ${F.message}`);continue}let O=W.injectHosts??J,V=F6+U,H;if(W.extract===void 0&&W.decode===void 0)H=X.register(V,M,O);else{let F=W.extract??R4,K=0,A=G9(M,F,(L,R)=>{if(W.decode==="jwt"&&!W9(L))return L;let I=`${V}#${R}`;if(W.decode==="jwt"&&W.maskClaims?.length){let T=M9(L,W.maskClaims,(w,P)=>X.register(`${V}#jwt${R}.${w}`,P,O));if(T===null)return Z(`[credential-mask] ${W.path}: verified JWT candidate has none of maskClaims ${JSON.stringify(W.maskClaims)} as `+"string claims \u2014 left unmasked."),L;let C=W.maskClaims.filter((w)=>!T.claimSentinels.has(w));if(C.length>0)Z(`[credential-mask] ${W.path}: maskClaims ${JSON.stringify(C)} absent or non-string in a `+"verified JWT \u2014 skipped.");return K++,X.registerWithSentinel(I,T.fakeToken,L,O)}return K++,W.decode==="jwt"?X.registerWithSentinel(I,U9(z6()),L,O):X.register(I,L,O)},{maskDuplicates:W.maskDuplicates??!1});if(A===null||K===0){let L=W.decode==="jwt"?W.maskClaims?.length?`decode "jwt" with pattern "${F}" that matched no verified JWT with maskable claims (maskClaims: ${JSON.stringify(W.maskClaims)})`:`decode "jwt" with pattern "${F}" that matched no verified JWT`:`extract pattern "${F}" that matched nothing`,R=W.onExtractNoMatch??"warn";if(R==="error")throw Error(`credentials.files entry "${W.path}": ${L} (onExtractNoMatch: "error"). Fix the config, change to "warn"/"deny", or remove the entry.`);if(R==="deny"){Z(`[credential-mask] ${W.path} has ${L} \u2014 degrading to `+'mode "deny".',{level:"warn"}),G.push(U);continue}let I=`[sandbox-runtime] WARNING: credentials.files entry "${W.path}" has ${L} in the file. The file is left UNPROTECTED (readable as-is inside the sandbox). Fix the config, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(I),Z(I,{level:"warn"});continue}H=A.fakeContent}let q=Q.write(V,H);Y.push({realPath:U,fakePath:q})}return{binds:Y,degradeToDenyPaths:G}}import{randomUUID as N6}from"crypto";var O9="env:";function j4($,J,X,Q=process.env){let Y={},G=[];for(let W of $){if(W.mode!=="mask")continue;let U=Q[W.name];if(U===void 0)continue;let M=W.injectHosts??J;if(W.decode==="jwt"){if(!W9(U)){let V=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has decode "jwt" but its value did not verify as a JWT. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(V),Z(V,{level:"warn"});continue}if(W.maskClaims?.length){let V=M9(U,W.maskClaims,(q,F)=>X.register(`${O9}${W.name}#${q}`,F,M));if(V===null){let q=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has maskClaims ${JSON.stringify(W.maskClaims)} but none is present as a string claim in its JWT value. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(q),Z(q,{level:"warn"});continue}let H=W.maskClaims.filter((q)=>!V.claimSentinels.has(q));if(H.length>0)Z(`[credential-mask] env var "${W.name}": maskClaims ${JSON.stringify(H)} absent or non-string in the `+"JWT \u2014 skipped.");Y[W.name]=X.registerWithSentinel(`${O9}${W.name}`,V.fakeToken,U,M);continue}Y[W.name]=X.registerWithSentinel(`${O9}${W.name}`,U9(N6()),U,M);continue}if(W.extract===void 0){Y[W.name]=X.register(W.name,U,M);continue}let O=G9(U,W.extract,(V,H)=>X.register(`${O9}${W.name}#${H}`,V,M));if(O===null){let V=W.onExtractNoMatch??"warn";if(V==="error")throw Error(`credentials.envVars entry "${W.name}": extract pattern "${W.extract}" matched nothing (onExtractNoMatch: "error"). Fix the regex, change to "warn"/"deny", or remove the entry.`);if(V==="deny"){Z(`[credential-mask] extract pattern /${W.extract}/ matched nothing in the value of ${W.name} \u2014 unsetting the variable.`,{level:"warn"}),G.push(W.name);continue}let H=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has extract pattern "${W.extract}" that matched nothing in the variable's value. The variable is left UNPROTECTED (visible as-is inside the sandbox). Fix the regex, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(H),Z(H,{level:"warn"});continue}Y[W.name]=O.fakeContent}return{setEnvVars:Y,degradeToUnsetNames:G}}var T4="AWS_ACCESS_KEY_ID",S4="AWS_SECRET_ACCESS_KEY",I4="AWS_SESSION_TOKEN";class A7{bySentinel=new Map;register($){this.bySentinel.set($.accessKeyIdSentinel,$)}lookup($){return this.bySentinel.get($)}get size(){return this.bySentinel.size}clear(){this.bySentinel.clear()}}function C4($,J,X,Q,Y,G=process.env){let W=[...J??[]],U=new Set(W.flatMap((H)=>[H.accessKeyIdVar,H.secretAccessKeyVar,...H.sessionTokenVar?[H.sessionTokenVar]:[]]));if(![T4,S4,I4].some((H)=>U.has(H)))W.push({accessKeyIdVar:T4,secretAccessKeyVar:S4,sessionTokenVar:I4});let O=(H)=>$.find((q)=>q.name===H&&q.mode==="mask"&&q.extract===void 0&&q.decode===void 0),V=(H)=>O(H)!==void 0?Q[H]:void 0;for(let H of W){let q=V(H.accessKeyIdVar),F=V(H.secretAccessKeyVar)!==void 0,K=G[H.accessKeyIdVar],A=G[H.secretAccessKeyVar];if(q===void 0||!F||K===void 0||A===void 0){if(F&&q===void 0){let T=`[sandbox-runtime] WARNING: "${H.secretAccessKeyVar}" is masked but "${H.accessKeyIdVar}" is not, so no AWS credential pair was registered. SigV4 requests will be signed with the masked placeholder secret and the proxy cannot `+"detect or re-sign them \u2014 they will fail upstream. Mask both "+"variables (whole-value) to enable re-signing.";console.warn(T),Z(T,{level:"warn"})}continue}let L=O(H.accessKeyIdVar),I=(H.sessionTokenVar!==void 0?V(H.sessionTokenVar):void 0)!==void 0&&H.sessionTokenVar!==void 0?G[H.sessionTokenVar]:void 0;Y.register({accessKeyIdSentinel:q,realAccessKeyId:K,realSecretAccessKey:A,...I!==void 0?{realSessionToken:I}:{},injectHosts:L.injectHosts??X}),Z(`[credential-aws] registered SigV4 pair for ${H.accessKeyIdVar}/${H.secretAccessKeyVar}`+(I!==void 0?" (+session token)":""))}}function L6($){return{streaming:$?.streaming??"deny",presigned:$?.presigned??"deny",sigv4a:$?.sigv4a??"deny"}}function w4($,J,X){let Q=L6(J);return(Y,G,W,U)=>{if($.size===0)return;let M=oW(W,G);if(M===null)return;let O=$.lookup(M.accessKeyId);if(O===void 0)return;if(!O.injectHosts.some((K)=>X(U,K)))return;if(M.kind!=="header-sigv4"){if(Q[M.kind]==="passthrough"){Z(`[credential-aws] ${M.kind} request with masked credential passed through un-resigned per credentials.sigv4.${M.kind} (its signature covers the placeholder secret and will fail upstream)`);return}return{action:"deny",reason:`AWS SigV4 ${M.kind} request uses a masked credential but cannot be re-signed by the sandbox proxy; denied by policy. Set credentials.sigv4.${M.kind} to "passthrough" to forward it unmodified (it will fail upstream: the signature covers the masked placeholder).`}}let V=aW(lQ(W.authorization));if(V===null)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but its Authorization header is malformed; the proxy cannot re-sign it."};let H=lQ(W["x-amz-date"]);if(H===void 0)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it."};let q=[...V.signedHeaders];for(let K of q){if(K==="host")continue;if(K==="x-amz-security-token"&&O.realSessionToken!==void 0)continue;if(W[K]===void 0)return{action:"deny",reason:`AWS SigV4 request uses a masked credential but signed header "${K}" is missing; the proxy cannot re-sign it.`}}if(O.realSessionToken!==void 0&&!q.includes("x-amz-security-token"))q.push("x-amz-security-token");let F=lQ(W["x-amz-content-sha256"]);return{action:"resign",payloadHash:F===J9?J9:void 0,apply(K,A,L){if(O.realSessionToken!==void 0)K["x-amz-security-token"]=O.realSessionToken;if(K["x-amz-content-sha256"]!==void 0&&F!==J9)K["x-amz-content-sha256"]=L;let{authorization:R}=sW({method:Y,requestTarget:G,headers:K,hostHeader:A,signedHeaders:q,payloadHash:L,amzDate:H,scope:{date:V.date,region:V.region,service:V.service},accessKeyId:O.realAccessKeyId,secretAccessKey:O.realSecretAccessKey});K.authorization=R}}}}import{spawnSync as A6}from"child_process";function R0($){if(typeof globalThis.Bun<"u")return globalThis.Bun.which($);let J=A6("which",[$],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000});if(J.status===0&&J.stdout)return J.stdout.trim();return null}import*as p0 from"fs";import{randomBytes as _K}from"crypto";function CJ($){return $.map((J)=>{if(J==="")return"''";if(/^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/.test(J))return J;return"'"+J.replace(/'/g,`'"'"'`)+"'"}).join(" ")}import{randomBytes as d6}from"crypto";import*as t from"fs";import{spawn as o4}from"child_process";import{tmpdir as E9}from"os";import f$,{join as a4}from"path";import{spawn as R6}from"child_process";import{text as P4}from"stream/consumers";var D6={ms:1e4};class V9 extends Error{constructor($){super(`ripgrep timed out after ${$} ms`);this.name="RipgrepTimeoutError"}}async function R7($,J,X,Q={command:"rg"}){let{command:Y,args:G=[],argv0:W}=Q,U=R6(Y,[...G,...$,J],{argv0:W,env:{PATH:process.env.PATH??"/usr/bin:/bin"},signal:X,windowsHide:!0}),M=D6.ms,O=!1,V=setTimeout(()=>{O=!0,U.kill("SIGKILL")},M),H,q,F;try{[H,q,F]=await Promise.all([P4(U.stdout),P4(U.stderr),new Promise((K,A)=>{U.on("close",K),U.on("error",A)})])}finally{clearTimeout(V)}if(O)throw new V9(M);if(F===0)return H.trim().split(`
62
- `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as O0,dirname as Z6}from"path";import{fileURLToPath as B6}from"url";import*as H9 from"fs";import{homedir as j6}from"os";var D7=new Map,Z7=null;function T6(){if(Z7)return Z7;let $=[],J=j6();return $.push(O0("/usr","lib","node_modules","@anthropic-ai","sandbox-runtime"),O0("/usr","local","lib","node_modules","@anthropic-ai","sandbox-runtime"),O0("/opt","homebrew","lib","node_modules","@anthropic-ai","sandbox-runtime"),O0(J,".npm","lib","node_modules","@anthropic-ai","sandbox-runtime"),O0(J,".npm-global","lib","node_modules","@anthropic-ai","sandbox-runtime")),Z7=$,$}function _4(){let $=process.arch;switch($){case"x64":case"x86_64":return"x64";case"arm64":case"aarch64":return"arm64";case"ia32":case"x86":return Z("[SeccompFilter] 32-bit x86 (ia32) is not currently supported due to missing socketcall() syscall blocking. The current seccomp filter only blocks socket(AF_UNIX, ...), but on 32-bit x86, socketcall() can be used to bypass this.",{level:"error"}),null;default:return Z(`[SeccompFilter] Unsupported architecture: ${$}. Only x64 and arm64 are supported.`),null}}function S6($){let J=_4();if(!J)return[];let X=Z6(B6(import.meta.url)),Q=O0("vendor","seccomp",J,$);return[O0(X,Q),O0(X,"..","..",Q),O0(X,"..",Q)]}function B7($){let J=$??"";if(D7.has(J))return D7.get(J);let X=I6($);return D7.set(J,X),X}function I6($){if($){if(H9.existsSync($))return Z(`[SeccompFilter] Using apply-seccomp binary from explicit path: ${$}`),$;Z(`[SeccompFilter] Explicit path provided but file not found: ${$}`)}let J=_4();if(!J)return Z(`[SeccompFilter] Cannot find apply-seccomp binary: unsupported architecture ${process.arch}`),null;Z(`[SeccompFilter] Looking for apply-seccomp binary for architecture: ${J}`);for(let X of S6("apply-seccomp"))if(H9.existsSync(X))return Z(`[SeccompFilter] Found apply-seccomp binary: ${X} (${J})`),X;for(let X of T6()){let Q=O0(X,"vendor","seccomp",J,"apply-seccomp");if(H9.existsSync(Q))return Z(`[SeccompFilter] Found apply-seccomp binary in global install: ${Q} (${J})`),Q}return Z(`[SeccompFilter] apply-seccomp binary not found in any expected location (${J})`),null}import{spawnSync as C6}from"child_process";import{createHash as w6}from"crypto";import*as r from"fs";import nJ from"path";class uX extends Error{}var P6={dir:"/run/srt-stubs",uid:0,lockWaitMs:2000,flockPath:"/usr/bin/flock"},pQ=P6,_6,k4;var q9=r.constants.O_CLOEXEC??524288,j7={kind:"masked"},x4={kind:"real"},hX={kind:"unregistered"},x6=new Set(["ENOENT","EACCES"]),v6=new Set(["ENOENT","ENOTDIR","EROFS"]),V0=null,HQ=null,k6=0;function gX($){return $?.code}function S7($){return w6("sha256").update($).digest("hex")}function I7(){if(process.platform!=="linux")return"off";let{dir:$,uid:J,flockPath:X}=pQ;if(process.geteuid?.()!==J)return"off";try{r.accessSync(X,r.constants.X_OK)}catch(Y){return x6.has(gX(Y)??"")?"off":"error"}try{r.mkdirSync($,{mode:448}),r.chmodSync($,448)}catch(Y){let G=gX(Y)??"";if(G!=="EEXIST")return v6.has(G)?"off":"error"}let Q;try{Q=r.lstatSync($)}catch{return"error"}if(!Q.isDirectory()||Q.uid!==J||(Q.mode&511)!==448)return Z(`[Sandbox Linux] ${$} is not a 0700 directory owned by uid ${J}; mask stubs are not shared`,{level:"warn"}),"off";return $}function f4($,J){try{return r.openSync(nJ.join($,J),r.constants.O_RDONLY|r.constants.O_CREAT|r.constants.O_NOFOLLOW|q9,384)}catch{return null}}function y4($,J){try{return C6(pQ.flockPath,[...J,"3"],{stdio:["ignore","ignore","ignore",$],timeout:pQ.lockWaitMs+5000}).status===0}catch{return!1}}function v4($,J,X){let Q=f4($,J);if(Q===null)return null;let Y=(pQ.lockWaitMs/1000).toFixed(3);if(y4(Q,[X,"-w",Y]))return Q;return r.closeSync(Q),null}function b4($){try{r.closeSync($)}catch{}}function h4(){let $=I7();if($==="off")return!1;if($==="error")throw new uX(`srt: cannot read the mask stub registry ${pQ.dir}; refusing to start the sandbox`);if(V0===null)V0=v4($,"lock","-s");if(V0!==null&&HQ===null)HQ=v4($,"claims","-x");if(V0===null||HQ===null)throw new uX(`srt: mask stub registry ${$} is busy (no ${V0===null?"shared":"claims"} lock within ${pQ.lockWaitMs} ms); refusing to start the sandbox rather than risk a mask another call removes`);return!0}function K9(){if(HQ===null)return;b4(HQ),HQ=null}function f6(){if(V0===null)return;b4(V0),V0=null}function u4(){let $=I7();if($==="off")return null;if($==="error"||V0===null||HQ===null)throw new uX("srt: mask stub claimed without holding the registry; refusing to start the sandbox");return $}function mX($){try{return r.lstatSync($,{bigint:!0})}catch(J){return gX(J)==="ENOENT"?"absent":"unknown"}}function g4($){try{let J=JSON.parse(r.readFileSync($,"utf8")),{v:X,type:Q,uid:Y,dev:G,ino:W,ctimeNs:U,path:M}=J,O=(V)=>typeof V==="string"&&/^\d+$/.test(V);if(X!==1||Q!=="f"&&Q!=="d"||typeof Y!=="number"||!O(G)||!O(W)||!O(U)||typeof M!=="string"||!M.startsWith("/"))return null;return{type:Q,uid:Y,dev:BigInt(G),ino:BigInt(W),ctimeNs:BigInt(U),dest:M}}catch{return null}}function m4($,J){return nJ.join($,`${S7(J)}.stub`)}function y6($,J){let X=S7(J.dest),Q=nJ.join($,`${X}.stub.${process.pid}-${++k6}`),Y=JSON.stringify({v:1,type:J.type,uid:J.uid,dev:String(J.dev),ino:String(J.ino),ctimeNs:String(J.ctimeNs),path:J.dest});r.writeFileSync(Q,Y+`
63
- `,{flag:"wx",mode:384}),r.renameSync(Q,nJ.join($,`${X}.stub`))}function l4($,J){return(J.type==="f"?$.isFile()&&$.size===BigInt(0):$.isDirectory())&&$.uid===BigInt(J.uid)&&$.dev===J.dev&&$.ino===J.ino&&$.ctimeNs===J.ctimeNs}function C7($){let J=nJ.dirname($),X;try{X=r.openSync(J,r.constants.O_RDONLY|r.constants.O_DIRECTORY|r.constants.O_NOFOLLOW|q9)}catch{return null}try{if(r.readlinkSync(`/proc/self/fd/${X}`)===J)return X}catch{}return r.closeSync(X),null}function p4($,J,X){return{type:$,uid:Number(J.uid),dev:J.dev,ino:J.ino,ctimeNs:J.ctimeNs,dest:X}}function b6($){let J=C7($);if(J===null)return null;try{let X;try{X=r.openSync(`/proc/self/fd/${J}/${nJ.basename($)}`,r.constants.O_RDONLY|r.constants.O_CREAT|r.constants.O_EXCL|r.constants.O_NOFOLLOW|q9,292)}catch(Q){return gX(Q)==="EEXIST"?"exists":null}try{return k4?.($),p4("f",r.fstatSync(X,{bigint:!0}),$)}finally{r.closeSync(X)}}finally{r.closeSync(J)}}function h6($,J){let X=C7($);if(X===null)return null;try{let Q=`/proc/self/fd/${X}/${nJ.basename($)}`;try{r.mkdirSync(Q,{mode:493})}catch(G){return gX(G)==="EEXIST"?"exists":null}k4?.($);let Y;try{Y=r.openSync(Q,r.constants.O_RDONLY|r.constants.O_DIRECTORY|r.constants.O_NOFOLLOW|q9)}catch{return null}try{let G=r.fstatSync(Y,{bigint:!0});if(!G.isDirectory()||G.uid!==BigInt(process.geteuid?.()??-1)||G.nlink>BigInt(2)||r.readdirSync(`/proc/self/fd/${Y}`).length!==0)return null;if(J)r.fchownSync(Y,J.uid,J.gid);return p4("d",r.fstatSync(Y,{bigint:!0}),$)}catch{return null}finally{r.closeSync(Y)}}finally{r.closeSync(X)}}function u6($){let J=C7($.dest);if(J===null)return;try{let X=`/proc/self/fd/${J}/${nJ.basename($.dest)}`,Q=mX(X);if(typeof Q==="object"&&l4(Q,$)){if($.type==="d")r.rmdirSync(X);else r.unlinkSync(X);Z(`[Sandbox Linux] Removed shared mask stub: ${$.dest}`)}}catch{}finally{r.closeSync(J)}}function g6($){try{r.unlinkSync($)}catch{}}function T7($,J,X,Q){let Y=g4(m4($,J));return Y!==null&&Y.type===Q&&Y.dest===J&&l4(X,Y)}function d4($,J,X){let Q=u4();if(Q===null)return hX;if(_6?.($)==="unregistered")return hX;let Y=mX($);if(Y==="unknown")return hX;if(Y!=="absent")return T7(Q,$,Y,J)?j7:x4;let G=X();if(G==="exists"){let W=mX($);return typeof W==="object"&&T7(Q,$,W,J)?j7:x4}if(G===null)return hX;try{y6(Q,G)}catch(W){Z(`[Sandbox Linux] mask stub marker not written for ${$}: ${W}`,{level:"warn"})}return j7}function m6($){return d4($,"f",()=>b6($))}function l6($,J){return d4($,"d",()=>h6($,J))}function c4($,J){let X=u4();if(X===null)return null;let Q=(G)=>J.some((W)=>G.startsWith(W+"/")),Y=[];for(let G=nJ.dirname($);Q(G);G=nJ.dirname(G))Y.unshift(G);for(let G of Y){let W=mX(G);if(typeof W==="object"&&T7(X,G,W,"d"))return G}return null}function n4($,J){try{return $()}catch(X){if(X instanceof uX)throw X;return Z(`[Sandbox Linux] mask stub not recorded for ${J}: ${X}`,{level:"warn"}),hX}}function w7($){return n4(()=>m6($),$)}function i4($,J){return n4(()=>l6($,J),$)}function p6($){let J;try{J=r.readdirSync($)}catch{return}let X=[],Q=[];for(let G of J){let W=/^([0-9a-f]{64})\.stub(\..*)?$/.exec(G);if(W===null)continue;let U=nJ.join($,G);if(Q.push(U),W[2]===void 0){let M=g4(U);if(M!==null&&S7(M.dest)===W[1])X.push(M)}}let Y=(G)=>G.dest.split("/").length;X.sort((G,W)=>G.type===W.type?Y(W)-Y(G):G.type==="f"?-1:1);for(let G of X)u6(G);for(let G of Q)g6(G)}function P7($,J){let X=I7(),Q=V0!==null;if(K9(),f6(),X==="off"){for(let G of $)J(G);return[]}if(X==="error")return[...$];if(!Q&&$.length===0)return[];let Y=f4(X,"lock");if(Y===null)return[...$];try{if(!y4(Y,["-x","-n"]))return[...$];for(let G of $)if(mX(m4(X,G))==="absent")J(G);return p6(X),[]}catch(G){return Z(`[Sandbox Linux] mask stub sweep failed: ${G}`,{level:"warn"}),[...$]}finally{r.closeSync(Y)}}var v7=3;function c6($){let J=$.uid===void 0?$.bwrapCommand:[$.setprivPath??"/usr/bin/setpriv",`--reuid=${$.uid}`,`--regid=${$.gid??$.uid}`,"--clear-groups","--inh-caps=-all","--ambient-caps=-all","--bounding-set=-all",...$.bwrapCommand],X=$.unsetEnvVars??[],Q=Object.entries($.setEnvVars??{});if(X.length===0&&Q.length===0)return J;return["/usr/bin/env",...X.flatMap((Y)=>["-u",Y]),...Q.map(([Y,G])=>`${Y}=${G}`),...J]}function _7($,J){let X=$.split(f$.sep),Q="";for(let Y of X){if(!Y)continue;let G=Q+f$.sep+Y;try{if(t.lstatSync(G).isSymbolicLink()){if(J.some((M)=>G.startsWith(M+"/")||G===M))return G}}catch{break}Q=G}return null}var n6=40;function s4($){let J=$;for(let X=0;X<n6;X++){try{return t.realpathSync(J)}catch{}let Q=J,Y=[],G=null;while(G===null){let M=f$.dirname(Q);if(M===Q)return null;Y.unshift(f$.basename(Q)),Q=M;try{G=t.realpathSync(Q)}catch{}}let W=f$.join(G,Y[0]),U=null;try{U=t.readlinkSync(W)}catch{}if(U===null)return f$.join(G,...Y);J=f$.join(f$.resolve(f$.dirname(W),U),...Y.slice(1))}return null}function i6($){let J=$.split(f$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+f$.sep+Q;try{let G=t.statSync(Y);if(G.isFile()||G.isSymbolicLink())return!0}catch{break}X=Y}return!1}function o6($){let J=$.split(f$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+f$.sep+Q;if(!t.existsSync(Y))return Y;X=Y}return $}async function a6($={command:"rg"},J=v7,X=!1,Q){let Y=process.cwd(),G=new AbortController,W=Q??G.signal,U=HY(),M=[...VX.map((K)=>f$.resolve(Y,K)),...U.map((K)=>f$.resolve(Y,K))],O=f$.resolve(Y,".git"),V=!1;try{V=t.statSync(O).isDirectory()}catch{}if(V){if(M.push(f$.resolve(Y,".git/hooks")),!X)M.push(f$.resolve(Y,".git/config"))}let H=[];for(let K of VX)H.push("--iglob",K);for(let K of U)H.push("--iglob",`**/${K}/**`);if(H.push("--iglob","**/.git/hooks/**"),!X)H.push("--iglob","**/.git/config");let q=["--files","--hidden","--no-ignore","--max-depth",String(J),...H,"-g","!**/node_modules/**"],F;try{F=await R7(q,Y,W,$)}catch(K){if(K instanceof V9)throw Error(`mandatory deny scan failed: ${K}`);Z(`[Sandbox] ripgrep scan failed, retrying once: ${K}`);try{F=await R7(q,Y,W,$)}catch(A){throw Error(`mandatory deny scan failed: ${A}`)}}for(let K of F){let A=f$.resolve(Y,K),L=!1;for(let R of[...U,".git"]){let I=l9(R),T=A.split(f$.sep),C=T.findIndex((w)=>l9(w)===I);if(C!==-1){if(R===".git"){let w=T.slice(0,C+1).join(f$.sep);if(K.includes(".git/hooks"))M.push(f$.join(w,"hooks"));else if(K.includes(".git/config"))M.push(f$.join(w,"config"))}else M.push(T.slice(0,C+1).join(f$.sep));L=!0;break}}if(!L)M.push(A)}return[...new Set(M)]}var lX;function s6(){if(process.getuid?.()!==0||process.env.ARA_SRT_FILE_MASK!=="empty")return"/dev/null";if(lX)try{let X=t.lstatSync(lX);if(X.isFile()&&X.size===0&&X.uid===0&&(X.mode&146)===0)return lX}catch{}let $=t.mkdtempSync(f$.join(E9(),"claude-empty-file-"));F9.add($),t.chmodSync($,493);let J=f$.join($,"empty");return t.writeFileSync(J,"",{flag:"wx",mode:292}),t.chmodSync(J,292),lX=J,J}var pX=new Set,F9=new Set;function r4($,J){return $===J?s6():"/dev/null"}function r6($){try{let J=t.lstatSync($);return J.isFile()&&J.size===0}catch{return!1}}var D0=0,t4=!1;function z9(){if(t4)return;process.on("exit",()=>{N9({force:!0})}),t4=!0}function N9($){if(!$?.force){if(D0>0)D0--;if(D0>0){Z(`[Sandbox Linux] Deferring mount point cleanup \u2014 ${D0} sandbox(es) still active`);return}}else D0=0;let J=[],X=[];for(let G of pX)try{let W=t.statSync(G);if(W.isFile()&&W.size===0)J.push(G);else if(W.isDirectory())X.push(G)}catch{}let Q=(G)=>G.split("/").length;X.sort((G,W)=>Q(W)-Q(G));let Y=P7([...J,...X],(G)=>{try{let W=t.statSync(G);if(W.isFile()&&W.size===0)t.unlinkSync(G),Z(`[Sandbox Linux] Cleaned up bwrap mount point (file): ${G}`);else if(W.isDirectory()){if(t.readdirSync(G).length!==0)return;t.rmdirSync(G),Z(`[Sandbox Linux] Cleaned up bwrap mount point (dir): ${G}`)}}catch{}});pX.clear();for(let G of Y)pX.add(G);for(let G of F9)try{t.rmSync(G,{recursive:!0,force:!0})}catch{}F9.clear(),lX=void 0}function e4($){try{return t.accessSync($,t.constants.X_OK),!0}catch{return!1}}function J5($){let{seccompConfig:J,bwrapPath:X,socatPath:Q}=$??{},Y=[],G=[];if(X){if(!e4(X))Y.push(`bubblewrap (bwrap) not executable at ${X}`)}else if(R0("bwrap")===null)Y.push("bubblewrap (bwrap) not installed");if(Q){if(!e4(Q))Y.push(`socat not executable at ${Q}`)}else if(R0("socat")===null)Y.push("socat not installed");if(!J?.argv0&&B7(J?.applyPath)===null)G.push("seccomp not available - unix socket access not restricted");return{warnings:G,errors:Y}}async function Q5($,J,X,Q,Y){let G=X??"socat",W=d6(8).toString("hex"),U=a4(E9(),`claude-http-${W}.sock`),M=a4(E9(),`claude-socks-${W}.sock`),O=[`UNIX-LISTEN:${U},fork,reuseaddr`,`TCP:localhost:${$},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];Z(`Starting HTTP bridge: ${G} ${O.join(" ")}`);let V=o4(G,O,{stdio:"ignore"});if(V.on("error",(K)=>{Z(`HTTP bridge process error: ${K}`,{level:"error"})}),V.on("exit",(K,A)=>{Z(`HTTP bridge process exited with code ${K}, signal ${A}`,{level:K===0?"info":"error"})}),!V.pid)throw Error("Failed to start HTTP bridge process");let H,q;if(J===$)H=V,q=U;else{q=M;let K=[`UNIX-LISTEN:${M},fork,reuseaddr`,`TCP:localhost:${J},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];if(Z(`Starting SOCKS bridge: ${G} ${K.join(" ")}`),H=o4(G,K,{stdio:"ignore"}),H.on("error",(A)=>{Z(`SOCKS bridge process error: ${A}`,{level:"error"})}),H.on("exit",(A,L)=>{Z(`SOCKS bridge process exited with code ${A}, signal ${L}`,{level:A===0?"info":"error"})}),!H.pid){if(V.pid)try{process.kill(V.pid,"SIGTERM")}catch{}throw Error("Failed to start SOCKS bridge process")}}let F=200;for(let K=0;K<F;K++){if(!V.pid||V.killed||!H.pid||H.killed)throw Error("Linux bridge process died unexpectedly");try{if(t.existsSync(U)&&t.existsSync(q)){if(Q!==void 0){let A=Y??Q;for(let L of new Set([U,q]))t.chownSync(L,Q,A),t.chmodSync(L,384)}Z(`Linux bridges ready after ${K+1} attempts`);break}}catch(A){Z(`Error checking sockets (attempt ${K+1}): ${A}`,{level:"error"})}if(K===F-1){if(V.pid)try{process.kill(V.pid,"SIGTERM")}catch{}if(H.pid)try{process.kill(H.pid,"SIGTERM")}catch{}throw Error(`Failed to create bridge sockets after ${F} attempts`)}await new Promise((A)=>setTimeout(A,5))}return{httpSocketPath:U,socksSocketPath:q,httpBridgeProcess:V,socksBridgeProcess:H,httpProxyPort:$,socksProxyPort:J}}function t6($,J){if(J){if(!$)throw Error("seccompConfig.argv0 requires seccompConfig.applyPath");return`ARGV0=${CJ([J])} ${CJ([$])} `}let X=B7($);return X?`${CJ([X])} `:void 0}function e6($,J,X,Q,Y,G){let W=Y||"bash",U=CJ([G??"socat"]),M=["srt_payload_pid=",`${U} TCP4-LISTEN:3128,bind=127.0.0.1,fork,reuseaddr ${CJ([`UNIX-CONNECT:${$}`])} >/dev/null 2>&1 &`,"srt_http_proxy_pid=$!",`${U} TCP4-LISTEN:1080,bind=127.0.0.1,fork,reuseaddr ${CJ([`UNIX-CONNECT:${J}`])} >/dev/null 2>&1 &`,"srt_socks_proxy_pid=$!","srt_cleanup_command() {"," srt_status=$?"," trap - EXIT INT TERM",' if [ -n "$srt_payload_pid" ]; then',' kill -KILL "$srt_payload_pid" 2>/dev/null',' wait "$srt_payload_pid" 2>/dev/null'," fi",' kill -KILL "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null',' wait "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null',' exit "$srt_status"',"}","trap srt_cleanup_command EXIT","trap 'exit 143' TERM","trap 'exit 130' INT",...[3128,1080].map((H)=>`${U} -u OPEN:/dev/null TCP4:127.0.0.1:${H},connect-timeout=0.1,retry=480,interval=0.005 >/dev/null 2>&1 || { printf '%s\\n' 'Sandbox proxy listener readiness failed' >&2; exit 1; }`),`kill -0 "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null || { printf '%s\\n' 'Sandbox proxy listener exited before command' >&2; exit 1; }`],O=(Q??"")+CJ([W,"-c",X]),V=[...M,`${O} <&0 &`,"srt_payload_pid=$!",'wait "$srt_payload_pid"',"srt_payload_status=$?","srt_payload_pid=",'exit "$srt_payload_status"'].join(`
64
- `);return`${W} -c ${CJ([V])}`}function x7($){try{if(t.lstatSync($).isSymbolicLink())return t.realpathSync($)}catch{}return $}function $5($,J,X,Q){let Y=J==="/"?"/":J+"/";$.push("--tmpfs",J);for(let G of X)if(G.startsWith(Y)||G===J)$.push("--bind",G,G),Z(`[Sandbox Linux] Re-bound write path wiped by denyRead tmpfs: ${G}`);for(let G of Q)if(G.startsWith(Y)||G===J){if(!t.existsSync(G)){Z(`[Sandbox Linux] Skipping non-existent read allow path: ${G}`);continue}if(X.some((W)=>(W.startsWith(Y)||W===J)&&(G===W||G.startsWith(W+"/"))))continue;$.push("--ro-bind",G,G),Z(`[Sandbox Linux] Re-allowed read access within denied region: ${G}`)}}async function $K($,J,X,Q,Y={command:"rg"},G=v7,W=!1,U,M){let O=[],V=[],H=[],q=new Set,F=new Map,K=new Map;if(J){O.push("--ro-bind","/","/");for(let U$ of J.allowOnly||[]){let v=JJ(U$).replace(/\/+$/,"")||"/";if(Z(`[Sandbox Linux] Processing write path: ${U$} -> ${v}`),v.startsWith("/dev/")){Z(`[Sandbox Linux] Skipping /dev path: ${v}`);continue}if(!t.existsSync(v)){Z(`[Sandbox Linux] Skipping non-existent write path: ${v}`);continue}try{let a=t.realpathSync(v),P$=v.replace(/\/+$/,"");if(a!==P$&&VY(v,a)){Z(`[Sandbox Linux] Skipping symlink write path pointing outside expected location: ${U$} -> ${a}`);continue}}catch{Z(`[Sandbox Linux] Skipping write path that could not be resolved: ${v}`);continue}O.push("--bind",v,v),V.push(v)}let k,p=()=>{if(k!==void 0)return k;let U$=[];for(let a of V){U$.push(a);try{let P$=t.realpathSync(a);if(P$!==a)U$.push(P$)}catch{}}let v=[];if($){let a=[],P$=new Set(["proc","dev","sys"]);for(let E$ of $.denyOnly||[])if(JJ(E$)==="/")try{for(let s of t.readdirSync("/"))if(!P$.has(s))a.push("/"+s)}catch{}else a.push(E$);if(t.existsSync("/etc/ssh/ssh_config.d"))a.push("/etc/ssh/ssh_config.d");for(let E$ of a){let s=JJ(E$),S$=!1;try{S$=t.statSync(s).isDirectory()}catch{continue}if(!S$)continue;v.push(s);try{let J$=t.realpathSync(s);if(J$!==s)v.push(J$)}catch{}}}return k={allowedWritePathsBothForms:U$,prospectiveReadDenyTmpfsDirsBothForms:v},k},$$=(U$)=>V.some((v)=>U$.startsWith(v+"/")||U$===v),N$=[...J.denyWithinAllow||[],...await a6(Y,G,W,U)];h4();let M$=new Set;for(let U$ of N$){let v=JJ(U$);if(v.startsWith("/dev/"))continue;let a=s4(v);if(a===null||a.startsWith("/dev/"))continue;if(_7(a,V))continue;let P$=!1;try{P$=t.statSync(a).isDirectory()}catch{continue}if(!P$)continue;if($$(a)){let E$=F.get(a);if(E$===void 0)E$=new Set,F.set(a,E$);E$.add(v)}}let b$=new Map,XJ=(U$)=>{let v=b$.get(U$);if(v!==void 0)return v;let{allowedWritePathsBothForms:a,prospectiveReadDenyTmpfsDirsBothForms:P$}=p(),E$=a.some((s)=>s.startsWith(U$+"/"))||P$.some((s)=>s===U$||s.startsWith(U$+"/"))||P$.some((s)=>[U$,...F.get(U$)??[]].some((S$)=>S$===s||S$.startsWith(s+"/")));return b$.set(U$,E$),E$},j$=[...F.keys()];for(let U$ of N$){let v=JJ(U$);if(v.startsWith("/dev/"))continue;let a=s4(v);if(a===null){let s=_7(v,V);if(s&&!M$.has(s))M$.add(s),H.push("--ro-bind","/dev/null",s),K.set(s,v);Z(`[Sandbox Linux] Deny path could not be resolved through symlinks, failing closed: ${v}`);continue}if(a!==v)Z(`[Sandbox Linux] Resolved symlinked deny path: ${v} -> ${a}`);if(a.startsWith("/dev/"))continue;if(M$.has(a))continue;M$.add(a);let P$=_7(a,V);if(P$){if(!M$.has(P$))M$.add(P$),H.push("--ro-bind","/dev/null",P$),K.set(P$,v);Z(`[Sandbox Linux] Mounted /dev/null at symlink ${P$} to prevent symlink replacement attack`);continue}if(!t.existsSync(a)){if(i6(a)){Z(`[Sandbox Linux] Skipping deny path with file ancestor (cannot create paths under a file): ${a}`);continue}let s=f$.dirname(a);while(s!=="/"&&!t.existsSync(s))s=f$.dirname(s);let S$=$$(s)||$$(a),J$=j$.filter((_$)=>s===_$||s.startsWith(_$+"/")),g$=J$.length>0&&!J$.some(XJ);if(S$&&!g$){let _$=o6(a),K$=c4(_$,V)??_$;if(K$!==a){if(!q.has(K$)){let c$=i4(K$,M),v$=t.mkdtempSync(f$.join(E9(),"claude-empty-"));if(t.chmodSync(v$,365),F9.add(v$),H.push("--ro-bind",v$,K$),K.set(K$,v),q.add(K$),c$.kind==="unregistered")pX.add(K$);z9(),Z(`[Sandbox Linux] Mounted empty dir at ${K$} to block creation of ${a}`)}}else{let c$=w7(K$),v$=r4(a,v);if(c$.kind==="masked")H.push("--ro-bind",v$,K$),K.set(K$,v),z9(),Z(`[Sandbox Linux] Masked shared stub at ${K$} with ${v$} to block creation of ${a}`);else if(c$.kind==="real")H.push("--ro-bind",K$,K$),K.set(K$,v);else H.push("--ro-bind",v$,K$),K.set(K$,v),pX.add(K$),z9(),Z(`[Sandbox Linux] Mounted ${v$} at ${K$} to block creation of ${a}`)}}else if(g$)Z(`[Sandbox Linux] Skipping non-existent deny path inside a read-only denied directory (already uncreatable): ${a}`);else Z(`[Sandbox Linux] Skipping non-existent deny path not within allowed paths: ${a}`);continue}if($$(a)){if((r6(a)?w7(a):void 0)?.kind==="masked")H.push("--ro-bind",r4(a,v),a),z9();else H.push("--ro-bind",a,a);K.set(a,v)}else Z(`[Sandbox Linux] Skipping deny path not within allowed paths: ${a}`)}}else O.push("--bind","/","/");let A=[],L=($?.allowWithinDeny||[]).map((k)=>JJ(k)),R=new Map,I=[],T=new Set(["proc","dev","sys"]);for(let k of $?.denyOnly||[])if(JJ(k)==="/"){for(let p of t.readdirSync("/"))if(!T.has(p))A.push("/"+p)}else A.push(k);if($&&t.existsSync("/etc/ssh/ssh_config.d"))A.push("/etc/ssh/ssh_config.d");let C=A.map((k)=>JJ(k)).sort((k,p)=>k.split("/").length-p.split("/").length);for(let k of C){if(!t.existsSync(k)){Z(`[Sandbox Linux] Skipping non-existent read deny path: ${k}`);continue}if(t.statSync(k).isDirectory())I.push(k),$5(O,k,V,L);else{if(L.includes(k)){Z(`[Sandbox Linux] Skipping read deny for re-allowed path: ${k}`);continue}let $$=x7(k);O.push("--ro-bind","/dev/null",$$),R.set($$,"/dev/null"),R.set(k,"/dev/null")}}for(let{realPath:k,fakePath:p}of X??[]){let $$=x7(k);O.push("--ro-bind",p,$$),R.set($$,p),R.set(k,p)}let w=(k)=>I.some((p)=>{if(!(k===p||k.startsWith(p+"/")))return!1;return!V.some((M$)=>(M$===p||M$.startsWith(p+"/"))&&(k===M$||k.startsWith(M$+"/")))}),P=[...q].filter((k)=>{let p=K.get(k)??k;return!R.has(k)&&!w(k)&&!w(p)&&!V.some(($$)=>$$===k||$$.startsWith(k+"/"))}),l=[];for(let k=0;k<H.length;k+=3){let p=H[k+2],$$=K.get(p)??p;if(R.has(p))continue;if(w(p)||w($$)){Z(`[Sandbox Linux] Skipping denyWrite bind already hidden by denyRead tmpfs: ${p}`);continue}if(P.some((N$)=>p.startsWith(N$+"/"))){Z(`[Sandbox Linux] Skipping denyWrite bind under an empty-directory mask: ${p}`);continue}if(O.push(H[k],H[k+1],p),l.push(p),$$!==p)l.push($$)}for(let k of I)if(l.some((p)=>k.startsWith(p+"/")))Z(`[Sandbox Linux] Re-applying denyRead tmpfs re-exposed by denyWrite bind: ${k}`),$5(O,k,V,L);for(let[k,p]of R)if(l.some(($$)=>k.startsWith($$+"/"))){if(x7(k)!==k)continue;Z(`[Sandbox Linux] Re-applying file mask re-exposed by denyWrite bind: ${k}`),O.push("--ro-bind",p,k)}if(Q!==void 0)O.push("--ro-bind",Q,Q);return O}async function X5($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpSocketPath:Y,socksSocketPath:G,httpProxyPort:W,socksProxyPort:U,proxyAuthToken:M,caCertPath:O,readConfig:V,writeConfig:H,unsetEnvVars:q,setEnvVars:F,maskedFileBinds:K,maskedFileStoreDir:A,enableWeakerNestedSandbox:L,runAsUid:R,runAsGid:I,runAsHostUid:T,runAsHostGid:C,runAsHostHome:w,runAsHostUser:P,setprivPath:l,allowAllUnixSockets:k,binShell:p,ripgrepConfig:$$={command:"rg"},mandatoryDenySearchDepth:N$=v7,allowGitConfig:M$=!1,gitSafeDirectories:b$,seccompConfig:XJ,bwrapPath:j$,socatPath:U$,observeSocketPath:v,abortSignal:a}=$,P$=V&&V.denyOnly.length>0||K!==void 0&&K.length>0,E$=H!==void 0,s=q!==void 0&&q.length>0||F!==void 0&&Object.keys(F).length>0,S$=(b$?.length??0)>0;if(!Q&&!P$&&!E$&&!s&&!S$)return J;D0++;let J$=["--new-session","--die-with-parent"],g$=[],_$;try{if(!k)if(_$=t6(XJ?.applyPath,XJ?.argv0),!_$)Z("[Sandbox Linux] apply-seccomp binary not available - unix socket blocking disabled. Install @anthropic-ai/sandbox-runtime globally for full protection.",{level:"warn"});else Z("[Sandbox Linux] Applying seccomp filter for Unix socket blocking");else Z("[Sandbox Linux] Skipping seccomp filter - allowAllUnixSockets is enabled");if(v&&_$)if(t.existsSync(v))g$.push("--bind",v,v),J$.push("--setenv","SRT_OBSERVE_SOCK",v),J$.push("--setenv","SRT_ENCODED_CMD",PJ(X??J));else Z("[Sandbox Linux] observe socket missing \u2014 supervisor not running; "+"continuing without violation monitoring");if(s){for(let y$ of q??[])J$.push("--unsetenv",y$);for(let[y$,n$]of Object.entries(F??{}))J$.push("--setenv",y$,n$)}if(b$&&b$.length>0){let y$=qY({safeDirs:b$,unsetEnvVars:q,setEnvVars:F});for(let[n$,t$]of Object.entries(y$))J$.push("--setenv",n$,t$)}if(Q){if(J$.push("--unshare-net"),Y&&G){if(!t.existsSync(Y))throw Error(`Linux HTTP bridge socket does not exist: ${Y}. The bridge process may have died. Try reinitializing the sandbox.`);if(!t.existsSync(G))throw Error(`Linux SOCKS bridge socket does not exist: ${G}. The bridge process may have died. Try reinitializing the sandbox.`);if(g$.push("--bind",Y,Y),G!==Y)g$.push("--bind",G,G);let y$=ZQ(3128,1080,O,M,H===void 0,PJ(X??J));if(J$.push(...y$.flatMap((n$)=>{let t$=n$.indexOf("="),WJ=n$.slice(0,t$),wU=n$.slice(t$+1);return["--setenv",WJ,wU]})),W!==void 0)J$.push("--setenv","CLAUDE_CODE_HOST_HTTP_PROXY_PORT",String(W));if(U!==void 0)J$.push("--setenv","CLAUDE_CODE_HOST_SOCKS_PROXY_PORT",String(U))}}let K$=await $K(V,H,K,A,$$,N$,M$,a,T===void 0?void 0:{uid:T,gid:C??T});if(K9(),J$.push(...K$),J$.push(...g$),J$.push("--dev","/dev"),J$.push("--unshare-pid"),!L){if(J$.push("--unshare-user","--cap-drop","ALL","--proc","/proc"),!_$)J$.push("--ro-bind","/dev/null","/proc/sysrq-trigger")}else J$.push("--unshare-user","--bind","/proc","/proc");if(R!==void 0)J$.push("--uid",String(R)),J$.push("--gid",String(I??R));if(T!==void 0){if(w)J$.push("--setenv","HOME",w);if(P)J$.push("--setenv","USER",P),J$.push("--setenv","LOGNAME",P)}let c$=p||"bash",v$=R0(c$);if(!v$)throw Error(`Shell '${c$}' not found in PATH`);if(J$.push("--",v$,"-c"),Q&&Y&&G){let y$=e6(Y,G,J,_$,v$,U$);J$.push(y$)}else if(_$){let y$=_$+CJ([v$,"-c",J]);J$.push(y$)}else J$.push(J);let YJ=[j$??"bwrap",...J$],GJ=CJ(c6({bwrapCommand:YJ,uid:T,gid:C,setprivPath:l,unsetEnvVars:q,setEnvVars:F})),a$=[];if(Q)a$.push("network");if(P$||E$)a$.push("filesystem");if(s)a$.push("env");if(_$)a$.push("seccomp(unix-block)");return Z(`[Sandbox Linux] Wrapped command with bwrap (${a$.join(", ")} restrictions)`),GJ}catch(K$){if(D0>0)D0--;if(K9(),D0===0)P7([],()=>{});throw K$}}import{spawn as JK}from"child_process";import*as Z0 from"path";class L9{violations=[];totalCount=0;maxSize=100;listeners=new Set;addViolation($){if(this.violations.push({...$,line:k7($.line).replace(/[<>]/g,"")}),this.totalCount++,this.violations.length>this.maxSize)this.violations=this.violations.slice(-this.maxSize);this.notifyListeners()}getViolations($){if($===void 0)return[...this.violations];return this.violations.slice(-$)}getCount(){return this.violations.length}getTotalCount(){return this.totalCount}getViolationsForCommand($){let J=PJ($);return this.violations.filter((X)=>X.encodedCommand===J)}clear(){this.violations=[],this.notifyListeners()}subscribe($){return this.listeners.add($),$(this.getViolations()),()=>{this.listeners.delete($)}}notifyListeners(){let $=this.getViolations();this.listeners.forEach((J)=>J($))}}function dQ($,J,X){if(!X)return!1;if((X["*"]??[]).some((Y)=>$.includes(Y)))return!0;if(J===void 0)return!1;for(let[Y,G]of Object.entries(X))if(Y!=="*"&&J.includes(Y)&&G.some((W)=>$.includes(W)))return!0;return!1}function k7($){return $.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").trim()}function QK($=!1){let J=process.cwd(),X=[];for(let Q of VX)X.push(Z0.resolve(J,Q)),X.push(`**/${Q}`);for(let Q of HY())X.push(Z0.resolve(J,Q)),X.push(`**/${Q}/**`);if(X.push(Z0.resolve(J,".git/hooks")),X.push("**/.git/hooks/**"),!$)X.push(Z0.resolve(J,".git/config")),X.push("**/.git/config");return[...new Set(X)]}var Y5=`_${Math.random().toString(36).slice(2,11)}_SBX`;function XK($){return`CMD64_${PJ($)}_END_${Y5}`}function cQ($){return NJ($)?`(regex ${iJ(zX($))})`:`(subpath ${iJ($)})`}function h7($){return zX($).slice(0,-1)+"(/.*)?$"}function qQ($){return NJ($)?`(regex ${iJ(h7($))})`:`(subpath ${iJ($)})`}function G5($){return $.replace(/\[[^\]]*\]|[*?]+/g,"x")}function y7($,J){let X=[...new Set(J)];if(X.length===0)return $;let Q=X.map((Y)=>`(require-not ${Y})`).join(" ");return`(require-all ${$} ${Q})`}function f7($){let J=JJ($);return{path:J,glob:NJ(J)}}function W5($,J){return $.test(J.glob?G5(J.path):J.path)}function A9($,J){let X=$.glob?G5($.path):$.path;return X.startsWith(J==="/"?"/":J+"/")&&X!==J}function YK($,J){return{denies:($.denyOnly||[]).map(f7),allows:($.allowWithinDeny||[]).map(f7),writeRoots:(J||[]).map(f7)}}function GK($){let J=[],X=!1,Q=$.allows.filter((Y)=>!Y.glob).map((Y)=>Y.path);for(let Y of $.denies){if(!Y.glob){if(Q.some((U)=>Y.path.startsWith(U+"/")))J.push(qQ(Y.path));continue}let G=new RegExp(h7(Y.path));if(G.test("/"))X=!0;let W=$.allows.filter((U)=>W5(G,U)).map((U)=>cQ(U.path));J.push(y7(qQ(Y.path),W))}return{filters:J,coversRoot:X}}function U5($){let J=$.split(/[*?[\]]/)[0];if(!J||J==="/")return"/";return J.endsWith("/")?J.slice(0,-1):Z0.dirname(J)}function WK($,J){let{denies:X,allows:Q,writeRoots:Y}=$;if(Y.length===0)return[];let G=Y.filter((H)=>H.glob).map((H)=>new RegExp(zX(H.path))),W=Y.filter((H)=>!H.glob).map((H)=>H.path),U=(H)=>W.some((q)=>A9({path:H,glob:!1},q))||G.some((q)=>q.test(H)),M=(H)=>[...Q,...Y].filter((q)=>A9(q,H)).map((q)=>cQ(q.path)),O=new Set,V=(H)=>{for(let q of H)if(U(q))O.add(`(literal ${iJ(q)})`)};for(let H of X)if(H.glob){let q=U5(H.path);if(!(G.length>0||W.some((L)=>q===L||A9({path:q,glob:!1},L)||A9({path:L,glob:!1},q))))continue;let K=new RegExp(h7(H.path)),A=[...Q,...Y].filter((L)=>W5(K,L)).map((L)=>cQ(L.path));if(O.add(y7(qQ(H.path),A)),q!=="/")V([q,...b7(q)])}else{if(!U(H.path))continue;O.add(y7(qQ(H.path),M(H.path))),V(b7(H.path))}return u0("deny",["file-write-unlink"],O,J)}function u0($,J,X,Q){if(X.size===0)return[];return[`(${$} ${J.join(" ")}`,...[...X].map((Y)=>` ${Y}`),` (with message "${Q}"))`]}function b7($){let J=[],X=Z0.dirname($);while(X!=="/"&&X!=="."){J.push(X);let Q=Z0.dirname(X);if(Q===X)break;X=Q}return J}function M5($,J){let X=new Set;for(let Q of $){let Y=JJ(Q);X.add(qQ(Y));let G;if(NJ(Y)){if(G=U5(Y),G==="/")continue;X.add(`(literal ${iJ(G)})`)}else G=Y;for(let W of b7(G))X.add(`(literal ${iJ(W)})`)}return u0("deny",["file-write-unlink","file-write-create"],X,J)}function UK($,J){if(!$)return["(allow file-read*)"];let X=[];X.push("(allow file-read*)");let Q=$.denies.some((M)=>M.path==="/"),Y=new Set($.denies.map((M)=>qQ(M.path)));X.push(...u0("deny",["file-read*"],Y,J));let G=new Set($.allows.map((M)=>cQ(M.path)));X.push(...u0("allow",["file-read*"],G,J));let W=GK($);if(X.push(...u0("deny",["file-read*"],new Set(W.filters),J)),Q||W.coversRoot)X.push('(allow file-read* (literal "/"))');if($.denies.length>0)X.push("(allow file-read-metadata"," (vnode-type DIRECTORY))");X.push(...M5($.denies.map((M)=>M.path),J));let U=new Set($.writeRoots.map((M)=>cQ(M.path)));return X.push(...u0("allow",["file-write-unlink","file-write-create"],U,J)),X}function MK($,J,X=!1){if(!$)return["(allow file-write*)"];let Q=[],Y=new Set;for(let U of $.allowOnly||[])Y.add(cQ(JJ(U)));Q.push(...u0("allow",["file-write*"],Y,J));let G=[...$.denyWithinAllow||[],...QK(X)],W=new Set;for(let U of G)W.add(qQ(JJ(U)));return Q.push(...u0("deny",["file-write*"],W,J)),Q.push(...M5(G,J)),Q}function OK({readConfig:$,writeConfig:J,httpProxyPort:X,socksProxyPort:Q,needsNetworkRestriction:Y,allowUnixSockets:G,allowAllUnixSockets:W,allowLocalBinding:U,allowMachLookup:M,allowPty:O,allowGitConfig:V=!1,enableWeakerNetworkIsolation:H=!1,allowAppleEvents:q=!1,logTag:F}){let K=["(version 1)",`(deny default (with message "${F}"))`,"",`; LogTag: ${F}`,"","; Essential permissions - based on Chrome sandbox policy","; Process permissions","(allow process-exec)","(allow process-fork)","(allow process-info* (target same-sandbox))","(allow signal (target same-sandbox))","(allow mach-priv-task-port (target same-sandbox))","","; User preferences","(allow user-preference-read)","","; Mach IPC - specific services only (no wildcard)","(allow mach-lookup",' (global-name "com.apple.audio.systemsoundserver")',' (global-name "com.apple.distributed_notifications@Uv3")',' (global-name "com.apple.FontObjectsServer")',' (global-name "com.apple.fonts")',' (global-name "com.apple.logd")',' (global-name "com.apple.lsd.mapdb")',' (global-name "com.apple.PowerManagement.control")',' (global-name "com.apple.system.logger")',' (global-name "com.apple.system.notification_center")',' (global-name "com.apple.system.opendirectoryd.libinfo")',' (global-name "com.apple.system.opendirectoryd.membership")',' (global-name "com.apple.bsd.dirhelper")',' (global-name "com.apple.securityd.xpc")',' (global-name "com.apple.coreservices.launchservicesd")',")","",...H?["; trustd.agent - needed for Go TLS certificate verification (weaker network isolation)",'(allow mach-lookup (global-name "com.apple.trustd.agent"))']:[],...q?["; Apple Events - opt-in; needed for open/osascript to talk to other apps (appleeventsd)","(allow appleevent-send)",'(allow mach-lookup (global-name "com.apple.coreservices.appleevents"))',"; Launch Services open requests need the lsopen operation plus, on","; macOS 14/15, coreservicesd and the quarantine resolver - without","; these open fails with -10822 kLSServerCommunicationErr or -54","(allow lsopen)",'(allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))','(allow mach-lookup (global-name "com.apple.coreservices.quarantine-resolver"))']:[],...M&&M.length>0?["; User-specified XPC/Mach services",...M.map((L)=>L.endsWith("*")?`(allow mach-lookup (global-name-prefix ${iJ(L.slice(0,-1))}))`:`(allow mach-lookup (global-name ${iJ(L)}))`)]:[],"","; POSIX IPC - shared memory","(allow ipc-posix-shm)","","; POSIX IPC - semaphores for Python multiprocessing","(allow ipc-posix-sem)","","; IOKit - specific operations only","(allow iokit-open",' (iokit-registry-entry-class "IOSurfaceRootUserClient")',' (iokit-registry-entry-class "RootDomainUserClient")',' (iokit-user-client-class "IOSurfaceSendRight")',")","","; IOKit properties","(allow iokit-get-properties)","","; Specific safe system-sockets, doesn't allow network access","(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))","","; sysctl - specific sysctls only","(allow sysctl-read",' (sysctl-name "hw.activecpu")',' (sysctl-name "hw.busfrequency_compat")',' (sysctl-name "hw.byteorder")',' (sysctl-name "hw.cacheconfig")',' (sysctl-name "hw.cachelinesize_compat")',' (sysctl-name "hw.cpufamily")',' (sysctl-name "hw.cpufrequency")',' (sysctl-name "hw.cpufrequency_compat")',' (sysctl-name "hw.cputype")',' (sysctl-name "hw.l1dcachesize_compat")',' (sysctl-name "hw.l1icachesize_compat")',' (sysctl-name "hw.l2cachesize_compat")',' (sysctl-name "hw.l3cachesize_compat")',' (sysctl-name "hw.logicalcpu")',' (sysctl-name "hw.logicalcpu_max")',' (sysctl-name "hw.machine")',' (sysctl-name "hw.memsize")',' (sysctl-name "hw.ncpu")',' (sysctl-name "hw.nperflevels")',' (sysctl-name "hw.packages")',' (sysctl-name "hw.pagesize_compat")',' (sysctl-name "hw.pagesize")',' (sysctl-name "hw.physicalcpu")',' (sysctl-name "hw.physicalcpu_max")',' (sysctl-name "hw.tbfrequency_compat")',' (sysctl-name "hw.vectorunit")',' (sysctl-name "kern.argmax")',' (sysctl-name "kern.bootargs")',' (sysctl-name "kern.hostname")',' (sysctl-name "kern.maxfiles")',' (sysctl-name "kern.maxfilesperproc")',' (sysctl-name "kern.maxproc")',' (sysctl-name "kern.ngroups")',' (sysctl-name "kern.osproductversion")',' (sysctl-name "kern.osrelease")',' (sysctl-name "kern.ostype")',' (sysctl-name "kern.osvariant_status")',' (sysctl-name "kern.osversion")',' (sysctl-name "kern.secure_kernel")',' (sysctl-name "kern.tcsm_available")',' (sysctl-name "kern.tcsm_enable")',' (sysctl-name "kern.usrstack64")',' (sysctl-name "kern.version")',' (sysctl-name "kern.willshutdown")',' (sysctl-name "machdep.cpu.brand_string")',' (sysctl-name "machdep.ptrauth_enabled")',' (sysctl-name "security.mac.lockdown_mode_state")',' (sysctl-name "sysctl.proc_cputype")',' (sysctl-name "vm.loadavg")',' (sysctl-name-prefix "hw.optional.arm")',' (sysctl-name-prefix "hw.optional.arm.")',' (sysctl-name-prefix "hw.optional.armv8_")',' (sysctl-name-prefix "hw.perflevel")',' (sysctl-name-prefix "kern.proc.all")',' (sysctl-name-prefix "kern.proc.pgrp.")',' (sysctl-name-prefix "kern.proc.pid.")',' (sysctl-name-prefix "machdep.cpu.")',' (sysctl-name-prefix "net.routetable.")',")","","; V8 thread calculations","(allow sysctl-write",' (sysctl-name "kern.tcsm_enable")',")","","; Distributed notifications","(allow distributed-notification-post)","","; Specific mach-lookup permissions for security operations",'(allow mach-lookup (global-name "com.apple.SecurityServer"))',"","; File I/O on device files",'(allow file-ioctl (literal "/dev/null"))','(allow file-ioctl (literal "/dev/zero"))','(allow file-ioctl (literal "/dev/random"))','(allow file-ioctl (literal "/dev/urandom"))','(allow file-ioctl (literal "/dev/dtracehelper"))','(allow file-ioctl (literal "/dev/tty"))',"","(allow file-ioctl file-read-data file-write-data"," (require-all",' (literal "/dev/null")'," (vnode-type CHARACTER-DEVICE)"," )",")",""];if(K.push("; Network"),!Y)K.push("(allow network*)");else{if(U)K.push('(allow network-bind (local ip "*:*"))'),K.push('(allow network-inbound (local ip "*:*"))'),K.push('(allow network-outbound (remote ip "localhost:*"))');if(W)K.push("(allow system-socket (socket-domain AF_UNIX))"),K.push('(allow network-bind (local unix-socket (path-regex #"^/")))'),K.push('(allow network-outbound (remote unix-socket (path-regex #"^/")))');else if(G&&G.length>0){K.push("(allow system-socket (socket-domain AF_UNIX))");for(let L of G){let R=JJ(L);K.push(`(allow network-bind (local unix-socket (subpath ${iJ(R)})))`),K.push(`(allow network-outbound (remote unix-socket (subpath ${iJ(R)})))`)}}if(X!==void 0)K.push(`(allow network-bind (local ip "localhost:${X}"))`),K.push(`(allow network-inbound (local ip "localhost:${X}"))`),K.push(`(allow network-outbound (remote ip "localhost:${X}"))`);if(Q!==void 0&&Q!==X)K.push(`(allow network-bind (local ip "localhost:${Q}"))`),K.push(`(allow network-inbound (local ip "localhost:${Q}"))`),K.push(`(allow network-outbound (remote ip "localhost:${Q}"))`)}K.push("");let A=$?YK($,J?.allowOnly):void 0;if(K.push("; File read"),K.push(...UK(A,F)),K.push(""),K.push("; File write"),K.push(...MK(J,F,V)),A){let L=WK(A,F);if(L.length>0)K.push(""),K.push("; File read: keep read-denied paths inside write roots in place"),K.push(...L)}if(O)K.push(""),K.push("; Pseudo-terminal (pty) support"),K.push("(allow pseudo-tty)"),K.push("(allow file-ioctl"),K.push(' (literal "/dev/ptmx")'),K.push(' (regex #"^/dev/ttys")'),K.push(")"),K.push("(allow file-read* file-write*"),K.push(' (literal "/dev/ptmx")'),K.push(' (regex #"^/dev/ttys")'),K.push(")");return K.join(`
65
- `)}function iJ($){return JSON.stringify($)}function O5($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpProxyPort:Y,socksProxyPort:G,proxyAuthToken:W,caCertPath:U,allowUnixSockets:M,allowAllUnixSockets:O,allowLocalBinding:V,allowMachLookup:H,readConfig:q,writeConfig:F,unsetEnvVars:K,setEnvVars:A,maskedFileBinds:L,allowPty:R,allowGitConfig:I=!1,gitSafeDirectories:T,enableWeakerNetworkIsolation:C=!1,allowAppleEvents:w=!1,binShell:P}=$,l=q;if(L&&L.length>0)Z("[Sandbox macOS] file mask degrades to deny on macOS until the interposer lands"),l={denyOnly:[...q?.denyOnly??[],...L.map((s)=>s.realPath)],allowWithinDeny:q?.allowWithinDeny};let k=l&&l.denyOnly.length>0,p=F!==void 0,$$=K!==void 0&&K.length>0||A!==void 0&&Object.keys(A).length>0,N$=(T?.length??0)>0;if(!Q&&!k&&!p&&!$$&&!N$)return J;let M$=X??J,b$=XK(M$),XJ=OK({readConfig:l,writeConfig:F,httpProxyPort:Y,socksProxyPort:G,needsNetworkRestriction:Q,allowUnixSockets:M,allowAllUnixSockets:O,allowLocalBinding:V,allowMachLookup:H,allowPty:R,allowGitConfig:I,enableWeakerNetworkIsolation:C,allowAppleEvents:w,logTag:b$}),j$=ZQ(Y,G,U,W,F===void 0,PJ(M$));if(V&&Q){let J$=(K??[]).includes("JAVA_TOOL_OPTIONS")?"":process.env.JAVA_TOOL_OPTIONS??"",g$=J$.includes("-Djava.net.preferIPv4Stack=true")?J$:[J$,"-Djava.net.preferIPv4Stack=true"].filter(Boolean).join(" ");j$.push(`JAVA_TOOL_OPTIONS=${g$}`)}if(T&&T.length>0){let s=qY({safeDirs:T,unsetEnvVars:K,setEnvVars:A});for(let[S$,J$]of Object.entries(s))j$.push(`${S$}=${J$}`)}let U$=P||"bash",v=R0(U$);if(!v)throw Error(`Shell '${U$}' not found in PATH`);let a=(K??[]).flatMap((s)=>["-u",s]),P$=Object.entries(A??{}).map(([s,S$])=>`${s}=${S$}`),E$=CJ(["env",...a,...P$,...j$,"/usr/bin/sandbox-exec","-p",XJ,v,"-c",J]);return Z(`[Sandbox macOS] Applied restrictions - network: ${!!(Y||G)}, read: ${l?"allowAllExcept"in l?"allowAllExcept":"denyAllExcept":"none"}, write: ${F?"allowAllExcept"in F?"allowAllExcept":"denyAllExcept":"none"}`),E$}function V5($,J,X=(Q)=>Q){let Q=/CMD64_(.+?)_END/,Y=/Sandbox:\s+(.+)$/,G=JK("log",["stream","--predicate",`(eventMessage ENDSWITH "${Y5}")`,"--style","compact"]);return G.stdout?.on("data",(W)=>{let U=W.toString().split(`
66
- `),M=U.find((K)=>K.includes("Sandbox:")&&K.includes("deny")),O=U.find((K)=>K.startsWith("CMD64_"));if(!M)return;let V=M.match(Y);if(!V?.[1])return;let H=V[1],q,F;if(O){if(F=O.match(Q)?.[1],F)try{q=X(t0(F))}catch{}}if(H.includes("mDNSResponder")||H.includes("mach-lookup com.apple.diagnosticd")||H.includes("mach-lookup com.apple.analyticsd"))return;if(dQ(H,q,J))return;$({line:H,command:q,encodedCommand:F,timestamp:new Date})}),G.stderr?.on("data",(W)=>{Z(`[Sandbox Monitor] Log stream stderr: ${W.toString()}`)}),G.on("error",(W)=>{Z(`[Sandbox Monitor] Failed to start log stream: ${W.message}`)}),G.on("exit",(W)=>{Z(`[Sandbox Monitor] Log stream exited with code: ${W}`)}),()=>{Z("[Sandbox Monitor] Stopping log monitor"),G.kill("SIGTERM")}}import{randomBytes as VK}from"crypto";import{chmodSync as H5,chownSync as HK,mkdtempSync as qK,rmSync as KK}from"fs";import{createServer as zK}from"net";import{tmpdir as EK}from"os";import{join as q5,posix as FK}from"path";import{createInterface as NK}from"readline";function K5($,J){let{allowWritePaths:X,denyWritePaths:Q,ignoreViolations:Y,resolveCommandText:G=(T)=>T,consumerUid:W,consumerGid:U}=J,M=qK(q5(EK(),"srt-obs-")),O=q5(M,`s${VK(4).toString("hex")}.sock`),V=(T,C)=>T===C||T.startsWith(C.endsWith("/")?C:C+"/"),H=(T)=>{let C=FK.normalize(T);if(Q.some((w)=>V(C,w)))return!0;return!X.some((w)=>V(C,w))},q=(T,C)=>{if(T.observe_init_error){Z(`[Sandbox Linux Monitor] observe filter not installed: ${T.observe_init_error}`);return}if(typeof T.path!=="string")return;if(!T.path.startsWith("/"))return;if(!H(T.path))return;let w;if(C)try{w=G(t0(C))}catch{}if(dQ(T.path,w,Y))return;let P={line:`deny ${T.syscall??"syscall"} ${T.path}`,command:w,encodedCommand:C,timestamp:new Date};$(P)},F,K=new Promise((T)=>{F=T}),A=O,L=zK((T)=>{let C,w=NK({input:T});w.on("line",(P)=>{if(!P)return;let l;try{l=JSON.parse(P)}catch{return}if(l.encodedCommand&&C===void 0)C=l.encodedCommand;q(l,C??l.encodedCommand)}),T.on("error",()=>w.close()),T.on("close",()=>w.close())});L.on("error",(T)=>{Z(`[Sandbox Linux Monitor] listen failed: ${T.message} - violation monitoring disabled`,{level:"warn"}),A=void 0,F()}),L.listen(O,()=>{if(W!==void 0)H5(M,457),HK(O,W,U??W),H5(O,384);F()});let R=new Set;return L.on("connection",(T)=>{R.add(T),T.on("close",()=>R.delete(T))}),{get observeSocketPath(){return A},ready:K,stop:()=>{Z("[Sandbox Linux Monitor] stopping");for(let T of R)T.destroy();L.close();try{KK(M,{recursive:!0,force:!0})}catch{}}}}import*as $J from"fs";import*as F5 from"net";import*as e$ from"path";import{spawn as LK,spawnSync as AK}from"child_process";import{once as RK}from"events";import{fileURLToPath as DK}from"url";class L$ extends Error{code;subcommand;constructor($,J,X){super(J);this.name="WindowsSandboxError",this.code=$,this.subcommand=X}}var R9=[60080,60089],z5=["-NoProfile","-Command"];function D9($){let J=process.env.SystemRoot??"C:\\Windows",X={exe:e$.win32.join(J,"System32","cmd.exe"),args:["/d","/s","/c"]};if($===void 0||$===null)return X;if(typeof $==="object"){if(!e$.win32.isAbsolute($.exe))throw new L$("bin_shell_invalid",`binShell.exe must be an absolute path (got ${JSON.stringify($.exe)})`);if(!Array.isArray($.args))throw new L$("bin_shell_invalid",`binShell.args must be an array (got ${JSON.stringify($.args)})`);return $}let Q=e$.win32.basename($),Y=Q.toLowerCase(),G=e$.win32.isAbsolute($);if(!G&&$!==Q)throw new L$("bin_shell_invalid",`binShell string must be a bare token or an absolute path (got ${JSON.stringify($)})`);switch(Y){case"bash":case"bash.exe":case"sh":case"sh.exe":if(!G)throw new L$("bin_shell_invalid",`binShell bash path must be absolute (got ${JSON.stringify($)}); pass the resolved Git Bash install path`);return{exe:$,args:["-c"]};case"pwsh":case"pwsh.exe":return{exe:G?$:"pwsh.exe",args:z5};case"powershell":case"powershell.exe":return{exe:G?$:e$.win32.join(J,"System32","WindowsPowerShell","v1.0","powershell.exe"),args:z5};case"cmd":case"cmd.exe":return G?{exe:$,args:X.args}:X;default:throw new L$("bin_shell_invalid",`unrecognised binShell ${JSON.stringify($)}: expected 'cmd' | 'powershell' | 'pwsh' or an absolute path to bash.exe/sh.exe/pwsh.exe/powershell.exe`)}}function N5(){let $=e$.dirname(DK(import.meta.url));return e$.resolve($,"..","..")}var L5={x64:"x64",arm64:"arm64"},ZK=e$.join(N5(),"vendor","srt-win",L5[process.arch]??process.arch,"srt-win.exe");function BK(){let $=N5(),J=L5[process.arch],X=[];if(J)X.push(e$.join($,"vendor","srt-win",J,"srt-win.exe"));X.push(e$.join($,"vendor","srt-win-src","target","release","srt-win.exe"));for(let Q of X)if($J.existsSync(Q))return Q;throw new L$("srt_win_not_found",`srt-win.exe not found. Set windows.srtWin.path or build with \`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. Looked in: ${X.join(", ")}`)}var A5="--srt-win";function wJ($){if($?.path===void 0)throw new L$("srt_win_not_found","no srt-win path configured; set windows.srtWin.path (e.g. to the exported VENDORED_SRT_WIN_EXE constant for the packaged binary)");if(!$J.existsSync($.path))throw new L$("srt_win_not_found",`windows.srtWin.path is set to '${$.path}' but the file does not exist`);return{exe:$.path,prependArgs:[A5]}}function g0($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??wJ(),Y=AK(X,[...Q,...$],{encoding:"utf8",windowsHide:!0,timeout:J.timeoutMs??15000,...J.stdin!==void 0?{input:J.stdin}:{}});if(Y.error){if(Y.error.code==="ETIMEDOUT")throw new L$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${J.timeoutMs??15000}ms`+(Y.signal?` (killed by ${Y.signal})`:""),$[0]);throw new L$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${Y.error.message}`,$[0])}return{status:Y.status,signal:Y.signal,stdout:(Y.stdout??"").trim(),stderr:(Y.stderr??"").trim()}}function g7($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??wJ(),Y=J.timeoutMs??15000;return new Promise((G,W)=>{let U=LK(X,[...Q,...$],{windowsHide:!0}),M=!1,O=Y>0?setTimeout(()=>{M=!0,U.kill()},Y):void 0,V="",H="";U.stdout?.setEncoding("utf8").on("data",(q)=>V+=q),U.stderr?.setEncoding("utf8").on("data",(q)=>H+=q),U.stdin?.on("error",()=>{}).end(J.stdin),U.once("error",(q)=>{clearTimeout(O),W(new L$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${q.message}`,$[0]))}),U.once("close",(q,F)=>{if(clearTimeout(O),M){W(new L$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${Y}ms`+(F?` (killed by ${F})`:""),$[0]));return}G({status:q,signal:F,stdout:V.trim(),stderr:H.trim()})})})}function R5($,J){if(J.status!==0)throw new L$("srt_win_nonzero",`srt-win ${$.join(" ")} exited ${J.status}: ${J.stderr||J.stdout}`,$[0]);try{return JSON.parse(J.stdout)}catch(X){throw new L$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(J.stdout)}: ${X.message}`,$[0])}}function m7($,J){return R5($,g0($,J))}async function l7($,J){return R5($,await g7($,J))}function D5($,J){let X=g0($,J),Q;try{Q=JSON.parse(X.stdout)}catch(Y){throw new L$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(X.stdout)}: ${Y.message}`,$[0])}return{ok:X.status===0,json:Q,stderr:X.stderr}}function Z5($){let J=["wfp","status"];if($)J.push("--sublayer-guid",$);return J}function Z9($){return{state:$.state,filters:$.filters,...$.port_range&&{portRange:$.port_range},...$.user_sid&&{userSid:$.user_sid},...$.hint&&{hint:$.hint}}}function B9($){return{provisioned:$.user.exists,...$.user.sid&&{sid:$.user.sid},groupExists:$.user.group_exists,...$.user.group_sid&&{groupSid:$.user.group_sid},inBuiltinUsers:$.user.in_builtin_users,inSandboxGroup:$.user.in_sandbox_group,hiddenFromLogon:$.user.hidden_from_logon,credPresent:$.cred_present,...typeof $.marker_version==="number"&&{markerVersion:$.marker_version},realUserSid:$.real_user_sid,...$.ca_cert_thumb&&{caCertThumb:$.ca_cert_thumb},...$.ca_cert_pem&&{caCertPem:$.ca_cert_pem}}}function B5($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=m7(J,{srtWin:$.srtWin});return{user:B9(X.user),wfp:Z9(X.wfp)}}async function j5($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=await l7(J,{srtWin:$.srtWin});return{user:B9(X.user),wfp:Z9(X.wfp)}}function T5($={}){return Z9(m7(Z5($.sublayerGuid),{srtWin:$.srtWin}))}async function S5($={}){return Z9(await l7(Z5($.sublayerGuid),{srtWin:$.srtWin}))}async function p7($={}){let J=$.target,X;if(!J){let[Q,Y]=$.proxyPortRange??R9;for(let G=0;G<5;G++){let W=F5.createServer();W.listen(0,"127.0.0.1"),await RK(W,"listening");let U=W.address().port;if(U<Q||U>Y){X=W,J=`127.0.0.1:${U}`;break}W.close()}if(!J)throw new L$("wfp_verify_bind_failed",`verifyWindowsWfpEgress: could not bind a loopback listener outside the WFP permit range [${Q},${Y}] in 5 attempts`)}try{let Q=g0(["wfp","verify","--target",J],{timeoutMs:30000,srtWin:$.srtWin});Z(`[Sandbox Windows] wfp verify exit=${Q.status}: ${Q.stderr||Q.stdout}`);let Y;try{Y=JSON.parse(Q.stdout)}catch{throw new L$("wfp_verify_unparseable","WFP egress fence could not be verified \u2014 `srt-win wfp "+`verify\` exited ${Q.status}`+(Q.signal?` (signal ${Q.signal})`:"")+` with unparseable output ${JSON.stringify(Q.stdout)} (stderr: ${JSON.stringify(Q.stderr)})`)}if(Q.status===3)throw new L$("wfp_fence_inactive","WFP egress fence is not active \u2014 direct outbound from the "+`sandbox user to ${Y.target} succeeded. Re-run \`srt-win install\` (one UAC prompt). (${Q.stderr})`);if(Q.status!==0)throw new L$("wfp_verify_inconclusive","WFP egress fence could not be verified \u2014 probe to "+`${Y.target} was '${Y.egress_probe}' (exit ${Q.status}). The fence may be absent. Re-run \`srt-win install\`. (${Q.stderr})`);return{target:Y.target,stderr:Q.stderr}}finally{X?.close()}}function d7($={}){return B9(m7(["user","status"],{srtWin:$.srtWin}))}async function dX($={}){return B9(await l7(["user","status"],{srtWin:$.srtWin}))}function c7($,J={}){let X=$??d7(J);if(!X.caCertThumb||!X.caCertPem)return null;return{pem:X.caCertPem,thumb:X.caCertThumb}}function jK($,J={}){let X=g0(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});C5($,X)}async function I5($,J={}){let X=await g7(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});C5($,X)}function C5($,J){if(Z(`[Sandbox Windows] user trust-ca exit=${J.status}: ${J.stderr||J.stdout}`),J.status!==0)throw new L$("trust_ca_failed",`srt-win user trust-ca '${$}' failed (exit ${J.status}): ${J.stderr||J.stdout}`)}function w5(){let $=process.env.ProgramData;if(!$)throw Error("ProgramData is not set");return e$.win32.join($,"sandbox-runtime")}async function n7($={}){let J=$.status??await dX({srtWin:$.srtWin});if(!J.provisioned||!J.credPresent)throw Error(`ensurePersistentWindowsCa: sandbox user is not provisioned (user=${J.provisioned}, cred=${J.credPresent}). Run \`npx sandbox-runtime windows-install\` first.`);let X=$.dir?void 0:w5();if(X&&!$J.existsSync(X))throw Error(`ensurePersistentWindowsCa: state directory ${X} does not exist. Run \`npx sandbox-runtime windows-install\` first.`);let Q=$.dir??e$.win32.join(X,"ca"),Y=e$.join(Q,"ca.json"),G=e$.join(Q,"cert.pem"),W=e$.join(Q,"key.pem"),U=($.regenerateWithinDays??30)*24*60*60*1000,M=(L,R)=>{let I=`${L}.tmp.${process.pid}`;$J.writeFileSync(I,R),$J.renameSync(I,L)},O=async(L,R,I,T)=>{M(G,L),M(W,R);let C=T||J.caCertThumb!==I;if(C){let w=e$.join(Q,`.trust.${process.pid}.${Date.now()}.pem`);$J.writeFileSync(w,L);try{await I5(w,{srtWin:$.srtWin})}finally{$J.rmSync(w,{force:!0})}}return Z(`[Sandbox Windows] persistent CA ${T?"generated":"reused"} (thumb=${I}${C&&!T?", trust reconciled":""})`),{certPem:L,keyPem:R,certPath:G,keyPath:W,thumbprint:I,generated:T,trusted:C}},V=()=>{let L;try{L=JSON.parse($J.readFileSync(Y,"utf8"))}catch(I){Z(`[Sandbox Windows] persistent CA ca.json unreadable (${I.message})`,{level:"warn"});return}if(typeof L.certPem!=="string"||typeof L.keyPem!=="string")return;let R=xX(L.certPem,L.keyPem);if(!R.ok){Z(`[Sandbox Windows] persistent CA invalid (${R.reason})`,{level:"warn"});return}return{certPem:L.certPem,keyPem:L.keyPem,thumbprint:R.thumbprint,notAfter:R.notAfter}};if(!$.force){let L=V();if(L&&L.notAfter.getTime()-Date.now()>U)return await O(L.certPem,L.keyPem,L.thumbprint,!1);if(L)Z(`[Sandbox Windows] persistent CA expiring ${L.notAfter.toISOString()}; regenerating`,{level:"warn"})}$J.mkdirSync(Q,{recursive:!0});try{let L=Date.now()-300000;for(let R of $J.readdirSync(Q)){if(!R.includes(".tmp.")&&!R.startsWith(".trust."))continue;let I=e$.join(Q,R);if($J.statSync(I).mtimeMs<L)$J.rmSync(I,{force:!0})}}catch{}let H=oY({cn:"sandbox-runtime persistent CA"});M(Y,JSON.stringify({certPem:H.certPem,keyPem:H.keyPem}));let q=V(),{certPem:F,keyPem:K,thumbprint:A}=q??{certPem:H.certPem,keyPem:H.keyPem,thumbprint:gQ(H.certPem)};return await O(F,K,A,!0)}function i7($){return $.timeoutMs??120000}function P5($){let J=["install"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.proxyPortRange)J.push("--proxy-port-range",`${$.proxyPortRange[0]}-${$.proxyPortRange[1]}`);if($.sandboxUser)J.push("--sandbox-user",$.sandboxUser);if($.force)J.push("--force");return J}function _5($){if($ instanceof L$&&$.code==="srt_win_timeout")throw new L$("install_timeout","srt-win install timed out \u2014 the UAC prompt may still be open. "+`Re-run when ready to grant elevation. (${$.message})`);throw $}function x5($){if(Z(`[Sandbox Windows] install exit=${$.status}: ${$.stderr||$.stdout}`),$.status===0||$.status===10)return;let J=$.stderr||$.stdout;switch($.status){case 12:throw new L$("install_wfp_failed",`srt-win install: WFP filter install failed: ${J}`);case 14:throw new L$("install_user_failed",`srt-win install: sandbox user provisioning failed: ${J}`);case 13:throw new L$("install_config_conflict",`srt-win install: filters already exist under this sublayer with a different port range or sandbox-user name. Pass {force: true} to replace, or pick a different sublayerGuid. Output: ${J}`);case 17:throw new L$("install_ambient_failed",`srt-win install: ambient write-deny stamping failed (stock world-writable system dirs could not be deny-stamped for the sandbox user): ${J}`);default:throw new L$("install_failed",`srt-win install failed (exit ${$.status}): ${J}`)}}function TK($={}){let J=$.srtWin??wJ(),X;try{X=g0(P5($),{timeoutMs:i7($),srtWin:J})}catch(Y){_5(Y)}x5(X);let Q=B5({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}async function SK($={}){let J=$.srtWin??wJ(),X;try{X=await g7(P5($),{timeoutMs:i7($),srtWin:J})}catch(Y){_5(Y)}x5(X);let Q=await j5({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}function IK($={}){let J=["uninstall"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.keepUser)J.push("--keep-user");let X=g0(J,{timeoutMs:i7($),srtWin:$.srtWin});if(Z(`[Sandbox Windows] uninstall exit=${X.status}: ${X.stderr||X.stdout}`),X.status===10)return{cancelled:!0};if(X.status!==0)throw new L$("uninstall_failed",`srt-win uninstall failed (exit ${X.status}): ${X.stderr||X.stdout}`);return{}}function j9($,J){let X=new Set;for(let Q of $){let Y=JJ(Q),G=HX(Y);if(qX(Y)&&!G){X.add(Y);continue}let W=G?e0(Y,{caseInsensitive:!0}):[Y];for(let U of W){if(!$J.statSync(U,{throwIfNoEntry:!1})){if(J?.mode==="deny"&&!G)X.add(/[\\/]$/.test(Q)&&!/[\\/]$/.test(U)?U+"\\":U);continue}X.add(U)}}return[...X]}function CK($){for(let J of $.split(/\r?\n/)){let X=J.trim();if(!X.startsWith("{")||!X.includes('"code"'))continue;try{let Q=JSON.parse(X);if(Q.code==="mapped_drive_cwd")return Object.assign(new L$("mapped_drive_cwd",Q.message??"mapped/network-drive working directory","exec"),{drive:Q.drive})}catch{}}return}function o7($){let J=$.holderPid??process.pid,X=JSON.stringify({denyRead:$.denyRead,denyWrite:$.denyWrite}),Q=g0(["acl","stamp","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl stamp exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new L$("acl_stamp_failed",`srt-win acl stamp exited ${Q.status} `+(Q.status===2?"(partial \u2014 some inputs skipped)":"(failed)")+`: ${Q.stderr||Q.stdout}`)}function T9($){let J=$.holderPid??process.pid;try{let X=D5(["acl","restore","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl restore exited non-zero (per-path outcomes preserved): ${X.stderr}`,{level:"error"});return Array.isArray(X.json)?X.json:[...X.json.paths??[],...X.json.parents??[]]}catch(X){Z(`[Sandbox Windows] acl restore: ${X.message}`,{level:"error"});return}}function a7($){let J=$.holderPid??process.pid,X=JSON.stringify({read:$.read,write:$.write}),Q=g0(["acl","grant","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl grant exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new L$("acl_grant_failed",`srt-win acl grant exited ${Q.status}: ${Q.stderr||Q.stdout}`)}function S9($){let J=$.holderPid??process.pid;try{let X=D5(["acl","revoke","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl revoke exited non-zero: ${X.stderr}`,{level:"error"});return X.json}catch(X){Z(`[Sandbox Windows] acl revoke: ${X.message}`,{level:"error"});return}}function v5($){let{exe:J,prependArgs:X}=$.srtWin??wJ(),Q=wK(ZQ($.httpProxyPort,$.socksProxyPort,$.caCertPath?.replace(/\\/g,"/"),$.proxyAuthToken,void 0,PJ($.commandId??$.command)));delete Q.TMPDIR,delete Q.NO_PROXY,delete Q.no_proxy;let Y=KX({safeDirs:[$.cwd??process.cwd(),...$.allowWrite??[],...$.gitSafeDirectories??[]],schannelCa:$.caCertPath!==void 0,baseEnv:$.setEnvVars}),G=[J,...X,"exec"];if($.quiet!==!1)G.push("--quiet");for(let V of $.denyRead??[])G.push("--deny-read",V);for(let V of $.denyWrite??[])G.push("--deny-write",V);let W={PATH:process.env.PATH,PATHEXT:process.env.PATHEXT,...$.setEnvVars??{},...Q,...Y};for(let[V,H]of Object.entries(W))if(H!==void 0)G.push("--env",`${V}=${H}`);G.push("--");let U=$.binShell??D9(void 0);G.push(U.exe,...U.args,$.command);let M=G.reduce((V,H)=>V+H.length+3,0);if(M>30000)throw new L$("argv_too_long",`Windows sandbox argv is ~${M} chars (CreateProcessW limit is 32 767).`);let O={...process.env,...Q};return{argv:G,env:O}}function wK($){let J={};for(let X of $){let Q=X.indexOf("=");if(Q===-1)continue;J[X.slice(0,Q)]=X.slice(Q+1)}return J}function u7($){let J=$?` --sublayer-guid ${$}`:"";return`Windows sandbox needs a one-time install (one UAC prompt):
61
+ `)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=eq((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on("error",(V)=>Z(`mux: client socket error: ${V.message}`));let O=setTimeout(()=>{Z("mux: first-byte timeout; destroying connection"),M.destroy()},J);if(typeof O.unref==="function")O.unref();M.once("readable",()=>{clearTimeout(O);let V=M.read(1);if(!V||V.length===0){M.destroy();return}if(M.unshift(V),Q6.has(V[0]))$.handleSocksConnection(M);else W(M)})});return{server:U,getPort(){let M=U.address();return M&&typeof M==="object"?M.port:void 0},async listenHttpBackend(){if(!X){let O=G6();await N4(O).catch(()=>{}),await new Promise((V,H)=>{$.httpServer.once("error",H),$.httpServer.listen(O,()=>{$.httpServer.removeListener("error",H),V()})}),Q=O,Z(`mux: HTTP backend listening on ${O}`);return}await G9($.httpServer,(O)=>$.httpServer.listen(O,"127.0.0.1"),$.httpBackendPortRange,new Set);let M=$.httpServer.address();return Y=M&&typeof M==="object"?M.port:void 0,Z(`mux: HTTP backend listening on 127.0.0.1:${Y}`),Y},async close(){for(let M of G)M.destroy();if(G.clear(),await new Promise((M)=>U.close(()=>M())),await new Promise((M)=>$.httpServer.close(()=>M())),Q)await N4(Q).catch(()=>{}),Q=void 0;Y=void 0},unref(){U.unref(),$.httpServer.unref()}}}import{randomBytes as W6,randomUUID as U6}from"crypto";var bX="fake_value_",A4="abcdefghijklmnopqrstuvwxyz0123456789_-";function M6($){let J=bX+U6(),X=Buffer.byteLength($)-J.length;if(X<=0)return J;let Q=J;for(let Y of W6(X))Q+=A4[Y%A4.length];return Q}class E7{byName=new Map;bySentinel=new Map;allSentinelsPrefixed=!0;register($,J,X){return this.registerWithSentinel($,M6(J),J,X)}registerWithSentinel($,J,X,Q){let Y=this.byName.get($);if(Y!==void 0)return Y.realValue=X,Y.injectHosts=Q,Y.sentinel;if(!J.startsWith(bX))this.allSentinelsPrefixed=!1;let G={name:$,sentinel:J,realValue:X,injectHosts:Q};return this.byName.set($,G),this.bySentinel.set(J,G),J}lookupReal($){return this.bySentinel.get($)?.realValue}namesInjectableAt($,J){let X=[];for(let Q of this.byName.values())if(Q.injectHosts.some((Y)=>J($,Y)))X.push(Q.name);return X}sentinelsForHost($,J){let X=[];for(let Q of this.bySentinel.values()){if(!Q.injectHosts.some((Y)=>J($,Y)))continue;X.push({sentinel:Buffer.from(Q.sentinel),realValue:Buffer.from(Q.realValue)})}return X}*entries(){for(let $ of this.bySentinel.values())yield[$.sentinel,$.realValue]}get size(){return this.bySentinel.size}clear(){this.byName.clear(),this.bySentinel.clear(),this.allSentinelsPrefixed=!0}substituteInHeaders($,J,X){if(this.bySentinel.size===0)return;for(let[Q,Y]of Object.entries($)){if(Y===void 0)continue;if(Array.isArray(Y))for(let G=0;G<Y.length;G++)Y[G]=this.substituteInHeaderValue(Q,Y[G],J,X);else $[Q]=this.substituteInHeaderValue(Q,Y,J,X)}}substituteInHeaderValue($,J,X,Q){let Y=this.substituteInString(J,X,Q);if($.toLowerCase()!=="authorization")return Y;let G=/^(\s*basic\s+)([a-z0-9+/]+={0,2})(\s*)$/i.exec(Y);if(G===null)return Y;let W=G[2],U=Buffer.from(W,"base64");if(W.length%4!==0||U.toString("base64")!==W)return Y;let M=U.toString("utf8");if(!Buffer.from(M,"utf8").equals(U))return Y;let O=this.substituteInString(M,X,Q);if(O===M)return Y;return`${G[1]}${Buffer.from(O,"utf8").toString("base64")}${G[3]}`}substituteInString($,J,X){if(this.allSentinelsPrefixed&&!$.includes(bX))return $;let Q=$;for(let Y of this.bySentinel.values()){if(!Q.includes(Y.sentinel))continue;if(!Y.injectHosts.some((G)=>X(J,G)))continue;Q=Q.split(Y.sentinel).join(Y.realValue)}return Q}}import{randomUUID as F6}from"crypto";import*as cJ from"fs";import{tmpdir as N6}from"os";import{join as B4}from"path";function O6($,J){let X=!1;for(let Q=J+1;Q<$.length;Q++){let Y=$[Q];if(X){X=!1;continue}if(Y==="\\")X=!0;else if(Y==="]")return Q+1}return $.length}function V6($){switch($){case"s":return{kind:"whitespace"};case"S":return{kind:"non-whitespace"};case"d":return{kind:"digit"};case"D":return{kind:"non-digit"};case"w":return{kind:"word"};case"W":return{kind:"non-word"};default:return{kind:"unknown"}}}function R4($,J){if($===null||J===null)return!0;if($.kind==="literal"&&J.kind==="literal")return $.value===J.value;if($.kind==="whitespace"&&J.kind==="non-whitespace"||$.kind==="non-whitespace"&&J.kind==="whitespace"||$.kind==="digit"&&J.kind==="non-digit"||$.kind==="non-digit"&&J.kind==="digit"||$.kind==="word"&&J.kind==="non-word"||$.kind==="non-word"&&J.kind==="word")return!1;return!0}function H6($,J){if($[J+1]!=="?")return{next:J+1,capturing:!0};if($[J+2]==="<"){let Q=$[J+3];if(Q==="="||Q==="!")return{next:J+4,capturing:!1};let Y=$.indexOf(">",J+3);return{next:Y===-1?J+3:Y+1,capturing:!0}}return{next:J+3,capturing:!1}}function q6($,J){let X=$[J];if(X==="*"||X==="+")return{next:$[J+1]==="?"?J+2:J+1,unbounded:!0};if(X==="?")return{next:$[J+1]==="?"?J+2:J+1,unbounded:!1};if(X!=="{")return null;let Q=J+1,Y=Q;while(/[0-9]/.test($[Q]??""))Q++;if(Q===Y)return null;let G=Number($.slice(Y,Q)),W=G,U=!1;if($[Q]===","){Q++;let M=Q;while(/[0-9]/.test($[Q]??""))Q++;if(Q===M)U=!0,W=void 0;else W=Number($.slice(M,Q))}if($[Q]!=="}")return null;if(!Number.isFinite(G)||G>4096||W!==void 0&&(!Number.isFinite(W)||W>4096))return{next:Q+1,unbounded:U,error:"finite repetitions must be at most 4096"};if(Q++,$[Q]==="?")Q++;return{next:Q,unbounded:U}}function K6($){let J=[{previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}],X=0,Q=()=>J[J.length-1],Y=(G)=>{let W=Q();if(W.lastAtom?.hasUnboundedQuantifier&&G.hasUnboundedQuantifier&&W.lastAtom.repeatClass!==null&&G.repeatClass!==null&&R4(W.lastAtom.repeatClass,G.repeatClass))W.error="adjacent unbounded repetition with overlapping input is not supported";if(W.previousAtom=W.lastAtom,W.lastAtom=G,W.atomCount===0)W.simpleClass=G.repeatClass;else W.simpleClass=null;if(W.atomCount++,G.kind==="group")W.containsQuantifier||=G.containsQuantifier,W.containsAlternation||=G.containsAlternation;W.hasUnboundedQuantifier||=G.hasUnboundedQuantifier};for(let G=0;G<$.length;){if(Q().error!==void 0)return{groupCount:X,error:Q().error};let W=$[G];if(W==="\\"){let M=$[G+1];if(M!==void 0&&/[1-9]/.test(M)||M==="k"&&$[G+2]==="<")return{groupCount:X,error:"backreferences are not supported by the safe extractor"};let O=M==="b"||M==="B";if(Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:V6(M)}),G+=M===void 0?1:2,O)Q().previousAtom=null,Q().lastAtom=null;continue}if(W==="["){Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:{kind:"unknown"}}),G=O6($,G);continue}if(W==="("){let M=H6($,G);if(M.capturing)X++;J.push({previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}),G=M.next;continue}if(W===")"){if(J.length>1){let M=J.pop();if(M.error!==void 0)return{groupCount:X,error:M.error};Y({kind:"group",containsQuantifier:M.containsQuantifier,containsAlternation:M.containsAlternation,hasUnboundedQuantifier:M.hasUnboundedQuantifier,repeatClass:M.atomCount===1&&!M.containsAlternation?M.simpleClass:null})}G++;continue}if(W==="|"){Q().containsAlternation=!0,Q().previousAtom=null,Q().lastAtom=null,G++;continue}let U=q6($,G);if(U!==null){if(U.error)return{groupCount:X,error:U.error};let M=Q(),O=M.lastAtom;if(U.unbounded&&O?.kind==="group"&&(O.containsQuantifier||O.containsAlternation))return{groupCount:X,error:"nested unbounded repetition or unbounded alternation is not supported"};if(U.unbounded&&M.previousAtom?.hasUnboundedQuantifier&&O!==null&&M.previousAtom.repeatClass!==null&&O.repeatClass!==null&&R4(M.previousAtom.repeatClass,O.repeatClass))return{groupCount:X,error:"adjacent unbounded repetition with overlapping input is not supported"};if(M.containsQuantifier=!0,O!==null)M.lastAtom={...O,containsQuantifier:!0,hasUnboundedQuantifier:O.hasUnboundedQuantifier||U.unbounded};M.hasUnboundedQuantifier||=U.unbounded,G=U.next;continue}if(W!=="^"&&W!=="$")Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:W==="."?{kind:"any"}:{kind:"literal",value:W}});else Q().previousAtom=null,Q().lastAtom=null;G++}return{groupCount:X,error:Q().error}}function F7($){if($.length>2048)throw Error("Credential extract pattern exceeds the 2048-character limit");let J;try{J=new RegExp($)}catch{throw Error("Credential extract pattern is not a valid regular expression")}let X=K6($);if(X.error!==void 0)throw Error(`Credential extract pattern rejected: ${X.error}`);return{regex:J,groupCount:X.groupCount}}function z6($,J=""){F7($);try{return new RegExp($,J)}catch{throw Error("Credential extract pattern is not supported by this runtime")}}function W9($,J,X,Q={}){if($.length>1048576)throw Error("Credential extraction input exceeds the 1048576-character limit");let Y=z6(J,"gd"),G=new Map,W=new Map,U=[],M=0;for(let H of $.matchAll(Y)){if(M++,M>4096)throw Error("Credential extraction exceeds the 4096-match limit");let q=H[1];if(q===void 0)throw Error(`Credential extraction matched at offset ${H.index} without a group-1 capture; group 1 must capture the credential value on every match.`);if(q.length===0)continue;let F=G.get(q);if(F===void 0)G.set(q,F=G.size);let[K,A]=H.indices[1],L=X(q,F);if(!W.has(q))W.set(q,L);U.push({start:K,end:A,sentinel:L})}if(G.size===0)return null;if(Q.maskDuplicates){let H=[...G.keys()].sort((q,F)=>F.length-q.length);for(let q of H){let F=W.get(q);if(F===q)continue;for(let K=$.indexOf(q);K!==-1;K=$.indexOf(q,K+1)){let A=K+q.length;if(U.some((L)=>K<L.end&&L.start<A))continue;U.push({start:K,end:A,sentinel:F})}}U.sort((q,F)=>q.start-F.start)}let O="",V=0;for(let H of U)O+=$.slice(V,H.start)+H.sentinel,V=H.end;return{fakeContent:O+$.slice(V),captures:[...G.keys()]}}var D4="(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";function N7($){try{return JSON.parse(Buffer.from($,"base64url").toString("utf8"))}catch{return}}function U9($){let J=$.split(".");if(J.length!==3)return!1;let X=N7(J[0]);if(typeof X!=="object"||X===null||!("alg"in X))return!1;return N7(J[1])!==void 0}var E6=9999999999,Z4="c3J0LWZha2U";function L7($){return Buffer.from($,"utf8").toString("base64url")}function M9($){let J=L7(JSON.stringify({alg:"HS256",typ:"JWT"})),X=L7(JSON.stringify({sub:bX+$,exp:E6}));return`${J}.${X}.${Z4}`}function O9($,J,X){let[Q,Y]=$.split("."),G=N7(Y??"");if(typeof G!=="object"||G===null||Array.isArray(G))return null;let W=G,U=[];for(let O of J){let V=W[O];if(typeof V==="string")U.push([O,V])}if(U.length===0)return null;let M=new Map;for(let[O,V]of U){let H=X(O,V);W[O]=H,M.set(O,H)}return{fakeToken:`${Q}.${L7(JSON.stringify(W))}.${Z4}`,claimSentinels:M}}var L6="file:";class A7{dir;byKey=new Map;write($,J){if(this.dir===void 0)this.dir=cJ.mkdtempSync(B4(N6(),"srt-credmask-"));let X=this.byKey.get($);if(X===void 0)X=B4(this.dir,`${this.byKey.size}.fake`),this.byKey.set($,X);return cJ.rmSync(X,{force:!0}),cJ.writeFileSync(X,J,{mode:384}),X}dispose(){if(this.dir!==void 0)try{cJ.rmSync(this.dir,{recursive:!0,force:!0})}catch($){Z(`MaskedFileStore cleanup failed: ${$}`,{level:"error"})}this.dir=void 0,this.byKey.clear()}get dirPath(){return this.dir}}function j4($,J,X,Q){let Y=[],G=[];for(let W of $){if(W.mode!=="mask")continue;let U=XJ(W.path),M;try{if(cJ.statSync(U).isDirectory()){Z(`[credential-mask] Skipping masked file entry that resolves to a directory: ${W.path} \u2014 use mode "deny" for directories.`,{level:"warn"});continue}let K=cJ.readFileSync(U);if(M=K.toString("utf8"),Buffer.byteLength(M,"utf8")!==K.length){Z(`[credential-mask] Skipping masked file with non-UTF-8 content (binary credential files are not supported in mask mode): ${W.path}`,{level:"warn"});continue}}catch(F){Z(`[credential-mask] Skipping masked file (unreadable on host): ${W.path} \u2014 ${F.message}`);continue}let O=W.injectHosts??J,V=L6+U,H;if(W.extract===void 0&&W.decode===void 0)H=X.register(V,M,O);else{let F=W.extract??D4,K=0,A=W9(M,F,(L,R)=>{if(W.decode==="jwt"&&!U9(L))return L;let I=`${V}#${R}`;if(W.decode==="jwt"&&W.maskClaims?.length){let j=O9(L,W.maskClaims,(w,P)=>X.register(`${V}#jwt${R}.${w}`,P,O));if(j===null)return Z(`[credential-mask] ${W.path}: verified JWT candidate has none of maskClaims ${JSON.stringify(W.maskClaims)} as `+"string claims \u2014 left unmasked."),L;let C=W.maskClaims.filter((w)=>!j.claimSentinels.has(w));if(C.length>0)Z(`[credential-mask] ${W.path}: maskClaims ${JSON.stringify(C)} absent or non-string in a `+"verified JWT \u2014 skipped.");return K++,X.registerWithSentinel(I,j.fakeToken,L,O)}return K++,W.decode==="jwt"?X.registerWithSentinel(I,M9(F6()),L,O):X.register(I,L,O)},{maskDuplicates:W.maskDuplicates??!1});if(A===null||K===0){let L=W.decode==="jwt"?W.maskClaims?.length?`decode "jwt" with pattern "${F}" that matched no verified JWT with maskable claims (maskClaims: ${JSON.stringify(W.maskClaims)})`:`decode "jwt" with pattern "${F}" that matched no verified JWT`:`extract pattern "${F}" that matched nothing`,R=W.onExtractNoMatch??"warn";if(R==="error")throw Error(`credentials.files entry "${W.path}": ${L} (onExtractNoMatch: "error"). Fix the config, change to "warn"/"deny", or remove the entry.`);if(R==="deny"){Z(`[credential-mask] ${W.path} has ${L} \u2014 degrading to `+'mode "deny".',{level:"warn"}),G.push(U);continue}let I=`[sandbox-runtime] WARNING: credentials.files entry "${W.path}" has ${L} in the file. The file is left UNPROTECTED (readable as-is inside the sandbox). Fix the config, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(I),Z(I,{level:"warn"});continue}H=A.fakeContent}let q=Q.write(V,H);Y.push({realPath:U,fakePath:q})}return{binds:Y,degradeToDenyPaths:G}}import{randomUUID as A6}from"crypto";var V9="env:";function T4($,J,X,Q=process.env){let Y={},G=[];for(let W of $){if(W.mode!=="mask")continue;let U=Q[W.name];if(U===void 0)continue;let M=W.injectHosts??J;if(W.decode==="jwt"){if(!U9(U)){let V=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has decode "jwt" but its value did not verify as a JWT. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(V),Z(V,{level:"warn"});continue}if(W.maskClaims?.length){let V=O9(U,W.maskClaims,(q,F)=>X.register(`${V9}${W.name}#${q}`,F,M));if(V===null){let q=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has maskClaims ${JSON.stringify(W.maskClaims)} but none is present as a string claim in its JWT value. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(q),Z(q,{level:"warn"});continue}let H=W.maskClaims.filter((q)=>!V.claimSentinels.has(q));if(H.length>0)Z(`[credential-mask] env var "${W.name}": maskClaims ${JSON.stringify(H)} absent or non-string in the `+"JWT \u2014 skipped.");Y[W.name]=X.registerWithSentinel(`${V9}${W.name}`,V.fakeToken,U,M);continue}Y[W.name]=X.registerWithSentinel(`${V9}${W.name}`,M9(A6()),U,M);continue}if(W.extract===void 0){Y[W.name]=X.register(W.name,U,M);continue}let O=W9(U,W.extract,(V,H)=>X.register(`${V9}${W.name}#${H}`,V,M));if(O===null){let V=W.onExtractNoMatch??"warn";if(V==="error")throw Error(`credentials.envVars entry "${W.name}": extract pattern "${W.extract}" matched nothing (onExtractNoMatch: "error"). Fix the regex, change to "warn"/"deny", or remove the entry.`);if(V==="deny"){Z(`[credential-mask] extract pattern /${W.extract}/ matched nothing in the value of ${W.name} \u2014 unsetting the variable.`,{level:"warn"}),G.push(W.name);continue}let H=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has extract pattern "${W.extract}" that matched nothing in the variable's value. The variable is left UNPROTECTED (visible as-is inside the sandbox). Fix the regex, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(H),Z(H,{level:"warn"});continue}Y[W.name]=O.fakeContent}return{setEnvVars:Y,degradeToUnsetNames:G}}var S4="AWS_ACCESS_KEY_ID",I4="AWS_SECRET_ACCESS_KEY",C4="AWS_SESSION_TOKEN";class R7{bySentinel=new Map;register($){this.bySentinel.set($.accessKeyIdSentinel,$)}lookup($){return this.bySentinel.get($)}get size(){return this.bySentinel.size}clear(){this.bySentinel.clear()}}function w4($,J,X,Q,Y,G=process.env){let W=[...J??[]],U=new Set(W.flatMap((H)=>[H.accessKeyIdVar,H.secretAccessKeyVar,...H.sessionTokenVar?[H.sessionTokenVar]:[]]));if(![S4,I4,C4].some((H)=>U.has(H)))W.push({accessKeyIdVar:S4,secretAccessKeyVar:I4,sessionTokenVar:C4});let O=(H)=>$.find((q)=>q.name===H&&q.mode==="mask"&&q.extract===void 0&&q.decode===void 0),V=(H)=>O(H)!==void 0?Q[H]:void 0;for(let H of W){let q=V(H.accessKeyIdVar),F=V(H.secretAccessKeyVar)!==void 0,K=G[H.accessKeyIdVar],A=G[H.secretAccessKeyVar];if(q===void 0||!F||K===void 0||A===void 0){if(F&&q===void 0){let j=`[sandbox-runtime] WARNING: "${H.secretAccessKeyVar}" is masked but "${H.accessKeyIdVar}" is not, so no AWS credential pair was registered. SigV4 requests will be signed with the masked placeholder secret and the proxy cannot `+"detect or re-sign them \u2014 they will fail upstream. Mask both "+"variables (whole-value) to enable re-signing.";console.warn(j),Z(j,{level:"warn"})}continue}let L=O(H.accessKeyIdVar),I=(H.sessionTokenVar!==void 0?V(H.sessionTokenVar):void 0)!==void 0&&H.sessionTokenVar!==void 0?G[H.sessionTokenVar]:void 0;Y.register({accessKeyIdSentinel:q,realAccessKeyId:K,realSecretAccessKey:A,...I!==void 0?{realSessionToken:I}:{},injectHosts:L.injectHosts??X}),Z(`[credential-aws] registered SigV4 pair for ${H.accessKeyIdVar}/${H.secretAccessKeyVar}`+(I!==void 0?" (+session token)":""))}}function R6($){return{streaming:$?.streaming??"deny",presigned:$?.presigned??"deny",sigv4a:$?.sigv4a??"deny"}}function P4($,J,X){let Q=R6(J);return(Y,G,W,U)=>{if($.size===0)return;let M=aW(W,G);if(M===null)return;let O=$.lookup(M.accessKeyId);if(O===void 0)return;if(!O.injectHosts.some((K)=>X(U,K)))return;if(M.kind!=="header-sigv4"){if(Q[M.kind]==="passthrough"){Z(`[credential-aws] ${M.kind} request with masked credential passed through un-resigned per credentials.sigv4.${M.kind} (its signature covers the placeholder secret and will fail upstream)`);return}return{action:"deny",reason:`AWS SigV4 ${M.kind} request uses a masked credential but cannot be re-signed by the sandbox proxy; denied by policy. Set credentials.sigv4.${M.kind} to "passthrough" to forward it unmodified (it will fail upstream: the signature covers the masked placeholder).`}}let V=sW(lQ(W.authorization));if(V===null)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but its Authorization header is malformed; the proxy cannot re-sign it."};let H=lQ(W["x-amz-date"]);if(H===void 0)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it."};let q=[...V.signedHeaders];for(let K of q){if(K==="host")continue;if(K==="x-amz-security-token"&&O.realSessionToken!==void 0)continue;if(W[K]===void 0)return{action:"deny",reason:`AWS SigV4 request uses a masked credential but signed header "${K}" is missing; the proxy cannot re-sign it.`}}if(O.realSessionToken!==void 0&&!q.includes("x-amz-security-token"))q.push("x-amz-security-token");let F=lQ(W["x-amz-content-sha256"]);return{action:"resign",payloadHash:F===Q9?Q9:void 0,apply(K,A,L){if(O.realSessionToken!==void 0)K["x-amz-security-token"]=O.realSessionToken;if(K["x-amz-content-sha256"]!==void 0&&F!==Q9)K["x-amz-content-sha256"]=L;let{authorization:R}=rW({method:Y,requestTarget:G,headers:K,hostHeader:A,signedHeaders:q,payloadHash:L,amzDate:H,scope:{date:V.date,region:V.region,service:V.service},accessKeyId:O.realAccessKeyId,secretAccessKey:O.realSecretAccessKey});K.authorization=R}}}}import{spawnSync as D6}from"child_process";function R0($){if(typeof globalThis.Bun<"u")return globalThis.Bun.which($);let J=D6("which",[$],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000});if(J.status===0&&J.stdout)return J.stdout.trim();return null}import*as p0 from"fs";import{randomBytes as yK}from"crypto";function CJ($){return $.map((J)=>{if(J==="")return"''";if(/^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/.test(J))return J;return"'"+J.replace(/'/g,`'"'"'`)+"'"}).join(" ")}import{randomBytes as n6}from"crypto";import*as r from"fs";import{spawn as a4}from"child_process";import{tmpdir as F9}from"os";import f$,{join as s4}from"path";import{spawn as Z6}from"child_process";import{text as _4}from"stream/consumers";var B6={ms:1e4};class H9 extends Error{constructor($){super(`ripgrep timed out after ${$} ms`);this.name="RipgrepTimeoutError"}}async function D7($,J,X,Q={command:"rg"}){let{command:Y,args:G=[],argv0:W}=Q,U=Z6(Y,[...G,...$,J],{argv0:W,env:{PATH:process.env.PATH??"/usr/bin:/bin"},signal:X,windowsHide:!0}),M=B6.ms,O=!1,V=setTimeout(()=>{O=!0,U.kill("SIGKILL")},M),H,q,F;try{[H,q,F]=await Promise.all([_4(U.stdout),_4(U.stderr),new Promise((K,A)=>{U.on("close",K),U.on("error",A)})])}finally{clearTimeout(V)}if(O)throw new H9(M);if(F===0)return H.trim().split(`
62
+ `).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as O0,dirname as j6}from"path";import{fileURLToPath as T6}from"url";import*as q9 from"fs";import{homedir as S6}from"os";var Z7=new Map,B7=null;function I6(){if(B7)return B7;let $=[],J=S6();return $.push(O0("/usr","lib","node_modules","@anthropic-ai","sandbox-runtime"),O0("/usr","local","lib","node_modules","@anthropic-ai","sandbox-runtime"),O0("/opt","homebrew","lib","node_modules","@anthropic-ai","sandbox-runtime"),O0(J,".npm","lib","node_modules","@anthropic-ai","sandbox-runtime"),O0(J,".npm-global","lib","node_modules","@anthropic-ai","sandbox-runtime")),B7=$,$}function x4(){let $=process.arch;switch($){case"x64":case"x86_64":return"x64";case"arm64":case"aarch64":return"arm64";case"ia32":case"x86":return Z("[SeccompFilter] 32-bit x86 (ia32) is not currently supported due to missing socketcall() syscall blocking. The current seccomp filter only blocks socket(AF_UNIX, ...), but on 32-bit x86, socketcall() can be used to bypass this.",{level:"error"}),null;default:return Z(`[SeccompFilter] Unsupported architecture: ${$}. Only x64 and arm64 are supported.`),null}}function C6($){let J=x4();if(!J)return[];let X=j6(T6(import.meta.url)),Q=O0("vendor","seccomp",J,$);return[O0(X,Q),O0(X,"..","..",Q),O0(X,"..",Q)]}function j7($){let J=$??"";if(Z7.has(J))return Z7.get(J);let X=w6($);return Z7.set(J,X),X}function w6($){if($){if(q9.existsSync($))return Z(`[SeccompFilter] Using apply-seccomp binary from explicit path: ${$}`),$;Z(`[SeccompFilter] Explicit path provided but file not found: ${$}`)}let J=x4();if(!J)return Z(`[SeccompFilter] Cannot find apply-seccomp binary: unsupported architecture ${process.arch}`),null;Z(`[SeccompFilter] Looking for apply-seccomp binary for architecture: ${J}`);for(let X of C6("apply-seccomp"))if(q9.existsSync(X))return Z(`[SeccompFilter] Found apply-seccomp binary: ${X} (${J})`),X;for(let X of I6()){let Q=O0(X,"vendor","seccomp",J,"apply-seccomp");if(q9.existsSync(Q))return Z(`[SeccompFilter] Found apply-seccomp binary in global install: ${Q} (${J})`),Q}return Z(`[SeccompFilter] apply-seccomp binary not found in any expected location (${J})`),null}import{spawnSync as P6}from"child_process";import{createHash as _6}from"crypto";import*as s from"fs";import nJ from"path";class uX extends Error{}var x6={dir:"/run/srt-stubs",uid:0,lockWaitMs:2000,flockPath:"/usr/bin/flock"},pQ=x6,v6,f4;var K9=s.constants.O_CLOEXEC??524288,T7={kind:"masked"},v4={kind:"real"},hX={kind:"unregistered"},k6=new Set(["ENOENT","EACCES"]),f6=new Set(["ENOENT","ENOTDIR","EROFS"]),V0=null,HQ=null,y6=0;function gX($){return $?.code}function I7($){return _6("sha256").update($).digest("hex")}function C7(){if(process.platform!=="linux")return"off";let{dir:$,uid:J,flockPath:X}=pQ;if(process.geteuid?.()!==J)return"off";try{s.accessSync(X,s.constants.X_OK)}catch(Y){return k6.has(gX(Y)??"")?"off":"error"}try{s.mkdirSync($,{mode:448}),s.chmodSync($,448)}catch(Y){let G=gX(Y)??"";if(G!=="EEXIST")return f6.has(G)?"off":"error"}let Q;try{Q=s.lstatSync($)}catch{return"error"}if(!Q.isDirectory()||Q.uid!==J||(Q.mode&511)!==448)return Z(`[Sandbox Linux] ${$} is not a 0700 directory owned by uid ${J}; mask stubs are not shared`,{level:"warn"}),"off";return $}function y4($,J){try{return s.openSync(nJ.join($,J),s.constants.O_RDONLY|s.constants.O_CREAT|s.constants.O_NOFOLLOW|K9,384)}catch{return null}}function b4($,J){try{return P6(pQ.flockPath,[...J,"3"],{stdio:["ignore","ignore","ignore",$],timeout:pQ.lockWaitMs+5000}).status===0}catch{return!1}}function k4($,J,X){let Q=y4($,J);if(Q===null)return null;let Y=(pQ.lockWaitMs/1000).toFixed(3);if(b4(Q,[X,"-w",Y]))return Q;return s.closeSync(Q),null}function h4($){try{s.closeSync($)}catch{}}function u4(){let $=C7();if($==="off")return!1;if($==="error")throw new uX(`srt: cannot read the mask stub registry ${pQ.dir}; refusing to start the sandbox`);if(V0===null)V0=k4($,"lock","-s");if(V0!==null&&HQ===null)HQ=k4($,"claims","-x");if(V0===null||HQ===null)throw new uX(`srt: mask stub registry ${$} is busy (no ${V0===null?"shared":"claims"} lock within ${pQ.lockWaitMs} ms); refusing to start the sandbox rather than risk a mask another call removes`);return!0}function z9(){if(HQ===null)return;h4(HQ),HQ=null}function b6(){if(V0===null)return;h4(V0),V0=null}function g4(){let $=C7();if($==="off")return null;if($==="error"||V0===null||HQ===null)throw new uX("srt: mask stub claimed without holding the registry; refusing to start the sandbox");return $}function mX($){try{return s.lstatSync($,{bigint:!0})}catch(J){return gX(J)==="ENOENT"?"absent":"unknown"}}function m4($){try{let J=JSON.parse(s.readFileSync($,"utf8")),{v:X,type:Q,uid:Y,dev:G,ino:W,ctimeNs:U,path:M}=J,O=(V)=>typeof V==="string"&&/^\d+$/.test(V);if(X!==1||Q!=="f"&&Q!=="d"||typeof Y!=="number"||!O(G)||!O(W)||!O(U)||typeof M!=="string"||!M.startsWith("/"))return null;return{type:Q,uid:Y,dev:BigInt(G),ino:BigInt(W),ctimeNs:BigInt(U),dest:M}}catch{return null}}function l4($,J){return nJ.join($,`${I7(J)}.stub`)}function h6($,J){let X=I7(J.dest),Q=nJ.join($,`${X}.stub.${process.pid}-${++y6}`),Y=JSON.stringify({v:1,type:J.type,uid:J.uid,dev:String(J.dev),ino:String(J.ino),ctimeNs:String(J.ctimeNs),path:J.dest});s.writeFileSync(Q,Y+`
63
+ `,{flag:"wx",mode:384}),s.renameSync(Q,nJ.join($,`${X}.stub`))}function p4($,J){return(J.type==="f"?$.isFile()&&$.size===BigInt(0):$.isDirectory())&&$.uid===BigInt(J.uid)&&$.dev===J.dev&&$.ino===J.ino&&$.ctimeNs===J.ctimeNs}function w7($){let J=nJ.dirname($),X;try{X=s.openSync(J,s.constants.O_RDONLY|s.constants.O_DIRECTORY|s.constants.O_NOFOLLOW|K9)}catch{return null}try{if(s.readlinkSync(`/proc/self/fd/${X}`)===J)return X}catch{}return s.closeSync(X),null}function d4($,J,X){return{type:$,uid:Number(J.uid),dev:J.dev,ino:J.ino,ctimeNs:J.ctimeNs,dest:X}}function u6($){let J=w7($);if(J===null)return null;try{let X;try{X=s.openSync(`/proc/self/fd/${J}/${nJ.basename($)}`,s.constants.O_RDONLY|s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_NOFOLLOW|K9,292)}catch(Q){return gX(Q)==="EEXIST"?"exists":null}try{return f4?.($),d4("f",s.fstatSync(X,{bigint:!0}),$)}finally{s.closeSync(X)}}finally{s.closeSync(J)}}function g6($,J){let X=w7($);if(X===null)return null;try{let Q=`/proc/self/fd/${X}/${nJ.basename($)}`;try{s.mkdirSync(Q,{mode:493})}catch(G){return gX(G)==="EEXIST"?"exists":null}f4?.($);let Y;try{Y=s.openSync(Q,s.constants.O_RDONLY|s.constants.O_DIRECTORY|s.constants.O_NOFOLLOW|K9)}catch{return null}try{let G=s.fstatSync(Y,{bigint:!0});if(!G.isDirectory()||G.uid!==BigInt(process.geteuid?.()??-1)||G.nlink>BigInt(2)||s.readdirSync(`/proc/self/fd/${Y}`).length!==0)return null;if(J)s.fchownSync(Y,J.uid,J.gid);return d4("d",s.fstatSync(Y,{bigint:!0}),$)}catch{return null}finally{s.closeSync(Y)}}finally{s.closeSync(X)}}function m6($){let J=w7($.dest);if(J===null)return;try{let X=`/proc/self/fd/${J}/${nJ.basename($.dest)}`,Q=mX(X);if(typeof Q==="object"&&p4(Q,$)){if($.type==="d")s.rmdirSync(X);else s.unlinkSync(X);Z(`[Sandbox Linux] Removed shared mask stub: ${$.dest}`)}}catch{}finally{s.closeSync(J)}}function l6($){try{s.unlinkSync($)}catch{}}function S7($,J,X,Q){let Y=m4(l4($,J));return Y!==null&&Y.type===Q&&Y.dest===J&&p4(X,Y)}function c4($,J,X){let Q=g4();if(Q===null)return hX;if(v6?.($)==="unregistered")return hX;let Y=mX($);if(Y==="unknown")return hX;if(Y!=="absent")return S7(Q,$,Y,J)?T7:v4;let G=X();if(G==="exists"){let W=mX($);return typeof W==="object"&&S7(Q,$,W,J)?T7:v4}if(G===null)return hX;try{h6(Q,G)}catch(W){Z(`[Sandbox Linux] mask stub marker not written for ${$}: ${W}`,{level:"warn"})}return T7}function p6($){return c4($,"f",()=>u6($))}function d6($,J){return c4($,"d",()=>g6($,J))}function n4($,J){let X=g4();if(X===null)return null;let Q=(G)=>J.some((W)=>G.startsWith(W+"/")),Y=[];for(let G=nJ.dirname($);Q(G);G=nJ.dirname(G))Y.unshift(G);for(let G of Y){let W=mX(G);if(typeof W==="object"&&S7(X,G,W,"d"))return G}return null}function i4($,J){try{return $()}catch(X){if(X instanceof uX)throw X;return Z(`[Sandbox Linux] mask stub not recorded for ${J}: ${X}`,{level:"warn"}),hX}}function P7($){return i4(()=>p6($),$)}function o4($,J){return i4(()=>d6($,J),$)}function c6($){let J;try{J=s.readdirSync($)}catch{return}let X=[],Q=[];for(let G of J){let W=/^([0-9a-f]{64})\.stub(\..*)?$/.exec(G);if(W===null)continue;let U=nJ.join($,G);if(Q.push(U),W[2]===void 0){let M=m4(U);if(M!==null&&I7(M.dest)===W[1])X.push(M)}}let Y=(G)=>G.dest.split("/").length;X.sort((G,W)=>G.type===W.type?Y(W)-Y(G):G.type==="f"?-1:1);for(let G of X)m6(G);for(let G of Q)l6(G)}function _7($,J){let X=C7(),Q=V0!==null;if(z9(),b6(),X==="off"){for(let G of $)J(G);return[]}if(X==="error")return[...$];if(!Q&&$.length===0)return[];let Y=y4(X,"lock");if(Y===null)return[...$];try{if(!b4(Y,["-x","-n"]))return[...$];for(let G of $)if(mX(l4(X,G))==="absent")J(G);return c6(X),[]}catch(G){return Z(`[Sandbox Linux] mask stub sweep failed: ${G}`,{level:"warn"}),[...$]}finally{s.closeSync(Y)}}var k7=3;function i6($){let J=$.uid===void 0?$.bwrapCommand:[$.setprivPath??"/usr/bin/setpriv",`--reuid=${$.uid}`,`--regid=${$.gid??$.uid}`,"--clear-groups","--inh-caps=-all","--ambient-caps=-all","--bounding-set=-all",...$.bwrapCommand],X=$.unsetEnvVars??[],Q=Object.entries($.setEnvVars??{});if(X.length===0&&Q.length===0)return J;return["/usr/bin/env",...X.flatMap((Y)=>["-u",Y]),...Q.map(([Y,G])=>`${Y}=${G}`),...J]}function x7($,J){let X=$.split(f$.sep),Q="";for(let Y of X){if(!Y)continue;let G=Q+f$.sep+Y;try{if(r.lstatSync(G).isSymbolicLink()){if(J.some((M)=>G.startsWith(M+"/")||G===M))return G}}catch{break}Q=G}return null}var o6=40;function r4($){let J=$;for(let X=0;X<o6;X++){try{return r.realpathSync(J)}catch{}let Q=J,Y=[],G=null;while(G===null){let M=f$.dirname(Q);if(M===Q)return null;Y.unshift(f$.basename(Q)),Q=M;try{G=r.realpathSync(Q)}catch{}}let W=f$.join(G,Y[0]),U=null;try{U=r.readlinkSync(W)}catch{}if(U===null)return f$.join(G,...Y);J=f$.join(f$.resolve(f$.dirname(W),U),...Y.slice(1))}return null}function a6($){let J=$.split(f$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+f$.sep+Q;try{let G=r.statSync(Y);if(G.isFile()||G.isSymbolicLink())return!0}catch{break}X=Y}return!1}function s6($){let J=$.split(f$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+f$.sep+Q;if(!r.existsSync(Y))return Y;X=Y}return $}async function r6($={command:"rg"},J=k7,X=!1,Q){let Y=process.cwd(),G=new AbortController,W=Q??G.signal,U=qY(),M=[...VX.map((K)=>f$.resolve(Y,K)),...U.map((K)=>f$.resolve(Y,K))],O=f$.resolve(Y,".git"),V=!1;try{V=r.statSync(O).isDirectory()}catch{}if(V){if(M.push(f$.resolve(Y,".git/hooks")),!X)M.push(f$.resolve(Y,".git/config"))}let H=[];for(let K of VX)H.push("--iglob",K);for(let K of U)H.push("--iglob",`**/${K}/**`);if(H.push("--iglob","**/.git/hooks/**"),!X)H.push("--iglob","**/.git/config");let q=["--files","--hidden","--no-ignore","--max-depth",String(J),...H,"-g","!**/node_modules/**"],F;try{F=await D7(q,Y,W,$)}catch(K){if(K instanceof H9)throw Error(`mandatory deny scan failed: ${K}`);Z(`[Sandbox] ripgrep scan failed, retrying once: ${K}`);try{F=await D7(q,Y,W,$)}catch(A){throw Error(`mandatory deny scan failed: ${A}`)}}for(let K of F){let A=f$.resolve(Y,K),L=!1;for(let R of[...U,".git"]){let I=p9(R),j=A.split(f$.sep),C=j.findIndex((w)=>p9(w)===I);if(C!==-1){if(R===".git"){let w=j.slice(0,C+1).join(f$.sep);if(K.includes(".git/hooks"))M.push(f$.join(w,"hooks"));else if(K.includes(".git/config"))M.push(f$.join(w,"config"))}else M.push(j.slice(0,C+1).join(f$.sep));L=!0;break}}if(!L)M.push(A)}return[...new Set(M)]}var lX;function t6(){if(process.getuid?.()!==0||process.env.ARA_SRT_FILE_MASK!=="empty")return"/dev/null";if(lX)try{let X=r.lstatSync(lX);if(X.isFile()&&X.size===0&&X.uid===0&&(X.mode&146)===0)return lX}catch{}let $=r.mkdtempSync(f$.join(F9(),"claude-empty-file-"));N9.add($),r.chmodSync($,493);let J=f$.join($,"empty");return r.writeFileSync(J,"",{flag:"wx",mode:292}),r.chmodSync(J,292),lX=J,J}var pX=new Set,N9=new Set;function t4($,J){return $===J?t6():"/dev/null"}var e6="ARA_SRT_MASKED_PATHS",$K=16384;function JK($,J,X=$K){let Q=[],Y=0;for(let G of new Set($)){if(G.includes(`
64
+ `))continue;if(G!==J&&!G.startsWith(J==="/"?"/":J+"/"))continue;let W=G.split("'").length-1,U=Buffer.byteLength(G)+4*W+(Q.length>0?1:0);if(Y+U>X)break;Q.push(G),Y+=U}return Q.length>0?Q.join(`
65
+ `):void 0}function QK($){try{let J=r.lstatSync($);return J.isFile()&&J.size===0}catch{return!1}}var D0=0,e4=!1;function E9(){if(e4)return;process.on("exit",()=>{L9({force:!0})}),e4=!0}function L9($){if(!$?.force){if(D0>0)D0--;if(D0>0){Z(`[Sandbox Linux] Deferring mount point cleanup \u2014 ${D0} sandbox(es) still active`);return}}else D0=0;let J=[],X=[];for(let G of pX)try{let W=r.statSync(G);if(W.isFile()&&W.size===0)J.push(G);else if(W.isDirectory())X.push(G)}catch{}let Q=(G)=>G.split("/").length;X.sort((G,W)=>Q(W)-Q(G));let Y=_7([...J,...X],(G)=>{try{let W=r.statSync(G);if(W.isFile()&&W.size===0)r.unlinkSync(G),Z(`[Sandbox Linux] Cleaned up bwrap mount point (file): ${G}`);else if(W.isDirectory()){if(r.readdirSync(G).length!==0)return;r.rmdirSync(G),Z(`[Sandbox Linux] Cleaned up bwrap mount point (dir): ${G}`)}}catch{}});pX.clear();for(let G of Y)pX.add(G);for(let G of N9)try{r.rmSync(G,{recursive:!0,force:!0})}catch{}N9.clear(),lX=void 0}function $5($){try{return r.accessSync($,r.constants.X_OK),!0}catch{return!1}}function Q5($){let{seccompConfig:J,bwrapPath:X,socatPath:Q}=$??{},Y=[],G=[];if(X){if(!$5(X))Y.push(`bubblewrap (bwrap) not executable at ${X}`)}else if(R0("bwrap")===null)Y.push("bubblewrap (bwrap) not installed");if(Q){if(!$5(Q))Y.push(`socat not executable at ${Q}`)}else if(R0("socat")===null)Y.push("socat not installed");if(!J?.argv0&&j7(J?.applyPath)===null)G.push("seccomp not available - unix socket access not restricted");return{warnings:G,errors:Y}}async function X5($,J,X,Q,Y){let G=X??"socat",W=n6(8).toString("hex"),U=s4(F9(),`claude-http-${W}.sock`),M=s4(F9(),`claude-socks-${W}.sock`),O=[`UNIX-LISTEN:${U},fork,reuseaddr`,`TCP:localhost:${$},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];Z(`Starting HTTP bridge: ${G} ${O.join(" ")}`);let V=a4(G,O,{stdio:"ignore"});if(V.on("error",(K)=>{Z(`HTTP bridge process error: ${K}`,{level:"error"})}),V.on("exit",(K,A)=>{Z(`HTTP bridge process exited with code ${K}, signal ${A}`,{level:K===0?"info":"error"})}),!V.pid)throw Error("Failed to start HTTP bridge process");let H,q;if(J===$)H=V,q=U;else{q=M;let K=[`UNIX-LISTEN:${M},fork,reuseaddr`,`TCP:localhost:${J},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];if(Z(`Starting SOCKS bridge: ${G} ${K.join(" ")}`),H=a4(G,K,{stdio:"ignore"}),H.on("error",(A)=>{Z(`SOCKS bridge process error: ${A}`,{level:"error"})}),H.on("exit",(A,L)=>{Z(`SOCKS bridge process exited with code ${A}, signal ${L}`,{level:A===0?"info":"error"})}),!H.pid){if(V.pid)try{process.kill(V.pid,"SIGTERM")}catch{}throw Error("Failed to start SOCKS bridge process")}}let F=200;for(let K=0;K<F;K++){if(!V.pid||V.killed||!H.pid||H.killed)throw Error("Linux bridge process died unexpectedly");try{if(r.existsSync(U)&&r.existsSync(q)){if(Q!==void 0){let A=Y??Q;for(let L of new Set([U,q]))r.chownSync(L,Q,A),r.chmodSync(L,384)}Z(`Linux bridges ready after ${K+1} attempts`);break}}catch(A){Z(`Error checking sockets (attempt ${K+1}): ${A}`,{level:"error"})}if(K===F-1){if(V.pid)try{process.kill(V.pid,"SIGTERM")}catch{}if(H.pid)try{process.kill(H.pid,"SIGTERM")}catch{}throw Error(`Failed to create bridge sockets after ${F} attempts`)}await new Promise((A)=>setTimeout(A,5))}return{httpSocketPath:U,socksSocketPath:q,httpBridgeProcess:V,socksBridgeProcess:H,httpProxyPort:$,socksProxyPort:J}}function XK($,J){if(J){if(!$)throw Error("seccompConfig.argv0 requires seccompConfig.applyPath");return`ARGV0=${CJ([J])} ${CJ([$])} `}let X=j7($);return X?`${CJ([X])} `:void 0}function YK($,J,X,Q,Y,G){let W=Y||"bash",U=CJ([G??"socat"]),M=["srt_payload_pid=",`${U} TCP4-LISTEN:3128,bind=127.0.0.1,fork,reuseaddr ${CJ([`UNIX-CONNECT:${$}`])} >/dev/null 2>&1 &`,"srt_http_proxy_pid=$!",`${U} TCP4-LISTEN:1080,bind=127.0.0.1,fork,reuseaddr ${CJ([`UNIX-CONNECT:${J}`])} >/dev/null 2>&1 &`,"srt_socks_proxy_pid=$!","srt_cleanup_command() {"," srt_status=$?"," trap - EXIT INT TERM",' if [ -n "$srt_payload_pid" ]; then',' kill -KILL "$srt_payload_pid" 2>/dev/null',' wait "$srt_payload_pid" 2>/dev/null'," fi",' kill -KILL "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null',' wait "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null',' exit "$srt_status"',"}","trap srt_cleanup_command EXIT","trap 'exit 143' TERM","trap 'exit 130' INT",...[3128,1080].map((H)=>`${U} -u OPEN:/dev/null TCP4:127.0.0.1:${H},connect-timeout=0.1,retry=480,interval=0.005 >/dev/null 2>&1 || { printf '%s\\n' 'Sandbox proxy listener readiness failed' >&2; exit 1; }`),`kill -0 "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null || { printf '%s\\n' 'Sandbox proxy listener exited before command' >&2; exit 1; }`],O=(Q??"")+CJ([W,"-c",X]),V=[...M,`${O} <&0 &`,"srt_payload_pid=$!",'wait "$srt_payload_pid"',"srt_payload_status=$?","srt_payload_pid=",'exit "$srt_payload_status"'].join(`
66
+ `);return`${W} -c ${CJ([V])}`}function v7($){try{if(r.lstatSync($).isSymbolicLink())return r.realpathSync($)}catch{}return $}function J5($,J,X,Q){let Y=J==="/"?"/":J+"/";$.push("--tmpfs",J);for(let G of X)if(G.startsWith(Y)||G===J)$.push("--bind",G,G),Z(`[Sandbox Linux] Re-bound write path wiped by denyRead tmpfs: ${G}`);for(let G of Q)if(G.startsWith(Y)||G===J){if(!r.existsSync(G)){Z(`[Sandbox Linux] Skipping non-existent read allow path: ${G}`);continue}if(X.some((W)=>(W.startsWith(Y)||W===J)&&(G===W||G.startsWith(W+"/"))))continue;$.push("--ro-bind",G,G),Z(`[Sandbox Linux] Re-allowed read access within denied region: ${G}`)}}async function GK($,J,X,Q,Y={command:"rg"},G=k7,W=!1,U,M,O=[]){let V=[],H=[],q=[],F=new Set,K=new Map,A=new Map;if(J){V.push("--ro-bind","/","/");for(let u of J.allowOnly||[]){let J$=XJ(u).replace(/\/+$/,"")||"/";if(Z(`[Sandbox Linux] Processing write path: ${u} -> ${J$}`),J$.startsWith("/dev/")){Z(`[Sandbox Linux] Skipping /dev path: ${J$}`);continue}if(!r.existsSync(J$)){Z(`[Sandbox Linux] Skipping non-existent write path: ${J$}`);continue}try{let a=r.realpathSync(J$),V$=J$.replace(/\/+$/,"");if(a!==V$&&HY(J$,a)){Z(`[Sandbox Linux] Skipping symlink write path pointing outside expected location: ${u} -> ${a}`);continue}}catch{Z(`[Sandbox Linux] Skipping write path that could not be resolved: ${J$}`);continue}V.push("--bind",J$,J$),H.push(J$)}let y,n=()=>{if(y!==void 0)return y;let u=[];for(let a of H){u.push(a);try{let V$=r.realpathSync(a);if(V$!==a)u.push(V$)}catch{}}let J$=[];if($){let a=[],V$=new Set(["proc","dev","sys"]);for(let O$ of $.denyOnly||[])if(XJ(O$)==="/")try{for(let $$ of r.readdirSync("/"))if(!V$.has($$))a.push("/"+$$)}catch{}else a.push(O$);if(r.existsSync("/etc/ssh/ssh_config.d"))a.push("/etc/ssh/ssh_config.d");for(let O$ of a){let $$=XJ(O$),P$=!1;try{P$=r.statSync($$).isDirectory()}catch{continue}if(!P$)continue;J$.push($$);try{let G$=r.realpathSync($$);if(G$!==$$)J$.push(G$)}catch{}}}return y={allowedWritePathsBothForms:u,prospectiveReadDenyTmpfsDirsBothForms:J$},y},Y$=(u)=>H.some((J$)=>u.startsWith(J$+"/")||u===J$),L$=[...J.denyWithinAllow||[],...await r6(Y,G,W,U)];u4();let j$=new Set;for(let u of L$){let J$=XJ(u);if(J$.startsWith("/dev/"))continue;let a=r4(J$);if(a===null||a.startsWith("/dev/"))continue;if(x7(a,H))continue;let V$=!1;try{V$=r.statSync(a).isDirectory()}catch{continue}if(!V$)continue;if(Y$(a)){let O$=K.get(a);if(O$===void 0)O$=new Set,K.set(a,O$);O$.add(J$)}}let QJ=new Map,S$=(u)=>{let J$=QJ.get(u);if(J$!==void 0)return J$;let{allowedWritePathsBothForms:a,prospectiveReadDenyTmpfsDirsBothForms:V$}=n(),O$=a.some(($$)=>$$.startsWith(u+"/"))||V$.some(($$)=>$$===u||$$.startsWith(u+"/"))||V$.some(($$)=>[u,...K.get(u)??[]].some((P$)=>P$===$$||P$.startsWith($$+"/")));return QJ.set(u,O$),O$},h$=[...K.keys()];for(let u of L$){let J$=XJ(u);if(J$.startsWith("/dev/"))continue;let a=r4(J$);if(a===null){let $$=x7(J$,H);if($$&&!j$.has($$))j$.add($$),q.push("--ro-bind","/dev/null",$$),A.set($$,J$);Z(`[Sandbox Linux] Deny path could not be resolved through symlinks, failing closed: ${J$}`);continue}if(a!==J$)Z(`[Sandbox Linux] Resolved symlinked deny path: ${J$} -> ${a}`);if(a.startsWith("/dev/"))continue;if(j$.has(a))continue;j$.add(a);let V$=x7(a,H);if(V$){if(!j$.has(V$))j$.add(V$),q.push("--ro-bind","/dev/null",V$),A.set(V$,J$);Z(`[Sandbox Linux] Mounted /dev/null at symlink ${V$} to prevent symlink replacement attack`);continue}if(!r.existsSync(a)){if(a6(a)){Z(`[Sandbox Linux] Skipping deny path with file ancestor (cannot create paths under a file): ${a}`);continue}let $$=f$.dirname(a);while($$!=="/"&&!r.existsSync($$))$$=f$.dirname($$);let P$=Y$($$)||Y$(a),G$=h$.filter((x$)=>$$===x$||$$.startsWith(x$+"/")),c$=G$.length>0&&!G$.some(S$);if(P$&&!c$){let x$=s6(a),E$=n4(x$,H)??x$;if(E$!==a){if(!F.has(E$)){let n$=o4(E$,M),y$=r.mkdtempSync(f$.join(F9(),"claude-empty-"));if(r.chmodSync(y$,365),N9.add(y$),q.push("--ro-bind",y$,E$),A.set(E$,J$),F.add(E$),n$.kind==="unregistered")pX.add(E$);E9(),Z(`[Sandbox Linux] Mounted empty dir at ${E$} to block creation of ${a}`)}}else{let n$=P7(E$),y$=t4(a,J$);if(n$.kind==="masked")q.push("--ro-bind",y$,E$),A.set(E$,J$),E9(),Z(`[Sandbox Linux] Masked shared stub at ${E$} with ${y$} to block creation of ${a}`);else if(n$.kind==="real")q.push("--ro-bind",E$,E$),A.set(E$,J$);else q.push("--ro-bind",y$,E$),A.set(E$,J$),pX.add(E$),E9(),Z(`[Sandbox Linux] Mounted ${y$} at ${E$} to block creation of ${a}`)}}else if(c$)Z(`[Sandbox Linux] Skipping non-existent deny path inside a read-only denied directory (already uncreatable): ${a}`);else Z(`[Sandbox Linux] Skipping non-existent deny path not within allowed paths: ${a}`);continue}if(Y$(a)){if((QK(a)?P7(a):void 0)?.kind==="masked")q.push("--ro-bind",t4(a,J$),a),E9();else q.push("--ro-bind",a,a);A.set(a,J$)}else Z(`[Sandbox Linux] Skipping deny path not within allowed paths: ${a}`)}}else V.push("--bind","/","/");let L=[],R=($?.allowWithinDeny||[]).map((y)=>XJ(y)),I=new Map,j=[],C=new Set(["proc","dev","sys"]);for(let y of $?.denyOnly||[])if(XJ(y)==="/"){for(let n of r.readdirSync("/"))if(!C.has(n))L.push("/"+n)}else L.push(y);if($&&r.existsSync("/etc/ssh/ssh_config.d"))L.push("/etc/ssh/ssh_config.d");let w=L.map((y)=>XJ(y)).sort((y,n)=>y.split("/").length-n.split("/").length);for(let y of w){if(!r.existsSync(y)){Z(`[Sandbox Linux] Skipping non-existent read deny path: ${y}`);continue}if(r.statSync(y).isDirectory())j.push(y),J5(V,y,H,R);else{if(R.includes(y)){Z(`[Sandbox Linux] Skipping read deny for re-allowed path: ${y}`);continue}let Y$=v7(y);V.push("--ro-bind","/dev/null",Y$),I.set(Y$,"/dev/null"),I.set(y,"/dev/null")}}for(let{realPath:y,fakePath:n}of X??[]){let Y$=v7(y);V.push("--ro-bind",n,Y$),I.set(Y$,n),I.set(y,n)}let P=(y)=>j.some((n)=>{if(!(y===n||y.startsWith(n+"/")))return!1;return!H.some((j$)=>(j$===n||j$.startsWith(n+"/"))&&(y===j$||y.startsWith(j$+"/")))}),l=[...F].filter((y)=>{let n=A.get(y)??y;return!I.has(y)&&!P(y)&&!P(n)&&!H.some((Y$)=>Y$===y||Y$.startsWith(y+"/"))}),e=[];for(let y=0;y<q.length;y+=3){let n=q[y+2],Y$=A.get(n)??n;if(I.has(n))continue;if(P(n)||P(Y$)){Z(`[Sandbox Linux] Skipping denyWrite bind already hidden by denyRead tmpfs: ${n}`);continue}if(l.some((L$)=>n.startsWith(L$+"/"))){Z(`[Sandbox Linux] Skipping denyWrite bind under an empty-directory mask: ${n}`);continue}if(V.push(q[y],q[y+1],n),e.push(n),q[y+1]!==n)O.push(n);if(Y$!==n)e.push(Y$)}for(let y of j)if(e.some((n)=>y.startsWith(n+"/")))Z(`[Sandbox Linux] Re-applying denyRead tmpfs re-exposed by denyWrite bind: ${y}`),J5(V,y,H,R);for(let[y,n]of I)if(e.some((Y$)=>y.startsWith(Y$+"/"))){if(v7(y)!==y)continue;Z(`[Sandbox Linux] Re-applying file mask re-exposed by denyWrite bind: ${y}`),V.push("--ro-bind",n,y)}if(Q!==void 0)V.push("--ro-bind",Q,Q);return V}async function Y5($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpSocketPath:Y,socksSocketPath:G,httpProxyPort:W,socksProxyPort:U,proxyAuthToken:M,caCertPath:O,readConfig:V,writeConfig:H,unsetEnvVars:q,setEnvVars:F,maskedFileBinds:K,maskedFileStoreDir:A,enableWeakerNestedSandbox:L,runAsUid:R,runAsGid:I,runAsHostUid:j,runAsHostGid:C,runAsHostHome:w,runAsHostUser:P,setprivPath:l,allowAllUnixSockets:e,binShell:y,ripgrepConfig:n={command:"rg"},mandatoryDenySearchDepth:Y$=k7,allowGitConfig:L$=!1,gitSafeDirectories:j$,seccompConfig:QJ,bwrapPath:S$,socatPath:h$,observeSocketPath:u,abortSignal:J$}=$,a=V&&V.denyOnly.length>0||K!==void 0&&K.length>0,V$=H!==void 0,O$=q!==void 0&&q.length>0||F!==void 0&&Object.keys(F).length>0,$$=(j$?.length??0)>0;if(!Q&&!a&&!V$&&!O$&&!$$)return J;D0++;let P$=[],G$=["--new-session","--die-with-parent"],c$=[],x$;try{if(!e)if(x$=XK(QJ?.applyPath,QJ?.argv0),!x$)Z("[Sandbox Linux] apply-seccomp binary not available - unix socket blocking disabled. Install @anthropic-ai/sandbox-runtime globally for full protection.",{level:"warn"});else Z("[Sandbox Linux] Applying seccomp filter for Unix socket blocking");else Z("[Sandbox Linux] Skipping seccomp filter - allowAllUnixSockets is enabled");if(u&&x$)if(r.existsSync(u))c$.push("--bind",u,u),G$.push("--setenv","SRT_OBSERVE_SOCK",u),G$.push("--setenv","SRT_ENCODED_CMD",PJ(X??J));else Z("[Sandbox Linux] observe socket missing \u2014 supervisor not running; "+"continuing without violation monitoring");if(O$){for(let b$ of q??[])G$.push("--unsetenv",b$);for(let[b$,i$]of Object.entries(F??{}))G$.push("--setenv",b$,i$)}if(j$&&j$.length>0){let b$=KY({safeDirs:j$,unsetEnvVars:q,setEnvVars:F});for(let[i$,MY]of Object.entries(b$))G$.push("--setenv",i$,MY)}if(Q){if(G$.push("--unshare-net"),Y&&G){if(!r.existsSync(Y))throw Error(`Linux HTTP bridge socket does not exist: ${Y}. The bridge process may have died. Try reinitializing the sandbox.`);if(!r.existsSync(G))throw Error(`Linux SOCKS bridge socket does not exist: ${G}. The bridge process may have died. Try reinitializing the sandbox.`);if(c$.push("--bind",Y,Y),G!==Y)c$.push("--bind",G,G);let b$=ZQ(3128,1080,O,M,H===void 0,PJ(X??J));if(G$.push(...b$.flatMap((i$)=>{let MY=i$.indexOf("="),PU=i$.slice(0,MY),_U=i$.slice(MY+1);return["--setenv",PU,_U]})),W!==void 0)G$.push("--setenv","CLAUDE_CODE_HOST_HTTP_PROXY_PORT",String(W));if(U!==void 0)G$.push("--setenv","CLAUDE_CODE_HOST_SOCKS_PROXY_PORT",String(U))}}let E$=await GK(V,H,K,A,n,Y$,L$,J$,j===void 0?void 0:{uid:j,gid:C??j},P$);z9(),G$.push(...E$);let n$=JK(P$,process.cwd());if(n$!==void 0)G$.push("--setenv",e6,n$);if(G$.push(...c$),G$.push("--dev","/dev"),G$.push("--unshare-pid"),!L){if(G$.push("--unshare-user","--cap-drop","ALL","--proc","/proc"),!x$)G$.push("--ro-bind","/dev/null","/proc/sysrq-trigger")}else G$.push("--unshare-user","--bind","/proc","/proc");if(R!==void 0)G$.push("--uid",String(R)),G$.push("--gid",String(I??R));if(j!==void 0){if(w)G$.push("--setenv","HOME",w);if(P)G$.push("--setenv","USER",P),G$.push("--setenv","LOGNAME",P)}let y$=y||"bash",e$=R0(y$);if(!e$)throw Error(`Shell '${y$}' not found in PATH`);if(G$.push("--",e$,"-c"),Q&&Y&&G){let b$=YK(Y,G,J,x$,e$,h$);G$.push(b$)}else if(x$){let b$=x$+CJ([e$,"-c",J]);G$.push(b$)}else G$.push(J);let GJ=[S$??"bwrap",...G$],WJ=CJ(i6({bwrapCommand:GJ,uid:j,gid:C,setprivPath:l,unsetEnvVars:q,setEnvVars:F})),s$=[];if(Q)s$.push("network");if(a||V$)s$.push("filesystem");if(O$)s$.push("env");if(x$)s$.push("seccomp(unix-block)");return Z(`[Sandbox Linux] Wrapped command with bwrap (${s$.join(", ")} restrictions)`),WJ}catch(E$){if(D0>0)D0--;if(z9(),D0===0)_7([],()=>{});throw E$}}import{spawn as WK}from"child_process";import*as Z0 from"path";class A9{violations=[];totalCount=0;maxSize=100;listeners=new Set;addViolation($){if(this.violations.push({...$,line:f7($.line).replace(/[<>]/g,"")}),this.totalCount++,this.violations.length>this.maxSize)this.violations=this.violations.slice(-this.maxSize);this.notifyListeners()}getViolations($){if($===void 0)return[...this.violations];return this.violations.slice(-$)}getCount(){return this.violations.length}getTotalCount(){return this.totalCount}getViolationsForCommand($){let J=PJ($);return this.violations.filter((X)=>X.encodedCommand===J)}clear(){this.violations=[],this.notifyListeners()}subscribe($){return this.listeners.add($),$(this.getViolations()),()=>{this.listeners.delete($)}}notifyListeners(){let $=this.getViolations();this.listeners.forEach((J)=>J($))}}function dQ($,J,X){if(!X)return!1;if((X["*"]??[]).some((Y)=>$.includes(Y)))return!0;if(J===void 0)return!1;for(let[Y,G]of Object.entries(X))if(Y!=="*"&&J.includes(Y)&&G.some((W)=>$.includes(W)))return!0;return!1}function f7($){return $.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").trim()}function UK($=!1){let J=process.cwd(),X=[];for(let Q of VX)X.push(Z0.resolve(J,Q)),X.push(`**/${Q}`);for(let Q of qY())X.push(Z0.resolve(J,Q)),X.push(`**/${Q}/**`);if(X.push(Z0.resolve(J,".git/hooks")),X.push("**/.git/hooks/**"),!$)X.push(Z0.resolve(J,".git/config")),X.push("**/.git/config");return[...new Set(X)]}var G5=`_${Math.random().toString(36).slice(2,11)}_SBX`;function MK($){return`CMD64_${PJ($)}_END_${G5}`}function cQ($){return NJ($)?`(regex ${iJ(zX($))})`:`(subpath ${iJ($)})`}function u7($){return zX($).slice(0,-1)+"(/.*)?$"}function qQ($){return NJ($)?`(regex ${iJ(u7($))})`:`(subpath ${iJ($)})`}function W5($){return $.replace(/\[[^\]]*\]|[*?]+/g,"x")}function b7($,J){let X=[...new Set(J)];if(X.length===0)return $;let Q=X.map((Y)=>`(require-not ${Y})`).join(" ");return`(require-all ${$} ${Q})`}function y7($){let J=XJ($);return{path:J,glob:NJ(J)}}function U5($,J){return $.test(J.glob?W5(J.path):J.path)}function R9($,J){let X=$.glob?W5($.path):$.path;return X.startsWith(J==="/"?"/":J+"/")&&X!==J}function OK($,J){return{denies:($.denyOnly||[]).map(y7),allows:($.allowWithinDeny||[]).map(y7),writeRoots:(J||[]).map(y7)}}function VK($){let J=[],X=!1,Q=$.allows.filter((Y)=>!Y.glob).map((Y)=>Y.path);for(let Y of $.denies){if(!Y.glob){if(Q.some((U)=>Y.path.startsWith(U+"/")))J.push(qQ(Y.path));continue}let G=new RegExp(u7(Y.path));if(G.test("/"))X=!0;let W=$.allows.filter((U)=>U5(G,U)).map((U)=>cQ(U.path));J.push(b7(qQ(Y.path),W))}return{filters:J,coversRoot:X}}function M5($){let J=$.split(/[*?[\]]/)[0];if(!J||J==="/")return"/";return J.endsWith("/")?J.slice(0,-1):Z0.dirname(J)}function HK($,J){let{denies:X,allows:Q,writeRoots:Y}=$;if(Y.length===0)return[];let G=Y.filter((H)=>H.glob).map((H)=>new RegExp(zX(H.path))),W=Y.filter((H)=>!H.glob).map((H)=>H.path),U=(H)=>W.some((q)=>R9({path:H,glob:!1},q))||G.some((q)=>q.test(H)),M=(H)=>[...Q,...Y].filter((q)=>R9(q,H)).map((q)=>cQ(q.path)),O=new Set,V=(H)=>{for(let q of H)if(U(q))O.add(`(literal ${iJ(q)})`)};for(let H of X)if(H.glob){let q=M5(H.path);if(!(G.length>0||W.some((L)=>q===L||R9({path:q,glob:!1},L)||R9({path:L,glob:!1},q))))continue;let K=new RegExp(u7(H.path)),A=[...Q,...Y].filter((L)=>U5(K,L)).map((L)=>cQ(L.path));if(O.add(b7(qQ(H.path),A)),q!=="/")V([q,...h7(q)])}else{if(!U(H.path))continue;O.add(b7(qQ(H.path),M(H.path))),V(h7(H.path))}return u0("deny",["file-write-unlink"],O,J)}function u0($,J,X,Q){if(X.size===0)return[];return[`(${$} ${J.join(" ")}`,...[...X].map((Y)=>` ${Y}`),` (with message "${Q}"))`]}function h7($){let J=[],X=Z0.dirname($);while(X!=="/"&&X!=="."){J.push(X);let Q=Z0.dirname(X);if(Q===X)break;X=Q}return J}function O5($,J){let X=new Set;for(let Q of $){let Y=XJ(Q);X.add(qQ(Y));let G;if(NJ(Y)){if(G=M5(Y),G==="/")continue;X.add(`(literal ${iJ(G)})`)}else G=Y;for(let W of h7(G))X.add(`(literal ${iJ(W)})`)}return u0("deny",["file-write-unlink","file-write-create"],X,J)}function qK($,J){if(!$)return["(allow file-read*)"];let X=[];X.push("(allow file-read*)");let Q=$.denies.some((M)=>M.path==="/"),Y=new Set($.denies.map((M)=>qQ(M.path)));X.push(...u0("deny",["file-read*"],Y,J));let G=new Set($.allows.map((M)=>cQ(M.path)));X.push(...u0("allow",["file-read*"],G,J));let W=VK($);if(X.push(...u0("deny",["file-read*"],new Set(W.filters),J)),Q||W.coversRoot)X.push('(allow file-read* (literal "/"))');if($.denies.length>0)X.push("(allow file-read-metadata"," (vnode-type DIRECTORY))");X.push(...O5($.denies.map((M)=>M.path),J));let U=new Set($.writeRoots.map((M)=>cQ(M.path)));return X.push(...u0("allow",["file-write-unlink","file-write-create"],U,J)),X}function KK($,J,X=!1){if(!$)return["(allow file-write*)"];let Q=[],Y=new Set;for(let U of $.allowOnly||[])Y.add(cQ(XJ(U)));Q.push(...u0("allow",["file-write*"],Y,J));let G=[...$.denyWithinAllow||[],...UK(X)],W=new Set;for(let U of G)W.add(qQ(XJ(U)));return Q.push(...u0("deny",["file-write*"],W,J)),Q.push(...O5(G,J)),Q}function zK({readConfig:$,writeConfig:J,httpProxyPort:X,socksProxyPort:Q,needsNetworkRestriction:Y,allowUnixSockets:G,allowAllUnixSockets:W,allowLocalBinding:U,allowMachLookup:M,allowPty:O,allowGitConfig:V=!1,enableWeakerNetworkIsolation:H=!1,allowAppleEvents:q=!1,logTag:F}){let K=["(version 1)",`(deny default (with message "${F}"))`,"",`; LogTag: ${F}`,"","; Essential permissions - based on Chrome sandbox policy","; Process permissions","(allow process-exec)","(allow process-fork)","(allow process-info* (target same-sandbox))","(allow signal (target same-sandbox))","(allow mach-priv-task-port (target same-sandbox))","","; User preferences","(allow user-preference-read)","","; Mach IPC - specific services only (no wildcard)","(allow mach-lookup",' (global-name "com.apple.audio.systemsoundserver")',' (global-name "com.apple.distributed_notifications@Uv3")',' (global-name "com.apple.FontObjectsServer")',' (global-name "com.apple.fonts")',' (global-name "com.apple.logd")',' (global-name "com.apple.lsd.mapdb")',' (global-name "com.apple.PowerManagement.control")',' (global-name "com.apple.system.logger")',' (global-name "com.apple.system.notification_center")',' (global-name "com.apple.system.opendirectoryd.libinfo")',' (global-name "com.apple.system.opendirectoryd.membership")',' (global-name "com.apple.bsd.dirhelper")',' (global-name "com.apple.securityd.xpc")',' (global-name "com.apple.coreservices.launchservicesd")',")","",...H?["; trustd.agent - needed for Go TLS certificate verification (weaker network isolation)",'(allow mach-lookup (global-name "com.apple.trustd.agent"))']:[],...q?["; Apple Events - opt-in; needed for open/osascript to talk to other apps (appleeventsd)","(allow appleevent-send)",'(allow mach-lookup (global-name "com.apple.coreservices.appleevents"))',"; Launch Services open requests need the lsopen operation plus, on","; macOS 14/15, coreservicesd and the quarantine resolver - without","; these open fails with -10822 kLSServerCommunicationErr or -54","(allow lsopen)",'(allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))','(allow mach-lookup (global-name "com.apple.coreservices.quarantine-resolver"))']:[],...M&&M.length>0?["; User-specified XPC/Mach services",...M.map((L)=>L.endsWith("*")?`(allow mach-lookup (global-name-prefix ${iJ(L.slice(0,-1))}))`:`(allow mach-lookup (global-name ${iJ(L)}))`)]:[],"","; POSIX IPC - shared memory","(allow ipc-posix-shm)","","; POSIX IPC - semaphores for Python multiprocessing","(allow ipc-posix-sem)","","; IOKit - specific operations only","(allow iokit-open",' (iokit-registry-entry-class "IOSurfaceRootUserClient")',' (iokit-registry-entry-class "RootDomainUserClient")',' (iokit-user-client-class "IOSurfaceSendRight")',")","","; IOKit properties","(allow iokit-get-properties)","","; Specific safe system-sockets, doesn't allow network access","(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))","","; sysctl - specific sysctls only","(allow sysctl-read",' (sysctl-name "hw.activecpu")',' (sysctl-name "hw.busfrequency_compat")',' (sysctl-name "hw.byteorder")',' (sysctl-name "hw.cacheconfig")',' (sysctl-name "hw.cachelinesize_compat")',' (sysctl-name "hw.cpufamily")',' (sysctl-name "hw.cpufrequency")',' (sysctl-name "hw.cpufrequency_compat")',' (sysctl-name "hw.cputype")',' (sysctl-name "hw.l1dcachesize_compat")',' (sysctl-name "hw.l1icachesize_compat")',' (sysctl-name "hw.l2cachesize_compat")',' (sysctl-name "hw.l3cachesize_compat")',' (sysctl-name "hw.logicalcpu")',' (sysctl-name "hw.logicalcpu_max")',' (sysctl-name "hw.machine")',' (sysctl-name "hw.memsize")',' (sysctl-name "hw.ncpu")',' (sysctl-name "hw.nperflevels")',' (sysctl-name "hw.packages")',' (sysctl-name "hw.pagesize_compat")',' (sysctl-name "hw.pagesize")',' (sysctl-name "hw.physicalcpu")',' (sysctl-name "hw.physicalcpu_max")',' (sysctl-name "hw.tbfrequency_compat")',' (sysctl-name "hw.vectorunit")',' (sysctl-name "kern.argmax")',' (sysctl-name "kern.bootargs")',' (sysctl-name "kern.hostname")',' (sysctl-name "kern.maxfiles")',' (sysctl-name "kern.maxfilesperproc")',' (sysctl-name "kern.maxproc")',' (sysctl-name "kern.ngroups")',' (sysctl-name "kern.osproductversion")',' (sysctl-name "kern.osrelease")',' (sysctl-name "kern.ostype")',' (sysctl-name "kern.osvariant_status")',' (sysctl-name "kern.osversion")',' (sysctl-name "kern.secure_kernel")',' (sysctl-name "kern.tcsm_available")',' (sysctl-name "kern.tcsm_enable")',' (sysctl-name "kern.usrstack64")',' (sysctl-name "kern.version")',' (sysctl-name "kern.willshutdown")',' (sysctl-name "machdep.cpu.brand_string")',' (sysctl-name "machdep.ptrauth_enabled")',' (sysctl-name "security.mac.lockdown_mode_state")',' (sysctl-name "sysctl.proc_cputype")',' (sysctl-name "vm.loadavg")',' (sysctl-name-prefix "hw.optional.arm")',' (sysctl-name-prefix "hw.optional.arm.")',' (sysctl-name-prefix "hw.optional.armv8_")',' (sysctl-name-prefix "hw.perflevel")',' (sysctl-name-prefix "kern.proc.all")',' (sysctl-name-prefix "kern.proc.pgrp.")',' (sysctl-name-prefix "kern.proc.pid.")',' (sysctl-name-prefix "machdep.cpu.")',' (sysctl-name-prefix "net.routetable.")',")","","; V8 thread calculations","(allow sysctl-write",' (sysctl-name "kern.tcsm_enable")',")","","; Distributed notifications","(allow distributed-notification-post)","","; Specific mach-lookup permissions for security operations",'(allow mach-lookup (global-name "com.apple.SecurityServer"))',"","; File I/O on device files",'(allow file-ioctl (literal "/dev/null"))','(allow file-ioctl (literal "/dev/zero"))','(allow file-ioctl (literal "/dev/random"))','(allow file-ioctl (literal "/dev/urandom"))','(allow file-ioctl (literal "/dev/dtracehelper"))','(allow file-ioctl (literal "/dev/tty"))',"","(allow file-ioctl file-read-data file-write-data"," (require-all",' (literal "/dev/null")'," (vnode-type CHARACTER-DEVICE)"," )",")",""];if(K.push("; Network"),!Y)K.push("(allow network*)");else{if(U)K.push('(allow network-bind (local ip "*:*"))'),K.push('(allow network-inbound (local ip "*:*"))'),K.push('(allow network-outbound (remote ip "localhost:*"))');if(W)K.push("(allow system-socket (socket-domain AF_UNIX))"),K.push('(allow network-bind (local unix-socket (path-regex #"^/")))'),K.push('(allow network-outbound (remote unix-socket (path-regex #"^/")))');else if(G&&G.length>0){K.push("(allow system-socket (socket-domain AF_UNIX))");for(let L of G){let R=XJ(L);K.push(`(allow network-bind (local unix-socket (subpath ${iJ(R)})))`),K.push(`(allow network-outbound (remote unix-socket (subpath ${iJ(R)})))`)}}if(X!==void 0)K.push(`(allow network-bind (local ip "localhost:${X}"))`),K.push(`(allow network-inbound (local ip "localhost:${X}"))`),K.push(`(allow network-outbound (remote ip "localhost:${X}"))`);if(Q!==void 0&&Q!==X)K.push(`(allow network-bind (local ip "localhost:${Q}"))`),K.push(`(allow network-inbound (local ip "localhost:${Q}"))`),K.push(`(allow network-outbound (remote ip "localhost:${Q}"))`)}K.push("");let A=$?OK($,J?.allowOnly):void 0;if(K.push("; File read"),K.push(...qK(A,F)),K.push(""),K.push("; File write"),K.push(...KK(J,F,V)),A){let L=HK(A,F);if(L.length>0)K.push(""),K.push("; File read: keep read-denied paths inside write roots in place"),K.push(...L)}if(O)K.push(""),K.push("; Pseudo-terminal (pty) support"),K.push("(allow pseudo-tty)"),K.push("(allow file-ioctl"),K.push(' (literal "/dev/ptmx")'),K.push(' (regex #"^/dev/ttys")'),K.push(")"),K.push("(allow file-read* file-write*"),K.push(' (literal "/dev/ptmx")'),K.push(' (regex #"^/dev/ttys")'),K.push(")");return K.join(`
67
+ `)}function iJ($){return JSON.stringify($)}function V5($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpProxyPort:Y,socksProxyPort:G,proxyAuthToken:W,caCertPath:U,allowUnixSockets:M,allowAllUnixSockets:O,allowLocalBinding:V,allowMachLookup:H,readConfig:q,writeConfig:F,unsetEnvVars:K,setEnvVars:A,maskedFileBinds:L,allowPty:R,allowGitConfig:I=!1,gitSafeDirectories:j,enableWeakerNetworkIsolation:C=!1,allowAppleEvents:w=!1,binShell:P}=$,l=q;if(L&&L.length>0)Z("[Sandbox macOS] file mask degrades to deny on macOS until the interposer lands"),l={denyOnly:[...q?.denyOnly??[],...L.map((O$)=>O$.realPath)],allowWithinDeny:q?.allowWithinDeny};let e=l&&l.denyOnly.length>0,y=F!==void 0,n=K!==void 0&&K.length>0||A!==void 0&&Object.keys(A).length>0,Y$=(j?.length??0)>0;if(!Q&&!e&&!y&&!n&&!Y$)return J;let L$=X??J,j$=MK(L$),QJ=zK({readConfig:l,writeConfig:F,httpProxyPort:Y,socksProxyPort:G,needsNetworkRestriction:Q,allowUnixSockets:M,allowAllUnixSockets:O,allowLocalBinding:V,allowMachLookup:H,allowPty:R,allowGitConfig:I,enableWeakerNetworkIsolation:C,allowAppleEvents:w,logTag:j$}),S$=ZQ(Y,G,U,W,F===void 0,PJ(L$));if(V&&Q){let P$=(K??[]).includes("JAVA_TOOL_OPTIONS")?"":process.env.JAVA_TOOL_OPTIONS??"",G$=P$.includes("-Djava.net.preferIPv4Stack=true")?P$:[P$,"-Djava.net.preferIPv4Stack=true"].filter(Boolean).join(" ");S$.push(`JAVA_TOOL_OPTIONS=${G$}`)}if(j&&j.length>0){let O$=KY({safeDirs:j,unsetEnvVars:K,setEnvVars:A});for(let[$$,P$]of Object.entries(O$))S$.push(`${$$}=${P$}`)}let h$=P||"bash",u=R0(h$);if(!u)throw Error(`Shell '${h$}' not found in PATH`);let J$=(K??[]).flatMap((O$)=>["-u",O$]),a=Object.entries(A??{}).map(([O$,$$])=>`${O$}=${$$}`),V$=CJ(["env",...J$,...a,...S$,"/usr/bin/sandbox-exec","-p",QJ,u,"-c",J]);return Z(`[Sandbox macOS] Applied restrictions - network: ${!!(Y||G)}, read: ${l?"allowAllExcept"in l?"allowAllExcept":"denyAllExcept":"none"}, write: ${F?"allowAllExcept"in F?"allowAllExcept":"denyAllExcept":"none"}`),V$}function H5($,J,X=(Q)=>Q){let Q=/CMD64_(.+?)_END/,Y=/Sandbox:\s+(.+)$/,G=WK("log",["stream","--predicate",`(eventMessage ENDSWITH "${G5}")`,"--style","compact"]);return G.stdout?.on("data",(W)=>{let U=W.toString().split(`
68
+ `),M=U.find((K)=>K.includes("Sandbox:")&&K.includes("deny")),O=U.find((K)=>K.startsWith("CMD64_"));if(!M)return;let V=M.match(Y);if(!V?.[1])return;let H=V[1],q,F;if(O){if(F=O.match(Q)?.[1],F)try{q=X(t0(F))}catch{}}if(H.includes("mDNSResponder")||H.includes("mach-lookup com.apple.diagnosticd")||H.includes("mach-lookup com.apple.analyticsd"))return;if(dQ(H,q,J))return;$({line:H,command:q,encodedCommand:F,timestamp:new Date})}),G.stderr?.on("data",(W)=>{Z(`[Sandbox Monitor] Log stream stderr: ${W.toString()}`)}),G.on("error",(W)=>{Z(`[Sandbox Monitor] Failed to start log stream: ${W.message}`)}),G.on("exit",(W)=>{Z(`[Sandbox Monitor] Log stream exited with code: ${W}`)}),()=>{Z("[Sandbox Monitor] Stopping log monitor"),G.kill("SIGTERM")}}import{randomBytes as EK}from"crypto";import{chmodSync as q5,chownSync as FK,mkdtempSync as NK,rmSync as LK}from"fs";import{createServer as AK}from"net";import{tmpdir as RK}from"os";import{join as K5,posix as DK}from"path";import{createInterface as ZK}from"readline";function z5($,J){let{allowWritePaths:X,denyWritePaths:Q,ignoreViolations:Y,resolveCommandText:G=(j)=>j,consumerUid:W,consumerGid:U}=J,M=NK(K5(RK(),"srt-obs-")),O=K5(M,`s${EK(4).toString("hex")}.sock`),V=(j,C)=>j===C||j.startsWith(C.endsWith("/")?C:C+"/"),H=(j)=>{let C=DK.normalize(j);if(Q.some((w)=>V(C,w)))return!0;return!X.some((w)=>V(C,w))},q=(j,C)=>{if(j.observe_init_error){Z(`[Sandbox Linux Monitor] observe filter not installed: ${j.observe_init_error}`);return}if(typeof j.path!=="string")return;if(!j.path.startsWith("/"))return;if(!H(j.path))return;let w;if(C)try{w=G(t0(C))}catch{}if(dQ(j.path,w,Y))return;let P={line:`deny ${j.syscall??"syscall"} ${j.path}`,command:w,encodedCommand:C,timestamp:new Date};$(P)},F,K=new Promise((j)=>{F=j}),A=O,L=AK((j)=>{let C,w=ZK({input:j});w.on("line",(P)=>{if(!P)return;let l;try{l=JSON.parse(P)}catch{return}if(l.encodedCommand&&C===void 0)C=l.encodedCommand;q(l,C??l.encodedCommand)}),j.on("error",()=>w.close()),j.on("close",()=>w.close())});L.on("error",(j)=>{Z(`[Sandbox Linux Monitor] listen failed: ${j.message} - violation monitoring disabled`,{level:"warn"}),A=void 0,F()}),L.listen(O,()=>{if(W!==void 0)q5(M,457),FK(O,W,U??W),q5(O,384);F()});let R=new Set;return L.on("connection",(j)=>{R.add(j),j.on("close",()=>R.delete(j))}),{get observeSocketPath(){return A},ready:K,stop:()=>{Z("[Sandbox Linux Monitor] stopping");for(let j of R)j.destroy();L.close();try{LK(M,{recursive:!0,force:!0})}catch{}}}}import*as JJ from"fs";import*as N5 from"net";import*as $J from"path";import{spawn as BK,spawnSync as jK}from"child_process";import{once as TK}from"events";import{fileURLToPath as SK}from"url";class A$ extends Error{code;subcommand;constructor($,J,X){super(J);this.name="WindowsSandboxError",this.code=$,this.subcommand=X}}var D9=[60080,60089],E5=["-NoProfile","-Command"];function Z9($){let J=process.env.SystemRoot??"C:\\Windows",X={exe:$J.win32.join(J,"System32","cmd.exe"),args:["/d","/s","/c"]};if($===void 0||$===null)return X;if(typeof $==="object"){if(!$J.win32.isAbsolute($.exe))throw new A$("bin_shell_invalid",`binShell.exe must be an absolute path (got ${JSON.stringify($.exe)})`);if(!Array.isArray($.args))throw new A$("bin_shell_invalid",`binShell.args must be an array (got ${JSON.stringify($.args)})`);return $}let Q=$J.win32.basename($),Y=Q.toLowerCase(),G=$J.win32.isAbsolute($);if(!G&&$!==Q)throw new A$("bin_shell_invalid",`binShell string must be a bare token or an absolute path (got ${JSON.stringify($)})`);switch(Y){case"bash":case"bash.exe":case"sh":case"sh.exe":if(!G)throw new A$("bin_shell_invalid",`binShell bash path must be absolute (got ${JSON.stringify($)}); pass the resolved Git Bash install path`);return{exe:$,args:["-c"]};case"pwsh":case"pwsh.exe":return{exe:G?$:"pwsh.exe",args:E5};case"powershell":case"powershell.exe":return{exe:G?$:$J.win32.join(J,"System32","WindowsPowerShell","v1.0","powershell.exe"),args:E5};case"cmd":case"cmd.exe":return G?{exe:$,args:X.args}:X;default:throw new A$("bin_shell_invalid",`unrecognised binShell ${JSON.stringify($)}: expected 'cmd' | 'powershell' | 'pwsh' or an absolute path to bash.exe/sh.exe/pwsh.exe/powershell.exe`)}}function L5(){let $=$J.dirname(SK(import.meta.url));return $J.resolve($,"..","..")}var A5={x64:"x64",arm64:"arm64"},IK=$J.join(L5(),"vendor","srt-win",A5[process.arch]??process.arch,"srt-win.exe");function CK(){let $=L5(),J=A5[process.arch],X=[];if(J)X.push($J.join($,"vendor","srt-win",J,"srt-win.exe"));X.push($J.join($,"vendor","srt-win-src","target","release","srt-win.exe"));for(let Q of X)if(JJ.existsSync(Q))return Q;throw new A$("srt_win_not_found",`srt-win.exe not found. Set windows.srtWin.path or build with \`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. Looked in: ${X.join(", ")}`)}var R5="--srt-win";function wJ($){if($?.path===void 0)throw new A$("srt_win_not_found","no srt-win path configured; set windows.srtWin.path (e.g. to the exported VENDORED_SRT_WIN_EXE constant for the packaged binary)");if(!JJ.existsSync($.path))throw new A$("srt_win_not_found",`windows.srtWin.path is set to '${$.path}' but the file does not exist`);return{exe:$.path,prependArgs:[R5]}}function g0($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??wJ(),Y=jK(X,[...Q,...$],{encoding:"utf8",windowsHide:!0,timeout:J.timeoutMs??15000,...J.stdin!==void 0?{input:J.stdin}:{}});if(Y.error){if(Y.error.code==="ETIMEDOUT")throw new A$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${J.timeoutMs??15000}ms`+(Y.signal?` (killed by ${Y.signal})`:""),$[0]);throw new A$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${Y.error.message}`,$[0])}return{status:Y.status,signal:Y.signal,stdout:(Y.stdout??"").trim(),stderr:(Y.stderr??"").trim()}}function m7($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??wJ(),Y=J.timeoutMs??15000;return new Promise((G,W)=>{let U=BK(X,[...Q,...$],{windowsHide:!0}),M=!1,O=Y>0?setTimeout(()=>{M=!0,U.kill()},Y):void 0,V="",H="";U.stdout?.setEncoding("utf8").on("data",(q)=>V+=q),U.stderr?.setEncoding("utf8").on("data",(q)=>H+=q),U.stdin?.on("error",()=>{}).end(J.stdin),U.once("error",(q)=>{clearTimeout(O),W(new A$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${q.message}`,$[0]))}),U.once("close",(q,F)=>{if(clearTimeout(O),M){W(new A$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${Y}ms`+(F?` (killed by ${F})`:""),$[0]));return}G({status:q,signal:F,stdout:V.trim(),stderr:H.trim()})})})}function D5($,J){if(J.status!==0)throw new A$("srt_win_nonzero",`srt-win ${$.join(" ")} exited ${J.status}: ${J.stderr||J.stdout}`,$[0]);try{return JSON.parse(J.stdout)}catch(X){throw new A$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(J.stdout)}: ${X.message}`,$[0])}}function l7($,J){return D5($,g0($,J))}async function p7($,J){return D5($,await m7($,J))}function Z5($,J){let X=g0($,J),Q;try{Q=JSON.parse(X.stdout)}catch(Y){throw new A$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(X.stdout)}: ${Y.message}`,$[0])}return{ok:X.status===0,json:Q,stderr:X.stderr}}function B5($){let J=["wfp","status"];if($)J.push("--sublayer-guid",$);return J}function B9($){return{state:$.state,filters:$.filters,...$.port_range&&{portRange:$.port_range},...$.user_sid&&{userSid:$.user_sid},...$.hint&&{hint:$.hint}}}function j9($){return{provisioned:$.user.exists,...$.user.sid&&{sid:$.user.sid},groupExists:$.user.group_exists,...$.user.group_sid&&{groupSid:$.user.group_sid},inBuiltinUsers:$.user.in_builtin_users,inSandboxGroup:$.user.in_sandbox_group,hiddenFromLogon:$.user.hidden_from_logon,credPresent:$.cred_present,...typeof $.marker_version==="number"&&{markerVersion:$.marker_version},realUserSid:$.real_user_sid,...$.ca_cert_thumb&&{caCertThumb:$.ca_cert_thumb},...$.ca_cert_pem&&{caCertPem:$.ca_cert_pem}}}function j5($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=l7(J,{srtWin:$.srtWin});return{user:j9(X.user),wfp:B9(X.wfp)}}async function T5($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=await p7(J,{srtWin:$.srtWin});return{user:j9(X.user),wfp:B9(X.wfp)}}function S5($={}){return B9(l7(B5($.sublayerGuid),{srtWin:$.srtWin}))}async function I5($={}){return B9(await p7(B5($.sublayerGuid),{srtWin:$.srtWin}))}async function d7($={}){let J=$.target,X;if(!J){let[Q,Y]=$.proxyPortRange??D9;for(let G=0;G<5;G++){let W=N5.createServer();W.listen(0,"127.0.0.1"),await TK(W,"listening");let U=W.address().port;if(U<Q||U>Y){X=W,J=`127.0.0.1:${U}`;break}W.close()}if(!J)throw new A$("wfp_verify_bind_failed",`verifyWindowsWfpEgress: could not bind a loopback listener outside the WFP permit range [${Q},${Y}] in 5 attempts`)}try{let Q=g0(["wfp","verify","--target",J],{timeoutMs:30000,srtWin:$.srtWin});Z(`[Sandbox Windows] wfp verify exit=${Q.status}: ${Q.stderr||Q.stdout}`);let Y;try{Y=JSON.parse(Q.stdout)}catch{throw new A$("wfp_verify_unparseable","WFP egress fence could not be verified \u2014 `srt-win wfp "+`verify\` exited ${Q.status}`+(Q.signal?` (signal ${Q.signal})`:"")+` with unparseable output ${JSON.stringify(Q.stdout)} (stderr: ${JSON.stringify(Q.stderr)})`)}if(Q.status===3)throw new A$("wfp_fence_inactive","WFP egress fence is not active \u2014 direct outbound from the "+`sandbox user to ${Y.target} succeeded. Re-run \`srt-win install\` (one UAC prompt). (${Q.stderr})`);if(Q.status!==0)throw new A$("wfp_verify_inconclusive","WFP egress fence could not be verified \u2014 probe to "+`${Y.target} was '${Y.egress_probe}' (exit ${Q.status}). The fence may be absent. Re-run \`srt-win install\`. (${Q.stderr})`);return{target:Y.target,stderr:Q.stderr}}finally{X?.close()}}function c7($={}){return j9(l7(["user","status"],{srtWin:$.srtWin}))}async function dX($={}){return j9(await p7(["user","status"],{srtWin:$.srtWin}))}function n7($,J={}){let X=$??c7(J);if(!X.caCertThumb||!X.caCertPem)return null;return{pem:X.caCertPem,thumb:X.caCertThumb}}function wK($,J={}){let X=g0(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});w5($,X)}async function C5($,J={}){let X=await m7(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});w5($,X)}function w5($,J){if(Z(`[Sandbox Windows] user trust-ca exit=${J.status}: ${J.stderr||J.stdout}`),J.status!==0)throw new A$("trust_ca_failed",`srt-win user trust-ca '${$}' failed (exit ${J.status}): ${J.stderr||J.stdout}`)}function P5(){let $=process.env.ProgramData;if(!$)throw Error("ProgramData is not set");return $J.win32.join($,"sandbox-runtime")}async function i7($={}){let J=$.status??await dX({srtWin:$.srtWin});if(!J.provisioned||!J.credPresent)throw Error(`ensurePersistentWindowsCa: sandbox user is not provisioned (user=${J.provisioned}, cred=${J.credPresent}). Run \`npx sandbox-runtime windows-install\` first.`);let X=$.dir?void 0:P5();if(X&&!JJ.existsSync(X))throw Error(`ensurePersistentWindowsCa: state directory ${X} does not exist. Run \`npx sandbox-runtime windows-install\` first.`);let Q=$.dir??$J.win32.join(X,"ca"),Y=$J.join(Q,"ca.json"),G=$J.join(Q,"cert.pem"),W=$J.join(Q,"key.pem"),U=($.regenerateWithinDays??30)*24*60*60*1000,M=(L,R)=>{let I=`${L}.tmp.${process.pid}`;JJ.writeFileSync(I,R),JJ.renameSync(I,L)},O=async(L,R,I,j)=>{M(G,L),M(W,R);let C=j||J.caCertThumb!==I;if(C){let w=$J.join(Q,`.trust.${process.pid}.${Date.now()}.pem`);JJ.writeFileSync(w,L);try{await C5(w,{srtWin:$.srtWin})}finally{JJ.rmSync(w,{force:!0})}}return Z(`[Sandbox Windows] persistent CA ${j?"generated":"reused"} (thumb=${I}${C&&!j?", trust reconciled":""})`),{certPem:L,keyPem:R,certPath:G,keyPath:W,thumbprint:I,generated:j,trusted:C}},V=()=>{let L;try{L=JSON.parse(JJ.readFileSync(Y,"utf8"))}catch(I){Z(`[Sandbox Windows] persistent CA ca.json unreadable (${I.message})`,{level:"warn"});return}if(typeof L.certPem!=="string"||typeof L.keyPem!=="string")return;let R=xX(L.certPem,L.keyPem);if(!R.ok){Z(`[Sandbox Windows] persistent CA invalid (${R.reason})`,{level:"warn"});return}return{certPem:L.certPem,keyPem:L.keyPem,thumbprint:R.thumbprint,notAfter:R.notAfter}};if(!$.force){let L=V();if(L&&L.notAfter.getTime()-Date.now()>U)return await O(L.certPem,L.keyPem,L.thumbprint,!1);if(L)Z(`[Sandbox Windows] persistent CA expiring ${L.notAfter.toISOString()}; regenerating`,{level:"warn"})}JJ.mkdirSync(Q,{recursive:!0});try{let L=Date.now()-300000;for(let R of JJ.readdirSync(Q)){if(!R.includes(".tmp.")&&!R.startsWith(".trust."))continue;let I=$J.join(Q,R);if(JJ.statSync(I).mtimeMs<L)JJ.rmSync(I,{force:!0})}}catch{}let H=aY({cn:"sandbox-runtime persistent CA"});M(Y,JSON.stringify({certPem:H.certPem,keyPem:H.keyPem}));let q=V(),{certPem:F,keyPem:K,thumbprint:A}=q??{certPem:H.certPem,keyPem:H.keyPem,thumbprint:gQ(H.certPem)};return await O(F,K,A,!0)}function o7($){return $.timeoutMs??120000}function _5($){let J=["install"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.proxyPortRange)J.push("--proxy-port-range",`${$.proxyPortRange[0]}-${$.proxyPortRange[1]}`);if($.sandboxUser)J.push("--sandbox-user",$.sandboxUser);if($.force)J.push("--force");return J}function x5($){if($ instanceof A$&&$.code==="srt_win_timeout")throw new A$("install_timeout","srt-win install timed out \u2014 the UAC prompt may still be open. "+`Re-run when ready to grant elevation. (${$.message})`);throw $}function v5($){if(Z(`[Sandbox Windows] install exit=${$.status}: ${$.stderr||$.stdout}`),$.status===0||$.status===10)return;let J=$.stderr||$.stdout;switch($.status){case 12:throw new A$("install_wfp_failed",`srt-win install: WFP filter install failed: ${J}`);case 14:throw new A$("install_user_failed",`srt-win install: sandbox user provisioning failed: ${J}`);case 13:throw new A$("install_config_conflict",`srt-win install: filters already exist under this sublayer with a different port range or sandbox-user name. Pass {force: true} to replace, or pick a different sublayerGuid. Output: ${J}`);case 17:throw new A$("install_ambient_failed",`srt-win install: ambient write-deny stamping failed (stock world-writable system dirs could not be deny-stamped for the sandbox user): ${J}`);default:throw new A$("install_failed",`srt-win install failed (exit ${$.status}): ${J}`)}}function PK($={}){let J=$.srtWin??wJ(),X;try{X=g0(_5($),{timeoutMs:o7($),srtWin:J})}catch(Y){x5(Y)}v5(X);let Q=j5({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}async function _K($={}){let J=$.srtWin??wJ(),X;try{X=await m7(_5($),{timeoutMs:o7($),srtWin:J})}catch(Y){x5(Y)}v5(X);let Q=await T5({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}function xK($={}){let J=["uninstall"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.keepUser)J.push("--keep-user");let X=g0(J,{timeoutMs:o7($),srtWin:$.srtWin});if(Z(`[Sandbox Windows] uninstall exit=${X.status}: ${X.stderr||X.stdout}`),X.status===10)return{cancelled:!0};if(X.status!==0)throw new A$("uninstall_failed",`srt-win uninstall failed (exit ${X.status}): ${X.stderr||X.stdout}`);return{}}function T9($,J){let X=new Set;for(let Q of $){let Y=XJ(Q),G=HX(Y);if(qX(Y)&&!G){X.add(Y);continue}let W=G?e0(Y,{caseInsensitive:!0}):[Y];for(let U of W){if(!JJ.statSync(U,{throwIfNoEntry:!1})){if(J?.mode==="deny"&&!G)X.add(/[\\/]$/.test(Q)&&!/[\\/]$/.test(U)?U+"\\":U);continue}X.add(U)}}return[...X]}function vK($){for(let J of $.split(/\r?\n/)){let X=J.trim();if(!X.startsWith("{")||!X.includes('"code"'))continue;try{let Q=JSON.parse(X);if(Q.code==="mapped_drive_cwd")return Object.assign(new A$("mapped_drive_cwd",Q.message??"mapped/network-drive working directory","exec"),{drive:Q.drive})}catch{}}return}function a7($){let J=$.holderPid??process.pid,X=JSON.stringify({denyRead:$.denyRead,denyWrite:$.denyWrite}),Q=g0(["acl","stamp","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl stamp exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new A$("acl_stamp_failed",`srt-win acl stamp exited ${Q.status} `+(Q.status===2?"(partial \u2014 some inputs skipped)":"(failed)")+`: ${Q.stderr||Q.stdout}`)}function S9($){let J=$.holderPid??process.pid;try{let X=Z5(["acl","restore","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl restore exited non-zero (per-path outcomes preserved): ${X.stderr}`,{level:"error"});return Array.isArray(X.json)?X.json:[...X.json.paths??[],...X.json.parents??[]]}catch(X){Z(`[Sandbox Windows] acl restore: ${X.message}`,{level:"error"});return}}function s7($){let J=$.holderPid??process.pid,X=JSON.stringify({read:$.read,write:$.write}),Q=g0(["acl","grant","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl grant exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new A$("acl_grant_failed",`srt-win acl grant exited ${Q.status}: ${Q.stderr||Q.stdout}`)}function I9($){let J=$.holderPid??process.pid;try{let X=Z5(["acl","revoke","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl revoke exited non-zero: ${X.stderr}`,{level:"error"});return X.json}catch(X){Z(`[Sandbox Windows] acl revoke: ${X.message}`,{level:"error"});return}}function k5($){let{exe:J,prependArgs:X}=$.srtWin??wJ(),Q=kK(ZQ($.httpProxyPort,$.socksProxyPort,$.caCertPath?.replace(/\\/g,"/"),$.proxyAuthToken,void 0,PJ($.commandId??$.command)));delete Q.TMPDIR,delete Q.NO_PROXY,delete Q.no_proxy;let Y=KX({safeDirs:[$.cwd??process.cwd(),...$.allowWrite??[],...$.gitSafeDirectories??[]],schannelCa:$.caCertPath!==void 0,baseEnv:$.setEnvVars}),G=[J,...X,"exec"];if($.quiet!==!1)G.push("--quiet");for(let V of $.denyRead??[])G.push("--deny-read",V);for(let V of $.denyWrite??[])G.push("--deny-write",V);let W={PATH:process.env.PATH,PATHEXT:process.env.PATHEXT,...$.setEnvVars??{},...Q,...Y};for(let[V,H]of Object.entries(W))if(H!==void 0)G.push("--env",`${V}=${H}`);G.push("--");let U=$.binShell??Z9(void 0);G.push(U.exe,...U.args,$.command);let M=G.reduce((V,H)=>V+H.length+3,0);if(M>30000)throw new A$("argv_too_long",`Windows sandbox argv is ~${M} chars (CreateProcessW limit is 32 767).`);let O={...process.env,...Q};return{argv:G,env:O}}function kK($){let J={};for(let X of $){let Q=X.indexOf("=");if(Q===-1)continue;J[X.slice(0,Q)]=X.slice(Q+1)}return J}function g7($){let J=$?` --sublayer-guid ${$}`:"";return`Windows sandbox needs a one-time install (one UAC prompt):
67
69
  npx sandbox-runtime windows-install
68
70
  `+" \u2014 or call installWindowsSandbox(), or run "+`\`srt-win.exe install${J}\` directly.
69
- No logout is needed: the WFP filter keys on the dedicated \`srt-sandbox\` user's SID, so your network is unaffected.`}function E5($){try{return{status:"fulfilled",value:$()}}catch(J){return{status:"rejected",reason:J}}}function k5($,J,X){let Q=[],Y=[];if(J.status==="rejected")return Q.push(`srt-win user status failed: ${J.reason.message}`),{errors:Q,warnings:Y};let G=J.value;if(!G.provisioned||!G.credPresent)Q.push(`Sandbox user is not provisioned (user=${G.provisioned}, cred=${G.credPresent}). `+u7($));let W=X();if(W.status==="rejected")return Q.push(`srt-win wfp status failed: ${W.reason.message}`),{errors:Q,warnings:Y};let U=W.value;if(U.state==="cannot-read")Z(`[Sandbox Windows] wfp status cannot-read (non-elevated): ${U.hint}`);else if(U.state!=="installed"){if(G.provisioned&&G.credPresent)Q.push(`WFP filters not installed under sublayer ${$??"(default)"}. `+u7($))}else if(U.portRange)Z(`[Sandbox Windows] WFP installed: ${U.filters} filters, proxy port range ${U.portRange[0]}-${U.portRange[1]}`);return{errors:Q,warnings:Y}}function f5($={}){let J;try{J=$.srtWin??wJ()}catch(X){return{errors:[X.message],warnings:[]}}return Z(`[Sandbox Windows] using srt-win at ${J.exe}`),k5($.sublayerGuid,E5(()=>d7({srtWin:J})),()=>E5(()=>T5({sublayerGuid:$.sublayerGuid,srtWin:J})))}async function s7($={}){let J;try{J=$.srtWin??wJ()}catch(Y){return{errors:[Y.message],warnings:[]}}Z(`[Sandbox Windows] using srt-win at ${J.exe}`);let[X,Q]=await Promise.allSettled([dX({srtWin:J}),S5({sublayerGuid:$.sublayerGuid,srtWin:J})]);return k5($.sublayerGuid,X,()=>Q)}import{isIP as PK}from"net";function cX($){if($.startsWith("[")){let Q=$.indexOf("]");if(Q===-1)return{hostPattern:$,port:void 0};let Y=$.slice(1,Q),G=jJ(Y)??Y,W=$.slice(Q+1);if(W==="")return{hostPattern:G,port:void 0};let U=y5(W.startsWith(":")?W.slice(1):"");return U===void 0?{hostPattern:$,port:void 0}:{hostPattern:G,port:U}}let J=$.lastIndexOf(":");if(J===-1)return{hostPattern:$,port:void 0};if($.indexOf(":")!==J)return{hostPattern:jJ($)??$,port:void 0};let X=y5($.slice(J+1));if(X===void 0)return{hostPattern:$,port:void 0};return{hostPattern:$.slice(0,J),port:X}}function y5($){if(!/^[1-9][0-9]{0,4}$/.test($))return;let J=Number($);return J>65535?void 0:J}function nX($){return cX($).hostPattern}function B0($,J){let X=$.toLowerCase();if(J==="*")return!0;if(J.startsWith("*.")){if(PK(dJ(X)))return!1;let Q=J.substring(2).toLowerCase();return X.endsWith("."+Q)}return X===J.toLowerCase()}function iX($,J,X){let{hostPattern:Q,port:Y}=cX(X);if(Y!==void 0&&Y!==J)return!1;return B0($,Q)}function I9($,J){let X=J.map(nX);if(!$.startsWith("*."))return X.some((Y)=>B0($,Y));let Q=$.slice(2).toLowerCase();return X.some((Y)=>{if(!Y.startsWith("*."))return!1;let G=Y.slice(2).toLowerCase();return Q===G||Q.endsWith("."+G)})}function b5($,J,X,Q){if(!mQ(J))return{verdict:"deny",reason:"malformed host"};let Y=jJ(J)??J;for(let G of $.deniedDomains)if(iX(Y,X,G))return{verdict:"deny",reason:$.deniedDomainReasons?.[G]??"host is on the deny list",rule:G};for(let G of $.allowedDomains)if(iX(Y,X,G))return{verdict:"allow",rule:G};if(!Q||$.strictAllowlist)return{verdict:"deny",reason:"host is not on the allow list"};return{verdict:"ask"}}import{EOL as r7}from"os";import{dirname as t7}from"path";var b,sX,rX,tX,uJ,m0,oX,h5=!1,C9,nQ,d0,u$,c0,iQ,l0,w9,u5=!1,eX,zQ=new L9,EQ=new z7,_9=new A7,P9=new L7;function xK(){if(h5)return;let $=()=>GG().catch((J)=>{Z(`Cleanup failed in registerCleanup ${J}`,{level:"error"})});process.once("exit",$),process.once("SIGINT",$),process.once("SIGTERM",$),h5=!0}var vK=1024,KQ=new Map;function c5($,J){let X=J?.commandId,Q=J?.commandText??$;if(X===void 0||X===Q)return;let Y=t0(PJ(X));KQ.delete(Y),KQ.set(Y,Q);while(KQ.size>vK){let G=KQ.keys().next().value;if(G===void 0)break;KQ.delete(G)}}function g5($){return KQ.get($)??$}function e7($,J){let X=J?(()=>{let Q=t0(J);return KQ.get(Q)??k7(Q)})():void 0;if(dQ($,X,b?.ignoreViolations))return;zQ.addViolation({line:$,encodedCommand:J,command:X,timestamp:new Date})}function kK($){try{let J=new URL($);return`${J.origin}${J.pathname}${J.search?"?\u2026":""}`}catch{let J=$.indexOf("?");return J===-1?$:`${$.slice(0,J)}?\u2026`}}async function m5($,J,X,Q){let Y=(W)=>{return e7(`deny network-outbound ${J}:${$} (${W})`,Q),!1};if(!b)return Z("No config available, denying network request"),Y("sandbox policy unavailable");let G=b5(b.network,J,$,X!==void 0);if(G.verdict==="allow")return Z(`Allowed by config rule: ${J}:${$}`),!0;if(G.verdict==="deny"){if(G.reason==="malformed host")Z(`Denying malformed host: ${JSON.stringify(J)}:${$}`,{level:"error"});else if(G.rule!==void 0)Z(`Denied by config rule: ${J}:${$}`);else Z(`No matching config rule, denying: ${J}:${$}`);return Y(G.reason)}Z(`No matching config rule, asking user: ${J}:${$}`);try{if(await X({host:J,port:$}))return Z(`User allowed: ${J}:${$}`),!0;return Z(`User denied: ${J}:${$}`),Y("user denied")}catch(W){return Z(`Error in permission callback: ${W}`,{level:"error"}),Y("permission prompt failed")}}function fK(){if(!b?.credentials)return;return($,J)=>{EQ.substituteInHeaders($,J,B0)}}function yK(){if(!b?.credentials)return;return($)=>EQ.sentinelsForHost($,B0)}function bK(){if(!b?.credentials)return;return($,J,X,Q)=>w4(_9,b?.credentials?.sigv4,B0)($,J,X,Q)}function hK($){if(!b?.network.mitmProxy)return;let{socketPath:J,domains:X}=b.network.mitmProxy,Q=jJ($)??$;for(let Y of X)if(B0(Q,Y))return Z(`Host ${$} matches MITM pattern ${Y}`),J;return}function uK($){let J=b?.network.tlsTerminate?.excludeDomains;if(!J?.length)return!0;let X=jJ($)??$;for(let Q of J){if(!B0(X,Q))continue;Z(`Host ${$} matches tlsTerminate.excludeDomains pattern ${Q}; skipping TLS termination`);let Y=EQ.namesInjectableAt(X,B0);if(Y.length>0)Z(`tlsTerminate.excludeDomains: masked credential(s) ${Y.join(", ")} are configured for injection at ${$}, but its connections are not terminated, so the upstream will receive the placeholder`,{level:"error"});return!1}return!0}async function gK($,J){let X=fK(),Q=yK();sX=G4({filter:(U,M,O,V)=>m5(U,M,$,V),getMitmSocketPath:hK,mitmCA:u$,shouldTerminateTLS:uK,filterRequest:b?.network.filterRequest,onFilterRequestDenied:({method:U,url:M,reason:O,encodedCommand:V})=>{e7(`deny http-request ${U} ${kK(M)} (${O})`,V)},mutateHeaders:X,mutateHeadersPlaintext:b?.credentials?.allowPlaintextInject?X:void 0,getBodySubstitutions:Q,getBodySubstitutionsPlaintext:b?.credentials?.allowPlaintextInject?Q:void 0,planSigv4:bK(),parentProxy:d0,proxyAuthToken:c0}),rX=z4({filter:(U,M,O)=>m5(U,M,$,O),parentProxy:d0,proxyAuthToken:c0,probeUnauthenticated:async(U,M)=>{if(!b)return{};let O=jJ(M)??M;for(let V of b.network.deniedDomains)if(iX(O,U,V)){let H=b.network.deniedDomainReasons?.[V]??"host is on the deny list";return e7(`deny network-outbound ${M}:${U} (${H})`,void 0),{deniedReason:H}}return{}}}),tX=N4({httpServer:sX,handleSocksConnection:(U)=>rX.handleConnection(U),httpBackendPortRange:J});let Y=tX,G=await Y.listenHttpBackend();await Y9(Y.server,(U)=>Y.server.listen(U,"127.0.0.1"),J,G!==void 0?new Set([G]):new Set);let W=Y.getPort();if(W===void 0)throw Error("Failed to get mux proxy server port");return Y.unref(),Z(`Mux proxy (HTTP+SOCKS) listening on localhost:${W}`),W}async function mK($,J,X=!1){if(m0){await m0;return}if(b=$,d0=X7($.network.parentProxy),d0)Z(`Parent proxy configured: http=${W7(d0.httpUrl)} https=${W7(d0.httpsUrl)}`);if($.network.tlsTerminate&&$.network.mitmProxy)throw Error("network.tlsTerminate and network.mitmProxy are mutually exclusive");let Q=$.network.tlsTerminate,Y=x$()==="windows"&&Q!==void 0&&!Q.caCertPath&&!Q.caKeyPath;if(u$=Q&&!Y?r8(Q):void 0,u$&&$.runAsHostUid!==void 0&&x$()==="linux"){if(p0.chmodSync(t7(u$.trustBundlePath),457),p0.chmodSync(u$.trustBundlePath,420),u$.ephemeral)p0.chmodSync(t7(u$.certPath),457),p0.chmodSync(u$.certPath,420)}let G=await o5();if(G.errors.length>0)throw Error(`Sandbox dependencies not available: ${G.errors.join(", ")}`);if(X&&x$()==="macos")C9=V5(zQ.addViolation.bind(zQ),b.ignoreViolations,g5),Z("Started macOS sandbox log monitor");if(X&&x$()==="linux")nQ=K5(zQ.addViolation.bind(zQ),{allowWritePaths:[...DQ($.runAsHostHome),...b.filesystem.allowWrite],denyWritePaths:b.filesystem.denyWrite,ignoreViolations:b.ignoreViolations,resolveCommandText:g5,consumerUid:$.runAsHostUid,consumerGid:$.runAsHostGid}),nQ.ready,Z("Started Linux seccomp violation monitor");if(xK(),x$()==="windows"){eX=wJ($.windows?.srtWin);let W=eX,U=await dX({srtWin:W});if(!U.provisioned||!U.credPresent)throw b=void 0,new L$("not_provisioned",`Windows sandbox user is not provisioned (user=${U.provisioned}, cred=${U.credPresent}). Run \`npx sandbox-runtime windows-install\` (one UAC prompt) to provision it.`);if(!u5){try{await p7({proxyPortRange:$.windows?.proxyPortRange,srtWin:W})}catch(M){throw b=void 0,M}u5=!0}if(Y&&Q)try{let M=await n7({status:U,srtWin:W});u$=r8({caCertPem:M.certPem,caKeyPem:M.keyPem,caCertPath:M.certPath,caKeyPath:M.keyPath,extraCaCertPaths:Q.extraCaCertPaths})}catch(M){throw b=void 0,M}if(Q&&u$&&!Y){let M=c7(U),O=gQ(u$.certPem);if(!M)throw b=void 0,new L$("trust_ca_not_installed",`tlsTerminate on Windows requires the sandbox to be installed with this CA (thumb=${O}): run \`srt-win user trust-ca ${u$.certPath}\`. Per-exec installs into the sandbox user's Root store are not supported.`);if(M.thumb!==O)throw b=void 0,new L$("trust_ca_thumbprint_mismatch",`tlsTerminate on Windows: the sandbox's installed CA (thumb=${M.thumb}) doesn't match this session's CA (thumb=${O}). Run \`srt-win user trust-ca ${u$.certPath}\` to update it.`)}try{let M=nK($);if(u$)M.grantRead.push(t7(u$.trustBundlePath));if(!U.sid)throw Error("sandbox user SID missing from `srt-win user status` (provisioned but in an inconsistent state)");let O=U.sid;if(l0=O,M.grantRead.length>0||M.grantWrite.length>0)a7({sandboxUserSid:O,read:M.grantRead,write:M.grantWrite,srtWin:W});if(M.denyRead.length>0||M.denyWrite.length>0)o7({sandboxUserSid:O,denyRead:M.denyRead,denyWrite:M.denyWrite,srtWin:W});if(M.grantRead.length>0||M.grantWrite.length>0||M.denyRead.length>0||M.denyWrite.length>0)iQ=M,Z(`[Sandbox Windows] fs applied: ${M.grantWrite.length} grantWrite, ${M.grantRead.length} grantRead, ${M.denyRead.length} denyRead, ${M.denyWrite.length} denyWrite`);w9=s5($)}catch(M){if(l0)S9({sandboxUserSid:l0,srtWin:W}),T9({sandboxUserSid:l0,srtWin:W});throw l0=void 0,b=void 0,M}}m0=(async()=>{try{let W=x$()==="windows"?b.windows?.proxyPortRange??R9:void 0;c0=b.network.httpProxyPort!==void 0?void 0:_K(16).toString("hex");let M=b.network.httpProxyPort===void 0||b.network.socksProxyPort===void 0?await gK(J,W):void 0,O=b.network.httpProxyPort??M,V=b.network.socksProxyPort??M;if(u$&&M!==void 0&&x$()==="windows")u$.crlUrl=`http://127.0.0.1:${M}${iY}`;if(b.network.httpProxyPort!==void 0)Z(`Using external HTTP proxy on port ${O}`);if(b.network.socksProxyPort!==void 0)Z(`Using external SOCKS proxy on port ${V}`);let H;if(x$()==="linux")H=await Q5(O,V,b.socatPath,b.runAsHostUid,b.runAsHostGid);let q={httpProxyPort:O,socksProxyPort:V,linuxBridge:H};return uJ=q,Z("Network infrastructure initialized"),q}catch(W){throw m0=void 0,uJ=void 0,GG().catch((U)=>{Z(`Cleanup failed in initializationPromise ${U}`,{level:"error"})}),W}})(),await m0}function n5(){let $=x$();if($==="linux")return m9()!=="1";return $==="macos"||$==="windows"}function lK(){return b!==void 0}function i5($){if(!n5())return{done:{errors:["Unsupported platform"],warnings:[]}};let J=[],X=[],Q=x$();if(Q==="linux"){let Y=$??b?.ripgrep??{command:"rg"};if(R0(Y.command)===null)J.push(`ripgrep (${Y.command}) not found`);let G=J5({seccompConfig:b?.seccomp,bwrapPath:b?.bwrapPath,socatPath:b?.socatPath});J.push(...G.errors),X.push(...G.warnings)}else if(Q==="windows"){let Y;try{Y=wJ(b?.windows?.srtWin)}catch(G){return J.push(G.message),{done:{errors:J,warnings:X}}}return{windows:{sublayerGuid:b?.windows?.sublayerGuid??b?.windows?.wfpSublayerGuid,srtWin:Y}}}return{done:{errors:J,warnings:X}}}function pK($){let J=i5($);if("done"in J)return J.done;return f5(J.windows)}async function o5($){let J=i5($);if("done"in J)return J.done;return s7(J.windows)}function JG($,J){if(!$)return{denyReadPaths:[],unsetEnvVars:[],setEnvVars:{},maskedFileBinds:[],maskedFileStoreDir:void 0};let X=x9($),Q=[...new Set((J??[]).map(nX))],Y=[];for(let V of $.envVars??[])if(V.mode==="deny")Y.push(V.name);let{setEnvVars:G,degradeToUnsetNames:W}=j4($.envVars??[],Q,EQ);Y.push(...W),C4($.envVars??[],$.awsPairs,Q,G,_9);let U=$.files??[],{binds:M,degradeToDenyPaths:O}=B4(U,Q,EQ,P9);return{denyReadPaths:[...new Set([...X,...O])],unsetEnvVars:[...new Set(Y)],setEnvVars:G,maskedFileBinds:M,maskedFileStoreDir:P9.dirPath}}function x9($){let J=$?.files??[];return[...new Set(J.filter((X)=>X.mode==="deny").map((X)=>X.path))]}function a5($,J){return[...new Set([...$,...J.denyReadPaths])]}function dK(){if(!b||b.filesystem.disabled)return{denyOnly:[],allowWithinDeny:[]};let $=a5(b.filesystem.denyRead,JG(b.credentials,b.network.allowedDomains)),J=[];for(let Q of $){let Y=E0(Q);if(x$()==="linux"&&NJ(Y)){let G=e0(Q);Z(`[Sandbox] Expanded glob pattern "${Q}" to ${G.length} paths on Linux`),J.push(...G)}else J.push(Y)}let X=[];for(let Q of b.filesystem.allowRead??[]){let Y=E0(Q);if(x$()==="linux"&&NJ(Y)){let G=e0(Q);Z(`[Sandbox] Expanded allowRead glob pattern "${Q}" to ${G.length} paths on Linux`),X.push(...G)}else X.push(Y)}return{denyOnly:J,allowWithinDeny:X}}function cK(){if(!b)return{allowOnly:DQ(),denyWithinAllow:[]};if(b.filesystem.disabled)return{allowOnly:["/"],denyWithinAllow:[]};let $=b.filesystem.allowWrite.map((Q)=>E0(Q)).filter((Q)=>{if(x$()==="linux"&&NJ(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0}),J=b.filesystem.denyWrite.map((Q)=>E0(Q)).filter((Q)=>{if(x$()==="linux"&&NJ(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0});return{allowOnly:[...DQ($G()),...$],denyWithinAllow:J}}function nK($){let J=$.filesystem;if(J?.disabled)return{grantRead:[],grantWrite:[],denyRead:[],denyWrite:[]};let X=j9,Q=X([...new Set([...J?.denyRead??[],...x9($.credentials)])],{mode:"deny"}),Y=X(J?.denyWrite??[],{mode:"deny"});return{grantRead:X(J?.allowRead??[],{mode:"grant"}),grantWrite:X(J?.allowWrite??[],{mode:"grant"}),denyRead:Q,denyWrite:Y}}function s5($){return{disabled:$.filesystem.disabled??!1,denyRead:[...$.filesystem.denyRead],denyWrite:[...$.filesystem.denyWrite],allowRead:[...$.filesystem.allowRead??[]],allowWrite:[...$.filesystem.allowWrite],credFiles:x9($.credentials)}}function aX($,J){if($.length!==J.length)return!1;let X=new Set($);return J.every((Q)=>X.has(Q))}function iK($,J){return $.disabled===J.disabled&&aX($.denyRead,J.denyRead)&&aX($.denyWrite,J.denyWrite)&&aX($.allowRead,J.allowRead)&&aX($.allowWrite,J.allowWrite)&&aX($.credFiles,J.credFiles)}function oK($){return w9!==void 0&&iK(w9,s5($))}function aK(){if(!b)return{};let $=b.network.allowedDomains,J=b.network.deniedDomains;return{allowedHosts:$,...J.length>0&&{deniedHosts:J}}}function r5(){return b?.network?.allowUnixSockets}function l5(){return b?.network?.allowAllUnixSockets}function t5(){return b?.network?.allowLocalBinding}function e5(){return b?.network?.allowMachLookup}function $U(){return b?.ignoreViolations}function JU(){return b?.enableWeakerNestedSandbox}function sK(){return b?.runAsUid}function rK(){return b?.runAsGid}function tK(){return b?.runAsHostUid}function eK(){return b?.runAsHostGid}function $G(){return b?.runAsHostHome}function $z(){return b?.runAsHostUser}function Jz(){return b?.enableWeakerNetworkIsolation}function Qz(){return b?.allowAppleEvents}function Xz(){return b?.ripgrep??{command:"rg"}}function Yz(){return b?.mandatoryDenySearchDepth??3}function p5(){return b?.filesystem?.allowGitConfig??!1}function QU($){return[...b?.git?.safeDirectories??[],...$?.git?.safeDirectories??[]]}function Gz(){return b?.seccomp}function Wz(){return c0}function QG(){return uJ?.httpProxyPort}function XG(){return uJ?.socksProxyPort}function XU(){return uJ?.linuxBridge?.httpSocketPath}function YU(){return uJ?.linuxBridge?.socksSocketPath}async function YG(){if(!b)return!1;if(m0)try{return await m0,!0}catch{return!1}return uJ!==void 0}async function GU($,J,X,Q,Y){let G=x$(),W=Y?.commandId;c5($,Y);let U=X?.filesystem!==void 0?X.filesystem.disabled??!1:b?.filesystem.disabled??!1,M=JG(X?.credentials??b?.credentials,X?.network?.allowedDomains??b?.network?.allowedDomains),O,V;if(!U){let L=(P)=>P.map((l)=>E0(l)).filter((l)=>{if(x$()==="linux"&&NJ(l))return Z(`[Sandbox] Skipping glob write pattern on Linux: ${l}`),!1;return!0}),R=L(X?.filesystem?.allowWrite??b?.filesystem.allowWrite??[]);O={allowOnly:[...DQ(X?.runAsHostHome??$G()),...R],denyWithinAllow:L(X?.filesystem?.denyWrite??b?.filesystem.denyWrite??[])};let I=a5(X?.filesystem?.denyRead??b?.filesystem.denyRead??[],M),T=[];for(let P of I){let l=E0(P);if(x$()==="linux"&&NJ(l))T.push(...e0(P));else T.push(l)}let C=X?.filesystem?.allowRead??b?.filesystem.allowRead??[],w=[];for(let P of C){let l=E0(P);if(x$()==="linux"&&NJ(l))w.push(...e0(P));else w.push(l)}if(u$)w.push(u$.certPath,u$.trustBundlePath);V={denyOnly:T,allowWithinDeny:w}}let H=X?.network?.allowedDomains!==void 0||b?.network?.allowedDomains!==void 0,q=H,F=H;if(F)await YG();let K=X?.allowPty??b?.allowPty,A=QU(X);switch(G){case"macos":return O5({command:$,commandId:W,needsNetworkRestriction:q,httpProxyPort:F?QG():void 0,socksProxyPort:F?XG():void 0,proxyAuthToken:F?c0:void 0,caCertPath:u$?.trustBundlePath,readConfig:V,writeConfig:O,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,allowUnixSockets:r5(),allowAllUnixSockets:l5(),allowLocalBinding:t5(),allowMachLookup:e5(),ignoreViolations:$U(),allowPty:K,allowGitConfig:p5(),gitSafeDirectories:A,enableWeakerNetworkIsolation:Jz(),allowAppleEvents:Qz(),binShell:J});case"linux":return X5({command:$,commandId:W,needsNetworkRestriction:q,httpSocketPath:F?XU():void 0,socksSocketPath:F?YU():void 0,httpProxyPort:F?uJ?.httpProxyPort:void 0,socksProxyPort:F?uJ?.socksProxyPort:void 0,proxyAuthToken:F?c0:void 0,caCertPath:u$?.trustBundlePath,readConfig:V,writeConfig:O,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,maskedFileStoreDir:M.maskedFileStoreDir,enableWeakerNestedSandbox:JU(),runAsUid:sK(),runAsGid:rK(),runAsHostUid:tK(),runAsHostGid:eK(),runAsHostHome:$G(),runAsHostUser:$z(),setprivPath:"/usr/bin/setpriv",allowAllUnixSockets:l5(),binShell:J,ripgrepConfig:Xz(),mandatoryDenySearchDepth:Yz(),allowGitConfig:p5(),gitSafeDirectories:A,seccompConfig:Gz(),bwrapPath:b?.bwrapPath,socatPath:b?.socatPath,observeSocketPath:nQ?.observeSocketPath,abortSignal:Q});case"windows":throw Error("wrapWithSandbox() returns a shell string and is not supported on Windows. Use SandboxManager.wrapWithSandboxArgv() and spawn the result with {shell: false}.");default:throw Error(`Sandbox configuration is not supported on platform: ${G}`)}}async function Uz($,J,X,Q,Y,G){if(x$()==="windows"){let O=X?.network?.allowedDomains!==void 0||b?.network?.allowedDomains!==void 0;if(O)await YG();let V=JG(X?.credentials??b?.credentials,X?.network?.allowedDomains??b?.network?.allowedDomains),H=X?.filesystem,q=[],F=[];if(!H?.disabled){if(H?.allowRead?.length||H?.allowWrite?.length)throw Error("Per-exec filesystem.allowRead/allowWrite is not supported "+"on Windows \u2014 `srt-win exec` only exposes per-exec "+"denies. Set them at the session level (initialize()).");let K=[...H?.denyRead??[],...x9(X?.credentials)],A=H?.denyWrite??[];if(K.length>0||A.length>0){let L=new Set(iQ?.denyRead??[]),R=new Set(iQ?.denyWrite??[]),I=j9;q=I(K,{mode:"deny"}).filter((T)=>!L.has(T)),F=I(A,{mode:"deny"}).filter((T)=>!L.has(T)&&!R.has(T))}}return c5($,G),v5({command:$,commandId:G?.commandId,httpProxyPort:O?QG():void 0,socksProxyPort:O?XG():void 0,proxyAuthToken:O?c0:void 0,setEnvVars:V.setEnvVars,denyRead:q,denyWrite:F,cwd:Y,allowWrite:iQ?.grantWrite,gitSafeDirectories:QU(X),caCertPath:u$?.trustBundlePath,binShell:D9(J),srtWin:X?.windows?.srtWin?wJ(X.windows.srtWin):eX??wJ(b?.windows?.srtWin)})}if(typeof J==="object")throw Error("binShell object form is Windows-only; pass a shell path string on macOS/Linux");let U=await GU($,J,X,Q,G);return{argv:[J??"/bin/bash","-c",U],env:process.env}}function Mz(){return b}function Oz($){if(x$()==="windows"&&b&&!oK($))Z("[Sandbox Windows] updateConfig: the resolved file-access set "+"(filesystem.* \u222A credentials.files) changed but the ACL "+"stamp/grant is session-wide \u2014 call reset() then initialize() "+"to apply. The previously-applied set stays in effect.",{level:"warn"});let{filterRequest:J,...X}=$.network;b=structuredClone({...$,network:X}),b.network.filterRequest=J,d0=X7($.network.parentProxy),Z("Sandbox configuration updated")}function Vz(){N9()}var Hz=1500;function d5($,J){if(!$.pid||$.exitCode!==null||$.signalCode!==null)return Promise.resolve();try{process.kill($.pid,"SIGTERM"),Z(`Sent SIGTERM to ${J} bridge process`)}catch(X){if(X.code!=="ESRCH")Z(`Error killing ${J} bridge: ${X}`,{level:"error"});return Promise.resolve()}return new Promise((X)=>{let Q=!1,Y=()=>{if(Q)return;Q=!0,clearTimeout(G),X()};$.once("exit",()=>{Z(`${J} bridge process exited`),Y()});let G=setTimeout(()=>{if($.exitCode===null&&$.signalCode===null){Z(`${J} bridge did not exit, forcing SIGKILL`,{level:"warn"});try{if($.pid)process.kill($.pid,"SIGKILL")}catch{}}Y()},Hz);G.unref?.()})}function qz($){return new Promise((J)=>{if(typeof $.closeAllConnections==="function")$.closeAllConnections();$.close((X)=>{if(X&&X.message!=="Server is not running.")Z(`Error closing HTTP proxy server: ${X.message}`,{level:"error"});J()})})}async function Kz(){if(iQ&&l0){let J=l0,X=eX,Q=new Set(["revoked","stillHeld","restored","alreadyOriginal"]),Y=(G,W)=>{if(!Q.has(W.status))Z(`[Sandbox Windows] ${G}: '${W.path}' ${W.status} \u2014 `+"ACE may be left in place; resolve and run `srt-win acl recover` to clear",{level:"warn"})};for(let G of S9({sandboxUserSid:J,srtWin:X})??[])Y("grant revoke",G);for(let G of T9({sandboxUserSid:J,srtWin:X})??[])Y("deny restore",G)}if(iQ=void 0,l0=void 0,w9=void 0,eX=void 0,N9({force:!0}),C9)C9(),C9=void 0;if(nQ)nQ.stop(),nQ=void 0;if(uJ?.linuxBridge){let{httpSocketPath:J,socksSocketPath:X,httpBridgeProcess:Q,socksBridgeProcess:Y}=uJ.linuxBridge;if(await Promise.all([d5(Q,"HTTP"),d5(Y,"SOCKS")]),J)try{p0.rmSync(J,{force:!0}),Z("Cleaned up HTTP socket")}catch(G){Z(`HTTP socket cleanup error: ${G}`,{level:"error"})}if(X)try{p0.rmSync(X,{force:!0}),Z("Cleaned up SOCKS socket")}catch(G){Z(`SOCKS socket cleanup error: ${G}`,{level:"error"})}}let $=[];if(u$)$.push(kW(u$));if(tX)$.push(tX.close().catch((J)=>{Z(`Error closing mux proxy server: ${J.message}`,{level:"error"})}));if(sX)$.push(qz(sX));if(rX){let J=rX.close().catch((X)=>{Z(`Error closing SOCKS proxy server: ${X.message}`,{level:"error"})});$.push(J)}await Promise.all($),tX=void 0,sX=void 0,c0=void 0,rX=void 0,uJ=void 0,m0=void 0,d0=void 0,u$=void 0,EQ.clear(),_9.clear(),P9.dispose()}async function GG(){if(oX)return oX;oX=Kz();try{await oX}finally{oX=void 0}}function zz(){return zQ}function Ez($,J){if(!b)return J;let X=zQ.getViolationsForCommand($);if(X.length===0)return J;let Q=J;Q+=r7+"<sandbox_violations>"+r7;for(let Y of X)Q+=Y.line+r7;return Q+="</sandbox_violations>",Q}function Fz(){if(x$()!=="linux"||!b||b.filesystem.disabled)return[];let $=[],J=[...b.filesystem.allowWrite,...b.filesystem.denyWrite];for(let X of J){let Q=E0(X);if(NJ(Q))$.push(X)}return $}var Nz={initialize:mK,isSupportedPlatform:n5,isSandboxingEnabled:lK,checkDependencies:pK,checkDependenciesAsync:o5,getFsReadConfig:dK,getFsWriteConfig:cK,getNetworkRestrictionConfig:aK,getAllowUnixSockets:r5,getAllowLocalBinding:t5,getAllowMachLookup:e5,getIgnoreViolations:$U,getEnableWeakerNestedSandbox:JU,getProxyPort:QG,getProxyAuthToken:Wz,getSocksProxyPort:XG,getLinuxHttpSocketPath:XU,getLinuxSocksSocketPath:YU,waitForNetworkInitialization:YG,wrapWithSandbox:GU,wrapWithSandboxArgv:Uz,cleanupAfterCommand:Vz,reset:GG,getMitmCA:()=>u$,getSentinelRegistry:()=>EQ,getAwsPairRegistry:()=>_9,getMaskedFileStore:()=>P9,getSandboxViolationStore:zz,annotateStderrWithSandboxFailures:Ez,getLinuxGlobPatternWarnings:Fz,getConfig:Mz,updateConfig:Oz};import{isIP as CE}from"net";import{isAbsolute as wE}from"path";var x={};uU(x,{void:()=>JE,util:()=>Z$,unknown:()=>ez,union:()=>GE,undefined:()=>sz,tuple:()=>ME,transformer:()=>LE,symbol:()=>az,string:()=>zU,strictObject:()=>YE,setErrorMap:()=>Rz,set:()=>HE,record:()=>OE,quotelessJson:()=>Lz,promise:()=>NE,preprocess:()=>DE,pipeline:()=>ZE,ostring:()=>BE,optional:()=>AE,onumber:()=>jE,oboolean:()=>TE,objectUtil:()=>WG,object:()=>XE,number:()=>EU,nullable:()=>RE,null:()=>rz,never:()=>$E,nativeEnum:()=>FE,nan:()=>nz,map:()=>VE,makeIssue:()=>$Y,literal:()=>zE,lazy:()=>KE,late:()=>dz,isValid:()=>n0,isDirty:()=>k9,isAsync:()=>aQ,isAborted:()=>v9,intersection:()=>UE,instanceof:()=>cz,getParsedType:()=>H0,getErrorMap:()=>oQ,function:()=>qE,enum:()=>EE,effect:()=>LE,discriminatedUnion:()=>WE,defaultErrorMap:()=>j0,datetimeRegex:()=>HU,date:()=>oz,custom:()=>KU,coerce:()=>SE,boolean:()=>FU,bigint:()=>iz,array:()=>QE,any:()=>tz,addIssueToContext:()=>n,ZodVoid:()=>QY,ZodUnknown:()=>i0,ZodUnion:()=>JX,ZodUndefined:()=>eQ,ZodType:()=>F$,ZodTuple:()=>K0,ZodTransformer:()=>tJ,ZodSymbol:()=>JY,ZodString:()=>oJ,ZodSet:()=>AQ,ZodSchema:()=>F$,ZodRecord:()=>XY,ZodReadonly:()=>MX,ZodPromise:()=>RQ,ZodPipeline:()=>WY,ZodParsedType:()=>m,ZodOptional:()=>sJ,ZodObject:()=>o$,ZodNumber:()=>o0,ZodNullable:()=>S0,ZodNull:()=>$X,ZodNever:()=>q0,ZodNativeEnum:()=>GX,ZodNaN:()=>GY,ZodMap:()=>YY,ZodLiteral:()=>YX,ZodLazy:()=>XX,ZodIssueCode:()=>u,ZodIntersection:()=>QX,ZodFunction:()=>rQ,ZodFirstPartyTypeKind:()=>W$,ZodError:()=>TJ,ZodEnum:()=>s0,ZodEffects:()=>tJ,ZodDiscriminatedUnion:()=>f9,ZodDefault:()=>WX,ZodDate:()=>NQ,ZodCatch:()=>UX,ZodBranded:()=>y9,ZodBoolean:()=>tQ,ZodBigInt:()=>a0,ZodArray:()=>aJ,ZodAny:()=>LQ,Schema:()=>F$,ParseStatus:()=>EJ,OK:()=>FJ,NEVER:()=>IE,INVALID:()=>Y$,EMPTY_PATH:()=>Dz,DIRTY:()=>FQ,BRAND:()=>pz});var Z$;(function($){$.assertEqual=(Y)=>{};function J(Y){}$.assertIs=J;function X(Y){throw Error()}$.assertNever=X,$.arrayToEnum=(Y)=>{let G={};for(let W of Y)G[W]=W;return G},$.getValidEnumValues=(Y)=>{let G=$.objectKeys(Y).filter((U)=>typeof Y[Y[U]]!=="number"),W={};for(let U of G)W[U]=Y[U];return $.objectValues(W)},$.objectValues=(Y)=>{return $.objectKeys(Y).map(function(G){return Y[G]})},$.objectKeys=typeof Object.keys==="function"?(Y)=>Object.keys(Y):(Y)=>{let G=[];for(let W in Y)if(Object.prototype.hasOwnProperty.call(Y,W))G.push(W);return G},$.find=(Y,G)=>{for(let W of Y)if(G(W))return W;return},$.isInteger=typeof Number.isInteger==="function"?(Y)=>Number.isInteger(Y):(Y)=>typeof Y==="number"&&Number.isFinite(Y)&&Math.floor(Y)===Y;function Q(Y,G=" | "){return Y.map((W)=>typeof W==="string"?`'${W}'`:W).join(G)}$.joinValues=Q,$.jsonStringifyReplacer=(Y,G)=>{if(typeof G==="bigint")return G.toString();return G}})(Z$||(Z$={}));var WG;(function($){$.mergeShapes=(J,X)=>{return{...J,...X}}})(WG||(WG={}));var m=Z$.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),H0=($)=>{switch(typeof $){case"undefined":return m.undefined;case"string":return m.string;case"number":return Number.isNaN($)?m.nan:m.number;case"boolean":return m.boolean;case"function":return m.function;case"bigint":return m.bigint;case"symbol":return m.symbol;case"object":if(Array.isArray($))return m.array;if($===null)return m.null;if($.then&&typeof $.then==="function"&&$.catch&&typeof $.catch==="function")return m.promise;if(typeof Map<"u"&&$ instanceof Map)return m.map;if(typeof Set<"u"&&$ instanceof Set)return m.set;if(typeof Date<"u"&&$ instanceof Date)return m.date;return m.object;default:return m.unknown}};var u=Z$.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]),Lz=($)=>{return JSON.stringify($,null,2).replace(/"([^"]+)":/g,"$1:")};class TJ extends Error{get errors(){return this.issues}constructor($){super();this.issues=[],this.addIssue=(X)=>{this.issues=[...this.issues,X]},this.addIssues=(X=[])=>{this.issues=[...this.issues,...X]};let J=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,J);else this.__proto__=J;this.name="ZodError",this.issues=$}format($){let J=$||function(Y){return Y.message},X={_errors:[]},Q=(Y)=>{for(let G of Y.issues)if(G.code==="invalid_union")G.unionErrors.map(Q);else if(G.code==="invalid_return_type")Q(G.returnTypeError);else if(G.code==="invalid_arguments")Q(G.argumentsError);else if(G.path.length===0)X._errors.push(J(G));else{let W=X,U=0;while(U<G.path.length){let M=G.path[U];if(U!==G.path.length-1)W[M]=W[M]||{_errors:[]};else W[M]=W[M]||{_errors:[]},W[M]._errors.push(J(G));W=W[M],U++}}};return Q(this),X}static assert($){if(!($ instanceof TJ))throw Error(`Not a ZodError: ${$}`)}toString(){return this.message}get message(){return JSON.stringify(this.issues,Z$.jsonStringifyReplacer,2)}get isEmpty(){return this.issues.length===0}flatten($=(J)=>J.message){let J={},X=[];for(let Q of this.issues)if(Q.path.length>0){let Y=Q.path[0];J[Y]=J[Y]||[],J[Y].push($(Q))}else X.push($(Q));return{formErrors:X,fieldErrors:J}}get formErrors(){return this.flatten()}}TJ.create=($)=>{return new TJ($)};var Az=($,J)=>{let X;switch($.code){case u.invalid_type:if($.received===m.undefined)X="Required";else X=`Expected ${$.expected}, received ${$.received}`;break;case u.invalid_literal:X=`Invalid literal value, expected ${JSON.stringify($.expected,Z$.jsonStringifyReplacer)}`;break;case u.unrecognized_keys:X=`Unrecognized key(s) in object: ${Z$.joinValues($.keys,", ")}`;break;case u.invalid_union:X="Invalid input";break;case u.invalid_union_discriminator:X=`Invalid discriminator value. Expected ${Z$.joinValues($.options)}`;break;case u.invalid_enum_value:X=`Invalid enum value. Expected ${Z$.joinValues($.options)}, received '${$.received}'`;break;case u.invalid_arguments:X="Invalid function arguments";break;case u.invalid_return_type:X="Invalid function return type";break;case u.invalid_date:X="Invalid date";break;case u.invalid_string:if(typeof $.validation==="object")if("includes"in $.validation){if(X=`Invalid input: must include "${$.validation.includes}"`,typeof $.validation.position==="number")X=`${X} at one or more positions greater than or equal to ${$.validation.position}`}else if("startsWith"in $.validation)X=`Invalid input: must start with "${$.validation.startsWith}"`;else if("endsWith"in $.validation)X=`Invalid input: must end with "${$.validation.endsWith}"`;else Z$.assertNever($.validation);else if($.validation!=="regex")X=`Invalid ${$.validation}`;else X="Invalid";break;case u.too_small:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at least":"more than"} ${$.minimum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at least":"over"} ${$.minimum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="bigint")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${new Date(Number($.minimum))}`;else X="Invalid input";break;case u.too_big:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at most":"less than"} ${$.maximum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at most":"under"} ${$.maximum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="bigint")X=`BigInt must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly":$.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number($.maximum))}`;else X="Invalid input";break;case u.custom:X="Invalid input";break;case u.invalid_intersection_types:X="Intersection results could not be merged";break;case u.not_multiple_of:X=`Number must be a multiple of ${$.multipleOf}`;break;case u.not_finite:X="Number must be finite";break;default:X=J.defaultError,Z$.assertNever($)}return{message:X}},j0=Az;var WU=j0;function Rz($){WU=$}function oQ(){return WU}var $Y=($)=>{let{data:J,path:X,errorMaps:Q,issueData:Y}=$,G=[...X,...Y.path||[]],W={...Y,path:G};if(Y.message!==void 0)return{...Y,path:G,message:Y.message};let U="",M=Q.filter((O)=>!!O).slice().reverse();for(let O of M)U=O(W,{data:J,defaultError:U}).message;return{...Y,path:G,message:U}},Dz=[];function n($,J){let X=oQ(),Q=$Y({issueData:J,data:$.data,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,X,X===j0?void 0:j0].filter((Y)=>!!Y)});$.common.issues.push(Q)}class EJ{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray($,J){let X=[];for(let Q of J){if(Q.status==="aborted")return Y$;if(Q.status==="dirty")$.dirty();X.push(Q.value)}return{status:$.value,value:X}}static async mergeObjectAsync($,J){let X=[];for(let Q of J){let Y=await Q.key,G=await Q.value;X.push({key:Y,value:G})}return EJ.mergeObjectSync($,X)}static mergeObjectSync($,J){let X={};for(let Q of J){let{key:Y,value:G}=Q;if(Y.status==="aborted")return Y$;if(G.status==="aborted")return Y$;if(Y.status==="dirty")$.dirty();if(G.status==="dirty")$.dirty();if(Y.value!=="__proto__"&&(typeof G.value<"u"||Q.alwaysSet))X[Y.value]=G.value}return{status:$.value,value:X}}}var Y$=Object.freeze({status:"aborted"}),FQ=($)=>({status:"dirty",value:$}),FJ=($)=>({status:"valid",value:$}),v9=($)=>$.status==="aborted",k9=($)=>$.status==="dirty",n0=($)=>$.status==="valid",aQ=($)=>typeof Promise<"u"&&$ instanceof Promise;var e;(function($){$.errToObj=(J)=>typeof J==="string"?{message:J}:J||{},$.toString=(J)=>typeof J==="string"?J:J?.message})(e||(e={}));class rJ{constructor($,J,X,Q){this._cachedPath=[],this.parent=$,this.data=J,this._path=X,this._key=Q}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var UU=($,J)=>{if(n0(J))return{success:!0,data:J.value};else{if(!$.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let X=new TJ($.common.issues);return this._error=X,this._error}}}};function H$($){if(!$)return{};let{errorMap:J,invalid_type_error:X,required_error:Q,description:Y}=$;if(J&&(X||Q))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if(J)return{errorMap:J,description:Y};return{errorMap:(W,U)=>{let{message:M}=$;if(W.code==="invalid_enum_value")return{message:M??U.defaultError};if(typeof U.data>"u")return{message:M??Q??U.defaultError};if(W.code!=="invalid_type")return{message:U.defaultError};return{message:M??X??U.defaultError}},description:Y}}class F${get description(){return this._def.description}_getType($){return H0($.data)}_getOrReturnCtx($,J){return J||{common:$.parent.common,data:$.data,parsedType:H0($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}_processInputParams($){return{status:new EJ,ctx:{common:$.parent.common,data:$.data,parsedType:H0($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}}_parseSync($){let J=this._parse($);if(aQ(J))throw Error("Synchronous parse encountered promise.");return J}_parseAsync($){let J=this._parse($);return Promise.resolve(J)}parse($,J){let X=this.safeParse($,J);if(X.success)return X.data;throw X.error}safeParse($,J){let X={common:{issues:[],async:J?.async??!1,contextualErrorMap:J?.errorMap},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)},Q=this._parseSync({data:$,path:X.path,parent:X});return UU(X,Q)}"~validate"($){let J={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)};if(!this["~standard"].async)try{let X=this._parseSync({data:$,path:[],parent:J});return n0(X)?{value:X.value}:{issues:J.common.issues}}catch(X){if(X?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;J.common={issues:[],async:!0}}return this._parseAsync({data:$,path:[],parent:J}).then((X)=>n0(X)?{value:X.value}:{issues:J.common.issues})}async parseAsync($,J){let X=await this.safeParseAsync($,J);if(X.success)return X.data;throw X.error}async safeParseAsync($,J){let X={common:{issues:[],contextualErrorMap:J?.errorMap,async:!0},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)},Q=this._parse({data:$,path:X.path,parent:X}),Y=await(aQ(Q)?Q:Promise.resolve(Q));return UU(X,Y)}refine($,J){let X=(Q)=>{if(typeof J==="string"||typeof J>"u")return{message:J};else if(typeof J==="function")return J(Q);else return J};return this._refinement((Q,Y)=>{let G=$(Q),W=()=>Y.addIssue({code:u.custom,...X(Q)});if(typeof Promise<"u"&&G instanceof Promise)return G.then((U)=>{if(!U)return W(),!1;else return!0});if(!G)return W(),!1;else return!0})}refinement($,J){return this._refinement((X,Q)=>{if(!$(X))return Q.addIssue(typeof J==="function"?J(X,Q):J),!1;else return!0})}_refinement($){return new tJ({schema:this,typeName:W$.ZodEffects,effect:{type:"refinement",refinement:$}})}superRefine($){return this._refinement($)}constructor($){this.spa=this.safeParseAsync,this._def=$,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:(J)=>this["~validate"](J)}}optional(){return sJ.create(this,this._def)}nullable(){return S0.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return aJ.create(this)}promise(){return RQ.create(this,this._def)}or($){return JX.create([this,$],this._def)}and($){return QX.create(this,$,this._def)}transform($){return new tJ({...H$(this._def),schema:this,typeName:W$.ZodEffects,effect:{type:"transform",transform:$}})}default($){let J=typeof $==="function"?$:()=>$;return new WX({...H$(this._def),innerType:this,defaultValue:J,typeName:W$.ZodDefault})}brand(){return new y9({typeName:W$.ZodBranded,type:this,...H$(this._def)})}catch($){let J=typeof $==="function"?$:()=>$;return new UX({...H$(this._def),innerType:this,catchValue:J,typeName:W$.ZodCatch})}describe($){return new this.constructor({...this._def,description:$})}pipe($){return WY.create(this,$)}readonly(){return MX.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var Zz=/^c[^\s-]{8,}$/i,Bz=/^[0-9a-z]+$/,jz=/^[0-9A-HJKMNP-TV-Z]{26}$/i,Tz=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,Sz=/^[a-z0-9_-]{21}$/i,Iz=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,Cz=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,wz=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,Pz="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",UG,_z=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,xz=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,vz=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,kz=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,fz=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,yz=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,OU="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",bz=new RegExp(`^${OU}$`);function VU($){let J="[0-5]\\d";if($.precision)J=`${J}\\.\\d{${$.precision}}`;else if($.precision==null)J=`${J}(\\.\\d+)?`;let X=$.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${J})${X}`}function hz($){return new RegExp(`^${VU($)}$`)}function HU($){let J=`${OU}T${VU($)}`,X=[];if(X.push($.local?"Z?":"Z"),$.offset)X.push("([+-]\\d{2}:?\\d{2})");return J=`${J}(${X.join("|")})`,new RegExp(`^${J}$`)}function uz($,J){if((J==="v4"||!J)&&_z.test($))return!0;if((J==="v6"||!J)&&vz.test($))return!0;return!1}function gz($,J){if(!Iz.test($))return!1;try{let[X]=$.split(".");if(!X)return!1;let Q=X.replace(/-/g,"+").replace(/_/g,"/").padEnd(X.length+(4-X.length%4)%4,"="),Y=JSON.parse(atob(Q));if(typeof Y!=="object"||Y===null)return!1;if("typ"in Y&&Y?.typ!=="JWT")return!1;if(!Y.alg)return!1;if(J&&Y.alg!==J)return!1;return!0}catch{return!1}}function mz($,J){if((J==="v4"||!J)&&xz.test($))return!0;if((J==="v6"||!J)&&kz.test($))return!0;return!1}class oJ extends F${_parse($){if(this._def.coerce)$.data=String($.data);if(this._getType($)!==m.string){let Y=this._getOrReturnCtx($);return n(Y,{code:u.invalid_type,expected:m.string,received:Y.parsedType}),Y$}let X=new EJ,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.length<Y.value)Q=this._getOrReturnCtx($,Q),n(Q,{code:u.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="max"){if($.data.length>Y.value)Q=this._getOrReturnCtx($,Q),n(Q,{code:u.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="length"){let G=$.data.length>Y.value,W=$.data.length<Y.value;if(G||W){if(Q=this._getOrReturnCtx($,Q),G)n(Q,{code:u.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});else if(W)n(Q,{code:u.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});X.dirty()}}else if(Y.kind==="email"){if(!wz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"email",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="emoji"){if(!UG)UG=new RegExp(Pz,"u");if(!UG.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"emoji",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="uuid"){if(!Tz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"uuid",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="nanoid"){if(!Sz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"nanoid",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid"){if(!Zz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"cuid",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid2"){if(!Bz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"cuid2",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ulid"){if(!jz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"ulid",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="url")try{new URL($.data)}catch{Q=this._getOrReturnCtx($,Q),n(Q,{validation:"url",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="regex"){if(Y.regex.lastIndex=0,!Y.regex.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"regex",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="trim")$.data=$.data.trim();else if(Y.kind==="includes"){if(!$.data.includes(Y.value,Y.position))Q=this._getOrReturnCtx($,Q),n(Q,{code:u.invalid_string,validation:{includes:Y.value,position:Y.position},message:Y.message}),X.dirty()}else if(Y.kind==="toLowerCase")$.data=$.data.toLowerCase();else if(Y.kind==="toUpperCase")$.data=$.data.toUpperCase();else if(Y.kind==="startsWith"){if(!$.data.startsWith(Y.value))Q=this._getOrReturnCtx($,Q),n(Q,{code:u.invalid_string,validation:{startsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="endsWith"){if(!$.data.endsWith(Y.value))Q=this._getOrReturnCtx($,Q),n(Q,{code:u.invalid_string,validation:{endsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="datetime"){if(!HU(Y).test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{code:u.invalid_string,validation:"datetime",message:Y.message}),X.dirty()}else if(Y.kind==="date"){if(!bz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{code:u.invalid_string,validation:"date",message:Y.message}),X.dirty()}else if(Y.kind==="time"){if(!hz(Y).test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{code:u.invalid_string,validation:"time",message:Y.message}),X.dirty()}else if(Y.kind==="duration"){if(!Cz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"duration",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ip"){if(!uz($.data,Y.version))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"ip",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="jwt"){if(!gz($.data,Y.alg))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"jwt",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cidr"){if(!mz($.data,Y.version))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"cidr",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64"){if(!fz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"base64",code:u.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64url"){if(!yz.test($.data))Q=this._getOrReturnCtx($,Q),n(Q,{validation:"base64url",code:u.invalid_string,message:Y.message}),X.dirty()}else Z$.assertNever(Y);return{status:X.value,value:$.data}}_regex($,J,X){return this.refinement((Q)=>$.test(Q),{validation:J,code:u.invalid_string,...e.errToObj(X)})}_addCheck($){return new oJ({...this._def,checks:[...this._def.checks,$]})}email($){return this._addCheck({kind:"email",...e.errToObj($)})}url($){return this._addCheck({kind:"url",...e.errToObj($)})}emoji($){return this._addCheck({kind:"emoji",...e.errToObj($)})}uuid($){return this._addCheck({kind:"uuid",...e.errToObj($)})}nanoid($){return this._addCheck({kind:"nanoid",...e.errToObj($)})}cuid($){return this._addCheck({kind:"cuid",...e.errToObj($)})}cuid2($){return this._addCheck({kind:"cuid2",...e.errToObj($)})}ulid($){return this._addCheck({kind:"ulid",...e.errToObj($)})}base64($){return this._addCheck({kind:"base64",...e.errToObj($)})}base64url($){return this._addCheck({kind:"base64url",...e.errToObj($)})}jwt($){return this._addCheck({kind:"jwt",...e.errToObj($)})}ip($){return this._addCheck({kind:"ip",...e.errToObj($)})}cidr($){return this._addCheck({kind:"cidr",...e.errToObj($)})}datetime($){if(typeof $==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:$});return this._addCheck({kind:"datetime",precision:typeof $?.precision>"u"?null:$?.precision,offset:$?.offset??!1,local:$?.local??!1,...e.errToObj($?.message)})}date($){return this._addCheck({kind:"date",message:$})}time($){if(typeof $==="string")return this._addCheck({kind:"time",precision:null,message:$});return this._addCheck({kind:"time",precision:typeof $?.precision>"u"?null:$?.precision,...e.errToObj($?.message)})}duration($){return this._addCheck({kind:"duration",...e.errToObj($)})}regex($,J){return this._addCheck({kind:"regex",regex:$,...e.errToObj(J)})}includes($,J){return this._addCheck({kind:"includes",value:$,position:J?.position,...e.errToObj(J?.message)})}startsWith($,J){return this._addCheck({kind:"startsWith",value:$,...e.errToObj(J)})}endsWith($,J){return this._addCheck({kind:"endsWith",value:$,...e.errToObj(J)})}min($,J){return this._addCheck({kind:"min",value:$,...e.errToObj(J)})}max($,J){return this._addCheck({kind:"max",value:$,...e.errToObj(J)})}length($,J){return this._addCheck({kind:"length",value:$,...e.errToObj(J)})}nonempty($){return this.min(1,e.errToObj($))}trim(){return new oJ({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new oJ({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new oJ({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find(($)=>$.kind==="datetime")}get isDate(){return!!this._def.checks.find(($)=>$.kind==="date")}get isTime(){return!!this._def.checks.find(($)=>$.kind==="time")}get isDuration(){return!!this._def.checks.find(($)=>$.kind==="duration")}get isEmail(){return!!this._def.checks.find(($)=>$.kind==="email")}get isURL(){return!!this._def.checks.find(($)=>$.kind==="url")}get isEmoji(){return!!this._def.checks.find(($)=>$.kind==="emoji")}get isUUID(){return!!this._def.checks.find(($)=>$.kind==="uuid")}get isNANOID(){return!!this._def.checks.find(($)=>$.kind==="nanoid")}get isCUID(){return!!this._def.checks.find(($)=>$.kind==="cuid")}get isCUID2(){return!!this._def.checks.find(($)=>$.kind==="cuid2")}get isULID(){return!!this._def.checks.find(($)=>$.kind==="ulid")}get isIP(){return!!this._def.checks.find(($)=>$.kind==="ip")}get isCIDR(){return!!this._def.checks.find(($)=>$.kind==="cidr")}get isBase64(){return!!this._def.checks.find(($)=>$.kind==="base64")}get isBase64url(){return!!this._def.checks.find(($)=>$.kind==="base64url")}get minLength(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxLength(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}oJ.create=($)=>{return new oJ({checks:[],typeName:W$.ZodString,coerce:$?.coerce??!1,...H$($)})};function lz($,J){let X=($.toString().split(".")[1]||"").length,Q=(J.toString().split(".")[1]||"").length,Y=X>Q?X:Q,G=Number.parseInt($.toFixed(Y).replace(".","")),W=Number.parseInt(J.toFixed(Y).replace(".",""));return G%W/10**Y}class o0 extends F${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse($){if(this._def.coerce)$.data=Number($.data);if(this._getType($)!==m.number){let Y=this._getOrReturnCtx($);return n(Y,{code:u.invalid_type,expected:m.number,received:Y.parsedType}),Y$}let X=void 0,Q=new EJ;for(let Y of this._def.checks)if(Y.kind==="int"){if(!Z$.isInteger($.data))X=this._getOrReturnCtx($,X),n(X,{code:u.invalid_type,expected:"integer",received:"float",message:Y.message}),Q.dirty()}else if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),n(X,{code:u.too_small,minimum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),n(X,{code:u.too_big,maximum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if(lz($.data,Y.value)!==0)X=this._getOrReturnCtx($,X),n(X,{code:u.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else if(Y.kind==="finite"){if(!Number.isFinite($.data))X=this._getOrReturnCtx($,X),n(X,{code:u.not_finite,message:Y.message}),Q.dirty()}else Z$.assertNever(Y);return{status:Q.value,value:$.data}}gte($,J){return this.setLimit("min",$,!0,e.toString(J))}gt($,J){return this.setLimit("min",$,!1,e.toString(J))}lte($,J){return this.setLimit("max",$,!0,e.toString(J))}lt($,J){return this.setLimit("max",$,!1,e.toString(J))}setLimit($,J,X,Q){return new o0({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:e.toString(Q)}]})}_addCheck($){return new o0({...this._def,checks:[...this._def.checks,$]})}int($){return this._addCheck({kind:"int",message:e.toString($)})}positive($){return this._addCheck({kind:"min",value:0,inclusive:!1,message:e.toString($)})}negative($){return this._addCheck({kind:"max",value:0,inclusive:!1,message:e.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:0,inclusive:!0,message:e.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:0,inclusive:!0,message:e.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:e.toString(J)})}finite($){return this._addCheck({kind:"finite",message:e.toString($)})}safe($){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:e.toString($)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:e.toString($)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}get isInt(){return!!this._def.checks.find(($)=>$.kind==="int"||$.kind==="multipleOf"&&Z$.isInteger($.value))}get isFinite(){let $=null,J=null;for(let X of this._def.checks)if(X.kind==="finite"||X.kind==="int"||X.kind==="multipleOf")return!0;else if(X.kind==="min"){if(J===null||X.value>J)J=X.value}else if(X.kind==="max"){if($===null||X.value<$)$=X.value}return Number.isFinite(J)&&Number.isFinite($)}}o0.create=($)=>{return new o0({checks:[],typeName:W$.ZodNumber,coerce:$?.coerce||!1,...H$($)})};class a0 extends F${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse($){if(this._def.coerce)try{$.data=BigInt($.data)}catch{return this._getInvalidInput($)}if(this._getType($)!==m.bigint)return this._getInvalidInput($);let X=void 0,Q=new EJ;for(let Y of this._def.checks)if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),n(X,{code:u.too_small,type:"bigint",minimum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),n(X,{code:u.too_big,type:"bigint",maximum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if($.data%Y.value!==BigInt(0))X=this._getOrReturnCtx($,X),n(X,{code:u.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else Z$.assertNever(Y);return{status:Q.value,value:$.data}}_getInvalidInput($){let J=this._getOrReturnCtx($);return n(J,{code:u.invalid_type,expected:m.bigint,received:J.parsedType}),Y$}gte($,J){return this.setLimit("min",$,!0,e.toString(J))}gt($,J){return this.setLimit("min",$,!1,e.toString(J))}lte($,J){return this.setLimit("max",$,!0,e.toString(J))}lt($,J){return this.setLimit("max",$,!1,e.toString(J))}setLimit($,J,X,Q){return new a0({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:e.toString(Q)}]})}_addCheck($){return new a0({...this._def,checks:[...this._def.checks,$]})}positive($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:e.toString($)})}negative($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:e.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:e.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:e.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:e.toString(J)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}a0.create=($)=>{return new a0({checks:[],typeName:W$.ZodBigInt,coerce:$?.coerce??!1,...H$($)})};class tQ extends F${_parse($){if(this._def.coerce)$.data=Boolean($.data);if(this._getType($)!==m.boolean){let X=this._getOrReturnCtx($);return n(X,{code:u.invalid_type,expected:m.boolean,received:X.parsedType}),Y$}return FJ($.data)}}tQ.create=($)=>{return new tQ({typeName:W$.ZodBoolean,coerce:$?.coerce||!1,...H$($)})};class NQ extends F${_parse($){if(this._def.coerce)$.data=new Date($.data);if(this._getType($)!==m.date){let Y=this._getOrReturnCtx($);return n(Y,{code:u.invalid_type,expected:m.date,received:Y.parsedType}),Y$}if(Number.isNaN($.data.getTime())){let Y=this._getOrReturnCtx($);return n(Y,{code:u.invalid_date}),Y$}let X=new EJ,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.getTime()<Y.value)Q=this._getOrReturnCtx($,Q),n(Q,{code:u.too_small,message:Y.message,inclusive:!0,exact:!1,minimum:Y.value,type:"date"}),X.dirty()}else if(Y.kind==="max"){if($.data.getTime()>Y.value)Q=this._getOrReturnCtx($,Q),n(Q,{code:u.too_big,message:Y.message,inclusive:!0,exact:!1,maximum:Y.value,type:"date"}),X.dirty()}else Z$.assertNever(Y);return{status:X.value,value:new Date($.data.getTime())}}_addCheck($){return new NQ({...this._def,checks:[...this._def.checks,$]})}min($,J){return this._addCheck({kind:"min",value:$.getTime(),message:e.toString(J)})}max($,J){return this._addCheck({kind:"max",value:$.getTime(),message:e.toString(J)})}get minDate(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $!=null?new Date($):null}get maxDate(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $!=null?new Date($):null}}NQ.create=($)=>{return new NQ({checks:[],coerce:$?.coerce||!1,typeName:W$.ZodDate,...H$($)})};class JY extends F${_parse($){if(this._getType($)!==m.symbol){let X=this._getOrReturnCtx($);return n(X,{code:u.invalid_type,expected:m.symbol,received:X.parsedType}),Y$}return FJ($.data)}}JY.create=($)=>{return new JY({typeName:W$.ZodSymbol,...H$($)})};class eQ extends F${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return n(X,{code:u.invalid_type,expected:m.undefined,received:X.parsedType}),Y$}return FJ($.data)}}eQ.create=($)=>{return new eQ({typeName:W$.ZodUndefined,...H$($)})};class $X extends F${_parse($){if(this._getType($)!==m.null){let X=this._getOrReturnCtx($);return n(X,{code:u.invalid_type,expected:m.null,received:X.parsedType}),Y$}return FJ($.data)}}$X.create=($)=>{return new $X({typeName:W$.ZodNull,...H$($)})};class LQ extends F${constructor(){super(...arguments);this._any=!0}_parse($){return FJ($.data)}}LQ.create=($)=>{return new LQ({typeName:W$.ZodAny,...H$($)})};class i0 extends F${constructor(){super(...arguments);this._unknown=!0}_parse($){return FJ($.data)}}i0.create=($)=>{return new i0({typeName:W$.ZodUnknown,...H$($)})};class q0 extends F${_parse($){let J=this._getOrReturnCtx($);return n(J,{code:u.invalid_type,expected:m.never,received:J.parsedType}),Y$}}q0.create=($)=>{return new q0({typeName:W$.ZodNever,...H$($)})};class QY extends F${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return n(X,{code:u.invalid_type,expected:m.void,received:X.parsedType}),Y$}return FJ($.data)}}QY.create=($)=>{return new QY({typeName:W$.ZodVoid,...H$($)})};class aJ extends F${_parse($){let{ctx:J,status:X}=this._processInputParams($),Q=this._def;if(J.parsedType!==m.array)return n(J,{code:u.invalid_type,expected:m.array,received:J.parsedType}),Y$;if(Q.exactLength!==null){let G=J.data.length>Q.exactLength.value,W=J.data.length<Q.exactLength.value;if(G||W)n(J,{code:G?u.too_big:u.too_small,minimum:W?Q.exactLength.value:void 0,maximum:G?Q.exactLength.value:void 0,type:"array",inclusive:!0,exact:!0,message:Q.exactLength.message}),X.dirty()}if(Q.minLength!==null){if(J.data.length<Q.minLength.value)n(J,{code:u.too_small,minimum:Q.minLength.value,type:"array",inclusive:!0,exact:!1,message:Q.minLength.message}),X.dirty()}if(Q.maxLength!==null){if(J.data.length>Q.maxLength.value)n(J,{code:u.too_big,maximum:Q.maxLength.value,type:"array",inclusive:!0,exact:!1,message:Q.maxLength.message}),X.dirty()}if(J.common.async)return Promise.all([...J.data].map((G,W)=>{return Q.type._parseAsync(new rJ(J,G,J.path,W))})).then((G)=>{return EJ.mergeArray(X,G)});let Y=[...J.data].map((G,W)=>{return Q.type._parseSync(new rJ(J,G,J.path,W))});return EJ.mergeArray(X,Y)}get element(){return this._def.type}min($,J){return new aJ({...this._def,minLength:{value:$,message:e.toString(J)}})}max($,J){return new aJ({...this._def,maxLength:{value:$,message:e.toString(J)}})}length($,J){return new aJ({...this._def,exactLength:{value:$,message:e.toString(J)}})}nonempty($){return this.min(1,$)}}aJ.create=($,J)=>{return new aJ({type:$,minLength:null,maxLength:null,exactLength:null,typeName:W$.ZodArray,...H$(J)})};function sQ($){if($ instanceof o$){let J={};for(let X in $.shape){let Q=$.shape[X];J[X]=sJ.create(sQ(Q))}return new o$({...$._def,shape:()=>J})}else if($ instanceof aJ)return new aJ({...$._def,type:sQ($.element)});else if($ instanceof sJ)return sJ.create(sQ($.unwrap()));else if($ instanceof S0)return S0.create(sQ($.unwrap()));else if($ instanceof K0)return K0.create($.items.map((J)=>sQ(J)));else return $}class o$ extends F${constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let $=this._def.shape(),J=Z$.objectKeys($);return this._cached={shape:$,keys:J},this._cached}_parse($){if(this._getType($)!==m.object){let M=this._getOrReturnCtx($);return n(M,{code:u.invalid_type,expected:m.object,received:M.parsedType}),Y$}let{status:X,ctx:Q}=this._processInputParams($),{shape:Y,keys:G}=this._getCached(),W=[];if(!(this._def.catchall instanceof q0&&this._def.unknownKeys==="strip")){for(let M in Q.data)if(!G.includes(M))W.push(M)}let U=[];for(let M of G){let O=Y[M],V=Q.data[M];U.push({key:{status:"valid",value:M},value:O._parse(new rJ(Q,V,Q.path,M)),alwaysSet:M in Q.data})}if(this._def.catchall instanceof q0){let M=this._def.unknownKeys;if(M==="passthrough")for(let O of W)U.push({key:{status:"valid",value:O},value:{status:"valid",value:Q.data[O]}});else if(M==="strict"){if(W.length>0)n(Q,{code:u.unrecognized_keys,keys:W}),X.dirty()}else if(M==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let M=this._def.catchall;for(let O of W){let V=Q.data[O];U.push({key:{status:"valid",value:O},value:M._parse(new rJ(Q,V,Q.path,O)),alwaysSet:O in Q.data})}}if(Q.common.async)return Promise.resolve().then(async()=>{let M=[];for(let O of U){let V=await O.key,H=await O.value;M.push({key:V,value:H,alwaysSet:O.alwaysSet})}return M}).then((M)=>{return EJ.mergeObjectSync(X,M)});else return EJ.mergeObjectSync(X,U)}get shape(){return this._def.shape()}strict($){return e.errToObj,new o$({...this._def,unknownKeys:"strict",...$!==void 0?{errorMap:(J,X)=>{let Q=this._def.errorMap?.(J,X).message??X.defaultError;if(J.code==="unrecognized_keys")return{message:e.errToObj($).message??Q};return{message:Q}}}:{}})}strip(){return new o$({...this._def,unknownKeys:"strip"})}passthrough(){return new o$({...this._def,unknownKeys:"passthrough"})}extend($){return new o$({...this._def,shape:()=>({...this._def.shape(),...$})})}merge($){return new o$({unknownKeys:$._def.unknownKeys,catchall:$._def.catchall,shape:()=>({...this._def.shape(),...$._def.shape()}),typeName:W$.ZodObject})}setKey($,J){return this.augment({[$]:J})}catchall($){return new o$({...this._def,catchall:$})}pick($){let J={};for(let X of Z$.objectKeys($))if($[X]&&this.shape[X])J[X]=this.shape[X];return new o$({...this._def,shape:()=>J})}omit($){let J={};for(let X of Z$.objectKeys(this.shape))if(!$[X])J[X]=this.shape[X];return new o$({...this._def,shape:()=>J})}deepPartial(){return sQ(this)}partial($){let J={};for(let X of Z$.objectKeys(this.shape)){let Q=this.shape[X];if($&&!$[X])J[X]=Q;else J[X]=Q.optional()}return new o$({...this._def,shape:()=>J})}required($){let J={};for(let X of Z$.objectKeys(this.shape))if($&&!$[X])J[X]=this.shape[X];else{let Y=this.shape[X];while(Y instanceof sJ)Y=Y._def.innerType;J[X]=Y}return new o$({...this._def,shape:()=>J})}keyof(){return qU(Z$.objectKeys(this.shape))}}o$.create=($,J)=>{return new o$({shape:()=>$,unknownKeys:"strip",catchall:q0.create(),typeName:W$.ZodObject,...H$(J)})};o$.strictCreate=($,J)=>{return new o$({shape:()=>$,unknownKeys:"strict",catchall:q0.create(),typeName:W$.ZodObject,...H$(J)})};o$.lazycreate=($,J)=>{return new o$({shape:$,unknownKeys:"strip",catchall:q0.create(),typeName:W$.ZodObject,...H$(J)})};class JX extends F${_parse($){let{ctx:J}=this._processInputParams($),X=this._def.options;function Q(Y){for(let W of Y)if(W.result.status==="valid")return W.result;for(let W of Y)if(W.result.status==="dirty")return J.common.issues.push(...W.ctx.common.issues),W.result;let G=Y.map((W)=>new TJ(W.ctx.common.issues));return n(J,{code:u.invalid_union,unionErrors:G}),Y$}if(J.common.async)return Promise.all(X.map(async(Y)=>{let G={...J,common:{...J.common,issues:[]},parent:null};return{result:await Y._parseAsync({data:J.data,path:J.path,parent:G}),ctx:G}})).then(Q);else{let Y=void 0,G=[];for(let U of X){let M={...J,common:{...J.common,issues:[]},parent:null},O=U._parseSync({data:J.data,path:J.path,parent:M});if(O.status==="valid")return O;else if(O.status==="dirty"&&!Y)Y={result:O,ctx:M};if(M.common.issues.length)G.push(M.common.issues)}if(Y)return J.common.issues.push(...Y.ctx.common.issues),Y.result;let W=G.map((U)=>new TJ(U));return n(J,{code:u.invalid_union,unionErrors:W}),Y$}}get options(){return this._def.options}}JX.create=($,J)=>{return new JX({options:$,typeName:W$.ZodUnion,...H$(J)})};var T0=($)=>{if($ instanceof XX)return T0($.schema);else if($ instanceof tJ)return T0($.innerType());else if($ instanceof YX)return[$.value];else if($ instanceof s0)return $.options;else if($ instanceof GX)return Z$.objectValues($.enum);else if($ instanceof WX)return T0($._def.innerType);else if($ instanceof eQ)return[void 0];else if($ instanceof $X)return[null];else if($ instanceof sJ)return[void 0,...T0($.unwrap())];else if($ instanceof S0)return[null,...T0($.unwrap())];else if($ instanceof y9)return T0($.unwrap());else if($ instanceof MX)return T0($.unwrap());else if($ instanceof UX)return T0($._def.innerType);else return[]};class f9 extends F${_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.object)return n(J,{code:u.invalid_type,expected:m.object,received:J.parsedType}),Y$;let X=this.discriminator,Q=J.data[X],Y=this.optionsMap.get(Q);if(!Y)return n(J,{code:u.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[X]}),Y$;if(J.common.async)return Y._parseAsync({data:J.data,path:J.path,parent:J});else return Y._parseSync({data:J.data,path:J.path,parent:J})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create($,J,X){let Q=new Map;for(let Y of J){let G=T0(Y.shape[$]);if(!G.length)throw Error(`A discriminator value for key \`${$}\` could not be extracted from all schema options`);for(let W of G){if(Q.has(W))throw Error(`Discriminator property ${String($)} has duplicate value ${String(W)}`);Q.set(W,Y)}}return new f9({typeName:W$.ZodDiscriminatedUnion,discriminator:$,options:J,optionsMap:Q,...H$(X)})}}function MG($,J){let X=H0($),Q=H0(J);if($===J)return{valid:!0,data:$};else if(X===m.object&&Q===m.object){let Y=Z$.objectKeys(J),G=Z$.objectKeys($).filter((U)=>Y.indexOf(U)!==-1),W={...$,...J};for(let U of G){let M=MG($[U],J[U]);if(!M.valid)return{valid:!1};W[U]=M.data}return{valid:!0,data:W}}else if(X===m.array&&Q===m.array){if($.length!==J.length)return{valid:!1};let Y=[];for(let G=0;G<$.length;G++){let W=$[G],U=J[G],M=MG(W,U);if(!M.valid)return{valid:!1};Y.push(M.data)}return{valid:!0,data:Y}}else if(X===m.date&&Q===m.date&&+$===+J)return{valid:!0,data:$};else return{valid:!1}}class QX extends F${_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=(Y,G)=>{if(v9(Y)||v9(G))return Y$;let W=MG(Y.value,G.value);if(!W.valid)return n(X,{code:u.invalid_intersection_types}),Y$;if(k9(Y)||k9(G))J.dirty();return{status:J.value,value:W.data}};if(X.common.async)return Promise.all([this._def.left._parseAsync({data:X.data,path:X.path,parent:X}),this._def.right._parseAsync({data:X.data,path:X.path,parent:X})]).then(([Y,G])=>Q(Y,G));else return Q(this._def.left._parseSync({data:X.data,path:X.path,parent:X}),this._def.right._parseSync({data:X.data,path:X.path,parent:X}))}}QX.create=($,J,X)=>{return new QX({left:$,right:J,typeName:W$.ZodIntersection,...H$(X)})};class K0 extends F${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.array)return n(X,{code:u.invalid_type,expected:m.array,received:X.parsedType}),Y$;if(X.data.length<this._def.items.length)return n(X,{code:u.too_small,minimum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),Y$;if(!this._def.rest&&X.data.length>this._def.items.length)n(X,{code:u.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),J.dirty();let Y=[...X.data].map((G,W)=>{let U=this._def.items[W]||this._def.rest;if(!U)return null;return U._parse(new rJ(X,G,X.path,W))}).filter((G)=>!!G);if(X.common.async)return Promise.all(Y).then((G)=>{return EJ.mergeArray(J,G)});else return EJ.mergeArray(J,Y)}get items(){return this._def.items}rest($){return new K0({...this._def,rest:$})}}K0.create=($,J)=>{if(!Array.isArray($))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new K0({items:$,typeName:W$.ZodTuple,rest:null,...H$(J)})};class XY extends F${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.object)return n(X,{code:u.invalid_type,expected:m.object,received:X.parsedType}),Y$;let Q=[],Y=this._def.keyType,G=this._def.valueType;for(let W in X.data)Q.push({key:Y._parse(new rJ(X,W,X.path,W)),value:G._parse(new rJ(X,X.data[W],X.path,W)),alwaysSet:W in X.data});if(X.common.async)return EJ.mergeObjectAsync(J,Q);else return EJ.mergeObjectSync(J,Q)}get element(){return this._def.valueType}static create($,J,X){if(J instanceof F$)return new XY({keyType:$,valueType:J,typeName:W$.ZodRecord,...H$(X)});return new XY({keyType:oJ.create(),valueType:$,typeName:W$.ZodRecord,...H$(J)})}}class YY extends F${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.map)return n(X,{code:u.invalid_type,expected:m.map,received:X.parsedType}),Y$;let Q=this._def.keyType,Y=this._def.valueType,G=[...X.data.entries()].map(([W,U],M)=>{return{key:Q._parse(new rJ(X,W,X.path,[M,"key"])),value:Y._parse(new rJ(X,U,X.path,[M,"value"]))}});if(X.common.async){let W=new Map;return Promise.resolve().then(async()=>{for(let U of G){let M=await U.key,O=await U.value;if(M.status==="aborted"||O.status==="aborted")return Y$;if(M.status==="dirty"||O.status==="dirty")J.dirty();W.set(M.value,O.value)}return{status:J.value,value:W}})}else{let W=new Map;for(let U of G){let{key:M,value:O}=U;if(M.status==="aborted"||O.status==="aborted")return Y$;if(M.status==="dirty"||O.status==="dirty")J.dirty();W.set(M.value,O.value)}return{status:J.value,value:W}}}}YY.create=($,J,X)=>{return new YY({valueType:J,keyType:$,typeName:W$.ZodMap,...H$(X)})};class AQ extends F${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.set)return n(X,{code:u.invalid_type,expected:m.set,received:X.parsedType}),Y$;let Q=this._def;if(Q.minSize!==null){if(X.data.size<Q.minSize.value)n(X,{code:u.too_small,minimum:Q.minSize.value,type:"set",inclusive:!0,exact:!1,message:Q.minSize.message}),J.dirty()}if(Q.maxSize!==null){if(X.data.size>Q.maxSize.value)n(X,{code:u.too_big,maximum:Q.maxSize.value,type:"set",inclusive:!0,exact:!1,message:Q.maxSize.message}),J.dirty()}let Y=this._def.valueType;function G(U){let M=new Set;for(let O of U){if(O.status==="aborted")return Y$;if(O.status==="dirty")J.dirty();M.add(O.value)}return{status:J.value,value:M}}let W=[...X.data.values()].map((U,M)=>Y._parse(new rJ(X,U,X.path,M)));if(X.common.async)return Promise.all(W).then((U)=>G(U));else return G(W)}min($,J){return new AQ({...this._def,minSize:{value:$,message:e.toString(J)}})}max($,J){return new AQ({...this._def,maxSize:{value:$,message:e.toString(J)}})}size($,J){return this.min($,J).max($,J)}nonempty($){return this.min(1,$)}}AQ.create=($,J)=>{return new AQ({valueType:$,minSize:null,maxSize:null,typeName:W$.ZodSet,...H$(J)})};class rQ extends F${constructor(){super(...arguments);this.validate=this.implement}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.function)return n(J,{code:u.invalid_type,expected:m.function,received:J.parsedType}),Y$;function X(W,U){return $Y({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,oQ(),j0].filter((M)=>!!M),issueData:{code:u.invalid_arguments,argumentsError:U}})}function Q(W,U){return $Y({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,oQ(),j0].filter((M)=>!!M),issueData:{code:u.invalid_return_type,returnTypeError:U}})}let Y={errorMap:J.common.contextualErrorMap},G=J.data;if(this._def.returns instanceof RQ){let W=this;return FJ(async function(...U){let M=new TJ([]),O=await W._def.args.parseAsync(U,Y).catch((q)=>{throw M.addIssue(X(U,q)),M}),V=await Reflect.apply(G,this,O);return await W._def.returns._def.type.parseAsync(V,Y).catch((q)=>{throw M.addIssue(Q(V,q)),M})})}else{let W=this;return FJ(function(...U){let M=W._def.args.safeParse(U,Y);if(!M.success)throw new TJ([X(U,M.error)]);let O=Reflect.apply(G,this,M.data),V=W._def.returns.safeParse(O,Y);if(!V.success)throw new TJ([Q(O,V.error)]);return V.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(...$){return new rQ({...this._def,args:K0.create($).rest(i0.create())})}returns($){return new rQ({...this._def,returns:$})}implement($){return this.parse($)}strictImplement($){return this.parse($)}static create($,J,X){return new rQ({args:$?$:K0.create([]).rest(i0.create()),returns:J||i0.create(),typeName:W$.ZodFunction,...H$(X)})}}class XX extends F${get schema(){return this._def.getter()}_parse($){let{ctx:J}=this._processInputParams($);return this._def.getter()._parse({data:J.data,path:J.path,parent:J})}}XX.create=($,J)=>{return new XX({getter:$,typeName:W$.ZodLazy,...H$(J)})};class YX extends F${_parse($){if($.data!==this._def.value){let J=this._getOrReturnCtx($);return n(J,{received:J.data,code:u.invalid_literal,expected:this._def.value}),Y$}return{status:"valid",value:$.data}}get value(){return this._def.value}}YX.create=($,J)=>{return new YX({value:$,typeName:W$.ZodLiteral,...H$(J)})};function qU($,J){return new s0({values:$,typeName:W$.ZodEnum,...H$(J)})}class s0 extends F${_parse($){if(typeof $.data!=="string"){let J=this._getOrReturnCtx($),X=this._def.values;return n(J,{expected:Z$.joinValues(X),received:J.parsedType,code:u.invalid_type}),Y$}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has($.data)){let J=this._getOrReturnCtx($),X=this._def.values;return n(J,{received:J.data,code:u.invalid_enum_value,options:X}),Y$}return FJ($.data)}get options(){return this._def.values}get enum(){let $={};for(let J of this._def.values)$[J]=J;return $}get Values(){let $={};for(let J of this._def.values)$[J]=J;return $}get Enum(){let $={};for(let J of this._def.values)$[J]=J;return $}extract($,J=this._def){return s0.create($,{...this._def,...J})}exclude($,J=this._def){return s0.create(this.options.filter((X)=>!$.includes(X)),{...this._def,...J})}}s0.create=qU;class GX extends F${_parse($){let J=Z$.getValidEnumValues(this._def.values),X=this._getOrReturnCtx($);if(X.parsedType!==m.string&&X.parsedType!==m.number){let Q=Z$.objectValues(J);return n(X,{expected:Z$.joinValues(Q),received:X.parsedType,code:u.invalid_type}),Y$}if(!this._cache)this._cache=new Set(Z$.getValidEnumValues(this._def.values));if(!this._cache.has($.data)){let Q=Z$.objectValues(J);return n(X,{received:X.data,code:u.invalid_enum_value,options:Q}),Y$}return FJ($.data)}get enum(){return this._def.values}}GX.create=($,J)=>{return new GX({values:$,typeName:W$.ZodNativeEnum,...H$(J)})};class RQ extends F${unwrap(){return this._def.type}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.promise&&J.common.async===!1)return n(J,{code:u.invalid_type,expected:m.promise,received:J.parsedType}),Y$;let X=J.parsedType===m.promise?J.data:Promise.resolve(J.data);return FJ(X.then((Q)=>{return this._def.type.parseAsync(Q,{path:J.path,errorMap:J.common.contextualErrorMap})}))}}RQ.create=($,J)=>{return new RQ({type:$,typeName:W$.ZodPromise,...H$(J)})};class tJ extends F${innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===W$.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=this._def.effect||null,Y={addIssue:(G)=>{if(n(X,G),G.fatal)J.abort();else J.dirty()},get path(){return X.path}};if(Y.addIssue=Y.addIssue.bind(Y),Q.type==="preprocess"){let G=Q.transform(X.data,Y);if(X.common.async)return Promise.resolve(G).then(async(W)=>{if(J.value==="aborted")return Y$;let U=await this._def.schema._parseAsync({data:W,path:X.path,parent:X});if(U.status==="aborted")return Y$;if(U.status==="dirty")return FQ(U.value);if(J.value==="dirty")return FQ(U.value);return U});else{if(J.value==="aborted")return Y$;let W=this._def.schema._parseSync({data:G,path:X.path,parent:X});if(W.status==="aborted")return Y$;if(W.status==="dirty")return FQ(W.value);if(J.value==="dirty")return FQ(W.value);return W}}if(Q.type==="refinement"){let G=(W)=>{let U=Q.refinement(W,Y);if(X.common.async)return Promise.resolve(U);if(U instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return W};if(X.common.async===!1){let W=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(W.status==="aborted")return Y$;if(W.status==="dirty")J.dirty();return G(W.value),{status:J.value,value:W.value}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((W)=>{if(W.status==="aborted")return Y$;if(W.status==="dirty")J.dirty();return G(W.value).then(()=>{return{status:J.value,value:W.value}})})}if(Q.type==="transform")if(X.common.async===!1){let G=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(!n0(G))return Y$;let W=Q.transform(G.value,Y);if(W instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:J.value,value:W}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((G)=>{if(!n0(G))return Y$;return Promise.resolve(Q.transform(G.value,Y)).then((W)=>({status:J.value,value:W}))});Z$.assertNever(Q)}}tJ.create=($,J,X)=>{return new tJ({schema:$,typeName:W$.ZodEffects,effect:J,...H$(X)})};tJ.createWithPreprocess=($,J,X)=>{return new tJ({schema:J,effect:{type:"preprocess",transform:$},typeName:W$.ZodEffects,...H$(X)})};class sJ extends F${_parse($){if(this._getType($)===m.undefined)return FJ(void 0);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}sJ.create=($,J)=>{return new sJ({innerType:$,typeName:W$.ZodOptional,...H$(J)})};class S0 extends F${_parse($){if(this._getType($)===m.null)return FJ(null);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}S0.create=($,J)=>{return new S0({innerType:$,typeName:W$.ZodNullable,...H$(J)})};class WX extends F${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;if(J.parsedType===m.undefined)X=this._def.defaultValue();return this._def.innerType._parse({data:X,path:J.path,parent:J})}removeDefault(){return this._def.innerType}}WX.create=($,J)=>{return new WX({innerType:$,typeName:W$.ZodDefault,defaultValue:typeof J.default==="function"?J.default:()=>J.default,...H$(J)})};class UX extends F${_parse($){let{ctx:J}=this._processInputParams($),X={...J,common:{...J.common,issues:[]}},Q=this._def.innerType._parse({data:X.data,path:X.path,parent:{...X}});if(aQ(Q))return Q.then((Y)=>{return{status:"valid",value:Y.status==="valid"?Y.value:this._def.catchValue({get error(){return new TJ(X.common.issues)},input:X.data})}});else return{status:"valid",value:Q.status==="valid"?Q.value:this._def.catchValue({get error(){return new TJ(X.common.issues)},input:X.data})}}removeCatch(){return this._def.innerType}}UX.create=($,J)=>{return new UX({innerType:$,typeName:W$.ZodCatch,catchValue:typeof J.catch==="function"?J.catch:()=>J.catch,...H$(J)})};class GY extends F${_parse($){if(this._getType($)!==m.nan){let X=this._getOrReturnCtx($);return n(X,{code:u.invalid_type,expected:m.nan,received:X.parsedType}),Y$}return{status:"valid",value:$.data}}}GY.create=($)=>{return new GY({typeName:W$.ZodNaN,...H$($)})};var pz=Symbol("zod_brand");class y9 extends F${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;return this._def.type._parse({data:X,path:J.path,parent:J})}unwrap(){return this._def.type}}class WY extends F${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.common.async)return(async()=>{let Y=await this._def.in._parseAsync({data:X.data,path:X.path,parent:X});if(Y.status==="aborted")return Y$;if(Y.status==="dirty")return J.dirty(),FQ(Y.value);else return this._def.out._parseAsync({data:Y.value,path:X.path,parent:X})})();else{let Q=this._def.in._parseSync({data:X.data,path:X.path,parent:X});if(Q.status==="aborted")return Y$;if(Q.status==="dirty")return J.dirty(),{status:"dirty",value:Q.value};else return this._def.out._parseSync({data:Q.value,path:X.path,parent:X})}}static create($,J){return new WY({in:$,out:J,typeName:W$.ZodPipeline})}}class MX extends F${_parse($){let J=this._def.innerType._parse($),X=(Q)=>{if(n0(Q))Q.value=Object.freeze(Q.value);return Q};return aQ(J)?J.then((Q)=>X(Q)):X(J)}unwrap(){return this._def.innerType}}MX.create=($,J)=>{return new MX({innerType:$,typeName:W$.ZodReadonly,...H$(J)})};function MU($,J){let X=typeof $==="function"?$(J):typeof $==="string"?{message:$}:$;return typeof X==="string"?{message:X}:X}function KU($,J={},X){if($)return LQ.create().superRefine((Q,Y)=>{let G=$(Q);if(G instanceof Promise)return G.then((W)=>{if(!W){let U=MU(J,Q),M=U.fatal??X??!0;Y.addIssue({code:"custom",...U,fatal:M})}});if(!G){let W=MU(J,Q),U=W.fatal??X??!0;Y.addIssue({code:"custom",...W,fatal:U})}return});return LQ.create()}var dz={object:o$.lazycreate},W$;(function($){$.ZodString="ZodString",$.ZodNumber="ZodNumber",$.ZodNaN="ZodNaN",$.ZodBigInt="ZodBigInt",$.ZodBoolean="ZodBoolean",$.ZodDate="ZodDate",$.ZodSymbol="ZodSymbol",$.ZodUndefined="ZodUndefined",$.ZodNull="ZodNull",$.ZodAny="ZodAny",$.ZodUnknown="ZodUnknown",$.ZodNever="ZodNever",$.ZodVoid="ZodVoid",$.ZodArray="ZodArray",$.ZodObject="ZodObject",$.ZodUnion="ZodUnion",$.ZodDiscriminatedUnion="ZodDiscriminatedUnion",$.ZodIntersection="ZodIntersection",$.ZodTuple="ZodTuple",$.ZodRecord="ZodRecord",$.ZodMap="ZodMap",$.ZodSet="ZodSet",$.ZodFunction="ZodFunction",$.ZodLazy="ZodLazy",$.ZodLiteral="ZodLiteral",$.ZodEnum="ZodEnum",$.ZodEffects="ZodEffects",$.ZodNativeEnum="ZodNativeEnum",$.ZodOptional="ZodOptional",$.ZodNullable="ZodNullable",$.ZodDefault="ZodDefault",$.ZodCatch="ZodCatch",$.ZodPromise="ZodPromise",$.ZodBranded="ZodBranded",$.ZodPipeline="ZodPipeline",$.ZodReadonly="ZodReadonly"})(W$||(W$={}));var cz=($,J={message:`Input not instance of ${$.name}`})=>KU((X)=>X instanceof $,J),zU=oJ.create,EU=o0.create,nz=GY.create,iz=a0.create,FU=tQ.create,oz=NQ.create,az=JY.create,sz=eQ.create,rz=$X.create,tz=LQ.create,ez=i0.create,$E=q0.create,JE=QY.create,QE=aJ.create,XE=o$.create,YE=o$.strictCreate,GE=JX.create,WE=f9.create,UE=QX.create,ME=K0.create,OE=XY.create,VE=YY.create,HE=AQ.create,qE=rQ.create,KE=XX.create,zE=YX.create,EE=s0.create,FE=GX.create,NE=RQ.create,LE=tJ.create,AE=sJ.create,RE=S0.create,DE=tJ.createWithPreprocess,ZE=WY.create,BE=()=>zU().optional(),jE=()=>EU().optional(),TE=()=>FU().optional(),SE={string:($)=>oJ.create({...$,coerce:!0}),number:($)=>o0.create({...$,coerce:!0}),boolean:($)=>tQ.create({...$,coerce:!0}),bigint:($)=>a0.create({...$,coerce:!0}),date:($)=>NQ.create({...$,coerce:!0})};var IE=Y$;function VG($){if(CE($)===6)return!0;if($.includes("://")||$.includes("/")||$.includes(":"))return!1;if($==="localhost")return!0;if($.startsWith("*.")){let J=$.slice(2);if(!J.includes(".")||J.startsWith(".")||J.endsWith("."))return!1;let X=J.split(".");return X.length>=2&&X.every((Q)=>Q.length>0)}if($.includes("*"))return!1;return $.includes(".")&&!$.startsWith(".")&&!$.endsWith(".")}var HG='Invalid domain pattern. Must be a valid domain (e.g., "example.com"), a wildcard (e.g., "*.example.com"), or a bracketed IPv6 literal (e.g., "[::1]", "[2001:db8::1]:443"). Overly broad patterns like "*.com" or "*" are not allowed for security reasons.',h9=x.string().refine(VG,{message:HG});function LU($){let J=$.indexOf(":");return!(J!==-1&&$.indexOf(":",J+1)!==-1)||$.startsWith("[")}var PE=x.string().refine(($)=>LU($)&&VG(cX($).hostPattern),{message:HG+' An optional ":port" suffix (1-65535) restricts the entry to that port.'}),_E=x.string().refine(($)=>{if(!LU($))return!1;let{hostPattern:J}=cX($);return J==="*"||VG(J)},{message:HG+' In deniedDomains a bare "*" (deny-all) is also accepted, and an optional ":port" suffix (1-65535) restricts the entry to that port.'}),UY=x.string().min(1,"Path cannot be empty"),NU=x.string().min(1,"Path cannot be empty").refine(($)=>wE($),{message:"Binary path must be absolute"}),xE=x.object({socketPath:x.string().min(1).describe("Unix socket path to the MITM proxy"),domains:x.array(h9).min(1).describe('Domains to route through the MITM proxy (e.g., ["api.example.com", "*.internal.org"])')}),vE=x.object({http:x.string().url().optional().describe("Upstream proxy URL for plain HTTP traffic"),https:x.string().url().optional().describe("Upstream proxy URL for HTTPS/CONNECT traffic (falls back to http if unset)"),noProxy:x.string().optional().describe("Comma-separated NO_PROXY list (hostname suffixes and CIDR ranges). Matching destinations connect directly instead of via the parent proxy.")}),AU=x.enum(["deny","mask"]),b9=x.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/,"Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores"),RU=x.string().superRefine(($,J)=>{try{let{groupCount:X}=E7($);if(X<1)J.addIssue({code:x.ZodIssueCode.custom,message:"extract must contain at least one capturing group \u2014 group 1 is "+'the credential value to mask (e.g. "token:\\s*(\\S+)").'})}catch(X){J.addIssue({code:x.ZodIssueCode.custom,message:X instanceof Error?X.message:"Credential extract pattern is invalid"})}}),kE=x.object({path:UY.describe("Path to a credential file or directory. Supports the same path forms as filesystem.denyRead (absolute paths and ~ expansion)."),mode:AU.describe("Access mode for this path"),extract:RU.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the file is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe("What to do when extract matches nothing (or, with decode, no "+'candidate verifies): "warn" (default \u2014 stderr warning, file left '+'readable), "deny" (degrade to mode "deny" \u2014 file unreadable), or '+'"error" (throw at wrap time). Only meaningful with mode "mask" and extract or decode set.'),decode:x.enum(["jwt"]).optional().describe('Optional encoded-credential format. "jwt": decodes recognized JWTs so masking can target fields inside them (see maskClaims). Candidates are located with a built-in JWT regex (or the explicit extract pattern, if set) and verified to actually be JWTs before masking. Without maskClaims, the whole decoded value is treated as the credential and replaced with a structurally valid fake JWT, so client-side token parsing keeps working. If no candidate verifies, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches in any verified token, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskDuplicates:x.boolean().optional().describe("If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the "+"corresponding sentinel \u2014 for a secret repeated where the regex "+`does not reach (e.g. in a comment). Matches raw substrings: short or common credential values may corrupt unrelated content, so this is intended for long, high-entropy secrets. With decode, only values that passed verification are scanned; duplicates reuse the verified value's fake without re-verification. Defaults to false. Only meaningful with mode "mask" and extract or decode set; accepted but ignored otherwise.`),injectHosts:x.array(h9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),fE=x.object({name:b9.describe("Environment variable name"),mode:AU.describe("Access mode for this environment variable"),extract:RU.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the value is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe('What to do when extract matches nothing: "warn" (default \u2014 stderr '+'warning, variable passes through unmasked), "deny" (variable unset inside the sandbox), or "error" (throw at wrap time). Only meaningful with mode "mask" and extract set.'),decode:x.enum(["jwt"]).optional().describe(`Optional encoded-credential format. "jwt": the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".`),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHosts:x.array(h9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),yE=x.object({accessKeyIdVar:b9.describe("Name of the masked env var holding the AWS access key id."),secretAccessKeyVar:b9.describe("Name of the masked env var holding the AWS secret access key."),sessionTokenVar:b9.optional().describe("Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.")}).strict(),OG=x.enum(["deny","passthrough"]),bE=x.object({streaming:OG.optional().describe('Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. Default "deny".'),presigned:OG.optional().describe('Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. Default "deny".'),sigv4a:OG.optional().describe('Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. Default "deny".')}).strict(),DU=x.object({files:x.array(kE).optional().describe("Credential files or directories to protect"),envVars:x.array(fE).optional().describe("Environment variables to protect"),allowPlaintextInject:x.boolean().optional().describe("Allow sentinel\u2192real substitution on the plain-HTTP proxy path. "+"Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures."),awsPairs:x.array(yE).optional().describe("Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked."),sigv4:bE.optional().describe('Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: "deny" (default) or "passthrough".')}).strict(),ZU=x.object({allowedDomains:x.array(PE).describe('List of allowed domains (e.g., ["github.com", "*.npmjs.org", "api.example.com:443"]). An optional ":port" suffix restricts the entry to that destination port.'),deniedDomains:x.array(_E).describe('List of denied domains. Unlike allowedDomains, a bare "*" is accepted here (deny-all). An optional ":port" suffix (e.g., "*:22") restricts the entry to that destination port.'),deniedDomainReasons:x.record(x.string(),x.string().min(1)).optional().describe('Optional model-facing reason keyed by the exact deniedDomains entry it explains (e.g., {"github.com:22": "SSH pushes to GitHub are blocked; use an https remote"}). Reported in the <sandbox_violations> line when that entry denies a connection; entries without one use a generic reason. Keys are matched by exact entry string, so a key with no matching deniedDomains entry never fires.'),strictAllowlist:x.boolean().optional().describe("If true, hosts not in allowedDomains are denied without consulting the ask callback. Set this when allowedDomains is policy enforcement, not a prompt-suppression hint."),allowUnixSockets:x.array(x.string()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),allowAllUnixSockets:x.boolean().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),allowLocalBinding:x.boolean().optional().describe("Whether to allow binding to local ports (default: false)"),allowMachLookup:x.array(x.string().refine(($)=>{return!($.endsWith("*")?$.slice(0,-1):$).includes("*")},{message:'Wildcards are only allowed as a single trailing "*" (e.g., "com.example.*" or "*" for all services).'})).optional().describe('macOS only: Additional XPC/Mach service names to allow looking up. Supports trailing-wildcard prefix matching (e.g., "2BUA8C4S2C.com.1password.*"). Needed for tools like 1Password CLI, Playwright, or the iOS Simulator that communicate via XPC.'),httpProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external HTTP proxy to use instead of starting a local one. When provided, the library will skip starting its own HTTP proxy and use this port. The external proxy must handle domain filtering."),socksProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external SOCKS proxy to use instead of starting a local one. When provided, the library will skip starting its own SOCKS proxy and use this port. The external proxy must handle domain filtering."),mitmProxy:xE.optional().describe("Optional MITM proxy configuration. Routes matching domains through an upstream proxy via Unix socket while SRT still handles allow/deny filtering."),filterRequest:x.custom(($)=>typeof $==="function",{message:"filterRequest must be a function"}).optional().describe("Per-request filter callback. Receives the parsed HTTP request (web-standard Request) and returns {action, reason?}. Denied requests get a 403 with the reason. If the callback throws, the request is denied. Applies to plain HTTP through the proxy and, when tlsTerminate is configured, to terminated HTTPS. SRT does not provide a policy language; library consumers own matching."),tlsTerminate:x.object({caCertPath:x.string().min(1).optional().describe("Path to a PEM-encoded CA certificate. The sandboxed child is configured to trust this CA, and the TLS-terminating proxy uses it to sign per-host certificates. If omitted, on Windows SRT generates-if-absent a persistent CA under %ProgramData%\\sandbox-runtime\\ca\\ and trusts it in the sandbox user's Root store; on other platforms SRT generates an ephemeral CA into a temp directory for the lifetime of the session."),caKeyPath:x.string().min(1).optional().describe("Path to the PEM-encoded private key for caCertPath."),excludeDomains:x.array(h9).optional().describe("Domain patterns (same syntax as allowedDomains) whose HTTPS connections are NOT terminated. Matching CONNECTs are opaque byte tunnels: still subject to the allow/deny domain lists, but the sandboxed client completes its own TLS handshake with the upstream, so filterRequest and credential injection do not apply to their HTTPS traffic (plain-HTTP requests to the same hosts keep the normal request pipeline). Use for hosts the proxy must not re-originate: mTLS upstreams (only the client holds the client certificate) and clients that pin the upstream certificate and would reject the MITM CA. Hosts still need to be reachable via allowedDomains; this list only changes how they are tunnelled."),extraCaCertPaths:x.array(x.string().min(1)).optional().describe("Paths to PEM CA certificate files appended to the trust bundle the sandboxed child is pointed at, after the MITM CA and the host's regular roots. Use for site-local roots (e.g. an internal mTLS CA) presented by excluded/passthrough hosts, so the child can verify them itself. Only the CERTIFICATE blocks of each file are copied; files that are missing, unreadable, or contain no PEM CERTIFICATE block are skipped (with a debug log), so paths that exist on only some hosts are safe to list.")}).refine(($)=>!$.caCertPath===!$.caKeyPath,{message:"caCertPath and caKeyPath must be provided together"}).optional().describe("[EXPERIMENTAL] Enable in-process TLS termination so HTTPS request/response bodies are visible to SRT. Provide a CA cert+key, or omit both to have SRT generate an ephemeral one."),parentProxy:vE.optional().describe("Upstream HTTP proxy for outbound connections. When set, SRT's proxy tunnels non-mitmProxy traffic through this parent instead of connecting directly. Falls back to HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars if unset.")}),BU=x.object({disabled:x.boolean().optional().describe("Disable all filesystem policy enforcement. When true, no read or write rules are emitted: denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, .claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process is trusted with full host filesystem access. Network and credential-env restrictions still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs."),denyRead:x.array(UY).describe("Paths denied for reading"),allowRead:x.array(UY).optional().describe("Paths to re-allow reading within denied regions (takes precedence over denyRead). Use with denyRead to deny a broad region then allow back specific subdirectories."),allowWrite:x.array(UY).describe("Paths allowed for writing"),denyWrite:x.array(UY).describe("Paths denied for writing (takes precedence over allowWrite)"),allowGitConfig:x.boolean().optional().describe("Allow writes to .git/config files (default: false). Enables git remote URL updates while keeping .git/hooks protected.")}),jU=x.record(x.string(),x.array(x.string())).describe('Map of command patterns to filesystem paths to ignore violations for. Use "*" to match all commands'),TU=x.object({command:x.string().describe("The ripgrep command to execute"),args:x.array(x.string()).optional().describe("Additional arguments to pass before ripgrep args"),argv0:x.string().optional().describe("Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])")}),SU=x.object({safeDirectories:x.array(x.string()).default([]).describe("Directories git should treat as safe (`safe.directory`) even though they're owned by a different user inside the sandbox. Use for the repo top-level when launching from a subdirectory. Does NOT grant write.")}),IU=x.object({path:x.string().min(1).describe("Path to the srt-win binary. Pass the exported VENDORED_SRT_WIN_EXE constant to use the packaged vendor/srt-win/<arch>/srt-win.exe (see its WARNING: in a dev checkout that file may sit inside your sandbox write grant). The binary is spawned with the `--srt-win` argv[1] sentinel so a multicall dispatcher can route to srt-win's CLI.")}),CU=x.object({sandboxUser:x.string().min(1).max(20,"Windows local usernames are limited to 20 characters").optional().describe("Name for the dedicated sandbox user account that `srt-win install` creates and the sandboxed child runs as. Default: `srt-sandbox`. Install refuses if an account by this name already exists and srt-win did not create it (it will not rotate the password of an account it does not own). Must match what `srt-win install --sandbox-user` was run with."),sublayerGuid:x.string().uuid().optional().describe("WFP sublayer GUID under which the filters were installed. Omit to use the srt-win compile-time default. Set this when filters were installed by enterprise tooling under a custom sublayer."),wfpSublayerGuid:x.string().uuid().optional().describe("Deprecated alias for sublayerGuid."),proxyPortRange:x.tuple([x.number().int().min(1),x.number().int().max(65535)]).refine(([$,J])=>$<=J&&J-$<=64,{message:"low must be \u2264 high and range width \u2264 64"}).optional().describe("Inclusive [low, high] port range the JS mux proxy listeners bind inside. MUST match the range passed to `srt-win install "+"--proxy-port-range` (default 60080\u201360089) \u2014 the WFP loopback "+"permit only covers ports in that range."),srtWin:IU.optional().describe("How to locate/invoke the srt-win helper binary. `srtWin.path` is "+"required to use the Windows sandbox \u2014 your own (multicall) binary, "+"or the exported VENDORED_SRT_WIN_EXE constant for the packaged exe.")}),hE=x.object({applyPath:x.string().optional().describe("Path to the apply-seccomp binary"),argv0:x.string().optional().describe("Invoke apply-seccomp as a multicall binary that dispatches on the ARGV0 environment variable. When set, applyPath is used verbatim (no existence check) and the invocation inside bwrap is prefixed with ARGV0=<this value>. The caller is responsible for ensuring applyPath resolves inside the bwrap namespace and that the target binary implements the apply-seccomp interface when ARGV0 matches.")}),uE=x.object({network:ZU.describe("Network restrictions configuration"),filesystem:BU.describe("Filesystem restrictions configuration"),credentials:DU.optional().describe("Credential handling configuration. Only the explicitly declared files and environment variables are restricted."),ignoreViolations:jU.optional().describe("Optional configuration for ignoring specific violations"),enableWeakerNestedSandbox:x.boolean().optional().describe("Enable weaker nested sandbox mode (for Docker environments)"),runAsUid:x.number().int().nonnegative().optional().describe("ARA: uid to drop the sandboxed command to (bwrap --uid)"),runAsGid:x.number().int().nonnegative().optional().describe("ARA: gid to drop the sandboxed command to (bwrap --gid)"),runAsHostUid:x.number().int().positive().optional().describe("ARA: real host uid used to launch the sandboxed bwrap child"),runAsHostGid:x.number().int().positive().optional().describe("ARA: real host gid used to launch the sandboxed bwrap child"),runAsHostHome:x.string().min(1).optional().describe("ARA: HOME set inside a real-host-uid sandbox child"),runAsHostUser:x.string().min(1).optional().describe("ARA: USER and LOGNAME set inside a real-host-uid sandbox child"),enableWeakerNetworkIsolation:x.boolean().optional().describe("Enable weaker network isolation to allow access to com.apple.trustd.agent (macOS only). This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data exfiltration vector through the trustd service. Only enable if you need Go TLS verification."),allowAppleEvents:x.boolean().optional().describe("Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or network restrictions), and can script running apps subject to TCC automation consent. Default: false."),ripgrep:TU.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),mandatoryDenySearchDepth:x.number().int().min(1).max(10).optional().describe("Maximum directory depth to search for dangerous files on Linux (default: 3). Higher values provide more protection but slower performance."),allowPty:x.boolean().optional().describe("Allow pseudo-terminal (pty) operations (macOS only)"),seccomp:hE.optional().describe("Custom seccomp binary paths (Linux only)."),bwrapPath:NU.optional().describe('Linux only: absolute path to the bwrap (bubblewrap) binary. When set, this path is used directly instead of resolving "bwrap" via PATH.'),socatPath:NU.optional().describe('Linux only: absolute path to the socat binary. When set, this path is used directly instead of resolving "socat" via PATH.'),windows:CU.optional().describe("Windows-specific settings (WFP sublayer, proxy port range)."),git:SU.optional().describe("Git configuration to inject via GIT_CONFIG_* env vars (cross-platform). `safeDirectories` marks paths as `safe.directory` without adding them to `filesystem.allowWrite`.")}).superRefine(($,J)=>{let X=$.credentials;if(!X)return;let Q=$.network.allowedDomains.map(nX),Y=(M,O)=>{for(let[V,H]of M.entries())if(!I9(H,Q))J.addIssue({code:x.ZodIssueCode.custom,path:[...O,V],message:`injectHosts entry "${H}" is not reachable via `+`network.allowedDomains \u2014 add "${H}" (or a covering wildcard) to allowedDomains, or remove it from injectHosts.`})},G=!1,W=(M,O)=>{if(M.injectHosts)Y(M.injectHosts,[...O,"injectHosts"]);if(M.mode!=="mask")return;G=!0;let V=$.network.tlsTerminate?.excludeDomains;if(V?.length){if(M.injectHosts){for(let[H,q]of M.injectHosts.entries())if(I9(q,V))J.addIssue({code:x.ZodIssueCode.custom,path:[...O,"injectHosts",H],message:`injectHosts entry "${q}" is entirely covered by network.tlsTerminate.excludeDomains. Credential injection only runs on TLS-terminated connections, so this host would receive the placeholder instead of the credential. Remove it from one of the two lists.`})}else if(Q.length>0&&Q.every((H)=>I9(H,V)))J.addIssue({code:x.ZodIssueCode.custom,path:O,message:"This masked credential has no injectHosts, so it defaults "+"to network.allowedDomains \u2014 but "+"network.tlsTerminate.excludeDomains covers every allowed domain, so it could never be injected anywhere. Credential injection only runs on TLS-terminated connections."})}if(M.injectHosts!==void 0&&M.injectHosts.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:O,message:"injectHosts is explicitly empty \u2014 the credential would be "+"masked but never injected. Omit injectHosts to default to network.allowedDomains, or list the intended hosts."})};for(let[M,O]of(X.envVars??[]).entries()){if(W(O,["credentials","envVars",M]),O.maskClaims!==void 0&&O.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the whole value.'});if(O.maskClaims!==void 0&&O.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."})}for(let[M,O]of(X.files??[]).entries()){if(W(O,["credentials","files",M]),O.maskClaims!==void 0&&O.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the extracted value whole.'});if(O.maskClaims!==void 0&&O.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."});if(O.mode==="mask"&&O.path.endsWith("/"))J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"path"],message:`Credential mode "mask" applies to a single file, not a directory. Use mode "deny" for "${O.path}", or point at the credential file inside it.`})}let U=new Set;for(let[M,O]of(X.awsPairs??[]).entries()){let V=[["accessKeyIdVar",O.accessKeyIdVar],["secretAccessKeyVar",O.secretAccessKeyVar]];if(O.sessionTokenVar!==void 0)V.push(["sessionTokenVar",O.sessionTokenVar]);for(let[H,q]of V){let F=["credentials","awsPairs",M,H];if(U.has(q)){J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" appears in more than one awsPairs slot (within `+"or across pairs) \u2014 each variable can fill exactly one slot."});continue}U.add(q);let K=(X.envVars??[]).find((A)=>A.name===q);if(K===void 0||K.mode!=="mask")J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" does not reference a credentials.envVars entry `+'with mode "mask" \u2014 an AWS pair links already-masked '+"variables; add the entry (masking is the opt-in for SigV4 re-signing)."});else if(K.extract!==void 0||K.decode!==void 0)J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" uses extract/decode, but an AWS pair member must be masked whole-value: the SigV4 trigger is an exact match of the fake access key id, and the signer needs the entire real value.`})}}if(G&&$.network.tlsTerminate===void 0&&!X.allowPlaintextInject)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials"],message:"Credential masking requires network.tlsTerminate so substitution runs only over a verified TLS connection. Enable tlsTerminate, or set credentials.allowPlaintextInject to opt out (not recommended)."})});export{I5 as windowsTrustCaAsync,jK as windowsTrustCa,w5 as windowsStateDir,u7 as windowsInstallInstructions,p7 as verifyWindowsWfpEgress,xX as validateCaPair,IK as uninstallWindowsSandbox,o7 as stampWindowsAcl,S9 as revokeWindowsAcl,T9 as restoreWindowsAcl,wJ as resolveSrtWin,CK as parseWindowsSandboxError,D9 as parseWindowsBinShell,qX as isUncPath,SK as installWindowsSandboxAsync,TK as installWindowsSandbox,a7 as grantWindowsAcl,m9 as getWslVersion,S5 as getWindowsWfpStatusAsync,T5 as getWindowsWfpStatus,dX as getWindowsSandboxUserStatusAsync,d7 as getWindowsSandboxUserStatus,c7 as getWindowsSandboxCaCert,BK as getSrtWinPath,DQ as getDefaultWritePaths,oY as generateCa,j9 as expandWindowsFsPaths,n7 as ensurePersistentWindowsCa,j5 as checkWindowsSandboxStatusAsync,B5 as checkWindowsSandboxStatus,s7 as checkWindowsDependenciesAsync,gQ as certThumbprint,KX as buildGitConfigEnv,L$ as WindowsSandboxError,CU as WindowsConfigSchema,ZK as VENDORED_SRT_WIN_EXE,IU as SrtWinConfigSchema,L9 as SandboxViolationStore,uE as SandboxRuntimeConfigSchema,Nz as SandboxManager,A5 as SRT_WIN_DISPATCH_ARG1,TU as RipgrepConfigSchema,ZU as NetworkConfigSchema,jU as IgnoreViolationsConfigSchema,SU as GitConfigSchema,BU as FilesystemConfigSchema,R9 as DEFAULT_WINDOWS_PROXY_PORT_RANGE,DU as CredentialsConfigSchema};
71
+ No logout is needed: the WFP filter keys on the dedicated \`srt-sandbox\` user's SID, so your network is unaffected.`}function F5($){try{return{status:"fulfilled",value:$()}}catch(J){return{status:"rejected",reason:J}}}function f5($,J,X){let Q=[],Y=[];if(J.status==="rejected")return Q.push(`srt-win user status failed: ${J.reason.message}`),{errors:Q,warnings:Y};let G=J.value;if(!G.provisioned||!G.credPresent)Q.push(`Sandbox user is not provisioned (user=${G.provisioned}, cred=${G.credPresent}). `+g7($));let W=X();if(W.status==="rejected")return Q.push(`srt-win wfp status failed: ${W.reason.message}`),{errors:Q,warnings:Y};let U=W.value;if(U.state==="cannot-read")Z(`[Sandbox Windows] wfp status cannot-read (non-elevated): ${U.hint}`);else if(U.state!=="installed"){if(G.provisioned&&G.credPresent)Q.push(`WFP filters not installed under sublayer ${$??"(default)"}. `+g7($))}else if(U.portRange)Z(`[Sandbox Windows] WFP installed: ${U.filters} filters, proxy port range ${U.portRange[0]}-${U.portRange[1]}`);return{errors:Q,warnings:Y}}function y5($={}){let J;try{J=$.srtWin??wJ()}catch(X){return{errors:[X.message],warnings:[]}}return Z(`[Sandbox Windows] using srt-win at ${J.exe}`),f5($.sublayerGuid,F5(()=>c7({srtWin:J})),()=>F5(()=>S5({sublayerGuid:$.sublayerGuid,srtWin:J})))}async function r7($={}){let J;try{J=$.srtWin??wJ()}catch(Y){return{errors:[Y.message],warnings:[]}}Z(`[Sandbox Windows] using srt-win at ${J.exe}`);let[X,Q]=await Promise.allSettled([dX({srtWin:J}),I5({sublayerGuid:$.sublayerGuid,srtWin:J})]);return f5($.sublayerGuid,X,()=>Q)}import{isIP as fK}from"net";function cX($){if($.startsWith("[")){let Q=$.indexOf("]");if(Q===-1)return{hostPattern:$,port:void 0};let Y=$.slice(1,Q),G=jJ(Y)??Y,W=$.slice(Q+1);if(W==="")return{hostPattern:G,port:void 0};let U=b5(W.startsWith(":")?W.slice(1):"");return U===void 0?{hostPattern:$,port:void 0}:{hostPattern:G,port:U}}let J=$.lastIndexOf(":");if(J===-1)return{hostPattern:$,port:void 0};if($.indexOf(":")!==J)return{hostPattern:jJ($)??$,port:void 0};let X=b5($.slice(J+1));if(X===void 0)return{hostPattern:$,port:void 0};return{hostPattern:$.slice(0,J),port:X}}function b5($){if(!/^[1-9][0-9]{0,4}$/.test($))return;let J=Number($);return J>65535?void 0:J}function nX($){return cX($).hostPattern}function B0($,J){let X=$.toLowerCase();if(J==="*")return!0;if(J.startsWith("*.")){if(fK(dJ(X)))return!1;let Q=J.substring(2).toLowerCase();return X.endsWith("."+Q)}return X===J.toLowerCase()}function iX($,J,X){let{hostPattern:Q,port:Y}=cX(X);if(Y!==void 0&&Y!==J)return!1;return B0($,Q)}function C9($,J){let X=J.map(nX);if(!$.startsWith("*."))return X.some((Y)=>B0($,Y));let Q=$.slice(2).toLowerCase();return X.some((Y)=>{if(!Y.startsWith("*."))return!1;let G=Y.slice(2).toLowerCase();return Q===G||Q.endsWith("."+G)})}function h5($,J,X,Q){if(!mQ(J))return{verdict:"deny",reason:"malformed host"};let Y=jJ(J)??J;for(let G of $.deniedDomains)if(iX(Y,X,G))return{verdict:"deny",reason:$.deniedDomainReasons?.[G]??"host is on the deny list",rule:G};for(let G of $.allowedDomains)if(iX(Y,X,G))return{verdict:"allow",rule:G};if(!Q||$.strictAllowlist)return{verdict:"deny",reason:"host is not on the allow list"};return{verdict:"ask"}}import{EOL as t7}from"os";import{dirname as e7}from"path";var f,sX,rX,tX,uJ,m0,oX,u5=!1,w9,nQ,d0,g$,c0,iQ,l0,P9,g5=!1,eX,zQ=new A9,EQ=new E7,x9=new R7,_9=new A7;function bK(){if(u5)return;let $=()=>WG().catch((J)=>{Z(`Cleanup failed in registerCleanup ${J}`,{level:"error"})});process.once("exit",$),process.once("SIGINT",$),process.once("SIGTERM",$),u5=!0}var hK=1024,KQ=new Map;function n5($,J){let X=J?.commandId,Q=J?.commandText??$;if(X===void 0||X===Q)return;let Y=t0(PJ(X));KQ.delete(Y),KQ.set(Y,Q);while(KQ.size>hK){let G=KQ.keys().next().value;if(G===void 0)break;KQ.delete(G)}}function m5($){return KQ.get($)??$}function $G($,J){let X=J?(()=>{let Q=t0(J);return KQ.get(Q)??f7(Q)})():void 0;if(dQ($,X,f?.ignoreViolations))return;zQ.addViolation({line:$,encodedCommand:J,command:X,timestamp:new Date})}function uK($){try{let J=new URL($);return`${J.origin}${J.pathname}${J.search?"?\u2026":""}`}catch{let J=$.indexOf("?");return J===-1?$:`${$.slice(0,J)}?\u2026`}}async function l5($,J,X,Q){let Y=(W)=>{return $G(`deny network-outbound ${J}:${$} (${W})`,Q),!1};if(!f)return Z("No config available, denying network request"),Y("sandbox policy unavailable");let G=h5(f.network,J,$,X!==void 0);if(G.verdict==="allow")return Z(`Allowed by config rule: ${J}:${$}`),!0;if(G.verdict==="deny"){if(G.reason==="malformed host")Z(`Denying malformed host: ${JSON.stringify(J)}:${$}`,{level:"error"});else if(G.rule!==void 0)Z(`Denied by config rule: ${J}:${$}`);else Z(`No matching config rule, denying: ${J}:${$}`);return Y(G.reason)}Z(`No matching config rule, asking user: ${J}:${$}`);try{if(await X({host:J,port:$}))return Z(`User allowed: ${J}:${$}`),!0;return Z(`User denied: ${J}:${$}`),Y("user denied")}catch(W){return Z(`Error in permission callback: ${W}`,{level:"error"}),Y("permission prompt failed")}}function gK(){if(!f?.credentials)return;return($,J)=>{EQ.substituteInHeaders($,J,B0)}}function mK(){if(!f?.credentials)return;return($)=>EQ.sentinelsForHost($,B0)}function lK(){if(!f?.credentials)return;return($,J,X,Q)=>P4(x9,f?.credentials?.sigv4,B0)($,J,X,Q)}function pK($){if(!f?.network.mitmProxy)return;let{socketPath:J,domains:X}=f.network.mitmProxy,Q=jJ($)??$;for(let Y of X)if(B0(Q,Y))return Z(`Host ${$} matches MITM pattern ${Y}`),J;return}function dK($){let J=f?.network.tlsTerminate?.excludeDomains;if(!J?.length)return!0;let X=jJ($)??$;for(let Q of J){if(!B0(X,Q))continue;Z(`Host ${$} matches tlsTerminate.excludeDomains pattern ${Q}; skipping TLS termination`);let Y=EQ.namesInjectableAt(X,B0);if(Y.length>0)Z(`tlsTerminate.excludeDomains: masked credential(s) ${Y.join(", ")} are configured for injection at ${$}, but its connections are not terminated, so the upstream will receive the placeholder`,{level:"error"});return!1}return!0}async function cK($,J){let X=gK(),Q=mK();sX=W4({filter:(U,M,O,V)=>l5(U,M,$,V),getMitmSocketPath:pK,mitmCA:g$,shouldTerminateTLS:dK,filterRequest:f?.network.filterRequest,onFilterRequestDenied:({method:U,url:M,reason:O,encodedCommand:V})=>{$G(`deny http-request ${U} ${uK(M)} (${O})`,V)},mutateHeaders:X,mutateHeadersPlaintext:f?.credentials?.allowPlaintextInject?X:void 0,getBodySubstitutions:Q,getBodySubstitutionsPlaintext:f?.credentials?.allowPlaintextInject?Q:void 0,planSigv4:lK(),parentProxy:d0,proxyAuthToken:c0}),rX=E4({filter:(U,M,O)=>l5(U,M,$,O),parentProxy:d0,proxyAuthToken:c0,probeUnauthenticated:async(U,M)=>{if(!f)return{};let O=jJ(M)??M;for(let V of f.network.deniedDomains)if(iX(O,U,V)){let H=f.network.deniedDomainReasons?.[V]??"host is on the deny list";return $G(`deny network-outbound ${M}:${U} (${H})`,void 0),{deniedReason:H}}return{}}}),tX=L4({httpServer:sX,handleSocksConnection:(U)=>rX.handleConnection(U),httpBackendPortRange:J});let Y=tX,G=await Y.listenHttpBackend();await G9(Y.server,(U)=>Y.server.listen(U,"127.0.0.1"),J,G!==void 0?new Set([G]):new Set);let W=Y.getPort();if(W===void 0)throw Error("Failed to get mux proxy server port");return Y.unref(),Z(`Mux proxy (HTTP+SOCKS) listening on localhost:${W}`),W}async function nK($,J,X=!1){if(m0){await m0;return}if(f=$,d0=Y7($.network.parentProxy),d0)Z(`Parent proxy configured: http=${U7(d0.httpUrl)} https=${U7(d0.httpsUrl)}`);if($.network.tlsTerminate&&$.network.mitmProxy)throw Error("network.tlsTerminate and network.mitmProxy are mutually exclusive");let Q=$.network.tlsTerminate,Y=v$()==="windows"&&Q!==void 0&&!Q.caCertPath&&!Q.caKeyPath;if(g$=Q&&!Y?t8(Q):void 0,g$&&$.runAsHostUid!==void 0&&v$()==="linux"){if(p0.chmodSync(e7(g$.trustBundlePath),457),p0.chmodSync(g$.trustBundlePath,420),g$.ephemeral)p0.chmodSync(e7(g$.certPath),457),p0.chmodSync(g$.certPath,420)}let G=await a5();if(G.errors.length>0)throw Error(`Sandbox dependencies not available: ${G.errors.join(", ")}`);if(X&&v$()==="macos")w9=H5(zQ.addViolation.bind(zQ),f.ignoreViolations,m5),Z("Started macOS sandbox log monitor");if(X&&v$()==="linux")nQ=z5(zQ.addViolation.bind(zQ),{allowWritePaths:[...DQ($.runAsHostHome),...f.filesystem.allowWrite],denyWritePaths:f.filesystem.denyWrite,ignoreViolations:f.ignoreViolations,resolveCommandText:m5,consumerUid:$.runAsHostUid,consumerGid:$.runAsHostGid}),nQ.ready,Z("Started Linux seccomp violation monitor");if(bK(),v$()==="windows"){eX=wJ($.windows?.srtWin);let W=eX,U=await dX({srtWin:W});if(!U.provisioned||!U.credPresent)throw f=void 0,new A$("not_provisioned",`Windows sandbox user is not provisioned (user=${U.provisioned}, cred=${U.credPresent}). Run \`npx sandbox-runtime windows-install\` (one UAC prompt) to provision it.`);if(!g5){try{await d7({proxyPortRange:$.windows?.proxyPortRange,srtWin:W})}catch(M){throw f=void 0,M}g5=!0}if(Y&&Q)try{let M=await i7({status:U,srtWin:W});g$=t8({caCertPem:M.certPem,caKeyPem:M.keyPem,caCertPath:M.certPath,caKeyPath:M.keyPath,extraCaCertPaths:Q.extraCaCertPaths})}catch(M){throw f=void 0,M}if(Q&&g$&&!Y){let M=n7(U),O=gQ(g$.certPem);if(!M)throw f=void 0,new A$("trust_ca_not_installed",`tlsTerminate on Windows requires the sandbox to be installed with this CA (thumb=${O}): run \`srt-win user trust-ca ${g$.certPath}\`. Per-exec installs into the sandbox user's Root store are not supported.`);if(M.thumb!==O)throw f=void 0,new A$("trust_ca_thumbprint_mismatch",`tlsTerminate on Windows: the sandbox's installed CA (thumb=${M.thumb}) doesn't match this session's CA (thumb=${O}). Run \`srt-win user trust-ca ${g$.certPath}\` to update it.`)}try{let M=rK($);if(g$)M.grantRead.push(e7(g$.trustBundlePath));if(!U.sid)throw Error("sandbox user SID missing from `srt-win user status` (provisioned but in an inconsistent state)");let O=U.sid;if(l0=O,M.grantRead.length>0||M.grantWrite.length>0)s7({sandboxUserSid:O,read:M.grantRead,write:M.grantWrite,srtWin:W});if(M.denyRead.length>0||M.denyWrite.length>0)a7({sandboxUserSid:O,denyRead:M.denyRead,denyWrite:M.denyWrite,srtWin:W});if(M.grantRead.length>0||M.grantWrite.length>0||M.denyRead.length>0||M.denyWrite.length>0)iQ=M,Z(`[Sandbox Windows] fs applied: ${M.grantWrite.length} grantWrite, ${M.grantRead.length} grantRead, ${M.denyRead.length} denyRead, ${M.denyWrite.length} denyWrite`);P9=r5($)}catch(M){if(l0)I9({sandboxUserSid:l0,srtWin:W}),S9({sandboxUserSid:l0,srtWin:W});throw l0=void 0,f=void 0,M}}m0=(async()=>{try{let W=v$()==="windows"?f.windows?.proxyPortRange??D9:void 0;c0=f.network.httpProxyPort!==void 0?void 0:yK(16).toString("hex");let M=f.network.httpProxyPort===void 0||f.network.socksProxyPort===void 0?await cK(J,W):void 0,O=f.network.httpProxyPort??M,V=f.network.socksProxyPort??M;if(g$&&M!==void 0&&v$()==="windows")g$.crlUrl=`http://127.0.0.1:${M}${oY}`;if(f.network.httpProxyPort!==void 0)Z(`Using external HTTP proxy on port ${O}`);if(f.network.socksProxyPort!==void 0)Z(`Using external SOCKS proxy on port ${V}`);let H;if(v$()==="linux")H=await X5(O,V,f.socatPath,f.runAsHostUid,f.runAsHostGid);let q={httpProxyPort:O,socksProxyPort:V,linuxBridge:H};return uJ=q,Z("Network infrastructure initialized"),q}catch(W){throw m0=void 0,uJ=void 0,WG().catch((U)=>{Z(`Cleanup failed in initializationPromise ${U}`,{level:"error"})}),W}})(),await m0}function i5(){let $=v$();if($==="linux")return l9()!=="1";return $==="macos"||$==="windows"}function iK(){return f!==void 0}function o5($){if(!i5())return{done:{errors:["Unsupported platform"],warnings:[]}};let J=[],X=[],Q=v$();if(Q==="linux"){let Y=$??f?.ripgrep??{command:"rg"};if(R0(Y.command)===null)J.push(`ripgrep (${Y.command}) not found`);let G=Q5({seccompConfig:f?.seccomp,bwrapPath:f?.bwrapPath,socatPath:f?.socatPath});J.push(...G.errors),X.push(...G.warnings)}else if(Q==="windows"){let Y;try{Y=wJ(f?.windows?.srtWin)}catch(G){return J.push(G.message),{done:{errors:J,warnings:X}}}return{windows:{sublayerGuid:f?.windows?.sublayerGuid??f?.windows?.wfpSublayerGuid,srtWin:Y}}}return{done:{errors:J,warnings:X}}}function oK($){let J=o5($);if("done"in J)return J.done;return y5(J.windows)}async function a5($){let J=o5($);if("done"in J)return J.done;return r7(J.windows)}function QG($,J){if(!$)return{denyReadPaths:[],unsetEnvVars:[],setEnvVars:{},maskedFileBinds:[],maskedFileStoreDir:void 0};let X=v9($),Q=[...new Set((J??[]).map(nX))],Y=[];for(let V of $.envVars??[])if(V.mode==="deny")Y.push(V.name);let{setEnvVars:G,degradeToUnsetNames:W}=T4($.envVars??[],Q,EQ);Y.push(...W),w4($.envVars??[],$.awsPairs,Q,G,x9);let U=$.files??[],{binds:M,degradeToDenyPaths:O}=j4(U,Q,EQ,_9);return{denyReadPaths:[...new Set([...X,...O])],unsetEnvVars:[...new Set(Y)],setEnvVars:G,maskedFileBinds:M,maskedFileStoreDir:_9.dirPath}}function v9($){let J=$?.files??[];return[...new Set(J.filter((X)=>X.mode==="deny").map((X)=>X.path))]}function s5($,J){return[...new Set([...$,...J.denyReadPaths])]}function aK(){if(!f||f.filesystem.disabled)return{denyOnly:[],allowWithinDeny:[]};let $=s5(f.filesystem.denyRead,QG(f.credentials,f.network.allowedDomains)),J=[];for(let Q of $){let Y=E0(Q);if(v$()==="linux"&&NJ(Y)){let G=e0(Q);Z(`[Sandbox] Expanded glob pattern "${Q}" to ${G.length} paths on Linux`),J.push(...G)}else J.push(Y)}let X=[];for(let Q of f.filesystem.allowRead??[]){let Y=E0(Q);if(v$()==="linux"&&NJ(Y)){let G=e0(Q);Z(`[Sandbox] Expanded allowRead glob pattern "${Q}" to ${G.length} paths on Linux`),X.push(...G)}else X.push(Y)}return{denyOnly:J,allowWithinDeny:X}}function sK(){if(!f)return{allowOnly:DQ(),denyWithinAllow:[]};if(f.filesystem.disabled)return{allowOnly:["/"],denyWithinAllow:[]};let $=f.filesystem.allowWrite.map((Q)=>E0(Q)).filter((Q)=>{if(v$()==="linux"&&NJ(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0}),J=f.filesystem.denyWrite.map((Q)=>E0(Q)).filter((Q)=>{if(v$()==="linux"&&NJ(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0});return{allowOnly:[...DQ(JG()),...$],denyWithinAllow:J}}function rK($){let J=$.filesystem;if(J?.disabled)return{grantRead:[],grantWrite:[],denyRead:[],denyWrite:[]};let X=T9,Q=X([...new Set([...J?.denyRead??[],...v9($.credentials)])],{mode:"deny"}),Y=X(J?.denyWrite??[],{mode:"deny"});return{grantRead:X(J?.allowRead??[],{mode:"grant"}),grantWrite:X(J?.allowWrite??[],{mode:"grant"}),denyRead:Q,denyWrite:Y}}function r5($){return{disabled:$.filesystem.disabled??!1,denyRead:[...$.filesystem.denyRead],denyWrite:[...$.filesystem.denyWrite],allowRead:[...$.filesystem.allowRead??[]],allowWrite:[...$.filesystem.allowWrite],credFiles:v9($.credentials)}}function aX($,J){if($.length!==J.length)return!1;let X=new Set($);return J.every((Q)=>X.has(Q))}function tK($,J){return $.disabled===J.disabled&&aX($.denyRead,J.denyRead)&&aX($.denyWrite,J.denyWrite)&&aX($.allowRead,J.allowRead)&&aX($.allowWrite,J.allowWrite)&&aX($.credFiles,J.credFiles)}function eK($){return P9!==void 0&&tK(P9,r5($))}function $z(){if(!f)return{};let $=f.network.allowedDomains,J=f.network.deniedDomains;return{allowedHosts:$,...J.length>0&&{deniedHosts:J}}}function t5(){return f?.network?.allowUnixSockets}function p5(){return f?.network?.allowAllUnixSockets}function e5(){return f?.network?.allowLocalBinding}function $U(){return f?.network?.allowMachLookup}function JU(){return f?.ignoreViolations}function QU(){return f?.enableWeakerNestedSandbox}function Jz(){return f?.runAsUid}function Qz(){return f?.runAsGid}function Xz(){return f?.runAsHostUid}function Yz(){return f?.runAsHostGid}function JG(){return f?.runAsHostHome}function Gz(){return f?.runAsHostUser}function Wz(){return f?.enableWeakerNetworkIsolation}function Uz(){return f?.allowAppleEvents}function Mz(){return f?.ripgrep??{command:"rg"}}function Oz(){return f?.mandatoryDenySearchDepth??3}function d5(){return f?.filesystem?.allowGitConfig??!1}function XU($){return[...f?.git?.safeDirectories??[],...$?.git?.safeDirectories??[]]}function Vz(){return f?.seccomp}function Hz(){return c0}function XG(){return uJ?.httpProxyPort}function YG(){return uJ?.socksProxyPort}function YU(){return uJ?.linuxBridge?.httpSocketPath}function GU(){return uJ?.linuxBridge?.socksSocketPath}async function GG(){if(!f)return!1;if(m0)try{return await m0,!0}catch{return!1}return uJ!==void 0}async function WU($,J,X,Q,Y){let G=v$(),W=Y?.commandId;n5($,Y);let U=X?.filesystem!==void 0?X.filesystem.disabled??!1:f?.filesystem.disabled??!1,M=QG(X?.credentials??f?.credentials,X?.network?.allowedDomains??f?.network?.allowedDomains),O,V;if(!U){let L=(P)=>P.map((l)=>E0(l)).filter((l)=>{if(v$()==="linux"&&NJ(l))return Z(`[Sandbox] Skipping glob write pattern on Linux: ${l}`),!1;return!0}),R=L(X?.filesystem?.allowWrite??f?.filesystem.allowWrite??[]);O={allowOnly:[...DQ(X?.runAsHostHome??JG()),...R],denyWithinAllow:L(X?.filesystem?.denyWrite??f?.filesystem.denyWrite??[])};let I=s5(X?.filesystem?.denyRead??f?.filesystem.denyRead??[],M),j=[];for(let P of I){let l=E0(P);if(v$()==="linux"&&NJ(l))j.push(...e0(P));else j.push(l)}let C=X?.filesystem?.allowRead??f?.filesystem.allowRead??[],w=[];for(let P of C){let l=E0(P);if(v$()==="linux"&&NJ(l))w.push(...e0(P));else w.push(l)}if(g$)w.push(g$.certPath,g$.trustBundlePath);V={denyOnly:j,allowWithinDeny:w}}let H=X?.network?.allowedDomains!==void 0||f?.network?.allowedDomains!==void 0,q=H,F=H;if(F)await GG();let K=X?.allowPty??f?.allowPty,A=XU(X);switch(G){case"macos":return V5({command:$,commandId:W,needsNetworkRestriction:q,httpProxyPort:F?XG():void 0,socksProxyPort:F?YG():void 0,proxyAuthToken:F?c0:void 0,caCertPath:g$?.trustBundlePath,readConfig:V,writeConfig:O,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,allowUnixSockets:t5(),allowAllUnixSockets:p5(),allowLocalBinding:e5(),allowMachLookup:$U(),ignoreViolations:JU(),allowPty:K,allowGitConfig:d5(),gitSafeDirectories:A,enableWeakerNetworkIsolation:Wz(),allowAppleEvents:Uz(),binShell:J});case"linux":return Y5({command:$,commandId:W,needsNetworkRestriction:q,httpSocketPath:F?YU():void 0,socksSocketPath:F?GU():void 0,httpProxyPort:F?uJ?.httpProxyPort:void 0,socksProxyPort:F?uJ?.socksProxyPort:void 0,proxyAuthToken:F?c0:void 0,caCertPath:g$?.trustBundlePath,readConfig:V,writeConfig:O,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,maskedFileStoreDir:M.maskedFileStoreDir,enableWeakerNestedSandbox:QU(),runAsUid:Jz(),runAsGid:Qz(),runAsHostUid:Xz(),runAsHostGid:Yz(),runAsHostHome:JG(),runAsHostUser:Gz(),setprivPath:"/usr/bin/setpriv",allowAllUnixSockets:p5(),binShell:J,ripgrepConfig:Mz(),mandatoryDenySearchDepth:Oz(),allowGitConfig:d5(),gitSafeDirectories:A,seccompConfig:Vz(),bwrapPath:f?.bwrapPath,socatPath:f?.socatPath,observeSocketPath:nQ?.observeSocketPath,abortSignal:Q});case"windows":throw Error("wrapWithSandbox() returns a shell string and is not supported on Windows. Use SandboxManager.wrapWithSandboxArgv() and spawn the result with {shell: false}.");default:throw Error(`Sandbox configuration is not supported on platform: ${G}`)}}async function qz($,J,X,Q,Y,G){if(v$()==="windows"){let O=X?.network?.allowedDomains!==void 0||f?.network?.allowedDomains!==void 0;if(O)await GG();let V=QG(X?.credentials??f?.credentials,X?.network?.allowedDomains??f?.network?.allowedDomains),H=X?.filesystem,q=[],F=[];if(!H?.disabled){if(H?.allowRead?.length||H?.allowWrite?.length)throw Error("Per-exec filesystem.allowRead/allowWrite is not supported "+"on Windows \u2014 `srt-win exec` only exposes per-exec "+"denies. Set them at the session level (initialize()).");let K=[...H?.denyRead??[],...v9(X?.credentials)],A=H?.denyWrite??[];if(K.length>0||A.length>0){let L=new Set(iQ?.denyRead??[]),R=new Set(iQ?.denyWrite??[]),I=T9;q=I(K,{mode:"deny"}).filter((j)=>!L.has(j)),F=I(A,{mode:"deny"}).filter((j)=>!L.has(j)&&!R.has(j))}}return n5($,G),k5({command:$,commandId:G?.commandId,httpProxyPort:O?XG():void 0,socksProxyPort:O?YG():void 0,proxyAuthToken:O?c0:void 0,setEnvVars:V.setEnvVars,denyRead:q,denyWrite:F,cwd:Y,allowWrite:iQ?.grantWrite,gitSafeDirectories:XU(X),caCertPath:g$?.trustBundlePath,binShell:Z9(J),srtWin:X?.windows?.srtWin?wJ(X.windows.srtWin):eX??wJ(f?.windows?.srtWin)})}if(typeof J==="object")throw Error("binShell object form is Windows-only; pass a shell path string on macOS/Linux");let U=await WU($,J,X,Q,G);return{argv:[J??"/bin/bash","-c",U],env:process.env}}function Kz(){return f}function zz($){if(v$()==="windows"&&f&&!eK($))Z("[Sandbox Windows] updateConfig: the resolved file-access set "+"(filesystem.* \u222A credentials.files) changed but the ACL "+"stamp/grant is session-wide \u2014 call reset() then initialize() "+"to apply. The previously-applied set stays in effect.",{level:"warn"});let{filterRequest:J,...X}=$.network;f=structuredClone({...$,network:X}),f.network.filterRequest=J,d0=Y7($.network.parentProxy),Z("Sandbox configuration updated")}function Ez(){L9()}var Fz=1500;function c5($,J){if(!$.pid||$.exitCode!==null||$.signalCode!==null)return Promise.resolve();try{process.kill($.pid,"SIGTERM"),Z(`Sent SIGTERM to ${J} bridge process`)}catch(X){if(X.code!=="ESRCH")Z(`Error killing ${J} bridge: ${X}`,{level:"error"});return Promise.resolve()}return new Promise((X)=>{let Q=!1,Y=()=>{if(Q)return;Q=!0,clearTimeout(G),X()};$.once("exit",()=>{Z(`${J} bridge process exited`),Y()});let G=setTimeout(()=>{if($.exitCode===null&&$.signalCode===null){Z(`${J} bridge did not exit, forcing SIGKILL`,{level:"warn"});try{if($.pid)process.kill($.pid,"SIGKILL")}catch{}}Y()},Fz);G.unref?.()})}function Nz($){return new Promise((J)=>{if(typeof $.closeAllConnections==="function")$.closeAllConnections();$.close((X)=>{if(X&&X.message!=="Server is not running.")Z(`Error closing HTTP proxy server: ${X.message}`,{level:"error"});J()})})}async function Lz(){if(iQ&&l0){let J=l0,X=eX,Q=new Set(["revoked","stillHeld","restored","alreadyOriginal"]),Y=(G,W)=>{if(!Q.has(W.status))Z(`[Sandbox Windows] ${G}: '${W.path}' ${W.status} \u2014 `+"ACE may be left in place; resolve and run `srt-win acl recover` to clear",{level:"warn"})};for(let G of I9({sandboxUserSid:J,srtWin:X})??[])Y("grant revoke",G);for(let G of S9({sandboxUserSid:J,srtWin:X})??[])Y("deny restore",G)}if(iQ=void 0,l0=void 0,P9=void 0,eX=void 0,L9({force:!0}),w9)w9(),w9=void 0;if(nQ)nQ.stop(),nQ=void 0;if(uJ?.linuxBridge){let{httpSocketPath:J,socksSocketPath:X,httpBridgeProcess:Q,socksBridgeProcess:Y}=uJ.linuxBridge;if(await Promise.all([c5(Q,"HTTP"),c5(Y,"SOCKS")]),J)try{p0.rmSync(J,{force:!0}),Z("Cleaned up HTTP socket")}catch(G){Z(`HTTP socket cleanup error: ${G}`,{level:"error"})}if(X)try{p0.rmSync(X,{force:!0}),Z("Cleaned up SOCKS socket")}catch(G){Z(`SOCKS socket cleanup error: ${G}`,{level:"error"})}}let $=[];if(g$)$.push(fW(g$));if(tX)$.push(tX.close().catch((J)=>{Z(`Error closing mux proxy server: ${J.message}`,{level:"error"})}));if(sX)$.push(Nz(sX));if(rX){let J=rX.close().catch((X)=>{Z(`Error closing SOCKS proxy server: ${X.message}`,{level:"error"})});$.push(J)}await Promise.all($),tX=void 0,sX=void 0,c0=void 0,rX=void 0,uJ=void 0,m0=void 0,d0=void 0,g$=void 0,EQ.clear(),x9.clear(),_9.dispose()}async function WG(){if(oX)return oX;oX=Lz();try{await oX}finally{oX=void 0}}function Az(){return zQ}function Rz($,J){if(!f)return J;let X=zQ.getViolationsForCommand($);if(X.length===0)return J;let Q=J;Q+=t7+"<sandbox_violations>"+t7;for(let Y of X)Q+=Y.line+t7;return Q+="</sandbox_violations>",Q}function Dz(){if(v$()!=="linux"||!f||f.filesystem.disabled)return[];let $=[],J=[...f.filesystem.allowWrite,...f.filesystem.denyWrite];for(let X of J){let Q=E0(X);if(NJ(Q))$.push(X)}return $}var Zz={initialize:nK,isSupportedPlatform:i5,isSandboxingEnabled:iK,checkDependencies:oK,checkDependenciesAsync:a5,getFsReadConfig:aK,getFsWriteConfig:sK,getNetworkRestrictionConfig:$z,getAllowUnixSockets:t5,getAllowLocalBinding:e5,getAllowMachLookup:$U,getIgnoreViolations:JU,getEnableWeakerNestedSandbox:QU,getProxyPort:XG,getProxyAuthToken:Hz,getSocksProxyPort:YG,getLinuxHttpSocketPath:YU,getLinuxSocksSocketPath:GU,waitForNetworkInitialization:GG,wrapWithSandbox:WU,wrapWithSandboxArgv:qz,cleanupAfterCommand:Ez,reset:WG,getMitmCA:()=>g$,getSentinelRegistry:()=>EQ,getAwsPairRegistry:()=>x9,getMaskedFileStore:()=>_9,getSandboxViolationStore:Az,annotateStderrWithSandboxFailures:Rz,getLinuxGlobPatternWarnings:Dz,getConfig:Kz,updateConfig:zz};import{isIP as vE}from"net";import{isAbsolute as kE}from"path";var x={};mU(x,{void:()=>WE,util:()=>B$,unknown:()=>YE,union:()=>VE,undefined:()=>JE,tuple:()=>KE,transformer:()=>BE,symbol:()=>$E,string:()=>EU,strictObject:()=>OE,setErrorMap:()=>Tz,set:()=>FE,record:()=>zE,quotelessJson:()=>Bz,promise:()=>ZE,preprocess:()=>SE,pipeline:()=>IE,ostring:()=>CE,optional:()=>jE,onumber:()=>wE,oboolean:()=>PE,objectUtil:()=>UG,object:()=>ME,number:()=>FU,nullable:()=>TE,null:()=>QE,never:()=>GE,nativeEnum:()=>DE,nan:()=>rz,map:()=>EE,makeIssue:()=>$Y,literal:()=>AE,lazy:()=>LE,late:()=>az,isValid:()=>n0,isDirty:()=>f9,isAsync:()=>aQ,isAborted:()=>k9,intersection:()=>qE,instanceof:()=>sz,getParsedType:()=>H0,getErrorMap:()=>oQ,function:()=>NE,enum:()=>RE,effect:()=>BE,discriminatedUnion:()=>HE,defaultErrorMap:()=>j0,datetimeRegex:()=>qU,date:()=>ez,custom:()=>zU,coerce:()=>_E,boolean:()=>NU,bigint:()=>tz,array:()=>UE,any:()=>XE,addIssueToContext:()=>c,ZodVoid:()=>QY,ZodUnknown:()=>i0,ZodUnion:()=>JX,ZodUndefined:()=>eQ,ZodType:()=>N$,ZodTuple:()=>K0,ZodTransformer:()=>tJ,ZodSymbol:()=>JY,ZodString:()=>oJ,ZodSet:()=>AQ,ZodSchema:()=>N$,ZodRecord:()=>XY,ZodReadonly:()=>MX,ZodPromise:()=>RQ,ZodPipeline:()=>WY,ZodParsedType:()=>m,ZodOptional:()=>sJ,ZodObject:()=>a$,ZodNumber:()=>o0,ZodNullable:()=>S0,ZodNull:()=>$X,ZodNever:()=>q0,ZodNativeEnum:()=>GX,ZodNaN:()=>GY,ZodMap:()=>YY,ZodLiteral:()=>YX,ZodLazy:()=>XX,ZodIssueCode:()=>h,ZodIntersection:()=>QX,ZodFunction:()=>rQ,ZodFirstPartyTypeKind:()=>M$,ZodError:()=>TJ,ZodEnum:()=>s0,ZodEffects:()=>tJ,ZodDiscriminatedUnion:()=>y9,ZodDefault:()=>WX,ZodDate:()=>NQ,ZodCatch:()=>UX,ZodBranded:()=>b9,ZodBoolean:()=>tQ,ZodBigInt:()=>a0,ZodArray:()=>aJ,ZodAny:()=>LQ,Schema:()=>N$,ParseStatus:()=>EJ,OK:()=>FJ,NEVER:()=>xE,INVALID:()=>W$,EMPTY_PATH:()=>Sz,DIRTY:()=>FQ,BRAND:()=>oz});var B$;(function($){$.assertEqual=(Y)=>{};function J(Y){}$.assertIs=J;function X(Y){throw Error()}$.assertNever=X,$.arrayToEnum=(Y)=>{let G={};for(let W of Y)G[W]=W;return G},$.getValidEnumValues=(Y)=>{let G=$.objectKeys(Y).filter((U)=>typeof Y[Y[U]]!=="number"),W={};for(let U of G)W[U]=Y[U];return $.objectValues(W)},$.objectValues=(Y)=>{return $.objectKeys(Y).map(function(G){return Y[G]})},$.objectKeys=typeof Object.keys==="function"?(Y)=>Object.keys(Y):(Y)=>{let G=[];for(let W in Y)if(Object.prototype.hasOwnProperty.call(Y,W))G.push(W);return G},$.find=(Y,G)=>{for(let W of Y)if(G(W))return W;return},$.isInteger=typeof Number.isInteger==="function"?(Y)=>Number.isInteger(Y):(Y)=>typeof Y==="number"&&Number.isFinite(Y)&&Math.floor(Y)===Y;function Q(Y,G=" | "){return Y.map((W)=>typeof W==="string"?`'${W}'`:W).join(G)}$.joinValues=Q,$.jsonStringifyReplacer=(Y,G)=>{if(typeof G==="bigint")return G.toString();return G}})(B$||(B$={}));var UG;(function($){$.mergeShapes=(J,X)=>{return{...J,...X}}})(UG||(UG={}));var m=B$.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),H0=($)=>{switch(typeof $){case"undefined":return m.undefined;case"string":return m.string;case"number":return Number.isNaN($)?m.nan:m.number;case"boolean":return m.boolean;case"function":return m.function;case"bigint":return m.bigint;case"symbol":return m.symbol;case"object":if(Array.isArray($))return m.array;if($===null)return m.null;if($.then&&typeof $.then==="function"&&$.catch&&typeof $.catch==="function")return m.promise;if(typeof Map<"u"&&$ instanceof Map)return m.map;if(typeof Set<"u"&&$ instanceof Set)return m.set;if(typeof Date<"u"&&$ instanceof Date)return m.date;return m.object;default:return m.unknown}};var h=B$.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]),Bz=($)=>{return JSON.stringify($,null,2).replace(/"([^"]+)":/g,"$1:")};class TJ extends Error{get errors(){return this.issues}constructor($){super();this.issues=[],this.addIssue=(X)=>{this.issues=[...this.issues,X]},this.addIssues=(X=[])=>{this.issues=[...this.issues,...X]};let J=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,J);else this.__proto__=J;this.name="ZodError",this.issues=$}format($){let J=$||function(Y){return Y.message},X={_errors:[]},Q=(Y)=>{for(let G of Y.issues)if(G.code==="invalid_union")G.unionErrors.map(Q);else if(G.code==="invalid_return_type")Q(G.returnTypeError);else if(G.code==="invalid_arguments")Q(G.argumentsError);else if(G.path.length===0)X._errors.push(J(G));else{let W=X,U=0;while(U<G.path.length){let M=G.path[U];if(U!==G.path.length-1)W[M]=W[M]||{_errors:[]};else W[M]=W[M]||{_errors:[]},W[M]._errors.push(J(G));W=W[M],U++}}};return Q(this),X}static assert($){if(!($ instanceof TJ))throw Error(`Not a ZodError: ${$}`)}toString(){return this.message}get message(){return JSON.stringify(this.issues,B$.jsonStringifyReplacer,2)}get isEmpty(){return this.issues.length===0}flatten($=(J)=>J.message){let J={},X=[];for(let Q of this.issues)if(Q.path.length>0){let Y=Q.path[0];J[Y]=J[Y]||[],J[Y].push($(Q))}else X.push($(Q));return{formErrors:X,fieldErrors:J}}get formErrors(){return this.flatten()}}TJ.create=($)=>{return new TJ($)};var jz=($,J)=>{let X;switch($.code){case h.invalid_type:if($.received===m.undefined)X="Required";else X=`Expected ${$.expected}, received ${$.received}`;break;case h.invalid_literal:X=`Invalid literal value, expected ${JSON.stringify($.expected,B$.jsonStringifyReplacer)}`;break;case h.unrecognized_keys:X=`Unrecognized key(s) in object: ${B$.joinValues($.keys,", ")}`;break;case h.invalid_union:X="Invalid input";break;case h.invalid_union_discriminator:X=`Invalid discriminator value. Expected ${B$.joinValues($.options)}`;break;case h.invalid_enum_value:X=`Invalid enum value. Expected ${B$.joinValues($.options)}, received '${$.received}'`;break;case h.invalid_arguments:X="Invalid function arguments";break;case h.invalid_return_type:X="Invalid function return type";break;case h.invalid_date:X="Invalid date";break;case h.invalid_string:if(typeof $.validation==="object")if("includes"in $.validation){if(X=`Invalid input: must include "${$.validation.includes}"`,typeof $.validation.position==="number")X=`${X} at one or more positions greater than or equal to ${$.validation.position}`}else if("startsWith"in $.validation)X=`Invalid input: must start with "${$.validation.startsWith}"`;else if("endsWith"in $.validation)X=`Invalid input: must end with "${$.validation.endsWith}"`;else B$.assertNever($.validation);else if($.validation!=="regex")X=`Invalid ${$.validation}`;else X="Invalid";break;case h.too_small:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at least":"more than"} ${$.minimum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at least":"over"} ${$.minimum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="bigint")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${new Date(Number($.minimum))}`;else X="Invalid input";break;case h.too_big:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at most":"less than"} ${$.maximum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at most":"under"} ${$.maximum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="bigint")X=`BigInt must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly":$.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number($.maximum))}`;else X="Invalid input";break;case h.custom:X="Invalid input";break;case h.invalid_intersection_types:X="Intersection results could not be merged";break;case h.not_multiple_of:X=`Number must be a multiple of ${$.multipleOf}`;break;case h.not_finite:X="Number must be finite";break;default:X=J.defaultError,B$.assertNever($)}return{message:X}},j0=jz;var UU=j0;function Tz($){UU=$}function oQ(){return UU}var $Y=($)=>{let{data:J,path:X,errorMaps:Q,issueData:Y}=$,G=[...X,...Y.path||[]],W={...Y,path:G};if(Y.message!==void 0)return{...Y,path:G,message:Y.message};let U="",M=Q.filter((O)=>!!O).slice().reverse();for(let O of M)U=O(W,{data:J,defaultError:U}).message;return{...Y,path:G,message:U}},Sz=[];function c($,J){let X=oQ(),Q=$Y({issueData:J,data:$.data,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,X,X===j0?void 0:j0].filter((Y)=>!!Y)});$.common.issues.push(Q)}class EJ{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray($,J){let X=[];for(let Q of J){if(Q.status==="aborted")return W$;if(Q.status==="dirty")$.dirty();X.push(Q.value)}return{status:$.value,value:X}}static async mergeObjectAsync($,J){let X=[];for(let Q of J){let Y=await Q.key,G=await Q.value;X.push({key:Y,value:G})}return EJ.mergeObjectSync($,X)}static mergeObjectSync($,J){let X={};for(let Q of J){let{key:Y,value:G}=Q;if(Y.status==="aborted")return W$;if(G.status==="aborted")return W$;if(Y.status==="dirty")$.dirty();if(G.status==="dirty")$.dirty();if(Y.value!=="__proto__"&&(typeof G.value<"u"||Q.alwaysSet))X[Y.value]=G.value}return{status:$.value,value:X}}}var W$=Object.freeze({status:"aborted"}),FQ=($)=>({status:"dirty",value:$}),FJ=($)=>({status:"valid",value:$}),k9=($)=>$.status==="aborted",f9=($)=>$.status==="dirty",n0=($)=>$.status==="valid",aQ=($)=>typeof Promise<"u"&&$ instanceof Promise;var t;(function($){$.errToObj=(J)=>typeof J==="string"?{message:J}:J||{},$.toString=(J)=>typeof J==="string"?J:J?.message})(t||(t={}));class rJ{constructor($,J,X,Q){this._cachedPath=[],this.parent=$,this.data=J,this._path=X,this._key=Q}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var MU=($,J)=>{if(n0(J))return{success:!0,data:J.value};else{if(!$.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let X=new TJ($.common.issues);return this._error=X,this._error}}}};function K$($){if(!$)return{};let{errorMap:J,invalid_type_error:X,required_error:Q,description:Y}=$;if(J&&(X||Q))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if(J)return{errorMap:J,description:Y};return{errorMap:(W,U)=>{let{message:M}=$;if(W.code==="invalid_enum_value")return{message:M??U.defaultError};if(typeof U.data>"u")return{message:M??Q??U.defaultError};if(W.code!=="invalid_type")return{message:U.defaultError};return{message:M??X??U.defaultError}},description:Y}}class N${get description(){return this._def.description}_getType($){return H0($.data)}_getOrReturnCtx($,J){return J||{common:$.parent.common,data:$.data,parsedType:H0($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}_processInputParams($){return{status:new EJ,ctx:{common:$.parent.common,data:$.data,parsedType:H0($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}}_parseSync($){let J=this._parse($);if(aQ(J))throw Error("Synchronous parse encountered promise.");return J}_parseAsync($){let J=this._parse($);return Promise.resolve(J)}parse($,J){let X=this.safeParse($,J);if(X.success)return X.data;throw X.error}safeParse($,J){let X={common:{issues:[],async:J?.async??!1,contextualErrorMap:J?.errorMap},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)},Q=this._parseSync({data:$,path:X.path,parent:X});return MU(X,Q)}"~validate"($){let J={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)};if(!this["~standard"].async)try{let X=this._parseSync({data:$,path:[],parent:J});return n0(X)?{value:X.value}:{issues:J.common.issues}}catch(X){if(X?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;J.common={issues:[],async:!0}}return this._parseAsync({data:$,path:[],parent:J}).then((X)=>n0(X)?{value:X.value}:{issues:J.common.issues})}async parseAsync($,J){let X=await this.safeParseAsync($,J);if(X.success)return X.data;throw X.error}async safeParseAsync($,J){let X={common:{issues:[],contextualErrorMap:J?.errorMap,async:!0},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)},Q=this._parse({data:$,path:X.path,parent:X}),Y=await(aQ(Q)?Q:Promise.resolve(Q));return MU(X,Y)}refine($,J){let X=(Q)=>{if(typeof J==="string"||typeof J>"u")return{message:J};else if(typeof J==="function")return J(Q);else return J};return this._refinement((Q,Y)=>{let G=$(Q),W=()=>Y.addIssue({code:h.custom,...X(Q)});if(typeof Promise<"u"&&G instanceof Promise)return G.then((U)=>{if(!U)return W(),!1;else return!0});if(!G)return W(),!1;else return!0})}refinement($,J){return this._refinement((X,Q)=>{if(!$(X))return Q.addIssue(typeof J==="function"?J(X,Q):J),!1;else return!0})}_refinement($){return new tJ({schema:this,typeName:M$.ZodEffects,effect:{type:"refinement",refinement:$}})}superRefine($){return this._refinement($)}constructor($){this.spa=this.safeParseAsync,this._def=$,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:(J)=>this["~validate"](J)}}optional(){return sJ.create(this,this._def)}nullable(){return S0.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return aJ.create(this)}promise(){return RQ.create(this,this._def)}or($){return JX.create([this,$],this._def)}and($){return QX.create(this,$,this._def)}transform($){return new tJ({...K$(this._def),schema:this,typeName:M$.ZodEffects,effect:{type:"transform",transform:$}})}default($){let J=typeof $==="function"?$:()=>$;return new WX({...K$(this._def),innerType:this,defaultValue:J,typeName:M$.ZodDefault})}brand(){return new b9({typeName:M$.ZodBranded,type:this,...K$(this._def)})}catch($){let J=typeof $==="function"?$:()=>$;return new UX({...K$(this._def),innerType:this,catchValue:J,typeName:M$.ZodCatch})}describe($){return new this.constructor({...this._def,description:$})}pipe($){return WY.create(this,$)}readonly(){return MX.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var Iz=/^c[^\s-]{8,}$/i,Cz=/^[0-9a-z]+$/,wz=/^[0-9A-HJKMNP-TV-Z]{26}$/i,Pz=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,_z=/^[a-z0-9_-]{21}$/i,xz=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,vz=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,kz=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,fz="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",MG,yz=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,bz=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,hz=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,uz=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,gz=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,mz=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,VU="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",lz=new RegExp(`^${VU}$`);function HU($){let J="[0-5]\\d";if($.precision)J=`${J}\\.\\d{${$.precision}}`;else if($.precision==null)J=`${J}(\\.\\d+)?`;let X=$.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${J})${X}`}function pz($){return new RegExp(`^${HU($)}$`)}function qU($){let J=`${VU}T${HU($)}`,X=[];if(X.push($.local?"Z?":"Z"),$.offset)X.push("([+-]\\d{2}:?\\d{2})");return J=`${J}(${X.join("|")})`,new RegExp(`^${J}$`)}function dz($,J){if((J==="v4"||!J)&&yz.test($))return!0;if((J==="v6"||!J)&&hz.test($))return!0;return!1}function cz($,J){if(!xz.test($))return!1;try{let[X]=$.split(".");if(!X)return!1;let Q=X.replace(/-/g,"+").replace(/_/g,"/").padEnd(X.length+(4-X.length%4)%4,"="),Y=JSON.parse(atob(Q));if(typeof Y!=="object"||Y===null)return!1;if("typ"in Y&&Y?.typ!=="JWT")return!1;if(!Y.alg)return!1;if(J&&Y.alg!==J)return!1;return!0}catch{return!1}}function nz($,J){if((J==="v4"||!J)&&bz.test($))return!0;if((J==="v6"||!J)&&uz.test($))return!0;return!1}class oJ extends N${_parse($){if(this._def.coerce)$.data=String($.data);if(this._getType($)!==m.string){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.string,received:Y.parsedType}),W$}let X=new EJ,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.length<Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="max"){if($.data.length>Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="length"){let G=$.data.length>Y.value,W=$.data.length<Y.value;if(G||W){if(Q=this._getOrReturnCtx($,Q),G)c(Q,{code:h.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});else if(W)c(Q,{code:h.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});X.dirty()}}else if(Y.kind==="email"){if(!kz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"email",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="emoji"){if(!MG)MG=new RegExp(fz,"u");if(!MG.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"emoji",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="uuid"){if(!Pz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"uuid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="nanoid"){if(!_z.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"nanoid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid"){if(!Iz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cuid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid2"){if(!Cz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cuid2",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ulid"){if(!wz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"ulid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="url")try{new URL($.data)}catch{Q=this._getOrReturnCtx($,Q),c(Q,{validation:"url",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="regex"){if(Y.regex.lastIndex=0,!Y.regex.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"regex",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="trim")$.data=$.data.trim();else if(Y.kind==="includes"){if(!$.data.includes(Y.value,Y.position))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{includes:Y.value,position:Y.position},message:Y.message}),X.dirty()}else if(Y.kind==="toLowerCase")$.data=$.data.toLowerCase();else if(Y.kind==="toUpperCase")$.data=$.data.toUpperCase();else if(Y.kind==="startsWith"){if(!$.data.startsWith(Y.value))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{startsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="endsWith"){if(!$.data.endsWith(Y.value))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{endsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="datetime"){if(!qU(Y).test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"datetime",message:Y.message}),X.dirty()}else if(Y.kind==="date"){if(!lz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"date",message:Y.message}),X.dirty()}else if(Y.kind==="time"){if(!pz(Y).test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"time",message:Y.message}),X.dirty()}else if(Y.kind==="duration"){if(!vz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"duration",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ip"){if(!dz($.data,Y.version))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"ip",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="jwt"){if(!cz($.data,Y.alg))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"jwt",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cidr"){if(!nz($.data,Y.version))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cidr",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64"){if(!gz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"base64",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64url"){if(!mz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"base64url",code:h.invalid_string,message:Y.message}),X.dirty()}else B$.assertNever(Y);return{status:X.value,value:$.data}}_regex($,J,X){return this.refinement((Q)=>$.test(Q),{validation:J,code:h.invalid_string,...t.errToObj(X)})}_addCheck($){return new oJ({...this._def,checks:[...this._def.checks,$]})}email($){return this._addCheck({kind:"email",...t.errToObj($)})}url($){return this._addCheck({kind:"url",...t.errToObj($)})}emoji($){return this._addCheck({kind:"emoji",...t.errToObj($)})}uuid($){return this._addCheck({kind:"uuid",...t.errToObj($)})}nanoid($){return this._addCheck({kind:"nanoid",...t.errToObj($)})}cuid($){return this._addCheck({kind:"cuid",...t.errToObj($)})}cuid2($){return this._addCheck({kind:"cuid2",...t.errToObj($)})}ulid($){return this._addCheck({kind:"ulid",...t.errToObj($)})}base64($){return this._addCheck({kind:"base64",...t.errToObj($)})}base64url($){return this._addCheck({kind:"base64url",...t.errToObj($)})}jwt($){return this._addCheck({kind:"jwt",...t.errToObj($)})}ip($){return this._addCheck({kind:"ip",...t.errToObj($)})}cidr($){return this._addCheck({kind:"cidr",...t.errToObj($)})}datetime($){if(typeof $==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:$});return this._addCheck({kind:"datetime",precision:typeof $?.precision>"u"?null:$?.precision,offset:$?.offset??!1,local:$?.local??!1,...t.errToObj($?.message)})}date($){return this._addCheck({kind:"date",message:$})}time($){if(typeof $==="string")return this._addCheck({kind:"time",precision:null,message:$});return this._addCheck({kind:"time",precision:typeof $?.precision>"u"?null:$?.precision,...t.errToObj($?.message)})}duration($){return this._addCheck({kind:"duration",...t.errToObj($)})}regex($,J){return this._addCheck({kind:"regex",regex:$,...t.errToObj(J)})}includes($,J){return this._addCheck({kind:"includes",value:$,position:J?.position,...t.errToObj(J?.message)})}startsWith($,J){return this._addCheck({kind:"startsWith",value:$,...t.errToObj(J)})}endsWith($,J){return this._addCheck({kind:"endsWith",value:$,...t.errToObj(J)})}min($,J){return this._addCheck({kind:"min",value:$,...t.errToObj(J)})}max($,J){return this._addCheck({kind:"max",value:$,...t.errToObj(J)})}length($,J){return this._addCheck({kind:"length",value:$,...t.errToObj(J)})}nonempty($){return this.min(1,t.errToObj($))}trim(){return new oJ({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new oJ({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new oJ({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find(($)=>$.kind==="datetime")}get isDate(){return!!this._def.checks.find(($)=>$.kind==="date")}get isTime(){return!!this._def.checks.find(($)=>$.kind==="time")}get isDuration(){return!!this._def.checks.find(($)=>$.kind==="duration")}get isEmail(){return!!this._def.checks.find(($)=>$.kind==="email")}get isURL(){return!!this._def.checks.find(($)=>$.kind==="url")}get isEmoji(){return!!this._def.checks.find(($)=>$.kind==="emoji")}get isUUID(){return!!this._def.checks.find(($)=>$.kind==="uuid")}get isNANOID(){return!!this._def.checks.find(($)=>$.kind==="nanoid")}get isCUID(){return!!this._def.checks.find(($)=>$.kind==="cuid")}get isCUID2(){return!!this._def.checks.find(($)=>$.kind==="cuid2")}get isULID(){return!!this._def.checks.find(($)=>$.kind==="ulid")}get isIP(){return!!this._def.checks.find(($)=>$.kind==="ip")}get isCIDR(){return!!this._def.checks.find(($)=>$.kind==="cidr")}get isBase64(){return!!this._def.checks.find(($)=>$.kind==="base64")}get isBase64url(){return!!this._def.checks.find(($)=>$.kind==="base64url")}get minLength(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxLength(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}oJ.create=($)=>{return new oJ({checks:[],typeName:M$.ZodString,coerce:$?.coerce??!1,...K$($)})};function iz($,J){let X=($.toString().split(".")[1]||"").length,Q=(J.toString().split(".")[1]||"").length,Y=X>Q?X:Q,G=Number.parseInt($.toFixed(Y).replace(".","")),W=Number.parseInt(J.toFixed(Y).replace(".",""));return G%W/10**Y}class o0 extends N${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse($){if(this._def.coerce)$.data=Number($.data);if(this._getType($)!==m.number){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.number,received:Y.parsedType}),W$}let X=void 0,Q=new EJ;for(let Y of this._def.checks)if(Y.kind==="int"){if(!B$.isInteger($.data))X=this._getOrReturnCtx($,X),c(X,{code:h.invalid_type,expected:"integer",received:"float",message:Y.message}),Q.dirty()}else if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_small,minimum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_big,maximum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if(iz($.data,Y.value)!==0)X=this._getOrReturnCtx($,X),c(X,{code:h.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else if(Y.kind==="finite"){if(!Number.isFinite($.data))X=this._getOrReturnCtx($,X),c(X,{code:h.not_finite,message:Y.message}),Q.dirty()}else B$.assertNever(Y);return{status:Q.value,value:$.data}}gte($,J){return this.setLimit("min",$,!0,t.toString(J))}gt($,J){return this.setLimit("min",$,!1,t.toString(J))}lte($,J){return this.setLimit("max",$,!0,t.toString(J))}lt($,J){return this.setLimit("max",$,!1,t.toString(J))}setLimit($,J,X,Q){return new o0({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:t.toString(Q)}]})}_addCheck($){return new o0({...this._def,checks:[...this._def.checks,$]})}int($){return this._addCheck({kind:"int",message:t.toString($)})}positive($){return this._addCheck({kind:"min",value:0,inclusive:!1,message:t.toString($)})}negative($){return this._addCheck({kind:"max",value:0,inclusive:!1,message:t.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:0,inclusive:!0,message:t.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:0,inclusive:!0,message:t.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:t.toString(J)})}finite($){return this._addCheck({kind:"finite",message:t.toString($)})}safe($){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:t.toString($)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:t.toString($)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}get isInt(){return!!this._def.checks.find(($)=>$.kind==="int"||$.kind==="multipleOf"&&B$.isInteger($.value))}get isFinite(){let $=null,J=null;for(let X of this._def.checks)if(X.kind==="finite"||X.kind==="int"||X.kind==="multipleOf")return!0;else if(X.kind==="min"){if(J===null||X.value>J)J=X.value}else if(X.kind==="max"){if($===null||X.value<$)$=X.value}return Number.isFinite(J)&&Number.isFinite($)}}o0.create=($)=>{return new o0({checks:[],typeName:M$.ZodNumber,coerce:$?.coerce||!1,...K$($)})};class a0 extends N${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse($){if(this._def.coerce)try{$.data=BigInt($.data)}catch{return this._getInvalidInput($)}if(this._getType($)!==m.bigint)return this._getInvalidInput($);let X=void 0,Q=new EJ;for(let Y of this._def.checks)if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_small,type:"bigint",minimum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_big,type:"bigint",maximum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if($.data%Y.value!==BigInt(0))X=this._getOrReturnCtx($,X),c(X,{code:h.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else B$.assertNever(Y);return{status:Q.value,value:$.data}}_getInvalidInput($){let J=this._getOrReturnCtx($);return c(J,{code:h.invalid_type,expected:m.bigint,received:J.parsedType}),W$}gte($,J){return this.setLimit("min",$,!0,t.toString(J))}gt($,J){return this.setLimit("min",$,!1,t.toString(J))}lte($,J){return this.setLimit("max",$,!0,t.toString(J))}lt($,J){return this.setLimit("max",$,!1,t.toString(J))}setLimit($,J,X,Q){return new a0({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:t.toString(Q)}]})}_addCheck($){return new a0({...this._def,checks:[...this._def.checks,$]})}positive($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:t.toString($)})}negative($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:t.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:t.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:t.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:t.toString(J)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}a0.create=($)=>{return new a0({checks:[],typeName:M$.ZodBigInt,coerce:$?.coerce??!1,...K$($)})};class tQ extends N${_parse($){if(this._def.coerce)$.data=Boolean($.data);if(this._getType($)!==m.boolean){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.boolean,received:X.parsedType}),W$}return FJ($.data)}}tQ.create=($)=>{return new tQ({typeName:M$.ZodBoolean,coerce:$?.coerce||!1,...K$($)})};class NQ extends N${_parse($){if(this._def.coerce)$.data=new Date($.data);if(this._getType($)!==m.date){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.date,received:Y.parsedType}),W$}if(Number.isNaN($.data.getTime())){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_date}),W$}let X=new EJ,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.getTime()<Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_small,message:Y.message,inclusive:!0,exact:!1,minimum:Y.value,type:"date"}),X.dirty()}else if(Y.kind==="max"){if($.data.getTime()>Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_big,message:Y.message,inclusive:!0,exact:!1,maximum:Y.value,type:"date"}),X.dirty()}else B$.assertNever(Y);return{status:X.value,value:new Date($.data.getTime())}}_addCheck($){return new NQ({...this._def,checks:[...this._def.checks,$]})}min($,J){return this._addCheck({kind:"min",value:$.getTime(),message:t.toString(J)})}max($,J){return this._addCheck({kind:"max",value:$.getTime(),message:t.toString(J)})}get minDate(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $!=null?new Date($):null}get maxDate(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $!=null?new Date($):null}}NQ.create=($)=>{return new NQ({checks:[],coerce:$?.coerce||!1,typeName:M$.ZodDate,...K$($)})};class JY extends N${_parse($){if(this._getType($)!==m.symbol){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.symbol,received:X.parsedType}),W$}return FJ($.data)}}JY.create=($)=>{return new JY({typeName:M$.ZodSymbol,...K$($)})};class eQ extends N${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.undefined,received:X.parsedType}),W$}return FJ($.data)}}eQ.create=($)=>{return new eQ({typeName:M$.ZodUndefined,...K$($)})};class $X extends N${_parse($){if(this._getType($)!==m.null){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.null,received:X.parsedType}),W$}return FJ($.data)}}$X.create=($)=>{return new $X({typeName:M$.ZodNull,...K$($)})};class LQ extends N${constructor(){super(...arguments);this._any=!0}_parse($){return FJ($.data)}}LQ.create=($)=>{return new LQ({typeName:M$.ZodAny,...K$($)})};class i0 extends N${constructor(){super(...arguments);this._unknown=!0}_parse($){return FJ($.data)}}i0.create=($)=>{return new i0({typeName:M$.ZodUnknown,...K$($)})};class q0 extends N${_parse($){let J=this._getOrReturnCtx($);return c(J,{code:h.invalid_type,expected:m.never,received:J.parsedType}),W$}}q0.create=($)=>{return new q0({typeName:M$.ZodNever,...K$($)})};class QY extends N${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.void,received:X.parsedType}),W$}return FJ($.data)}}QY.create=($)=>{return new QY({typeName:M$.ZodVoid,...K$($)})};class aJ extends N${_parse($){let{ctx:J,status:X}=this._processInputParams($),Q=this._def;if(J.parsedType!==m.array)return c(J,{code:h.invalid_type,expected:m.array,received:J.parsedType}),W$;if(Q.exactLength!==null){let G=J.data.length>Q.exactLength.value,W=J.data.length<Q.exactLength.value;if(G||W)c(J,{code:G?h.too_big:h.too_small,minimum:W?Q.exactLength.value:void 0,maximum:G?Q.exactLength.value:void 0,type:"array",inclusive:!0,exact:!0,message:Q.exactLength.message}),X.dirty()}if(Q.minLength!==null){if(J.data.length<Q.minLength.value)c(J,{code:h.too_small,minimum:Q.minLength.value,type:"array",inclusive:!0,exact:!1,message:Q.minLength.message}),X.dirty()}if(Q.maxLength!==null){if(J.data.length>Q.maxLength.value)c(J,{code:h.too_big,maximum:Q.maxLength.value,type:"array",inclusive:!0,exact:!1,message:Q.maxLength.message}),X.dirty()}if(J.common.async)return Promise.all([...J.data].map((G,W)=>{return Q.type._parseAsync(new rJ(J,G,J.path,W))})).then((G)=>{return EJ.mergeArray(X,G)});let Y=[...J.data].map((G,W)=>{return Q.type._parseSync(new rJ(J,G,J.path,W))});return EJ.mergeArray(X,Y)}get element(){return this._def.type}min($,J){return new aJ({...this._def,minLength:{value:$,message:t.toString(J)}})}max($,J){return new aJ({...this._def,maxLength:{value:$,message:t.toString(J)}})}length($,J){return new aJ({...this._def,exactLength:{value:$,message:t.toString(J)}})}nonempty($){return this.min(1,$)}}aJ.create=($,J)=>{return new aJ({type:$,minLength:null,maxLength:null,exactLength:null,typeName:M$.ZodArray,...K$(J)})};function sQ($){if($ instanceof a$){let J={};for(let X in $.shape){let Q=$.shape[X];J[X]=sJ.create(sQ(Q))}return new a$({...$._def,shape:()=>J})}else if($ instanceof aJ)return new aJ({...$._def,type:sQ($.element)});else if($ instanceof sJ)return sJ.create(sQ($.unwrap()));else if($ instanceof S0)return S0.create(sQ($.unwrap()));else if($ instanceof K0)return K0.create($.items.map((J)=>sQ(J)));else return $}class a$ extends N${constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let $=this._def.shape(),J=B$.objectKeys($);return this._cached={shape:$,keys:J},this._cached}_parse($){if(this._getType($)!==m.object){let M=this._getOrReturnCtx($);return c(M,{code:h.invalid_type,expected:m.object,received:M.parsedType}),W$}let{status:X,ctx:Q}=this._processInputParams($),{shape:Y,keys:G}=this._getCached(),W=[];if(!(this._def.catchall instanceof q0&&this._def.unknownKeys==="strip")){for(let M in Q.data)if(!G.includes(M))W.push(M)}let U=[];for(let M of G){let O=Y[M],V=Q.data[M];U.push({key:{status:"valid",value:M},value:O._parse(new rJ(Q,V,Q.path,M)),alwaysSet:M in Q.data})}if(this._def.catchall instanceof q0){let M=this._def.unknownKeys;if(M==="passthrough")for(let O of W)U.push({key:{status:"valid",value:O},value:{status:"valid",value:Q.data[O]}});else if(M==="strict"){if(W.length>0)c(Q,{code:h.unrecognized_keys,keys:W}),X.dirty()}else if(M==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let M=this._def.catchall;for(let O of W){let V=Q.data[O];U.push({key:{status:"valid",value:O},value:M._parse(new rJ(Q,V,Q.path,O)),alwaysSet:O in Q.data})}}if(Q.common.async)return Promise.resolve().then(async()=>{let M=[];for(let O of U){let V=await O.key,H=await O.value;M.push({key:V,value:H,alwaysSet:O.alwaysSet})}return M}).then((M)=>{return EJ.mergeObjectSync(X,M)});else return EJ.mergeObjectSync(X,U)}get shape(){return this._def.shape()}strict($){return t.errToObj,new a$({...this._def,unknownKeys:"strict",...$!==void 0?{errorMap:(J,X)=>{let Q=this._def.errorMap?.(J,X).message??X.defaultError;if(J.code==="unrecognized_keys")return{message:t.errToObj($).message??Q};return{message:Q}}}:{}})}strip(){return new a$({...this._def,unknownKeys:"strip"})}passthrough(){return new a$({...this._def,unknownKeys:"passthrough"})}extend($){return new a$({...this._def,shape:()=>({...this._def.shape(),...$})})}merge($){return new a$({unknownKeys:$._def.unknownKeys,catchall:$._def.catchall,shape:()=>({...this._def.shape(),...$._def.shape()}),typeName:M$.ZodObject})}setKey($,J){return this.augment({[$]:J})}catchall($){return new a$({...this._def,catchall:$})}pick($){let J={};for(let X of B$.objectKeys($))if($[X]&&this.shape[X])J[X]=this.shape[X];return new a$({...this._def,shape:()=>J})}omit($){let J={};for(let X of B$.objectKeys(this.shape))if(!$[X])J[X]=this.shape[X];return new a$({...this._def,shape:()=>J})}deepPartial(){return sQ(this)}partial($){let J={};for(let X of B$.objectKeys(this.shape)){let Q=this.shape[X];if($&&!$[X])J[X]=Q;else J[X]=Q.optional()}return new a$({...this._def,shape:()=>J})}required($){let J={};for(let X of B$.objectKeys(this.shape))if($&&!$[X])J[X]=this.shape[X];else{let Y=this.shape[X];while(Y instanceof sJ)Y=Y._def.innerType;J[X]=Y}return new a$({...this._def,shape:()=>J})}keyof(){return KU(B$.objectKeys(this.shape))}}a$.create=($,J)=>{return new a$({shape:()=>$,unknownKeys:"strip",catchall:q0.create(),typeName:M$.ZodObject,...K$(J)})};a$.strictCreate=($,J)=>{return new a$({shape:()=>$,unknownKeys:"strict",catchall:q0.create(),typeName:M$.ZodObject,...K$(J)})};a$.lazycreate=($,J)=>{return new a$({shape:$,unknownKeys:"strip",catchall:q0.create(),typeName:M$.ZodObject,...K$(J)})};class JX extends N${_parse($){let{ctx:J}=this._processInputParams($),X=this._def.options;function Q(Y){for(let W of Y)if(W.result.status==="valid")return W.result;for(let W of Y)if(W.result.status==="dirty")return J.common.issues.push(...W.ctx.common.issues),W.result;let G=Y.map((W)=>new TJ(W.ctx.common.issues));return c(J,{code:h.invalid_union,unionErrors:G}),W$}if(J.common.async)return Promise.all(X.map(async(Y)=>{let G={...J,common:{...J.common,issues:[]},parent:null};return{result:await Y._parseAsync({data:J.data,path:J.path,parent:G}),ctx:G}})).then(Q);else{let Y=void 0,G=[];for(let U of X){let M={...J,common:{...J.common,issues:[]},parent:null},O=U._parseSync({data:J.data,path:J.path,parent:M});if(O.status==="valid")return O;else if(O.status==="dirty"&&!Y)Y={result:O,ctx:M};if(M.common.issues.length)G.push(M.common.issues)}if(Y)return J.common.issues.push(...Y.ctx.common.issues),Y.result;let W=G.map((U)=>new TJ(U));return c(J,{code:h.invalid_union,unionErrors:W}),W$}}get options(){return this._def.options}}JX.create=($,J)=>{return new JX({options:$,typeName:M$.ZodUnion,...K$(J)})};var T0=($)=>{if($ instanceof XX)return T0($.schema);else if($ instanceof tJ)return T0($.innerType());else if($ instanceof YX)return[$.value];else if($ instanceof s0)return $.options;else if($ instanceof GX)return B$.objectValues($.enum);else if($ instanceof WX)return T0($._def.innerType);else if($ instanceof eQ)return[void 0];else if($ instanceof $X)return[null];else if($ instanceof sJ)return[void 0,...T0($.unwrap())];else if($ instanceof S0)return[null,...T0($.unwrap())];else if($ instanceof b9)return T0($.unwrap());else if($ instanceof MX)return T0($.unwrap());else if($ instanceof UX)return T0($._def.innerType);else return[]};class y9 extends N${_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.object)return c(J,{code:h.invalid_type,expected:m.object,received:J.parsedType}),W$;let X=this.discriminator,Q=J.data[X],Y=this.optionsMap.get(Q);if(!Y)return c(J,{code:h.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[X]}),W$;if(J.common.async)return Y._parseAsync({data:J.data,path:J.path,parent:J});else return Y._parseSync({data:J.data,path:J.path,parent:J})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create($,J,X){let Q=new Map;for(let Y of J){let G=T0(Y.shape[$]);if(!G.length)throw Error(`A discriminator value for key \`${$}\` could not be extracted from all schema options`);for(let W of G){if(Q.has(W))throw Error(`Discriminator property ${String($)} has duplicate value ${String(W)}`);Q.set(W,Y)}}return new y9({typeName:M$.ZodDiscriminatedUnion,discriminator:$,options:J,optionsMap:Q,...K$(X)})}}function OG($,J){let X=H0($),Q=H0(J);if($===J)return{valid:!0,data:$};else if(X===m.object&&Q===m.object){let Y=B$.objectKeys(J),G=B$.objectKeys($).filter((U)=>Y.indexOf(U)!==-1),W={...$,...J};for(let U of G){let M=OG($[U],J[U]);if(!M.valid)return{valid:!1};W[U]=M.data}return{valid:!0,data:W}}else if(X===m.array&&Q===m.array){if($.length!==J.length)return{valid:!1};let Y=[];for(let G=0;G<$.length;G++){let W=$[G],U=J[G],M=OG(W,U);if(!M.valid)return{valid:!1};Y.push(M.data)}return{valid:!0,data:Y}}else if(X===m.date&&Q===m.date&&+$===+J)return{valid:!0,data:$};else return{valid:!1}}class QX extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=(Y,G)=>{if(k9(Y)||k9(G))return W$;let W=OG(Y.value,G.value);if(!W.valid)return c(X,{code:h.invalid_intersection_types}),W$;if(f9(Y)||f9(G))J.dirty();return{status:J.value,value:W.data}};if(X.common.async)return Promise.all([this._def.left._parseAsync({data:X.data,path:X.path,parent:X}),this._def.right._parseAsync({data:X.data,path:X.path,parent:X})]).then(([Y,G])=>Q(Y,G));else return Q(this._def.left._parseSync({data:X.data,path:X.path,parent:X}),this._def.right._parseSync({data:X.data,path:X.path,parent:X}))}}QX.create=($,J,X)=>{return new QX({left:$,right:J,typeName:M$.ZodIntersection,...K$(X)})};class K0 extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.array)return c(X,{code:h.invalid_type,expected:m.array,received:X.parsedType}),W$;if(X.data.length<this._def.items.length)return c(X,{code:h.too_small,minimum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),W$;if(!this._def.rest&&X.data.length>this._def.items.length)c(X,{code:h.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),J.dirty();let Y=[...X.data].map((G,W)=>{let U=this._def.items[W]||this._def.rest;if(!U)return null;return U._parse(new rJ(X,G,X.path,W))}).filter((G)=>!!G);if(X.common.async)return Promise.all(Y).then((G)=>{return EJ.mergeArray(J,G)});else return EJ.mergeArray(J,Y)}get items(){return this._def.items}rest($){return new K0({...this._def,rest:$})}}K0.create=($,J)=>{if(!Array.isArray($))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new K0({items:$,typeName:M$.ZodTuple,rest:null,...K$(J)})};class XY extends N${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.object)return c(X,{code:h.invalid_type,expected:m.object,received:X.parsedType}),W$;let Q=[],Y=this._def.keyType,G=this._def.valueType;for(let W in X.data)Q.push({key:Y._parse(new rJ(X,W,X.path,W)),value:G._parse(new rJ(X,X.data[W],X.path,W)),alwaysSet:W in X.data});if(X.common.async)return EJ.mergeObjectAsync(J,Q);else return EJ.mergeObjectSync(J,Q)}get element(){return this._def.valueType}static create($,J,X){if(J instanceof N$)return new XY({keyType:$,valueType:J,typeName:M$.ZodRecord,...K$(X)});return new XY({keyType:oJ.create(),valueType:$,typeName:M$.ZodRecord,...K$(J)})}}class YY extends N${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.map)return c(X,{code:h.invalid_type,expected:m.map,received:X.parsedType}),W$;let Q=this._def.keyType,Y=this._def.valueType,G=[...X.data.entries()].map(([W,U],M)=>{return{key:Q._parse(new rJ(X,W,X.path,[M,"key"])),value:Y._parse(new rJ(X,U,X.path,[M,"value"]))}});if(X.common.async){let W=new Map;return Promise.resolve().then(async()=>{for(let U of G){let M=await U.key,O=await U.value;if(M.status==="aborted"||O.status==="aborted")return W$;if(M.status==="dirty"||O.status==="dirty")J.dirty();W.set(M.value,O.value)}return{status:J.value,value:W}})}else{let W=new Map;for(let U of G){let{key:M,value:O}=U;if(M.status==="aborted"||O.status==="aborted")return W$;if(M.status==="dirty"||O.status==="dirty")J.dirty();W.set(M.value,O.value)}return{status:J.value,value:W}}}}YY.create=($,J,X)=>{return new YY({valueType:J,keyType:$,typeName:M$.ZodMap,...K$(X)})};class AQ extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.set)return c(X,{code:h.invalid_type,expected:m.set,received:X.parsedType}),W$;let Q=this._def;if(Q.minSize!==null){if(X.data.size<Q.minSize.value)c(X,{code:h.too_small,minimum:Q.minSize.value,type:"set",inclusive:!0,exact:!1,message:Q.minSize.message}),J.dirty()}if(Q.maxSize!==null){if(X.data.size>Q.maxSize.value)c(X,{code:h.too_big,maximum:Q.maxSize.value,type:"set",inclusive:!0,exact:!1,message:Q.maxSize.message}),J.dirty()}let Y=this._def.valueType;function G(U){let M=new Set;for(let O of U){if(O.status==="aborted")return W$;if(O.status==="dirty")J.dirty();M.add(O.value)}return{status:J.value,value:M}}let W=[...X.data.values()].map((U,M)=>Y._parse(new rJ(X,U,X.path,M)));if(X.common.async)return Promise.all(W).then((U)=>G(U));else return G(W)}min($,J){return new AQ({...this._def,minSize:{value:$,message:t.toString(J)}})}max($,J){return new AQ({...this._def,maxSize:{value:$,message:t.toString(J)}})}size($,J){return this.min($,J).max($,J)}nonempty($){return this.min(1,$)}}AQ.create=($,J)=>{return new AQ({valueType:$,minSize:null,maxSize:null,typeName:M$.ZodSet,...K$(J)})};class rQ extends N${constructor(){super(...arguments);this.validate=this.implement}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.function)return c(J,{code:h.invalid_type,expected:m.function,received:J.parsedType}),W$;function X(W,U){return $Y({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,oQ(),j0].filter((M)=>!!M),issueData:{code:h.invalid_arguments,argumentsError:U}})}function Q(W,U){return $Y({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,oQ(),j0].filter((M)=>!!M),issueData:{code:h.invalid_return_type,returnTypeError:U}})}let Y={errorMap:J.common.contextualErrorMap},G=J.data;if(this._def.returns instanceof RQ){let W=this;return FJ(async function(...U){let M=new TJ([]),O=await W._def.args.parseAsync(U,Y).catch((q)=>{throw M.addIssue(X(U,q)),M}),V=await Reflect.apply(G,this,O);return await W._def.returns._def.type.parseAsync(V,Y).catch((q)=>{throw M.addIssue(Q(V,q)),M})})}else{let W=this;return FJ(function(...U){let M=W._def.args.safeParse(U,Y);if(!M.success)throw new TJ([X(U,M.error)]);let O=Reflect.apply(G,this,M.data),V=W._def.returns.safeParse(O,Y);if(!V.success)throw new TJ([Q(O,V.error)]);return V.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(...$){return new rQ({...this._def,args:K0.create($).rest(i0.create())})}returns($){return new rQ({...this._def,returns:$})}implement($){return this.parse($)}strictImplement($){return this.parse($)}static create($,J,X){return new rQ({args:$?$:K0.create([]).rest(i0.create()),returns:J||i0.create(),typeName:M$.ZodFunction,...K$(X)})}}class XX extends N${get schema(){return this._def.getter()}_parse($){let{ctx:J}=this._processInputParams($);return this._def.getter()._parse({data:J.data,path:J.path,parent:J})}}XX.create=($,J)=>{return new XX({getter:$,typeName:M$.ZodLazy,...K$(J)})};class YX extends N${_parse($){if($.data!==this._def.value){let J=this._getOrReturnCtx($);return c(J,{received:J.data,code:h.invalid_literal,expected:this._def.value}),W$}return{status:"valid",value:$.data}}get value(){return this._def.value}}YX.create=($,J)=>{return new YX({value:$,typeName:M$.ZodLiteral,...K$(J)})};function KU($,J){return new s0({values:$,typeName:M$.ZodEnum,...K$(J)})}class s0 extends N${_parse($){if(typeof $.data!=="string"){let J=this._getOrReturnCtx($),X=this._def.values;return c(J,{expected:B$.joinValues(X),received:J.parsedType,code:h.invalid_type}),W$}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has($.data)){let J=this._getOrReturnCtx($),X=this._def.values;return c(J,{received:J.data,code:h.invalid_enum_value,options:X}),W$}return FJ($.data)}get options(){return this._def.values}get enum(){let $={};for(let J of this._def.values)$[J]=J;return $}get Values(){let $={};for(let J of this._def.values)$[J]=J;return $}get Enum(){let $={};for(let J of this._def.values)$[J]=J;return $}extract($,J=this._def){return s0.create($,{...this._def,...J})}exclude($,J=this._def){return s0.create(this.options.filter((X)=>!$.includes(X)),{...this._def,...J})}}s0.create=KU;class GX extends N${_parse($){let J=B$.getValidEnumValues(this._def.values),X=this._getOrReturnCtx($);if(X.parsedType!==m.string&&X.parsedType!==m.number){let Q=B$.objectValues(J);return c(X,{expected:B$.joinValues(Q),received:X.parsedType,code:h.invalid_type}),W$}if(!this._cache)this._cache=new Set(B$.getValidEnumValues(this._def.values));if(!this._cache.has($.data)){let Q=B$.objectValues(J);return c(X,{received:X.data,code:h.invalid_enum_value,options:Q}),W$}return FJ($.data)}get enum(){return this._def.values}}GX.create=($,J)=>{return new GX({values:$,typeName:M$.ZodNativeEnum,...K$(J)})};class RQ extends N${unwrap(){return this._def.type}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.promise&&J.common.async===!1)return c(J,{code:h.invalid_type,expected:m.promise,received:J.parsedType}),W$;let X=J.parsedType===m.promise?J.data:Promise.resolve(J.data);return FJ(X.then((Q)=>{return this._def.type.parseAsync(Q,{path:J.path,errorMap:J.common.contextualErrorMap})}))}}RQ.create=($,J)=>{return new RQ({type:$,typeName:M$.ZodPromise,...K$(J)})};class tJ extends N${innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===M$.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=this._def.effect||null,Y={addIssue:(G)=>{if(c(X,G),G.fatal)J.abort();else J.dirty()},get path(){return X.path}};if(Y.addIssue=Y.addIssue.bind(Y),Q.type==="preprocess"){let G=Q.transform(X.data,Y);if(X.common.async)return Promise.resolve(G).then(async(W)=>{if(J.value==="aborted")return W$;let U=await this._def.schema._parseAsync({data:W,path:X.path,parent:X});if(U.status==="aborted")return W$;if(U.status==="dirty")return FQ(U.value);if(J.value==="dirty")return FQ(U.value);return U});else{if(J.value==="aborted")return W$;let W=this._def.schema._parseSync({data:G,path:X.path,parent:X});if(W.status==="aborted")return W$;if(W.status==="dirty")return FQ(W.value);if(J.value==="dirty")return FQ(W.value);return W}}if(Q.type==="refinement"){let G=(W)=>{let U=Q.refinement(W,Y);if(X.common.async)return Promise.resolve(U);if(U instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return W};if(X.common.async===!1){let W=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(W.status==="aborted")return W$;if(W.status==="dirty")J.dirty();return G(W.value),{status:J.value,value:W.value}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((W)=>{if(W.status==="aborted")return W$;if(W.status==="dirty")J.dirty();return G(W.value).then(()=>{return{status:J.value,value:W.value}})})}if(Q.type==="transform")if(X.common.async===!1){let G=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(!n0(G))return W$;let W=Q.transform(G.value,Y);if(W instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:J.value,value:W}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((G)=>{if(!n0(G))return W$;return Promise.resolve(Q.transform(G.value,Y)).then((W)=>({status:J.value,value:W}))});B$.assertNever(Q)}}tJ.create=($,J,X)=>{return new tJ({schema:$,typeName:M$.ZodEffects,effect:J,...K$(X)})};tJ.createWithPreprocess=($,J,X)=>{return new tJ({schema:J,effect:{type:"preprocess",transform:$},typeName:M$.ZodEffects,...K$(X)})};class sJ extends N${_parse($){if(this._getType($)===m.undefined)return FJ(void 0);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}sJ.create=($,J)=>{return new sJ({innerType:$,typeName:M$.ZodOptional,...K$(J)})};class S0 extends N${_parse($){if(this._getType($)===m.null)return FJ(null);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}S0.create=($,J)=>{return new S0({innerType:$,typeName:M$.ZodNullable,...K$(J)})};class WX extends N${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;if(J.parsedType===m.undefined)X=this._def.defaultValue();return this._def.innerType._parse({data:X,path:J.path,parent:J})}removeDefault(){return this._def.innerType}}WX.create=($,J)=>{return new WX({innerType:$,typeName:M$.ZodDefault,defaultValue:typeof J.default==="function"?J.default:()=>J.default,...K$(J)})};class UX extends N${_parse($){let{ctx:J}=this._processInputParams($),X={...J,common:{...J.common,issues:[]}},Q=this._def.innerType._parse({data:X.data,path:X.path,parent:{...X}});if(aQ(Q))return Q.then((Y)=>{return{status:"valid",value:Y.status==="valid"?Y.value:this._def.catchValue({get error(){return new TJ(X.common.issues)},input:X.data})}});else return{status:"valid",value:Q.status==="valid"?Q.value:this._def.catchValue({get error(){return new TJ(X.common.issues)},input:X.data})}}removeCatch(){return this._def.innerType}}UX.create=($,J)=>{return new UX({innerType:$,typeName:M$.ZodCatch,catchValue:typeof J.catch==="function"?J.catch:()=>J.catch,...K$(J)})};class GY extends N${_parse($){if(this._getType($)!==m.nan){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.nan,received:X.parsedType}),W$}return{status:"valid",value:$.data}}}GY.create=($)=>{return new GY({typeName:M$.ZodNaN,...K$($)})};var oz=Symbol("zod_brand");class b9 extends N${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;return this._def.type._parse({data:X,path:J.path,parent:J})}unwrap(){return this._def.type}}class WY extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.common.async)return(async()=>{let Y=await this._def.in._parseAsync({data:X.data,path:X.path,parent:X});if(Y.status==="aborted")return W$;if(Y.status==="dirty")return J.dirty(),FQ(Y.value);else return this._def.out._parseAsync({data:Y.value,path:X.path,parent:X})})();else{let Q=this._def.in._parseSync({data:X.data,path:X.path,parent:X});if(Q.status==="aborted")return W$;if(Q.status==="dirty")return J.dirty(),{status:"dirty",value:Q.value};else return this._def.out._parseSync({data:Q.value,path:X.path,parent:X})}}static create($,J){return new WY({in:$,out:J,typeName:M$.ZodPipeline})}}class MX extends N${_parse($){let J=this._def.innerType._parse($),X=(Q)=>{if(n0(Q))Q.value=Object.freeze(Q.value);return Q};return aQ(J)?J.then((Q)=>X(Q)):X(J)}unwrap(){return this._def.innerType}}MX.create=($,J)=>{return new MX({innerType:$,typeName:M$.ZodReadonly,...K$(J)})};function OU($,J){let X=typeof $==="function"?$(J):typeof $==="string"?{message:$}:$;return typeof X==="string"?{message:X}:X}function zU($,J={},X){if($)return LQ.create().superRefine((Q,Y)=>{let G=$(Q);if(G instanceof Promise)return G.then((W)=>{if(!W){let U=OU(J,Q),M=U.fatal??X??!0;Y.addIssue({code:"custom",...U,fatal:M})}});if(!G){let W=OU(J,Q),U=W.fatal??X??!0;Y.addIssue({code:"custom",...W,fatal:U})}return});return LQ.create()}var az={object:a$.lazycreate},M$;(function($){$.ZodString="ZodString",$.ZodNumber="ZodNumber",$.ZodNaN="ZodNaN",$.ZodBigInt="ZodBigInt",$.ZodBoolean="ZodBoolean",$.ZodDate="ZodDate",$.ZodSymbol="ZodSymbol",$.ZodUndefined="ZodUndefined",$.ZodNull="ZodNull",$.ZodAny="ZodAny",$.ZodUnknown="ZodUnknown",$.ZodNever="ZodNever",$.ZodVoid="ZodVoid",$.ZodArray="ZodArray",$.ZodObject="ZodObject",$.ZodUnion="ZodUnion",$.ZodDiscriminatedUnion="ZodDiscriminatedUnion",$.ZodIntersection="ZodIntersection",$.ZodTuple="ZodTuple",$.ZodRecord="ZodRecord",$.ZodMap="ZodMap",$.ZodSet="ZodSet",$.ZodFunction="ZodFunction",$.ZodLazy="ZodLazy",$.ZodLiteral="ZodLiteral",$.ZodEnum="ZodEnum",$.ZodEffects="ZodEffects",$.ZodNativeEnum="ZodNativeEnum",$.ZodOptional="ZodOptional",$.ZodNullable="ZodNullable",$.ZodDefault="ZodDefault",$.ZodCatch="ZodCatch",$.ZodPromise="ZodPromise",$.ZodBranded="ZodBranded",$.ZodPipeline="ZodPipeline",$.ZodReadonly="ZodReadonly"})(M$||(M$={}));var sz=($,J={message:`Input not instance of ${$.name}`})=>zU((X)=>X instanceof $,J),EU=oJ.create,FU=o0.create,rz=GY.create,tz=a0.create,NU=tQ.create,ez=NQ.create,$E=JY.create,JE=eQ.create,QE=$X.create,XE=LQ.create,YE=i0.create,GE=q0.create,WE=QY.create,UE=aJ.create,ME=a$.create,OE=a$.strictCreate,VE=JX.create,HE=y9.create,qE=QX.create,KE=K0.create,zE=XY.create,EE=YY.create,FE=AQ.create,NE=rQ.create,LE=XX.create,AE=YX.create,RE=s0.create,DE=GX.create,ZE=RQ.create,BE=tJ.create,jE=sJ.create,TE=S0.create,SE=tJ.createWithPreprocess,IE=WY.create,CE=()=>EU().optional(),wE=()=>FU().optional(),PE=()=>NU().optional(),_E={string:($)=>oJ.create({...$,coerce:!0}),number:($)=>o0.create({...$,coerce:!0}),boolean:($)=>tQ.create({...$,coerce:!0}),bigint:($)=>a0.create({...$,coerce:!0}),date:($)=>NQ.create({...$,coerce:!0})};var xE=W$;function HG($){if(vE($)===6)return!0;if($.includes("://")||$.includes("/")||$.includes(":"))return!1;if($==="localhost")return!0;if($.startsWith("*.")){let J=$.slice(2);if(!J.includes(".")||J.startsWith(".")||J.endsWith("."))return!1;let X=J.split(".");return X.length>=2&&X.every((Q)=>Q.length>0)}if($.includes("*"))return!1;return $.includes(".")&&!$.startsWith(".")&&!$.endsWith(".")}var qG='Invalid domain pattern. Must be a valid domain (e.g., "example.com"), a wildcard (e.g., "*.example.com"), or a bracketed IPv6 literal (e.g., "[::1]", "[2001:db8::1]:443"). Overly broad patterns like "*.com" or "*" are not allowed for security reasons.',u9=x.string().refine(HG,{message:qG});function AU($){let J=$.indexOf(":");return!(J!==-1&&$.indexOf(":",J+1)!==-1)||$.startsWith("[")}var fE=x.string().refine(($)=>AU($)&&HG(cX($).hostPattern),{message:qG+' An optional ":port" suffix (1-65535) restricts the entry to that port.'}),yE=x.string().refine(($)=>{if(!AU($))return!1;let{hostPattern:J}=cX($);return J==="*"||HG(J)},{message:qG+' In deniedDomains a bare "*" (deny-all) is also accepted, and an optional ":port" suffix (1-65535) restricts the entry to that port.'}),UY=x.string().min(1,"Path cannot be empty"),LU=x.string().min(1,"Path cannot be empty").refine(($)=>kE($),{message:"Binary path must be absolute"}),bE=x.object({socketPath:x.string().min(1).describe("Unix socket path to the MITM proxy"),domains:x.array(u9).min(1).describe('Domains to route through the MITM proxy (e.g., ["api.example.com", "*.internal.org"])')}),hE=x.object({http:x.string().url().optional().describe("Upstream proxy URL for plain HTTP traffic"),https:x.string().url().optional().describe("Upstream proxy URL for HTTPS/CONNECT traffic (falls back to http if unset)"),noProxy:x.string().optional().describe("Comma-separated NO_PROXY list (hostname suffixes and CIDR ranges). Matching destinations connect directly instead of via the parent proxy.")}),RU=x.enum(["deny","mask"]),h9=x.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/,"Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores"),DU=x.string().superRefine(($,J)=>{try{let{groupCount:X}=F7($);if(X<1)J.addIssue({code:x.ZodIssueCode.custom,message:"extract must contain at least one capturing group \u2014 group 1 is "+'the credential value to mask (e.g. "token:\\s*(\\S+)").'})}catch(X){J.addIssue({code:x.ZodIssueCode.custom,message:X instanceof Error?X.message:"Credential extract pattern is invalid"})}}),uE=x.object({path:UY.describe("Path to a credential file or directory. Supports the same path forms as filesystem.denyRead (absolute paths and ~ expansion)."),mode:RU.describe("Access mode for this path"),extract:DU.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the file is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe("What to do when extract matches nothing (or, with decode, no "+'candidate verifies): "warn" (default \u2014 stderr warning, file left '+'readable), "deny" (degrade to mode "deny" \u2014 file unreadable), or '+'"error" (throw at wrap time). Only meaningful with mode "mask" and extract or decode set.'),decode:x.enum(["jwt"]).optional().describe('Optional encoded-credential format. "jwt": decodes recognized JWTs so masking can target fields inside them (see maskClaims). Candidates are located with a built-in JWT regex (or the explicit extract pattern, if set) and verified to actually be JWTs before masking. Without maskClaims, the whole decoded value is treated as the credential and replaced with a structurally valid fake JWT, so client-side token parsing keeps working. If no candidate verifies, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches in any verified token, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskDuplicates:x.boolean().optional().describe("If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the "+"corresponding sentinel \u2014 for a secret repeated where the regex "+`does not reach (e.g. in a comment). Matches raw substrings: short or common credential values may corrupt unrelated content, so this is intended for long, high-entropy secrets. With decode, only values that passed verification are scanned; duplicates reuse the verified value's fake without re-verification. Defaults to false. Only meaningful with mode "mask" and extract or decode set; accepted but ignored otherwise.`),injectHosts:x.array(u9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),gE=x.object({name:h9.describe("Environment variable name"),mode:RU.describe("Access mode for this environment variable"),extract:DU.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the value is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe('What to do when extract matches nothing: "warn" (default \u2014 stderr '+'warning, variable passes through unmasked), "deny" (variable unset inside the sandbox), or "error" (throw at wrap time). Only meaningful with mode "mask" and extract set.'),decode:x.enum(["jwt"]).optional().describe(`Optional encoded-credential format. "jwt": the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".`),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHosts:x.array(u9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),mE=x.object({accessKeyIdVar:h9.describe("Name of the masked env var holding the AWS access key id."),secretAccessKeyVar:h9.describe("Name of the masked env var holding the AWS secret access key."),sessionTokenVar:h9.optional().describe("Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.")}).strict(),VG=x.enum(["deny","passthrough"]),lE=x.object({streaming:VG.optional().describe('Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. Default "deny".'),presigned:VG.optional().describe('Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. Default "deny".'),sigv4a:VG.optional().describe('Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. Default "deny".')}).strict(),ZU=x.object({files:x.array(uE).optional().describe("Credential files or directories to protect"),envVars:x.array(gE).optional().describe("Environment variables to protect"),allowPlaintextInject:x.boolean().optional().describe("Allow sentinel\u2192real substitution on the plain-HTTP proxy path. "+"Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures."),awsPairs:x.array(mE).optional().describe("Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked."),sigv4:lE.optional().describe('Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: "deny" (default) or "passthrough".')}).strict(),BU=x.object({allowedDomains:x.array(fE).describe('List of allowed domains (e.g., ["github.com", "*.npmjs.org", "api.example.com:443"]). An optional ":port" suffix restricts the entry to that destination port.'),deniedDomains:x.array(yE).describe('List of denied domains. Unlike allowedDomains, a bare "*" is accepted here (deny-all). An optional ":port" suffix (e.g., "*:22") restricts the entry to that destination port.'),deniedDomainReasons:x.record(x.string(),x.string().min(1)).optional().describe('Optional model-facing reason keyed by the exact deniedDomains entry it explains (e.g., {"github.com:22": "SSH pushes to GitHub are blocked; use an https remote"}). Reported in the <sandbox_violations> line when that entry denies a connection; entries without one use a generic reason. Keys are matched by exact entry string, so a key with no matching deniedDomains entry never fires.'),strictAllowlist:x.boolean().optional().describe("If true, hosts not in allowedDomains are denied without consulting the ask callback. Set this when allowedDomains is policy enforcement, not a prompt-suppression hint."),allowUnixSockets:x.array(x.string()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),allowAllUnixSockets:x.boolean().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),allowLocalBinding:x.boolean().optional().describe("Whether to allow binding to local ports (default: false)"),allowMachLookup:x.array(x.string().refine(($)=>{return!($.endsWith("*")?$.slice(0,-1):$).includes("*")},{message:'Wildcards are only allowed as a single trailing "*" (e.g., "com.example.*" or "*" for all services).'})).optional().describe('macOS only: Additional XPC/Mach service names to allow looking up. Supports trailing-wildcard prefix matching (e.g., "2BUA8C4S2C.com.1password.*"). Needed for tools like 1Password CLI, Playwright, or the iOS Simulator that communicate via XPC.'),httpProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external HTTP proxy to use instead of starting a local one. When provided, the library will skip starting its own HTTP proxy and use this port. The external proxy must handle domain filtering."),socksProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external SOCKS proxy to use instead of starting a local one. When provided, the library will skip starting its own SOCKS proxy and use this port. The external proxy must handle domain filtering."),mitmProxy:bE.optional().describe("Optional MITM proxy configuration. Routes matching domains through an upstream proxy via Unix socket while SRT still handles allow/deny filtering."),filterRequest:x.custom(($)=>typeof $==="function",{message:"filterRequest must be a function"}).optional().describe("Per-request filter callback. Receives the parsed HTTP request (web-standard Request) and returns {action, reason?}. Denied requests get a 403 with the reason. If the callback throws, the request is denied. Applies to plain HTTP through the proxy and, when tlsTerminate is configured, to terminated HTTPS. SRT does not provide a policy language; library consumers own matching."),tlsTerminate:x.object({caCertPath:x.string().min(1).optional().describe("Path to a PEM-encoded CA certificate. The sandboxed child is configured to trust this CA, and the TLS-terminating proxy uses it to sign per-host certificates. If omitted, on Windows SRT generates-if-absent a persistent CA under %ProgramData%\\sandbox-runtime\\ca\\ and trusts it in the sandbox user's Root store; on other platforms SRT generates an ephemeral CA into a temp directory for the lifetime of the session."),caKeyPath:x.string().min(1).optional().describe("Path to the PEM-encoded private key for caCertPath."),excludeDomains:x.array(u9).optional().describe("Domain patterns (same syntax as allowedDomains) whose HTTPS connections are NOT terminated. Matching CONNECTs are opaque byte tunnels: still subject to the allow/deny domain lists, but the sandboxed client completes its own TLS handshake with the upstream, so filterRequest and credential injection do not apply to their HTTPS traffic (plain-HTTP requests to the same hosts keep the normal request pipeline). Use for hosts the proxy must not re-originate: mTLS upstreams (only the client holds the client certificate) and clients that pin the upstream certificate and would reject the MITM CA. Hosts still need to be reachable via allowedDomains; this list only changes how they are tunnelled."),extraCaCertPaths:x.array(x.string().min(1)).optional().describe("Paths to PEM CA certificate files appended to the trust bundle the sandboxed child is pointed at, after the MITM CA and the host's regular roots. Use for site-local roots (e.g. an internal mTLS CA) presented by excluded/passthrough hosts, so the child can verify them itself. Only the CERTIFICATE blocks of each file are copied; files that are missing, unreadable, or contain no PEM CERTIFICATE block are skipped (with a debug log), so paths that exist on only some hosts are safe to list.")}).refine(($)=>!$.caCertPath===!$.caKeyPath,{message:"caCertPath and caKeyPath must be provided together"}).optional().describe("[EXPERIMENTAL] Enable in-process TLS termination so HTTPS request/response bodies are visible to SRT. Provide a CA cert+key, or omit both to have SRT generate an ephemeral one."),parentProxy:hE.optional().describe("Upstream HTTP proxy for outbound connections. When set, SRT's proxy tunnels non-mitmProxy traffic through this parent instead of connecting directly. Falls back to HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars if unset.")}),jU=x.object({disabled:x.boolean().optional().describe("Disable all filesystem policy enforcement. When true, no read or write rules are emitted: denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, .claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process is trusted with full host filesystem access. Network and credential-env restrictions still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs."),denyRead:x.array(UY).describe("Paths denied for reading"),allowRead:x.array(UY).optional().describe("Paths to re-allow reading within denied regions (takes precedence over denyRead). Use with denyRead to deny a broad region then allow back specific subdirectories."),allowWrite:x.array(UY).describe("Paths allowed for writing"),denyWrite:x.array(UY).describe("Paths denied for writing (takes precedence over allowWrite)"),allowGitConfig:x.boolean().optional().describe("Allow writes to .git/config files (default: false). Enables git remote URL updates while keeping .git/hooks protected.")}),TU=x.record(x.string(),x.array(x.string())).describe('Map of command patterns to filesystem paths to ignore violations for. Use "*" to match all commands'),SU=x.object({command:x.string().describe("The ripgrep command to execute"),args:x.array(x.string()).optional().describe("Additional arguments to pass before ripgrep args"),argv0:x.string().optional().describe("Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])")}),IU=x.object({safeDirectories:x.array(x.string()).default([]).describe("Directories git should treat as safe (`safe.directory`) even though they're owned by a different user inside the sandbox. Use for the repo top-level when launching from a subdirectory. Does NOT grant write.")}),CU=x.object({path:x.string().min(1).describe("Path to the srt-win binary. Pass the exported VENDORED_SRT_WIN_EXE constant to use the packaged vendor/srt-win/<arch>/srt-win.exe (see its WARNING: in a dev checkout that file may sit inside your sandbox write grant). The binary is spawned with the `--srt-win` argv[1] sentinel so a multicall dispatcher can route to srt-win's CLI.")}),wU=x.object({sandboxUser:x.string().min(1).max(20,"Windows local usernames are limited to 20 characters").optional().describe("Name for the dedicated sandbox user account that `srt-win install` creates and the sandboxed child runs as. Default: `srt-sandbox`. Install refuses if an account by this name already exists and srt-win did not create it (it will not rotate the password of an account it does not own). Must match what `srt-win install --sandbox-user` was run with."),sublayerGuid:x.string().uuid().optional().describe("WFP sublayer GUID under which the filters were installed. Omit to use the srt-win compile-time default. Set this when filters were installed by enterprise tooling under a custom sublayer."),wfpSublayerGuid:x.string().uuid().optional().describe("Deprecated alias for sublayerGuid."),proxyPortRange:x.tuple([x.number().int().min(1),x.number().int().max(65535)]).refine(([$,J])=>$<=J&&J-$<=64,{message:"low must be \u2264 high and range width \u2264 64"}).optional().describe("Inclusive [low, high] port range the JS mux proxy listeners bind inside. MUST match the range passed to `srt-win install "+"--proxy-port-range` (default 60080\u201360089) \u2014 the WFP loopback "+"permit only covers ports in that range."),srtWin:CU.optional().describe("How to locate/invoke the srt-win helper binary. `srtWin.path` is "+"required to use the Windows sandbox \u2014 your own (multicall) binary, "+"or the exported VENDORED_SRT_WIN_EXE constant for the packaged exe.")}),pE=x.object({applyPath:x.string().optional().describe("Path to the apply-seccomp binary"),argv0:x.string().optional().describe("Invoke apply-seccomp as a multicall binary that dispatches on the ARGV0 environment variable. When set, applyPath is used verbatim (no existence check) and the invocation inside bwrap is prefixed with ARGV0=<this value>. The caller is responsible for ensuring applyPath resolves inside the bwrap namespace and that the target binary implements the apply-seccomp interface when ARGV0 matches.")}),dE=x.object({network:BU.describe("Network restrictions configuration"),filesystem:jU.describe("Filesystem restrictions configuration"),credentials:ZU.optional().describe("Credential handling configuration. Only the explicitly declared files and environment variables are restricted."),ignoreViolations:TU.optional().describe("Optional configuration for ignoring specific violations"),enableWeakerNestedSandbox:x.boolean().optional().describe("Enable weaker nested sandbox mode (for Docker environments)"),runAsUid:x.number().int().nonnegative().optional().describe("ARA: uid to drop the sandboxed command to (bwrap --uid)"),runAsGid:x.number().int().nonnegative().optional().describe("ARA: gid to drop the sandboxed command to (bwrap --gid)"),runAsHostUid:x.number().int().positive().optional().describe("ARA: real host uid used to launch the sandboxed bwrap child"),runAsHostGid:x.number().int().positive().optional().describe("ARA: real host gid used to launch the sandboxed bwrap child"),runAsHostHome:x.string().min(1).optional().describe("ARA: HOME set inside a real-host-uid sandbox child"),runAsHostUser:x.string().min(1).optional().describe("ARA: USER and LOGNAME set inside a real-host-uid sandbox child"),enableWeakerNetworkIsolation:x.boolean().optional().describe("Enable weaker network isolation to allow access to com.apple.trustd.agent (macOS only). This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data exfiltration vector through the trustd service. Only enable if you need Go TLS verification."),allowAppleEvents:x.boolean().optional().describe("Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or network restrictions), and can script running apps subject to TCC automation consent. Default: false."),ripgrep:SU.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),mandatoryDenySearchDepth:x.number().int().min(1).max(10).optional().describe("Maximum directory depth to search for dangerous files on Linux (default: 3). Higher values provide more protection but slower performance."),allowPty:x.boolean().optional().describe("Allow pseudo-terminal (pty) operations (macOS only)"),seccomp:pE.optional().describe("Custom seccomp binary paths (Linux only)."),bwrapPath:LU.optional().describe('Linux only: absolute path to the bwrap (bubblewrap) binary. When set, this path is used directly instead of resolving "bwrap" via PATH.'),socatPath:LU.optional().describe('Linux only: absolute path to the socat binary. When set, this path is used directly instead of resolving "socat" via PATH.'),windows:wU.optional().describe("Windows-specific settings (WFP sublayer, proxy port range)."),git:IU.optional().describe("Git configuration to inject via GIT_CONFIG_* env vars (cross-platform). `safeDirectories` marks paths as `safe.directory` without adding them to `filesystem.allowWrite`.")}).superRefine(($,J)=>{let X=$.credentials;if(!X)return;let Q=$.network.allowedDomains.map(nX),Y=(M,O)=>{for(let[V,H]of M.entries())if(!C9(H,Q))J.addIssue({code:x.ZodIssueCode.custom,path:[...O,V],message:`injectHosts entry "${H}" is not reachable via `+`network.allowedDomains \u2014 add "${H}" (or a covering wildcard) to allowedDomains, or remove it from injectHosts.`})},G=!1,W=(M,O)=>{if(M.injectHosts)Y(M.injectHosts,[...O,"injectHosts"]);if(M.mode!=="mask")return;G=!0;let V=$.network.tlsTerminate?.excludeDomains;if(V?.length){if(M.injectHosts){for(let[H,q]of M.injectHosts.entries())if(C9(q,V))J.addIssue({code:x.ZodIssueCode.custom,path:[...O,"injectHosts",H],message:`injectHosts entry "${q}" is entirely covered by network.tlsTerminate.excludeDomains. Credential injection only runs on TLS-terminated connections, so this host would receive the placeholder instead of the credential. Remove it from one of the two lists.`})}else if(Q.length>0&&Q.every((H)=>C9(H,V)))J.addIssue({code:x.ZodIssueCode.custom,path:O,message:"This masked credential has no injectHosts, so it defaults "+"to network.allowedDomains \u2014 but "+"network.tlsTerminate.excludeDomains covers every allowed domain, so it could never be injected anywhere. Credential injection only runs on TLS-terminated connections."})}if(M.injectHosts!==void 0&&M.injectHosts.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:O,message:"injectHosts is explicitly empty \u2014 the credential would be "+"masked but never injected. Omit injectHosts to default to network.allowedDomains, or list the intended hosts."})};for(let[M,O]of(X.envVars??[]).entries()){if(W(O,["credentials","envVars",M]),O.maskClaims!==void 0&&O.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the whole value.'});if(O.maskClaims!==void 0&&O.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."})}for(let[M,O]of(X.files??[]).entries()){if(W(O,["credentials","files",M]),O.maskClaims!==void 0&&O.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the extracted value whole.'});if(O.maskClaims!==void 0&&O.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."});if(O.mode==="mask"&&O.path.endsWith("/"))J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"path"],message:`Credential mode "mask" applies to a single file, not a directory. Use mode "deny" for "${O.path}", or point at the credential file inside it.`})}let U=new Set;for(let[M,O]of(X.awsPairs??[]).entries()){let V=[["accessKeyIdVar",O.accessKeyIdVar],["secretAccessKeyVar",O.secretAccessKeyVar]];if(O.sessionTokenVar!==void 0)V.push(["sessionTokenVar",O.sessionTokenVar]);for(let[H,q]of V){let F=["credentials","awsPairs",M,H];if(U.has(q)){J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" appears in more than one awsPairs slot (within `+"or across pairs) \u2014 each variable can fill exactly one slot."});continue}U.add(q);let K=(X.envVars??[]).find((A)=>A.name===q);if(K===void 0||K.mode!=="mask")J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" does not reference a credentials.envVars entry `+'with mode "mask" \u2014 an AWS pair links already-masked '+"variables; add the entry (masking is the opt-in for SigV4 re-signing)."});else if(K.extract!==void 0||K.decode!==void 0)J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" uses extract/decode, but an AWS pair member must be masked whole-value: the SigV4 trigger is an exact match of the fake access key id, and the signer needs the entire real value.`})}}if(G&&$.network.tlsTerminate===void 0&&!X.allowPlaintextInject)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials"],message:"Credential masking requires network.tlsTerminate so substitution runs only over a verified TLS connection. Enable tlsTerminate, or set credentials.allowPlaintextInject to opt out (not recommended)."})});export{C5 as windowsTrustCaAsync,wK as windowsTrustCa,P5 as windowsStateDir,g7 as windowsInstallInstructions,d7 as verifyWindowsWfpEgress,xX as validateCaPair,xK as uninstallWindowsSandbox,a7 as stampWindowsAcl,I9 as revokeWindowsAcl,S9 as restoreWindowsAcl,wJ as resolveSrtWin,vK as parseWindowsSandboxError,Z9 as parseWindowsBinShell,qX as isUncPath,_K as installWindowsSandboxAsync,PK as installWindowsSandbox,s7 as grantWindowsAcl,l9 as getWslVersion,I5 as getWindowsWfpStatusAsync,S5 as getWindowsWfpStatus,dX as getWindowsSandboxUserStatusAsync,c7 as getWindowsSandboxUserStatus,n7 as getWindowsSandboxCaCert,CK as getSrtWinPath,DQ as getDefaultWritePaths,aY as generateCa,T9 as expandWindowsFsPaths,i7 as ensurePersistentWindowsCa,T5 as checkWindowsSandboxStatusAsync,j5 as checkWindowsSandboxStatus,r7 as checkWindowsDependenciesAsync,gQ as certThumbprint,KX as buildGitConfigEnv,A$ as WindowsSandboxError,wU as WindowsConfigSchema,IK as VENDORED_SRT_WIN_EXE,CU as SrtWinConfigSchema,A9 as SandboxViolationStore,dE as SandboxRuntimeConfigSchema,Zz as SandboxManager,R5 as SRT_WIN_DISPATCH_ARG1,SU as RipgrepConfigSchema,BU as NetworkConfigSchema,TU as IgnoreViolationsConfigSchema,IU as GitConfigSchema,jU as FilesystemConfigSchema,D9 as DEFAULT_WINDOWS_PROXY_PORT_RANGE,ZU as CredentialsConfigSchema};