npm - @reason-machines/cli-darwin-x64 - Versions diffs - 0.2.397 → 0.2.401 - Mend

@reason-machines/cli-darwin-x64 0.2.397 → 0.2.401

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/bin/runtime/srt/sandbox-runtime.mjs CHANGED Viewed

@@ -1,71 +1,71 @@
 // @bun
-var vU=Object.create;var{getPrototypeOf:kU,defineProperty:m9,getOwnPropertyNames:fU}=Object;var yU=Object.prototype.hasOwnProperty;function bU($){return this[$]}var hU,uU,l9=($,J,X)=>{var Q=$!=null&&typeof $==="object";if(Q){var Y=J?hU??=new WeakMap:uU??=new WeakMap,G=Y.get($);if(G)return G}X=$!=null?vU(kU($)):{};let W=J||!$||!$.__esModule?m9(X,"default",{value:$,enumerable:!0}):X;for(let U of fU($))if(!yU.call(W,U))m9(W,U,{get:bU.bind($,U),enumerable:!0});if(Q)Y.set($,W);return W};var H$=($,J)=>()=>(J||$((J={exports:{}}).exports,J),J.exports);var gU=($)=>$;function mU($,J){this[$]=gU.bind(null,J)}var lU=($,J)=>{for(var X in J)m9($,X,{get:J[X],enumerable:!0,configurable:!0,set:mU.bind(J,X)})};var qX=import.meta.require;var F$=H$((XF,RG)=>{RG.exports={options:{usePureJavaScript:!1}}});var BG=H$((YF,ZG)=>{var c9={};ZG.exports=c9;var DG={};c9.encode=function($,J,X){if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');if(X!==void 0&&typeof X!=="number")throw TypeError('"maxline" must be a number.');var Q="";if(!($ instanceof Uint8Array))Q=sU($,J);else{var Y=0,G=J.length,W=J.charAt(0),U=[0];for(Y=0;Y<$.length;++Y){for(var M=0,O=$[Y];M<U.length;++M)O+=U[M]<<8,U[M]=O%G,O=O/G|0;while(O>0)U.push(O%G),O=O/G|0}for(Y=0;$[Y]===0&&Y<$.length-1;++Y)Q+=W;for(Y=U.length-1;Y>=0;--Y)Q+=J[U[Y]]}if(X){var V=new RegExp(".{1,"+X+"}","g");Q=Q.match(V).join(`\r
-`)}return Q};c9.decode=function($,J){if(typeof $!=="string")throw TypeError('"input" must be a string.');if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');var X=DG[J];if(!X){X=DG[J]=[];for(var Q=0;Q<J.length;++Q)X[J.charCodeAt(Q)]=Q}$=$.replace(/\s/g,"");var Y=J.length,G=J.charAt(0),W=[0];for(var Q=0;Q<$.length;Q++){var U=X[$.charCodeAt(Q)];if(U===void 0)return;for(var M=0,O=U;M<W.length;++M)O+=W[M]*Y,W[M]=O&255,O>>=8;while(O>0)W.push(O&255),O>>=8}for(var V=0;$[V]===G&&V<$.length-1;++V)W.push(0);if(typeof Buffer<"u")return Buffer.from(W.reverse());return new Uint8Array(W.reverse())};function sU($,J){var X=0,Q=J.length,Y=J.charAt(0),G=[0];for(X=0;X<$.length();++X){for(var W=0,U=$.at(X);W<G.length;++W)U+=G[W]<<8,G[W]=U%Q,U=U/Q|0;while(U>0)G.push(U%Q),U=U/Q|0}var M="";for(X=0;$.at(X)===0&&X<$.length()-1;++X)M+=Y;for(X=G.length-1;X>=0;--X)M+=J[G[X]];return M}});var _$=H$((GF,IG)=>{var jG=F$(),TG=BG(),T=IG.exports=jG.util=jG.util||{};(function(){if(typeof process<"u"&&process.nextTick){if(T.nextTick=process.nextTick,typeof setImmediate==="function")T.setImmediate=setImmediate;else T.setImmediate=T.nextTick;return}if(typeof setImmediate==="function"){T.setImmediate=function(){return setImmediate.apply(void 0,arguments)},T.nextTick=function(U){return setImmediate(U)};return}if(T.setImmediate=function(U){setTimeout(U,0)},typeof window<"u"&&typeof window.postMessage==="function"){let U=function(M){if(M.source===window&&M.data===$){M.stopPropagation();var O=J.slice();J.length=0,O.forEach(function(V){V()})}};var W=U,$="forge.setImmediate",J=[];T.setImmediate=function(M){if(J.push(M),J.length===1)window.postMessage($,"*")},window.addEventListener("message",U,!0)}if(typeof MutationObserver<"u"){var X=Date.now(),Q=!0,Y=document.createElement("div"),J=[];new MutationObserver(function(){var M=J.slice();J.length=0,M.forEach(function(O){O()})}).observe(Y,{attributes:!0});var G=T.setImmediate;T.setImmediate=function(M){if(Date.now()-X>15)X=Date.now(),G(M);else if(J.push(M),J.length===1)Y.setAttribute("a",Q=!Q)}}T.nextTick=T.setImmediate})();T.isNodejs=typeof process<"u"&&process.versions&&process.versions.node;T.globalScope=function(){if(T.isNodejs)return global;return typeof self>"u"?window:self}();T.isArray=Array.isArray||function($){return Object.prototype.toString.call($)==="[object Array]"};T.isArrayBuffer=function($){return typeof ArrayBuffer<"u"&&$ instanceof ArrayBuffer};T.isArrayBufferView=function($){return $&&T.isArrayBuffer($.buffer)&&$.byteLength!==void 0};function LX($){if(!($===8||$===16||$===24||$===32))throw Error("Only 8, 16, 24, or 32 bits supported: "+$)}T.ByteBuffer=n9;function n9($){if(this.data="",this.read=0,typeof $==="string")this.data=$;else if(T.isArrayBuffer($)||T.isArrayBufferView($))if(typeof Buffer<"u"&&$ instanceof Buffer)this.data=$.toString("binary");else{var J=new Uint8Array($);try{this.data=String.fromCharCode.apply(null,J)}catch(Q){for(var X=0;X<J.length;++X)this.putByte(J[X])}}else if($ instanceof n9||typeof $==="object"&&typeof $.data==="string"&&typeof $.read==="number")this.data=$.data,this.read=$.read;this._constructedStringLength=0}T.ByteStringBuffer=n9;var rU=4096;T.ByteStringBuffer.prototype._optimizeConstructedString=function($){if(this._constructedStringLength+=$,this._constructedStringLength>rU)this.data.substr(0,1),this._constructedStringLength=0};T.ByteStringBuffer.prototype.length=function(){return this.data.length-this.read};T.ByteStringBuffer.prototype.isEmpty=function(){return this.length()<=0};T.ByteStringBuffer.prototype.putByte=function($){return this.putBytes(String.fromCharCode($))};T.ByteStringBuffer.prototype.fillWithByte=function($,J){$=String.fromCharCode($);var X=this.data;while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return this.data=X,this._optimizeConstructedString(J),this};T.ByteStringBuffer.prototype.putBytes=function($){return this.data+=$,this._optimizeConstructedString($.length),this};T.ByteStringBuffer.prototype.putString=function($){return this.putBytes(T.encodeUtf8($))};T.ByteStringBuffer.prototype.putInt16=function($){return this.putBytes(String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt24=function($){return this.putBytes(String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt32=function($){return this.putBytes(String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt16Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255))};T.ByteStringBuffer.prototype.putInt24Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255))};T.ByteStringBuffer.prototype.putInt32Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>24&255))};T.ByteStringBuffer.prototype.putInt=function($,J){LX(J);var X="";do J-=8,X+=String.fromCharCode($>>J&255);while(J>0);return this.putBytes(X)};T.ByteStringBuffer.prototype.putSignedInt=function($,J){if($<0)$+=2<<J-1;return this.putInt($,J)};T.ByteStringBuffer.prototype.putBuffer=function($){return this.putBytes($.getBytes())};T.ByteStringBuffer.prototype.getByte=function(){return this.data.charCodeAt(this.read++)};T.ByteStringBuffer.prototype.getInt16=function(){var $=this.data.charCodeAt(this.read)<<8^this.data.charCodeAt(this.read+1);return this.read+=2,$};T.ByteStringBuffer.prototype.getInt24=function(){var $=this.data.charCodeAt(this.read)<<16^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2);return this.read+=3,$};T.ByteStringBuffer.prototype.getInt32=function(){var $=this.data.charCodeAt(this.read)<<24^this.data.charCodeAt(this.read+1)<<16^this.data.charCodeAt(this.read+2)<<8^this.data.charCodeAt(this.read+3);return this.read+=4,$};T.ByteStringBuffer.prototype.getInt16Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8;return this.read+=2,$};T.ByteStringBuffer.prototype.getInt24Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16;return this.read+=3,$};T.ByteStringBuffer.prototype.getInt32Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16^this.data.charCodeAt(this.read+3)<<24;return this.read+=4,$};T.ByteStringBuffer.prototype.getInt=function($){LX($);var J=0;do J=(J<<8)+this.data.charCodeAt(this.read++),$-=8;while($>0);return J};T.ByteStringBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};T.ByteStringBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};T.ByteStringBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};T.ByteStringBuffer.prototype.at=function($){return this.data.charCodeAt(this.read+$)};T.ByteStringBuffer.prototype.setAt=function($,J){return this.data=this.data.substr(0,this.read+$)+String.fromCharCode(J)+this.data.substr(this.read+$+1),this};T.ByteStringBuffer.prototype.last=function(){return this.data.charCodeAt(this.data.length-1)};T.ByteStringBuffer.prototype.copy=function(){var $=T.createBuffer(this.data);return $.read=this.read,$};T.ByteStringBuffer.prototype.compact=function(){if(this.read>0)this.data=this.data.slice(this.read),this.read=0;return this};T.ByteStringBuffer.prototype.clear=function(){return this.data="",this.read=0,this};T.ByteStringBuffer.prototype.truncate=function($){var J=Math.max(0,this.length()-$);return this.data=this.data.substr(this.read,J),this.read=0,this};T.ByteStringBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.length;++J){var X=this.data.charCodeAt(J);if(X<16)$+="0";$+=X.toString(16)}return $};T.ByteStringBuffer.prototype.toString=function(){return T.decodeUtf8(this.bytes())};function tU($,J){J=J||{},this.read=J.readOffset||0,this.growSize=J.growSize||1024;var X=T.isArrayBuffer($),Q=T.isArrayBufferView($);if(X||Q){if(X)this.data=new DataView($);else this.data=new DataView($.buffer,$.byteOffset,$.byteLength);this.write="writeOffset"in J?J.writeOffset:this.data.byteLength;return}if(this.data=new DataView(new ArrayBuffer(0)),this.write=0,$!==null&&$!==void 0)this.putBytes($);if("writeOffset"in J)this.write=J.writeOffset}T.DataBuffer=tU;T.DataBuffer.prototype.length=function(){return this.write-this.read};T.DataBuffer.prototype.isEmpty=function(){return this.length()<=0};T.DataBuffer.prototype.accommodate=function($,J){if(this.length()>=$)return this;J=Math.max(J||this.growSize,$);var X=new Uint8Array(this.data.buffer,this.data.byteOffset,this.data.byteLength),Q=new Uint8Array(this.length()+J);return Q.set(X),this.data=new DataView(Q.buffer),this};T.DataBuffer.prototype.putByte=function($){return this.accommodate(1),this.data.setUint8(this.write++,$),this};T.DataBuffer.prototype.fillWithByte=function($,J){this.accommodate(J);for(var X=0;X<J;++X)this.data.setUint8($);return this};T.DataBuffer.prototype.putBytes=function($,J){if(T.isArrayBufferView($)){var X=new Uint8Array($.buffer,$.byteOffset,$.byteLength),Q=X.byteLength-X.byteOffset;this.accommodate(Q);var Y=new Uint8Array(this.data.buffer,this.write);return Y.set(X),this.write+=Q,this}if(T.isArrayBuffer($)){var X=new Uint8Array($);this.accommodate(X.byteLength);var Y=new Uint8Array(this.data.buffer);return Y.set(X,this.write),this.write+=X.byteLength,this}if($ instanceof T.DataBuffer||typeof $==="object"&&typeof $.read==="number"&&typeof $.write==="number"&&T.isArrayBufferView($.data)){var X=new Uint8Array($.data.byteLength,$.read,$.length());this.accommodate(X.byteLength);var Y=new Uint8Array($.data.byteLength,this.write);return Y.set(X),this.write+=X.byteLength,this}if($ instanceof T.ByteStringBuffer)$=$.data,J="binary";if(J=J||"binary",typeof $==="string"){var G;if(J==="hex")return this.accommodate(Math.ceil($.length/2)),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.hex.decode($,G,this.write),this;if(J==="base64")return this.accommodate(Math.ceil($.length/4)*3),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.base64.decode($,G,this.write),this;if(J==="utf8")$=T.encodeUtf8($),J="binary";if(J==="binary"||J==="raw")return this.accommodate($.length),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.raw.decode(G),this;if(J==="utf16")return this.accommodate($.length*2),G=new Uint16Array(this.data.buffer,this.write),this.write+=T.text.utf16.encode(G),this;throw Error("Invalid encoding: "+J)}throw Error("Invalid parameter: "+$)};T.DataBuffer.prototype.putBuffer=function($){return this.putBytes($),$.clear(),this};T.DataBuffer.prototype.putString=function($){return this.putBytes($,"utf16")};T.DataBuffer.prototype.putInt16=function($){return this.accommodate(2),this.data.setInt16(this.write,$),this.write+=2,this};T.DataBuffer.prototype.putInt24=function($){return this.accommodate(3),this.data.setInt16(this.write,$>>8&65535),this.data.setInt8(this.write,$>>16&255),this.write+=3,this};T.DataBuffer.prototype.putInt32=function($){return this.accommodate(4),this.data.setInt32(this.write,$),this.write+=4,this};T.DataBuffer.prototype.putInt16Le=function($){return this.accommodate(2),this.data.setInt16(this.write,$,!0),this.write+=2,this};T.DataBuffer.prototype.putInt24Le=function($){return this.accommodate(3),this.data.setInt8(this.write,$>>16&255),this.data.setInt16(this.write,$>>8&65535,!0),this.write+=3,this};T.DataBuffer.prototype.putInt32Le=function($){return this.accommodate(4),this.data.setInt32(this.write,$,!0),this.write+=4,this};T.DataBuffer.prototype.putInt=function($,J){LX(J),this.accommodate(J/8);do J-=8,this.data.setInt8(this.write++,$>>J&255);while(J>0);return this};T.DataBuffer.prototype.putSignedInt=function($,J){if(LX(J),this.accommodate(J/8),$<0)$+=2<<J-1;return this.putInt($,J)};T.DataBuffer.prototype.getByte=function(){return this.data.getInt8(this.read++)};T.DataBuffer.prototype.getInt16=function(){var $=this.data.getInt16(this.read);return this.read+=2,$};T.DataBuffer.prototype.getInt24=function(){var $=this.data.getInt16(this.read)<<8^this.data.getInt8(this.read+2);return this.read+=3,$};T.DataBuffer.prototype.getInt32=function(){var $=this.data.getInt32(this.read);return this.read+=4,$};T.DataBuffer.prototype.getInt16Le=function(){var $=this.data.getInt16(this.read,!0);return this.read+=2,$};T.DataBuffer.prototype.getInt24Le=function(){var $=this.data.getInt8(this.read)^this.data.getInt16(this.read+1,!0)<<8;return this.read+=3,$};T.DataBuffer.prototype.getInt32Le=function(){var $=this.data.getInt32(this.read,!0);return this.read+=4,$};T.DataBuffer.prototype.getInt=function($){LX($);var J=0;do J=(J<<8)+this.data.getInt8(this.read++),$-=8;while($>0);return J};T.DataBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};T.DataBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};T.DataBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};T.DataBuffer.prototype.at=function($){return this.data.getUint8(this.read+$)};T.DataBuffer.prototype.setAt=function($,J){return this.data.setUint8($,J),this};T.DataBuffer.prototype.last=function(){return this.data.getUint8(this.write-1)};T.DataBuffer.prototype.copy=function(){return new T.DataBuffer(this)};T.DataBuffer.prototype.compact=function(){if(this.read>0){var $=new Uint8Array(this.data.buffer,this.read),J=new Uint8Array($.byteLength);J.set($),this.data=new DataView(J),this.write-=this.read,this.read=0}return this};T.DataBuffer.prototype.clear=function(){return this.data=new DataView(new ArrayBuffer(0)),this.read=this.write=0,this};T.DataBuffer.prototype.truncate=function($){return this.write=Math.max(0,this.length()-$),this.read=Math.min(this.read,this.write),this};T.DataBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.byteLength;++J){var X=this.data.getUint8(J);if(X<16)$+="0";$+=X.toString(16)}return $};T.DataBuffer.prototype.toString=function($){var J=new Uint8Array(this.data,this.read,this.length());if($=$||"utf8",$==="binary"||$==="raw")return T.binary.raw.encode(J);if($==="hex")return T.binary.hex.encode(J);if($==="base64")return T.binary.base64.encode(J);if($==="utf8")return T.text.utf8.decode(J);if($==="utf16")return T.text.utf16.decode(J);throw Error("Invalid encoding: "+$)};T.createBuffer=function($,J){if(J=J||"raw",$!==void 0&&J==="utf8")$=T.encodeUtf8($);return new T.ByteBuffer($)};T.fillString=function($,J){var X="";while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return X};T.xorBytes=function($,J,X){var Q="",Y="",G="",W=0,U=0;for(;X>0;--X,++W){if(Y=$.charCodeAt(W)^J.charCodeAt(W),U>=10)Q+=G,G="",U=0;G+=String.fromCharCode(Y),++U}return Q+=G,Q};T.hexToBytes=function($){var J="",X=0;if($.length&!0)X=1,J+=String.fromCharCode(parseInt($[0],16));for(;X<$.length;X+=2)J+=String.fromCharCode(parseInt($.substr(X,2),16));return J};T.bytesToHex=function($){return T.createBuffer($).toHex()};T.int32ToBytes=function($){return String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255)};var C0="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",w0=[62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,64,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],SG="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";T.encode64=function($,J){var X="",Q="",Y,G,W,U=0;while(U<$.length){if(Y=$.charCodeAt(U++),G=$.charCodeAt(U++),W=$.charCodeAt(U++),X+=C0.charAt(Y>>2),X+=C0.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=C0.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":C0.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
-`,X=X.substr(J)}return Q+=X,Q};T.decode64=function($){$=$.replace(/[^A-Za-z0-9\+\/\=]/g,"");var J="",X,Q,Y,G,W=0;while(W<$.length)if(X=w0[$.charCodeAt(W++)-43],Q=w0[$.charCodeAt(W++)-43],Y=w0[$.charCodeAt(W++)-43],G=w0[$.charCodeAt(W++)-43],J+=String.fromCharCode(X<<2|Q>>4),Y!==64){if(J+=String.fromCharCode((Q&15)<<4|Y>>2),G!==64)J+=String.fromCharCode((Y&3)<<6|G)}return J};T.encodeUtf8=function($){return unescape(encodeURIComponent($))};T.decodeUtf8=function($){return decodeURIComponent(escape($))};T.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:TG.encode,decode:TG.decode}};T.binary.raw.encode=function($){return String.fromCharCode.apply(null,$)};T.binary.raw.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};T.binary.hex.encode=T.bytesToHex;T.binary.hex.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/2));X=X||0;var Y=0,G=X;if($.length&1)Y=1,Q[G++]=parseInt($[0],16);for(;Y<$.length;Y+=2)Q[G++]=parseInt($.substr(Y,2),16);return J?G-X:Q};T.binary.base64.encode=function($,J){var X="",Q="",Y,G,W,U=0;while(U<$.byteLength){if(Y=$[U++],G=$[U++],W=$[U++],X+=C0.charAt(Y>>2),X+=C0.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=C0.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":C0.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
-`,X=X.substr(J)}return Q+=X,Q};T.binary.base64.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/4)*3);$=$.replace(/[^A-Za-z0-9\+\/\=]/g,""),X=X||0;var Y,G,W,U,M=0,O=X;while(M<$.length)if(Y=w0[$.charCodeAt(M++)-43],G=w0[$.charCodeAt(M++)-43],W=w0[$.charCodeAt(M++)-43],U=w0[$.charCodeAt(M++)-43],Q[O++]=Y<<2|G>>4,W!==64){if(Q[O++]=(G&15)<<4|W>>2,U!==64)Q[O++]=(W&3)<<6|U}return J?O-X:Q.subarray(0,O)};T.binary.base58.encode=function($,J){return T.binary.baseN.encode($,SG,J)};T.binary.base58.decode=function($,J){return T.binary.baseN.decode($,SG,J)};T.text={utf8:{},utf16:{}};T.text.utf8.encode=function($,J,X){$=T.encodeUtf8($);var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};T.text.utf8.decode=function($){return T.decodeUtf8(String.fromCharCode.apply(null,$))};T.text.utf16.encode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length*2);var Y=new Uint16Array(Q.buffer);X=X||0;var G=X,W=X;for(var U=0;U<$.length;++U)Y[W++]=$.charCodeAt(U),G+=2;return J?G-X:Q};T.text.utf16.decode=function($){return String.fromCharCode.apply(null,new Uint16Array($.buffer))};T.deflate=function($,J,X){if(J=T.decode64($.deflate(T.encode64(J)).rval),X){var Q=2,Y=J.charCodeAt(1);if(Y&32)Q=6;J=J.substring(Q,J.length-4)}return J};T.inflate=function($,J,X){var Q=$.inflate(T.encode64(J)).rval;return Q===null?null:T.decode64(Q)};var i9=function($,J,X){if(!$)throw Error("WebStorage not available.");var Q;if(X===null)Q=$.removeItem(J);else X=T.encode64(JSON.stringify(X)),Q=$.setItem(J,X);if(typeof Q<"u"&&Q.rval!==!0){var Y=Error(Q.error.message);throw Y.id=Q.error.id,Y.name=Q.error.name,Y}},o9=function($,J){if(!$)throw Error("WebStorage not available.");var X=$.getItem(J);if($.init)if(X.rval===null){if(X.error){var Q=Error(X.error.message);throw Q.id=X.error.id,Q.name=X.error.name,Q}X=null}else X=X.rval;if(X!==null)X=JSON.parse(T.decode64(X));return X},eU=function($,J,X,Q){var Y=o9($,J);if(Y===null)Y={};Y[X]=Q,i9($,J,Y)},$M=function($,J,X){var Q=o9($,J);if(Q!==null)Q=X in Q?Q[X]:null;return Q},JM=function($,J,X){var Q=o9($,J);if(Q!==null&&X in Q){delete Q[X];var Y=!0;for(var G in Q){Y=!1;break}if(Y)Q=null;i9($,J,Q)}},QM=function($,J){i9($,J,null)},NY=function($,J,X){var Q=null;if(typeof X>"u")X=["web","flash"];var Y,G=!1,W=null;for(var U in X){Y=X[U];try{if(Y==="flash"||Y==="both"){if(J[0]===null)throw Error("Flash local storage not available.");Q=$.apply(this,J),G=Y==="flash"}if(Y==="web"||Y==="both")J[0]=localStorage,Q=$.apply(this,J),G=!0}catch(M){W=M}if(G)break}if(!G)throw W;return Q};T.setItem=function($,J,X,Q,Y){NY(eU,arguments,Y)};T.getItem=function($,J,X,Q){return NY($M,arguments,Q)};T.removeItem=function($,J,X,Q){NY(JM,arguments,Q)};T.clearItems=function($,J,X){NY(QM,arguments,X)};T.isEmpty=function($){for(var J in $)if($.hasOwnProperty(J))return!1;return!0};T.format=function($){var J=/%./g,X,Q,Y=0,G=[],W=0;while(X=J.exec($)){if(Q=$.substring(W,J.lastIndex-2),Q.length>0)G.push(Q);W=J.lastIndex;var U=X[0][1];switch(U){case"s":case"o":if(Y<arguments.length)G.push(arguments[Y+++1]);else G.push("<?>");break;case"%":G.push("%");break;default:G.push("<%"+U+"?>")}}return G.push($.substring(W)),G.join("")};T.formatNumber=function($,J,X,Q){var Y=$,G=isNaN(J=Math.abs(J))?2:J,W=X===void 0?",":X,U=Q===void 0?".":Q,M=Y<0?"-":"",O=parseInt(Y=Math.abs(+Y||0).toFixed(G),10)+"",V=O.length>3?O.length%3:0;return M+(V?O.substr(0,V)+U:"")+O.substr(V).replace(/(\d{3})(?=\d)/g,"$1"+U)+(G?W+Math.abs(Y-O).toFixed(G).slice(2):"")};T.formatSize=function($){if($>=1073741824)$=T.formatNumber($/1073741824,2,".","")+" GiB";else if($>=1048576)$=T.formatNumber($/1048576,2,".","")+" MiB";else if($>=1024)$=T.formatNumber($/1024,0)+" KiB";else $=T.formatNumber($,0)+" bytes";return $};T.bytesFromIP=function($){if($.indexOf(".")!==-1)return T.bytesFromIPv4($);if($.indexOf(":")!==-1)return T.bytesFromIPv6($);return null};T.bytesFromIPv4=function($){if($=$.split("."),$.length!==4)return null;var J=T.createBuffer();for(var X=0;X<$.length;++X){var Q=parseInt($[X],10);if(isNaN(Q))return null;J.putByte(Q)}return J.getBytes()};T.bytesFromIPv6=function($){var J=0;$=$.split(":").filter(function(W){if(W.length===0)++J;return!0});var X=(8-$.length+J)*2,Q=T.createBuffer();for(var Y=0;Y<8;++Y){if(!$[Y]||$[Y].length===0){Q.fillWithByte(0,X),X=0;continue}var G=T.hexToBytes($[Y]);if(G.length<2)Q.putByte(0);Q.putBytes(G)}return Q.getBytes()};T.bytesToIP=function($){if($.length===4)return T.bytesToIPv4($);if($.length===16)return T.bytesToIPv6($);return null};T.bytesToIPv4=function($){if($.length!==4)return null;var J=[];for(var X=0;X<$.length;++X)J.push($.charCodeAt(X));return J.join(".")};T.bytesToIPv6=function($){if($.length!==16)return null;var J=[],X=[],Q=0;for(var Y=0;Y<$.length;Y+=2){var G=T.bytesToHex($[Y]+$[Y+1]);while(G[0]==="0"&&G!=="0")G=G.substr(1);if(G==="0"){var W=X[X.length-1],U=J.length;if(!W||U!==W.end+1)X.push({start:U,end:U});else if(W.end=U,W.end-W.start>X[Q].end-X[Q].start)Q=X.length-1}J.push(G)}if(X.length>0){var M=X[Q];if(M.end-M.start>0){if(J.splice(M.start,M.end-M.start+1,""),M.start===0)J.unshift("");if(M.end===7)J.push("")}}return J.join(":")};T.estimateCores=function($,J){if(typeof $==="function")J=$,$={};if($=$||{},"cores"in T&&!$.update)return J(null,T.cores);if(typeof navigator<"u"&&"hardwareConcurrency"in navigator&&navigator.hardwareConcurrency>0)return T.cores=navigator.hardwareConcurrency,J(null,T.cores);if(typeof Worker>"u")return T.cores=1,J(null,T.cores);if(typeof Blob>"u")return T.cores=2,J(null,T.cores);var X=URL.createObjectURL(new Blob(["(",function(){self.addEventListener("message",function(W){var U=Date.now(),M=U+4;while(Date.now()<M);self.postMessage({st:U,et:M})})}.toString(),")()"],{type:"application/javascript"}));Q([],5,16);function Q(W,U,M){if(U===0){var O=Math.floor(W.reduce(function(V,H){return V+H},0)/W.length);return T.cores=Math.max(1,O),URL.revokeObjectURL(X),J(null,T.cores)}Y(M,function(V,H){W.push(G(M,H)),Q(W,U-1,M)})}function Y(W,U){var M=[],O=[];for(var V=0;V<W;++V){var H=new Worker(X);H.addEventListener("message",function(q){if(O.push(q.data),O.length===W){for(var F=0;F<W;++F)M[F].terminate();U(null,O)}}),M.push(H)}for(var V=0;V<W;++V)M[V].postMessage(V)}function G(W,U){var M=[];for(var O=0;O<W;++O){var V=U[O],H=M[O]=[];for(var q=0;q<W;++q){if(O===q)continue;var F=U[q];if(V.st>F.st&&V.st<F.et||F.st>V.st&&F.st<V.et)H.push(q)}}return M.reduce(function(K,A){return Math.max(K,A.length)},0)}}});var LY=H$((WF,CG)=>{var MJ=F$();_$();CG.exports=MJ.cipher=MJ.cipher||{};MJ.cipher.algorithms=MJ.cipher.algorithms||{};MJ.cipher.createCipher=function($,J){var X=$;if(typeof X==="string"){if(X=MJ.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new MJ.cipher.BlockCipher({algorithm:X,key:J,decrypt:!1})};MJ.cipher.createDecipher=function($,J){var X=$;if(typeof X==="string"){if(X=MJ.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new MJ.cipher.BlockCipher({algorithm:X,key:J,decrypt:!0})};MJ.cipher.registerAlgorithm=function($,J){$=$.toUpperCase(),MJ.cipher.algorithms[$]=J};MJ.cipher.getAlgorithm=function($){if($=$.toUpperCase(),$ in MJ.cipher.algorithms)return MJ.cipher.algorithms[$];return null};var a9=MJ.cipher.BlockCipher=function($){this.algorithm=$.algorithm,this.mode=this.algorithm.mode,this.blockSize=this.mode.blockSize,this._finish=!1,this._input=null,this.output=null,this._op=$.decrypt?this.mode.decrypt:this.mode.encrypt,this._decrypt=$.decrypt,this.algorithm.initialize($)};a9.prototype.start=function($){$=$||{};var J={};for(var X in $)J[X]=$[X];J.decrypt=this._decrypt,this._finish=!1,this._input=MJ.util.createBuffer(),this.output=$.output||MJ.util.createBuffer(),this.mode.start(J)};a9.prototype.update=function($){if($)this._input.putBuffer($);while(!this._op.call(this.mode,this._input,this.output,this._finish)&&!this._finish);this._input.compact()};a9.prototype.finish=function($){if($&&(this.mode.name==="ECB"||this.mode.name==="CBC"))this.mode.pad=function(X){return $(this.blockSize,X,!1)},this.mode.unpad=function(X){return $(this.blockSize,X,!0)};var J={};if(J.decrypt=this._decrypt,J.overflow=this._input.length()%this.blockSize,!this._decrypt&&this.mode.pad){if(!this.mode.pad(this._input,J))return!1}if(this._finish=!0,this.update(),this._decrypt&&this.mode.unpad){if(!this.mode.unpad(this.output,J))return!1}if(this.mode.afterFinish){if(!this.mode.afterFinish(this.output,J))return!1}return!0}});var r9=H$((UF,wG)=>{var OJ=F$();_$();OJ.cipher=OJ.cipher||{};var R$=wG.exports=OJ.cipher.modes=OJ.cipher.modes||{};R$.ecb=function($){$=$||{},this.name="ECB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};R$.ecb.prototype.start=function($){};R$.ecb.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};R$.ecb.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};R$.ecb.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};R$.ecb.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};R$.cbc=function($){$=$||{},this.name="CBC",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};R$.cbc.prototype.start=function($){if($.iv===null){if(!this._prev)throw Error("Invalid IV parameter.");this._iv=this._prev.slice(0)}else if(!("iv"in $))throw Error("Invalid IV parameter.");else this._iv=AY($.iv,this.blockSize),this._prev=this._iv.slice(0)};R$.cbc.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=this._prev[Q]^$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q]);this._prev=this._outBlock};R$.cbc.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._prev[Q]^this._outBlock[Q]);this._prev=this._inBlock.slice(0)};R$.cbc.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};R$.cbc.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};R$.cfb=function($){$=$||{},this.name="CFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.cfb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=AY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.cfb.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32()^this._outBlock[Y],J.putInt32(this._inBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32()^this._outBlock[Y],this._partialOutput.putInt32(this._partialBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.cfb.prototype.decrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32(),J.putInt32(this._inBlock[Y]^this._outBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32(),this._partialOutput.putInt32(this._partialBlock[Y]^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.ofb=function($){$=$||{},this.name="OFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.ofb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=AY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.ofb.prototype.encrypt=function($,J,X){var Q=$.length();if($.length()===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]),this._inBlock[Y]=this._outBlock[Y];return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._outBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.ofb.prototype.decrypt=R$.ofb.prototype.encrypt;R$.ctr=function($){$=$||{},this.name="CTR",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.ctr.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=AY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.ctr.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize)for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]);else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}RY(this._inBlock)};R$.ctr.prototype.decrypt=R$.ctr.prototype.encrypt;R$.gcm=function($){$=$||{},this.name="GCM",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0,this._R=3774873600};R$.gcm.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");var J=OJ.util.createBuffer($.iv);this._cipherLength=0;var X;if("additionalData"in $)X=OJ.util.createBuffer($.additionalData);else X=OJ.util.createBuffer();if("tagLength"in $)this._tagLength=$.tagLength;else this._tagLength=128;if(this._tag=null,$.decrypt){if(this._tag=OJ.util.createBuffer($.tag).getBytes(),this._tag.length!==this._tagLength/8)throw Error("Authentication tag does not match tag length.")}this._hashBlock=Array(this._ints),this.tag=null,this._hashSubkey=Array(this._ints),this.cipher.encrypt([0,0,0,0],this._hashSubkey),this.componentBits=4,this._m=this.generateHashTable(this._hashSubkey,this.componentBits);var Q=J.length();if(Q===12)this._j0=[J.getInt32(),J.getInt32(),J.getInt32(),1];else{this._j0=[0,0,0,0];while(J.length()>0)this._j0=this.ghash(this._hashSubkey,this._j0,[J.getInt32(),J.getInt32(),J.getInt32(),J.getInt32()]);this._j0=this.ghash(this._hashSubkey,this._j0,[0,0].concat(s9(Q*8)))}this._inBlock=this._j0.slice(0),RY(this._inBlock),this._partialBytes=0,X=OJ.util.createBuffer(X),this._aDataLength=s9(X.length()*8);var Y=X.length()%this.blockSize;if(Y)X.fillWithByte(0,this.blockSize-Y);this._s=[0,0,0,0];while(X.length()>0)this._s=this.ghash(this._hashSubkey,this._s,[X.getInt32(),X.getInt32(),X.getInt32(),X.getInt32()])};R$.gcm.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^=$.getInt32());this._cipherLength+=this.blockSize}else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G<=0||X){if(X){var W=Q%this.blockSize;this._cipherLength+=W,this._partialOutput.truncate(this.blockSize-W)}else this._cipherLength+=this.blockSize;for(var Y=0;Y<this._ints;++Y)this._outBlock[Y]=this._partialOutput.getInt32();this._partialOutput.read-=this.blockSize}if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return $.read-=this.blockSize,J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}this._s=this.ghash(this._hashSubkey,this._s,this._outBlock),RY(this._inBlock)};R$.gcm.prototype.decrypt=function($,J,X){var Q=$.length();if(Q<this.blockSize&&!(X&&Q>0))return!0;this.cipher.encrypt(this._inBlock,this._outBlock),RY(this._inBlock),this._hashBlock[0]=$.getInt32(),this._hashBlock[1]=$.getInt32(),this._hashBlock[2]=$.getInt32(),this._hashBlock[3]=$.getInt32(),this._s=this.ghash(this._hashSubkey,this._s,this._hashBlock);for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^this._hashBlock[Y]);if(Q<this.blockSize)this._cipherLength+=Q%this.blockSize;else this._cipherLength+=this.blockSize};R$.gcm.prototype.afterFinish=function($,J){var X=!0;if(J.decrypt&&J.overflow)$.truncate(this.blockSize-J.overflow);this.tag=OJ.util.createBuffer();var Q=this._aDataLength.concat(s9(this._cipherLength*8));this._s=this.ghash(this._hashSubkey,this._s,Q);var Y=[];this.cipher.encrypt(this._j0,Y);for(var G=0;G<this._ints;++G)this.tag.putInt32(this._s[G]^Y[G]);if(this.tag.truncate(this.tag.length()%(this._tagLength/8)),J.decrypt&&this.tag.bytes()!==this._tag)X=!1;return X};R$.gcm.prototype.multiply=function($,J){var X=[0,0,0,0],Q=J.slice(0);for(var Y=0;Y<128;++Y){var G=$[Y/32|0]&1<<31-Y%32;if(G)X[0]^=Q[0],X[1]^=Q[1],X[2]^=Q[2],X[3]^=Q[3];this.pow(Q,Q)}return X};R$.gcm.prototype.pow=function($,J){var X=$[3]&1;for(var Q=3;Q>0;--Q)J[Q]=$[Q]>>>1|($[Q-1]&1)<<31;if(J[0]=$[0]>>>1,X)J[0]^=this._R};R$.gcm.prototype.tableMultiply=function($){var J=[0,0,0,0];for(var X=0;X<32;++X){var Q=X/8|0,Y=$[Q]>>>(7-X%8)*4&15,G=this._m[X][Y];J[0]^=G[0],J[1]^=G[1],J[2]^=G[2],J[3]^=G[3]}return J};R$.gcm.prototype.ghash=function($,J,X){return J[0]^=X[0],J[1]^=X[1],J[2]^=X[2],J[3]^=X[3],this.tableMultiply(J)};R$.gcm.prototype.generateHashTable=function($,J){var X=8/J,Q=4*X,Y=16*X,G=Array(Y);for(var W=0;W<Y;++W){var U=[0,0,0,0],M=W/Q|0,O=(Q-1-W%Q)*J;U[M]=1<<J-1<<O,G[W]=this.generateSubHashTable(this.multiply(U,$),J)}return G};R$.gcm.prototype.generateSubHashTable=function($,J){var X=1<<J,Q=X>>>1,Y=Array(X);Y[Q]=$.slice(0);var G=Q>>>1;while(G>0)this.pow(Y[2*G],Y[G]=[]),G>>=1;G=2;while(G<Q){for(var W=1;W<G;++W){var U=Y[G],M=Y[W];Y[G+W]=[U[0]^M[0],U[1]^M[1],U[2]^M[2],U[3]^M[3]]}G*=2}Y[0]=[0,0,0,0];for(G=Q+1;G<X;++G){var O=Y[G^Q];Y[G]=[$[0]^O[0],$[1]^O[1],$[2]^O[2],$[3]^O[3]]}return Y};function AY($,J){if(typeof $==="string")$=OJ.util.createBuffer($);if(OJ.util.isArray($)&&$.length>4){var X=$;$=OJ.util.createBuffer();for(var Q=0;Q<X.length;++Q)$.putByte(X[Q])}if($.length()<J)throw Error("Invalid IV length; got "+$.length()+" bytes and expected "+J+" bytes.");if(!OJ.util.isArray($)){var Y=[],G=J/4;for(var Q=0;Q<G;++Q)Y.push($.getInt32());$=Y}return $}function RY($){$[$.length-1]=$[$.length-1]+1&4294967295}function s9($){return[$/4294967296|0,$&4294967295]}});var P0=H$((MF,vG)=>{var m$=F$();LY();r9();_$();vG.exports=m$.aes=m$.aes||{};m$.aes.startEncrypting=function($,J,X,Q){var Y=DY({key:$,output:X,decrypt:!1,mode:Q});return Y.start(J),Y};m$.aes.createEncryptionCipher=function($,J){return DY({key:$,output:null,decrypt:!1,mode:J})};m$.aes.startDecrypting=function($,J,X,Q){var Y=DY({key:$,output:X,decrypt:!0,mode:Q});return Y.start(J),Y};m$.aes.createDecryptionCipher=function($,J){return DY({key:$,output:null,decrypt:!0,mode:J})};m$.aes.Algorithm=function($,J){if(!$8)_G();var X=this;X.name=$,X.mode=new J({blockSize:16,cipher:{encrypt:function(Q,Y){return e9(X._w,Q,Y,!1)},decrypt:function(Q,Y){return e9(X._w,Q,Y,!0)}}}),X._init=!1};m$.aes.Algorithm.prototype.initialize=function($){if(this._init)return;var J=$.key,X;if(typeof J==="string"&&(J.length===16||J.length===24||J.length===32))J=m$.util.createBuffer(J);else if(m$.util.isArray(J)&&(J.length===16||J.length===24||J.length===32)){X=J,J=m$.util.createBuffer();for(var Q=0;Q<X.length;++Q)J.putByte(X[Q])}if(!m$.util.isArray(J)){X=J,J=[];var Y=X.length();if(Y===16||Y===24||Y===32){Y=Y>>>2;for(var Q=0;Q<Y;++Q)J.push(X.getInt32())}}if(!m$.util.isArray(J)||!(J.length===4||J.length===6||J.length===8))throw Error("Invalid key parameter.");var G=this.mode.name,W=["CFB","OFB","CTR","GCM"].indexOf(G)!==-1;this._w=xG(J,$.decrypt&&!W),this._init=!0};m$.aes._expandKey=function($,J){if(!$8)_G();return xG($,J)};m$.aes._updateBlock=e9;jQ("AES-ECB",m$.cipher.modes.ecb);jQ("AES-CBC",m$.cipher.modes.cbc);jQ("AES-CFB",m$.cipher.modes.cfb);jQ("AES-OFB",m$.cipher.modes.ofb);jQ("AES-CTR",m$.cipher.modes.ctr);jQ("AES-GCM",m$.cipher.modes.gcm);function jQ($,J){var X=function(){return new m$.aes.Algorithm($,J)};m$.cipher.registerAlgorithm($,X)}var $8=!1,BQ=4,LJ,t9,PG,JQ,gJ;function _G(){$8=!0,PG=[0,1,2,4,8,16,32,64,128,27,54];var $=Array(256);for(var J=0;J<128;++J)$[J]=J<<1,$[J+128]=J+128<<1^283;LJ=Array(256),t9=Array(256),JQ=[,,,,],gJ=[,,,,];for(var J=0;J<4;++J)JQ[J]=Array(256),gJ[J]=Array(256);var X=0,Q=0,Y,G,W,U,M,O,V;for(var J=0;J<256;++J){U=Q^Q<<1^Q<<2^Q<<3^Q<<4,U=U>>8^U&255^99,LJ[X]=U,t9[U]=X,M=$[U],Y=$[X],G=$[Y],W=$[G],O=M<<24^U<<16^U<<8^(U^M),V=(Y^G^W)<<24^(X^W)<<16^(X^G^W)<<8^(X^Y^W);for(var H=0;H<4;++H)JQ[H][X]=O,gJ[H][U]=V,O=O<<24|O>>>8,V=V<<24|V>>>8;if(X===0)X=Q=1;else X=Y^$[$[$[Y^W]]],Q^=$[$[Q]]}}function xG($,J){var X=$.slice(0),Q,Y=1,G=X.length,W=G+6+1,U=BQ*W;for(var M=G;M<U;++M){if(Q=X[M-1],M%G===0)Q=LJ[Q>>>16&255]<<24^LJ[Q>>>8&255]<<16^LJ[Q&255]<<8^LJ[Q>>>24]^PG[Y]<<24,Y++;else if(G>6&&M%G===4)Q=LJ[Q>>>24]<<24^LJ[Q>>>16&255]<<16^LJ[Q>>>8&255]<<8^LJ[Q&255];X[M]=X[M-G]^Q}if(J){var O,V=gJ[0],H=gJ[1],q=gJ[2],F=gJ[3],K=X.slice(0);U=X.length;for(var M=0,A=U-BQ;M<U;M+=BQ,A-=BQ)if(M===0||M===U-BQ)K[M]=X[A],K[M+1]=X[A+3],K[M+2]=X[A+2],K[M+3]=X[A+1];else for(var L=0;L<BQ;++L)O=X[A+L],K[M+(3&-L)]=V[LJ[O>>>24]]^H[LJ[O>>>16&255]]^q[LJ[O>>>8&255]]^F[LJ[O&255]];X=K}return X}function e9($,J,X,Q){var Y=$.length/4-1,G,W,U,M,O;if(Q)G=gJ[0],W=gJ[1],U=gJ[2],M=gJ[3],O=t9;else G=JQ[0],W=JQ[1],U=JQ[2],M=JQ[3],O=LJ;var V,H,q,F,K,A,L;V=J[0]^$[0],H=J[Q?3:1]^$[1],q=J[2]^$[2],F=J[Q?1:3]^$[3];var R=3;for(var I=1;I<Y;++I)K=G[V>>>24]^W[H>>>16&255]^U[q>>>8&255]^M[F&255]^$[++R],A=G[H>>>24]^W[q>>>16&255]^U[F>>>8&255]^M[V&255]^$[++R],L=G[q>>>24]^W[F>>>16&255]^U[V>>>8&255]^M[H&255]^$[++R],F=G[F>>>24]^W[V>>>16&255]^U[H>>>8&255]^M[q&255]^$[++R],V=K,H=A,q=L;X[0]=O[V>>>24]<<24^O[H>>>16&255]<<16^O[q>>>8&255]<<8^O[F&255]^$[++R],X[Q?3:1]=O[H>>>24]<<24^O[q>>>16&255]<<16^O[F>>>8&255]<<8^O[V&255]^$[++R],X[2]=O[q>>>24]<<24^O[F>>>16&255]<<16^O[V>>>8&255]<<8^O[H&255]^$[++R],X[Q?1:3]=O[F>>>24]<<24^O[V>>>16&255]<<16^O[H>>>8&255]<<8^O[q&255]^$[++R]}function DY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="AES-"+J,Q;if($.decrypt)Q=m$.cipher.createDecipher(X,$.key);else Q=m$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var U=null;if(W instanceof m$.util.ByteBuffer)U=W,W={};W=W||{},W.output=U,W.iv=G,Y.call(Q,W)},Q}});var _0=H$((OF,kG)=>{var AX=F$();AX.pki=AX.pki||{};var J8=kG.exports=AX.pki.oids=AX.oids=AX.oids||{};function b($,J){J8[$]=J,J8[J]=$}function k$($,J){J8[$]=J}b("1.2.840.113549.1.1.1","rsaEncryption");b("1.2.840.113549.1.1.4","md5WithRSAEncryption");b("1.2.840.113549.1.1.5","sha1WithRSAEncryption");b("1.2.840.113549.1.1.7","RSAES-OAEP");b("1.2.840.113549.1.1.8","mgf1");b("1.2.840.113549.1.1.9","pSpecified");b("1.2.840.113549.1.1.10","RSASSA-PSS");b("1.2.840.113549.1.1.11","sha256WithRSAEncryption");b("1.2.840.113549.1.1.12","sha384WithRSAEncryption");b("1.2.840.113549.1.1.13","sha512WithRSAEncryption");b("1.3.101.112","EdDSA25519");b("1.2.840.10040.4.3","dsa-with-sha1");b("1.3.14.3.2.7","desCBC");b("1.3.14.3.2.26","sha1");b("1.3.14.3.2.29","sha1WithRSASignature");b("2.16.840.1.101.3.4.2.1","sha256");b("2.16.840.1.101.3.4.2.2","sha384");b("2.16.840.1.101.3.4.2.3","sha512");b("2.16.840.1.101.3.4.2.4","sha224");b("2.16.840.1.101.3.4.2.5","sha512-224");b("2.16.840.1.101.3.4.2.6","sha512-256");b("1.2.840.113549.2.2","md2");b("1.2.840.113549.2.5","md5");b("1.2.840.113549.1.7.1","data");b("1.2.840.113549.1.7.2","signedData");b("1.2.840.113549.1.7.3","envelopedData");b("1.2.840.113549.1.7.4","signedAndEnvelopedData");b("1.2.840.113549.1.7.5","digestedData");b("1.2.840.113549.1.7.6","encryptedData");b("1.2.840.113549.1.9.1","emailAddress");b("1.2.840.113549.1.9.2","unstructuredName");b("1.2.840.113549.1.9.3","contentType");b("1.2.840.113549.1.9.4","messageDigest");b("1.2.840.113549.1.9.5","signingTime");b("1.2.840.113549.1.9.6","counterSignature");b("1.2.840.113549.1.9.7","challengePassword");b("1.2.840.113549.1.9.8","unstructuredAddress");b("1.2.840.113549.1.9.14","extensionRequest");b("1.2.840.113549.1.9.20","friendlyName");b("1.2.840.113549.1.9.21","localKeyId");b("1.2.840.113549.1.9.22.1","x509Certificate");b("1.2.840.113549.1.12.10.1.1","keyBag");b("1.2.840.113549.1.12.10.1.2","pkcs8ShroudedKeyBag");b("1.2.840.113549.1.12.10.1.3","certBag");b("1.2.840.113549.1.12.10.1.4","crlBag");b("1.2.840.113549.1.12.10.1.5","secretBag");b("1.2.840.113549.1.12.10.1.6","safeContentsBag");b("1.2.840.113549.1.5.13","pkcs5PBES2");b("1.2.840.113549.1.5.12","pkcs5PBKDF2");b("1.2.840.113549.1.12.1.1","pbeWithSHAAnd128BitRC4");b("1.2.840.113549.1.12.1.2","pbeWithSHAAnd40BitRC4");b("1.2.840.113549.1.12.1.3","pbeWithSHAAnd3-KeyTripleDES-CBC");b("1.2.840.113549.1.12.1.4","pbeWithSHAAnd2-KeyTripleDES-CBC");b("1.2.840.113549.1.12.1.5","pbeWithSHAAnd128BitRC2-CBC");b("1.2.840.113549.1.12.1.6","pbewithSHAAnd40BitRC2-CBC");b("1.2.840.113549.2.7","hmacWithSHA1");b("1.2.840.113549.2.8","hmacWithSHA224");b("1.2.840.113549.2.9","hmacWithSHA256");b("1.2.840.113549.2.10","hmacWithSHA384");b("1.2.840.113549.2.11","hmacWithSHA512");b("1.2.840.113549.3.7","des-EDE3-CBC");b("2.16.840.1.101.3.4.1.2","aes128-CBC");b("2.16.840.1.101.3.4.1.22","aes192-CBC");b("2.16.840.1.101.3.4.1.42","aes256-CBC");b("2.5.4.3","commonName");b("2.5.4.4","surname");b("2.5.4.5","serialNumber");b("2.5.4.6","countryName");b("2.5.4.7","localityName");b("2.5.4.8","stateOrProvinceName");b("2.5.4.9","streetAddress");b("2.5.4.10","organizationName");b("2.5.4.11","organizationalUnitName");b("2.5.4.12","title");b("2.5.4.13","description");b("2.5.4.15","businessCategory");b("2.5.4.17","postalCode");b("2.5.4.42","givenName");b("2.5.4.65","pseudonym");b("1.3.6.1.4.1.311.60.2.1.2","jurisdictionOfIncorporationStateOrProvinceName");b("1.3.6.1.4.1.311.60.2.1.3","jurisdictionOfIncorporationCountryName");b("2.16.840.1.113730.1.1","nsCertType");b("2.16.840.1.113730.1.13","nsComment");k$("2.5.29.1","authorityKeyIdentifier");k$("2.5.29.2","keyAttributes");k$("2.5.29.3","certificatePolicies");k$("2.5.29.4","keyUsageRestriction");k$("2.5.29.5","policyMapping");k$("2.5.29.6","subtreesConstraint");k$("2.5.29.7","subjectAltName");k$("2.5.29.8","issuerAltName");k$("2.5.29.9","subjectDirectoryAttributes");k$("2.5.29.10","basicConstraints");k$("2.5.29.11","nameConstraints");k$("2.5.29.12","policyConstraints");k$("2.5.29.13","basicConstraints");b("2.5.29.14","subjectKeyIdentifier");b("2.5.29.15","keyUsage");k$("2.5.29.16","privateKeyUsagePeriod");b("2.5.29.17","subjectAltName");b("2.5.29.18","issuerAltName");b("2.5.29.19","basicConstraints");k$("2.5.29.20","cRLNumber");k$("2.5.29.21","cRLReason");k$("2.5.29.22","expirationDate");k$("2.5.29.23","instructionCode");k$("2.5.29.24","invalidityDate");k$("2.5.29.25","cRLDistributionPoints");k$("2.5.29.26","issuingDistributionPoint");k$("2.5.29.27","deltaCRLIndicator");k$("2.5.29.28","issuingDistributionPoint");k$("2.5.29.29","certificateIssuer");k$("2.5.29.30","nameConstraints");b("2.5.29.31","cRLDistributionPoints");b("2.5.29.32","certificatePolicies");k$("2.5.29.33","policyMappings");k$("2.5.29.34","policyConstraints");b("2.5.29.35","authorityKeyIdentifier");k$("2.5.29.36","policyConstraints");b("2.5.29.37","extKeyUsage");k$("2.5.29.46","freshestCRL");k$("2.5.29.54","inhibitAnyPolicy");b("1.3.6.1.4.1.11129.2.4.2","timestampList");b("1.3.6.1.5.5.7.1.1","authorityInfoAccess");b("1.3.6.1.5.5.7.3.1","serverAuth");b("1.3.6.1.5.5.7.3.2","clientAuth");b("1.3.6.1.5.5.7.3.3","codeSigning");b("1.3.6.1.5.5.7.3.4","emailProtection");b("1.3.6.1.5.5.7.3.8","timeStamping")});var mJ=H$((VF,yG)=>{var p$=F$();_$();_0();var d=yG.exports=p$.asn1=p$.asn1||{};d.Class={UNIVERSAL:0,APPLICATION:64,CONTEXT_SPECIFIC:128,PRIVATE:192};d.Type={NONE:0,BOOLEAN:1,INTEGER:2,BITSTRING:3,OCTETSTRING:4,NULL:5,OID:6,ODESC:7,EXTERNAL:8,REAL:9,ENUMERATED:10,EMBEDDED:11,UTF8:12,ROID:13,SEQUENCE:16,SET:17,PRINTABLESTRING:19,IA5STRING:22,UTCTIME:23,GENERALIZEDTIME:24,BMPSTRING:30};d.maxDepth=256;d.create=function($,J,X,Q,Y){if(p$.util.isArray(Q)){var G=[];for(var W=0;W<Q.length;++W)if(Q[W]!==void 0)G.push(Q[W]);Q=G}var U={tagClass:$,type:J,constructed:X,composed:X||p$.util.isArray(Q),value:Q};if(Y&&"bitStringContents"in Y)U.bitStringContents=Y.bitStringContents,U.original=d.copy(U);return U};d.copy=function($,J){var X;if(p$.util.isArray($)){X=[];for(var Q=0;Q<$.length;++Q)X.push(d.copy($[Q],J));return X}if(typeof $==="string")return $;if(X={tagClass:$.tagClass,type:$.type,constructed:$.constructed,composed:$.composed,value:d.copy($.value,J)},J&&!J.excludeBitStringContents)X.bitStringContents=$.bitStringContents;return X};d.equals=function($,J,X){if(p$.util.isArray($)){if(!p$.util.isArray(J))return!1;if($.length!==J.length)return!1;for(var Q=0;Q<$.length;++Q)if(!d.equals($[Q],J[Q]))return!1;return!0}if(typeof $!==typeof J)return!1;if(typeof $==="string")return $===J;var Y=$.tagClass===J.tagClass&&$.type===J.type&&$.constructed===J.constructed&&$.composed===J.composed&&d.equals($.value,J.value);if(X&&X.includeBitStringContents)Y=Y&&$.bitStringContents===J.bitStringContents;return Y};d.getBerValueLength=function($){var J=$.getByte();if(J===128)return;var X,Q=J&128;if(!Q)X=J;else X=$.getInt((J&127)<<3);return X};function RX($,J,X){if(X>J){var Q=Error("Too few bytes to parse DER.");throw Q.available=$.length(),Q.remaining=J,Q.requested=X,Q}}var XM=function($,J){var X=$.getByte();if(J--,X===128)return;var Q,Y=X&128;if(!Y)Q=X;else{var G=X&127;RX($,J,G),Q=$.getInt(G<<3)}if(Q<0)throw Error("Negative length: "+Q);return Q};d.fromDer=function($,J){if(J===void 0)J={strict:!0,parseAllBytes:!0,decodeBitStrings:!0};if(typeof J==="boolean")J={strict:J,parseAllBytes:!0,decodeBitStrings:!0};if(!("strict"in J))J.strict=!0;if(!("parseAllBytes"in J))J.parseAllBytes=!0;if(!("decodeBitStrings"in J))J.decodeBitStrings=!0;if(!("maxDepth"in J))J.maxDepth=d.maxDepth;if(typeof $==="string")$=p$.util.createBuffer($);var X=$.length(),Q=ZY($,$.length(),0,J);if(J.parseAllBytes&&$.length()!==0){var Y=Error("Unparsed DER bytes remain after ASN.1 parsing.");throw Y.byteCount=X,Y.remaining=$.length(),Y}return Q};function ZY($,J,X,Q){if(X>=Q.maxDepth)throw Error("ASN.1 parsing error: Max depth exceeded.");var Y;RX($,J,2);var G=$.getByte();J--;var W=G&192,U=G&31;Y=$.length();var M=XM($,J);if(J-=Y-$.length(),M!==void 0&&M>J){if(Q.strict){var O=Error("Too few bytes to read ASN.1 value.");throw O.available=$.length(),O.remaining=J,O.requested=M,O}M=J}var V,H,q=(G&32)===32;if(q)if(V=[],M===void 0)for(;;){if(RX($,J,2),$.bytes(2)===String.fromCharCode(0,0)){$.getBytes(2),J-=2;break}Y=$.length(),V.push(ZY($,J,X+1,Q)),J-=Y-$.length()}else while(M>0)Y=$.length(),V.push(ZY($,M,X+1,Q)),J-=Y-$.length(),M-=Y-$.length();if(V===void 0&&W===d.Class.UNIVERSAL&&U===d.Type.BITSTRING)H=$.bytes(M);if(V===void 0&&Q.decodeBitStrings&&W===d.Class.UNIVERSAL&&U===d.Type.BITSTRING&&M>1){var F=$.read,K=J,A=0;if(U===d.Type.BITSTRING)RX($,J,1),A=$.getByte(),J--;if(A===0)try{Y=$.length();var L={strict:!0,decodeBitStrings:!0},R=ZY($,J,X+1,L),I=Y-$.length();if(J-=I,U==d.Type.BITSTRING)I++;var j=R.tagClass;if(I===M&&(j===d.Class.UNIVERSAL||j===d.Class.CONTEXT_SPECIFIC))V=[R]}catch(w){}if(V===void 0)$.read=F,J=K}if(V===void 0){if(M===void 0){if(Q.strict)throw Error("Non-constructed ASN.1 object of indefinite length.");M=J}if(U===d.Type.BMPSTRING){V="";for(;M>0;M-=2)RX($,J,2),V+=String.fromCharCode($.getInt16()),J-=2}else V=$.getBytes(M),J-=M}var C=H===void 0?null:{bitStringContents:H};return d.create(W,U,q,V,C)}d.toDer=function($){var J=p$.util.createBuffer(),X=$.tagClass|$.type,Q=p$.util.createBuffer(),Y=!1;if("bitStringContents"in $){if(Y=!0,$.original)Y=d.equals($,$.original)}if(Y)Q.putBytes($.bitStringContents);else if($.composed){if($.constructed)X|=32;else Q.putByte(0);for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0)Q.putBuffer(d.toDer($.value[G]))}else if($.type===d.Type.BMPSTRING)for(var G=0;G<$.value.length;++G)Q.putInt16($.value.charCodeAt(G));else if($.type===d.Type.INTEGER&&$.value.length>1&&($.value.charCodeAt(0)===0&&($.value.charCodeAt(1)&128)===0||$.value.charCodeAt(0)===255&&($.value.charCodeAt(1)&128)===128))Q.putBytes($.value.substr(1));else Q.putBytes($.value);if(J.putByte(X),Q.length()<=127)J.putByte(Q.length()&127);else{var W=Q.length(),U="";do U+=String.fromCharCode(W&255),W=W>>>8;while(W>0);J.putByte(U.length|128);for(var G=U.length-1;G>=0;--G)J.putByte(U.charCodeAt(G))}return J.putBuffer(Q),J};d.oidToDer=function($){var J=$.split("."),X=p$.util.createBuffer();X.putByte(40*parseInt(J[0],10)+parseInt(J[1],10));var Q,Y,G,W;for(var U=2;U<J.length;++U){if(Q=!0,Y=[],G=parseInt(J[U],10),G>4294967295)throw Error("OID value too large; max is 32-bits.");do{if(W=G&127,G=G>>>7,!Q)W|=128;Y.push(W),Q=!1}while(G>0);for(var M=Y.length-1;M>=0;--M)X.putByte(Y[M])}return X};d.derToOid=function($){var J;if(typeof $==="string")$=p$.util.createBuffer($);var X=$.getByte();J=Math.floor(X/40)+"."+X%40;var Q=0;while($.length()>0){if(Q>70368744177663)throw Error("OID value too large; max is 53-bits.");if(X=$.getByte(),Q=Q*128,X&128)Q+=X&127;else J+="."+(Q+X),Q=0}return J};d.utcTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,2),10);X=X>=50?1900+X:2000+X;var Q=parseInt($.substr(2,2),10)-1,Y=parseInt($.substr(4,2),10),G=parseInt($.substr(6,2),10),W=parseInt($.substr(8,2),10),U=0;if($.length>11){var M=$.charAt(10),O=10;if(M!=="+"&&M!=="-")U=parseInt($.substr(10,2),10),O+=2}if(J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,U,0),O){if(M=$.charAt(O),M==="+"||M==="-"){var V=parseInt($.substr(O+1,2),10),H=parseInt($.substr(O+4,2),10),q=V*60+H;if(q*=60000,M==="+")J.setTime(+J-q);else J.setTime(+J+q)}}return J};d.generalizedTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,4),10),Q=parseInt($.substr(4,2),10)-1,Y=parseInt($.substr(6,2),10),G=parseInt($.substr(8,2),10),W=parseInt($.substr(10,2),10),U=parseInt($.substr(12,2),10),M=0,O=0,V=!1;if($.charAt($.length-1)==="Z")V=!0;var H=$.length-5,q=$.charAt(H);if(q==="+"||q==="-"){var F=parseInt($.substr(H+1,2),10),K=parseInt($.substr(H+4,2),10);if(O=F*60+K,O*=60000,q==="+")O*=-1;V=!0}if($.charAt(14)===".")M=parseFloat($.substr(14),10)*1000;if(V)J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,U,M),J.setTime(+J+O);else J.setFullYear(X,Q,Y),J.setHours(G,W,U,M);return J};d.dateToUtcTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push((""+$.getUTCFullYear()).substr(2)),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};d.dateToGeneralizedTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push(""+$.getUTCFullYear()),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};d.integerToDer=function($){var J=p$.util.createBuffer();if($>=-128&&$<128)return J.putSignedInt($,8);if($>=-32768&&$<32768)return J.putSignedInt($,16);if($>=-8388608&&$<8388608)return J.putSignedInt($,24);if($>=-2147483648&&$<2147483648)return J.putSignedInt($,32);var X=Error("Integer too large; max is 32-bits.");throw X.integer=$,X};d.derToInteger=function($){if(typeof $==="string")$=p$.util.createBuffer($);var J=$.length()*8;if(J>32)throw Error("Integer too large; max is 32-bits.");return $.getSignedInt(J)};d.validate=function($,J,X,Q){var Y=!1;if(($.tagClass===J.tagClass||typeof J.tagClass>"u")&&($.type===J.type||typeof J.type>"u")){if($.constructed===J.constructed||typeof J.constructed>"u"){if(Y=!0,J.value&&p$.util.isArray(J.value)){var G=0;for(var W=0;Y&&W<J.value.length;++W){var U=J.value[W];Y=!!U.optional;var M=$.value[G];if(!M){if(!U.optional){if(Y=!1,Q)Q.push("["+J.name+'] Missing required element. Expected tag class "'+U.tagClass+'", type "'+U.type+'"')}continue}var O=typeof U.tagClass<"u"&&typeof U.type<"u";if(O&&(M.tagClass!==U.tagClass||M.type!==U.type))if(U.optional){Y=!0;continue}else{if(Y=!1,Q)Q.push("["+J.name+"] Tag mismatch. Expected ("+U.tagClass+","+U.type+"), got ("+M.tagClass+","+M.type+")");break}var V=d.validate(M,U,X,Q);if(V)++G,Y=!0;else if(U.optional)Y=!0;else{Y=!1;break}}}if(Y&&X){if(J.capture)X[J.capture]=$.value;if(J.captureAsn1)X[J.captureAsn1]=$;if(J.captureBitStringContents&&"bitStringContents"in $)X[J.captureBitStringContents]=$.bitStringContents;if(J.captureBitStringValue&&"bitStringContents"in $){var H;if($.bitStringContents.length<2)X[J.captureBitStringValue]="";else{var q=$.bitStringContents.charCodeAt(0);if(q!==0)throw Error("captureBitStringValue only supported for zero unused bits");X[J.captureBitStringValue]=$.bitStringContents.slice(1)}}}}else if(Q)Q.push("["+J.name+'] Expected constructed "'+J.constructed+'", got "'+$.constructed+'"')}else if(Q){if($.tagClass!==J.tagClass)Q.push("["+J.name+'] Expected tag class "'+J.tagClass+'", got "'+$.tagClass+'"');if($.type!==J.type)Q.push("["+J.name+'] Expected type "'+J.type+'", got "'+$.type+'"')}return Y};var fG=/[^\\u0000-\\u00ff]/;d.prettyPrint=function($,J,X){var Q="";if(J=J||0,X=X||2,J>0)Q+=`
+var uU=Object.create;var{getPrototypeOf:gU,defineProperty:l9,getOwnPropertyNames:mU}=Object;var lU=Object.prototype.hasOwnProperty;function pU($){return this[$]}var dU,cU,p9=($,J,X)=>{var Q=$!=null&&typeof $==="object";if(Q){var Y=J?dU??=new WeakMap:cU??=new WeakMap,G=Y.get($);if(G)return G}X=$!=null?uU(gU($)):{};let W=J||!$||!$.__esModule?l9(X,"default",{value:$,enumerable:!0}):X;for(let U of mU($))if(!lU.call(W,U))l9(W,U,{get:pU.bind($,U),enumerable:!0});if(Q)Y.set($,W);return W};var q$=($,J)=>()=>(J||$((J={exports:{}}).exports,J),J.exports);var nU=($)=>$;function iU($,J){this[$]=nU.bind(null,J)}var oU=($,J)=>{for(var X in J)l9($,X,{get:J[X],enumerable:!0,configurable:!0,set:iU.bind(J,X)})};var KX=import.meta.require;var F$=q$((KF,BG)=>{BG.exports={options:{usePureJavaScript:!1}}});var SG=q$((zF,TG)=>{var n9={};TG.exports=n9;var jG={};n9.encode=function($,J,X){if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');if(X!==void 0&&typeof X!=="number")throw TypeError('"maxline" must be a number.');var Q="";if(!($ instanceof Uint8Array))Q=QM($,J);else{var Y=0,G=J.length,W=J.charAt(0),U=[0];for(Y=0;Y<$.length;++Y){for(var M=0,O=$[Y];M<U.length;++M)O+=U[M]<<8,U[M]=O%G,O=O/G|0;while(O>0)U.push(O%G),O=O/G|0}for(Y=0;$[Y]===0&&Y<$.length-1;++Y)Q+=W;for(Y=U.length-1;Y>=0;--Y)Q+=J[U[Y]]}if(X){var V=new RegExp(".{1,"+X+"}","g");Q=Q.match(V).join(`\r
+`)}return Q};n9.decode=function($,J){if(typeof $!=="string")throw TypeError('"input" must be a string.');if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');var X=jG[J];if(!X){X=jG[J]=[];for(var Q=0;Q<J.length;++Q)X[J.charCodeAt(Q)]=Q}$=$.replace(/\s/g,"");var Y=J.length,G=J.charAt(0),W=[0];for(var Q=0;Q<$.length;Q++){var U=X[$.charCodeAt(Q)];if(U===void 0)return;for(var M=0,O=U;M<W.length;++M)O+=W[M]*Y,W[M]=O&255,O>>=8;while(O>0)W.push(O&255),O>>=8}for(var V=0;$[V]===G&&V<$.length-1;++V)W.push(0);if(typeof Buffer<"u")return Buffer.from(W.reverse());return new Uint8Array(W.reverse())};function QM($,J){var X=0,Q=J.length,Y=J.charAt(0),G=[0];for(X=0;X<$.length();++X){for(var W=0,U=$.at(X);W<G.length;++W)U+=G[W]<<8,G[W]=U%Q,U=U/Q|0;while(U>0)G.push(U%Q),U=U/Q|0}var M="";for(X=0;$.at(X)===0&&X<$.length()-1;++X)M+=Y;for(X=G.length-1;X>=0;--X)M+=J[G[X]];return M}});var _$=q$((EF,PG)=>{var IG=F$(),CG=SG(),T=PG.exports=IG.util=IG.util||{};(function(){if(typeof process<"u"&&process.nextTick){if(T.nextTick=process.nextTick,typeof setImmediate==="function")T.setImmediate=setImmediate;else T.setImmediate=T.nextTick;return}if(typeof setImmediate==="function"){T.setImmediate=function(){return setImmediate.apply(void 0,arguments)},T.nextTick=function(U){return setImmediate(U)};return}if(T.setImmediate=function(U){setTimeout(U,0)},typeof window<"u"&&typeof window.postMessage==="function"){let U=function(M){if(M.source===window&&M.data===$){M.stopPropagation();var O=J.slice();J.length=0,O.forEach(function(V){V()})}};var W=U,$="forge.setImmediate",J=[];T.setImmediate=function(M){if(J.push(M),J.length===1)window.postMessage($,"*")},window.addEventListener("message",U,!0)}if(typeof MutationObserver<"u"){var X=Date.now(),Q=!0,Y=document.createElement("div"),J=[];new MutationObserver(function(){var M=J.slice();J.length=0,M.forEach(function(O){O()})}).observe(Y,{attributes:!0});var G=T.setImmediate;T.setImmediate=function(M){if(Date.now()-X>15)X=Date.now(),G(M);else if(J.push(M),J.length===1)Y.setAttribute("a",Q=!Q)}}T.nextTick=T.setImmediate})();T.isNodejs=typeof process<"u"&&process.versions&&process.versions.node;T.globalScope=function(){if(T.isNodejs)return global;return typeof self>"u"?window:self}();T.isArray=Array.isArray||function($){return Object.prototype.toString.call($)==="[object Array]"};T.isArrayBuffer=function($){return typeof ArrayBuffer<"u"&&$ instanceof ArrayBuffer};T.isArrayBufferView=function($){return $&&T.isArrayBuffer($.buffer)&&$.byteLength!==void 0};function AX($){if(!($===8||$===16||$===24||$===32))throw Error("Only 8, 16, 24, or 32 bits supported: "+$)}T.ByteBuffer=i9;function i9($){if(this.data="",this.read=0,typeof $==="string")this.data=$;else if(T.isArrayBuffer($)||T.isArrayBufferView($))if(typeof Buffer<"u"&&$ instanceof Buffer)this.data=$.toString("binary");else{var J=new Uint8Array($);try{this.data=String.fromCharCode.apply(null,J)}catch(Q){for(var X=0;X<J.length;++X)this.putByte(J[X])}}else if($ instanceof i9||typeof $==="object"&&typeof $.data==="string"&&typeof $.read==="number")this.data=$.data,this.read=$.read;this._constructedStringLength=0}T.ByteStringBuffer=i9;var XM=4096;T.ByteStringBuffer.prototype._optimizeConstructedString=function($){if(this._constructedStringLength+=$,this._constructedStringLength>XM)this.data.substr(0,1),this._constructedStringLength=0};T.ByteStringBuffer.prototype.length=function(){return this.data.length-this.read};T.ByteStringBuffer.prototype.isEmpty=function(){return this.length()<=0};T.ByteStringBuffer.prototype.putByte=function($){return this.putBytes(String.fromCharCode($))};T.ByteStringBuffer.prototype.fillWithByte=function($,J){$=String.fromCharCode($);var X=this.data;while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return this.data=X,this._optimizeConstructedString(J),this};T.ByteStringBuffer.prototype.putBytes=function($){return this.data+=$,this._optimizeConstructedString($.length),this};T.ByteStringBuffer.prototype.putString=function($){return this.putBytes(T.encodeUtf8($))};T.ByteStringBuffer.prototype.putInt16=function($){return this.putBytes(String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt24=function($){return this.putBytes(String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt32=function($){return this.putBytes(String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt16Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255))};T.ByteStringBuffer.prototype.putInt24Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255))};T.ByteStringBuffer.prototype.putInt32Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>24&255))};T.ByteStringBuffer.prototype.putInt=function($,J){AX(J);var X="";do J-=8,X+=String.fromCharCode($>>J&255);while(J>0);return this.putBytes(X)};T.ByteStringBuffer.prototype.putSignedInt=function($,J){if($<0)$+=2<<J-1;return this.putInt($,J)};T.ByteStringBuffer.prototype.putBuffer=function($){return this.putBytes($.getBytes())};T.ByteStringBuffer.prototype.getByte=function(){return this.data.charCodeAt(this.read++)};T.ByteStringBuffer.prototype.getInt16=function(){var $=this.data.charCodeAt(this.read)<<8^this.data.charCodeAt(this.read+1);return this.read+=2,$};T.ByteStringBuffer.prototype.getInt24=function(){var $=this.data.charCodeAt(this.read)<<16^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2);return this.read+=3,$};T.ByteStringBuffer.prototype.getInt32=function(){var $=this.data.charCodeAt(this.read)<<24^this.data.charCodeAt(this.read+1)<<16^this.data.charCodeAt(this.read+2)<<8^this.data.charCodeAt(this.read+3);return this.read+=4,$};T.ByteStringBuffer.prototype.getInt16Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8;return this.read+=2,$};T.ByteStringBuffer.prototype.getInt24Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16;return this.read+=3,$};T.ByteStringBuffer.prototype.getInt32Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16^this.data.charCodeAt(this.read+3)<<24;return this.read+=4,$};T.ByteStringBuffer.prototype.getInt=function($){AX($);var J=0;do J=(J<<8)+this.data.charCodeAt(this.read++),$-=8;while($>0);return J};T.ByteStringBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};T.ByteStringBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};T.ByteStringBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};T.ByteStringBuffer.prototype.at=function($){return this.data.charCodeAt(this.read+$)};T.ByteStringBuffer.prototype.setAt=function($,J){return this.data=this.data.substr(0,this.read+$)+String.fromCharCode(J)+this.data.substr(this.read+$+1),this};T.ByteStringBuffer.prototype.last=function(){return this.data.charCodeAt(this.data.length-1)};T.ByteStringBuffer.prototype.copy=function(){var $=T.createBuffer(this.data);return $.read=this.read,$};T.ByteStringBuffer.prototype.compact=function(){if(this.read>0)this.data=this.data.slice(this.read),this.read=0;return this};T.ByteStringBuffer.prototype.clear=function(){return this.data="",this.read=0,this};T.ByteStringBuffer.prototype.truncate=function($){var J=Math.max(0,this.length()-$);return this.data=this.data.substr(this.read,J),this.read=0,this};T.ByteStringBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.length;++J){var X=this.data.charCodeAt(J);if(X<16)$+="0";$+=X.toString(16)}return $};T.ByteStringBuffer.prototype.toString=function(){return T.decodeUtf8(this.bytes())};function YM($,J){J=J||{},this.read=J.readOffset||0,this.growSize=J.growSize||1024;var X=T.isArrayBuffer($),Q=T.isArrayBufferView($);if(X||Q){if(X)this.data=new DataView($);else this.data=new DataView($.buffer,$.byteOffset,$.byteLength);this.write="writeOffset"in J?J.writeOffset:this.data.byteLength;return}if(this.data=new DataView(new ArrayBuffer(0)),this.write=0,$!==null&&$!==void 0)this.putBytes($);if("writeOffset"in J)this.write=J.writeOffset}T.DataBuffer=YM;T.DataBuffer.prototype.length=function(){return this.write-this.read};T.DataBuffer.prototype.isEmpty=function(){return this.length()<=0};T.DataBuffer.prototype.accommodate=function($,J){if(this.length()>=$)return this;J=Math.max(J||this.growSize,$);var X=new Uint8Array(this.data.buffer,this.data.byteOffset,this.data.byteLength),Q=new Uint8Array(this.length()+J);return Q.set(X),this.data=new DataView(Q.buffer),this};T.DataBuffer.prototype.putByte=function($){return this.accommodate(1),this.data.setUint8(this.write++,$),this};T.DataBuffer.prototype.fillWithByte=function($,J){this.accommodate(J);for(var X=0;X<J;++X)this.data.setUint8($);return this};T.DataBuffer.prototype.putBytes=function($,J){if(T.isArrayBufferView($)){var X=new Uint8Array($.buffer,$.byteOffset,$.byteLength),Q=X.byteLength-X.byteOffset;this.accommodate(Q);var Y=new Uint8Array(this.data.buffer,this.write);return Y.set(X),this.write+=Q,this}if(T.isArrayBuffer($)){var X=new Uint8Array($);this.accommodate(X.byteLength);var Y=new Uint8Array(this.data.buffer);return Y.set(X,this.write),this.write+=X.byteLength,this}if($ instanceof T.DataBuffer||typeof $==="object"&&typeof $.read==="number"&&typeof $.write==="number"&&T.isArrayBufferView($.data)){var X=new Uint8Array($.data.byteLength,$.read,$.length());this.accommodate(X.byteLength);var Y=new Uint8Array($.data.byteLength,this.write);return Y.set(X),this.write+=X.byteLength,this}if($ instanceof T.ByteStringBuffer)$=$.data,J="binary";if(J=J||"binary",typeof $==="string"){var G;if(J==="hex")return this.accommodate(Math.ceil($.length/2)),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.hex.decode($,G,this.write),this;if(J==="base64")return this.accommodate(Math.ceil($.length/4)*3),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.base64.decode($,G,this.write),this;if(J==="utf8")$=T.encodeUtf8($),J="binary";if(J==="binary"||J==="raw")return this.accommodate($.length),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.raw.decode(G),this;if(J==="utf16")return this.accommodate($.length*2),G=new Uint16Array(this.data.buffer,this.write),this.write+=T.text.utf16.encode(G),this;throw Error("Invalid encoding: "+J)}throw Error("Invalid parameter: "+$)};T.DataBuffer.prototype.putBuffer=function($){return this.putBytes($),$.clear(),this};T.DataBuffer.prototype.putString=function($){return this.putBytes($,"utf16")};T.DataBuffer.prototype.putInt16=function($){return this.accommodate(2),this.data.setInt16(this.write,$),this.write+=2,this};T.DataBuffer.prototype.putInt24=function($){return this.accommodate(3),this.data.setInt16(this.write,$>>8&65535),this.data.setInt8(this.write,$>>16&255),this.write+=3,this};T.DataBuffer.prototype.putInt32=function($){return this.accommodate(4),this.data.setInt32(this.write,$),this.write+=4,this};T.DataBuffer.prototype.putInt16Le=function($){return this.accommodate(2),this.data.setInt16(this.write,$,!0),this.write+=2,this};T.DataBuffer.prototype.putInt24Le=function($){return this.accommodate(3),this.data.setInt8(this.write,$>>16&255),this.data.setInt16(this.write,$>>8&65535,!0),this.write+=3,this};T.DataBuffer.prototype.putInt32Le=function($){return this.accommodate(4),this.data.setInt32(this.write,$,!0),this.write+=4,this};T.DataBuffer.prototype.putInt=function($,J){AX(J),this.accommodate(J/8);do J-=8,this.data.setInt8(this.write++,$>>J&255);while(J>0);return this};T.DataBuffer.prototype.putSignedInt=function($,J){if(AX(J),this.accommodate(J/8),$<0)$+=2<<J-1;return this.putInt($,J)};T.DataBuffer.prototype.getByte=function(){return this.data.getInt8(this.read++)};T.DataBuffer.prototype.getInt16=function(){var $=this.data.getInt16(this.read);return this.read+=2,$};T.DataBuffer.prototype.getInt24=function(){var $=this.data.getInt16(this.read)<<8^this.data.getInt8(this.read+2);return this.read+=3,$};T.DataBuffer.prototype.getInt32=function(){var $=this.data.getInt32(this.read);return this.read+=4,$};T.DataBuffer.prototype.getInt16Le=function(){var $=this.data.getInt16(this.read,!0);return this.read+=2,$};T.DataBuffer.prototype.getInt24Le=function(){var $=this.data.getInt8(this.read)^this.data.getInt16(this.read+1,!0)<<8;return this.read+=3,$};T.DataBuffer.prototype.getInt32Le=function(){var $=this.data.getInt32(this.read,!0);return this.read+=4,$};T.DataBuffer.prototype.getInt=function($){AX($);var J=0;do J=(J<<8)+this.data.getInt8(this.read++),$-=8;while($>0);return J};T.DataBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};T.DataBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};T.DataBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};T.DataBuffer.prototype.at=function($){return this.data.getUint8(this.read+$)};T.DataBuffer.prototype.setAt=function($,J){return this.data.setUint8($,J),this};T.DataBuffer.prototype.last=function(){return this.data.getUint8(this.write-1)};T.DataBuffer.prototype.copy=function(){return new T.DataBuffer(this)};T.DataBuffer.prototype.compact=function(){if(this.read>0){var $=new Uint8Array(this.data.buffer,this.read),J=new Uint8Array($.byteLength);J.set($),this.data=new DataView(J),this.write-=this.read,this.read=0}return this};T.DataBuffer.prototype.clear=function(){return this.data=new DataView(new ArrayBuffer(0)),this.read=this.write=0,this};T.DataBuffer.prototype.truncate=function($){return this.write=Math.max(0,this.length()-$),this.read=Math.min(this.read,this.write),this};T.DataBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.byteLength;++J){var X=this.data.getUint8(J);if(X<16)$+="0";$+=X.toString(16)}return $};T.DataBuffer.prototype.toString=function($){var J=new Uint8Array(this.data,this.read,this.length());if($=$||"utf8",$==="binary"||$==="raw")return T.binary.raw.encode(J);if($==="hex")return T.binary.hex.encode(J);if($==="base64")return T.binary.base64.encode(J);if($==="utf8")return T.text.utf8.decode(J);if($==="utf16")return T.text.utf16.decode(J);throw Error("Invalid encoding: "+$)};T.createBuffer=function($,J){if(J=J||"raw",$!==void 0&&J==="utf8")$=T.encodeUtf8($);return new T.ByteBuffer($)};T.fillString=function($,J){var X="";while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return X};T.xorBytes=function($,J,X){var Q="",Y="",G="",W=0,U=0;for(;X>0;--X,++W){if(Y=$.charCodeAt(W)^J.charCodeAt(W),U>=10)Q+=G,G="",U=0;G+=String.fromCharCode(Y),++U}return Q+=G,Q};T.hexToBytes=function($){var J="",X=0;if($.length&!0)X=1,J+=String.fromCharCode(parseInt($[0],16));for(;X<$.length;X+=2)J+=String.fromCharCode(parseInt($.substr(X,2),16));return J};T.bytesToHex=function($){return T.createBuffer($).toHex()};T.int32ToBytes=function($){return String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255)};var C0="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",w0=[62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,64,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],wG="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";T.encode64=function($,J){var X="",Q="",Y,G,W,U=0;while(U<$.length){if(Y=$.charCodeAt(U++),G=$.charCodeAt(U++),W=$.charCodeAt(U++),X+=C0.charAt(Y>>2),X+=C0.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=C0.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":C0.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
+`,X=X.substr(J)}return Q+=X,Q};T.decode64=function($){$=$.replace(/[^A-Za-z0-9\+\/\=]/g,"");var J="",X,Q,Y,G,W=0;while(W<$.length)if(X=w0[$.charCodeAt(W++)-43],Q=w0[$.charCodeAt(W++)-43],Y=w0[$.charCodeAt(W++)-43],G=w0[$.charCodeAt(W++)-43],J+=String.fromCharCode(X<<2|Q>>4),Y!==64){if(J+=String.fromCharCode((Q&15)<<4|Y>>2),G!==64)J+=String.fromCharCode((Y&3)<<6|G)}return J};T.encodeUtf8=function($){return unescape(encodeURIComponent($))};T.decodeUtf8=function($){return decodeURIComponent(escape($))};T.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:CG.encode,decode:CG.decode}};T.binary.raw.encode=function($){return String.fromCharCode.apply(null,$)};T.binary.raw.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};T.binary.hex.encode=T.bytesToHex;T.binary.hex.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/2));X=X||0;var Y=0,G=X;if($.length&1)Y=1,Q[G++]=parseInt($[0],16);for(;Y<$.length;Y+=2)Q[G++]=parseInt($.substr(Y,2),16);return J?G-X:Q};T.binary.base64.encode=function($,J){var X="",Q="",Y,G,W,U=0;while(U<$.byteLength){if(Y=$[U++],G=$[U++],W=$[U++],X+=C0.charAt(Y>>2),X+=C0.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=C0.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":C0.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
+`,X=X.substr(J)}return Q+=X,Q};T.binary.base64.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/4)*3);$=$.replace(/[^A-Za-z0-9\+\/\=]/g,""),X=X||0;var Y,G,W,U,M=0,O=X;while(M<$.length)if(Y=w0[$.charCodeAt(M++)-43],G=w0[$.charCodeAt(M++)-43],W=w0[$.charCodeAt(M++)-43],U=w0[$.charCodeAt(M++)-43],Q[O++]=Y<<2|G>>4,W!==64){if(Q[O++]=(G&15)<<4|W>>2,U!==64)Q[O++]=(W&3)<<6|U}return J?O-X:Q.subarray(0,O)};T.binary.base58.encode=function($,J){return T.binary.baseN.encode($,wG,J)};T.binary.base58.decode=function($,J){return T.binary.baseN.decode($,wG,J)};T.text={utf8:{},utf16:{}};T.text.utf8.encode=function($,J,X){$=T.encodeUtf8($);var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};T.text.utf8.decode=function($){return T.decodeUtf8(String.fromCharCode.apply(null,$))};T.text.utf16.encode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length*2);var Y=new Uint16Array(Q.buffer);X=X||0;var G=X,W=X;for(var U=0;U<$.length;++U)Y[W++]=$.charCodeAt(U),G+=2;return J?G-X:Q};T.text.utf16.decode=function($){return String.fromCharCode.apply(null,new Uint16Array($.buffer))};T.deflate=function($,J,X){if(J=T.decode64($.deflate(T.encode64(J)).rval),X){var Q=2,Y=J.charCodeAt(1);if(Y&32)Q=6;J=J.substring(Q,J.length-4)}return J};T.inflate=function($,J,X){var Q=$.inflate(T.encode64(J)).rval;return Q===null?null:T.decode64(Q)};var o9=function($,J,X){if(!$)throw Error("WebStorage not available.");var Q;if(X===null)Q=$.removeItem(J);else X=T.encode64(JSON.stringify(X)),Q=$.setItem(J,X);if(typeof Q<"u"&&Q.rval!==!0){var Y=Error(Q.error.message);throw Y.id=Q.error.id,Y.name=Q.error.name,Y}},a9=function($,J){if(!$)throw Error("WebStorage not available.");var X=$.getItem(J);if($.init)if(X.rval===null){if(X.error){var Q=Error(X.error.message);throw Q.id=X.error.id,Q.name=X.error.name,Q}X=null}else X=X.rval;if(X!==null)X=JSON.parse(T.decode64(X));return X},GM=function($,J,X,Q){var Y=a9($,J);if(Y===null)Y={};Y[X]=Q,o9($,J,Y)},WM=function($,J,X){var Q=a9($,J);if(Q!==null)Q=X in Q?Q[X]:null;return Q},UM=function($,J,X){var Q=a9($,J);if(Q!==null&&X in Q){delete Q[X];var Y=!0;for(var G in Q){Y=!1;break}if(Y)Q=null;o9($,J,Q)}},MM=function($,J){o9($,J,null)},LY=function($,J,X){var Q=null;if(typeof X>"u")X=["web","flash"];var Y,G=!1,W=null;for(var U in X){Y=X[U];try{if(Y==="flash"||Y==="both"){if(J[0]===null)throw Error("Flash local storage not available.");Q=$.apply(this,J),G=Y==="flash"}if(Y==="web"||Y==="both")J[0]=localStorage,Q=$.apply(this,J),G=!0}catch(M){W=M}if(G)break}if(!G)throw W;return Q};T.setItem=function($,J,X,Q,Y){LY(GM,arguments,Y)};T.getItem=function($,J,X,Q){return LY(WM,arguments,Q)};T.removeItem=function($,J,X,Q){LY(UM,arguments,Q)};T.clearItems=function($,J,X){LY(MM,arguments,X)};T.isEmpty=function($){for(var J in $)if($.hasOwnProperty(J))return!1;return!0};T.format=function($){var J=/%./g,X,Q,Y=0,G=[],W=0;while(X=J.exec($)){if(Q=$.substring(W,J.lastIndex-2),Q.length>0)G.push(Q);W=J.lastIndex;var U=X[0][1];switch(U){case"s":case"o":if(Y<arguments.length)G.push(arguments[Y+++1]);else G.push("<?>");break;case"%":G.push("%");break;default:G.push("<%"+U+"?>")}}return G.push($.substring(W)),G.join("")};T.formatNumber=function($,J,X,Q){var Y=$,G=isNaN(J=Math.abs(J))?2:J,W=X===void 0?",":X,U=Q===void 0?".":Q,M=Y<0?"-":"",O=parseInt(Y=Math.abs(+Y||0).toFixed(G),10)+"",V=O.length>3?O.length%3:0;return M+(V?O.substr(0,V)+U:"")+O.substr(V).replace(/(\d{3})(?=\d)/g,"$1"+U)+(G?W+Math.abs(Y-O).toFixed(G).slice(2):"")};T.formatSize=function($){if($>=1073741824)$=T.formatNumber($/1073741824,2,".","")+" GiB";else if($>=1048576)$=T.formatNumber($/1048576,2,".","")+" MiB";else if($>=1024)$=T.formatNumber($/1024,0)+" KiB";else $=T.formatNumber($,0)+" bytes";return $};T.bytesFromIP=function($){if($.indexOf(".")!==-1)return T.bytesFromIPv4($);if($.indexOf(":")!==-1)return T.bytesFromIPv6($);return null};T.bytesFromIPv4=function($){if($=$.split("."),$.length!==4)return null;var J=T.createBuffer();for(var X=0;X<$.length;++X){var Q=parseInt($[X],10);if(isNaN(Q))return null;J.putByte(Q)}return J.getBytes()};T.bytesFromIPv6=function($){var J=0;$=$.split(":").filter(function(W){if(W.length===0)++J;return!0});var X=(8-$.length+J)*2,Q=T.createBuffer();for(var Y=0;Y<8;++Y){if(!$[Y]||$[Y].length===0){Q.fillWithByte(0,X),X=0;continue}var G=T.hexToBytes($[Y]);if(G.length<2)Q.putByte(0);Q.putBytes(G)}return Q.getBytes()};T.bytesToIP=function($){if($.length===4)return T.bytesToIPv4($);if($.length===16)return T.bytesToIPv6($);return null};T.bytesToIPv4=function($){if($.length!==4)return null;var J=[];for(var X=0;X<$.length;++X)J.push($.charCodeAt(X));return J.join(".")};T.bytesToIPv6=function($){if($.length!==16)return null;var J=[],X=[],Q=0;for(var Y=0;Y<$.length;Y+=2){var G=T.bytesToHex($[Y]+$[Y+1]);while(G[0]==="0"&&G!=="0")G=G.substr(1);if(G==="0"){var W=X[X.length-1],U=J.length;if(!W||U!==W.end+1)X.push({start:U,end:U});else if(W.end=U,W.end-W.start>X[Q].end-X[Q].start)Q=X.length-1}J.push(G)}if(X.length>0){var M=X[Q];if(M.end-M.start>0){if(J.splice(M.start,M.end-M.start+1,""),M.start===0)J.unshift("");if(M.end===7)J.push("")}}return J.join(":")};T.estimateCores=function($,J){if(typeof $==="function")J=$,$={};if($=$||{},"cores"in T&&!$.update)return J(null,T.cores);if(typeof navigator<"u"&&"hardwareConcurrency"in navigator&&navigator.hardwareConcurrency>0)return T.cores=navigator.hardwareConcurrency,J(null,T.cores);if(typeof Worker>"u")return T.cores=1,J(null,T.cores);if(typeof Blob>"u")return T.cores=2,J(null,T.cores);var X=URL.createObjectURL(new Blob(["(",function(){self.addEventListener("message",function(W){var U=Date.now(),M=U+4;while(Date.now()<M);self.postMessage({st:U,et:M})})}.toString(),")()"],{type:"application/javascript"}));Q([],5,16);function Q(W,U,M){if(U===0){var O=Math.floor(W.reduce(function(V,q){return V+q},0)/W.length);return T.cores=Math.max(1,O),URL.revokeObjectURL(X),J(null,T.cores)}Y(M,function(V,q){W.push(G(M,q)),Q(W,U-1,M)})}function Y(W,U){var M=[],O=[];for(var V=0;V<W;++V){var q=new Worker(X);q.addEventListener("message",function(H){if(O.push(H.data),O.length===W){for(var N=0;N<W;++N)M[N].terminate();U(null,O)}}),M.push(q)}for(var V=0;V<W;++V)M[V].postMessage(V)}function G(W,U){var M=[];for(var O=0;O<W;++O){var V=U[O],q=M[O]=[];for(var H=0;H<W;++H){if(O===H)continue;var N=U[H];if(V.st>N.st&&V.st<N.et||N.st>V.st&&N.st<V.et)q.push(H)}}return M.reduce(function(K,L){return Math.max(K,L.length)},0)}}});var AY=q$((FF,_G)=>{var MJ=F$();_$();_G.exports=MJ.cipher=MJ.cipher||{};MJ.cipher.algorithms=MJ.cipher.algorithms||{};MJ.cipher.createCipher=function($,J){var X=$;if(typeof X==="string"){if(X=MJ.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new MJ.cipher.BlockCipher({algorithm:X,key:J,decrypt:!1})};MJ.cipher.createDecipher=function($,J){var X=$;if(typeof X==="string"){if(X=MJ.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new MJ.cipher.BlockCipher({algorithm:X,key:J,decrypt:!0})};MJ.cipher.registerAlgorithm=function($,J){$=$.toUpperCase(),MJ.cipher.algorithms[$]=J};MJ.cipher.getAlgorithm=function($){if($=$.toUpperCase(),$ in MJ.cipher.algorithms)return MJ.cipher.algorithms[$];return null};var s9=MJ.cipher.BlockCipher=function($){this.algorithm=$.algorithm,this.mode=this.algorithm.mode,this.blockSize=this.mode.blockSize,this._finish=!1,this._input=null,this.output=null,this._op=$.decrypt?this.mode.decrypt:this.mode.encrypt,this._decrypt=$.decrypt,this.algorithm.initialize($)};s9.prototype.start=function($){$=$||{};var J={};for(var X in $)J[X]=$[X];J.decrypt=this._decrypt,this._finish=!1,this._input=MJ.util.createBuffer(),this.output=$.output||MJ.util.createBuffer(),this.mode.start(J)};s9.prototype.update=function($){if($)this._input.putBuffer($);while(!this._op.call(this.mode,this._input,this.output,this._finish)&&!this._finish);this._input.compact()};s9.prototype.finish=function($){if($&&(this.mode.name==="ECB"||this.mode.name==="CBC"))this.mode.pad=function(X){return $(this.blockSize,X,!1)},this.mode.unpad=function(X){return $(this.blockSize,X,!0)};var J={};if(J.decrypt=this._decrypt,J.overflow=this._input.length()%this.blockSize,!this._decrypt&&this.mode.pad){if(!this.mode.pad(this._input,J))return!1}if(this._finish=!0,this.update(),this._decrypt&&this.mode.unpad){if(!this.mode.unpad(this.output,J))return!1}if(this.mode.afterFinish){if(!this.mode.afterFinish(this.output,J))return!1}return!0}});var t9=q$((NF,xG)=>{var OJ=F$();_$();OJ.cipher=OJ.cipher||{};var R$=xG.exports=OJ.cipher.modes=OJ.cipher.modes||{};R$.ecb=function($){$=$||{},this.name="ECB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};R$.ecb.prototype.start=function($){};R$.ecb.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};R$.ecb.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};R$.ecb.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};R$.ecb.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};R$.cbc=function($){$=$||{},this.name="CBC",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};R$.cbc.prototype.start=function($){if($.iv===null){if(!this._prev)throw Error("Invalid IV parameter.");this._iv=this._prev.slice(0)}else if(!("iv"in $))throw Error("Invalid IV parameter.");else this._iv=RY($.iv,this.blockSize),this._prev=this._iv.slice(0)};R$.cbc.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=this._prev[Q]^$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q]);this._prev=this._outBlock};R$.cbc.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._prev[Q]^this._outBlock[Q]);this._prev=this._inBlock.slice(0)};R$.cbc.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};R$.cbc.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};R$.cfb=function($){$=$||{},this.name="CFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.cfb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=RY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.cfb.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32()^this._outBlock[Y],J.putInt32(this._inBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32()^this._outBlock[Y],this._partialOutput.putInt32(this._partialBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.cfb.prototype.decrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32(),J.putInt32(this._inBlock[Y]^this._outBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32(),this._partialOutput.putInt32(this._partialBlock[Y]^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.ofb=function($){$=$||{},this.name="OFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.ofb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=RY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.ofb.prototype.encrypt=function($,J,X){var Q=$.length();if($.length()===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]),this._inBlock[Y]=this._outBlock[Y];return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._outBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};R$.ofb.prototype.decrypt=R$.ofb.prototype.encrypt;R$.ctr=function($){$=$||{},this.name="CTR",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0};R$.ctr.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=RY($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};R$.ctr.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize)for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]);else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}DY(this._inBlock)};R$.ctr.prototype.decrypt=R$.ctr.prototype.encrypt;R$.gcm=function($){$=$||{},this.name="GCM",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints),this._partialOutput=OJ.util.createBuffer(),this._partialBytes=0,this._R=3774873600};R$.gcm.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");var J=OJ.util.createBuffer($.iv);this._cipherLength=0;var X;if("additionalData"in $)X=OJ.util.createBuffer($.additionalData);else X=OJ.util.createBuffer();if("tagLength"in $)this._tagLength=$.tagLength;else this._tagLength=128;if(this._tag=null,$.decrypt){if(this._tag=OJ.util.createBuffer($.tag).getBytes(),this._tag.length!==this._tagLength/8)throw Error("Authentication tag does not match tag length.")}this._hashBlock=Array(this._ints),this.tag=null,this._hashSubkey=Array(this._ints),this.cipher.encrypt([0,0,0,0],this._hashSubkey),this.componentBits=4,this._m=this.generateHashTable(this._hashSubkey,this.componentBits);var Q=J.length();if(Q===12)this._j0=[J.getInt32(),J.getInt32(),J.getInt32(),1];else{this._j0=[0,0,0,0];while(J.length()>0)this._j0=this.ghash(this._hashSubkey,this._j0,[J.getInt32(),J.getInt32(),J.getInt32(),J.getInt32()]);this._j0=this.ghash(this._hashSubkey,this._j0,[0,0].concat(r9(Q*8)))}this._inBlock=this._j0.slice(0),DY(this._inBlock),this._partialBytes=0,X=OJ.util.createBuffer(X),this._aDataLength=r9(X.length()*8);var Y=X.length()%this.blockSize;if(Y)X.fillWithByte(0,this.blockSize-Y);this._s=[0,0,0,0];while(X.length()>0)this._s=this.ghash(this._hashSubkey,this._s,[X.getInt32(),X.getInt32(),X.getInt32(),X.getInt32()])};R$.gcm.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^=$.getInt32());this._cipherLength+=this.blockSize}else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G<=0||X){if(X){var W=Q%this.blockSize;this._cipherLength+=W,this._partialOutput.truncate(this.blockSize-W)}else this._cipherLength+=this.blockSize;for(var Y=0;Y<this._ints;++Y)this._outBlock[Y]=this._partialOutput.getInt32();this._partialOutput.read-=this.blockSize}if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return $.read-=this.blockSize,J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}this._s=this.ghash(this._hashSubkey,this._s,this._outBlock),DY(this._inBlock)};R$.gcm.prototype.decrypt=function($,J,X){var Q=$.length();if(Q<this.blockSize&&!(X&&Q>0))return!0;this.cipher.encrypt(this._inBlock,this._outBlock),DY(this._inBlock),this._hashBlock[0]=$.getInt32(),this._hashBlock[1]=$.getInt32(),this._hashBlock[2]=$.getInt32(),this._hashBlock[3]=$.getInt32(),this._s=this.ghash(this._hashSubkey,this._s,this._hashBlock);for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^this._hashBlock[Y]);if(Q<this.blockSize)this._cipherLength+=Q%this.blockSize;else this._cipherLength+=this.blockSize};R$.gcm.prototype.afterFinish=function($,J){var X=!0;if(J.decrypt&&J.overflow)$.truncate(this.blockSize-J.overflow);this.tag=OJ.util.createBuffer();var Q=this._aDataLength.concat(r9(this._cipherLength*8));this._s=this.ghash(this._hashSubkey,this._s,Q);var Y=[];this.cipher.encrypt(this._j0,Y);for(var G=0;G<this._ints;++G)this.tag.putInt32(this._s[G]^Y[G]);if(this.tag.truncate(this.tag.length()%(this._tagLength/8)),J.decrypt&&this.tag.bytes()!==this._tag)X=!1;return X};R$.gcm.prototype.multiply=function($,J){var X=[0,0,0,0],Q=J.slice(0);for(var Y=0;Y<128;++Y){var G=$[Y/32|0]&1<<31-Y%32;if(G)X[0]^=Q[0],X[1]^=Q[1],X[2]^=Q[2],X[3]^=Q[3];this.pow(Q,Q)}return X};R$.gcm.prototype.pow=function($,J){var X=$[3]&1;for(var Q=3;Q>0;--Q)J[Q]=$[Q]>>>1|($[Q-1]&1)<<31;if(J[0]=$[0]>>>1,X)J[0]^=this._R};R$.gcm.prototype.tableMultiply=function($){var J=[0,0,0,0];for(var X=0;X<32;++X){var Q=X/8|0,Y=$[Q]>>>(7-X%8)*4&15,G=this._m[X][Y];J[0]^=G[0],J[1]^=G[1],J[2]^=G[2],J[3]^=G[3]}return J};R$.gcm.prototype.ghash=function($,J,X){return J[0]^=X[0],J[1]^=X[1],J[2]^=X[2],J[3]^=X[3],this.tableMultiply(J)};R$.gcm.prototype.generateHashTable=function($,J){var X=8/J,Q=4*X,Y=16*X,G=Array(Y);for(var W=0;W<Y;++W){var U=[0,0,0,0],M=W/Q|0,O=(Q-1-W%Q)*J;U[M]=1<<J-1<<O,G[W]=this.generateSubHashTable(this.multiply(U,$),J)}return G};R$.gcm.prototype.generateSubHashTable=function($,J){var X=1<<J,Q=X>>>1,Y=Array(X);Y[Q]=$.slice(0);var G=Q>>>1;while(G>0)this.pow(Y[2*G],Y[G]=[]),G>>=1;G=2;while(G<Q){for(var W=1;W<G;++W){var U=Y[G],M=Y[W];Y[G+W]=[U[0]^M[0],U[1]^M[1],U[2]^M[2],U[3]^M[3]]}G*=2}Y[0]=[0,0,0,0];for(G=Q+1;G<X;++G){var O=Y[G^Q];Y[G]=[$[0]^O[0],$[1]^O[1],$[2]^O[2],$[3]^O[3]]}return Y};function RY($,J){if(typeof $==="string")$=OJ.util.createBuffer($);if(OJ.util.isArray($)&&$.length>4){var X=$;$=OJ.util.createBuffer();for(var Q=0;Q<X.length;++Q)$.putByte(X[Q])}if($.length()<J)throw Error("Invalid IV length; got "+$.length()+" bytes and expected "+J+" bytes.");if(!OJ.util.isArray($)){var Y=[],G=J/4;for(var Q=0;Q<G;++Q)Y.push($.getInt32());$=Y}return $}function DY($){$[$.length-1]=$[$.length-1]+1&4294967295}function r9($){return[$/4294967296|0,$&4294967295]}});var P0=q$((LF,yG)=>{var m$=F$();AY();t9();_$();yG.exports=m$.aes=m$.aes||{};m$.aes.startEncrypting=function($,J,X,Q){var Y=ZY({key:$,output:X,decrypt:!1,mode:Q});return Y.start(J),Y};m$.aes.createEncryptionCipher=function($,J){return ZY({key:$,output:null,decrypt:!1,mode:J})};m$.aes.startDecrypting=function($,J,X,Q){var Y=ZY({key:$,output:X,decrypt:!0,mode:Q});return Y.start(J),Y};m$.aes.createDecryptionCipher=function($,J){return ZY({key:$,output:null,decrypt:!0,mode:J})};m$.aes.Algorithm=function($,J){if(!J8)kG();var X=this;X.name=$,X.mode=new J({blockSize:16,cipher:{encrypt:function(Q,Y){return $8(X._w,Q,Y,!1)},decrypt:function(Q,Y){return $8(X._w,Q,Y,!0)}}}),X._init=!1};m$.aes.Algorithm.prototype.initialize=function($){if(this._init)return;var J=$.key,X;if(typeof J==="string"&&(J.length===16||J.length===24||J.length===32))J=m$.util.createBuffer(J);else if(m$.util.isArray(J)&&(J.length===16||J.length===24||J.length===32)){X=J,J=m$.util.createBuffer();for(var Q=0;Q<X.length;++Q)J.putByte(X[Q])}if(!m$.util.isArray(J)){X=J,J=[];var Y=X.length();if(Y===16||Y===24||Y===32){Y=Y>>>2;for(var Q=0;Q<Y;++Q)J.push(X.getInt32())}}if(!m$.util.isArray(J)||!(J.length===4||J.length===6||J.length===8))throw Error("Invalid key parameter.");var G=this.mode.name,W=["CFB","OFB","CTR","GCM"].indexOf(G)!==-1;this._w=fG(J,$.decrypt&&!W),this._init=!0};m$.aes._expandKey=function($,J){if(!J8)kG();return fG($,J)};m$.aes._updateBlock=$8;jQ("AES-ECB",m$.cipher.modes.ecb);jQ("AES-CBC",m$.cipher.modes.cbc);jQ("AES-CFB",m$.cipher.modes.cfb);jQ("AES-OFB",m$.cipher.modes.ofb);jQ("AES-CTR",m$.cipher.modes.ctr);jQ("AES-GCM",m$.cipher.modes.gcm);function jQ($,J){var X=function(){return new m$.aes.Algorithm($,J)};m$.cipher.registerAlgorithm($,X)}var J8=!1,BQ=4,LJ,e9,vG,JQ,gJ;function kG(){J8=!0,vG=[0,1,2,4,8,16,32,64,128,27,54];var $=Array(256);for(var J=0;J<128;++J)$[J]=J<<1,$[J+128]=J+128<<1^283;LJ=Array(256),e9=Array(256),JQ=[,,,,],gJ=[,,,,];for(var J=0;J<4;++J)JQ[J]=Array(256),gJ[J]=Array(256);var X=0,Q=0,Y,G,W,U,M,O,V;for(var J=0;J<256;++J){U=Q^Q<<1^Q<<2^Q<<3^Q<<4,U=U>>8^U&255^99,LJ[X]=U,e9[U]=X,M=$[U],Y=$[X],G=$[Y],W=$[G],O=M<<24^U<<16^U<<8^(U^M),V=(Y^G^W)<<24^(X^W)<<16^(X^G^W)<<8^(X^Y^W);for(var q=0;q<4;++q)JQ[q][X]=O,gJ[q][U]=V,O=O<<24|O>>>8,V=V<<24|V>>>8;if(X===0)X=Q=1;else X=Y^$[$[$[Y^W]]],Q^=$[$[Q]]}}function fG($,J){var X=$.slice(0),Q,Y=1,G=X.length,W=G+6+1,U=BQ*W;for(var M=G;M<U;++M){if(Q=X[M-1],M%G===0)Q=LJ[Q>>>16&255]<<24^LJ[Q>>>8&255]<<16^LJ[Q&255]<<8^LJ[Q>>>24]^vG[Y]<<24,Y++;else if(G>6&&M%G===4)Q=LJ[Q>>>24]<<24^LJ[Q>>>16&255]<<16^LJ[Q>>>8&255]<<8^LJ[Q&255];X[M]=X[M-G]^Q}if(J){var O,V=gJ[0],q=gJ[1],H=gJ[2],N=gJ[3],K=X.slice(0);U=X.length;for(var M=0,L=U-BQ;M<U;M+=BQ,L-=BQ)if(M===0||M===U-BQ)K[M]=X[L],K[M+1]=X[L+3],K[M+2]=X[L+2],K[M+3]=X[L+1];else for(var A=0;A<BQ;++A)O=X[L+A],K[M+(3&-A)]=V[LJ[O>>>24]]^q[LJ[O>>>16&255]]^H[LJ[O>>>8&255]]^N[LJ[O&255]];X=K}return X}function $8($,J,X,Q){var Y=$.length/4-1,G,W,U,M,O;if(Q)G=gJ[0],W=gJ[1],U=gJ[2],M=gJ[3],O=e9;else G=JQ[0],W=JQ[1],U=JQ[2],M=JQ[3],O=LJ;var V,q,H,N,K,L,A;V=J[0]^$[0],q=J[Q?3:1]^$[1],H=J[2]^$[2],N=J[Q?1:3]^$[3];var D=3;for(var S=1;S<Y;++S)K=G[V>>>24]^W[q>>>16&255]^U[H>>>8&255]^M[N&255]^$[++D],L=G[q>>>24]^W[H>>>16&255]^U[N>>>8&255]^M[V&255]^$[++D],A=G[H>>>24]^W[N>>>16&255]^U[V>>>8&255]^M[q&255]^$[++D],N=G[N>>>24]^W[V>>>16&255]^U[q>>>8&255]^M[H&255]^$[++D],V=K,q=L,H=A;X[0]=O[V>>>24]<<24^O[q>>>16&255]<<16^O[H>>>8&255]<<8^O[N&255]^$[++D],X[Q?3:1]=O[q>>>24]<<24^O[H>>>16&255]<<16^O[N>>>8&255]<<8^O[V&255]^$[++D],X[2]=O[H>>>24]<<24^O[N>>>16&255]<<16^O[V>>>8&255]<<8^O[q&255]^$[++D],X[Q?1:3]=O[N>>>24]<<24^O[V>>>16&255]<<16^O[q>>>8&255]<<8^O[H&255]^$[++D]}function ZY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="AES-"+J,Q;if($.decrypt)Q=m$.cipher.createDecipher(X,$.key);else Q=m$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var U=null;if(W instanceof m$.util.ByteBuffer)U=W,W={};W=W||{},W.output=U,W.iv=G,Y.call(Q,W)},Q}});var _0=q$((AF,bG)=>{var RX=F$();RX.pki=RX.pki||{};var Q8=bG.exports=RX.pki.oids=RX.oids=RX.oids||{};function b($,J){Q8[$]=J,Q8[J]=$}function k$($,J){Q8[$]=J}b("1.2.840.113549.1.1.1","rsaEncryption");b("1.2.840.113549.1.1.4","md5WithRSAEncryption");b("1.2.840.113549.1.1.5","sha1WithRSAEncryption");b("1.2.840.113549.1.1.7","RSAES-OAEP");b("1.2.840.113549.1.1.8","mgf1");b("1.2.840.113549.1.1.9","pSpecified");b("1.2.840.113549.1.1.10","RSASSA-PSS");b("1.2.840.113549.1.1.11","sha256WithRSAEncryption");b("1.2.840.113549.1.1.12","sha384WithRSAEncryption");b("1.2.840.113549.1.1.13","sha512WithRSAEncryption");b("1.3.101.112","EdDSA25519");b("1.2.840.10040.4.3","dsa-with-sha1");b("1.3.14.3.2.7","desCBC");b("1.3.14.3.2.26","sha1");b("1.3.14.3.2.29","sha1WithRSASignature");b("2.16.840.1.101.3.4.2.1","sha256");b("2.16.840.1.101.3.4.2.2","sha384");b("2.16.840.1.101.3.4.2.3","sha512");b("2.16.840.1.101.3.4.2.4","sha224");b("2.16.840.1.101.3.4.2.5","sha512-224");b("2.16.840.1.101.3.4.2.6","sha512-256");b("1.2.840.113549.2.2","md2");b("1.2.840.113549.2.5","md5");b("1.2.840.113549.1.7.1","data");b("1.2.840.113549.1.7.2","signedData");b("1.2.840.113549.1.7.3","envelopedData");b("1.2.840.113549.1.7.4","signedAndEnvelopedData");b("1.2.840.113549.1.7.5","digestedData");b("1.2.840.113549.1.7.6","encryptedData");b("1.2.840.113549.1.9.1","emailAddress");b("1.2.840.113549.1.9.2","unstructuredName");b("1.2.840.113549.1.9.3","contentType");b("1.2.840.113549.1.9.4","messageDigest");b("1.2.840.113549.1.9.5","signingTime");b("1.2.840.113549.1.9.6","counterSignature");b("1.2.840.113549.1.9.7","challengePassword");b("1.2.840.113549.1.9.8","unstructuredAddress");b("1.2.840.113549.1.9.14","extensionRequest");b("1.2.840.113549.1.9.20","friendlyName");b("1.2.840.113549.1.9.21","localKeyId");b("1.2.840.113549.1.9.22.1","x509Certificate");b("1.2.840.113549.1.12.10.1.1","keyBag");b("1.2.840.113549.1.12.10.1.2","pkcs8ShroudedKeyBag");b("1.2.840.113549.1.12.10.1.3","certBag");b("1.2.840.113549.1.12.10.1.4","crlBag");b("1.2.840.113549.1.12.10.1.5","secretBag");b("1.2.840.113549.1.12.10.1.6","safeContentsBag");b("1.2.840.113549.1.5.13","pkcs5PBES2");b("1.2.840.113549.1.5.12","pkcs5PBKDF2");b("1.2.840.113549.1.12.1.1","pbeWithSHAAnd128BitRC4");b("1.2.840.113549.1.12.1.2","pbeWithSHAAnd40BitRC4");b("1.2.840.113549.1.12.1.3","pbeWithSHAAnd3-KeyTripleDES-CBC");b("1.2.840.113549.1.12.1.4","pbeWithSHAAnd2-KeyTripleDES-CBC");b("1.2.840.113549.1.12.1.5","pbeWithSHAAnd128BitRC2-CBC");b("1.2.840.113549.1.12.1.6","pbewithSHAAnd40BitRC2-CBC");b("1.2.840.113549.2.7","hmacWithSHA1");b("1.2.840.113549.2.8","hmacWithSHA224");b("1.2.840.113549.2.9","hmacWithSHA256");b("1.2.840.113549.2.10","hmacWithSHA384");b("1.2.840.113549.2.11","hmacWithSHA512");b("1.2.840.113549.3.7","des-EDE3-CBC");b("2.16.840.1.101.3.4.1.2","aes128-CBC");b("2.16.840.1.101.3.4.1.22","aes192-CBC");b("2.16.840.1.101.3.4.1.42","aes256-CBC");b("2.5.4.3","commonName");b("2.5.4.4","surname");b("2.5.4.5","serialNumber");b("2.5.4.6","countryName");b("2.5.4.7","localityName");b("2.5.4.8","stateOrProvinceName");b("2.5.4.9","streetAddress");b("2.5.4.10","organizationName");b("2.5.4.11","organizationalUnitName");b("2.5.4.12","title");b("2.5.4.13","description");b("2.5.4.15","businessCategory");b("2.5.4.17","postalCode");b("2.5.4.42","givenName");b("2.5.4.65","pseudonym");b("1.3.6.1.4.1.311.60.2.1.2","jurisdictionOfIncorporationStateOrProvinceName");b("1.3.6.1.4.1.311.60.2.1.3","jurisdictionOfIncorporationCountryName");b("2.16.840.1.113730.1.1","nsCertType");b("2.16.840.1.113730.1.13","nsComment");k$("2.5.29.1","authorityKeyIdentifier");k$("2.5.29.2","keyAttributes");k$("2.5.29.3","certificatePolicies");k$("2.5.29.4","keyUsageRestriction");k$("2.5.29.5","policyMapping");k$("2.5.29.6","subtreesConstraint");k$("2.5.29.7","subjectAltName");k$("2.5.29.8","issuerAltName");k$("2.5.29.9","subjectDirectoryAttributes");k$("2.5.29.10","basicConstraints");k$("2.5.29.11","nameConstraints");k$("2.5.29.12","policyConstraints");k$("2.5.29.13","basicConstraints");b("2.5.29.14","subjectKeyIdentifier");b("2.5.29.15","keyUsage");k$("2.5.29.16","privateKeyUsagePeriod");b("2.5.29.17","subjectAltName");b("2.5.29.18","issuerAltName");b("2.5.29.19","basicConstraints");k$("2.5.29.20","cRLNumber");k$("2.5.29.21","cRLReason");k$("2.5.29.22","expirationDate");k$("2.5.29.23","instructionCode");k$("2.5.29.24","invalidityDate");k$("2.5.29.25","cRLDistributionPoints");k$("2.5.29.26","issuingDistributionPoint");k$("2.5.29.27","deltaCRLIndicator");k$("2.5.29.28","issuingDistributionPoint");k$("2.5.29.29","certificateIssuer");k$("2.5.29.30","nameConstraints");b("2.5.29.31","cRLDistributionPoints");b("2.5.29.32","certificatePolicies");k$("2.5.29.33","policyMappings");k$("2.5.29.34","policyConstraints");b("2.5.29.35","authorityKeyIdentifier");k$("2.5.29.36","policyConstraints");b("2.5.29.37","extKeyUsage");k$("2.5.29.46","freshestCRL");k$("2.5.29.54","inhibitAnyPolicy");b("1.3.6.1.4.1.11129.2.4.2","timestampList");b("1.3.6.1.5.5.7.1.1","authorityInfoAccess");b("1.3.6.1.5.5.7.3.1","serverAuth");b("1.3.6.1.5.5.7.3.2","clientAuth");b("1.3.6.1.5.5.7.3.3","codeSigning");b("1.3.6.1.5.5.7.3.4","emailProtection");b("1.3.6.1.5.5.7.3.8","timeStamping")});var mJ=q$((RF,uG)=>{var p$=F$();_$();_0();var d=uG.exports=p$.asn1=p$.asn1||{};d.Class={UNIVERSAL:0,APPLICATION:64,CONTEXT_SPECIFIC:128,PRIVATE:192};d.Type={NONE:0,BOOLEAN:1,INTEGER:2,BITSTRING:3,OCTETSTRING:4,NULL:5,OID:6,ODESC:7,EXTERNAL:8,REAL:9,ENUMERATED:10,EMBEDDED:11,UTF8:12,ROID:13,SEQUENCE:16,SET:17,PRINTABLESTRING:19,IA5STRING:22,UTCTIME:23,GENERALIZEDTIME:24,BMPSTRING:30};d.maxDepth=256;d.create=function($,J,X,Q,Y){if(p$.util.isArray(Q)){var G=[];for(var W=0;W<Q.length;++W)if(Q[W]!==void 0)G.push(Q[W]);Q=G}var U={tagClass:$,type:J,constructed:X,composed:X||p$.util.isArray(Q),value:Q};if(Y&&"bitStringContents"in Y)U.bitStringContents=Y.bitStringContents,U.original=d.copy(U);return U};d.copy=function($,J){var X;if(p$.util.isArray($)){X=[];for(var Q=0;Q<$.length;++Q)X.push(d.copy($[Q],J));return X}if(typeof $==="string")return $;if(X={tagClass:$.tagClass,type:$.type,constructed:$.constructed,composed:$.composed,value:d.copy($.value,J)},J&&!J.excludeBitStringContents)X.bitStringContents=$.bitStringContents;return X};d.equals=function($,J,X){if(p$.util.isArray($)){if(!p$.util.isArray(J))return!1;if($.length!==J.length)return!1;for(var Q=0;Q<$.length;++Q)if(!d.equals($[Q],J[Q]))return!1;return!0}if(typeof $!==typeof J)return!1;if(typeof $==="string")return $===J;var Y=$.tagClass===J.tagClass&&$.type===J.type&&$.constructed===J.constructed&&$.composed===J.composed&&d.equals($.value,J.value);if(X&&X.includeBitStringContents)Y=Y&&$.bitStringContents===J.bitStringContents;return Y};d.getBerValueLength=function($){var J=$.getByte();if(J===128)return;var X,Q=J&128;if(!Q)X=J;else X=$.getInt((J&127)<<3);return X};function DX($,J,X){if(X>J){var Q=Error("Too few bytes to parse DER.");throw Q.available=$.length(),Q.remaining=J,Q.requested=X,Q}}var OM=function($,J){var X=$.getByte();if(J--,X===128)return;var Q,Y=X&128;if(!Y)Q=X;else{var G=X&127;DX($,J,G),Q=$.getInt(G<<3)}if(Q<0)throw Error("Negative length: "+Q);return Q};d.fromDer=function($,J){if(J===void 0)J={strict:!0,parseAllBytes:!0,decodeBitStrings:!0};if(typeof J==="boolean")J={strict:J,parseAllBytes:!0,decodeBitStrings:!0};if(!("strict"in J))J.strict=!0;if(!("parseAllBytes"in J))J.parseAllBytes=!0;if(!("decodeBitStrings"in J))J.decodeBitStrings=!0;if(!("maxDepth"in J))J.maxDepth=d.maxDepth;if(typeof $==="string")$=p$.util.createBuffer($);var X=$.length(),Q=BY($,$.length(),0,J);if(J.parseAllBytes&&$.length()!==0){var Y=Error("Unparsed DER bytes remain after ASN.1 parsing.");throw Y.byteCount=X,Y.remaining=$.length(),Y}return Q};function BY($,J,X,Q){if(X>=Q.maxDepth)throw Error("ASN.1 parsing error: Max depth exceeded.");var Y;DX($,J,2);var G=$.getByte();J--;var W=G&192,U=G&31;Y=$.length();var M=OM($,J);if(J-=Y-$.length(),M!==void 0&&M>J){if(Q.strict){var O=Error("Too few bytes to read ASN.1 value.");throw O.available=$.length(),O.remaining=J,O.requested=M,O}M=J}var V,q,H=(G&32)===32;if(H)if(V=[],M===void 0)for(;;){if(DX($,J,2),$.bytes(2)===String.fromCharCode(0,0)){$.getBytes(2),J-=2;break}Y=$.length(),V.push(BY($,J,X+1,Q)),J-=Y-$.length()}else while(M>0)Y=$.length(),V.push(BY($,M,X+1,Q)),J-=Y-$.length(),M-=Y-$.length();if(V===void 0&&W===d.Class.UNIVERSAL&&U===d.Type.BITSTRING)q=$.bytes(M);if(V===void 0&&Q.decodeBitStrings&&W===d.Class.UNIVERSAL&&U===d.Type.BITSTRING&&M>1){var N=$.read,K=J,L=0;if(U===d.Type.BITSTRING)DX($,J,1),L=$.getByte(),J--;if(L===0)try{Y=$.length();var A={strict:!0,decodeBitStrings:!0},D=BY($,J,X+1,A),S=Y-$.length();if(J-=S,U==d.Type.BITSTRING)S++;var B=D.tagClass;if(S===M&&(B===d.Class.UNIVERSAL||B===d.Class.CONTEXT_SPECIFIC))V=[D]}catch(w){}if(V===void 0)$.read=N,J=K}if(V===void 0){if(M===void 0){if(Q.strict)throw Error("Non-constructed ASN.1 object of indefinite length.");M=J}if(U===d.Type.BMPSTRING){V="";for(;M>0;M-=2)DX($,J,2),V+=String.fromCharCode($.getInt16()),J-=2}else V=$.getBytes(M),J-=M}var C=q===void 0?null:{bitStringContents:q};return d.create(W,U,H,V,C)}d.toDer=function($){var J=p$.util.createBuffer(),X=$.tagClass|$.type,Q=p$.util.createBuffer(),Y=!1;if("bitStringContents"in $){if(Y=!0,$.original)Y=d.equals($,$.original)}if(Y)Q.putBytes($.bitStringContents);else if($.composed){if($.constructed)X|=32;else Q.putByte(0);for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0)Q.putBuffer(d.toDer($.value[G]))}else if($.type===d.Type.BMPSTRING)for(var G=0;G<$.value.length;++G)Q.putInt16($.value.charCodeAt(G));else if($.type===d.Type.INTEGER&&$.value.length>1&&($.value.charCodeAt(0)===0&&($.value.charCodeAt(1)&128)===0||$.value.charCodeAt(0)===255&&($.value.charCodeAt(1)&128)===128))Q.putBytes($.value.substr(1));else Q.putBytes($.value);if(J.putByte(X),Q.length()<=127)J.putByte(Q.length()&127);else{var W=Q.length(),U="";do U+=String.fromCharCode(W&255),W=W>>>8;while(W>0);J.putByte(U.length|128);for(var G=U.length-1;G>=0;--G)J.putByte(U.charCodeAt(G))}return J.putBuffer(Q),J};d.oidToDer=function($){var J=$.split("."),X=p$.util.createBuffer();X.putByte(40*parseInt(J[0],10)+parseInt(J[1],10));var Q,Y,G,W;for(var U=2;U<J.length;++U){if(Q=!0,Y=[],G=parseInt(J[U],10),G>4294967295)throw Error("OID value too large; max is 32-bits.");do{if(W=G&127,G=G>>>7,!Q)W|=128;Y.push(W),Q=!1}while(G>0);for(var M=Y.length-1;M>=0;--M)X.putByte(Y[M])}return X};d.derToOid=function($){var J;if(typeof $==="string")$=p$.util.createBuffer($);var X=$.getByte();J=Math.floor(X/40)+"."+X%40;var Q=0;while($.length()>0){if(Q>70368744177663)throw Error("OID value too large; max is 53-bits.");if(X=$.getByte(),Q=Q*128,X&128)Q+=X&127;else J+="."+(Q+X),Q=0}return J};d.utcTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,2),10);X=X>=50?1900+X:2000+X;var Q=parseInt($.substr(2,2),10)-1,Y=parseInt($.substr(4,2),10),G=parseInt($.substr(6,2),10),W=parseInt($.substr(8,2),10),U=0;if($.length>11){var M=$.charAt(10),O=10;if(M!=="+"&&M!=="-")U=parseInt($.substr(10,2),10),O+=2}if(J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,U,0),O){if(M=$.charAt(O),M==="+"||M==="-"){var V=parseInt($.substr(O+1,2),10),q=parseInt($.substr(O+4,2),10),H=V*60+q;if(H*=60000,M==="+")J.setTime(+J-H);else J.setTime(+J+H)}}return J};d.generalizedTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,4),10),Q=parseInt($.substr(4,2),10)-1,Y=parseInt($.substr(6,2),10),G=parseInt($.substr(8,2),10),W=parseInt($.substr(10,2),10),U=parseInt($.substr(12,2),10),M=0,O=0,V=!1;if($.charAt($.length-1)==="Z")V=!0;var q=$.length-5,H=$.charAt(q);if(H==="+"||H==="-"){var N=parseInt($.substr(q+1,2),10),K=parseInt($.substr(q+4,2),10);if(O=N*60+K,O*=60000,H==="+")O*=-1;V=!0}if($.charAt(14)===".")M=parseFloat($.substr(14),10)*1000;if(V)J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,U,M),J.setTime(+J+O);else J.setFullYear(X,Q,Y),J.setHours(G,W,U,M);return J};d.dateToUtcTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push((""+$.getUTCFullYear()).substr(2)),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};d.dateToGeneralizedTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push(""+$.getUTCFullYear()),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};d.integerToDer=function($){var J=p$.util.createBuffer();if($>=-128&&$<128)return J.putSignedInt($,8);if($>=-32768&&$<32768)return J.putSignedInt($,16);if($>=-8388608&&$<8388608)return J.putSignedInt($,24);if($>=-2147483648&&$<2147483648)return J.putSignedInt($,32);var X=Error("Integer too large; max is 32-bits.");throw X.integer=$,X};d.derToInteger=function($){if(typeof $==="string")$=p$.util.createBuffer($);var J=$.length()*8;if(J>32)throw Error("Integer too large; max is 32-bits.");return $.getSignedInt(J)};d.validate=function($,J,X,Q){var Y=!1;if(($.tagClass===J.tagClass||typeof J.tagClass>"u")&&($.type===J.type||typeof J.type>"u")){if($.constructed===J.constructed||typeof J.constructed>"u"){if(Y=!0,J.value&&p$.util.isArray(J.value)){var G=0;for(var W=0;Y&&W<J.value.length;++W){var U=J.value[W];Y=!!U.optional;var M=$.value[G];if(!M){if(!U.optional){if(Y=!1,Q)Q.push("["+J.name+'] Missing required element. Expected tag class "'+U.tagClass+'", type "'+U.type+'"')}continue}var O=typeof U.tagClass<"u"&&typeof U.type<"u";if(O&&(M.tagClass!==U.tagClass||M.type!==U.type))if(U.optional){Y=!0;continue}else{if(Y=!1,Q)Q.push("["+J.name+"] Tag mismatch. Expected ("+U.tagClass+","+U.type+"), got ("+M.tagClass+","+M.type+")");break}var V=d.validate(M,U,X,Q);if(V)++G,Y=!0;else if(U.optional)Y=!0;else{Y=!1;break}}}if(Y&&X){if(J.capture)X[J.capture]=$.value;if(J.captureAsn1)X[J.captureAsn1]=$;if(J.captureBitStringContents&&"bitStringContents"in $)X[J.captureBitStringContents]=$.bitStringContents;if(J.captureBitStringValue&&"bitStringContents"in $){var q;if($.bitStringContents.length<2)X[J.captureBitStringValue]="";else{var H=$.bitStringContents.charCodeAt(0);if(H!==0)throw Error("captureBitStringValue only supported for zero unused bits");X[J.captureBitStringValue]=$.bitStringContents.slice(1)}}}}else if(Q)Q.push("["+J.name+'] Expected constructed "'+J.constructed+'", got "'+$.constructed+'"')}else if(Q){if($.tagClass!==J.tagClass)Q.push("["+J.name+'] Expected tag class "'+J.tagClass+'", got "'+$.tagClass+'"');if($.type!==J.type)Q.push("["+J.name+'] Expected type "'+J.type+'", got "'+$.type+'"')}return Y};var hG=/[^\\u0000-\\u00ff]/;d.prettyPrint=function($,J,X){var Q="";if(J=J||0,X=X||2,J>0)Q+=`
 `;var Y="";for(var G=0;G<J*X;++G)Y+=" ";switch(Q+=Y+"Tag: ",$.tagClass){case d.Class.UNIVERSAL:Q+="Universal:";break;case d.Class.APPLICATION:Q+="Application:";break;case d.Class.CONTEXT_SPECIFIC:Q+="Context-Specific:";break;case d.Class.PRIVATE:Q+="Private:";break}if($.tagClass===d.Class.UNIVERSAL)switch(Q+=$.type,$.type){case d.Type.NONE:Q+=" (None)";break;case d.Type.BOOLEAN:Q+=" (Boolean)";break;case d.Type.INTEGER:Q+=" (Integer)";break;case d.Type.BITSTRING:Q+=" (Bit string)";break;case d.Type.OCTETSTRING:Q+=" (Octet string)";break;case d.Type.NULL:Q+=" (Null)";break;case d.Type.OID:Q+=" (Object Identifier)";break;case d.Type.ODESC:Q+=" (Object Descriptor)";break;case d.Type.EXTERNAL:Q+=" (External or Instance of)";break;case d.Type.REAL:Q+=" (Real)";break;case d.Type.ENUMERATED:Q+=" (Enumerated)";break;case d.Type.EMBEDDED:Q+=" (Embedded PDV)";break;case d.Type.UTF8:Q+=" (UTF8)";break;case d.Type.ROID:Q+=" (Relative Object Identifier)";break;case d.Type.SEQUENCE:Q+=" (Sequence)";break;case d.Type.SET:Q+=" (Set)";break;case d.Type.PRINTABLESTRING:Q+=" (Printable String)";break;case d.Type.IA5String:Q+=" (IA5String (ASCII))";break;case d.Type.UTCTIME:Q+=" (UTC time)";break;case d.Type.GENERALIZEDTIME:Q+=" (Generalized time)";break;case d.Type.BMPSTRING:Q+=" (BMP String)";break}else Q+=$.type;if(Q+=`
 `,Q+=Y+"Constructed: "+$.constructed+`
-`,$.composed){var W=0,U="";for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0){if(W+=1,U+=d.prettyPrint($.value[G],J+1,X),G+1<$.value.length)U+=","}Q+=Y+"Sub values: "+W+U}else{if(Q+=Y+"Value: ",$.type===d.Type.OID){var M=d.derToOid($.value);if(Q+=M,p$.pki&&p$.pki.oids){if(M in p$.pki.oids)Q+=" ("+p$.pki.oids[M]+") "}}if($.type===d.Type.INTEGER)try{Q+=d.derToInteger($.value)}catch(V){Q+="0x"+p$.util.bytesToHex($.value)}else if($.type===d.Type.BITSTRING){if($.value.length>1)Q+="0x"+p$.util.bytesToHex($.value.slice(1));else Q+="(none)";if($.value.length>0){var O=$.value.charCodeAt(0);if(O==1)Q+=" (1 unused bit shown)";else if(O>1)Q+=" ("+O+" unused bits shown)"}}else if($.type===d.Type.OCTETSTRING){if(!fG.test($.value))Q+="("+$.value+") ";Q+="0x"+p$.util.bytesToHex($.value)}else if($.type===d.Type.UTF8)try{Q+=p$.util.decodeUtf8($.value)}catch(V){if(V.message==="URI malformed")Q+="0x"+p$.util.bytesToHex($.value)+" (malformed UTF8)";else throw V}else if($.type===d.Type.PRINTABLESTRING||$.type===d.Type.IA5String)Q+=$.value;else if(fG.test($.value))Q+="0x"+p$.util.bytesToHex($.value);else if($.value.length===0)Q+="[null]";else Q+=$.value}return Q}});var $0=H$((HF,bG)=>{var BY=F$();bG.exports=BY.md=BY.md||{};BY.md.algorithms=BY.md.algorithms||{}});var TQ=H$((qF,hG)=>{var N0=F$();$0();_$();var YM=hG.exports=N0.hmac=N0.hmac||{};YM.create=function(){var $=null,J=null,X=null,Q=null,Y={};return Y.start=function(G,W){if(G!==null)if(typeof G==="string")if(G=G.toLowerCase(),G in N0.md.algorithms)J=N0.md.algorithms[G].create();else throw Error('Unknown hash algorithm "'+G+'"');else J=G;if(W===null)W=$;else{if(typeof W==="string")W=N0.util.createBuffer(W);else if(N0.util.isArray(W)){var U=W;W=N0.util.createBuffer();for(var M=0;M<U.length;++M)W.putByte(U[M])}var O=W.length();if(O>J.blockLength)J.start(),J.update(W.bytes()),W=J.digest();X=N0.util.createBuffer(),Q=N0.util.createBuffer(),O=W.length();for(var M=0;M<O;++M){var U=W.at(M);X.putByte(54^U),Q.putByte(92^U)}if(O<J.blockLength){var U=J.blockLength-O;for(var M=0;M<U;++M)X.putByte(54),Q.putByte(92)}$=W,X=X.bytes(),Q=Q.bytes()}J.start(),J.update(X)},Y.update=function(G){J.update(G)},Y.getMac=function(){var G=J.digest().bytes();return J.start(),J.update(Q),J.update(G),J.digest()},Y.digest=Y.getMac,Y}});var TY=H$((KF,lG)=>{var J0=F$();$0();_$();var gG=lG.exports=J0.md5=J0.md5||{};J0.md.md5=J0.md.algorithms.md5=gG;gG.create=function(){if(!mG)GM();var $=null,J=J0.util.createBuffer(),X=Array(16),Q={algorithm:"md5",blockLength:64,digestLength:16,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=J0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=J0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),uG($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=J0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(Q8.substr(0,Q.blockLength-W));var U,M=0;for(var O=Q.fullMessageLength.length-1;O>=0;--O)U=Q.fullMessageLength[O]*8+M,M=U/4294967296>>>0,Y.putInt32Le(U>>>0);var V={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3};uG(V,X,Y);var H=J0.util.createBuffer();return H.putInt32Le(V.h0),H.putInt32Le(V.h1),H.putInt32Le(V.h2),H.putInt32Le(V.h3),H},Q};var Q8=null,jY=null,DX=null,SQ=null,mG=!1;function GM(){Q8=String.fromCharCode(128),Q8+=J0.util.fillString(String.fromCharCode(0),64),jY=[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,1,6,11,0,5,10,15,4,9,14,3,8,13,2,7,12,5,8,11,14,1,4,7,10,13,0,3,6,9,12,15,2,0,7,14,5,12,3,10,1,8,15,6,13,4,11,2,9],DX=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],SQ=Array(64);for(var $=0;$<64;++$)SQ[$]=Math.floor(Math.abs(Math.sin($+1))*4294967296);mG=!0}function uG($,J,X){var Q,Y,G,W,U,M,O,V,H=X.length();while(H>=64){Y=$.h0,G=$.h1,W=$.h2,U=$.h3;for(V=0;V<16;++V)J[V]=X.getInt32Le(),M=U^G&(W^U),Q=Y+M+SQ[V]+J[V],O=DX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<32;++V)M=W^U&(G^W),Q=Y+M+SQ[V]+J[jY[V]],O=DX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<48;++V)M=G^W^U,Q=Y+M+SQ[V]+J[jY[V]],O=DX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<64;++V)M=W^(G|~U),Q=Y+M+SQ[V]+J[jY[V]],O=DX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+U|0,H-=64}}});var QQ=H$((zF,dG)=>{var IY=F$();_$();var pG=dG.exports=IY.pem=IY.pem||{};pG.encode=function($,J){J=J||{};var X="-----BEGIN "+$.type+`-----\r
-`,Q;if($.procType)Q={name:"Proc-Type",values:[String($.procType.version),$.procType.type]},X+=SY(Q);if($.contentDomain)Q={name:"Content-Domain",values:[$.contentDomain]},X+=SY(Q);if($.dekInfo){if(Q={name:"DEK-Info",values:[$.dekInfo.algorithm]},$.dekInfo.parameters)Q.values.push($.dekInfo.parameters);X+=SY(Q)}if($.headers)for(var Y=0;Y<$.headers.length;++Y)X+=SY($.headers[Y]);if($.procType)X+=`\r
-`;return X+=IY.util.encode64($.body,J.maxline||64)+`\r
+`,$.composed){var W=0,U="";for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0){if(W+=1,U+=d.prettyPrint($.value[G],J+1,X),G+1<$.value.length)U+=","}Q+=Y+"Sub values: "+W+U}else{if(Q+=Y+"Value: ",$.type===d.Type.OID){var M=d.derToOid($.value);if(Q+=M,p$.pki&&p$.pki.oids){if(M in p$.pki.oids)Q+=" ("+p$.pki.oids[M]+") "}}if($.type===d.Type.INTEGER)try{Q+=d.derToInteger($.value)}catch(V){Q+="0x"+p$.util.bytesToHex($.value)}else if($.type===d.Type.BITSTRING){if($.value.length>1)Q+="0x"+p$.util.bytesToHex($.value.slice(1));else Q+="(none)";if($.value.length>0){var O=$.value.charCodeAt(0);if(O==1)Q+=" (1 unused bit shown)";else if(O>1)Q+=" ("+O+" unused bits shown)"}}else if($.type===d.Type.OCTETSTRING){if(!hG.test($.value))Q+="("+$.value+") ";Q+="0x"+p$.util.bytesToHex($.value)}else if($.type===d.Type.UTF8)try{Q+=p$.util.decodeUtf8($.value)}catch(V){if(V.message==="URI malformed")Q+="0x"+p$.util.bytesToHex($.value)+" (malformed UTF8)";else throw V}else if($.type===d.Type.PRINTABLESTRING||$.type===d.Type.IA5String)Q+=$.value;else if(hG.test($.value))Q+="0x"+p$.util.bytesToHex($.value);else if($.value.length===0)Q+="[null]";else Q+=$.value}return Q}});var $0=q$((DF,gG)=>{var jY=F$();gG.exports=jY.md=jY.md||{};jY.md.algorithms=jY.md.algorithms||{}});var TQ=q$((ZF,mG)=>{var N0=F$();$0();_$();var VM=mG.exports=N0.hmac=N0.hmac||{};VM.create=function(){var $=null,J=null,X=null,Q=null,Y={};return Y.start=function(G,W){if(G!==null)if(typeof G==="string")if(G=G.toLowerCase(),G in N0.md.algorithms)J=N0.md.algorithms[G].create();else throw Error('Unknown hash algorithm "'+G+'"');else J=G;if(W===null)W=$;else{if(typeof W==="string")W=N0.util.createBuffer(W);else if(N0.util.isArray(W)){var U=W;W=N0.util.createBuffer();for(var M=0;M<U.length;++M)W.putByte(U[M])}var O=W.length();if(O>J.blockLength)J.start(),J.update(W.bytes()),W=J.digest();X=N0.util.createBuffer(),Q=N0.util.createBuffer(),O=W.length();for(var M=0;M<O;++M){var U=W.at(M);X.putByte(54^U),Q.putByte(92^U)}if(O<J.blockLength){var U=J.blockLength-O;for(var M=0;M<U;++M)X.putByte(54),Q.putByte(92)}$=W,X=X.bytes(),Q=Q.bytes()}J.start(),J.update(X)},Y.update=function(G){J.update(G)},Y.getMac=function(){var G=J.digest().bytes();return J.start(),J.update(Q),J.update(G),J.digest()},Y.digest=Y.getMac,Y}});var SY=q$((BF,cG)=>{var J0=F$();$0();_$();var pG=cG.exports=J0.md5=J0.md5||{};J0.md.md5=J0.md.algorithms.md5=pG;pG.create=function(){if(!dG)qM();var $=null,J=J0.util.createBuffer(),X=Array(16),Q={algorithm:"md5",blockLength:64,digestLength:16,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=J0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=J0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),lG($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=J0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(X8.substr(0,Q.blockLength-W));var U,M=0;for(var O=Q.fullMessageLength.length-1;O>=0;--O)U=Q.fullMessageLength[O]*8+M,M=U/4294967296>>>0,Y.putInt32Le(U>>>0);var V={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3};lG(V,X,Y);var q=J0.util.createBuffer();return q.putInt32Le(V.h0),q.putInt32Le(V.h1),q.putInt32Le(V.h2),q.putInt32Le(V.h3),q},Q};var X8=null,TY=null,ZX=null,SQ=null,dG=!1;function qM(){X8=String.fromCharCode(128),X8+=J0.util.fillString(String.fromCharCode(0),64),TY=[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,1,6,11,0,5,10,15,4,9,14,3,8,13,2,7,12,5,8,11,14,1,4,7,10,13,0,3,6,9,12,15,2,0,7,14,5,12,3,10,1,8,15,6,13,4,11,2,9],ZX=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],SQ=Array(64);for(var $=0;$<64;++$)SQ[$]=Math.floor(Math.abs(Math.sin($+1))*4294967296);dG=!0}function lG($,J,X){var Q,Y,G,W,U,M,O,V,q=X.length();while(q>=64){Y=$.h0,G=$.h1,W=$.h2,U=$.h3;for(V=0;V<16;++V)J[V]=X.getInt32Le(),M=U^G&(W^U),Q=Y+M+SQ[V]+J[V],O=ZX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<32;++V)M=W^U&(G^W),Q=Y+M+SQ[V]+J[TY[V]],O=ZX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<48;++V)M=G^W^U,Q=Y+M+SQ[V]+J[TY[V]],O=ZX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;for(;V<64;++V)M=W^(G|~U),Q=Y+M+SQ[V]+J[TY[V]],O=ZX[V],Y=U,U=W,W=G,G+=Q<<O|Q>>>32-O;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+U|0,q-=64}}});var QQ=q$((jF,iG)=>{var CY=F$();_$();var nG=iG.exports=CY.pem=CY.pem||{};nG.encode=function($,J){J=J||{};var X="-----BEGIN "+$.type+`-----\r
+`,Q;if($.procType)Q={name:"Proc-Type",values:[String($.procType.version),$.procType.type]},X+=IY(Q);if($.contentDomain)Q={name:"Content-Domain",values:[$.contentDomain]},X+=IY(Q);if($.dekInfo){if(Q={name:"DEK-Info",values:[$.dekInfo.algorithm]},$.dekInfo.parameters)Q.values.push($.dekInfo.parameters);X+=IY(Q)}if($.headers)for(var Y=0;Y<$.headers.length;++Y)X+=IY($.headers[Y]);if($.procType)X+=`\r
+`;return X+=CY.util.encode64($.body,J.maxline||64)+`\r
 `,X+="-----END "+$.type+`-----\r
-`,X};pG.decode=function($){var J=[],X=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g,Q=/([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/,Y=/\r?\n/,G;while(!0){if(G=X.exec($),!G)break;var W=G[1];if(W==="NEW CERTIFICATE REQUEST")W="CERTIFICATE REQUEST";var U={type:W,procType:null,contentDomain:null,dekInfo:null,headers:[],body:IY.util.decode64(G[3])};if(J.push(U),!G[2])continue;var M=G[2].split(Y),O=0;while(G&&O<M.length){var V=M[O].replace(/\s+$/,"");for(var H=O+1;H<M.length;++H){var q=M[H];if(!/\s/.test(q[0]))break;V+=q,O=H}if(G=V.match(Q),G){var F={name:G[1],values:[]},K=G[2].split(",");for(var A=0;A<K.length;++A)F.values.push(WM(K[A]));if(!U.procType){if(F.name!=="Proc-Type")throw Error('Invalid PEM formatted message. The first encapsulated header must be "Proc-Type".');else if(F.values.length!==2)throw Error('Invalid PEM formatted message. The "Proc-Type" header must have two subfields.');U.procType={version:K[0],type:K[1]}}else if(!U.contentDomain&&F.name==="Content-Domain")U.contentDomain=K[0]||"";else if(!U.dekInfo&&F.name==="DEK-Info"){if(F.values.length===0)throw Error('Invalid PEM formatted message. The "DEK-Info" header must have at least one subfield.');U.dekInfo={algorithm:K[0],parameters:K[1]||null}}else U.headers.push(F)}++O}if(U.procType==="ENCRYPTED"&&!U.dekInfo)throw Error('Invalid PEM formatted message. The "DEK-Info" header must be present if "Proc-Type" is "ENCRYPTED".')}if(J.length===0)throw Error("Invalid PEM formatted message.");return J};function SY($){var J=$.name+": ",X=[],Q=function(M,O){return" "+O};for(var Y=0;Y<$.values.length;++Y)X.push($.values[Y].replace(/^(\S+\r\n)/,Q));J+=X.join(",")+`\r
+`,X};nG.decode=function($){var J=[],X=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g,Q=/([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/,Y=/\r?\n/,G;while(!0){if(G=X.exec($),!G)break;var W=G[1];if(W==="NEW CERTIFICATE REQUEST")W="CERTIFICATE REQUEST";var U={type:W,procType:null,contentDomain:null,dekInfo:null,headers:[],body:CY.util.decode64(G[3])};if(J.push(U),!G[2])continue;var M=G[2].split(Y),O=0;while(G&&O<M.length){var V=M[O].replace(/\s+$/,"");for(var q=O+1;q<M.length;++q){var H=M[q];if(!/\s/.test(H[0]))break;V+=H,O=q}if(G=V.match(Q),G){var N={name:G[1],values:[]},K=G[2].split(",");for(var L=0;L<K.length;++L)N.values.push(HM(K[L]));if(!U.procType){if(N.name!=="Proc-Type")throw Error('Invalid PEM formatted message. The first encapsulated header must be "Proc-Type".');else if(N.values.length!==2)throw Error('Invalid PEM formatted message. The "Proc-Type" header must have two subfields.');U.procType={version:K[0],type:K[1]}}else if(!U.contentDomain&&N.name==="Content-Domain")U.contentDomain=K[0]||"";else if(!U.dekInfo&&N.name==="DEK-Info"){if(N.values.length===0)throw Error('Invalid PEM formatted message. The "DEK-Info" header must have at least one subfield.');U.dekInfo={algorithm:K[0],parameters:K[1]||null}}else U.headers.push(N)}++O}if(U.procType==="ENCRYPTED"&&!U.dekInfo)throw Error('Invalid PEM formatted message. The "DEK-Info" header must be present if "Proc-Type" is "ENCRYPTED".')}if(J.length===0)throw Error("Invalid PEM formatted message.");return J};function IY($){var J=$.name+": ",X=[],Q=function(M,O){return" "+O};for(var Y=0;Y<$.values.length;++Y)X.push($.values[Y].replace(/^(\S+\r\n)/,Q));J+=X.join(",")+`\r
 `;var G=0,W=-1;for(var Y=0;Y<J.length;++Y,++G)if(G>65&&W!==-1){var U=J[W];if(U===",")++W,J=J.substr(0,W)+`\r
  `+J.substr(W);else J=J.substr(0,W)+`\r
-`+U+J.substr(W+1);G=Y-W-1,W=-1,++Y}else if(J[Y]===" "||J[Y]==="\t"||J[Y]===",")W=Y;return J}function WM($){return $.replace(/^\s+/,"")}});var ZX=H$((EF,nG)=>{var o$=F$();LY();r9();_$();nG.exports=o$.des=o$.des||{};o$.des.startEncrypting=function($,J,X,Q){var Y=CY({key:$,output:X,decrypt:!1,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};o$.des.createEncryptionCipher=function($,J){return CY({key:$,output:null,decrypt:!1,mode:J})};o$.des.startDecrypting=function($,J,X,Q){var Y=CY({key:$,output:X,decrypt:!0,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};o$.des.createDecryptionCipher=function($,J){return CY({key:$,output:null,decrypt:!0,mode:J})};o$.des.Algorithm=function($,J){var X=this;X.name=$,X.mode=new J({blockSize:8,cipher:{encrypt:function(Q,Y){return cG(X._keys,Q,Y,!1)},decrypt:function(Q,Y){return cG(X._keys,Q,Y,!0)}}}),X._init=!1};o$.des.Algorithm.prototype.initialize=function($){if(this._init)return;var J=o$.util.createBuffer($.key);if(this.name.indexOf("3DES")===0){if(J.length()!==24)throw Error("Invalid Triple-DES key size: "+J.length()*8)}this._keys=EM(J),this._init=!0};Q0("DES-ECB",o$.cipher.modes.ecb);Q0("DES-CBC",o$.cipher.modes.cbc);Q0("DES-CFB",o$.cipher.modes.cfb);Q0("DES-OFB",o$.cipher.modes.ofb);Q0("DES-CTR",o$.cipher.modes.ctr);Q0("3DES-ECB",o$.cipher.modes.ecb);Q0("3DES-CBC",o$.cipher.modes.cbc);Q0("3DES-CFB",o$.cipher.modes.cfb);Q0("3DES-OFB",o$.cipher.modes.ofb);Q0("3DES-CTR",o$.cipher.modes.ctr);function Q0($,J){var X=function(){return new o$.des.Algorithm($,J)};o$.cipher.registerAlgorithm($,X)}var UM=[16843776,0,65536,16843780,16842756,66564,4,65536,1024,16843776,16843780,1024,16778244,16842756,16777216,4,1028,16778240,16778240,66560,66560,16842752,16842752,16778244,65540,16777220,16777220,65540,0,1028,66564,16777216,65536,16843780,4,16842752,16843776,16777216,16777216,1024,16842756,65536,66560,16777220,1024,4,16778244,66564,16843780,65540,16842752,16778244,16777220,1028,66564,16843776,1028,16778240,16778240,0,65540,66560,0,16842756],MM=[-2146402272,-2147450880,32768,1081376,1048576,32,-2146435040,-2147450848,-2147483616,-2146402272,-2146402304,-2147483648,-2147450880,1048576,32,-2146435040,1081344,1048608,-2147450848,0,-2147483648,32768,1081376,-2146435072,1048608,-2147483616,0,1081344,32800,-2146402304,-2146435072,32800,0,1081376,-2146435040,1048576,-2147450848,-2146435072,-2146402304,32768,-2146435072,-2147450880,32,-2146402272,1081376,32,32768,-2147483648,32800,-2146402304,1048576,-2147483616,1048608,-2147450848,-2147483616,1048608,1081344,0,-2147450880,32800,-2147483648,-2146435040,-2146402272,1081344],OM=[520,134349312,0,134348808,134218240,0,131592,134218240,131080,134217736,134217736,131072,134349320,131080,134348800,520,134217728,8,134349312,512,131584,134348800,134348808,131592,134218248,131584,131072,134218248,8,134349320,512,134217728,134349312,134217728,131080,520,131072,134349312,134218240,0,512,131080,134349320,134218240,134217736,512,0,134348808,134218248,131072,134217728,134349320,8,131592,131584,134217736,134348800,134218248,520,134348800,131592,8,134348808,131584],VM=[8396801,8321,8321,128,8396928,8388737,8388609,8193,0,8396800,8396800,8396929,129,0,8388736,8388609,1,8192,8388608,8396801,128,8388608,8193,8320,8388737,1,8320,8388736,8192,8396928,8396929,129,8388736,8388609,8396800,8396929,129,0,0,8396800,8320,8388736,8388737,1,8396801,8321,8321,128,8396929,129,1,8192,8388609,8193,8396928,8388737,8193,8320,8388608,8396801,128,8388608,8192,8396928],HM=[256,34078976,34078720,1107296512,524288,256,1073741824,34078720,1074266368,524288,33554688,1074266368,1107296512,1107820544,524544,1073741824,33554432,1074266112,1074266112,0,1073742080,1107820800,1107820800,33554688,1107820544,1073742080,0,1107296256,34078976,33554432,1107296256,524544,524288,1107296512,256,33554432,1073741824,34078720,1107296512,1074266368,33554688,1073741824,1107820544,34078976,1074266368,256,33554432,1107820544,1107820800,524544,1107296256,1107820800,34078720,0,1074266112,1107296256,524544,33554688,1073742080,524288,0,1074266112,34078976,1073742080],qM=[536870928,541065216,16384,541081616,541065216,16,541081616,4194304,536887296,4210704,4194304,536870928,4194320,536887296,536870912,16400,0,4194320,536887312,16384,4210688,536887312,16,541065232,541065232,0,4210704,541081600,16400,4210688,541081600,536870912,536887296,16,541065232,4210688,541081616,4194304,16400,536870928,4194304,536887296,536870912,16400,536870928,541081616,4210688,541065216,4210704,541081600,0,541065232,16,16384,541065216,4210704,16384,4194320,536887312,0,541081600,536870912,4194320,536887312],KM=[2097152,69206018,67110914,0,2048,67110914,2099202,69208064,69208066,2097152,0,67108866,2,67108864,69206018,2050,67110912,2099202,2097154,67110912,67108866,69206016,69208064,2097154,69206016,2048,2050,69208066,2099200,2,67108864,2099200,67108864,2099200,2097152,67110914,67110914,69206018,69206018,2,2097154,67108864,67110912,2097152,69208064,2050,2099202,69208064,2050,67108866,69208066,69206016,2099200,0,2,69208066,0,2099202,69206016,2048,67108866,67110912,2048,2097154],zM=[268439616,4096,262144,268701760,268435456,268439616,64,268435456,262208,268697600,268701760,266240,268701696,266304,4096,64,268697600,268435520,268439552,4160,266240,262208,268697664,268701696,4160,0,0,268697664,268435520,268439552,266304,262144,266304,262144,268701696,4096,64,268697664,4096,266304,268439552,64,268435520,268697600,268697664,268435456,262144,268439616,0,268701760,262208,268435520,268697600,268439552,268439616,0,268701760,266240,266240,4160,4160,262208,268435456,268701696];function EM($){var J=[0,4,536870912,536870916,65536,65540,536936448,536936452,512,516,536871424,536871428,66048,66052,536936960,536936964],X=[0,1,1048576,1048577,67108864,67108865,68157440,68157441,256,257,1048832,1048833,67109120,67109121,68157696,68157697],Q=[0,8,2048,2056,16777216,16777224,16779264,16779272,0,8,2048,2056,16777216,16777224,16779264,16779272],Y=[0,2097152,134217728,136314880,8192,2105344,134225920,136323072,131072,2228224,134348800,136445952,139264,2236416,134356992,136454144],G=[0,262144,16,262160,0,262144,16,262160,4096,266240,4112,266256,4096,266240,4112,266256],W=[0,1024,32,1056,0,1024,32,1056,33554432,33555456,33554464,33555488,33554432,33555456,33554464,33555488],U=[0,268435456,524288,268959744,2,268435458,524290,268959746,0,268435456,524288,268959744,2,268435458,524290,268959746],M=[0,65536,2048,67584,536870912,536936448,536872960,536938496,131072,196608,133120,198656,537001984,537067520,537004032,537069568],O=[0,262144,0,262144,2,262146,2,262146,33554432,33816576,33554432,33816576,33554434,33816578,33554434,33816578],V=[0,268435456,8,268435464,0,268435456,8,268435464,1024,268436480,1032,268436488,1024,268436480,1032,268436488],H=[0,32,0,32,1048576,1048608,1048576,1048608,8192,8224,8192,8224,1056768,1056800,1056768,1056800],q=[0,16777216,512,16777728,2097152,18874368,2097664,18874880,67108864,83886080,67109376,83886592,69206016,85983232,69206528,85983744],F=[0,4096,134217728,134221824,524288,528384,134742016,134746112,16,4112,134217744,134221840,524304,528400,134742032,134746128],K=[0,4,256,260,0,4,256,260,1,5,257,261,1,5,257,261],A=$.length()>8?3:1,L=[],R=[0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0],I=0,j;for(var C=0;C<A;C++){var w=$.getInt32(),P=$.getInt32();j=(w>>>4^P)&252645135,P^=j,w^=j<<4,j=(P>>>-16^w)&65535,w^=j,P^=j<<-16,j=(w>>>2^P)&858993459,P^=j,w^=j<<2,j=(P>>>-16^w)&65535,w^=j,P^=j<<-16,j=(w>>>1^P)&1431655765,P^=j,w^=j<<1,j=(P>>>8^w)&16711935,w^=j,P^=j<<8,j=(w>>>1^P)&1431655765,P^=j,w^=j<<1,j=w<<8|P>>>20&240,w=P<<24|P<<8&16711680|P>>>8&65280|P>>>24&240,P=j;for(var l=0;l<R.length;++l){if(R[l])w=w<<2|w>>>26,P=P<<2|P>>>26;else w=w<<1|w>>>27,P=P<<1|P>>>27;w&=-15,P&=-15;var e=J[w>>>28]|X[w>>>24&15]|Q[w>>>20&15]|Y[w>>>16&15]|G[w>>>12&15]|W[w>>>8&15]|U[w>>>4&15],y=M[P>>>28]|O[P>>>24&15]|V[P>>>20&15]|H[P>>>16&15]|q[P>>>12&15]|F[P>>>8&15]|K[P>>>4&15];j=(y>>>16^e)&65535,L[I++]=e^j,L[I++]=y^j<<16}}return L}function cG($,J,X,Q){var Y=$.length===32?3:9,G;if(Y===3)G=Q?[30,-2,-2]:[0,32,2];else G=Q?[94,62,-2,32,64,2,30,-2,-2]:[0,32,2,62,30,-2,64,96,2];var W,U=J[0],M=J[1];W=(U>>>4^M)&252645135,M^=W,U^=W<<4,W=(U>>>16^M)&65535,M^=W,U^=W<<16,W=(M>>>2^U)&858993459,U^=W,M^=W<<2,W=(M>>>8^U)&16711935,U^=W,M^=W<<8,W=(U>>>1^M)&1431655765,M^=W,U^=W<<1,U=U<<1|U>>>31,M=M<<1|M>>>31;for(var O=0;O<Y;O+=3){var V=G[O+1],H=G[O+2];for(var q=G[O];q!=V;q+=H){var F=M^$[q],K=(M>>>4|M<<28)^$[q+1];W=U,U=M,M=W^(MM[F>>>24&63]|VM[F>>>16&63]|qM[F>>>8&63]|zM[F&63]|UM[K>>>24&63]|OM[K>>>16&63]|HM[K>>>8&63]|KM[K&63])}W=U,U=M,M=W}U=U>>>1|U<<31,M=M>>>1|M<<31,W=(U>>>1^M)&1431655765,M^=W,U^=W<<1,W=(M>>>8^U)&16711935,U^=W,M^=W<<8,W=(M>>>2^U)&858993459,U^=W,M^=W<<2,W=(U>>>16^M)&65535,M^=W,U^=W<<16,W=(U>>>4^M)&252645135,M^=W,U^=W<<4,X[0]=U,X[1]=M}function CY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="DES-"+J,Q;if($.decrypt)Q=o$.cipher.createDecipher(X,$.key);else Q=o$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var U=null;if(W instanceof o$.util.ByteBuffer)U=W,W={};W=W||{},W.output=U,W.iv=G,Y.call(Q,W)},Q}});var wY=H$((FF,iG)=>{var AJ=F$();TQ();$0();_$();var FM=AJ.pkcs5=AJ.pkcs5||{},L0;if(AJ.util.isNodejs&&!AJ.options.usePureJavaScript)L0=qX("crypto");iG.exports=AJ.pbkdf2=FM.pbkdf2=function($,J,X,Q,Y,G){if(typeof Y==="function")G=Y,Y=null;if(AJ.util.isNodejs&&!AJ.options.usePureJavaScript&&L0.pbkdf2&&(Y===null||typeof Y!=="object")&&(L0.pbkdf2Sync.length>4||(!Y||Y==="sha1"))){if(typeof Y!=="string")Y="sha1";if($=Buffer.from($,"binary"),J=Buffer.from(J,"binary"),!G){if(L0.pbkdf2Sync.length===4)return L0.pbkdf2Sync($,J,X,Q).toString("binary");return L0.pbkdf2Sync($,J,X,Q,Y).toString("binary")}if(L0.pbkdf2Sync.length===4)return L0.pbkdf2($,J,X,Q,function(j,C){if(j)return G(j);G(null,C.toString("binary"))});return L0.pbkdf2($,J,X,Q,Y,function(j,C){if(j)return G(j);G(null,C.toString("binary"))})}if(typeof Y>"u"||Y===null)Y="sha1";if(typeof Y==="string"){if(!(Y in AJ.md.algorithms))throw Error("Unknown hash algorithm: "+Y);Y=AJ.md[Y].create()}var W=Y.digestLength;if(Q>4294967295*W){var U=Error("Derived key is too long.");if(G)return G(U);throw U}var M=Math.ceil(Q/W),O=Q-(M-1)*W,V=AJ.hmac.create();V.start(Y,$);var H="",q,F,K;if(!G){for(var A=1;A<=M;++A){V.start(null,null),V.update(J),V.update(AJ.util.int32ToBytes(A)),q=K=V.digest().getBytes();for(var L=2;L<=X;++L)V.start(null,null),V.update(K),F=V.digest().getBytes(),q=AJ.util.xorBytes(q,F,W),K=F;H+=A<M?q:q.substr(0,O)}return H}var A=1,L;function R(){if(A>M)return G(null,H);V.start(null,null),V.update(J),V.update(AJ.util.int32ToBytes(A)),q=K=V.digest().getBytes(),L=2,I()}function I(){if(L<=X)return V.start(null,null),V.update(K),F=V.digest().getBytes(),q=AJ.util.xorBytes(q,F,W),K=F,++L,AJ.util.setImmediate(I);H+=A<M?q:q.substr(0,O),++A,R()}R()}});var Y8=H$((NF,tG)=>{var X0=F$();$0();_$();var aG=tG.exports=X0.sha256=X0.sha256||{};X0.md.sha256=X0.md.algorithms.sha256=aG;aG.create=function(){if(!sG)NM();var $=null,J=X0.util.createBuffer(),X=Array(64),Q={algorithm:"sha256",blockLength:64,digestLength:32,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=X0.util.createBuffer(),$={h0:1779033703,h1:3144134277,h2:1013904242,h3:2773480762,h4:1359893119,h5:2600822924,h6:528734635,h7:1541459225},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=X0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),oG($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=X0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(X8.substr(0,Q.blockLength-W));var U,M,O=Q.fullMessageLength[0]*8;for(var V=0;V<Q.fullMessageLength.length-1;++V)U=Q.fullMessageLength[V+1]*8,M=U/4294967296>>>0,O+=M,Y.putInt32(O>>>0),O=U>>>0;Y.putInt32(O);var H={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4,h5:$.h5,h6:$.h6,h7:$.h7};oG(H,X,Y);var q=X0.util.createBuffer();return q.putInt32(H.h0),q.putInt32(H.h1),q.putInt32(H.h2),q.putInt32(H.h3),q.putInt32(H.h4),q.putInt32(H.h5),q.putInt32(H.h6),q.putInt32(H.h7),q},Q};var X8=null,sG=!1,rG=null;function NM(){X8=String.fromCharCode(128),X8+=X0.util.fillString(String.fromCharCode(0),64),rG=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],sG=!0}function oG($,J,X){var Q,Y,G,W,U,M,O,V,H,q,F,K,A,L,R,I=X.length();while(I>=64){for(O=0;O<16;++O)J[O]=X.getInt32();for(;O<64;++O)Q=J[O-2],Q=(Q>>>17|Q<<15)^(Q>>>19|Q<<13)^Q>>>10,Y=J[O-15],Y=(Y>>>7|Y<<25)^(Y>>>18|Y<<14)^Y>>>3,J[O]=Q+J[O-7]+Y+J[O-16]|0;V=$.h0,H=$.h1,q=$.h2,F=$.h3,K=$.h4,A=$.h5,L=$.h6,R=$.h7;for(O=0;O<64;++O)W=(K>>>6|K<<26)^(K>>>11|K<<21)^(K>>>25|K<<7),U=L^K&(A^L),G=(V>>>2|V<<30)^(V>>>13|V<<19)^(V>>>22|V<<10),M=V&H|q&(V^H),Q=R+W+U+rG[O]+J[O],Y=G+M,R=L,L=A,A=K,K=F+Q>>>0,F=q,q=H,H=V,V=Q+Y>>>0;$.h0=$.h0+V|0,$.h1=$.h1+H|0,$.h2=$.h2+q|0,$.h3=$.h3+F|0,$.h4=$.h4+K|0,$.h5=$.h5+A|0,$.h6=$.h6+L|0,$.h7=$.h7+R|0,I-=64}}});var G8=H$((LF,eG)=>{var Y0=F$();_$();var PY=null;if(Y0.util.isNodejs&&!Y0.options.usePureJavaScript&&!process.versions["node-webkit"])PY=qX("crypto");var LM=eG.exports=Y0.prng=Y0.prng||{};LM.create=function($){var J={plugin:$,key:null,seed:null,time:null,reseeds:0,generated:0,keyBytes:""},X=$.md,Q=Array(32);for(var Y=0;Y<32;++Y)Q[Y]=X.create();J.pools=Q,J.pool=0,J.generate=function(O,V){if(!V)return J.generateSync(O);var H=J.plugin.cipher,q=J.plugin.increment,F=J.plugin.formatKey,K=J.plugin.formatSeed,A=Y0.util.createBuffer();J.key=null,L();function L(R){if(R)return V(R);if(A.length()>=O)return V(null,A.getBytes(O));if(J.generated>1048575)J.key=null;if(J.key===null)return Y0.util.nextTick(function(){G(L)});var I=H(J.key,J.seed);J.generated+=I.length,A.putBytes(I),J.key=F(H(J.key,q(J.seed))),J.seed=K(H(J.key,J.seed)),Y0.util.setImmediate(L)}},J.generateSync=function(O){var V=J.plugin.cipher,H=J.plugin.increment,q=J.plugin.formatKey,F=J.plugin.formatSeed;J.key=null;var K=Y0.util.createBuffer();while(K.length()<O){if(J.generated>1048575)J.key=null;if(J.key===null)W();var A=V(J.key,J.seed);J.generated+=A.length,K.putBytes(A),J.key=q(V(J.key,H(J.seed))),J.seed=F(V(J.key,J.seed))}return K.getBytes(O)};function G(O){if(J.pools[0].messageLength>=32)return U(),O();var V=32-J.pools[0].messageLength<<5;J.seedFile(V,function(H,q){if(H)return O(H);J.collect(q),U(),O()})}function W(){if(J.pools[0].messageLength>=32)return U();var O=32-J.pools[0].messageLength<<5;J.collect(J.seedFileSync(O)),U()}function U(){J.reseeds=J.reseeds===4294967295?0:J.reseeds+1;var O=J.plugin.md.create();O.update(J.keyBytes);var V=1;for(var H=0;H<32;++H){if(J.reseeds%V===0)O.update(J.pools[H].digest().getBytes()),J.pools[H].start();V=V<<1}J.keyBytes=O.digest().getBytes(),O.start(),O.update(J.keyBytes);var q=O.digest().getBytes();J.key=J.plugin.formatKey(J.keyBytes),J.seed=J.plugin.formatSeed(q),J.generated=0}function M(O){var V=null,H=Y0.util.globalScope,q=H.crypto||H.msCrypto;if(q&&q.getRandomValues)V=function(w){return q.getRandomValues(w)};var F=Y0.util.createBuffer();if(V)while(F.length()<O){var K=Math.max(1,Math.min(O-F.length(),65536)/4),A=new Uint32Array(Math.floor(K));try{V(A);for(var L=0;L<A.length;++L)F.putInt32(A[L])}catch(w){if(!(typeof QuotaExceededError<"u"&&w instanceof QuotaExceededError))throw w}}if(F.length()<O){var R,I,j,C=Math.floor(Math.random()*65536);while(F.length()<O){I=16807*(C&65535),R=16807*(C>>16),I+=(R&32767)<<16,I+=R>>15,I=(I&2147483647)+(I>>31),C=I&4294967295;for(var L=0;L<3;++L)j=C>>>(L<<3),j^=Math.floor(Math.random()*256),F.putByte(j&255)}}return F.getBytes(O)}if(PY)J.seedFile=function(O,V){PY.randomBytes(O,function(H,q){if(H)return V(H);V(null,q.toString())})},J.seedFileSync=function(O){return PY.randomBytes(O).toString()};else J.seedFile=function(O,V){try{V(null,M(O))}catch(H){V(H)}},J.seedFileSync=M;return J.collect=function(O){var V=O.length;for(var H=0;H<V;++H)J.pools[J.pool].update(O.substr(H,1)),J.pool=J.pool===31?0:J.pool+1},J.collectInt=function(O,V){var H="";for(var q=0;q<V;q+=8)H+=String.fromCharCode(O>>q&255);J.collect(H)},J.registerWorker=function(O){if(O===self)J.seedFile=function(H,q){function F(K){var A=K.data;if(A.forge&&A.forge.prng)self.removeEventListener("message",F),q(A.forge.prng.err,A.forge.prng.bytes)}self.addEventListener("message",F),self.postMessage({forge:{prng:{needed:H}}})};else{var V=function(H){var q=H.data;if(q.forge&&q.forge.prng)J.seedFile(q.forge.prng.needed,function(F,K){O.postMessage({forge:{prng:{err:F,bytes:K}}})})};O.addEventListener("message",V)}},J}});var _J=H$((AF,W8)=>{var VJ=F$();P0();Y8();G8();_$();(function(){if(VJ.random&&VJ.random.getBytes){W8.exports=VJ.random;return}(function($){var J={},X=[,,,,],Q=VJ.util.createBuffer();J.formatKey=function(H){var q=VJ.util.createBuffer(H);return H=[,,,,],H[0]=q.getInt32(),H[1]=q.getInt32(),H[2]=q.getInt32(),H[3]=q.getInt32(),VJ.aes._expandKey(H,!1)},J.formatSeed=function(H){var q=VJ.util.createBuffer(H);return H=[,,,,],H[0]=q.getInt32(),H[1]=q.getInt32(),H[2]=q.getInt32(),H[3]=q.getInt32(),H},J.cipher=function(H,q){return VJ.aes._updateBlock(H,q,X,!1),Q.putInt32(X[0]),Q.putInt32(X[1]),Q.putInt32(X[2]),Q.putInt32(X[3]),Q.getBytes()},J.increment=function(H){return++H[3],H},J.md=VJ.md.sha256;function Y(){var H=VJ.prng.create(J);return H.getBytes=function(q,F){return H.generate(q,F)},H.getBytesSync=function(q){return H.generate(q)},H}var G=Y(),W=null,U=VJ.util.globalScope,M=U.crypto||U.msCrypto;if(M&&M.getRandomValues)W=function(H){return M.getRandomValues(H)};if(VJ.options.usePureJavaScript||!VJ.util.isNodejs&&!W){if(typeof window>"u"||window.document===void 0);if(G.collectInt(+new Date,32),typeof navigator<"u"){var O="";for(var V in navigator)try{if(typeof navigator[V]=="string")O+=navigator[V]}catch(H){}G.collect(O),O=null}if($)$().mousemove(function(H){G.collectInt(H.clientX,16),G.collectInt(H.clientY,16)}),$().keypress(function(H){G.collectInt(H.charCode,8)})}if(!VJ.random)VJ.random=G;else for(var V in G)VJ.random[V]=G[V];VJ.random.createInstance=Y,W8.exports=VJ.random})(typeof jQuery<"u"?jQuery:null)})()});var M8=H$((RF,Q1)=>{var ZJ=F$();_$();var U8=[217,120,249,196,25,221,181,237,40,233,253,121,74,160,216,157,198,126,55,131,43,118,83,142,98,76,100,136,68,139,251,162,23,154,89,245,135,179,79,19,97,69,109,141,9,129,125,50,189,143,64,235,134,183,123,11,240,149,33,34,92,107,78,130,84,214,101,147,206,96,178,28,115,86,192,20,167,140,241,220,18,117,202,31,59,190,228,209,66,61,212,48,163,60,182,38,111,191,14,218,70,105,7,87,39,242,29,155,188,148,67,3,248,17,199,246,144,239,62,231,6,195,213,47,200,102,30,215,8,232,234,222,128,82,238,247,132,170,114,172,53,77,106,42,150,26,210,113,90,21,73,116,75,159,208,94,4,24,164,236,194,224,65,110,15,81,203,204,36,145,175,80,161,244,112,57,153,124,58,133,35,184,180,122,252,2,54,91,37,85,151,49,45,93,250,152,227,138,146,174,5,223,41,16,103,108,186,201,211,0,230,207,225,158,168,44,99,22,1,63,88,226,137,169,13,56,52,27,171,51,255,176,187,72,12,95,185,177,205,46,197,243,219,71,229,165,156,119,10,166,32,104,254,127,193,173],$1=[1,2,3,5],AM=function($,J){return $<<J&65535|($&65535)>>16-J},RM=function($,J){return($&65535)>>J|$<<16-J&65535};Q1.exports=ZJ.rc2=ZJ.rc2||{};ZJ.rc2.expandKey=function($,J){if(typeof $==="string")$=ZJ.util.createBuffer($);J=J||128;var X=$,Q=$.length(),Y=J,G=Math.ceil(Y/8),W=255>>(Y&7),U;for(U=Q;U<128;U++)X.putByte(U8[X.at(U-1)+X.at(U-Q)&255]);X.setAt(128-G,U8[X.at(128-G)&W]);for(U=127-G;U>=0;U--)X.setAt(U,U8[X.at(U+1)^X.at(U+G)]);return X};var J1=function($,J,X){var Q=!1,Y=null,G=null,W=null,U,M,O,V,H=[];$=ZJ.rc2.expandKey($,J);for(O=0;O<64;O++)H.push($.getInt16Le());if(X)U=function(K){for(O=0;O<4;O++)K[O]+=H[V]+(K[(O+3)%4]&K[(O+2)%4])+(~K[(O+3)%4]&K[(O+1)%4]),K[O]=AM(K[O],$1[O]),V++},M=function(K){for(O=0;O<4;O++)K[O]+=H[K[(O+3)%4]&63]};else U=function(K){for(O=3;O>=0;O--)K[O]=RM(K[O],$1[O]),K[O]-=H[V]+(K[(O+3)%4]&K[(O+2)%4])+(~K[(O+3)%4]&K[(O+1)%4]),V--},M=function(K){for(O=3;O>=0;O--)K[O]-=H[K[(O+3)%4]&63]};var q=function(K){var A=[];for(O=0;O<4;O++){var L=Y.getInt16Le();if(W!==null)if(X)L^=W.getInt16Le();else W.putInt16Le(L);A.push(L&65535)}V=X?0:63;for(var R=0;R<K.length;R++)for(var I=0;I<K[R][0];I++)K[R][1](A);for(O=0;O<4;O++){if(W!==null)if(X)W.putInt16Le(A[O]);else A[O]^=W.getInt16Le();G.putInt16Le(A[O])}},F=null;return F={start:function(K,A){if(K){if(typeof K==="string")K=ZJ.util.createBuffer(K)}Q=!1,Y=ZJ.util.createBuffer(),G=A||new ZJ.util.createBuffer,W=K,F.output=G},update:function(K){if(!Q)Y.putBuffer(K);while(Y.length()>=8)q([[5,U],[1,M],[6,U],[1,M],[5,U]])},finish:function(K){var A=!0;if(X)if(K)A=K(8,Y,!X);else{var L=Y.length()===8?8:8-Y.length();Y.fillWithByte(L,L)}if(A)Q=!0,F.update();if(!X){if(A=Y.length()===0,A)if(K)A=K(8,G,!X);else{var R=G.length(),I=G.at(R-1);if(I>R)A=!1;else G.truncate(I)}}return A}},F};ZJ.rc2.startEncrypting=function($,J,X){var Q=ZJ.rc2.createEncryptionCipher($,128);return Q.start(J,X),Q};ZJ.rc2.createEncryptionCipher=function($,J){return J1($,J,!0)};ZJ.rc2.startDecrypting=function($,J,X){var Q=ZJ.rc2.createDecryptionCipher($,128);return Q.start(J,X),Q};ZJ.rc2.createDecryptionCipher=function($,J){return J1($,J,!1)}});var jX=H$((DF,V1)=>{var O8=F$();V1.exports=O8.jsbn=O8.jsbn||{};var A0,DM=244837814094590,X1=(DM&16777215)==15715070;function v($,J,X){if(this.data=[],$!=null)if(typeof $=="number")this.fromNumber($,J,X);else if(J==null&&typeof $!="string")this.fromString($,256);else this.fromString($,J)}O8.jsbn.BigInteger=v;function C$(){return new v(null)}function ZM($,J,X,Q,Y,G){while(--G>=0){var W=J*this.data[$++]+X.data[Q]+Y;Y=Math.floor(W/67108864),X.data[Q++]=W&67108863}return Y}function BM($,J,X,Q,Y,G){var W=J&32767,U=J>>15;while(--G>=0){var M=this.data[$]&32767,O=this.data[$++]>>15,V=U*M+O*W;M=W*M+((V&32767)<<15)+X.data[Q]+(Y&1073741823),Y=(M>>>30)+(V>>>15)+U*O+(Y>>>30),X.data[Q++]=M&1073741823}return Y}function Y1($,J,X,Q,Y,G){var W=J&16383,U=J>>14;while(--G>=0){var M=this.data[$]&16383,O=this.data[$++]>>14,V=U*M+O*W;M=W*M+((V&16383)<<14)+X.data[Q]+Y,Y=(M>>28)+(V>>14)+U*O,X.data[Q++]=M&268435455}return Y}if(typeof navigator>"u")v.prototype.am=Y1,A0=28;else if(X1&&navigator.appName=="Microsoft Internet Explorer")v.prototype.am=BM,A0=30;else if(X1&&navigator.appName!="Netscape")v.prototype.am=ZM,A0=26;else v.prototype.am=Y1,A0=28;v.prototype.DB=A0;v.prototype.DM=(1<<A0)-1;v.prototype.DV=1<<A0;var V8=52;v.prototype.FV=Math.pow(2,V8);v.prototype.F1=V8-A0;v.prototype.F2=2*A0-V8;var jM="0123456789abcdefghijklmnopqrstuvwxyz",_Y=[],IQ,xJ;IQ=48;for(xJ=0;xJ<=9;++xJ)_Y[IQ++]=xJ;IQ=97;for(xJ=10;xJ<36;++xJ)_Y[IQ++]=xJ;IQ=65;for(xJ=10;xJ<36;++xJ)_Y[IQ++]=xJ;function G1($){return jM.charAt($)}function W1($,J){var X=_Y[$.charCodeAt(J)];return X==null?-1:X}function TM($){for(var J=this.t-1;J>=0;--J)$.data[J]=this.data[J];$.t=this.t,$.s=this.s}function SM($){if(this.t=1,this.s=$<0?-1:0,$>0)this.data[0]=$;else if($<-1)this.data[0]=$+this.DV;else this.t=0}function x0($){var J=C$();return J.fromInt($),J}function IM($,J){var X;if(J==16)X=4;else if(J==8)X=3;else if(J==256)X=8;else if(J==2)X=1;else if(J==32)X=5;else if(J==4)X=2;else{this.fromRadix($,J);return}this.t=0,this.s=0;var Q=$.length,Y=!1,G=0;while(--Q>=0){var W=X==8?$[Q]&255:W1($,Q);if(W<0){if($.charAt(Q)=="-")Y=!0;continue}if(Y=!1,G==0)this.data[this.t++]=W;else if(G+X>this.DB)this.data[this.t-1]|=(W&(1<<this.DB-G)-1)<<G,this.data[this.t++]=W>>this.DB-G;else this.data[this.t-1]|=W<<G;if(G+=X,G>=this.DB)G-=this.DB}if(X==8&&($[0]&128)!=0){if(this.s=-1,G>0)this.data[this.t-1]|=(1<<this.DB-G)-1<<G}if(this.clamp(),Y)v.ZERO.subTo(this,this)}function CM(){var $=this.s&this.DM;while(this.t>0&&this.data[this.t-1]==$)--this.t}function wM($){if(this.s<0)return"-"+this.negate().toString($);var J;if($==16)J=4;else if($==8)J=3;else if($==2)J=1;else if($==32)J=5;else if($==4)J=2;else return this.toRadix($);var X=(1<<J)-1,Q,Y=!1,G="",W=this.t,U=this.DB-W*this.DB%J;if(W-- >0){if(U<this.DB&&(Q=this.data[W]>>U)>0)Y=!0,G=G1(Q);while(W>=0){if(U<J)Q=(this.data[W]&(1<<U)-1)<<J-U,Q|=this.data[--W]>>(U+=this.DB-J);else if(Q=this.data[W]>>(U-=J)&X,U<=0)U+=this.DB,--W;if(Q>0)Y=!0;if(Y)G+=G1(Q)}}return Y?G:"0"}function PM(){var $=C$();return v.ZERO.subTo(this,$),$}function _M(){return this.s<0?this.negate():this}function xM($){var J=this.s-$.s;if(J!=0)return J;var X=this.t;if(J=X-$.t,J!=0)return this.s<0?-J:J;while(--X>=0)if((J=this.data[X]-$.data[X])!=0)return J;return 0}function xY($){var J=1,X;if((X=$>>>16)!=0)$=X,J+=16;if((X=$>>8)!=0)$=X,J+=8;if((X=$>>4)!=0)$=X,J+=4;if((X=$>>2)!=0)$=X,J+=2;if((X=$>>1)!=0)$=X,J+=1;return J}function vM(){if(this.t<=0)return 0;return this.DB*(this.t-1)+xY(this.data[this.t-1]^this.s&this.DM)}function kM($,J){var X;for(X=this.t-1;X>=0;--X)J.data[X+$]=this.data[X];for(X=$-1;X>=0;--X)J.data[X]=0;J.t=this.t+$,J.s=this.s}function fM($,J){for(var X=$;X<this.t;++X)J.data[X-$]=this.data[X];J.t=Math.max(this.t-$,0),J.s=this.s}function yM($,J){var X=$%this.DB,Q=this.DB-X,Y=(1<<Q)-1,G=Math.floor($/this.DB),W=this.s<<X&this.DM,U;for(U=this.t-1;U>=0;--U)J.data[U+G+1]=this.data[U]>>Q|W,W=(this.data[U]&Y)<<X;for(U=G-1;U>=0;--U)J.data[U]=0;J.data[G]=W,J.t=this.t+G+1,J.s=this.s,J.clamp()}function bM($,J){J.s=this.s;var X=Math.floor($/this.DB);if(X>=this.t){J.t=0;return}var Q=$%this.DB,Y=this.DB-Q,G=(1<<Q)-1;J.data[0]=this.data[X]>>Q;for(var W=X+1;W<this.t;++W)J.data[W-X-1]|=(this.data[W]&G)<<Y,J.data[W-X]=this.data[W]>>Q;if(Q>0)J.data[this.t-X-1]|=(this.s&G)<<Y;J.t=this.t-X,J.clamp()}function hM($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]-$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q-=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q-=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q-=$.s}if(J.s=Q<0?-1:0,Q<-1)J.data[X++]=this.DV+Q;else if(Q>0)J.data[X++]=Q;J.t=X,J.clamp()}function uM($,J){var X=this.abs(),Q=$.abs(),Y=X.t;J.t=Y+Q.t;while(--Y>=0)J.data[Y]=0;for(Y=0;Y<Q.t;++Y)J.data[Y+X.t]=X.am(0,Q.data[Y],J,Y,0,X.t);if(J.s=0,J.clamp(),this.s!=$.s)v.ZERO.subTo(J,J)}function gM($){var J=this.abs(),X=$.t=2*J.t;while(--X>=0)$.data[X]=0;for(X=0;X<J.t-1;++X){var Q=J.am(X,J.data[X],$,2*X,0,1);if(($.data[X+J.t]+=J.am(X+1,2*J.data[X],$,2*X+1,Q,J.t-X-1))>=J.DV)$.data[X+J.t]-=J.DV,$.data[X+J.t+1]=1}if($.t>0)$.data[$.t-1]+=J.am(X,J.data[X],$,2*X,0,1);$.s=0,$.clamp()}function mM($,J,X){var Q=$.abs();if(Q.t<=0)return;var Y=this.abs();if(Y.t<Q.t){if(J!=null)J.fromInt(0);if(X!=null)this.copyTo(X);return}if(X==null)X=C$();var G=C$(),W=this.s,U=$.s,M=this.DB-xY(Q.data[Q.t-1]);if(M>0)Q.lShiftTo(M,G),Y.lShiftTo(M,X);else Q.copyTo(G),Y.copyTo(X);var O=G.t,V=G.data[O-1];if(V==0)return;var H=V*(1<<this.F1)+(O>1?G.data[O-2]>>this.F2:0),q=this.FV/H,F=(1<<this.F1)/H,K=1<<this.F2,A=X.t,L=A-O,R=J==null?C$():J;if(G.dlShiftTo(L,R),X.compareTo(R)>=0)X.data[X.t++]=1,X.subTo(R,X);v.ONE.dlShiftTo(O,R),R.subTo(G,G);while(G.t<O)G.data[G.t++]=0;while(--L>=0){var I=X.data[--A]==V?this.DM:Math.floor(X.data[A]*q+(X.data[A-1]+K)*F);if((X.data[A]+=G.am(0,I,X,L,0,O))<I){G.dlShiftTo(L,R),X.subTo(R,X);while(X.data[A]<--I)X.subTo(R,X)}}if(J!=null){if(X.drShiftTo(O,J),W!=U)v.ZERO.subTo(J,J)}if(X.t=O,X.clamp(),M>0)X.rShiftTo(M,X);if(W<0)v.ZERO.subTo(X,X)}function lM($){var J=C$();if(this.abs().divRemTo($,null,J),this.s<0&&J.compareTo(v.ZERO)>0)$.subTo(J,J);return J}function XQ($){this.m=$}function pM($){if($.s<0||$.compareTo(this.m)>=0)return $.mod(this.m);else return $}function dM($){return $}function cM($){$.divRemTo(this.m,null,$)}function nM($,J,X){$.multiplyTo(J,X),this.reduce(X)}function iM($,J){$.squareTo(J),this.reduce(J)}XQ.prototype.convert=pM;XQ.prototype.revert=dM;XQ.prototype.reduce=cM;XQ.prototype.mulTo=nM;XQ.prototype.sqrTo=iM;function oM(){if(this.t<1)return 0;var $=this.data[0];if(($&1)==0)return 0;var J=$&3;return J=J*(2-($&15)*J)&15,J=J*(2-($&255)*J)&255,J=J*(2-(($&65535)*J&65535))&65535,J=J*(2-$*J%this.DV)%this.DV,J>0?this.DV-J:-J}function YQ($){this.m=$,this.mp=$.invDigit(),this.mpl=this.mp&32767,this.mph=this.mp>>15,this.um=(1<<$.DB-15)-1,this.mt2=2*$.t}function aM($){var J=C$();if($.abs().dlShiftTo(this.m.t,J),J.divRemTo(this.m,null,J),$.s<0&&J.compareTo(v.ZERO)>0)this.m.subTo(J,J);return J}function sM($){var J=C$();return $.copyTo(J),this.reduce(J),J}function rM($){while($.t<=this.mt2)$.data[$.t++]=0;for(var J=0;J<this.m.t;++J){var X=$.data[J]&32767,Q=X*this.mpl+((X*this.mph+($.data[J]>>15)*this.mpl&this.um)<<15)&$.DM;X=J+this.m.t,$.data[X]+=this.m.am(0,Q,$,J,0,this.m.t);while($.data[X]>=$.DV)$.data[X]-=$.DV,$.data[++X]++}if($.clamp(),$.drShiftTo(this.m.t,$),$.compareTo(this.m)>=0)$.subTo(this.m,$)}function tM($,J){$.squareTo(J),this.reduce(J)}function eM($,J,X){$.multiplyTo(J,X),this.reduce(X)}YQ.prototype.convert=aM;YQ.prototype.revert=sM;YQ.prototype.reduce=rM;YQ.prototype.mulTo=eM;YQ.prototype.sqrTo=tM;function $O(){return(this.t>0?this.data[0]&1:this.s)==0}function JO($,J){if($>4294967295||$<1)return v.ONE;var X=C$(),Q=C$(),Y=J.convert(this),G=xY($)-1;Y.copyTo(X);while(--G>=0)if(J.sqrTo(X,Q),($&1<<G)>0)J.mulTo(Q,Y,X);else{var W=X;X=Q,Q=W}return J.revert(X)}function QO($,J){var X;if($<256||J.isEven())X=new XQ(J);else X=new YQ(J);return this.exp($,X)}v.prototype.copyTo=TM;v.prototype.fromInt=SM;v.prototype.fromString=IM;v.prototype.clamp=CM;v.prototype.dlShiftTo=kM;v.prototype.drShiftTo=fM;v.prototype.lShiftTo=yM;v.prototype.rShiftTo=bM;v.prototype.subTo=hM;v.prototype.multiplyTo=uM;v.prototype.squareTo=gM;v.prototype.divRemTo=mM;v.prototype.invDigit=oM;v.prototype.isEven=$O;v.prototype.exp=JO;v.prototype.toString=wM;v.prototype.negate=PM;v.prototype.abs=_M;v.prototype.compareTo=xM;v.prototype.bitLength=vM;v.prototype.mod=lM;v.prototype.modPowInt=QO;v.ZERO=x0(0);v.ONE=x0(1);function XO(){var $=C$();return this.copyTo($),$}function YO(){if(this.s<0){if(this.t==1)return this.data[0]-this.DV;else if(this.t==0)return-1}else if(this.t==1)return this.data[0];else if(this.t==0)return 0;return(this.data[1]&(1<<32-this.DB)-1)<<this.DB|this.data[0]}function GO(){return this.t==0?this.s:this.data[0]<<24>>24}function WO(){return this.t==0?this.s:this.data[0]<<16>>16}function UO($){return Math.floor(Math.LN2*this.DB/Math.log($))}function MO(){if(this.s<0)return-1;else if(this.t<=0||this.t==1&&this.data[0]<=0)return 0;else return 1}function OO($){if($==null)$=10;if(this.signum()==0||$<2||$>36)return"0";var J=this.chunkSize($),X=Math.pow($,J),Q=x0(X),Y=C$(),G=C$(),W="";this.divRemTo(Q,Y,G);while(Y.signum()>0)W=(X+G.intValue()).toString($).substr(1)+W,Y.divRemTo(Q,Y,G);return G.intValue().toString($)+W}function VO($,J){if(this.fromInt(0),J==null)J=10;var X=this.chunkSize(J),Q=Math.pow(J,X),Y=!1,G=0,W=0;for(var U=0;U<$.length;++U){var M=W1($,U);if(M<0){if($.charAt(U)=="-"&&this.signum()==0)Y=!0;continue}if(W=J*W+M,++G>=X)this.dMultiply(Q),this.dAddOffset(W,0),G=0,W=0}if(G>0)this.dMultiply(Math.pow(J,G)),this.dAddOffset(W,0);if(Y)v.ZERO.subTo(this,this)}function HO($,J,X){if(typeof J=="number")if($<2)this.fromInt(1);else{if(this.fromNumber($,X),!this.testBit($-1))this.bitwiseTo(v.ONE.shiftLeft($-1),H8,this);if(this.isEven())this.dAddOffset(1,0);while(!this.isProbablePrime(J))if(this.dAddOffset(2,0),this.bitLength()>$)this.subTo(v.ONE.shiftLeft($-1),this)}else{var Q=[],Y=$&7;if(Q.length=($>>3)+1,J.nextBytes(Q),Y>0)Q[0]&=(1<<Y)-1;else Q[0]=0;this.fromString(Q,256)}}function qO(){var $=this.t,J=[];J[0]=this.s;var X=this.DB-$*this.DB%8,Q,Y=0;if($-- >0){if(X<this.DB&&(Q=this.data[$]>>X)!=(this.s&this.DM)>>X)J[Y++]=Q|this.s<<this.DB-X;while($>=0){if(X<8)Q=(this.data[$]&(1<<X)-1)<<8-X,Q|=this.data[--$]>>(X+=this.DB-8);else if(Q=this.data[$]>>(X-=8)&255,X<=0)X+=this.DB,--$;if((Q&128)!=0)Q|=-256;if(Y==0&&(this.s&128)!=(Q&128))++Y;if(Y>0||Q!=this.s)J[Y++]=Q}}return J}function KO($){return this.compareTo($)==0}function zO($){return this.compareTo($)<0?this:$}function EO($){return this.compareTo($)>0?this:$}function FO($,J,X){var Q,Y,G=Math.min($.t,this.t);for(Q=0;Q<G;++Q)X.data[Q]=J(this.data[Q],$.data[Q]);if($.t<this.t){Y=$.s&this.DM;for(Q=G;Q<this.t;++Q)X.data[Q]=J(this.data[Q],Y);X.t=this.t}else{Y=this.s&this.DM;for(Q=G;Q<$.t;++Q)X.data[Q]=J(Y,$.data[Q]);X.t=$.t}X.s=J(this.s,$.s),X.clamp()}function NO($,J){return $&J}function LO($){var J=C$();return this.bitwiseTo($,NO,J),J}function H8($,J){return $|J}function AO($){var J=C$();return this.bitwiseTo($,H8,J),J}function U1($,J){return $^J}function RO($){var J=C$();return this.bitwiseTo($,U1,J),J}function M1($,J){return $&~J}function DO($){var J=C$();return this.bitwiseTo($,M1,J),J}function ZO(){var $=C$();for(var J=0;J<this.t;++J)$.data[J]=this.DM&~this.data[J];return $.t=this.t,$.s=~this.s,$}function BO($){var J=C$();if($<0)this.rShiftTo(-$,J);else this.lShiftTo($,J);return J}function jO($){var J=C$();if($<0)this.lShiftTo(-$,J);else this.rShiftTo($,J);return J}function TO($){if($==0)return-1;var J=0;if(($&65535)==0)$>>=16,J+=16;if(($&255)==0)$>>=8,J+=8;if(($&15)==0)$>>=4,J+=4;if(($&3)==0)$>>=2,J+=2;if(($&1)==0)++J;return J}function SO(){for(var $=0;$<this.t;++$)if(this.data[$]!=0)return $*this.DB+TO(this.data[$]);if(this.s<0)return this.t*this.DB;return-1}function IO($){var J=0;while($!=0)$&=$-1,++J;return J}function CO(){var $=0,J=this.s&this.DM;for(var X=0;X<this.t;++X)$+=IO(this.data[X]^J);return $}function wO($){var J=Math.floor($/this.DB);if(J>=this.t)return this.s!=0;return(this.data[J]&1<<$%this.DB)!=0}function PO($,J){var X=v.ONE.shiftLeft($);return this.bitwiseTo(X,J,X),X}function _O($){return this.changeBit($,H8)}function xO($){return this.changeBit($,M1)}function vO($){return this.changeBit($,U1)}function kO($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]+$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q+=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q+=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=$.s}if(J.s=Q<0?-1:0,Q>0)J.data[X++]=Q;else if(Q<-1)J.data[X++]=this.DV+Q;J.t=X,J.clamp()}function fO($){var J=C$();return this.addTo($,J),J}function yO($){var J=C$();return this.subTo($,J),J}function bO($){var J=C$();return this.multiplyTo($,J),J}function hO(){var $=C$();return this.squareTo($),$}function uO($){var J=C$();return this.divRemTo($,J,null),J}function gO($){var J=C$();return this.divRemTo($,null,J),J}function mO($){var J=C$(),X=C$();return this.divRemTo($,J,X),[J,X]}function lO($){this.data[this.t]=this.am(0,$-1,this,0,0,this.t),++this.t,this.clamp()}function pO($,J){if($==0)return;while(this.t<=J)this.data[this.t++]=0;this.data[J]+=$;while(this.data[J]>=this.DV){if(this.data[J]-=this.DV,++J>=this.t)this.data[this.t++]=0;++this.data[J]}}function BX(){}function O1($){return $}function dO($,J,X){$.multiplyTo(J,X)}function cO($,J){$.squareTo(J)}BX.prototype.convert=O1;BX.prototype.revert=O1;BX.prototype.mulTo=dO;BX.prototype.sqrTo=cO;function nO($){return this.exp($,new BX)}function iO($,J,X){var Q=Math.min(this.t+$.t,J);X.s=0,X.t=Q;while(Q>0)X.data[--Q]=0;var Y;for(Y=X.t-this.t;Q<Y;++Q)X.data[Q+this.t]=this.am(0,$.data[Q],X,Q,0,this.t);for(Y=Math.min($.t,J);Q<Y;++Q)this.am(0,$.data[Q],X,Q,0,J-Q);X.clamp()}function oO($,J,X){--J;var Q=X.t=this.t+$.t-J;X.s=0;while(--Q>=0)X.data[Q]=0;for(Q=Math.max(J-this.t,0);Q<$.t;++Q)X.data[this.t+Q-J]=this.am(J-Q,$.data[Q],X,0,0,this.t+Q-J);X.clamp(),X.drShiftTo(1,X)}function CQ($){this.r2=C$(),this.q3=C$(),v.ONE.dlShiftTo(2*$.t,this.r2),this.mu=this.r2.divide($),this.m=$}function aO($){if($.s<0||$.t>2*this.m.t)return $.mod(this.m);else if($.compareTo(this.m)<0)return $;else{var J=C$();return $.copyTo(J),this.reduce(J),J}}function sO($){return $}function rO($){if($.drShiftTo(this.m.t-1,this.r2),$.t>this.m.t+1)$.t=this.m.t+1,$.clamp();this.mu.multiplyUpperTo(this.r2,this.m.t+1,this.q3),this.m.multiplyLowerTo(this.q3,this.m.t+1,this.r2);while($.compareTo(this.r2)<0)$.dAddOffset(1,this.m.t+1);$.subTo(this.r2,$);while($.compareTo(this.m)>=0)$.subTo(this.m,$)}function tO($,J){$.squareTo(J),this.reduce(J)}function eO($,J,X){$.multiplyTo(J,X),this.reduce(X)}CQ.prototype.convert=aO;CQ.prototype.revert=sO;CQ.prototype.reduce=rO;CQ.prototype.mulTo=eO;CQ.prototype.sqrTo=tO;function $V($,J){var X=$.bitLength(),Q,Y=x0(1),G;if(X<=0)return Y;else if(X<18)Q=1;else if(X<48)Q=3;else if(X<144)Q=4;else if(X<768)Q=5;else Q=6;if(X<8)G=new XQ(J);else if(J.isEven())G=new CQ(J);else G=new YQ(J);var W=[],U=3,M=Q-1,O=(1<<Q)-1;if(W[1]=G.convert(this),Q>1){var V=C$();G.sqrTo(W[1],V);while(U<=O)W[U]=C$(),G.mulTo(V,W[U-2],W[U]),U+=2}var H=$.t-1,q,F=!0,K=C$(),A;X=xY($.data[H])-1;while(H>=0){if(X>=M)q=$.data[H]>>X-M&O;else if(q=($.data[H]&(1<<X+1)-1)<<M-X,H>0)q|=$.data[H-1]>>this.DB+X-M;U=Q;while((q&1)==0)q>>=1,--U;if((X-=U)<0)X+=this.DB,--H;if(F)W[q].copyTo(Y),F=!1;else{while(U>1)G.sqrTo(Y,K),G.sqrTo(K,Y),U-=2;if(U>0)G.sqrTo(Y,K);else A=Y,Y=K,K=A;G.mulTo(K,W[q],Y)}while(H>=0&&($.data[H]&1<<X)==0)if(G.sqrTo(Y,K),A=Y,Y=K,K=A,--X<0)X=this.DB-1,--H}return G.revert(Y)}function JV($){var J=this.s<0?this.negate():this.clone(),X=$.s<0?$.negate():$.clone();if(J.compareTo(X)<0){var Q=J;J=X,X=Q}var Y=J.getLowestSetBit(),G=X.getLowestSetBit();if(G<0)return J;if(Y<G)G=Y;if(G>0)J.rShiftTo(G,J),X.rShiftTo(G,X);while(J.signum()>0){if((Y=J.getLowestSetBit())>0)J.rShiftTo(Y,J);if((Y=X.getLowestSetBit())>0)X.rShiftTo(Y,X);if(J.compareTo(X)>=0)J.subTo(X,J),J.rShiftTo(1,J);else X.subTo(J,X),X.rShiftTo(1,X)}if(G>0)X.lShiftTo(G,X);return X}function QV($){if($<=0)return 0;var J=this.DV%$,X=this.s<0?$-1:0;if(this.t>0)if(J==0)X=this.data[0]%$;else for(var Q=this.t-1;Q>=0;--Q)X=(J*X+this.data[Q])%$;return X}function XV($){if(this.signum()==0)return v.ZERO;var J=$.isEven();if(this.isEven()&&J||$.signum()==0)return v.ZERO;var X=$.clone(),Q=this.clone(),Y=x0(1),G=x0(0),W=x0(0),U=x0(1);while(X.signum()!=0){while(X.isEven()){if(X.rShiftTo(1,X),J){if(!Y.isEven()||!G.isEven())Y.addTo(this,Y),G.subTo($,G);Y.rShiftTo(1,Y)}else if(!G.isEven())G.subTo($,G);G.rShiftTo(1,G)}while(Q.isEven()){if(Q.rShiftTo(1,Q),J){if(!W.isEven()||!U.isEven())W.addTo(this,W),U.subTo($,U);W.rShiftTo(1,W)}else if(!U.isEven())U.subTo($,U);U.rShiftTo(1,U)}if(X.compareTo(Q)>=0){if(X.subTo(Q,X),J)Y.subTo(W,Y);G.subTo(U,G)}else{if(Q.subTo(X,Q),J)W.subTo(Y,W);U.subTo(G,U)}}if(Q.compareTo(v.ONE)!=0)return v.ZERO;if(U.compareTo($)>=0)return U.subtract($);if(U.signum()<0)U.addTo($,U);else return U;if(U.signum()<0)return U.add($);else return U}var lJ=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997],YV=67108864/lJ[lJ.length-1];function GV($){var J,X=this.abs();if(X.t==1&&X.data[0]<=lJ[lJ.length-1]){for(J=0;J<lJ.length;++J)if(X.data[0]==lJ[J])return!0;return!1}if(X.isEven())return!1;J=1;while(J<lJ.length){var Q=lJ[J],Y=J+1;while(Y<lJ.length&&Q<YV)Q*=lJ[Y++];Q=X.modInt(Q);while(J<Y)if(Q%lJ[J++]==0)return!1}return X.millerRabin($)}function WV($){var J=this.subtract(v.ONE),X=J.getLowestSetBit();if(X<=0)return!1;var Q=J.shiftRight(X),Y=UV(),G;for(var W=0;W<$;++W){do G=new v(this.bitLength(),Y);while(G.compareTo(v.ONE)<=0||G.compareTo(J)>=0);var U=G.modPow(Q,this);if(U.compareTo(v.ONE)!=0&&U.compareTo(J)!=0){var M=1;while(M++<X&&U.compareTo(J)!=0)if(U=U.modPowInt(2,this),U.compareTo(v.ONE)==0)return!1;if(U.compareTo(J)!=0)return!1}}return!0}function UV(){return{nextBytes:function($){for(var J=0;J<$.length;++J)$[J]=Math.floor(Math.random()*256)}}}v.prototype.chunkSize=UO;v.prototype.toRadix=OO;v.prototype.fromRadix=VO;v.prototype.fromNumber=HO;v.prototype.bitwiseTo=FO;v.prototype.changeBit=PO;v.prototype.addTo=kO;v.prototype.dMultiply=lO;v.prototype.dAddOffset=pO;v.prototype.multiplyLowerTo=iO;v.prototype.multiplyUpperTo=oO;v.prototype.modInt=QV;v.prototype.millerRabin=WV;v.prototype.clone=XO;v.prototype.intValue=YO;v.prototype.byteValue=GO;v.prototype.shortValue=WO;v.prototype.signum=MO;v.prototype.toByteArray=qO;v.prototype.equals=KO;v.prototype.min=zO;v.prototype.max=EO;v.prototype.and=LO;v.prototype.or=AO;v.prototype.xor=RO;v.prototype.andNot=DO;v.prototype.not=ZO;v.prototype.shiftLeft=BO;v.prototype.shiftRight=jO;v.prototype.getLowestSetBit=SO;v.prototype.bitCount=CO;v.prototype.testBit=wO;v.prototype.setBit=_O;v.prototype.clearBit=xO;v.prototype.flipBit=vO;v.prototype.add=fO;v.prototype.subtract=yO;v.prototype.multiply=bO;v.prototype.divide=uO;v.prototype.remainder=gO;v.prototype.divideAndRemainder=mO;v.prototype.modPow=$V;v.prototype.modInverse=XV;v.prototype.pow=nO;v.prototype.gcd=JV;v.prototype.isProbablePrime=GV;v.prototype.square=hO});var wQ=H$((ZF,z1)=>{var G0=F$();$0();_$();var q1=z1.exports=G0.sha1=G0.sha1||{};G0.md.sha1=G0.md.algorithms.sha1=q1;q1.create=function(){if(!K1)MV();var $=null,J=G0.util.createBuffer(),X=Array(80),Q={algorithm:"sha1",blockLength:64,digestLength:20,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=G0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878,h4:3285377520},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=G0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),H1($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=G0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(q8.substr(0,Q.blockLength-W));var U,M,O=Q.fullMessageLength[0]*8;for(var V=0;V<Q.fullMessageLength.length-1;++V)U=Q.fullMessageLength[V+1]*8,M=U/4294967296>>>0,O+=M,Y.putInt32(O>>>0),O=U>>>0;Y.putInt32(O);var H={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4};H1(H,X,Y);var q=G0.util.createBuffer();return q.putInt32(H.h0),q.putInt32(H.h1),q.putInt32(H.h2),q.putInt32(H.h3),q.putInt32(H.h4),q},Q};var q8=null,K1=!1;function MV(){q8=String.fromCharCode(128),q8+=G0.util.fillString(String.fromCharCode(0),64),K1=!0}function H1($,J,X){var Q,Y,G,W,U,M,O,V,H=X.length();while(H>=64){Y=$.h0,G=$.h1,W=$.h2,U=$.h3,M=$.h4;for(V=0;V<16;++V)Q=X.getInt32(),J[V]=Q,O=U^G&(W^U),Q=(Y<<5|Y>>>27)+O+M+1518500249+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<20;++V)Q=J[V-3]^J[V-8]^J[V-14]^J[V-16],Q=Q<<1|Q>>>31,J[V]=Q,O=U^G&(W^U),Q=(Y<<5|Y>>>27)+O+M+1518500249+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<32;++V)Q=J[V-3]^J[V-8]^J[V-14]^J[V-16],Q=Q<<1|Q>>>31,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+1859775393+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<40;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+1859775393+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<60;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G&W|U&(G^W),Q=(Y<<5|Y>>>27)+O+M+2400959708+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<80;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+3395469782+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+U|0,$.h4=$.h4+M|0,H-=64}}});var K8=H$((BF,F1)=>{var W0=F$();_$();_J();wQ();var E1=F1.exports=W0.pkcs1=W0.pkcs1||{};E1.encode_rsa_oaep=function($,J,X){var Q,Y,G,W;if(typeof X==="string")Q=X,Y=arguments[3]||void 0,G=arguments[4]||void 0;else if(X){if(Q=X.label||void 0,Y=X.seed||void 0,G=X.md||void 0,X.mgf1&&X.mgf1.md)W=X.mgf1.md}if(!G)G=W0.md.sha1.create();else G.start();if(!W)W=G;var U=Math.ceil($.n.bitLength()/8),M=U-2*G.digestLength-2;if(J.length>M){var O=Error("RSAES-OAEP input message length is too long.");throw O.length=J.length,O.maxLength=M,O}if(!Q)Q="";G.update(Q,"raw");var V=G.digest(),H="",q=M-J.length;for(var F=0;F<q;F++)H+="\x00";var K=V.getBytes()+H+"\x01"+J;if(!Y)Y=W0.random.getBytes(G.digestLength);else if(Y.length!==G.digestLength){var O=Error("Invalid RSAES-OAEP seed. The seed length must match the digest length.");throw O.seedLength=Y.length,O.digestLength=G.digestLength,O}var A=vY(Y,U-G.digestLength-1,W),L=W0.util.xorBytes(K,A,K.length),R=vY(L,G.digestLength,W),I=W0.util.xorBytes(Y,R,Y.length);return"\x00"+I+L};E1.decode_rsa_oaep=function($,J,X){var Q,Y,G;if(typeof X==="string")Q=X,Y=arguments[3]||void 0;else if(X){if(Q=X.label||void 0,Y=X.md||void 0,X.mgf1&&X.mgf1.md)G=X.mgf1.md}var W=Math.ceil($.n.bitLength()/8);if(J.length!==W){var L=Error("RSAES-OAEP encoded message length is invalid.");throw L.length=J.length,L.expectedLength=W,L}if(Y===void 0)Y=W0.md.sha1.create();else Y.start();if(!G)G=Y;if(W<2*Y.digestLength+2)throw Error("RSAES-OAEP key is too short for the hash function.");if(!Q)Q="";Y.update(Q,"raw");var U=Y.digest().getBytes(),M=J.charAt(0),O=J.substring(1,Y.digestLength+1),V=J.substring(1+Y.digestLength),H=vY(V,Y.digestLength,G),q=W0.util.xorBytes(O,H,O.length),F=vY(q,W-Y.digestLength-1,G),K=W0.util.xorBytes(V,F,V.length),A=K.substring(0,Y.digestLength),L=M!=="\x00";for(var R=0;R<Y.digestLength;++R)L|=U.charAt(R)!==A.charAt(R);var I=1,j=Y.digestLength;for(var C=Y.digestLength;C<K.length;C++){var w=K.charCodeAt(C),P=w&1^1,l=I?65534:0;L|=w&l,I=I&P,j+=I}if(L||K.charCodeAt(j)!==1)throw Error("Invalid RSAES-OAEP padding.");return K.substring(j+1)};function vY($,J,X){if(!X)X=W0.md.sha1.create();var Q="",Y=Math.ceil(J/X.digestLength);for(var G=0;G<Y;++G){var W=String.fromCharCode(G>>24&255,G>>16&255,G>>8&255,G&255);X.start(),X.update($+W),Q+=X.digest().getBytes()}return Q.substring(0,J)}});var E8=H$((jF,z8)=>{var v0=F$();_$();jX();_J();(function(){if(v0.prime){z8.exports=v0.prime;return}var $=z8.exports=v0.prime=v0.prime||{},J=v0.jsbn.BigInteger,X=[6,4,2,4,2,4,6,2],Q=new J(null);Q.fromInt(30);var Y=function(H,q){return H|q};$.generateProbablePrime=function(H,q,F){if(typeof q==="function")F=q,q={};q=q||{};var K=q.algorithm||"PRIMEINC";if(typeof K==="string")K={name:K};K.options=K.options||{};var A=q.prng||v0.random,L={nextBytes:function(R){var I=A.getBytesSync(R.length);for(var j=0;j<R.length;++j)R[j]=I.charCodeAt(j)}};if(K.name==="PRIMEINC")return G(H,L,K.options,F);throw Error("Invalid prime generation algorithm: "+K.name)};function G(H,q,F,K){if("workers"in F)return M(H,q,F,K);return W(H,q,F,K)}function W(H,q,F,K){var A=O(H,q),L=0,R=V(A.bitLength());if("millerRabinTests"in F)R=F.millerRabinTests;var I=10;if("maxBlockTime"in F)I=F.maxBlockTime;U(A,H,q,L,R,I,K)}function U(H,q,F,K,A,L,R){var I=+new Date;do{if(H.bitLength()>q)H=O(q,F);if(H.isProbablePrime(A))return R(null,H);H.dAddOffset(X[K++%8],0)}while(L<0||+new Date-I<L);v0.util.setImmediate(function(){U(H,q,F,K,A,L,R)})}function M(H,q,F,K){if(typeof Worker>"u")return W(H,q,F,K);var A=O(H,q),L=F.workers,R=F.workLoad||100,I=R*30/8,j=F.workerScript||"forge/prime.worker.js";if(L===-1)return v0.util.estimateCores(function(w,P){if(w)P=2;L=P-1,C()});C();function C(){L=Math.max(1,L);var w=[];for(var P=0;P<L;++P)w[P]=new Worker(j);var l=L;for(var P=0;P<L;++P)w[P].addEventListener("message",y);var e=!1;function y(n){if(e)return;--l;var Y$=n.data;if(Y$.found){for(var L$=0;L$<w.length;++L$)w[L$].terminate();return e=!0,K(null,new J(Y$.prime,16))}if(A.bitLength()>H)A=O(H,q);var j$=A.toString(16);n.target.postMessage({hex:j$,workLoad:R}),A.dAddOffset(I,0)}}}function O(H,q){var F=new J(H,q),K=H-1;if(!F.testBit(K))F.bitwiseTo(J.ONE.shiftLeft(K),Y,F);return F.dAddOffset(31-F.mod(Q).byteValue(),0),F}function V(H){if(H<=100)return 27;if(H<=150)return 18;if(H<=200)return 15;if(H<=250)return 12;if(H<=300)return 9;if(H<=350)return 8;if(H<=400)return 7;if(H<=500)return 6;if(H<=600)return 5;if(H<=800)return 4;if(H<=1250)return 3;return 2}})()});var TX=H$((TF,B1)=>{var Q$=F$();mJ();jX();_0();K8();E8();_J();_$();if(typeof I$>"u")I$=Q$.jsbn.BigInteger;var I$,F8=Q$.util.isNodejs?qX("crypto"):null,S=Q$.asn1,vJ=Q$.util;Q$.pki=Q$.pki||{};B1.exports=Q$.pki.rsa=Q$.rsa=Q$.rsa||{};var q$=Q$.pki,OV=[6,4,2,4,2,4,6,2],VV={name:"PrivateKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]},HV={name:"RSAPrivateKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPrivateKey.version",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"RSAPrivateKey.modulus",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyModulus"},{name:"RSAPrivateKey.publicExponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPublicExponent"},{name:"RSAPrivateKey.privateExponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrivateExponent"},{name:"RSAPrivateKey.prime1",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrime1"},{name:"RSAPrivateKey.prime2",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyPrime2"},{name:"RSAPrivateKey.exponent1",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyExponent1"},{name:"RSAPrivateKey.exponent2",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyExponent2"},{name:"RSAPrivateKey.coefficient",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"privateKeyCoefficient"}]},qV={name:"RSAPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPublicKey.modulus",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"publicKeyModulus"},{name:"RSAPublicKey.exponent",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"publicKeyExponent"}]},KV=Q$.pki.rsa.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{name:"SubjectPublicKeyInfo.subjectPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.BITSTRING,constructed:!1,value:[{name:"SubjectPublicKeyInfo.subjectPublicKey.RSAPublicKey",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"rsaPublicKey"}]}]},zV={name:"DigestInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm.algorithmIdentifier",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"algorithmIdentifier"},{name:"DigestInfo.DigestAlgorithm.parameters",tagClass:S.Class.UNIVERSAL,type:S.Type.NULL,capture:"parameters",optional:!0,constructed:!1}]},{name:"DigestInfo.digest",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"digest"}]},EV=function($){var J;if($.algorithm in q$.oids)J=q$.oids[$.algorithm];else{var X=Error("Unknown message digest algorithm.");throw X.algorithm=$.algorithm,X}var Q=S.oidToDer(J).getBytes(),Y=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[]),G=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[]);G.value.push(S.create(S.Class.UNIVERSAL,S.Type.OID,!1,Q)),G.value.push(S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,""));var W=S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,$.digest().getBytes());return Y.value.push(G),Y.value.push(W),S.toDer(Y).getBytes()},D1=function($,J,X){if(X)return $.modPow(J.e,J.n);if(!J.p||!J.q)return $.modPow(J.d,J.n);if(!J.dP)J.dP=J.d.mod(J.p.subtract(I$.ONE));if(!J.dQ)J.dQ=J.d.mod(J.q.subtract(I$.ONE));if(!J.qInv)J.qInv=J.q.modInverse(J.p);var Q;do Q=new I$(Q$.util.bytesToHex(Q$.random.getBytes(J.n.bitLength()/8)),16);while(Q.compareTo(J.n)>=0||!Q.gcd(J.n).equals(I$.ONE));$=$.multiply(Q.modPow(J.e,J.n)).mod(J.n);var Y=$.mod(J.p).modPow(J.dP,J.p),G=$.mod(J.q).modPow(J.dQ,J.q);while(Y.compareTo(G)<0)Y=Y.add(J.p);var W=Y.subtract(G).multiply(J.qInv).mod(J.p).multiply(J.q).add(G);return W=W.multiply(Q.modInverse(J.n)).mod(J.n),W};q$.rsa.encrypt=function($,J,X){var Q=X,Y,G=Math.ceil(J.n.bitLength()/8);if(X!==!1&&X!==!0)Q=X===2,Y=Z1($,J,X);else Y=Q$.util.createBuffer(),Y.putBytes($);var W=new I$(Y.toHex(),16),U=D1(W,J,Q),M=U.toString(16),O=Q$.util.createBuffer(),V=G-Math.ceil(M.length/2);while(V>0)O.putByte(0),--V;return O.putBytes(Q$.util.hexToBytes(M)),O.getBytes()};q$.rsa.decrypt=function($,J,X,Q){var Y=Math.ceil(J.n.bitLength()/8);if($.length!==Y){var G=Error("Encrypted message length is invalid.");throw G.length=$.length,G.expected=Y,G}var W=new I$(Q$.util.createBuffer($).toHex(),16);if(W.compareTo(J.n)>=0)throw Error("Encrypted message is invalid.");var U=D1(W,J,X),M=U.toString(16),O=Q$.util.createBuffer(),V=Y-Math.ceil(M.length/2);while(V>0)O.putByte(0),--V;if(O.putBytes(Q$.util.hexToBytes(M)),Q!==!1)return kY(O.getBytes(),J,X);return O.getBytes()};q$.rsa.createKeyPairGenerationState=function($,J,X){if(typeof $==="string")$=parseInt($,10);$=$||2048,X=X||{};var Q=X.prng||Q$.random,Y={nextBytes:function(U){var M=Q.getBytesSync(U.length);for(var O=0;O<U.length;++O)U[O]=M.charCodeAt(O)}},G=X.algorithm||"PRIMEINC",W;if(G==="PRIMEINC")W={algorithm:G,state:0,bits:$,rng:Y,eInt:J||65537,e:new I$(null),p:null,q:null,qBits:$>>1,pBits:$-($>>1),pqState:0,num:null,keys:null},W.e.fromInt(W.eInt);else throw Error("Invalid key generation algorithm: "+G);return W};q$.rsa.stepKeyPairGenerationState=function($,J){if(!("algorithm"in $))$.algorithm="PRIMEINC";var X=new I$(null);X.fromInt(30);var Q=0,Y=function(H,q){return H|q},G=+new Date,W,U=0;while($.keys===null&&(J<=0||U<J)){if($.state===0){var M=$.p===null?$.pBits:$.qBits,O=M-1;if($.pqState===0){if($.num=new I$(M,$.rng),!$.num.testBit(O))$.num.bitwiseTo(I$.ONE.shiftLeft(O),Y,$.num);$.num.dAddOffset(31-$.num.mod(X).byteValue(),0),Q=0,++$.pqState}else if($.pqState===1)if($.num.bitLength()>M)$.pqState=0;else if($.num.isProbablePrime(NV($.num.bitLength())))++$.pqState;else $.num.dAddOffset(OV[Q++%8],0);else if($.pqState===2)$.pqState=$.num.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)===0?3:0;else if($.pqState===3){if($.pqState=0,$.p===null)$.p=$.num;else $.q=$.num;if($.p!==null&&$.q!==null)++$.state;$.num=null}}else if($.state===1){if($.p.compareTo($.q)<0)$.num=$.p,$.p=$.q,$.q=$.num;++$.state}else if($.state===2)$.p1=$.p.subtract(I$.ONE),$.q1=$.q.subtract(I$.ONE),$.phi=$.p1.multiply($.q1),++$.state;else if($.state===3)if($.phi.gcd($.e).compareTo(I$.ONE)===0)++$.state;else $.p=null,$.q=null,$.state=0;else if($.state===4)if($.n=$.p.multiply($.q),$.n.bitLength()===$.bits)++$.state;else $.q=null,$.state=0;else if($.state===5){var V=$.e.modInverse($.phi);$.keys={privateKey:q$.rsa.setPrivateKey($.n,$.e,V,$.p,$.q,V.mod($.p1),V.mod($.q1),$.q.modInverse($.p)),publicKey:q$.rsa.setPublicKey($.n,$.e)}}W=+new Date,U+=W-G,G=W}return $.keys!==null};q$.rsa.generateKeyPair=function($,J,X,Q){if(arguments.length===1){if(typeof $==="object")X=$,$=void 0;else if(typeof $==="function")Q=$,$=void 0}else if(arguments.length===2)if(typeof $==="number"){if(typeof J==="function")Q=J,J=void 0;else if(typeof J!=="number")X=J,J=void 0}else X=$,Q=J,$=void 0,J=void 0;else if(arguments.length===3)if(typeof J==="number"){if(typeof X==="function")Q=X,X=void 0}else Q=X,X=J,J=void 0;if(X=X||{},$===void 0)$=X.bits||2048;if(J===void 0)J=X.e||65537;if(!Q$.options.usePureJavaScript&&!X.prng&&$>=256&&$<=16384&&(J===65537||J===3)){if(Q){if(N1("generateKeyPair"))return F8.generateKeyPair("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}},function(U,M,O){if(U)return Q(U);Q(null,{privateKey:q$.privateKeyFromPem(O),publicKey:q$.publicKeyFromPem(M)})});if(L1("generateKey")&&L1("exportKey"))return vJ.globalScope.crypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:R1(J),hash:{name:"SHA-256"}},!0,["sign","verify"]).then(function(U){return vJ.globalScope.crypto.subtle.exportKey("pkcs8",U.privateKey)}).then(void 0,function(U){Q(U)}).then(function(U){if(U){var M=q$.privateKeyFromAsn1(S.fromDer(Q$.util.createBuffer(U)));Q(null,{privateKey:M,publicKey:q$.setRsaPublicKey(M.n,M.e)})}});if(A1("generateKey")&&A1("exportKey")){var Y=vJ.globalScope.msCrypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:R1(J),hash:{name:"SHA-256"}},!0,["sign","verify"]);Y.oncomplete=function(U){var M=U.target.result,O=vJ.globalScope.msCrypto.subtle.exportKey("pkcs8",M.privateKey);O.oncomplete=function(V){var H=V.target.result,q=q$.privateKeyFromAsn1(S.fromDer(Q$.util.createBuffer(H)));Q(null,{privateKey:q,publicKey:q$.setRsaPublicKey(q.n,q.e)})},O.onerror=function(V){Q(V)}},Y.onerror=function(U){Q(U)};return}}else if(N1("generateKeyPairSync")){var G=F8.generateKeyPairSync("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{privateKey:q$.privateKeyFromPem(G.privateKey),publicKey:q$.publicKeyFromPem(G.publicKey)}}}var W=q$.rsa.createKeyPairGenerationState($,J,X);if(!Q)return q$.rsa.stepKeyPairGenerationState(W,0),W.keys;FV(W,X,Q)};q$.setRsaPublicKey=q$.rsa.setPublicKey=function($,J){var X={n:$,e:J};return X.encrypt=function(Q,Y,G){if(typeof Y==="string")Y=Y.toUpperCase();else if(Y===void 0)Y="RSAES-PKCS1-V1_5";if(Y==="RSAES-PKCS1-V1_5")Y={encode:function(U,M,O){return Z1(U,M,2).getBytes()}};else if(Y==="RSA-OAEP"||Y==="RSAES-OAEP")Y={encode:function(U,M){return Q$.pkcs1.encode_rsa_oaep(M,U,G)}};else if(["RAW","NONE","NULL",null].indexOf(Y)!==-1)Y={encode:function(U){return U}};else if(typeof Y==="string")throw Error('Unsupported encryption scheme: "'+Y+'".');var W=Y.encode(Q,X,!0);return q$.rsa.encrypt(W,X,!0)},X.verify=function(Q,Y,G,W){if(typeof G==="string")G=G.toUpperCase();else if(G===void 0)G="RSASSA-PKCS1-V1_5";if(W===void 0)W={_parseAllDigestBytes:!0,_skipPaddingChecks:!1};if(!("_parseAllDigestBytes"in W))W._parseAllDigestBytes=!0;if(!("_skipPaddingChecks"in W))W._skipPaddingChecks=!1;if(G==="RSASSA-PKCS1-V1_5")G={verify:function(M,O){O=kY(O,X,!0,void 0,W);var V=S.fromDer(O,{parseAllBytes:W._parseAllDigestBytes}),H={},q=[];if(!S.validate(V,zV,H,q)||V.value.length!==2){var F=Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.");throw F.errors=q,F}var K=S.derToOid(H.algorithmIdentifier);if(!(K===Q$.oids.md2||K===Q$.oids.md5||K===Q$.oids.sha1||K===Q$.oids.sha224||K===Q$.oids.sha256||K===Q$.oids.sha384||K===Q$.oids.sha512||K===Q$.oids["sha512-224"]||K===Q$.oids["sha512-256"])){var F=Error("Unknown RSASSA-PKCS1-v1_5 DigestAlgorithm identifier.");throw F.oid=K,F}if(K===Q$.oids.md2||K===Q$.oids.md5){if(!("parameters"in H))throw Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value. Missing algorithm identifier NULL parameters.")}return M===H.digest}};else if(G==="NONE"||G==="NULL"||G===null)G={verify:function(M,O){return O=kY(O,X,!0,void 0,W),M===O}};var U=q$.rsa.decrypt(Y,X,!0,!1);return G.verify(Q,U,X.n.bitLength())},X};q$.setRsaPrivateKey=q$.rsa.setPrivateKey=function($,J,X,Q,Y,G,W,U){var M={n:$,e:J,d:X,p:Q,q:Y,dP:G,dQ:W,qInv:U};return M.decrypt=function(O,V,H){if(typeof V==="string")V=V.toUpperCase();else if(V===void 0)V="RSAES-PKCS1-V1_5";var q=q$.rsa.decrypt(O,M,!1,!1);if(V==="RSAES-PKCS1-V1_5")V={decode:kY};else if(V==="RSA-OAEP"||V==="RSAES-OAEP")V={decode:function(F,K){return Q$.pkcs1.decode_rsa_oaep(K,F,H)}};else if(["RAW","NONE","NULL",null].indexOf(V)!==-1)V={decode:function(F){return F}};else throw Error('Unsupported encryption scheme: "'+V+'".');return V.decode(q,M,!1)},M.sign=function(O,V){var H=!1;if(typeof V==="string")V=V.toUpperCase();if(V===void 0||V==="RSASSA-PKCS1-V1_5")V={encode:EV},H=1;else if(V==="NONE"||V==="NULL"||V===null)V={encode:function(){return O}},H=1;var q=V.encode(O,M.n.bitLength());return q$.rsa.encrypt(q,M,H)},M};q$.wrapRsaPrivateKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(0).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(q$.oids.rsaEncryption).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,"")]),S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer($).getBytes())])};q$.privateKeyFromAsn1=function($){var J={},X=[];if(S.validate($,VV,J,X))$=S.fromDer(Q$.util.createBuffer(J.privateKey));if(J={},X=[],!S.validate($,HV,J,X)){var Q=Error("Cannot read private key. ASN.1 object does not contain an RSAPrivateKey.");throw Q.errors=X,Q}var Y,G,W,U,M,O,V,H;return Y=Q$.util.createBuffer(J.privateKeyModulus).toHex(),G=Q$.util.createBuffer(J.privateKeyPublicExponent).toHex(),W=Q$.util.createBuffer(J.privateKeyPrivateExponent).toHex(),U=Q$.util.createBuffer(J.privateKeyPrime1).toHex(),M=Q$.util.createBuffer(J.privateKeyPrime2).toHex(),O=Q$.util.createBuffer(J.privateKeyExponent1).toHex(),V=Q$.util.createBuffer(J.privateKeyExponent2).toHex(),H=Q$.util.createBuffer(J.privateKeyCoefficient).toHex(),q$.setRsaPrivateKey(new I$(Y,16),new I$(G,16),new I$(W,16),new I$(U,16),new I$(M,16),new I$(O,16),new I$(V,16),new I$(H,16))};q$.privateKeyToAsn1=q$.privateKeyToRSAPrivateKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(0).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.n)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.e)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.d)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.p)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.q)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.dP)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.dQ)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.qInv))])};q$.publicKeyFromAsn1=function($){var J={},X=[];if(S.validate($,KV,J,X)){var Q=S.derToOid(J.publicKeyOid);if(Q!==q$.oids.rsaEncryption){var Y=Error("Cannot read public key. Unknown OID.");throw Y.oid=Q,Y}$=J.rsaPublicKey}if(X=[],!S.validate($,qV,J,X)){var Y=Error("Cannot read public key. ASN.1 object does not contain an RSAPublicKey.");throw Y.errors=X,Y}var G=Q$.util.createBuffer(J.publicKeyModulus).toHex(),W=Q$.util.createBuffer(J.publicKeyExponent).toHex();return q$.setRsaPublicKey(new I$(G,16),new I$(W,16))};q$.publicKeyToAsn1=q$.publicKeyToSubjectPublicKeyInfo=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(q$.oids.rsaEncryption).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,"")]),S.create(S.Class.UNIVERSAL,S.Type.BITSTRING,!1,[q$.publicKeyToRSAPublicKey($)])])};q$.publicKeyToRSAPublicKey=function($){return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.n)),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,U0($.e))])};function Z1($,J,X){var Q=Q$.util.createBuffer(),Y=Math.ceil(J.n.bitLength()/8);if($.length>Y-11){var G=Error("Message is too long for PKCS#1 v1.5 padding.");throw G.length=$.length,G.max=Y-11,G}Q.putByte(0),Q.putByte(X);var W=Y-3-$.length,U;if(X===0||X===1){U=X===0?0:255;for(var M=0;M<W;++M)Q.putByte(U)}else while(W>0){var O=0,V=Q$.random.getBytes(W);for(var M=0;M<W;++M)if(U=V.charCodeAt(M),U===0)++O;else Q.putByte(U);W=O}return Q.putByte(0),Q.putBytes($),Q}function kY($,J,X,Q,Y){var G=Math.ceil(J.n.bitLength()/8),W=Q$.util.createBuffer($),U=W.getByte(),M=W.getByte();if(U!==0||X&&M!==0&&M!==1||!X&&M!==2||X&&M===0&&typeof Q>"u")throw Error("Encryption block is invalid.");var O=0;if(M===0){O=G-3-Q;for(var V=0;V<O;++V)if(W.getByte()!==0)throw Error("Encryption block is invalid.")}else if(M===1){O=0;while(W.length()>1){if(W.getByte()!==255){--W.read;break}++O}if(O<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}else if(M===2){O=0;while(W.length()>1){if(W.getByte()===0){--W.read;break}++O}if(O<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}var H=W.getByte();if(H!==0||O!==G-3-W.length())throw Error("Encryption block is invalid.");return W.getBytes()}function FV($,J,X){if(typeof J==="function")X=J,J={};J=J||{};var Q={algorithm:{name:J.algorithm||"PRIMEINC",options:{workers:J.workers||2,workLoad:J.workLoad||100,workerScript:J.workerScript}}};if("prng"in J)Q.prng=J.prng;Y();function Y(){G($.pBits,function(U,M){if(U)return X(U);if($.p=M,$.q!==null)return W(U,$.q);G($.qBits,W)})}function G(U,M){Q$.prime.generateProbablePrime(U,Q,M)}function W(U,M){if(U)return X(U);if($.q=M,$.p.compareTo($.q)<0){var O=$.p;$.p=$.q,$.q=O}if($.p.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)!==0){$.p=null,Y();return}if($.q.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)!==0){$.q=null,G($.qBits,W);return}if($.p1=$.p.subtract(I$.ONE),$.q1=$.q.subtract(I$.ONE),$.phi=$.p1.multiply($.q1),$.phi.gcd($.e).compareTo(I$.ONE)!==0){$.p=$.q=null,Y();return}if($.n=$.p.multiply($.q),$.n.bitLength()!==$.bits){$.q=null,G($.qBits,W);return}var V=$.e.modInverse($.phi);$.keys={privateKey:q$.rsa.setPrivateKey($.n,$.e,V,$.p,$.q,V.mod($.p1),V.mod($.q1),$.q.modInverse($.p)),publicKey:q$.rsa.setPublicKey($.n,$.e)},X(null,$.keys)}}function U0($){var J=$.toString(16);if(J[0]>="8")J="00"+J;var X=Q$.util.hexToBytes(J);if(X.length>1&&(X.charCodeAt(0)===0&&(X.charCodeAt(1)&128)===0||X.charCodeAt(0)===255&&(X.charCodeAt(1)&128)===128))return X.substr(1);return X}function NV($){if($<=100)return 27;if($<=150)return 18;if($<=200)return 15;if($<=250)return 12;if($<=300)return 9;if($<=350)return 8;if($<=400)return 7;if($<=500)return 6;if($<=600)return 5;if($<=800)return 4;if($<=1250)return 3;return 2}function N1($){return Q$.util.isNodejs&&typeof F8[$]==="function"}function L1($){return typeof vJ.globalScope<"u"&&typeof vJ.globalScope.crypto==="object"&&typeof vJ.globalScope.crypto.subtle==="object"&&typeof vJ.globalScope.crypto.subtle[$]==="function"}function A1($){return typeof vJ.globalScope<"u"&&typeof vJ.globalScope.msCrypto==="object"&&typeof vJ.globalScope.msCrypto.subtle==="object"&&typeof vJ.globalScope.msCrypto.subtle[$]==="function"}function R1($){var J=Q$.util.hexToBytes($.toString(16)),X=new Uint8Array(J.length);for(var Q=0;Q<J.length;++Q)X[Q]=J.charCodeAt(Q);return X}});var L8=H$((SF,I1)=>{var o=F$();P0();mJ();ZX();$0();_0();wY();QQ();_J();M8();TX();_$();if(typeof N8>"u")N8=o.jsbn.BigInteger;var N8,_=o.asn1,z$=o.pki=o.pki||{};I1.exports=z$.pbe=o.pbe=o.pbe||{};var GQ=z$.oids,LV={name:"EncryptedPrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedPrivateKeyInfo.encryptionAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encryptionOid"},{name:"AlgorithmIdentifier.parameters",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,captureAsn1:"encryptionParams"}]},{name:"EncryptedPrivateKeyInfo.encryptedData",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encryptedData"}]},AV={name:"PBES2Algorithms",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"kdfOid"},{name:"PBES2Algorithms.params",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.params.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"kdfSalt"},{name:"PBES2Algorithms.params.iterationCount",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"kdfIterationCount"},{name:"PBES2Algorithms.params.keyLength",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,optional:!0,capture:"keyLength"},{name:"PBES2Algorithms.params.prf",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,optional:!0,value:[{name:"PBES2Algorithms.params.prf.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"prfOid"}]}]}]},{name:"PBES2Algorithms.encryptionScheme",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.encryptionScheme.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encOid"},{name:"PBES2Algorithms.encryptionScheme.iv",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encIv"}]}]},RV={name:"pkcs-12PbeParams",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"pkcs-12PbeParams.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"salt"},{name:"pkcs-12PbeParams.iterations",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"iterations"}]};z$.encryptPrivateKeyInfo=function($,J,X){X=X||{},X.saltSize=X.saltSize||8,X.count=X.count||2048,X.algorithm=X.algorithm||"aes128",X.prfAlgorithm=X.prfAlgorithm||"sha1";var Q=o.random.getBytesSync(X.saltSize),Y=X.count,G=_.integerToDer(Y),W,U,M;if(X.algorithm.indexOf("aes")===0||X.algorithm==="des"){var O,V,H;switch(X.algorithm){case"aes128":W=16,O=16,V=GQ["aes128-CBC"],H=o.aes.createEncryptionCipher;break;case"aes192":W=24,O=16,V=GQ["aes192-CBC"],H=o.aes.createEncryptionCipher;break;case"aes256":W=32,O=16,V=GQ["aes256-CBC"],H=o.aes.createEncryptionCipher;break;case"des":W=8,O=8,V=GQ.desCBC,H=o.des.createEncryptionCipher;break;default:var q=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw q.algorithm=X.algorithm,q}var F="hmacWith"+X.prfAlgorithm.toUpperCase(),K=S1(F),A=o.pkcs5.pbkdf2(J,Q,Y,W,K),L=o.random.getBytesSync(O),R=H(A);R.start(L),R.update(_.toDer($)),R.finish(),M=R.output.getBytes();var I=DV(Q,G,W,F);U=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(GQ.pkcs5PBES2).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(GQ.pkcs5PBKDF2).getBytes()),I]),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(V).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,L)])])])}else if(X.algorithm==="3des"){W=24;var j=new o.util.ByteBuffer(Q),A=z$.pbe.generatePkcs12Key(J,j,1,Y,W),L=z$.pbe.generatePkcs12Key(J,j,2,Y,W),R=o.des.createEncryptionCipher(A);R.start(L),R.update(_.toDer($)),R.finish(),M=R.output.getBytes(),U=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(GQ["pbeWithSHAAnd3-KeyTripleDES-CBC"]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,Q),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,G.getBytes())])])}else{var q=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw q.algorithm=X.algorithm,q}var C=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[U,_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,M)]);return C};z$.decryptPrivateKeyInfo=function($,J){var X=null,Q={},Y=[];if(!_.validate($,LV,Q,Y)){var G=Error("Cannot read encrypted private key. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=_.derToOid(Q.encryptionOid),U=z$.pbe.getCipher(W,Q.encryptionParams,J),M=o.util.createBuffer(Q.encryptedData);if(U.update(M),U.finish())X=_.fromDer(U.output);return X};z$.encryptedPrivateKeyToPem=function($,J){var X={type:"ENCRYPTED PRIVATE KEY",body:_.toDer($).getBytes()};return o.pem.encode(X,{maxline:J})};z$.encryptedPrivateKeyFromPem=function($){var J=o.pem.decode($)[0];if(J.type!=="ENCRYPTED PRIVATE KEY"){var X=Error('Could not convert encrypted private key from PEM; PEM header type is "ENCRYPTED PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert encrypted private key from PEM; PEM is encrypted.");return _.fromDer(J.body)};z$.encryptRsaPrivateKey=function($,J,X){if(X=X||{},!X.legacy){var Q=z$.wrapRsaPrivateKey(z$.privateKeyToAsn1($));return Q=z$.encryptPrivateKeyInfo(Q,J,X),z$.encryptedPrivateKeyToPem(Q)}var Y,G,W,U;switch(X.algorithm){case"aes128":Y="AES-128-CBC",W=16,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"aes192":Y="AES-192-CBC",W=24,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"aes256":Y="AES-256-CBC",W=32,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"3des":Y="DES-EDE3-CBC",W=24,G=o.random.getBytesSync(8),U=o.des.createEncryptionCipher;break;case"des":Y="DES-CBC",W=8,G=o.random.getBytesSync(8),U=o.des.createEncryptionCipher;break;default:var M=Error('Could not encrypt RSA private key; unsupported encryption algorithm "'+X.algorithm+'".');throw M.algorithm=X.algorithm,M}var O=o.pbe.opensslDeriveBytes(J,G.substr(0,8),W),V=U(O);V.start(G),V.update(_.toDer(z$.privateKeyToAsn1($))),V.finish();var H={type:"RSA PRIVATE KEY",procType:{version:"4",type:"ENCRYPTED"},dekInfo:{algorithm:Y,parameters:o.util.bytesToHex(G).toUpperCase()},body:V.output.getBytes()};return o.pem.encode(H)};z$.decryptRsaPrivateKey=function($,J){var X=null,Q=o.pem.decode($)[0];if(Q.type!=="ENCRYPTED PRIVATE KEY"&&Q.type!=="PRIVATE KEY"&&Q.type!=="RSA PRIVATE KEY"){var Y=Error('Could not convert private key from PEM; PEM header type is not "ENCRYPTED PRIVATE KEY", "PRIVATE KEY", or "RSA PRIVATE KEY".');throw Y.headerType=Y,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED"){var G,W;switch(Q.dekInfo.algorithm){case"DES-CBC":G=8,W=o.des.createDecryptionCipher;break;case"DES-EDE3-CBC":G=24,W=o.des.createDecryptionCipher;break;case"AES-128-CBC":G=16,W=o.aes.createDecryptionCipher;break;case"AES-192-CBC":G=24,W=o.aes.createDecryptionCipher;break;case"AES-256-CBC":G=32,W=o.aes.createDecryptionCipher;break;case"RC2-40-CBC":G=5,W=function(H){return o.rc2.createDecryptionCipher(H,40)};break;case"RC2-64-CBC":G=8,W=function(H){return o.rc2.createDecryptionCipher(H,64)};break;case"RC2-128-CBC":G=16,W=function(H){return o.rc2.createDecryptionCipher(H,128)};break;default:var Y=Error('Could not decrypt private key; unsupported encryption algorithm "'+Q.dekInfo.algorithm+'".');throw Y.algorithm=Q.dekInfo.algorithm,Y}var U=o.util.hexToBytes(Q.dekInfo.parameters),M=o.pbe.opensslDeriveBytes(J,U.substr(0,8),G),O=W(M);if(O.start(U),O.update(o.util.createBuffer(Q.body)),O.finish())X=O.output.getBytes();else return X}else X=Q.body;if(Q.type==="ENCRYPTED PRIVATE KEY")X=z$.decryptPrivateKeyInfo(_.fromDer(X),J);else X=_.fromDer(X);if(X!==null)X=z$.privateKeyFromAsn1(X);return X};z$.pbe.generatePkcs12Key=function($,J,X,Q,Y,G){var W,U;if(typeof G>"u"||G===null){if(!("sha1"in o.md))throw Error('"sha1" hash algorithm unavailable.');G=o.md.sha1.create()}var{digestLength:M,blockLength:O}=G,V=new o.util.ByteBuffer,H=new o.util.ByteBuffer;if($!==null&&$!==void 0){for(U=0;U<$.length;U++)H.putInt16($.charCodeAt(U));H.putInt16(0)}var q=H.length(),F=J.length(),K=new o.util.ByteBuffer;K.fillWithByte(X,O);var A=O*Math.ceil(F/O),L=new o.util.ByteBuffer;for(U=0;U<A;U++)L.putByte(J.at(U%F));var R=O*Math.ceil(q/O),I=new o.util.ByteBuffer;for(U=0;U<R;U++)I.putByte(H.at(U%q));var j=L;j.putBuffer(I);var C=Math.ceil(Y/M);for(var w=1;w<=C;w++){var P=new o.util.ByteBuffer;P.putBytes(K.bytes()),P.putBytes(j.bytes());for(var l=0;l<Q;l++)G.start(),G.update(P.getBytes()),P=G.digest();var e=new o.util.ByteBuffer;for(U=0;U<O;U++)e.putByte(P.at(U%M));var y=Math.ceil(F/O)+Math.ceil(q/O),n=new o.util.ByteBuffer;for(W=0;W<y;W++){var Y$=new o.util.ByteBuffer(j.getBytes(O)),L$=511;for(U=e.length()-1;U>=0;U--)L$=L$>>8,L$+=e.at(U)+Y$.at(U),Y$.setAt(U,L$&255);n.putBuffer(Y$)}j=n,V.putBuffer(P)}return V.truncate(V.length()-Y),V};z$.pbe.getCipher=function($,J,X){switch($){case z$.oids.pkcs5PBES2:return z$.pbe.getCipherForPBES2($,J,X);case z$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:case z$.oids["pbewithSHAAnd40BitRC2-CBC"]:return z$.pbe.getCipherForPKCS12PBE($,J,X);default:var Q=Error("Cannot read encrypted PBE data block. Unsupported OID.");throw Q.oid=$,Q.supportedOids=["pkcs5PBES2","pbeWithSHAAnd3-KeyTripleDES-CBC","pbewithSHAAnd40BitRC2-CBC"],Q}};z$.pbe.getCipherForPBES2=function($,J,X){var Q={},Y=[];if(!_.validate(J,AV,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}if($=_.derToOid(Q.kdfOid),$!==z$.oids.pkcs5PBKDF2){var G=Error("Cannot read encrypted private key. Unsupported key derivation function OID.");throw G.oid=$,G.supportedOids=["pkcs5PBKDF2"],G}if($=_.derToOid(Q.encOid),$!==z$.oids["aes128-CBC"]&&$!==z$.oids["aes192-CBC"]&&$!==z$.oids["aes256-CBC"]&&$!==z$.oids["des-EDE3-CBC"]&&$!==z$.oids.desCBC){var G=Error("Cannot read encrypted private key. Unsupported encryption scheme OID.");throw G.oid=$,G.supportedOids=["aes128-CBC","aes192-CBC","aes256-CBC","des-EDE3-CBC","desCBC"],G}var W=Q.kdfSalt,U=o.util.createBuffer(Q.kdfIterationCount);U=U.getInt(U.length()<<3);var M,O;switch(z$.oids[$]){case"aes128-CBC":M=16,O=o.aes.createDecryptionCipher;break;case"aes192-CBC":M=24,O=o.aes.createDecryptionCipher;break;case"aes256-CBC":M=32,O=o.aes.createDecryptionCipher;break;case"des-EDE3-CBC":M=24,O=o.des.createDecryptionCipher;break;case"desCBC":M=8,O=o.des.createDecryptionCipher;break}var V=T1(Q.prfOid),H=o.pkcs5.pbkdf2(X,W,U,M,V),q=Q.encIv,F=O(H);return F.start(q),F};z$.pbe.getCipherForPKCS12PBE=function($,J,X){var Q={},Y=[];if(!_.validate(J,RV,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=o.util.createBuffer(Q.salt),U=o.util.createBuffer(Q.iterations);U=U.getInt(U.length()<<3);var M,O,V;switch($){case z$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:M=24,O=8,V=o.des.startDecrypting;break;case z$.oids["pbewithSHAAnd40BitRC2-CBC"]:M=5,O=8,V=function(A,L){var R=o.rc2.createDecryptionCipher(A,40);return R.start(L,null),R};break;default:var G=Error("Cannot read PKCS #12 PBE data block. Unsupported OID.");throw G.oid=$,G}var H=T1(Q.prfOid),q=z$.pbe.generatePkcs12Key(X,W,1,U,M,H);H.start();var F=z$.pbe.generatePkcs12Key(X,W,2,U,O,H);return V(q,F)};z$.pbe.opensslDeriveBytes=function($,J,X,Q){if(typeof Q>"u"||Q===null){if(!("md5"in o.md))throw Error('"md5" hash algorithm unavailable.');Q=o.md.md5.create()}if(J===null)J="";var Y=[j1(Q,$+J)];for(var G=16,W=1;G<X;++W,G+=16)Y.push(j1(Q,Y[W-1]+$+J));return Y.join("").substr(0,X)};function j1($,J){return $.start().update(J).digest().getBytes()}function T1($){var J;if(!$)J="hmacWithSHA1";else if(J=z$.oids[_.derToOid($)],!J){var X=Error("Unsupported PRF OID.");throw X.oid=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}return S1(J)}function S1($){var J=o.md;switch($){case"hmacWithSHA224":J=o.md.sha512;case"hmacWithSHA1":case"hmacWithSHA256":case"hmacWithSHA384":case"hmacWithSHA512":$=$.substr(8).toLowerCase();break;default:var X=Error("Unsupported PRF algorithm.");throw X.algorithm=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}if(!J||!($ in J))throw Error("Unknown hash algorithm: "+$);return J[$].create()}function DV($,J,X,Q){var Y=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,$),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,J.getBytes())]);if(Q!=="hmacWithSHA1")Y.value.push(_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,o.util.hexToBytes(X.toString(16))),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(z$.oids[Q]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]));return Y}});var A8=H$((IF,P1)=>{var PQ=F$();mJ();_$();var i=PQ.asn1,_Q=P1.exports=PQ.pkcs7asn1=PQ.pkcs7asn1||{};PQ.pkcs7=PQ.pkcs7||{};PQ.pkcs7.asn1=_Q;var C1={name:"ContentInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.ContentType",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,captureAsn1:"content"}]};_Q.contentInfoValidator=C1;var w1={name:"EncryptedContentInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentType",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"contentType"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentEncryptionAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,captureAsn1:"encParameter"}]},{name:"EncryptedContentInfo.encryptedContent",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,capture:"encryptedContent",captureAsn1:"encryptedContentAsn1"}]};_Q.envelopedDataValidator={name:"EnvelopedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EnvelopedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"EnvelopedData.RecipientInfos",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,constructed:!0,captureAsn1:"recipientInfos"}].concat(w1)};_Q.encryptedDataValidator={name:"EncryptedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"}].concat(w1)};var ZV={name:"SignerInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1},{name:"SignerInfo.issuerAndSerialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.issuerAndSerialNumber.issuer",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"SignerInfo.issuerAndSerialNumber.serialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"SignerInfo.digestAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.digestAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"digestAlgorithm"},{name:"SignerInfo.digestAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,constructed:!1,captureAsn1:"digestParameter",optional:!0}]},{name:"SignerInfo.authenticatedAttributes",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"authenticatedAttributes"},{name:"SignerInfo.digestEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,capture:"signatureAlgorithm"},{name:"SignerInfo.encryptedDigest",tagClass:i.Class.UNIVERSAL,type:i.Type.OCTETSTRING,constructed:!1,capture:"signature"},{name:"SignerInfo.unauthenticatedAttributes",tagClass:i.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,capture:"unauthenticatedAttributes"}]};_Q.signedDataValidator={name:"SignedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"SignedData.DigestAlgorithms",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,constructed:!0,captureAsn1:"digestAlgorithms"},C1,{name:"SignedData.Certificates",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,optional:!0,captureAsn1:"certificates"},{name:"SignedData.CertificateRevocationLists",tagClass:i.Class.CONTEXT_SPECIFIC,type:1,optional:!0,captureAsn1:"crls"},{name:"SignedData.SignerInfos",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,capture:"signerInfos",optional:!0,value:[ZV]}]};_Q.recipientInfoValidator={name:"RecipientInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"RecipientInfo.issuerAndSerial",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.issuerAndSerial.issuer",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"RecipientInfo.issuerAndSerial.serialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"RecipientInfo.keyEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.keyEncryptionAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"RecipientInfo.keyEncryptionAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,constructed:!1,captureAsn1:"encParameter",optional:!0}]},{name:"RecipientInfo.encryptedKey",tagClass:i.Class.UNIVERSAL,type:i.Type.OCTETSTRING,constructed:!1,capture:"encKey"}]}});var R8=H$((CF,_1)=>{var WQ=F$();_$();WQ.mgf=WQ.mgf||{};var BV=_1.exports=WQ.mgf.mgf1=WQ.mgf1=WQ.mgf1||{};BV.create=function($){var J={generate:function(X,Q){var Y=new WQ.util.ByteBuffer,G=Math.ceil(Q/$.digestLength);for(var W=0;W<G;W++){var U=new WQ.util.ByteBuffer;U.putInt32(W),$.start(),$.update(X+U.getBytes()),Y.putBuffer($.digest())}return Y.truncate(Y.length()-Q),Y.getBytes()}};return J}});var v1=H$((wF,x1)=>{var fY=F$();R8();x1.exports=fY.mgf=fY.mgf||{};fY.mgf.mgf1=fY.mgf1});var yY=H$((PF,k1)=>{var UQ=F$();_J();_$();var jV=k1.exports=UQ.pss=UQ.pss||{};jV.create=function($){if(arguments.length===3)$={md:arguments[0],mgf:arguments[1],saltLength:arguments[2]};var{md:J,mgf:X}=$,Q=J.digestLength,Y=$.salt||null;if(typeof Y==="string")Y=UQ.util.createBuffer(Y);var G;if("saltLength"in $)G=$.saltLength;else if(Y!==null)G=Y.length();else throw Error("Salt length not specified or specific salt not given.");if(Y!==null&&Y.length()!==G)throw Error("Given salt length does not match length of given salt.");var W=$.prng||UQ.random,U={};return U.encode=function(M,O){var V,H=O-1,q=Math.ceil(H/8),F=M.digest().getBytes();if(q<Q+G+2)throw Error("Message is too long to encrypt.");var K;if(Y===null)K=W.getBytesSync(G);else K=Y.bytes();var A=new UQ.util.ByteBuffer;A.fillWithByte(0,8),A.putBytes(F),A.putBytes(K),J.start(),J.update(A.getBytes());var L=J.digest().getBytes(),R=new UQ.util.ByteBuffer;R.fillWithByte(0,q-G-Q-2),R.putByte(1),R.putBytes(K);var I=R.getBytes(),j=q-Q-1,C=X.generate(L,j),w="";for(V=0;V<j;V++)w+=String.fromCharCode(I.charCodeAt(V)^C.charCodeAt(V));var P=65280>>8*q-H&255;return w=String.fromCharCode(w.charCodeAt(0)&~P)+w.substr(1),w+L+String.fromCharCode(188)},U.verify=function(M,O,V){var H,q=V-1,F=Math.ceil(q/8);if(O=O.substr(-F),F<Q+G+2)throw Error("Inconsistent parameters to PSS signature verification.");if(O.charCodeAt(F-1)!==188)throw Error("Encoded message does not end in 0xBC.");var K=F-Q-1,A=O.substr(0,K),L=O.substr(K,Q),R=65280>>8*F-q&255;if((A.charCodeAt(0)&R)!==0)throw Error("Bits beyond keysize not zero as expected.");var I=X.generate(L,K),j="";for(H=0;H<K;H++)j+=String.fromCharCode(A.charCodeAt(H)^I.charCodeAt(H));j=String.fromCharCode(j.charCodeAt(0)&~R)+j.substr(1);var C=F-Q-G-2;for(H=0;H<C;H++)if(j.charCodeAt(H)!==0)throw Error("Leftmost octets not zero as expected");if(j.charCodeAt(C)!==1)throw Error("Inconsistent PSS signature, 0x01 marker not found");var w=j.substr(-G),P=new UQ.util.ByteBuffer;P.fillWithByte(0,8),P.putBytes(M),P.putBytes(w),J.start(),J.update(P.getBytes());var l=J.digest().getBytes();return L===l},U}});var uY=H$((_F,u1)=>{var X$=F$();P0();mJ();ZX();$0();v1();_0();QQ();yY();TX();_$();var z=X$.asn1,g=u1.exports=X$.pki=X$.pki||{},w$=g.oids,r$={};r$.CN=w$.commonName;r$.commonName="CN";r$.C=w$.countryName;r$.countryName="C";r$.L=w$.localityName;r$.localityName="L";r$.ST=w$.stateOrProvinceName;r$.stateOrProvinceName="ST";r$.O=w$.organizationName;r$.organizationName="O";r$.OU=w$.organizationalUnitName;r$.organizationalUnitName="OU";r$.E=w$.emailAddress;r$.emailAddress="E";var y1=X$.pki.rsa.publicKeyValidator,TV={name:"Certificate",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"tbsCertificate",value:[{name:"Certificate.TBSCertificate.version",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.version.integer",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certVersion"}]},{name:"Certificate.TBSCertificate.serialNumber",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certSerialNumber"},{name:"Certificate.TBSCertificate.signature",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.signature.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"certinfoSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"certinfoSignatureParams"}]},{name:"Certificate.TBSCertificate.issuer",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certIssuer"},{name:"Certificate.TBSCertificate.validity",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.validity.notBefore (utc)",tagClass:z.Class.UNIVERSAL,type:z.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity1UTCTime"},{name:"Certificate.TBSCertificate.validity.notBefore (generalized)",tagClass:z.Class.UNIVERSAL,type:z.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity2GeneralizedTime"},{name:"Certificate.TBSCertificate.validity.notAfter (utc)",tagClass:z.Class.UNIVERSAL,type:z.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity3UTCTime"},{name:"Certificate.TBSCertificate.validity.notAfter (generalized)",tagClass:z.Class.UNIVERSAL,type:z.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity4GeneralizedTime"}]},{name:"Certificate.TBSCertificate.subject",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certSubject"},y1,{name:"Certificate.TBSCertificate.issuerUniqueID",tagClass:z.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.issuerUniqueID.id",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certIssuerUniqueId"}]},{name:"Certificate.TBSCertificate.subjectUniqueID",tagClass:z.Class.CONTEXT_SPECIFIC,type:2,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.subjectUniqueID.id",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSubjectUniqueId"}]},{name:"Certificate.TBSCertificate.extensions",tagClass:z.Class.CONTEXT_SPECIFIC,type:3,constructed:!0,captureAsn1:"certExtensions",optional:!0}]},{name:"Certificate.signatureAlgorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.signatureAlgorithm.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"certSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"certSignatureParams"}]},{name:"Certificate.signatureValue",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSignature"}]},SV={name:"rsapss",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.hashAlgorithm",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier",tagClass:z.Class.UNIVERSAL,type:z.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"hashOid"}]}]},{name:"rsapss.maskGenAlgorithm",tagClass:z.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier",tagClass:z.Class.UNIVERSAL,type:z.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"maskGenOid"},{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"maskGenHashOid"}]}]}]},{name:"rsapss.saltLength",tagClass:z.Class.CONTEXT_SPECIFIC,type:2,optional:!0,value:[{name:"rsapss.saltLength.saltLength",tagClass:z.Class.UNIVERSAL,type:z.Class.INTEGER,constructed:!1,capture:"saltLength"}]},{name:"rsapss.trailerField",tagClass:z.Class.CONTEXT_SPECIFIC,type:3,optional:!0,value:[{name:"rsapss.trailer.trailer",tagClass:z.Class.UNIVERSAL,type:z.Class.INTEGER,constructed:!1,capture:"trailer"}]}]},IV={name:"CertificationRequestInfo",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfo",value:[{name:"CertificationRequestInfo.integer",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certificationRequestInfoVersion"},{name:"CertificationRequestInfo.subject",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfoSubject"},y1,{name:"CertificationRequestInfo.attributes",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"certificationRequestInfoAttributes",value:[{name:"CertificationRequestInfo.attributes",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequestInfo.attributes.type",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1},{name:"CertificationRequestInfo.attributes.value",tagClass:z.Class.UNIVERSAL,type:z.Type.SET,constructed:!0}]}]}]},CV={name:"CertificationRequest",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"csr",value:[IV,{name:"CertificationRequest.signatureAlgorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequest.signatureAlgorithm.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"csrSignatureOid"},{name:"CertificationRequest.signatureAlgorithm.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"csrSignatureParams"}]},{name:"CertificationRequest.signature",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"csrSignature"}]};g.RDNAttributesAsArray=function($,J){var X=[],Q,Y,G;for(var W=0;W<$.value.length;++W){Q=$.value[W];for(var U=0;U<Q.value.length;++U){if(G={},Y=Q.value[U],G.type=z.derToOid(Y.value[0].value),G.value=Y.value[1].value,G.valueTagClass=Y.value[1].type,G.type in w$){if(G.name=w$[G.type],G.name in r$)G.shortName=r$[G.name]}if(J)J.update(G.type),J.update(G.value);X.push(G)}}return X};g.CRIAttributesAsArray=function($){var J=[];for(var X=0;X<$.length;++X){var Q=$[X],Y=z.derToOid(Q.value[0].value),G=Q.value[1].value;for(var W=0;W<G.length;++W){var U={};if(U.type=Y,U.value=G[W].value,U.valueTagClass=G[W].type,U.type in w$){if(U.name=w$[U.type],U.name in r$)U.shortName=r$[U.name]}if(U.type===w$.extensionRequest){U.extensions=[];for(var M=0;M<U.value.length;++M)U.extensions.push(g.certificateExtensionFromAsn1(U.value[M]))}J.push(U)}}return J};function k0($,J){if(typeof J==="string")J={shortName:J};var X=null,Q;for(var Y=0;X===null&&Y<$.attributes.length;++Y)if(Q=$.attributes[Y],J.type&&J.type===Q.type)X=Q;else if(J.name&&J.name===Q.name)X=Q;else if(J.shortName&&J.shortName===Q.shortName)X=Q;return X}var bY=function($,J,X){var Q={};if($!==w$["RSASSA-PSS"])return Q;if(X)Q={hash:{algorithmOid:w$.sha1},mgf:{algorithmOid:w$.mgf1,hash:{algorithmOid:w$.sha1}},saltLength:20};var Y={},G=[];if(!z.validate(J,SV,Y,G)){var W=Error("Cannot read RSASSA-PSS parameter block.");throw W.errors=G,W}if(Y.hashOid!==void 0)Q.hash=Q.hash||{},Q.hash.algorithmOid=z.derToOid(Y.hashOid);if(Y.maskGenOid!==void 0)Q.mgf=Q.mgf||{},Q.mgf.algorithmOid=z.derToOid(Y.maskGenOid),Q.mgf.hash=Q.mgf.hash||{},Q.mgf.hash.algorithmOid=z.derToOid(Y.maskGenHashOid);if(Y.saltLength!==void 0)Q.saltLength=Y.saltLength.charCodeAt(0);return Q},hY=function($){switch(w$[$.signatureOid]){case"sha1WithRSAEncryption":case"sha1WithRSASignature":return X$.md.sha1.create();case"md5WithRSAEncryption":return X$.md.md5.create();case"sha256WithRSAEncryption":return X$.md.sha256.create();case"sha384WithRSAEncryption":return X$.md.sha384.create();case"sha512WithRSAEncryption":return X$.md.sha512.create();case"RSASSA-PSS":return X$.md.sha256.create();default:var J=Error("Could not compute "+$.type+" digest. Unknown signature OID.");throw J.signatureOid=$.signatureOid,J}},b1=function($){var J=$.certificate,X;switch(J.signatureOid){case w$.sha1WithRSAEncryption:case w$.sha1WithRSASignature:break;case w$["RSASSA-PSS"]:var Q,Y;if(Q=w$[J.signatureParameters.mgf.hash.algorithmOid],Q===void 0||X$.md[Q]===void 0){var G=Error("Unsupported MGF hash function.");throw G.oid=J.signatureParameters.mgf.hash.algorithmOid,G.name=Q,G}if(Y=w$[J.signatureParameters.mgf.algorithmOid],Y===void 0||X$.mgf[Y]===void 0){var G=Error("Unsupported MGF function.");throw G.oid=J.signatureParameters.mgf.algorithmOid,G.name=Y,G}if(Y=X$.mgf[Y].create(X$.md[Q].create()),Q=w$[J.signatureParameters.hash.algorithmOid],Q===void 0||X$.md[Q]===void 0){var G=Error("Unsupported RSASSA-PSS hash function.");throw G.oid=J.signatureParameters.hash.algorithmOid,G.name=Q,G}X=X$.pss.create(X$.md[Q].create(),Y,J.signatureParameters.saltLength);break}return J.publicKey.verify($.md.digest().getBytes(),$.signature,X)};g.certificateFromPem=function($,J,X){var Q=X$.pem.decode($)[0];if(Q.type!=="CERTIFICATE"&&Q.type!=="X509 CERTIFICATE"&&Q.type!=="TRUSTED CERTIFICATE"){var Y=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var G=z.fromDer(Q.body,X);return g.certificateFromAsn1(G,J)};g.certificateToPem=function($,J){var X={type:"CERTIFICATE",body:z.toDer(g.certificateToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.publicKeyFromPem=function($){var J=X$.pem.decode($)[0];if(J.type!=="PUBLIC KEY"&&J.type!=="RSA PUBLIC KEY"){var X=Error('Could not convert public key from PEM; PEM header type is not "PUBLIC KEY" or "RSA PUBLIC KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert public key from PEM; PEM is encrypted.");var Q=z.fromDer(J.body);return g.publicKeyFromAsn1(Q)};g.publicKeyToPem=function($,J){var X={type:"PUBLIC KEY",body:z.toDer(g.publicKeyToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.publicKeyToRSAPublicKeyPem=function($,J){var X={type:"RSA PUBLIC KEY",body:z.toDer(g.publicKeyToRSAPublicKey($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||X$.md.sha1.create(),Q=J.type||"RSAPublicKey",Y;switch(Q){case"RSAPublicKey":Y=z.toDer(g.publicKeyToRSAPublicKey($)).getBytes();break;case"SubjectPublicKeyInfo":Y=z.toDer(g.publicKeyToAsn1($)).getBytes();break;default:throw Error('Unknown fingerprint type "'+J.type+'".')}X.start(),X.update(Y);var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};g.certificationRequestFromPem=function($,J,X){var Q=X$.pem.decode($)[0];if(Q.type!=="CERTIFICATE REQUEST"){var Y=Error('Could not convert certification request from PEM; PEM header type is not "CERTIFICATE REQUEST".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certification request from PEM; PEM is encrypted.");var G=z.fromDer(Q.body,X);return g.certificationRequestFromAsn1(G,J)};g.certificationRequestToPem=function($,J){var X={type:"CERTIFICATE REQUEST",body:z.toDer(g.certificationRequestToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.createCertificate=function(){var $={};return $.version=2,$.serialNumber="00",$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.validity={},$.validity.notBefore=new Date,$.validity.notAfter=new Date,$.issuer={},$.issuer.getField=function(J){return k0($.issuer,J)},$.issuer.addField=function(J){kJ([J]),$.issuer.attributes.push(J)},$.issuer.attributes=[],$.issuer.hash=null,$.subject={},$.subject.getField=function(J){return k0($.subject,J)},$.subject.addField=function(J){kJ([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.extensions=[],$.publicKey=null,$.md=null,$.setSubject=function(J,X){if(kJ(J),$.subject.attributes=J,delete $.subject.uniqueId,X)$.subject.uniqueId=X;$.subject.hash=null},$.setIssuer=function(J,X){if(kJ(J),$.issuer.attributes=J,delete $.issuer.uniqueId,X)$.issuer.uniqueId=X;$.issuer.hash=null},$.setExtensions=function(J){for(var X=0;X<J.length;++X)h1(J[X],{cert:$});$.extensions=J},$.getExtension=function(J){if(typeof J==="string")J={name:J};var X=null,Q;for(var Y=0;X===null&&Y<$.extensions.length;++Y)if(Q=$.extensions[Y],J.id&&Q.id===J.id)X=Q;else if(J.name&&Q.name===J.name)X=Q;return X},$.sign=function(J,X){$.md=X||X$.md.sha1.create();var Q=w$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certificate digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.tbsCertificate=g.getTBSCertificate($);var G=z.toDer($.tbsCertificate);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(J){var X=!1;if(!$.issued(J)){var Q=J.issuer,Y=$.subject,G=Error("The parent certificate did not issue the given child certificate; the child certificate's issuer does not match the parent's subject.");throw G.expectedIssuer=Y.attributes,G.actualIssuer=Q.attributes,G}var W=J.md;if(W===null){W=hY({signatureOid:J.signatureOid,type:"certificate"});var U=J.tbsCertificate||g.getTBSCertificate(J),M=z.toDer(U);W.update(M.getBytes())}if(W!==null)X=b1({certificate:$,md:W,signature:J.signature});return X},$.isIssuer=function(J){var X=!1,Q=$.issuer,Y=J.subject;if(Q.hash&&Y.hash)X=Q.hash===Y.hash;else if(Q.attributes.length===Y.attributes.length){X=!0;var G,W;for(var U=0;X&&U<Q.attributes.length;++U)if(G=Q.attributes[U],W=Y.attributes[U],G.type!==W.type||G.value!==W.value)X=!1}return X},$.issued=function(J){return J.isIssuer($)},$.generateSubjectKeyIdentifier=function(){return g.getPublicKeyFingerprint($.publicKey,{type:"RSAPublicKey"})},$.verifySubjectKeyIdentifier=function(){var J=w$.subjectKeyIdentifier;for(var X=0;X<$.extensions.length;++X){var Q=$.extensions[X];if(Q.id===J){var Y=$.generateSubjectKeyIdentifier().getBytes();return X$.util.hexToBytes(Q.subjectKeyIdentifier)===Y}}return!1},$};g.certificateFromAsn1=function($,J){var X={},Q=[];if(!z.validate($,TV,X,Q)){var Y=Error("Cannot read X.509 certificate. ASN.1 object is not an X509v3 Certificate.");throw Y.errors=Q,Y}var G=z.derToOid(X.publicKeyOid);if(G!==g.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=g.createCertificate();W.version=X.certVersion?X.certVersion.charCodeAt(0):0;var U=X$.util.createBuffer(X.certSerialNumber);W.serialNumber=U.toHex(),W.signatureOid=X$.asn1.derToOid(X.certSignatureOid),W.signatureParameters=bY(W.signatureOid,X.certSignatureParams,!0),W.siginfo.algorithmOid=X$.asn1.derToOid(X.certinfoSignatureOid),W.siginfo.parameters=bY(W.siginfo.algorithmOid,X.certinfoSignatureParams,!1),W.signature=X.certSignature;var M=[];if(X.certValidity1UTCTime!==void 0)M.push(z.utcTimeToDate(X.certValidity1UTCTime));if(X.certValidity2GeneralizedTime!==void 0)M.push(z.generalizedTimeToDate(X.certValidity2GeneralizedTime));if(X.certValidity3UTCTime!==void 0)M.push(z.utcTimeToDate(X.certValidity3UTCTime));if(X.certValidity4GeneralizedTime!==void 0)M.push(z.generalizedTimeToDate(X.certValidity4GeneralizedTime));if(M.length>2)throw Error("Cannot read notBefore/notAfter validity times; more than two times were provided in the certificate.");if(M.length<2)throw Error("Cannot read notBefore/notAfter validity times; they were not provided as either UTCTime or GeneralizedTime.");if(W.validity.notBefore=M[0],W.validity.notAfter=M[1],W.tbsCertificate=X.tbsCertificate,J){W.md=hY({signatureOid:W.signatureOid,type:"certificate"});var O=z.toDer(W.tbsCertificate);W.md.update(O.getBytes())}var V=X$.md.sha1.create(),H=z.toDer(X.certIssuer);if(V.update(H.getBytes()),W.issuer.getField=function(K){return k0(W.issuer,K)},W.issuer.addField=function(K){kJ([K]),W.issuer.attributes.push(K)},W.issuer.attributes=g.RDNAttributesAsArray(X.certIssuer),X.certIssuerUniqueId)W.issuer.uniqueId=X.certIssuerUniqueId;W.issuer.hash=V.digest().toHex();var q=X$.md.sha1.create(),F=z.toDer(X.certSubject);if(q.update(F.getBytes()),W.subject.getField=function(K){return k0(W.subject,K)},W.subject.addField=function(K){kJ([K]),W.subject.attributes.push(K)},W.subject.attributes=g.RDNAttributesAsArray(X.certSubject),X.certSubjectUniqueId)W.subject.uniqueId=X.certSubjectUniqueId;if(W.subject.hash=q.digest().toHex(),X.certExtensions)W.extensions=g.certificateExtensionsFromAsn1(X.certExtensions);else W.extensions=[];return W.publicKey=g.publicKeyFromAsn1(X.subjectPublicKeyInfo),W};g.certificateExtensionsFromAsn1=function($){var J=[];for(var X=0;X<$.value.length;++X){var Q=$.value[X];for(var Y=0;Y<Q.value.length;++Y)J.push(g.certificateExtensionFromAsn1(Q.value[Y]))}return J};g.certificateExtensionFromAsn1=function($){var J={};if(J.id=z.derToOid($.value[0].value),J.critical=!1,$.value[1].type===z.Type.BOOLEAN)J.critical=$.value[1].value.charCodeAt(0)!==0,J.value=$.value[2].value;else J.value=$.value[1].value;if(J.id in w$){if(J.name=w$[J.id],J.name==="keyUsage"){var X=z.fromDer(J.value),Q=0,Y=0;if(X.value.length>1)Q=X.value.charCodeAt(1),Y=X.value.length>2?X.value.charCodeAt(2):0;J.digitalSignature=(Q&128)===128,J.nonRepudiation=(Q&64)===64,J.keyEncipherment=(Q&32)===32,J.dataEncipherment=(Q&16)===16,J.keyAgreement=(Q&8)===8,J.keyCertSign=(Q&4)===4,J.cRLSign=(Q&2)===2,J.encipherOnly=(Q&1)===1,J.decipherOnly=(Y&128)===128}else if(J.name==="basicConstraints"){var X=z.fromDer(J.value);if(X.value.length>0&&X.value[0].type===z.Type.BOOLEAN)J.cA=X.value[0].value.charCodeAt(0)!==0;else J.cA=!1;var G=null;if(X.value.length>0&&X.value[0].type===z.Type.INTEGER)G=X.value[0].value;else if(X.value.length>1)G=X.value[1].value;if(G!==null)J.pathLenConstraint=z.derToInteger(G)}else if(J.name==="extKeyUsage"){var X=z.fromDer(J.value);for(var W=0;W<X.value.length;++W){var U=z.derToOid(X.value[W].value);if(U in w$)J[w$[U]]=!0;else J[U]=!0}}else if(J.name==="nsCertType"){var X=z.fromDer(J.value),Q=0;if(X.value.length>1)Q=X.value.charCodeAt(1);J.client=(Q&128)===128,J.server=(Q&64)===64,J.email=(Q&32)===32,J.objsign=(Q&16)===16,J.reserved=(Q&8)===8,J.sslCA=(Q&4)===4,J.emailCA=(Q&2)===2,J.objCA=(Q&1)===1}else if(J.name==="subjectAltName"||J.name==="issuerAltName"){J.altNames=[];var M,X=z.fromDer(J.value);for(var O=0;O<X.value.length;++O){M=X.value[O];var V={type:M.type,value:M.value};switch(J.altNames.push(V),M.type){case 1:case 2:case 6:break;case 7:V.ip=X$.util.bytesToIP(M.value);break;case 8:V.oid=z.derToOid(M.value);break;default:}}}else if(J.name==="subjectKeyIdentifier"){var X=z.fromDer(J.value);J.subjectKeyIdentifier=X$.util.bytesToHex(X.value)}}return J};g.certificationRequestFromAsn1=function($,J){var X={},Q=[];if(!z.validate($,CV,X,Q)){var Y=Error("Cannot read PKCS#10 certificate request. ASN.1 object is not a PKCS#10 CertificationRequest.");throw Y.errors=Q,Y}var G=z.derToOid(X.publicKeyOid);if(G!==g.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=g.createCertificationRequest();if(W.version=X.csrVersion?X.csrVersion.charCodeAt(0):0,W.signatureOid=X$.asn1.derToOid(X.csrSignatureOid),W.signatureParameters=bY(W.signatureOid,X.csrSignatureParams,!0),W.siginfo.algorithmOid=X$.asn1.derToOid(X.csrSignatureOid),W.siginfo.parameters=bY(W.siginfo.algorithmOid,X.csrSignatureParams,!1),W.signature=X.csrSignature,W.certificationRequestInfo=X.certificationRequestInfo,J){W.md=hY({signatureOid:W.signatureOid,type:"certification request"});var U=z.toDer(W.certificationRequestInfo);W.md.update(U.getBytes())}var M=X$.md.sha1.create();return W.subject.getField=function(O){return k0(W.subject,O)},W.subject.addField=function(O){kJ([O]),W.subject.attributes.push(O)},W.subject.attributes=g.RDNAttributesAsArray(X.certificationRequestInfoSubject,M),W.subject.hash=M.digest().toHex(),W.publicKey=g.publicKeyFromAsn1(X.subjectPublicKeyInfo),W.getAttribute=function(O){return k0(W,O)},W.addAttribute=function(O){kJ([O]),W.attributes.push(O)},W.attributes=g.CRIAttributesAsArray(X.certificationRequestInfoAttributes||[]),W};g.createCertificationRequest=function(){var $={};return $.version=0,$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.subject={},$.subject.getField=function(J){return k0($.subject,J)},$.subject.addField=function(J){kJ([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.publicKey=null,$.attributes=[],$.getAttribute=function(J){return k0($,J)},$.addAttribute=function(J){kJ([J]),$.attributes.push(J)},$.md=null,$.setSubject=function(J){kJ(J),$.subject.attributes=J,$.subject.hash=null},$.setAttributes=function(J){kJ(J),$.attributes=J},$.sign=function(J,X){$.md=X||X$.md.sha1.create();var Q=w$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certification request digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.certificationRequestInfo=g.getCertificationRequestInfo($);var G=z.toDer($.certificationRequestInfo);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(){var J=!1,X=$.md;if(X===null){X=hY({signatureOid:$.signatureOid,type:"certification request"});var Q=$.certificationRequestInfo||g.getCertificationRequestInfo($),Y=z.toDer(Q);X.update(Y.getBytes())}if(X!==null)J=b1({certificate:$,md:X,signature:$.signature});return J},$};function xQ($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),X,Q,Y=$.attributes;for(var G=0;G<Y.length;++G){X=Y[G];var W=X.value,U=z.Type.PRINTABLESTRING;if("valueTagClass"in X){if(U=X.valueTagClass,U===z.Type.UTF8)W=X$.util.encodeUtf8(W)}Q=z.create(z.Class.UNIVERSAL,z.Type.SET,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(X.type).getBytes()),z.create(z.Class.UNIVERSAL,U,!1,W)])]),J.value.push(Q)}return J}function kJ($){var J;for(var X=0;X<$.length;++X){if(J=$[X],typeof J.name>"u"){if(J.type&&J.type in g.oids)J.name=g.oids[J.type];else if(J.shortName&&J.shortName in r$)J.name=g.oids[r$[J.shortName]]}if(typeof J.type>"u")if(J.name&&J.name in g.oids)J.type=g.oids[J.name];else{var Q=Error("Attribute type not specified.");throw Q.attribute=J,Q}if(typeof J.shortName>"u"){if(J.name&&J.name in r$)J.shortName=r$[J.name]}if(J.type===w$.extensionRequest){if(J.valueConstructed=!0,J.valueTagClass=z.Type.SEQUENCE,!J.value&&J.extensions){J.value=[];for(var Y=0;Y<J.extensions.length;++Y)J.value.push(g.certificateExtensionToAsn1(h1(J.extensions[Y])))}}if(typeof J.value>"u"){var Q=Error("Attribute value not specified.");throw Q.attribute=J,Q}}}function h1($,J){if(J=J||{},typeof $.name>"u"){if($.id&&$.id in g.oids)$.name=g.oids[$.id]}if(typeof $.id>"u")if($.name&&$.name in g.oids)$.id=g.oids[$.name];else{var X=Error("Extension ID not specified.");throw X.extension=$,X}if(typeof $.value<"u")return $;if($.name==="keyUsage"){var Q=0,Y=0,G=0;if($.digitalSignature)Y|=128,Q=7;if($.nonRepudiation)Y|=64,Q=6;if($.keyEncipherment)Y|=32,Q=5;if($.dataEncipherment)Y|=16,Q=4;if($.keyAgreement)Y|=8,Q=3;if($.keyCertSign)Y|=4,Q=2;if($.cRLSign)Y|=2,Q=1;if($.encipherOnly)Y|=1,Q=0;if($.decipherOnly)G|=128,Q=7;var W=String.fromCharCode(Q);if(G!==0)W+=String.fromCharCode(Y)+String.fromCharCode(G);else if(Y!==0)W+=String.fromCharCode(Y);$.value=z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,W)}else if($.name==="basicConstraints"){if($.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),$.cA)$.value.value.push(z.create(z.Class.UNIVERSAL,z.Type.BOOLEAN,!1,String.fromCharCode(255)));if("pathLenConstraint"in $)$.value.value.push(z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.pathLenConstraint).getBytes()))}else if($.name==="extKeyUsage"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value;for(var M in $){if($[M]!==!0)continue;if(M in w$)U.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(w$[M]).getBytes()));else if(M.indexOf(".")!==-1)U.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(M).getBytes()))}}else if($.name==="nsCertType"){var Q=0,Y=0;if($.client)Y|=128,Q=7;if($.server)Y|=64,Q=6;if($.email)Y|=32,Q=5;if($.objsign)Y|=16,Q=4;if($.reserved)Y|=8,Q=3;if($.sslCA)Y|=4,Q=2;if($.emailCA)Y|=2,Q=1;if($.objCA)Y|=1,Q=0;var W=String.fromCharCode(Q);if(Y!==0)W+=String.fromCharCode(Y);$.value=z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,W)}else if($.name==="subjectAltName"||$.name==="issuerAltName"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var O;for(var V=0;V<$.altNames.length;++V){O=$.altNames[V];var W=O.value;if(O.type===7&&O.ip){if(W=X$.util.bytesFromIP(O.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(O.type===8)if(O.oid)W=z.oidToDer(z.oidToDer(O.oid));else W=z.oidToDer(W);$.value.value.push(z.create(z.Class.CONTEXT_SPECIFIC,O.type,!1,W))}}else if($.name==="nsComment"&&J.cert){if(!/^[\x00-\x7F]*$/.test($.comment)||$.comment.length<1||$.comment.length>128)throw Error('Invalid "nsComment" content.');$.value=z.create(z.Class.UNIVERSAL,z.Type.IA5STRING,!1,$.comment)}else if($.name==="subjectKeyIdentifier"&&J.cert){var H=J.cert.generateSubjectKeyIdentifier();$.subjectKeyIdentifier=H.toHex(),$.value=z.create(z.Class.UNIVERSAL,z.Type.OCTETSTRING,!1,H.getBytes())}else if($.name==="authorityKeyIdentifier"&&J.cert){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value;if($.keyIdentifier){var q=$.keyIdentifier===!0?J.cert.generateSubjectKeyIdentifier().getBytes():$.keyIdentifier;U.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!1,q))}if($.authorityCertIssuer){var F=[z.create(z.Class.CONTEXT_SPECIFIC,4,!0,[xQ($.authorityCertIssuer===!0?J.cert.issuer:$.authorityCertIssuer)])];U.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,F))}if($.serialNumber){var K=X$.util.hexToBytes($.serialNumber===!0?J.cert.serialNumber:$.serialNumber);U.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!1,K))}}else if($.name==="cRLDistributionPoints"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value,A=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),L=z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[]),O;for(var V=0;V<$.altNames.length;++V){O=$.altNames[V];var W=O.value;if(O.type===7&&O.ip){if(W=X$.util.bytesFromIP(O.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(O.type===8)if(O.oid)W=z.oidToDer(z.oidToDer(O.oid));else W=z.oidToDer(W);L.value.push(z.create(z.Class.CONTEXT_SPECIFIC,O.type,!1,W))}A.value.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[L])),U.push(A)}if(typeof $.value>"u"){var X=Error("Extension value not specified.");throw X.extension=$,X}return $}function D8($,J){switch($){case w$["RSASSA-PSS"]:var X=[];if(J.hash.algorithmOid!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.hash.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")])]));if(J.mgf.algorithmOid!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.mgf.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.mgf.hash.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")])])]));if(J.saltLength!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer(J.saltLength).getBytes())]));return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,X);default:return z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")}}function wV($){var J=z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[]);if($.attributes.length===0)return J;var X=$.attributes;for(var Q=0;Q<X.length;++Q){var Y=X[Q],G=Y.value,W=z.Type.UTF8;if("valueTagClass"in Y)W=Y.valueTagClass;if(W===z.Type.UTF8)G=X$.util.encodeUtf8(G);var U=!1;if("valueConstructed"in Y)U=Y.valueConstructed;var M=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(Y.type).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.SET,!0,[z.create(z.Class.UNIVERSAL,W,U,G)])]);J.value.push(M)}return J}var PV=new Date("1950-01-01T00:00:00Z"),_V=new Date("2050-01-01T00:00:00Z");function f1($){if($>=PV&&$<_V)return z.create(z.Class.UNIVERSAL,z.Type.UTCTIME,!1,z.dateToUtcTime($));else return z.create(z.Class.UNIVERSAL,z.Type.GENERALIZEDTIME,!1,z.dateToGeneralizedTime($))}g.getTBSCertificate=function($){var J=f1($.validity.notBefore),X=f1($.validity.notAfter),Q=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.version).getBytes())]),z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,X$.util.hexToBytes($.serialNumber)),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.siginfo.algorithmOid).getBytes()),D8($.siginfo.algorithmOid,$.siginfo.parameters)]),xQ($.issuer),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,X]),xQ($.subject),g.publicKeyToAsn1($.publicKey)]);if($.issuer.uniqueId)Q.value.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,[z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.issuer.uniqueId)]));if($.subject.uniqueId)Q.value.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!0,[z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.subject.uniqueId)]));if($.extensions.length>0)Q.value.push(g.certificateExtensionsToAsn1($.extensions));return Q};g.getCertificationRequestInfo=function($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.version).getBytes()),xQ($.subject),g.publicKeyToAsn1($.publicKey),wV($)]);return J};g.distinguishedNameToAsn1=function($){return xQ($)};g.certificateToAsn1=function($){var J=$.tbsCertificate||g.getTBSCertificate($);return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.signatureOid).getBytes()),D8($.signatureOid,$.signatureParameters)]),z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};g.certificateExtensionsToAsn1=function($){var J=z.create(z.Class.CONTEXT_SPECIFIC,3,!0,[]),X=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);J.value.push(X);for(var Q=0;Q<$.length;++Q)X.value.push(g.certificateExtensionToAsn1($[Q]));return J};g.certificateExtensionToAsn1=function($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);if(J.value.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.id).getBytes())),$.critical)J.value.push(z.create(z.Class.UNIVERSAL,z.Type.BOOLEAN,!1,String.fromCharCode(255)));var X=$.value;if(typeof $.value!=="string")X=z.toDer(X).getBytes();return J.value.push(z.create(z.Class.UNIVERSAL,z.Type.OCTETSTRING,!1,X)),J};g.certificationRequestToAsn1=function($){var J=$.certificationRequestInfo||g.getCertificationRequestInfo($);return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.signatureOid).getBytes()),D8($.signatureOid,$.signatureParameters)]),z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};g.createCaStore=function($){var J={certs:{}};J.getIssuer=function(W){var U=X(W.issuer);return U},J.addCertificate=function(W){if(typeof W==="string")W=X$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))if(W.subject.hash in J.certs){var U=J.certs[W.subject.hash];if(!X$.util.isArray(U))U=[U];U.push(W),J.certs[W.subject.hash]=U}else J.certs[W.subject.hash]=W},J.hasCertificate=function(W){if(typeof W==="string")W=X$.pki.certificateFromPem(W);var U=X(W.subject);if(!U)return!1;if(!X$.util.isArray(U))U=[U];var M=z.toDer(g.certificateToAsn1(W)).getBytes();for(var O=0;O<U.length;++O){var V=z.toDer(g.certificateToAsn1(U[O])).getBytes();if(M===V)return!0}return!1},J.listAllCertificates=function(){var W=[];for(var U in J.certs)if(J.certs.hasOwnProperty(U)){var M=J.certs[U];if(!X$.util.isArray(M))W.push(M);else for(var O=0;O<M.length;++O)W.push(M[O])}return W},J.removeCertificate=function(W){var U;if(typeof W==="string")W=X$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))return null;var M=X(W.subject);if(!X$.util.isArray(M))return U=J.certs[W.subject.hash],delete J.certs[W.subject.hash],U;var O=z.toDer(g.certificateToAsn1(W)).getBytes();for(var V=0;V<M.length;++V){var H=z.toDer(g.certificateToAsn1(M[V])).getBytes();if(O===H)U=M[V],M.splice(V,1)}if(M.length===0)delete J.certs[W.subject.hash];return U};function X(W){return Q(W),J.certs[W.hash]||null}function Q(W){if(!W.hash){var U=X$.md.sha1.create();W.attributes=g.RDNAttributesAsArray(xQ(W),U),W.hash=U.digest().toHex()}}if($)for(var Y=0;Y<$.length;++Y){var G=$[Y];J.addCertificate(G)}return J};g.certificateError={bad_certificate:"forge.pki.BadCertificate",unsupported_certificate:"forge.pki.UnsupportedCertificate",certificate_revoked:"forge.pki.CertificateRevoked",certificate_expired:"forge.pki.CertificateExpired",certificate_unknown:"forge.pki.CertificateUnknown",unknown_ca:"forge.pki.UnknownCertificateAuthority"};g.verifyCertificateChain=function($,J,X){if(typeof X==="function")X={verify:X};X=X||{},J=J.slice(0);var Q=J.slice(0),Y=X.validityCheckDate;if(typeof Y>"u")Y=new Date;var G=!0,W=null,U=0;do{var M=J.shift(),O=null,V=!1;if(Y){if(Y<M.validity.notBefore||Y>M.validity.notAfter)W={message:"Certificate is not valid yet or has expired.",error:g.certificateError.certificate_expired,notBefore:M.validity.notBefore,notAfter:M.validity.notAfter,now:Y}}if(W===null){if(O=J[0]||$.getIssuer(M),O===null){if(M.isIssuer(M))V=!0,O=M}if(O){var H=O;if(!X$.util.isArray(H))H=[H];var q=!1;while(!q&&H.length>0){O=H.shift();try{q=O.verify(M)}catch(w){}}if(!q)W={message:"Certificate signature is invalid.",error:g.certificateError.bad_certificate}}if(W===null&&(!O||V)&&!$.hasCertificate(M))W={message:"Certificate is not trusted.",error:g.certificateError.unknown_ca}}if(W===null&&O&&!M.isIssuer(O))W={message:"Certificate issuer is invalid.",error:g.certificateError.bad_certificate};if(W===null){var F={keyUsage:!0,basicConstraints:!0};for(var K=0;W===null&&K<M.extensions.length;++K){var A=M.extensions[K];if(A.critical&&!(A.name in F))W={message:"Certificate has an unsupported critical extension.",error:g.certificateError.unsupported_certificate}}}if(W===null&&(!G||J.length===0&&(!O||V))){var L=M.getExtension("basicConstraints"),R=M.getExtension("keyUsage");if(R!==null){if(!R.keyCertSign||L===null)W={message:"Certificate keyUsage or basicConstraints conflict or indicate that the certificate is not a CA. If the certificate is the only one in the chain or isn't the first then the certificate must be a valid CA.",error:g.certificateError.bad_certificate}}if(W===null&&L===null)W={message:"Certificate is missing basicConstraints extension and cannot be used as a CA.",error:g.certificateError.bad_certificate};if(W===null&&L!==null&&!L.cA)W={message:"Certificate basicConstraints indicates the certificate is not a CA.",error:g.certificateError.bad_certificate};if(W===null&&R!==null&&"pathLenConstraint"in L){var I=U-1;if(I>L.pathLenConstraint)W={message:"Certificate basicConstraints pathLenConstraint violated.",error:g.certificateError.bad_certificate}}}var j=W===null?!0:W.error,C=X.verify?X.verify(j,U,Q):j;if(C===!0)W=null;else{if(j===!0)W={message:"The application rejected the certificate.",error:g.certificateError.bad_certificate};if(C||C===0){if(typeof C==="object"&&!X$.util.isArray(C)){if(C.message)W.message=C.message;if(C.error)W.error=C.error}else if(typeof C==="string")W.error=C}throw W}G=!1,++U}while(J.length>0);return!0}});var B8=H$((xF,m1)=>{var l$=F$();mJ();TQ();_0();A8();L8();_J();TX();wQ();_$();uY();var{asn1:D,pki:D$}=l$,IX=m1.exports=l$.pkcs12=l$.pkcs12||{},g1={name:"ContentInfo",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.contentType",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"content"}]},xV={name:"PFX",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.version",tagClass:D.Class.UNIVERSAL,type:D.Type.INTEGER,constructed:!1,capture:"version"},g1,{name:"PFX.macData",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"mac",value:[{name:"PFX.macData.mac",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm.algorithm",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"macAlgorithm"},{name:"PFX.macData.mac.digestAlgorithm.parameters",optional:!0,tagClass:D.Class.UNIVERSAL,captureAsn1:"macAlgorithmParameters"}]},{name:"PFX.macData.mac.digest",tagClass:D.Class.UNIVERSAL,type:D.Type.OCTETSTRING,constructed:!1,capture:"macDigest"}]},{name:"PFX.macData.macSalt",tagClass:D.Class.UNIVERSAL,type:D.Type.OCTETSTRING,constructed:!1,capture:"macSalt"},{name:"PFX.macData.iterations",tagClass:D.Class.UNIVERSAL,type:D.Type.INTEGER,constructed:!1,optional:!0,capture:"macIterations"}]}]},vV={name:"SafeBag",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"SafeBag.bagId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"bagId"},{name:"SafeBag.bagValue",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"bagValue"},{name:"SafeBag.bagAttributes",tagClass:D.Class.UNIVERSAL,type:D.Type.SET,constructed:!0,optional:!0,capture:"bagAttributes"}]},kV={name:"Attribute",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"Attribute.attrId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"oid"},{name:"Attribute.attrValues",tagClass:D.Class.UNIVERSAL,type:D.Type.SET,constructed:!0,capture:"values"}]},fV={name:"CertBag",tagClass:D.Class.UNIVERSAL,type:D.Type.SEQUENCE,constructed:!0,value:[{name:"CertBag.certId",tagClass:D.Class.UNIVERSAL,type:D.Type.OID,constructed:!1,capture:"certId"},{name:"CertBag.certValue",tagClass:D.Class.CONTEXT_SPECIFIC,constructed:!0,value:[{name:"CertBag.certValue[0]",tagClass:D.Class.UNIVERSAL,type:D.Class.OCTETSTRING,constructed:!1,capture:"cert"}]}]};function SX($,J,X,Q){var Y=[];for(var G=0;G<$.length;G++)for(var W=0;W<$[G].safeBags.length;W++){var U=$[G].safeBags[W];if(Q!==void 0&&U.type!==Q)continue;if(J===null){Y.push(U);continue}if(U.attributes[J]!==void 0&&U.attributes[J].indexOf(X)>=0)Y.push(U)}return Y}IX.pkcs12FromAsn1=function($,J,X){if(typeof J==="string")X=J,J=!0;else if(J===void 0)J=!0;var Q={},Y=[];if(!D.validate($,xV,Q,Y)){var G=Error("Cannot read PKCS#12 PFX. ASN.1 object is not an PKCS#12 PFX.");throw G.errors=G,G}var W={version:Q.version.charCodeAt(0),safeContents:[],getBags:function(L){var R={},I;if("localKeyId"in L)I=L.localKeyId;else if("localKeyIdHex"in L)I=l$.util.hexToBytes(L.localKeyIdHex);if(I===void 0&&!("friendlyName"in L)&&"bagType"in L)R[L.bagType]=SX(W.safeContents,null,null,L.bagType);if(I!==void 0)R.localKeyId=SX(W.safeContents,"localKeyId",I,L.bagType);if("friendlyName"in L)R.friendlyName=SX(W.safeContents,"friendlyName",L.friendlyName,L.bagType);return R},getBagsByFriendlyName:function(L,R){return SX(W.safeContents,"friendlyName",L,R)},getBagsByLocalKeyId:function(L,R){return SX(W.safeContents,"localKeyId",L,R)}};if(Q.version.charCodeAt(0)!==3){var G=Error("PKCS#12 PFX of version other than 3 not supported.");throw G.version=Q.version.charCodeAt(0),G}if(D.derToOid(Q.contentType)!==D$.oids.data){var G=Error("Only PKCS#12 PFX in password integrity mode supported.");throw G.oid=D.derToOid(Q.contentType),G}var U=Q.content.value[0];if(U.tagClass!==D.Class.UNIVERSAL||U.type!==D.Type.OCTETSTRING)throw Error("PKCS#12 authSafe content data is not an OCTET STRING.");if(U=Z8(U),Q.mac){var M=null,O=0,V=D.derToOid(Q.macAlgorithm);switch(V){case D$.oids.sha1:M=l$.md.sha1.create(),O=20;break;case D$.oids.sha256:M=l$.md.sha256.create(),O=32;break;case D$.oids.sha384:M=l$.md.sha384.create(),O=48;break;case D$.oids.sha512:M=l$.md.sha512.create(),O=64;break;case D$.oids.md5:M=l$.md.md5.create(),O=16;break}if(M===null)throw Error("PKCS#12 uses unsupported MAC algorithm: "+V);var H=new l$.util.ByteBuffer(Q.macSalt),q="macIterations"in Q?parseInt(l$.util.bytesToHex(Q.macIterations),16):1,F=IX.generateKey(X,H,3,q,O,M),K=l$.hmac.create();K.start(M,F),K.update(U.value);var A=K.getMac();if(A.getBytes()!==Q.macDigest)throw Error("PKCS#12 MAC could not be verified. Invalid password?")}else if(Array.isArray($.value)&&$.value.length>2)throw Error("Invalid PKCS#12. macData field present but MAC was not validated.");return yV(W,U.value,J,X),W};function Z8($){if($.composed||$.constructed){var J=l$.util.createBuffer();for(var X=0;X<$.value.length;++X)J.putBytes($.value[X].value);$.composed=$.constructed=!1,$.value=J.getBytes()}return $}function yV($,J,X,Q){if(J=D.fromDer(J,X),J.tagClass!==D.Class.UNIVERSAL||J.type!==D.Type.SEQUENCE||J.constructed!==!0)throw Error("PKCS#12 AuthenticatedSafe expected to be a SEQUENCE OF ContentInfo");for(var Y=0;Y<J.value.length;Y++){var G=J.value[Y],W={},U=[];if(!D.validate(G,g1,W,U)){var M=Error("Cannot read ContentInfo.");throw M.errors=U,M}var O={encrypted:!1},V=null,H=W.content.value[0];switch(D.derToOid(W.contentType)){case D$.oids.data:if(H.tagClass!==D.Class.UNIVERSAL||H.type!==D.Type.OCTETSTRING)throw Error("PKCS#12 SafeContents Data is not an OCTET STRING.");V=Z8(H).value;break;case D$.oids.encryptedData:V=bV(H,Q),O.encrypted=!0;break;default:var M=Error("Unsupported PKCS#12 contentType.");throw M.contentType=D.derToOid(W.contentType),M}O.safeBags=hV(V,X,Q),$.safeContents.push(O)}}function bV($,J){var X={},Q=[];if(!D.validate($,l$.pkcs7.asn1.encryptedDataValidator,X,Q)){var Y=Error("Cannot read EncryptedContentInfo.");throw Y.errors=Q,Y}var G=D.derToOid(X.contentType);if(G!==D$.oids.data){var Y=Error("PKCS#12 EncryptedContentInfo ContentType is not Data.");throw Y.oid=G,Y}G=D.derToOid(X.encAlgorithm);var W=D$.pbe.getCipher(G,X.encParameter,J),U=Z8(X.encryptedContentAsn1),M=l$.util.createBuffer(U.value);if(W.update(M),!W.finish())throw Error("Failed to decrypt PKCS#12 SafeContents.");return W.output.getBytes()}function hV($,J,X){if(!J&&$.length===0)return[];if($=D.fromDer($,J),$.tagClass!==D.Class.UNIVERSAL||$.type!==D.Type.SEQUENCE||$.constructed!==!0)throw Error("PKCS#12 SafeContents expected to be a SEQUENCE OF SafeBag.");var Q=[];for(var Y=0;Y<$.value.length;Y++){var G=$.value[Y],W={},U=[];if(!D.validate(G,vV,W,U)){var M=Error("Cannot read SafeBag.");throw M.errors=U,M}var O={type:D.derToOid(W.bagId),attributes:uV(W.bagAttributes)};Q.push(O);var V,H,q=W.bagValue.value[0];switch(O.type){case D$.oids.pkcs8ShroudedKeyBag:if(q=D$.decryptPrivateKeyInfo(q,X),q===null)throw Error("Unable to decrypt PKCS#8 ShroudedKeyBag, wrong password?");case D$.oids.keyBag:try{O.key=D$.privateKeyFromAsn1(q)}catch(K){O.key=null,O.asn1=q}continue;case D$.oids.certBag:V=fV,H=function(){if(D.derToOid(W.certId)!==D$.oids.x509Certificate){var K=Error("Unsupported certificate type, only X.509 supported.");throw K.oid=D.derToOid(W.certId),K}var A=D.fromDer(W.cert,J);try{O.cert=D$.certificateFromAsn1(A,!0)}catch(L){O.cert=null,O.asn1=A}};break;default:var M=Error("Unsupported PKCS#12 SafeBag type.");throw M.oid=O.type,M}if(V!==void 0&&!D.validate(q,V,W,U)){var M=Error("Cannot read PKCS#12 "+V.name);throw M.errors=U,M}H()}return Q}function uV($){var J={};if($!==void 0)for(var X=0;X<$.length;++X){var Q={},Y=[];if(!D.validate($[X],kV,Q,Y)){var G=Error("Cannot read PKCS#12 BagAttribute.");throw G.errors=Y,G}var W=D.derToOid(Q.oid);if(D$.oids[W]===void 0)continue;J[D$.oids[W]]=[];for(var U=0;U<Q.values.length;++U)J[D$.oids[W]].push(Q.values[U].value)}return J}IX.toPkcs12Asn1=function($,J,X,Q){if(Q=Q||{},Q.saltSize=Q.saltSize||8,Q.count=Q.count||2048,Q.algorithm=Q.algorithm||Q.encAlgorithm||"aes128",!("useMac"in Q))Q.useMac=!0;if(!("localKeyId"in Q))Q.localKeyId=null;if(!("generateLocalKeyId"in Q))Q.generateLocalKeyId=!0;var Y=Q.localKeyId,G;if(Y!==null)Y=l$.util.hexToBytes(Y);else if(Q.generateLocalKeyId)if(J){var W=l$.util.isArray(J)?J[0]:J;if(typeof W==="string")W=D$.certificateFromPem(W);var U=l$.md.sha1.create();U.update(D.toDer(D$.certificateToAsn1(W)).getBytes()),Y=U.digest().getBytes()}else Y=l$.random.getBytes(20);var M=[];if(Y!==null)M.push(D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.localKeyId).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SET,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,Y)])]));if("friendlyName"in Q)M.push(D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.friendlyName).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SET,!0,[D.create(D.Class.UNIVERSAL,D.Type.BMPSTRING,!1,Q.friendlyName)])]));if(M.length>0)G=D.create(D.Class.UNIVERSAL,D.Type.SET,!0,M);var O=[],V=[];if(J!==null)if(l$.util.isArray(J))V=J;else V=[J];var H=[];for(var q=0;q<V.length;++q){if(J=V[q],typeof J==="string")J=D$.certificateFromPem(J);var F=q===0?G:void 0,K=D$.certificateToAsn1(J),A=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.certBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.x509Certificate).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(K).getBytes())])])]),F]);H.push(A)}if(H.length>0){var L=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,H),R=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(L).getBytes())])]);O.push(R)}var I=null;if($!==null){var j=D$.wrapRsaPrivateKey(D$.privateKeyToAsn1($));if(X===null)I=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.keyBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[j]),G]);else I=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.pkcs8ShroudedKeyBag).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D$.encryptPrivateKeyInfo(j,X,Q)]),G]);var C=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[I]),w=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(C).getBytes())])]);O.push(w)}var P=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,O),l;if(Q.useMac){var U=l$.md.sha1.create(),e=new l$.util.ByteBuffer(l$.random.getBytes(Q.saltSize)),y=Q.count,$=IX.generateKey(X,e,3,y,20),n=l$.hmac.create();n.start(U,$),n.update(D.toDer(P).getBytes());var Y$=n.getMac();l=D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.sha1).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.NULL,!1,"")]),D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,Y$.getBytes())]),D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,e.getBytes()),D.create(D.Class.UNIVERSAL,D.Type.INTEGER,!1,D.integerToDer(y).getBytes())])}return D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.INTEGER,!1,D.integerToDer(3).getBytes()),D.create(D.Class.UNIVERSAL,D.Type.SEQUENCE,!0,[D.create(D.Class.UNIVERSAL,D.Type.OID,!1,D.oidToDer(D$.oids.data).getBytes()),D.create(D.Class.CONTEXT_SPECIFIC,0,!0,[D.create(D.Class.UNIVERSAL,D.Type.OCTETSTRING,!1,D.toDer(P).getBytes())])]),l])};IX.generateKey=l$.pbe.generatePkcs12Key});var T8=H$((vF,l1)=>{var f0=F$();mJ();_0();L8();QQ();wY();B8();yY();TX();_$();uY();var j8=f0.asn1,vQ=l1.exports=f0.pki=f0.pki||{};vQ.pemToDer=function($){var J=f0.pem.decode($)[0];if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PEM to DER; PEM is encrypted.");return f0.util.createBuffer(J.body)};vQ.privateKeyFromPem=function($){var J=f0.pem.decode($)[0];if(J.type!=="PRIVATE KEY"&&J.type!=="RSA PRIVATE KEY"){var X=Error('Could not convert private key from PEM; PEM header type is not "PRIVATE KEY" or "RSA PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert private key from PEM; PEM is encrypted.");var Q=j8.fromDer(J.body);return vQ.privateKeyFromAsn1(Q)};vQ.privateKeyToPem=function($,J){var X={type:"RSA PRIVATE KEY",body:j8.toDer(vQ.privateKeyToAsn1($)).getBytes()};return f0.pem.encode(X,{maxline:J})};vQ.privateKeyInfoToPem=function($,J){var X={type:"PRIVATE KEY",body:j8.toDer($).getBytes()};return f0.pem.encode(X,{maxline:J})}});var _8=H$((kF,s1)=>{var f=F$();mJ();TQ();TY();QQ();T8();_J();wQ();_$();var lY=function($,J,X,Q){var Y=f.util.createBuffer(),G=$.length>>1,W=G+($.length&1),U=$.substr(0,W),M=$.substr(G,W),O=f.util.createBuffer(),V=f.hmac.create();X=J+X;var H=Math.ceil(Q/16),q=Math.ceil(Q/20);V.start("MD5",U);var F=f.util.createBuffer();O.putBytes(X);for(var K=0;K<H;++K)V.start(null,null),V.update(O.getBytes()),O.putBuffer(V.digest()),V.start(null,null),V.update(O.bytes()+X),F.putBuffer(V.digest());V.start("SHA1",M);var A=f.util.createBuffer();O.clear(),O.putBytes(X);for(var K=0;K<q;++K)V.start(null,null),V.update(O.getBytes()),O.putBuffer(V.digest()),V.start(null,null),V.update(O.bytes()+X),A.putBuffer(V.digest());return Y.putBytes(f.util.xorBytes(F.getBytes(),A.getBytes(),Q)),Y},gV=function($,J,X){var Q=f.hmac.create();Q.start("SHA1",$);var Y=f.util.createBuffer();return Y.putInt32(J[0]),Y.putInt32(J[1]),Y.putByte(X.type),Y.putByte(X.version.major),Y.putByte(X.version.minor),Y.putInt16(X.length),Y.putBytes(X.fragment.bytes()),Q.update(Y.getBytes()),Q.digest().getBytes()},mV=function($,J,X){var Q=!1;try{var Y=$.deflate(J.fragment.getBytes());J.fragment=f.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},lV=function($,J,X){var Q=!1;try{var Y=$.inflate(J.fragment.getBytes());J.fragment=f.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},SJ=function($,J){var X=0;switch(J){case 1:X=$.getByte();break;case 2:X=$.getInt16();break;case 3:X=$.getInt24();break;case 4:X=$.getInt32();break}return f.util.createBuffer($.getBytes(X))},fJ=function($,J,X){$.putInt(X.length(),J<<3),$.putBuffer(X)},N={};N.Versions={TLS_1_0:{major:3,minor:1},TLS_1_1:{major:3,minor:2},TLS_1_2:{major:3,minor:3}};N.SupportedVersions=[N.Versions.TLS_1_1,N.Versions.TLS_1_0];N.Version=N.SupportedVersions[0];N.MaxFragment=15360;N.ConnectionEnd={server:0,client:1};N.PRFAlgorithm={tls_prf_sha256:0};N.BulkCipherAlgorithm={none:null,rc4:0,des3:1,aes:2};N.CipherType={stream:0,block:1,aead:2};N.MACAlgorithm={none:null,hmac_md5:0,hmac_sha1:1,hmac_sha256:2,hmac_sha384:3,hmac_sha512:4};N.CompressionMethod={none:0,deflate:1};N.ContentType={change_cipher_spec:20,alert:21,handshake:22,application_data:23,heartbeat:24};N.HandshakeType={hello_request:0,client_hello:1,server_hello:2,certificate:11,server_key_exchange:12,certificate_request:13,server_hello_done:14,certificate_verify:15,client_key_exchange:16,finished:20};N.Alert={};N.Alert.Level={warning:1,fatal:2};N.Alert.Description={close_notify:0,unexpected_message:10,bad_record_mac:20,decryption_failed:21,record_overflow:22,decompression_failure:30,handshake_failure:40,bad_certificate:42,unsupported_certificate:43,certificate_revoked:44,certificate_expired:45,certificate_unknown:46,illegal_parameter:47,unknown_ca:48,access_denied:49,decode_error:50,decrypt_error:51,export_restriction:60,protocol_version:70,insufficient_security:71,internal_error:80,user_canceled:90,no_renegotiation:100};N.HeartbeatMessageType={heartbeat_request:1,heartbeat_response:2};N.CipherSuites={};N.getCipherSuite=function($){var J=null;for(var X in N.CipherSuites){var Q=N.CipherSuites[X];if(Q.id[0]===$.charCodeAt(0)&&Q.id[1]===$.charCodeAt(1)){J=Q;break}}return J};N.handleUnexpected=function($,J){var X=!$.open&&$.entity===N.ConnectionEnd.client;if(!X)$.error($,{message:"Unexpected message. Received TLS record out of order.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unexpected_message}})};N.handleHelloRequest=function($,J,X){if(!$.handshaking&&$.handshakes>0)N.queue($,N.createAlert($,{level:N.Alert.Level.warning,description:N.Alert.Description.no_renegotiation})),N.flush($);$.process()};N.parseHelloMessage=function($,J,X){var Q=null,Y=$.entity===N.ConnectionEnd.client;if(X<38)$.error($,{message:Y?"Invalid ServerHello message. Message too short.":"Invalid ClientHello message. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});else{var G=J.fragment,W=G.length();if(Q={version:{major:G.getByte(),minor:G.getByte()},random:f.util.createBuffer(G.getBytes(32)),session_id:SJ(G,1),extensions:[]},Y)Q.cipher_suite=G.getBytes(2),Q.compression_method=G.getByte();else Q.cipher_suites=SJ(G,2),Q.compression_methods=SJ(G,1);if(W=X-(W-G.length()),W>0){var U=SJ(G,2);while(U.length()>0)Q.extensions.push({type:[U.getByte(),U.getByte()],data:SJ(U,2)});if(!Y)for(var M=0;M<Q.extensions.length;++M){var O=Q.extensions[M];if(O.type[0]===0&&O.type[1]===0){var V=SJ(O.data,2);while(V.length()>0){var H=V.getByte();if(H!==0)break;$.session.extensions.server_name.serverNameList.push(SJ(V,2).getBytes())}}}}if($.session.version){if(Q.version.major!==$.session.version.major||Q.version.minor!==$.session.version.minor)return $.error($,{message:"TLS version change is disallowed during renegotiation.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}})}if(Y)$.session.cipherSuite=N.getCipherSuite(Q.cipher_suite);else{var q=f.util.createBuffer(Q.cipher_suites.bytes());while(q.length()>0)if($.session.cipherSuite=N.getCipherSuite(q.getBytes(2)),$.session.cipherSuite!==null)break}if($.session.cipherSuite===null)return $.error($,{message:"No cipher suites in common.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.handshake_failure},cipherSuite:f.util.bytesToHex(Q.cipher_suite)});if(Y)$.session.compressionMethod=Q.compression_method;else $.session.compressionMethod=N.CompressionMethod.none}return Q};N.createSecurityParameters=function($,J){var X=$.entity===N.ConnectionEnd.client,Q=J.random.bytes(),Y=X?$.session.sp.client_random:Q,G=X?Q:N.createRandom().getBytes();$.session.sp={entity:$.entity,prf_algorithm:N.PRFAlgorithm.tls_prf_sha256,bulk_cipher_algorithm:null,cipher_type:null,enc_key_length:null,block_length:null,fixed_iv_length:null,record_iv_length:null,mac_algorithm:null,mac_length:null,mac_key_length:null,compression_algorithm:$.session.compressionMethod,pre_master_secret:null,master_secret:null,client_random:Y,server_random:G}};N.handleServerHello=function($,J,X){var Q=N.parseHelloMessage($,J,X);if($.fail)return;if(Q.version.minor<=$.version.minor)$.version.minor=Q.version.minor;else return $.error($,{message:"Incompatible TLS version.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}});$.session.version=$.version;var Y=Q.session_id.bytes();if(Y.length>0&&Y===$.session.id)$.expect=c1,$.session.resuming=!0,$.session.sp.server_random=Q.random.bytes();else $.expect=dV,$.session.resuming=!1,N.createSecurityParameters($,Q);$.session.id=Y,$.process()};N.handleClientHello=function($,J,X){var Q=N.parseHelloMessage($,J,X);if($.fail)return;var Y=Q.session_id.bytes(),G=null;if($.sessionCache){if(G=$.sessionCache.getSession(Y),G===null)Y="";else if(G.version.major!==Q.version.major||G.version.minor>Q.version.minor)G=null,Y=""}if(Y.length===0)Y=f.random.getBytes(32);if($.session.id=Y,$.session.clientHelloVersion=Q.version,$.session.sp={},G)$.version=$.session.version=G.version,$.session.sp=G.sp;else{var W;for(var U=1;U<N.SupportedVersions.length;++U)if(W=N.SupportedVersions[U],W.minor<=Q.version.minor)break;$.version={major:W.major,minor:W.minor},$.session.version=$.version}if(G!==null)$.expect=w8,$.session.resuming=!0,$.session.sp.client_random=Q.random.bytes();else $.expect=$.verifyClient!==!1?rV:C8,$.session.resuming=!1,N.createSecurityParameters($,Q);if($.open=!0,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerHello($)})),$.session.resuming)N.queue($,N.createRecord($,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),$.state.pending=N.createConnectionState($),$.state.current.write=$.state.pending.write,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createFinished($)}));else if(N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificate($)})),!$.fail){if(N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerKeyExchange($)})),$.verifyClient!==!1)N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificateRequest($)}));N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerHelloDone($)}))}N.flush($),$.process()};N.handleCertificate=function($,J,X){if(X<3)return $.error($,{message:"Invalid Certificate message. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_list:SJ(Q,3)},G,W,U=[];try{while(Y.certificate_list.length()>0)G=SJ(Y.certificate_list,3),W=f.asn1.fromDer(G),G=f.pki.certificateFromAsn1(W,!0),U.push(G)}catch(O){return $.error($,{message:"Could not parse certificate list.",cause:O,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate}})}var M=$.entity===N.ConnectionEnd.client;if((M||$.verifyClient===!0)&&U.length===0)$.error($,{message:M?"No server certificate provided.":"No client certificate provided.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});else if(U.length===0)$.expect=M?p1:C8;else{if(M)$.session.serverCertificate=U[0];else $.session.clientCertificate=U[0];if(N.verifyCertificateChain($,U))$.expect=M?p1:C8}$.process()};N.handleServerKeyExchange=function($,J,X){if(X>0)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unsupported_certificate}});$.expect=cV,$.process()};N.handleClientKeyExchange=function($,J,X){if(X<48)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unsupported_certificate}});var Q=J.fragment,Y={enc_pre_master_secret:SJ(Q,2).getBytes()},G=null;if($.getPrivateKey)try{G=$.getPrivateKey($,$.session.serverCertificate),G=f.pki.privateKeyFromPem(G)}catch(M){$.error($,{message:"Could not get private key.",cause:M,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}})}if(G===null)return $.error($,{message:"No private key set.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});try{var W=$.session.sp;W.pre_master_secret=G.decrypt(Y.enc_pre_master_secret);var U=$.session.clientHelloVersion;if(U.major!==W.pre_master_secret.charCodeAt(0)||U.minor!==W.pre_master_secret.charCodeAt(1))throw Error("TLS version rollback attack detected.")}catch(M){W.pre_master_secret=f.random.getBytes(48)}if($.expect=w8,$.session.clientCertificate!==null)$.expect=tV;$.process()};N.handleCertificateRequest=function($,J,X){if(X<3)return $.error($,{message:"Invalid CertificateRequest. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_types:SJ(Q,1),certificate_authorities:SJ(Q,2)};$.session.certificateRequest=Y,$.expect=nV,$.process()};N.handleCertificateVerify=function($,J,X){if(X<2)return $.error($,{message:"Invalid CertificateVerify. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G={signature:SJ(Q,2).getBytes()},W=f.util.createBuffer();W.putBuffer($.session.md5.digest()),W.putBuffer($.session.sha1.digest()),W=W.getBytes();try{var U=$.session.clientCertificate;if(!U.publicKey.verify(W,G.signature,"NONE"))throw Error("CertificateVerify signature does not match.");$.session.md5.update(Y),$.session.sha1.update(Y)}catch(M){return $.error($,{message:"Bad signature in CertificateVerify.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.handshake_failure}})}$.expect=w8,$.process()};N.handleServerHelloDone=function($,J,X){if(X>0)return $.error($,{message:"Invalid ServerHelloDone message. Invalid length.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.record_overflow}});if($.serverCertificate===null){var Q={message:"No server certificate provided. Not enough security.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.insufficient_security}},Y=0,G=$.verify($,Q.alert.description,Y,[]);if(G!==!0){if(G||G===0){if(typeof G==="object"&&!f.util.isArray(G)){if(G.message)Q.message=G.message;if(G.alert)Q.alert.description=G.alert}else if(typeof G==="number")Q.alert.description=G}return $.error($,Q)}}if($.session.certificateRequest!==null)J=N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificate($)}),N.queue($,J);J=N.createRecord($,{type:N.ContentType.handshake,data:N.createClientKeyExchange($)}),N.queue($,J),$.expect=aV;var W=function(U,M){if(U.session.certificateRequest!==null&&U.session.clientCertificate!==null)N.queue(U,N.createRecord(U,{type:N.ContentType.handshake,data:N.createCertificateVerify(U,M)}));N.queue(U,N.createRecord(U,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),U.state.pending=N.createConnectionState(U),U.state.current.write=U.state.pending.write,N.queue(U,N.createRecord(U,{type:N.ContentType.handshake,data:N.createFinished(U)})),U.expect=c1,N.flush(U),U.process()};if($.session.certificateRequest===null||$.session.clientCertificate===null)return W($,null);N.getClientSignature($,W)};N.handleChangeCipherSpec=function($,J){if(J.fragment.getByte()!==1)return $.error($,{message:"Invalid ChangeCipherSpec message received.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var X=$.entity===N.ConnectionEnd.client;if($.session.resuming&&X||!$.session.resuming&&!X)$.state.pending=N.createConnectionState($);if($.state.current.read=$.state.pending.read,!$.session.resuming&&X||$.session.resuming&&!X)$.state.pending=null;$.expect=X?iV:eV,$.process()};N.handleFinished=function($,J,X){var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G=J.fragment.getBytes();Q=f.util.createBuffer(),Q.putBuffer($.session.md5.digest()),Q.putBuffer($.session.sha1.digest());var W=$.entity===N.ConnectionEnd.client,U=W?"server finished":"client finished",M=$.session.sp,O=12,V=lY;if(Q=V(M.master_secret,U,Q.getBytes(),O),Q.getBytes()!==G)return $.error($,{message:"Invalid verify_data in Finished message.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.decrypt_error}});if($.session.md5.update(Y),$.session.sha1.update(Y),$.session.resuming&&W||!$.session.resuming&&!W)N.queue($,N.createRecord($,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),$.state.current.write=$.state.pending.write,$.state.pending=null,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createFinished($)}));$.expect=W?oV:$H,$.handshaking=!1,++$.handshakes,$.peerCertificate=W?$.session.serverCertificate:$.session.clientCertificate,N.flush($),$.isConnected=!0,$.connected($),$.process()};N.handleAlert=function($,J){var X=J.fragment,Q={level:X.getByte(),description:X.getByte()},Y;switch(Q.description){case N.Alert.Description.close_notify:Y="Connection closed.";break;case N.Alert.Description.unexpected_message:Y="Unexpected message.";break;case N.Alert.Description.bad_record_mac:Y="Bad record MAC.";break;case N.Alert.Description.decryption_failed:Y="Decryption failed.";break;case N.Alert.Description.record_overflow:Y="Record overflow.";break;case N.Alert.Description.decompression_failure:Y="Decompression failed.";break;case N.Alert.Description.handshake_failure:Y="Handshake failure.";break;case N.Alert.Description.bad_certificate:Y="Bad certificate.";break;case N.Alert.Description.unsupported_certificate:Y="Unsupported certificate.";break;case N.Alert.Description.certificate_revoked:Y="Certificate revoked.";break;case N.Alert.Description.certificate_expired:Y="Certificate expired.";break;case N.Alert.Description.certificate_unknown:Y="Certificate unknown.";break;case N.Alert.Description.illegal_parameter:Y="Illegal parameter.";break;case N.Alert.Description.unknown_ca:Y="Unknown certificate authority.";break;case N.Alert.Description.access_denied:Y="Access denied.";break;case N.Alert.Description.decode_error:Y="Decode error.";break;case N.Alert.Description.decrypt_error:Y="Decrypt error.";break;case N.Alert.Description.export_restriction:Y="Export restriction.";break;case N.Alert.Description.protocol_version:Y="Unsupported protocol version.";break;case N.Alert.Description.insufficient_security:Y="Insufficient security.";break;case N.Alert.Description.internal_error:Y="Internal error.";break;case N.Alert.Description.user_canceled:Y="User canceled.";break;case N.Alert.Description.no_renegotiation:Y="Renegotiation not supported.";break;default:Y="Unknown error.";break}if(Q.description===N.Alert.Description.close_notify)return $.close();$.error($,{message:Y,send:!1,origin:$.entity===N.ConnectionEnd.client?"server":"client",alert:Q}),$.process()};N.handleHandshake=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt24();if(Y>X.length())return $.fragmented=J,J.fragment=f.util.createBuffer(),X.read-=4,$.process();$.fragmented=null,X.read-=4;var G=X.bytes(Y+4);if(X.read+=4,Q in mY[$.entity][$.expect]){if($.entity===N.ConnectionEnd.server&&!$.open&&!$.fail)$.handshaking=!0,$.session={version:null,extensions:{server_name:{serverNameList:[]}},cipherSuite:null,compressionMethod:null,serverCertificate:null,clientCertificate:null,md5:f.md.md5.create(),sha1:f.md.sha1.create()};if(Q!==N.HandshakeType.hello_request&&Q!==N.HandshakeType.certificate_verify&&Q!==N.HandshakeType.finished)$.session.md5.update(G),$.session.sha1.update(G);mY[$.entity][$.expect][Q]($,J,Y)}else N.handleUnexpected($,J)};N.handleApplicationData=function($,J){$.data.putBuffer(J.fragment),$.dataReady($),$.process()};N.handleHeartbeat=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt16(),G=X.getBytes(Y);if(Q===N.HeartbeatMessageType.heartbeat_request){if($.handshaking||Y>G.length)return $.process();N.queue($,N.createRecord($,{type:N.ContentType.heartbeat,data:N.createHeartbeat(N.HeartbeatMessageType.heartbeat_response,G)})),N.flush($)}else if(Q===N.HeartbeatMessageType.heartbeat_response){if(G!==$.expectedHeartbeatPayload)return $.process();if($.heartbeatReceived)$.heartbeatReceived($,f.util.createBuffer(G))}$.process()};var pV=0,dV=1,p1=2,cV=3,nV=4,c1=5,iV=6,oV=7,aV=8,sV=0,rV=1,C8=2,tV=3,w8=4,eV=5,$H=6,E=N.handleUnexpected,n1=N.handleChangeCipherSpec,qJ=N.handleAlert,RJ=N.handleHandshake,i1=N.handleApplicationData,KJ=N.handleHeartbeat,P8=[];P8[N.ConnectionEnd.client]=[[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[n1,qJ,E,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,i1,KJ],[E,qJ,RJ,E,KJ]];P8[N.ConnectionEnd.server]=[[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,E,KJ],[n1,qJ,E,E,KJ],[E,qJ,RJ,E,KJ],[E,qJ,RJ,i1,KJ],[E,qJ,RJ,E,KJ]];var{handleHelloRequest:y0,handleServerHello:JH,handleCertificate:o1,handleServerKeyExchange:d1,handleCertificateRequest:S8,handleServerHelloDone:gY,handleFinished:a1}=N,mY=[];mY[N.ConnectionEnd.client]=[[E,E,JH,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,o1,d1,S8,gY,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,d1,S8,gY,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,S8,gY,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,gY,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,a1],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E]];var{handleClientHello:QH,handleClientKeyExchange:XH,handleCertificateVerify:YH}=N;mY[N.ConnectionEnd.server]=[[E,QH,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,o1,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,XH,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,YH,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,a1],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E]];N.generateKeys=function($,J){var X=lY,Q=J.client_random+J.server_random;if(!$.session.resuming)J.master_secret=X(J.pre_master_secret,"master secret",Q,48).bytes(),J.pre_master_secret=null;Q=J.server_random+J.client_random;var Y=2*J.mac_key_length+2*J.enc_key_length,G=$.version.major===N.Versions.TLS_1_0.major&&$.version.minor===N.Versions.TLS_1_0.minor;if(G)Y+=2*J.fixed_iv_length;var W=X(J.master_secret,"key expansion",Q,Y),U={client_write_MAC_key:W.getBytes(J.mac_key_length),server_write_MAC_key:W.getBytes(J.mac_key_length),client_write_key:W.getBytes(J.enc_key_length),server_write_key:W.getBytes(J.enc_key_length)};if(G)U.client_write_IV=W.getBytes(J.fixed_iv_length),U.server_write_IV=W.getBytes(J.fixed_iv_length);return U};N.createConnectionState=function($){var J=$.entity===N.ConnectionEnd.client,X=function(){var G={sequenceNumber:[0,0],macKey:null,macLength:0,macFunction:null,cipherState:null,cipherFunction:function(W){return!0},compressionState:null,compressFunction:function(W){return!0},updateSequenceNumber:function(){if(G.sequenceNumber[1]===4294967295)G.sequenceNumber[1]=0,++G.sequenceNumber[0];else++G.sequenceNumber[1]}};return G},Q={read:X(),write:X()};if(Q.read.update=function(G,W){if(!Q.read.cipherFunction(W,Q.read))G.error(G,{message:"Could not decrypt record or bad MAC.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_record_mac}});else if(!Q.read.compressFunction(G,W,Q.read))G.error(G,{message:"Could not decompress record.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.decompression_failure}});return!G.fail},Q.write.update=function(G,W){if(!Q.write.compressFunction(G,W,Q.write))G.error(G,{message:"Could not compress record.",send:!1,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});else if(!Q.write.cipherFunction(W,Q.write))G.error(G,{message:"Could not encrypt record.",send:!1,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});return!G.fail},$.session){var Y=$.session.sp;switch($.session.cipherSuite.initSecurityParameters(Y),Y.keys=N.generateKeys($,Y),Q.read.macKey=J?Y.keys.server_write_MAC_key:Y.keys.client_write_MAC_key,Q.write.macKey=J?Y.keys.client_write_MAC_key:Y.keys.server_write_MAC_key,$.session.cipherSuite.initConnectionState(Q,$,Y),Y.compression_algorithm){case N.CompressionMethod.none:break;case N.CompressionMethod.deflate:Q.read.compressFunction=lV,Q.write.compressFunction=mV;break;default:throw Error("Unsupported compression algorithm.")}}return Q};N.createRandom=function(){var $=new Date,J=+$+$.getTimezoneOffset()*60000,X=f.util.createBuffer();return X.putInt32(J),X.putBytes(f.random.getBytes(28)),X};N.createRecord=function($,J){if(!J.data)return null;var X={type:J.type,version:{major:$.version.major,minor:$.version.minor},length:J.data.length(),fragment:J.data};return X};N.createAlert=function($,J){var X=f.util.createBuffer();return X.putByte(J.level),X.putByte(J.description),N.createRecord($,{type:N.ContentType.alert,data:X})};N.createClientHello=function($){$.session.clientHelloVersion={major:$.version.major,minor:$.version.minor};var J=f.util.createBuffer();for(var X=0;X<$.cipherSuites.length;++X){var Q=$.cipherSuites[X];J.putByte(Q.id[0]),J.putByte(Q.id[1])}var Y=J.length(),G=f.util.createBuffer();G.putByte(N.CompressionMethod.none);var W=G.length(),U=f.util.createBuffer();if($.virtualHost){var M=f.util.createBuffer();M.putByte(0),M.putByte(0);var O=f.util.createBuffer();O.putByte(0),fJ(O,2,f.util.createBuffer($.virtualHost));var V=f.util.createBuffer();fJ(V,2,O),fJ(M,2,V),U.putBuffer(M)}var H=U.length();if(H>0)H+=2;var q=$.session.id,F=q.length+1+2+4+28+2+Y+1+W+H,K=f.util.createBuffer();if(K.putByte(N.HandshakeType.client_hello),K.putInt24(F),K.putByte($.version.major),K.putByte($.version.minor),K.putBytes($.session.sp.client_random),fJ(K,1,f.util.createBuffer(q)),fJ(K,2,J),fJ(K,1,G),H>0)fJ(K,2,U);return K};N.createServerHello=function($){var J=$.session.id,X=J.length+1+2+4+28+2+1,Q=f.util.createBuffer();return Q.putByte(N.HandshakeType.server_hello),Q.putInt24(X),Q.putByte($.version.major),Q.putByte($.version.minor),Q.putBytes($.session.sp.server_random),fJ(Q,1,f.util.createBuffer(J)),Q.putByte($.session.cipherSuite.id[0]),Q.putByte($.session.cipherSuite.id[1]),Q.putByte($.session.compressionMethod),Q};N.createCertificate=function($){var J=$.entity===N.ConnectionEnd.client,X=null;if($.getCertificate){var Q;if(J)Q=$.session.certificateRequest;else Q=$.session.extensions.server_name.serverNameList;X=$.getCertificate($,Q)}var Y=f.util.createBuffer();if(X!==null)try{if(!f.util.isArray(X))X=[X];var G=null;for(var W=0;W<X.length;++W){var U=f.pem.decode(X[W])[0];if(U.type!=="CERTIFICATE"&&U.type!=="X509 CERTIFICATE"&&U.type!=="TRUSTED CERTIFICATE"){var M=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw M.headerType=U.type,M}if(U.procType&&U.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var O=f.util.createBuffer(U.body);if(G===null)G=f.asn1.fromDer(O.bytes(),!1);var V=f.util.createBuffer();fJ(V,3,O),Y.putBuffer(V)}if(X=f.pki.certificateFromAsn1(G),J)$.session.clientCertificate=X;else $.session.serverCertificate=X}catch(F){return $.error($,{message:"Could not send certificate list.",cause:F,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate}})}var H=3+Y.length(),q=f.util.createBuffer();return q.putByte(N.HandshakeType.certificate),q.putInt24(H),fJ(q,3,Y),q};N.createClientKeyExchange=function($){var J=f.util.createBuffer();J.putByte($.session.clientHelloVersion.major),J.putByte($.session.clientHelloVersion.minor),J.putBytes(f.random.getBytes(46));var X=$.session.sp;X.pre_master_secret=J.getBytes();var Q=$.session.serverCertificate.publicKey;J=Q.encrypt(X.pre_master_secret);var Y=J.length+2,G=f.util.createBuffer();return G.putByte(N.HandshakeType.client_key_exchange),G.putInt24(Y),G.putInt16(J.length),G.putBytes(J),G};N.createServerKeyExchange=function($){var J=0,X=f.util.createBuffer();if(J>0)X.putByte(N.HandshakeType.server_key_exchange),X.putInt24(J);return X};N.getClientSignature=function($,J){var X=f.util.createBuffer();X.putBuffer($.session.md5.digest()),X.putBuffer($.session.sha1.digest()),X=X.getBytes(),$.getSignature=$.getSignature||function(Q,Y,G){var W=null;if(Q.getPrivateKey)try{W=Q.getPrivateKey(Q,Q.session.clientCertificate),W=f.pki.privateKeyFromPem(W)}catch(U){Q.error(Q,{message:"Could not get private key.",cause:U,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}})}if(W===null)Q.error(Q,{message:"No private key set.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});else Y=W.sign(Y,null);G(Q,Y)},$.getSignature($,X,J)};N.createCertificateVerify=function($,J){var X=J.length+2,Q=f.util.createBuffer();return Q.putByte(N.HandshakeType.certificate_verify),Q.putInt24(X),Q.putInt16(J.length),Q.putBytes(J),Q};N.createCertificateRequest=function($){var J=f.util.createBuffer();J.putByte(1);var X=f.util.createBuffer();for(var Q in $.caStore.certs){var Y=$.caStore.certs[Q],G=f.pki.distinguishedNameToAsn1(Y.subject),W=f.asn1.toDer(G);X.putInt16(W.length()),X.putBuffer(W)}var U=1+J.length()+2+X.length(),M=f.util.createBuffer();return M.putByte(N.HandshakeType.certificate_request),M.putInt24(U),fJ(M,1,J),fJ(M,2,X),M};N.createServerHelloDone=function($){var J=f.util.createBuffer();return J.putByte(N.HandshakeType.server_hello_done),J.putInt24(0),J};N.createChangeCipherSpec=function(){var $=f.util.createBuffer();return $.putByte(1),$};N.createFinished=function($){var J=f.util.createBuffer();J.putBuffer($.session.md5.digest()),J.putBuffer($.session.sha1.digest());var X=$.entity===N.ConnectionEnd.client,Q=$.session.sp,Y=12,G=lY,W=X?"client finished":"server finished";J=G(Q.master_secret,W,J.getBytes(),Y);var U=f.util.createBuffer();return U.putByte(N.HandshakeType.finished),U.putInt24(J.length()),U.putBuffer(J),U};N.createHeartbeat=function($,J,X){if(typeof X>"u")X=J.length;var Q=f.util.createBuffer();Q.putByte($),Q.putInt16(X),Q.putBytes(J);var Y=Q.length(),G=Math.max(16,Y-X-3);return Q.putBytes(f.random.getBytes(G)),Q};N.queue=function($,J){if(!J)return;if(J.fragment.length()===0){if(J.type===N.ContentType.handshake||J.type===N.ContentType.alert||J.type===N.ContentType.change_cipher_spec)return}if(J.type===N.ContentType.handshake){var X=J.fragment.bytes();$.session.md5.update(X),$.session.sha1.update(X),X=null}var Q;if(J.fragment.length()<=N.MaxFragment)Q=[J];else{Q=[];var Y=J.fragment.bytes();while(Y.length>N.MaxFragment)Q.push(N.createRecord($,{type:J.type,data:f.util.createBuffer(Y.slice(0,N.MaxFragment))})),Y=Y.slice(N.MaxFragment);if(Y.length>0)Q.push(N.createRecord($,{type:J.type,data:f.util.createBuffer(Y)}))}for(var G=0;G<Q.length&&!$.fail;++G){var W=Q[G],U=$.state.current.write;if(U.update($,W))$.records.push(W)}};N.flush=function($){for(var J=0;J<$.records.length;++J){var X=$.records[J];$.tlsData.putByte(X.type),$.tlsData.putByte(X.version.major),$.tlsData.putByte(X.version.minor),$.tlsData.putInt16(X.fragment.length()),$.tlsData.putBuffer($.records[J].fragment)}return $.records=[],$.tlsDataReady($)};var I8=function($){switch($){case!0:return!0;case f.pki.certificateError.bad_certificate:return N.Alert.Description.bad_certificate;case f.pki.certificateError.unsupported_certificate:return N.Alert.Description.unsupported_certificate;case f.pki.certificateError.certificate_revoked:return N.Alert.Description.certificate_revoked;case f.pki.certificateError.certificate_expired:return N.Alert.Description.certificate_expired;case f.pki.certificateError.certificate_unknown:return N.Alert.Description.certificate_unknown;case f.pki.certificateError.unknown_ca:return N.Alert.Description.unknown_ca;default:return N.Alert.Description.bad_certificate}},GH=function($){switch($){case!0:return!0;case N.Alert.Description.bad_certificate:return f.pki.certificateError.bad_certificate;case N.Alert.Description.unsupported_certificate:return f.pki.certificateError.unsupported_certificate;case N.Alert.Description.certificate_revoked:return f.pki.certificateError.certificate_revoked;case N.Alert.Description.certificate_expired:return f.pki.certificateError.certificate_expired;case N.Alert.Description.certificate_unknown:return f.pki.certificateError.certificate_unknown;case N.Alert.Description.unknown_ca:return f.pki.certificateError.unknown_ca;default:return f.pki.certificateError.bad_certificate}};N.verifyCertificateChain=function($,J){try{var X={};for(var Q in $.verifyOptions)X[Q]=$.verifyOptions[Q];X.verify=function(G,W,U){var M=I8(G),O=$.verify($,G,W,U);if(O!==!0){if(typeof O==="object"&&!f.util.isArray(O)){var V=Error("The application rejected the certificate.");if(V.send=!0,V.alert={level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate},O.message)V.message=O.message;if(O.alert)V.alert.description=O.alert;throw V}if(O!==G)O=GH(O)}return O},f.pki.verifyCertificateChain($.caStore,J,X)}catch(G){var Y=G;if(typeof Y!=="object"||f.util.isArray(Y))Y={send:!0,alert:{level:N.Alert.Level.fatal,description:I8(G)}};if(!("send"in Y))Y.send=!0;if(!("alert"in Y))Y.alert={level:N.Alert.Level.fatal,description:I8(Y.error)};$.error($,Y)}return!$.fail};N.createSessionCache=function($,J){var X=null;if($&&$.getSession&&$.setSession&&$.order)X=$;else{X={},X.cache=$||{},X.capacity=Math.max(J||100,1),X.order=[];for(var Q in $)if(X.order.length<=J)X.order.push(Q);else delete $[Q];X.getSession=function(Y){var G=null,W=null;if(Y)W=f.util.bytesToHex(Y);else if(X.order.length>0)W=X.order[0];if(W!==null&&W in X.cache){G=X.cache[W],delete X.cache[W];for(var U in X.order)if(X.order[U]===W){X.order.splice(U,1);break}}return G},X.setSession=function(Y,G){if(X.order.length===X.capacity){var W=X.order.shift();delete X.cache[W]}var W=f.util.bytesToHex(Y);X.order.push(W),X.cache[W]=G}}return X};N.createConnection=function($){var J=null;if($.caStore)if(f.util.isArray($.caStore))J=f.pki.createCaStore($.caStore);else J=$.caStore;else J=f.pki.createCaStore();var X=$.cipherSuites||null;if(X===null){X=[];for(var Q in N.CipherSuites)X.push(N.CipherSuites[Q])}var Y=$.server?N.ConnectionEnd.server:N.ConnectionEnd.client,G=$.sessionCache?N.createSessionCache($.sessionCache):null,W={version:{major:N.Version.major,minor:N.Version.minor},entity:Y,sessionId:$.sessionId,caStore:J,sessionCache:G,cipherSuites:X,connected:$.connected,virtualHost:$.virtualHost||null,verifyClient:$.verifyClient||!1,verify:$.verify||function(V,H,q,F){return H},verifyOptions:$.verifyOptions||{},getCertificate:$.getCertificate||null,getPrivateKey:$.getPrivateKey||null,getSignature:$.getSignature||null,input:f.util.createBuffer(),tlsData:f.util.createBuffer(),data:f.util.createBuffer(),tlsDataReady:$.tlsDataReady,dataReady:$.dataReady,heartbeatReceived:$.heartbeatReceived,closed:$.closed,error:function(V,H){if(H.origin=H.origin||(V.entity===N.ConnectionEnd.client?"client":"server"),H.send)N.queue(V,N.createAlert(V,H.alert)),N.flush(V);var q=H.fatal!==!1;if(q)V.fail=!0;if($.error(V,H),q)V.close(!1)},deflate:$.deflate||null,inflate:$.inflate||null};W.reset=function(V){W.version={major:N.Version.major,minor:N.Version.minor},W.record=null,W.session=null,W.peerCertificate=null,W.state={pending:null,current:null},W.expect=W.entity===N.ConnectionEnd.client?pV:sV,W.fragmented=null,W.records=[],W.open=!1,W.handshakes=0,W.handshaking=!1,W.isConnected=!1,W.fail=!(V||typeof V>"u"),W.input.clear(),W.tlsData.clear(),W.data.clear(),W.state.current=N.createConnectionState(W)},W.reset();var U=function(V,H){var q=H.type-N.ContentType.change_cipher_spec,F=P8[V.entity][V.expect];if(q in F)F[q](V,H);else N.handleUnexpected(V,H)},M=function(V){var H=0,q=V.input,F=q.length();if(F<5)H=5-F;else{V.record={type:q.getByte(),version:{major:q.getByte(),minor:q.getByte()},length:q.getInt16(),fragment:f.util.createBuffer(),ready:!1};var K=V.record.version.major===V.version.major;if(K&&V.session&&V.session.version)K=V.record.version.minor===V.version.minor;if(!K)V.error(V,{message:"Incompatible TLS version.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}})}return H},O=function(V){var H=0,q=V.input,F=q.length();if(F<V.record.length)H=V.record.length-F;else{V.record.fragment.putBytes(q.getBytes(V.record.length)),q.compact();var K=V.state.current.read;if(K.update(V,V.record)){if(V.fragmented!==null)if(V.fragmented.type===V.record.type)V.fragmented.fragment.putBuffer(V.record.fragment),V.record=V.fragmented;else V.error(V,{message:"Invalid fragmented record.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unexpected_message}});V.record.ready=!0}}return H};return W.handshake=function(V){if(W.entity!==N.ConnectionEnd.client)W.error(W,{message:"Cannot initiate handshake as a server.",fatal:!1});else if(W.handshaking)W.error(W,{message:"Handshake already in progress.",fatal:!1});else{if(W.fail&&!W.open&&W.handshakes===0)W.fail=!1;W.handshaking=!0,V=V||"";var H=null;if(V.length>0){if(W.sessionCache)H=W.sessionCache.getSession(V);if(H===null)V=""}if(V.length===0&&W.sessionCache){if(H=W.sessionCache.getSession(),H!==null)V=H.id}if(W.session={id:V,version:null,cipherSuite:null,compressionMethod:null,serverCertificate:null,certificateRequest:null,clientCertificate:null,sp:{},md5:f.md.md5.create(),sha1:f.md.sha1.create()},H)W.version=H.version,W.session.sp=H.sp;W.session.sp.client_random=N.createRandom().getBytes(),W.open=!0,N.queue(W,N.createRecord(W,{type:N.ContentType.handshake,data:N.createClientHello(W)})),N.flush(W)}},W.process=function(V){var H=0;if(V)W.input.putBytes(V);if(!W.fail){if(W.record!==null&&W.record.ready&&W.record.fragment.isEmpty())W.record=null;if(W.record===null)H=M(W);if(!W.fail&&W.record!==null&&!W.record.ready)H=O(W);if(!W.fail&&W.record!==null&&W.record.ready)U(W,W.record)}return H},W.prepare=function(V){return N.queue(W,N.createRecord(W,{type:N.ContentType.application_data,data:f.util.createBuffer(V)})),N.flush(W)},W.prepareHeartbeatRequest=function(V,H){if(V instanceof f.util.ByteBuffer)V=V.bytes();if(typeof H>"u")H=V.length;return W.expectedHeartbeatPayload=V,N.queue(W,N.createRecord(W,{type:N.ContentType.heartbeat,data:N.createHeartbeat(N.HeartbeatMessageType.heartbeat_request,V,H)})),N.flush(W)},W.close=function(V){if(!W.fail&&W.sessionCache&&W.session){var H={id:W.session.id,version:W.session.version,sp:W.session.sp};H.sp.keys=null,W.sessionCache.setSession(H.id,H)}if(W.open){if(W.open=!1,W.input.clear(),W.isConnected||W.handshaking)W.isConnected=W.handshaking=!1,N.queue(W,N.createAlert(W,{level:N.Alert.Level.warning,description:N.Alert.Description.close_notify})),N.flush(W);W.closed(W)}W.reset(V)},W};s1.exports=f.tls=f.tls||{};for(CX in N)if(typeof N[CX]!=="function")f.tls[CX]=N[CX];var CX;f.tls.prf_tls1=lY;f.tls.hmac_sha1=gV;f.tls.createSessionCache=N.createSessionCache;f.tls.createConnection=N.createConnection});var e1=H$((fF,t1)=>{var b0=F$();P0();_8();var yJ=t1.exports=b0.tls;yJ.CipherSuites.TLS_RSA_WITH_AES_128_CBC_SHA={id:[0,47],name:"TLS_RSA_WITH_AES_128_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=yJ.BulkCipherAlgorithm.aes,$.cipher_type=yJ.CipherType.block,$.enc_key_length=16,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=yJ.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:r1};yJ.CipherSuites.TLS_RSA_WITH_AES_256_CBC_SHA={id:[0,53],name:"TLS_RSA_WITH_AES_256_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=yJ.BulkCipherAlgorithm.aes,$.cipher_type=yJ.CipherType.block,$.enc_key_length=32,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=yJ.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:r1};function r1($,J,X){var Q=J.entity===b0.tls.ConnectionEnd.client;$.read.cipherState={init:!1,cipher:b0.cipher.createDecipher("AES-CBC",Q?X.keys.server_write_key:X.keys.client_write_key),iv:Q?X.keys.server_write_IV:X.keys.client_write_IV},$.write.cipherState={init:!1,cipher:b0.cipher.createCipher("AES-CBC",Q?X.keys.client_write_key:X.keys.server_write_key),iv:Q?X.keys.client_write_IV:X.keys.server_write_IV},$.read.cipherFunction=OH,$.write.cipherFunction=WH,$.read.macLength=$.write.macLength=X.mac_length,$.read.macFunction=$.write.macFunction=yJ.hmac_sha1}function WH($,J){var X=!1,Q=J.macFunction(J.macKey,J.sequenceNumber,$);$.fragment.putBytes(Q),J.updateSequenceNumber();var Y;if($.version.minor===yJ.Versions.TLS_1_0.minor)Y=J.cipherState.init?null:J.cipherState.iv;else Y=b0.random.getBytesSync(16);J.cipherState.init=!0;var G=J.cipherState.cipher;if(G.start({iv:Y}),$.version.minor>=yJ.Versions.TLS_1_1.minor)G.output.putBytes(Y);if(G.update($.fragment),G.finish(UH))$.fragment=G.output,$.length=$.fragment.length(),X=!0;return X}function UH($,J,X){if(!X){var Q=$-J.length()%$;J.fillWithByte(Q-1,Q)}return!0}function MH($,J,X){var Q=!0;if(X){var Y=J.length(),G=J.last();for(var W=Y-1-G;W<Y-1;++W)Q=Q&&J.at(W)==G;if(Q)J.truncate(G+1)}return Q}function OH($,J){var X=!1,Q;if($.version.minor===yJ.Versions.TLS_1_0.minor)Q=J.cipherState.init?null:J.cipherState.iv;else Q=$.fragment.getBytes(16);J.cipherState.init=!0;var Y=J.cipherState.cipher;Y.start({iv:Q}),Y.update($.fragment),X=Y.finish(MH);var G=J.macLength,W=b0.random.getBytesSync(G),U=Y.output.length();if(U>=G)$.fragment=Y.output.getBytes(U-G),W=Y.output.getBytes(G);else $.fragment=Y.output.getBytes();$.fragment=b0.util.createBuffer($.fragment),$.length=$.fragment.length();var M=J.macFunction(J.macKey,J.sequenceNumber,$);return J.updateSequenceNumber(),X=VH(J.macKey,W,M)&&X,X}function VH($,J,X){var Q=b0.hmac.create();return Q.start("SHA1",$),Q.update(J),J=Q.digest().getBytes(),Q.start(null,null),Q.update(X),X=Q.digest().getBytes(),J===X}});var k8=H$((yF,XW)=>{var d$=F$();$0();_$();var wX=XW.exports=d$.sha512=d$.sha512||{};d$.md.sha512=d$.md.algorithms.sha512=wX;var JW=d$.sha384=d$.sha512.sha384=d$.sha512.sha384||{};JW.create=function(){return wX.create("SHA-384")};d$.md.sha384=d$.md.algorithms.sha384=JW;d$.sha512.sha256=d$.sha512.sha256||{create:function(){return wX.create("SHA-512/256")}};d$.md["sha512/256"]=d$.md.algorithms["sha512/256"]=d$.sha512.sha256;d$.sha512.sha224=d$.sha512.sha224||{create:function(){return wX.create("SHA-512/224")}};d$.md["sha512/224"]=d$.md.algorithms["sha512/224"]=d$.sha512.sha224;wX.create=function($){if(!QW)HH();if(typeof $>"u")$="SHA-512";if(!($ in MQ))throw Error("Invalid SHA-512 algorithm: "+$);var J=MQ[$],X=null,Q=d$.util.createBuffer(),Y=Array(80);for(var G=0;G<80;++G)Y[G]=[,,];var W=64;switch($){case"SHA-384":W=48;break;case"SHA-512/256":W=32;break;case"SHA-512/224":W=28;break}var U={algorithm:$.replace("-","").toLowerCase(),blockLength:128,digestLength:W,messageLength:0,fullMessageLength:null,messageLengthSize:16};return U.start=function(){U.messageLength=0,U.fullMessageLength=U.messageLength128=[];var M=U.messageLengthSize/4;for(var O=0;O<M;++O)U.fullMessageLength.push(0);Q=d$.util.createBuffer(),X=Array(J.length);for(var O=0;O<J.length;++O)X[O]=J[O].slice(0);return U},U.start(),U.update=function(M,O){if(O==="utf8")M=d$.util.encodeUtf8(M);var V=M.length;U.messageLength+=V,V=[V/4294967296>>>0,V>>>0];for(var H=U.fullMessageLength.length-1;H>=0;--H)U.fullMessageLength[H]+=V[1],V[1]=V[0]+(U.fullMessageLength[H]/4294967296>>>0),U.fullMessageLength[H]=U.fullMessageLength[H]>>>0,V[0]=V[1]/4294967296>>>0;if(Q.putBytes(M),$W(X,Y,Q),Q.read>2048||Q.length()===0)Q.compact();return U},U.digest=function(){var M=d$.util.createBuffer();M.putBytes(Q.bytes());var O=U.fullMessageLength[U.fullMessageLength.length-1]+U.messageLengthSize,V=O&U.blockLength-1;M.putBytes(x8.substr(0,U.blockLength-V));var H,q,F=U.fullMessageLength[0]*8;for(var K=0;K<U.fullMessageLength.length-1;++K)H=U.fullMessageLength[K+1]*8,q=H/4294967296>>>0,F+=q,M.putInt32(F>>>0),F=H>>>0;M.putInt32(F);var A=Array(X.length);for(var K=0;K<X.length;++K)A[K]=X[K].slice(0);$W(A,Y,M);var L=d$.util.createBuffer(),R;if($==="SHA-512")R=A.length;else if($==="SHA-384")R=A.length-2;else R=A.length-4;for(var K=0;K<R;++K)if(L.putInt32(A[K][0]),K!==R-1||$!=="SHA-512/224")L.putInt32(A[K][1]);return L},U};var x8=null,QW=!1,v8=null,MQ=null;function HH(){x8=String.fromCharCode(128),x8+=d$.util.fillString(String.fromCharCode(0),128),v8=[[1116352408,3609767458],[1899447441,602891725],[3049323471,3964484399],[3921009573,2173295548],[961987163,4081628472],[1508970993,3053834265],[2453635748,2937671579],[2870763221,3664609560],[3624381080,2734883394],[310598401,1164996542],[607225278,1323610764],[1426881987,3590304994],[1925078388,4068182383],[2162078206,991336113],[2614888103,633803317],[3248222580,3479774868],[3835390401,2666613458],[4022224774,944711139],[264347078,2341262773],[604807628,2007800933],[770255983,1495990901],[1249150122,1856431235],[1555081692,3175218132],[1996064986,2198950837],[2554220882,3999719339],[2821834349,766784016],[2952996808,2566594879],[3210313671,3203337956],[3336571891,1034457026],[3584528711,2466948901],[113926993,3758326383],[338241895,168717936],[666307205,1188179964],[773529912,1546045734],[1294757372,1522805485],[1396182291,2643833823],[1695183700,2343527390],[1986661051,1014477480],[2177026350,1206759142],[2456956037,344077627],[2730485921,1290863460],[2820302411,3158454273],[3259730800,3505952657],[3345764771,106217008],[3516065817,3606008344],[3600352804,1432725776],[4094571909,1467031594],[275423344,851169720],[430227734,3100823752],[506948616,1363258195],[659060556,3750685593],[883997877,3785050280],[958139571,3318307427],[1322822218,3812723403],[1537002063,2003034995],[1747873779,3602036899],[1955562222,1575990012],[2024104815,1125592928],[2227730452,2716904306],[2361852424,442776044],[2428436474,593698344],[2756734187,3733110249],[3204031479,2999351573],[3329325298,3815920427],[3391569614,3928383900],[3515267271,566280711],[3940187606,3454069534],[4118630271,4000239992],[116418474,1914138554],[174292421,2731055270],[289380356,3203993006],[460393269,320620315],[685471733,587496836],[852142971,1086792851],[1017036298,365543100],[1126000580,2618297676],[1288033470,3409855158],[1501505948,4234509866],[1607167915,987167468],[1816402316,1246189591]],MQ={},MQ["SHA-512"]=[[1779033703,4089235720],[3144134277,2227873595],[1013904242,4271175723],[2773480762,1595750129],[1359893119,2917565137],[2600822924,725511199],[528734635,4215389547],[1541459225,327033209]],MQ["SHA-384"]=[[3418070365,3238371032],[1654270250,914150663],[2438529370,812702999],[355462360,4144912697],[1731405415,4290775857],[2394180231,1750603025],[3675008525,1694076839],[1203062813,3204075428]],MQ["SHA-512/256"]=[[573645204,4230739756],[2673172387,3360449730],[596883563,1867755857],[2520282905,1497426621],[2519219938,2827943907],[3193839141,1401305490],[721525244,746961066],[246885852,2177182882]],MQ["SHA-512/224"]=[[2352822216,424955298],[1944164710,2312950998],[502970286,855612546],[1738396948,1479516111],[258812777,2077511080],[2011393907,79989058],[1067287976,1780299464],[286451373,2446758561]],QW=!0}function $W($,J,X){var Q,Y,G,W,U,M,O,V,H,q,F,K,A,L,R,I,j,C,w,P,l,e,y,n,Y$,L$,j$,QJ,S$,h$,u,J$,a,V$,O$,$$=X.length();while($$>=128){for(S$=0;S$<16;++S$)J[S$][0]=X.getInt32()>>>0,J[S$][1]=X.getInt32()>>>0;for(;S$<80;++S$)J$=J[S$-2],h$=J$[0],u=J$[1],Q=((h$>>>19|u<<13)^(u>>>29|h$<<3)^h$>>>6)>>>0,Y=((h$<<13|u>>>19)^(u<<3|h$>>>29)^(h$<<26|u>>>6))>>>0,V$=J[S$-15],h$=V$[0],u=V$[1],G=((h$>>>1|u<<31)^(h$>>>8|u<<24)^h$>>>7)>>>0,W=((h$<<31|u>>>1)^(h$<<24|u>>>8)^(h$<<25|u>>>7))>>>0,a=J[S$-7],O$=J[S$-16],u=Y+a[1]+W+O$[1],J[S$][0]=Q+a[0]+G+O$[0]+(u/4294967296>>>0)>>>0,J[S$][1]=u>>>0;A=$[0][0],L=$[0][1],R=$[1][0],I=$[1][1],j=$[2][0],C=$[2][1],w=$[3][0],P=$[3][1],l=$[4][0],e=$[4][1],y=$[5][0],n=$[5][1],Y$=$[6][0],L$=$[6][1],j$=$[7][0],QJ=$[7][1];for(S$=0;S$<80;++S$)O=((l>>>14|e<<18)^(l>>>18|e<<14)^(e>>>9|l<<23))>>>0,V=((l<<18|e>>>14)^(l<<14|e>>>18)^(e<<23|l>>>9))>>>0,H=(Y$^l&(y^Y$))>>>0,q=(L$^e&(n^L$))>>>0,U=((A>>>28|L<<4)^(L>>>2|A<<30)^(L>>>7|A<<25))>>>0,M=((A<<4|L>>>28)^(L<<30|A>>>2)^(L<<25|A>>>7))>>>0,F=(A&R|j&(A^R))>>>0,K=(L&I|C&(L^I))>>>0,u=QJ+V+q+v8[S$][1]+J[S$][1],Q=j$+O+H+v8[S$][0]+J[S$][0]+(u/4294967296>>>0)>>>0,Y=u>>>0,u=M+K,G=U+F+(u/4294967296>>>0)>>>0,W=u>>>0,j$=Y$,QJ=L$,Y$=y,L$=n,y=l,n=e,u=P+Y,l=w+Q+(u/4294967296>>>0)>>>0,e=u>>>0,w=j,P=C,j=R,C=I,R=A,I=L,u=Y+W,A=Q+G+(u/4294967296>>>0)>>>0,L=u>>>0;u=$[0][1]+L,$[0][0]=$[0][0]+A+(u/4294967296>>>0)>>>0,$[0][1]=u>>>0,u=$[1][1]+I,$[1][0]=$[1][0]+R+(u/4294967296>>>0)>>>0,$[1][1]=u>>>0,u=$[2][1]+C,$[2][0]=$[2][0]+j+(u/4294967296>>>0)>>>0,$[2][1]=u>>>0,u=$[3][1]+P,$[3][0]=$[3][0]+w+(u/4294967296>>>0)>>>0,$[3][1]=u>>>0,u=$[4][1]+e,$[4][0]=$[4][0]+l+(u/4294967296>>>0)>>>0,$[4][1]=u>>>0,u=$[5][1]+n,$[5][0]=$[5][0]+y+(u/4294967296>>>0)>>>0,$[5][1]=u>>>0,u=$[6][1]+L$,$[6][0]=$[6][0]+Y$+(u/4294967296>>>0)>>>0,$[6][1]=u>>>0,u=$[7][1]+QJ,$[7][0]=$[7][0]+j$+(u/4294967296>>>0)>>>0,$[7][1]=u>>>0,$$-=128}}});var YW=H$((KH)=>{var qH=F$();mJ();var HJ=qH.asn1;KH.privateKeyValidator={name:"PrivateKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]};KH.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{tagClass:HJ.Class.UNIVERSAL,type:HJ.Type.BITSTRING,constructed:!1,composed:!0,captureBitStringValue:"ed25519PublicKey"}]}});var FW=H$((hF,EW)=>{var zJ=F$();jX();_J();k8();_$();var OW=YW(),FH=OW.publicKeyValidator,NH=OW.privateKeyValidator;if(typeof y8>"u")y8=zJ.jsbn.BigInteger;var y8,b8=zJ.util.ByteBuffer,BJ=typeof Buffer>"u"?Uint8Array:Buffer;zJ.pki=zJ.pki||{};EW.exports=zJ.pki.ed25519=zJ.ed25519=zJ.ed25519||{};var Z$=zJ.ed25519;Z$.constants={};Z$.constants.PUBLIC_KEY_BYTE_LENGTH=32;Z$.constants.PRIVATE_KEY_BYTE_LENGTH=64;Z$.constants.SEED_BYTE_LENGTH=32;Z$.constants.SIGN_BYTE_LENGTH=64;Z$.constants.HASH_BYTE_LENGTH=64;Z$.generateKeyPair=function($){$=$||{};var J=$.seed;if(J===void 0)J=zJ.random.getBytesSync(Z$.constants.SEED_BYTE_LENGTH);else if(typeof J==="string"){if(J.length!==Z$.constants.SEED_BYTE_LENGTH)throw TypeError('"seed" must be '+Z$.constants.SEED_BYTE_LENGTH+" bytes in length.")}else if(!(J instanceof Uint8Array))throw TypeError('"seed" must be a node.js Buffer, Uint8Array, or a binary string.');J=R0({message:J,encoding:"binary"});var X=new BJ(Z$.constants.PUBLIC_KEY_BYTE_LENGTH),Q=new BJ(Z$.constants.PRIVATE_KEY_BYTE_LENGTH);for(var Y=0;Y<32;++Y)Q[Y]=J[Y];return DH(X,Q),{publicKey:X,privateKey:Q}};Z$.privateKeyFromAsn1=function($){var J={},X=[],Q=zJ.asn1.validate($,NH,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=zJ.asn1.derToOid(J.privateKeyOid),W=zJ.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var U=J.privateKey,M=R0({message:zJ.asn1.fromDer(U).value,encoding:"binary"});return{privateKeyBytes:M}};Z$.publicKeyFromAsn1=function($){var J={},X=[],Q=zJ.asn1.validate($,FH,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=zJ.asn1.derToOid(J.publicKeyOid),W=zJ.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var U=J.ed25519PublicKey;if(U.length!==Z$.constants.PUBLIC_KEY_BYTE_LENGTH)throw Error("Key length is invalid.");return R0({message:U,encoding:"binary"})};Z$.publicKeyFromPrivateKey=function($){$=$||{};var J=R0({message:$.privateKey,encoding:"binary"});if(J.length!==Z$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Z$.constants.PRIVATE_KEY_BYTE_LENGTH);var X=new BJ(Z$.constants.PUBLIC_KEY_BYTE_LENGTH);for(var Q=0;Q<X.length;++Q)X[Q]=J[32+Q];return X};Z$.sign=function($){$=$||{};var J=R0($),X=R0({message:$.privateKey,encoding:"binary"});if(X.length===Z$.constants.SEED_BYTE_LENGTH){var Q=Z$.generateKeyPair({seed:X});X=Q.privateKey}else if(X.length!==Z$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Z$.constants.SEED_BYTE_LENGTH+" or "+Z$.constants.PRIVATE_KEY_BYTE_LENGTH);var Y=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length);ZH(Y,J,J.length,X);var G=new BJ(Z$.constants.SIGN_BYTE_LENGTH);for(var W=0;W<G.length;++W)G[W]=Y[W];return G};Z$.verify=function($){$=$||{};var J=R0($);if($.signature===void 0)throw TypeError('"options.signature" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a binary string.');var X=R0({message:$.signature,encoding:"binary"});if(X.length!==Z$.constants.SIGN_BYTE_LENGTH)throw TypeError('"options.signature" must have a byte length of '+Z$.constants.SIGN_BYTE_LENGTH);var Q=R0({message:$.publicKey,encoding:"binary"});if(Q.length!==Z$.constants.PUBLIC_KEY_BYTE_LENGTH)throw TypeError('"options.publicKey" must have a byte length of '+Z$.constants.PUBLIC_KEY_BYTE_LENGTH);var Y=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length),G=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length),W;for(W=0;W<Z$.constants.SIGN_BYTE_LENGTH;++W)Y[W]=X[W];for(W=0;W<J.length;++W)Y[W+Z$.constants.SIGN_BYTE_LENGTH]=J[W];return BH(G,Y,Y.length,Q)>=0};function R0($){var J=$.message;if(J instanceof Uint8Array||J instanceof BJ)return J;var X=$.encoding;if(J===void 0)if($.md)J=$.md.digest().getBytes(),X="binary";else throw TypeError('"options.message" or "options.md" not specified.');if(typeof J==="string"&&!X)throw TypeError('"options.encoding" must be "binary" or "utf8".');if(typeof J==="string"){if(typeof Buffer<"u")return Buffer.from(J,X);J=new b8(J,X)}else if(!(J instanceof b8))throw TypeError('"options.message" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a string with "options.encoding" specifying its encoding.');var Q=new BJ(J.length());for(var Y=0;Y<Q.length;++Y)Q[Y]=J.at(Y);return Q}var h8=U$(),pY=U$([1]),LH=U$([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),AH=U$([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),GW=U$([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),WW=U$([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),PX=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]),RH=U$([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function _X($,J){var X=zJ.md.sha512.create(),Q=new b8($);X.update(Q.getBytes(J),"binary");var Y=X.digest().getBytes();if(typeof Buffer<"u")return Buffer.from(Y,"binary");var G=new BJ(Z$.constants.HASH_BYTE_LENGTH);for(var W=0;W<64;++W)G[W]=Y.charCodeAt(W);return G}function DH($,J){var X=[U$(),U$(),U$(),U$()],Q,Y=_X(J,32);Y[0]&=248,Y[31]&=127,Y[31]|=64,l8(X,Y),m8($,X);for(Q=0;Q<32;++Q)J[Q+32]=$[Q];return 0}function ZH($,J,X,Q){var Y,G,W=new Float64Array(64),U=[U$(),U$(),U$(),U$()],M=_X(Q,32);M[0]&=248,M[31]&=127,M[31]|=64;var O=X+64;for(Y=0;Y<X;++Y)$[64+Y]=J[Y];for(Y=0;Y<32;++Y)$[32+Y]=M[32+Y];var V=_X($.subarray(32),X+32);u8(V),l8(U,V),m8($,U);for(Y=32;Y<64;++Y)$[Y]=Q[Y];var H=_X($,X+64);u8(H);for(Y=32;Y<64;++Y)W[Y]=0;for(Y=0;Y<32;++Y)W[Y]=V[Y];for(Y=0;Y<32;++Y)for(G=0;G<32;G++)W[Y+G]+=H[Y]*M[G];return VW($.subarray(32),W),O}function BH($,J,X,Q){var Y,G,W=new BJ(32),U=[U$(),U$(),U$(),U$()],M=[U$(),U$(),U$(),U$()];if(G=-1,X<64)return-1;if(TH(M,Q))return-1;if(!jH(J,32))return-1;for(Y=0;Y<X;++Y)$[Y]=J[Y];for(Y=0;Y<32;++Y)$[Y+32]=Q[Y];var O=_X($,X);if(u8(O),KW(U,M,O),l8(M,J.subarray(32)),g8(U,M),m8(W,U),X-=64,HW(J,0,W,0)){for(Y=0;Y<X;++Y)$[Y]=0;return-1}for(Y=0;Y<X;++Y)$[Y]=J[Y+64];return G=X,G}function jH($,J){var X;for(X=31;X>=0;--X){if($[J+X]<PX[X])return!0;if($[J+X]>PX[X])return!1}return!1}function VW($,J){var X,Q,Y,G;for(Q=63;Q>=32;--Q){X=0;for(Y=Q-32,G=Q-12;Y<G;++Y)J[Y]+=X-16*J[Q]*PX[Y-(Q-32)],X=J[Y]+128>>8,J[Y]-=X*256;J[Y]+=X,J[Q]=0}X=0;for(Y=0;Y<32;++Y)J[Y]+=X-(J[31]>>4)*PX[Y],X=J[Y]>>8,J[Y]&=255;for(Y=0;Y<32;++Y)J[Y]-=X*PX[Y];for(Q=0;Q<32;++Q)J[Q+1]+=J[Q]>>8,$[Q]=J[Q]&255}function u8($){var J=new Float64Array(64);for(var X=0;X<64;++X)J[X]=$[X],$[X]=0;VW($,J)}function g8($,J){var X=U$(),Q=U$(),Y=U$(),G=U$(),W=U$(),U=U$(),M=U$(),O=U$(),V=U$();fQ(X,$[1],$[0]),fQ(V,J[1],J[0]),u$(X,X,V),kQ(Q,$[0],$[1]),kQ(V,J[0],J[1]),u$(Q,Q,V),u$(Y,$[3],J[3]),u$(Y,Y,AH),u$(G,$[2],J[2]),kQ(G,G,G),fQ(W,Q,X),fQ(U,G,Y),kQ(M,G,Y),kQ(O,Q,X),u$($[0],W,U),u$($[1],O,M),u$($[2],M,U),u$($[3],W,O)}function UW($,J,X){for(var Q=0;Q<4;++Q)zW($[Q],J[Q],X)}function m8($,J){var X=U$(),Q=U$(),Y=U$();wH(Y,J[2]),u$(X,J[0],Y),u$(Q,J[1],Y),dY($,Q),$[31]^=qW(X)<<7}function dY($,J){var X,Q,Y,G=U$(),W=U$();for(X=0;X<16;++X)W[X]=J[X];f8(W),f8(W),f8(W);for(Q=0;Q<2;++Q){G[0]=W[0]-65517;for(X=1;X<15;++X)G[X]=W[X]-65535-(G[X-1]>>16&1),G[X-1]&=65535;G[15]=W[15]-32767-(G[14]>>16&1),Y=G[15]>>16&1,G[14]&=65535,zW(W,G,1-Y)}for(X=0;X<16;X++)$[2*X]=W[X]&255,$[2*X+1]=W[X]>>8}function TH($,J){var X=U$(),Q=U$(),Y=U$(),G=U$(),W=U$(),U=U$(),M=U$();if(h0($[2],pY),SH($[1],J),OQ(Y,$[1]),u$(G,Y,LH),fQ(Y,Y,$[2]),kQ(G,$[2],G),OQ(W,G),OQ(U,W),u$(M,U,W),u$(X,M,Y),u$(X,X,G),IH(X,X),u$(X,X,Y),u$(X,X,G),u$(X,X,G),u$($[0],X,G),OQ(Q,$[0]),u$(Q,Q,G),MW(Q,Y))u$($[0],$[0],RH);if(OQ(Q,$[0]),u$(Q,Q,G),MW(Q,Y))return-1;if(qW($[0])===J[31]>>7)fQ($[0],h8,$[0]);return u$($[3],$[0],$[1]),0}function SH($,J){var X;for(X=0;X<16;++X)$[X]=J[2*X]+(J[2*X+1]<<8);$[15]&=32767}function IH($,J){var X=U$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=250;Q>=0;--Q)if(OQ(X,X),Q!==1)u$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function MW($,J){var X=new BJ(32),Q=new BJ(32);return dY(X,$),dY(Q,J),HW(X,0,Q,0)}function HW($,J,X,Q){return CH($,J,X,Q,32)}function CH($,J,X,Q,Y){var G,W=0;for(G=0;G<Y;++G)W|=$[J+G]^X[Q+G];return(1&W-1>>>8)-1}function qW($){var J=new BJ(32);return dY(J,$),J[0]&1}function KW($,J,X){var Q,Y;h0($[0],h8),h0($[1],pY),h0($[2],pY),h0($[3],h8);for(Y=255;Y>=0;--Y)Q=X[Y/8|0]>>(Y&7)&1,UW($,J,Q),g8(J,$),g8($,$),UW($,J,Q)}function l8($,J){var X=[U$(),U$(),U$(),U$()];h0(X[0],GW),h0(X[1],WW),h0(X[2],pY),u$(X[3],GW,WW),KW($,X,J)}function h0($,J){var X;for(X=0;X<16;X++)$[X]=J[X]|0}function wH($,J){var X=U$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=253;Q>=0;--Q)if(OQ(X,X),Q!==2&&Q!==4)u$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function f8($){var J,X,Q=1;for(J=0;J<16;++J)X=$[J]+Q+65535,Q=Math.floor(X/65536),$[J]=X-Q*65536;$[0]+=Q-1+37*(Q-1)}function zW($,J,X){var Q,Y=~(X-1);for(var G=0;G<16;++G)Q=Y&($[G]^J[G]),$[G]^=Q,J[G]^=Q}function U$($){var J,X=new Float64Array(16);if($)for(J=0;J<$.length;++J)X[J]=$[J];return X}function kQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]+X[Q]}function fQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]-X[Q]}function OQ($,J){u$($,J,J)}function u$($,J,X){var Q,Y,G=0,W=0,U=0,M=0,O=0,V=0,H=0,q=0,F=0,K=0,A=0,L=0,R=0,I=0,j=0,C=0,w=0,P=0,l=0,e=0,y=0,n=0,Y$=0,L$=0,j$=0,QJ=0,S$=0,h$=0,u=0,J$=0,a=0,V$=X[0],O$=X[1],$$=X[2],P$=X[3],G$=X[4],c$=X[5],x$=X[6],E$=X[7],n$=X[8],y$=X[9],e$=X[10],GJ=X[11],WJ=X[12],s$=X[13],b$=X[14],i$=X[15];Q=J[0],G+=Q*V$,W+=Q*O$,U+=Q*$$,M+=Q*P$,O+=Q*G$,V+=Q*c$,H+=Q*x$,q+=Q*E$,F+=Q*n$,K+=Q*y$,A+=Q*e$,L+=Q*GJ,R+=Q*WJ,I+=Q*s$,j+=Q*b$,C+=Q*i$,Q=J[1],W+=Q*V$,U+=Q*O$,M+=Q*$$,O+=Q*P$,V+=Q*G$,H+=Q*c$,q+=Q*x$,F+=Q*E$,K+=Q*n$,A+=Q*y$,L+=Q*e$,R+=Q*GJ,I+=Q*WJ,j+=Q*s$,C+=Q*b$,w+=Q*i$,Q=J[2],U+=Q*V$,M+=Q*O$,O+=Q*$$,V+=Q*P$,H+=Q*G$,q+=Q*c$,F+=Q*x$,K+=Q*E$,A+=Q*n$,L+=Q*y$,R+=Q*e$,I+=Q*GJ,j+=Q*WJ,C+=Q*s$,w+=Q*b$,P+=Q*i$,Q=J[3],M+=Q*V$,O+=Q*O$,V+=Q*$$,H+=Q*P$,q+=Q*G$,F+=Q*c$,K+=Q*x$,A+=Q*E$,L+=Q*n$,R+=Q*y$,I+=Q*e$,j+=Q*GJ,C+=Q*WJ,w+=Q*s$,P+=Q*b$,l+=Q*i$,Q=J[4],O+=Q*V$,V+=Q*O$,H+=Q*$$,q+=Q*P$,F+=Q*G$,K+=Q*c$,A+=Q*x$,L+=Q*E$,R+=Q*n$,I+=Q*y$,j+=Q*e$,C+=Q*GJ,w+=Q*WJ,P+=Q*s$,l+=Q*b$,e+=Q*i$,Q=J[5],V+=Q*V$,H+=Q*O$,q+=Q*$$,F+=Q*P$,K+=Q*G$,A+=Q*c$,L+=Q*x$,R+=Q*E$,I+=Q*n$,j+=Q*y$,C+=Q*e$,w+=Q*GJ,P+=Q*WJ,l+=Q*s$,e+=Q*b$,y+=Q*i$,Q=J[6],H+=Q*V$,q+=Q*O$,F+=Q*$$,K+=Q*P$,A+=Q*G$,L+=Q*c$,R+=Q*x$,I+=Q*E$,j+=Q*n$,C+=Q*y$,w+=Q*e$,P+=Q*GJ,l+=Q*WJ,e+=Q*s$,y+=Q*b$,n+=Q*i$,Q=J[7],q+=Q*V$,F+=Q*O$,K+=Q*$$,A+=Q*P$,L+=Q*G$,R+=Q*c$,I+=Q*x$,j+=Q*E$,C+=Q*n$,w+=Q*y$,P+=Q*e$,l+=Q*GJ,e+=Q*WJ,y+=Q*s$,n+=Q*b$,Y$+=Q*i$,Q=J[8],F+=Q*V$,K+=Q*O$,A+=Q*$$,L+=Q*P$,R+=Q*G$,I+=Q*c$,j+=Q*x$,C+=Q*E$,w+=Q*n$,P+=Q*y$,l+=Q*e$,e+=Q*GJ,y+=Q*WJ,n+=Q*s$,Y$+=Q*b$,L$+=Q*i$,Q=J[9],K+=Q*V$,A+=Q*O$,L+=Q*$$,R+=Q*P$,I+=Q*G$,j+=Q*c$,C+=Q*x$,w+=Q*E$,P+=Q*n$,l+=Q*y$,e+=Q*e$,y+=Q*GJ,n+=Q*WJ,Y$+=Q*s$,L$+=Q*b$,j$+=Q*i$,Q=J[10],A+=Q*V$,L+=Q*O$,R+=Q*$$,I+=Q*P$,j+=Q*G$,C+=Q*c$,w+=Q*x$,P+=Q*E$,l+=Q*n$,e+=Q*y$,y+=Q*e$,n+=Q*GJ,Y$+=Q*WJ,L$+=Q*s$,j$+=Q*b$,QJ+=Q*i$,Q=J[11],L+=Q*V$,R+=Q*O$,I+=Q*$$,j+=Q*P$,C+=Q*G$,w+=Q*c$,P+=Q*x$,l+=Q*E$,e+=Q*n$,y+=Q*y$,n+=Q*e$,Y$+=Q*GJ,L$+=Q*WJ,j$+=Q*s$,QJ+=Q*b$,S$+=Q*i$,Q=J[12],R+=Q*V$,I+=Q*O$,j+=Q*$$,C+=Q*P$,w+=Q*G$,P+=Q*c$,l+=Q*x$,e+=Q*E$,y+=Q*n$,n+=Q*y$,Y$+=Q*e$,L$+=Q*GJ,j$+=Q*WJ,QJ+=Q*s$,S$+=Q*b$,h$+=Q*i$,Q=J[13],I+=Q*V$,j+=Q*O$,C+=Q*$$,w+=Q*P$,P+=Q*G$,l+=Q*c$,e+=Q*x$,y+=Q*E$,n+=Q*n$,Y$+=Q*y$,L$+=Q*e$,j$+=Q*GJ,QJ+=Q*WJ,S$+=Q*s$,h$+=Q*b$,u+=Q*i$,Q=J[14],j+=Q*V$,C+=Q*O$,w+=Q*$$,P+=Q*P$,l+=Q*G$,e+=Q*c$,y+=Q*x$,n+=Q*E$,Y$+=Q*n$,L$+=Q*y$,j$+=Q*e$,QJ+=Q*GJ,S$+=Q*WJ,h$+=Q*s$,u+=Q*b$,J$+=Q*i$,Q=J[15],C+=Q*V$,w+=Q*O$,P+=Q*$$,l+=Q*P$,e+=Q*G$,y+=Q*c$,n+=Q*x$,Y$+=Q*E$,L$+=Q*n$,j$+=Q*y$,QJ+=Q*e$,S$+=Q*GJ,h$+=Q*WJ,u+=Q*s$,J$+=Q*b$,a+=Q*i$,G+=38*w,W+=38*P,U+=38*l,M+=38*e,O+=38*y,V+=38*n,H+=38*Y$,q+=38*L$,F+=38*j$,K+=38*QJ,A+=38*S$,L+=38*h$,R+=38*u,I+=38*J$,j+=38*a,Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=F+Y+65535,Y=Math.floor(Q/65536),F=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=R+Y+65535,Y=Math.floor(Q/65536),R=Q-Y*65536,Q=I+Y+65535,Y=Math.floor(Q/65536),I=Q-Y*65536,Q=j+Y+65535,Y=Math.floor(Q/65536),j=Q-Y*65536,Q=C+Y+65535,Y=Math.floor(Q/65536),C=Q-Y*65536,G+=Y-1+37*(Y-1),Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=F+Y+65535,Y=Math.floor(Q/65536),F=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=R+Y+65535,Y=Math.floor(Q/65536),R=Q-Y*65536,Q=I+Y+65535,Y=Math.floor(Q/65536),I=Q-Y*65536,Q=j+Y+65535,Y=Math.floor(Q/65536),j=Q-Y*65536,Q=C+Y+65535,Y=Math.floor(Q/65536),C=Q-Y*65536,G+=Y-1+37*(Y-1),$[0]=G,$[1]=W,$[2]=U,$[3]=M,$[4]=O,$[5]=V,$[6]=H,$[7]=q,$[8]=F,$[9]=K,$[10]=A,$[11]=L,$[12]=R,$[13]=I,$[14]=j,$[15]=C}});var RW=H$((uF,AW)=>{var IJ=F$();_$();_J();jX();AW.exports=IJ.kem=IJ.kem||{};var NW=IJ.jsbn.BigInteger;IJ.kem.rsa={};IJ.kem.rsa.create=function($,J){J=J||{};var X=J.prng||IJ.random,Q={};return Q.encrypt=function(Y,G){var W=Math.ceil(Y.n.bitLength()/8),U;do U=new NW(IJ.util.bytesToHex(X.getBytesSync(W)),16).mod(Y.n);while(U.compareTo(NW.ONE)<=0);U=IJ.util.hexToBytes(U.toString(16));var M=W-U.length;if(M>0)U=IJ.util.fillString(String.fromCharCode(0),M)+U;var O=Y.encrypt(U,"NONE"),V=$.generate(U,G);return{encapsulation:O,key:V}},Q.decrypt=function(Y,G,W){var U=Y.decrypt(G,"NONE");return $.generate(U,W)},Q};IJ.kem.kdf1=function($,J){LW(this,$,0,J||$.digestLength)};IJ.kem.kdf2=function($,J){LW(this,$,1,J||$.digestLength)};function LW($,J,X,Q){$.generate=function(Y,G){var W=new IJ.util.ByteBuffer,U=Math.ceil(G/Q)+X,M=new IJ.util.ByteBuffer;for(var O=X;O<U;++O){M.putInt32(O),J.start(),J.update(Y+M.getBytes());var V=J.digest();W.putBytes(V.getBytes(Q))}return W.truncate(W.length()-G),W.getBytes()}}});var ZW=H$((gF,DW)=>{var T$=F$();_$();DW.exports=T$.log=T$.log||{};T$.log.levels=["none","error","warning","info","debug","verbose","max"];var iY={},p8=[],xX=null;T$.log.LEVEL_LOCKED=2;T$.log.NO_LEVEL_CHECK=4;T$.log.INTERPOLATE=8;for(bJ=0;bJ<T$.log.levels.length;++bJ)cY=T$.log.levels[bJ],iY[cY]={index:bJ,name:cY.toUpperCase()};var cY,bJ;T$.log.logMessage=function($){var J=iY[$.level].index;for(var X=0;X<p8.length;++X){var Q=p8[X];if(Q.flags&T$.log.NO_LEVEL_CHECK)Q.f($);else{var Y=iY[Q.level].index;if(J<=Y)Q.f(Q,$)}}};T$.log.prepareStandard=function($){if(!("standard"in $))$.standard=iY[$.level].name+" ["+$.category+"] "+$.message};T$.log.prepareFull=function($){if(!("full"in $)){var J=[$.message];J=J.concat([]),$.full=T$.util.format.apply(this,J)}};T$.log.prepareStandardFull=function($){if(!("standardFull"in $))T$.log.prepareStandard($),$.standardFull=$.standard};nY=["error","warning","info","debug","verbose"];for(bJ=0;bJ<nY.length;++bJ)(function(J){T$.log[J]=function(X,Q){var Y=Array.prototype.slice.call(arguments).slice(2),G={timestamp:new Date,level:J,category:X,message:Q,arguments:Y};T$.log.logMessage(G)}})(nY[bJ]);var nY,bJ;T$.log.makeLogger=function($){var J={flags:0,f:$};return T$.log.setLevel(J,"none"),J};T$.log.setLevel=function($,J){var X=!1;if($&&!($.flags&T$.log.LEVEL_LOCKED))for(var Q=0;Q<T$.log.levels.length;++Q){var Y=T$.log.levels[Q];if(J==Y){$.level=J,X=!0;break}}return X};T$.log.lock=function($,J){if(typeof J>"u"||J)$.flags|=T$.log.LEVEL_LOCKED;else $.flags&=~T$.log.LEVEL_LOCKED};T$.log.addLogger=function($){p8.push($)};if(typeof console<"u"&&"log"in console){if(console.error&&console.warn&&console.info&&console.debug)d8={error:console.error,warning:console.warn,info:console.info,debug:console.debug,verbose:console.debug},bQ=function($,J){T$.log.prepareStandard(J);var X=d8[J.level],Q=[J.standard];Q=Q.concat(J.arguments.slice()),X.apply(console,Q)},VQ=T$.log.makeLogger(bQ);else bQ=function(J,X){T$.log.prepareStandardFull(X),console.log(X.standardFull)},VQ=T$.log.makeLogger(bQ);T$.log.setLevel(VQ,"debug"),T$.log.addLogger(VQ),xX=VQ}else console={log:function(){}};var VQ,d8,bQ;if(xX!==null&&typeof window<"u"&&window.location){if(yQ=new URL(window.location.href).searchParams,yQ.has("console.level"))T$.log.setLevel(xX,yQ.get("console.level").slice(-1)[0]);if(yQ.has("console.lock")){if(c8=yQ.get("console.lock").slice(-1)[0],c8=="true")T$.log.lock(xX)}}var yQ,c8;T$.log.consoleLogger=xX});var jW=H$((mF,BW)=>{BW.exports=$0();TY();wQ();Y8();k8()});var IW=H$((lF,SW)=>{var p=F$();P0();mJ();ZX();_0();QQ();A8();_J();_$();uY();var B=p.asn1,DJ=SW.exports=p.pkcs7=p.pkcs7||{};DJ.messageFromPem=function($){var J=p.pem.decode($)[0];if(J.type!=="PKCS7"){var X=Error('Could not convert PKCS#7 message from PEM; PEM header type is not "PKCS#7".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PKCS#7 message from PEM; PEM is encrypted.");var Q=B.fromDer(J.body);return DJ.messageFromAsn1(Q)};DJ.messageToPem=function($,J){var X={type:"PKCS7",body:B.toDer($.toAsn1()).getBytes()};return p.pem.encode(X,{maxline:J})};DJ.messageFromAsn1=function($){var J={},X=[];if(!B.validate($,DJ.asn1.contentInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 message. ASN.1 object is not an PKCS#7 ContentInfo.");throw Q.errors=X,Q}var Y=B.derToOid(J.contentType),G;switch(Y){case p.pki.oids.envelopedData:G=DJ.createEnvelopedData();break;case p.pki.oids.encryptedData:G=DJ.createEncryptedData();break;case p.pki.oids.signedData:G=DJ.createSignedData();break;default:throw Error("Cannot read PKCS#7 message. ContentType with OID "+Y+" is not (yet) supported.")}return G.fromAsn1(J.content.value[0]),G};DJ.createSignedData=function(){var $=null;return $={type:p.pki.oids.signedData,version:1,certificates:[],crls:[],signers:[],digestAlgorithmIdentifiers:[],contentInfo:null,signerInfos:[],fromAsn1:function(Q){if(i8($,Q,DJ.asn1.signedDataValidator),$.certificates=[],$.crls=[],$.digestAlgorithmIdentifiers=[],$.contentInfo=null,$.signerInfos=[],$.rawCapture.certificates){var Y=$.rawCapture.certificates.value;for(var G=0;G<Y.length;++G)$.certificates.push(p.pki.certificateFromAsn1(Y[G]))}},toAsn1:function(){if(!$.contentInfo)$.sign();var Q=[];for(var Y=0;Y<$.certificates.length;++Y)Q.push(p.pki.certificateToAsn1($.certificates[Y]));var G=[],W=B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,$.digestAlgorithmIdentifiers),$.contentInfo])]);if(Q.length>0)W.value[0].value.push(B.create(B.Class.CONTEXT_SPECIFIC,0,!0,Q));if(G.length>0)W.value[0].value.push(B.create(B.Class.CONTEXT_SPECIFIC,1,!0,G));return W.value[0].value.push(B.create(B.Class.UNIVERSAL,B.Type.SET,!0,$.signerInfos)),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),W])},addSigner:function(Q){var{issuer:Y,serialNumber:G}=Q;if(Q.certificate){var W=Q.certificate;if(typeof W==="string")W=p.pki.certificateFromPem(W);Y=W.issuer.attributes,G=W.serialNumber}var U=Q.key;if(!U)throw Error("Could not add PKCS#7 signer; no private key specified.");if(typeof U==="string")U=p.pki.privateKeyFromPem(U);var M=Q.digestAlgorithm||p.pki.oids.sha1;switch(M){case p.pki.oids.sha1:case p.pki.oids.sha256:case p.pki.oids.sha384:case p.pki.oids.sha512:case p.pki.oids.md5:break;default:throw Error("Could not add PKCS#7 signer; unknown message digest algorithm: "+M)}var O=Q.authenticatedAttributes||[];if(O.length>0){var V=!1,H=!1;for(var q=0;q<O.length;++q){var F=O[q];if(!V&&F.type===p.pki.oids.contentType){if(V=!0,H)break;continue}if(!H&&F.type===p.pki.oids.messageDigest){if(H=!0,V)break;continue}}if(!V||!H)throw Error("Invalid signer.authenticatedAttributes. If signer.authenticatedAttributes is specified, then it must contain at least two attributes, PKCS #9 content-type and PKCS #9 message-digest.")}$.signers.push({key:U,version:1,issuer:Y,serialNumber:G,digestAlgorithm:M,signatureAlgorithm:p.pki.oids.rsaEncryption,signature:null,authenticatedAttributes:O,unauthenticatedAttributes:[]})},sign:function(Q){if(Q=Q||{},typeof $.content!=="object"||$.contentInfo===null){if($.contentInfo=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(p.pki.oids.data).getBytes())]),"content"in $){var Y;if($.content instanceof p.util.ByteBuffer)Y=$.content.bytes();else if(typeof $.content==="string")Y=p.util.encodeUtf8($.content);if(Q.detached)$.detachedContent=B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,Y);else $.contentInfo.value.push(B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,Y)]))}}if($.signers.length===0)return;var G=J();X(G)},verify:function(){throw Error("PKCS#7 signature verification not yet implemented.")},addCertificate:function(Q){if(typeof Q==="string")Q=p.pki.certificateFromPem(Q);$.certificates.push(Q)},addCertificateRevokationList:function(Q){throw Error("PKCS#7 CRL support not yet implemented.")}},$;function J(){var Q={};for(var Y=0;Y<$.signers.length;++Y){var G=$.signers[Y],W=G.digestAlgorithm;if(!(W in Q))Q[W]=p.md[p.pki.oids[W]].create();if(G.authenticatedAttributes.length===0)G.md=Q[W];else G.md=p.md[p.pki.oids[W]].create()}$.digestAlgorithmIdentifiers=[];for(var W in Q)$.digestAlgorithmIdentifiers.push(B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(W).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]));return Q}function X(Q){var Y;if($.detachedContent)Y=$.detachedContent;else Y=$.contentInfo.value[1],Y=Y.value[0];if(!Y)throw Error("Could not sign PKCS#7 message; there is no content to sign.");var G=B.derToOid($.contentInfo.value[0].value),W=B.toDer(Y);W.getByte(),B.getBerValueLength(W),W=W.getBytes();for(var U in Q)Q[U].start().update(W);var M=new Date;for(var O=0;O<$.signers.length;++O){var V=$.signers[O];if(V.authenticatedAttributes.length===0){if(G!==p.pki.oids.data)throw Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.")}else{V.authenticatedAttributesAsn1=B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[]);var H=B.create(B.Class.UNIVERSAL,B.Type.SET,!0,[]);for(var q=0;q<V.authenticatedAttributes.length;++q){var F=V.authenticatedAttributes[q];if(F.type===p.pki.oids.messageDigest)F.value=Q[V.digestAlgorithm].digest();else if(F.type===p.pki.oids.signingTime){if(!F.value)F.value=M}H.value.push(n8(F)),V.authenticatedAttributesAsn1.value.push(n8(F))}W=B.toDer(H).getBytes(),V.md.start().update(W)}V.signature=V.key.sign(V.md,"RSASSA-PKCS1-V1_5")}$.signerInfos=fH($.signers)}};DJ.createEncryptedData=function(){var $=null;return $={type:p.pki.oids.encryptedData,version:0,encryptedContent:{algorithm:p.pki.oids["aes256-CBC"]},fromAsn1:function(J){i8($,J,DJ.asn1.encryptedDataValidator)},decrypt:function(J){if(J!==void 0)$.encryptedContent.key=J;TW($)}},$};DJ.createEnvelopedData=function(){var $=null;return $={type:p.pki.oids.envelopedData,version:0,recipients:[],encryptedContent:{algorithm:p.pki.oids["aes256-CBC"]},fromAsn1:function(J){var X=i8($,J,DJ.asn1.envelopedDataValidator);$.recipients=xH(X.recipientInfos.value)},toAsn1:function(){return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,vH($.recipients)),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,yH($.encryptedContent))])])])},findRecipient:function(J){var X=J.issuer.attributes;for(var Q=0;Q<$.recipients.length;++Q){var Y=$.recipients[Q],G=Y.issuer;if(Y.serialNumber!==J.serialNumber)continue;if(G.length!==X.length)continue;var W=!0;for(var U=0;U<X.length;++U)if(G[U].type!==X[U].type||G[U].value!==X[U].value){W=!1;break}if(W)return Y}return null},decrypt:function(J,X){if($.encryptedContent.key===void 0&&J!==void 0&&X!==void 0)switch(J.encryptedContent.algorithm){case p.pki.oids.rsaEncryption:case p.pki.oids.desCBC:var Q=X.decrypt(J.encryptedContent.content);$.encryptedContent.key=p.util.createBuffer(Q);break;default:throw Error("Unsupported asymmetric cipher, OID "+J.encryptedContent.algorithm)}TW($)},addRecipient:function(J){$.recipients.push({version:0,issuer:J.issuer.attributes,serialNumber:J.serialNumber,encryptedContent:{algorithm:p.pki.oids.rsaEncryption,key:J.publicKey}})},encrypt:function(J,X){if($.encryptedContent.content===void 0){X=X||$.encryptedContent.algorithm,J=J||$.encryptedContent.key;var Q,Y,G;switch(X){case p.pki.oids["aes128-CBC"]:Q=16,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["aes192-CBC"]:Q=24,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["aes256-CBC"]:Q=32,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["des-EDE3-CBC"]:Q=24,Y=8,G=p.des.createEncryptionCipher;break;default:throw Error("Unsupported symmetric cipher, OID "+X)}if(J===void 0)J=p.util.createBuffer(p.random.getBytes(Q));else if(J.length()!=Q)throw Error("Symmetric key has wrong length; got "+J.length()+" bytes, expected "+Q+".");$.encryptedContent.algorithm=X,$.encryptedContent.key=J,$.encryptedContent.parameter=p.util.createBuffer(p.random.getBytes(Y));var W=G(J);if(W.start($.encryptedContent.parameter.copy()),W.update($.content),!W.finish())throw Error("Symmetric encryption failed.");$.encryptedContent.content=W.output}for(var U=0;U<$.recipients.length;++U){var M=$.recipients[U];if(M.encryptedContent.content!==void 0)continue;switch(M.encryptedContent.algorithm){case p.pki.oids.rsaEncryption:M.encryptedContent.content=M.encryptedContent.key.encrypt($.encryptedContent.key.data);break;default:throw Error("Unsupported asymmetric cipher, OID "+M.encryptedContent.algorithm)}}}},$};function PH($){var J={},X=[];if(!B.validate($,DJ.asn1.recipientInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 RecipientInfo. ASN.1 object is not an PKCS#7 RecipientInfo.");throw Q.errors=X,Q}return{version:J.version.charCodeAt(0),issuer:p.pki.RDNAttributesAsArray(J.issuer),serialNumber:p.util.createBuffer(J.serial).toHex(),encryptedContent:{algorithm:B.derToOid(J.encAlgorithm),parameter:J.encParameter?J.encParameter.value:void 0,content:J.encKey}}}function _H($){return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[p.pki.distinguishedNameToAsn1({attributes:$.issuer}),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,p.util.hexToBytes($.serialNumber))]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.encryptedContent.algorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]),B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.encryptedContent.content)])}function xH($){var J=[];for(var X=0;X<$.length;++X)J.push(PH($[X]));return J}function vH($){var J=[];for(var X=0;X<$.length;++X)J.push(_H($[X]));return J}function kH($){var J=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[p.pki.distinguishedNameToAsn1({attributes:$.issuer}),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,p.util.hexToBytes($.serialNumber))]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.digestAlgorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")])]);if($.authenticatedAttributesAsn1)J.value.push($.authenticatedAttributesAsn1);if(J.value.push(B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.signatureAlgorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")])),J.value.push(B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.signature)),$.unauthenticatedAttributes.length>0){var X=B.create(B.Class.CONTEXT_SPECIFIC,1,!0,[]);for(var Q=0;Q<$.unauthenticatedAttributes.length;++Q){var Y=$.unauthenticatedAttributes[Q];X.values.push(n8(Y))}J.value.push(X)}return J}function fH($){var J=[];for(var X=0;X<$.length;++X)J.push(kH($[X]));return J}function n8($){var J;if($.type===p.pki.oids.contentType)J=B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.value).getBytes());else if($.type===p.pki.oids.messageDigest)J=B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.value.bytes());else if($.type===p.pki.oids.signingTime){var X=new Date("1950-01-01T00:00:00Z"),Q=new Date("2050-01-01T00:00:00Z"),Y=$.value;if(typeof Y==="string"){var G=Date.parse(Y);if(!isNaN(G))Y=new Date(G);else if(Y.length===13)Y=B.utcTimeToDate(Y);else Y=B.generalizedTimeToDate(Y)}if(Y>=X&&Y<Q)J=B.create(B.Class.UNIVERSAL,B.Type.UTCTIME,!1,B.dateToUtcTime(Y));else J=B.create(B.Class.UNIVERSAL,B.Type.GENERALIZEDTIME,!1,B.dateToGeneralizedTime(Y))}return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,[J])])}function yH($){return[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(p.pki.oids.data).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.algorithm).getBytes()),!$.parameter?void 0:B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.parameter.getBytes())]),B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.content.getBytes())])]}function i8($,J,X){var Q={},Y=[];if(!B.validate(J,X,Q,Y)){var G=Error("Cannot read PKCS#7 message. ASN.1 object is not a supported PKCS#7 message.");throw G.errors=G,G}var W=B.derToOid(Q.contentType);if(W!==p.pki.oids.data)throw Error("Unsupported PKCS#7 message. Only wrapped ContentType Data supported.");if(Q.encryptedContent){var U="";if(p.util.isArray(Q.encryptedContent))for(var M=0;M<Q.encryptedContent.length;++M){if(Q.encryptedContent[M].type!==B.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting encrypted content constructed of only OCTET STRING objects.");U+=Q.encryptedContent[M].value}else U=Q.encryptedContent;$.encryptedContent={algorithm:B.derToOid(Q.encAlgorithm),parameter:p.util.createBuffer(Q.encParameter.value),content:p.util.createBuffer(U)}}if(Q.content){var U="";if(p.util.isArray(Q.content))for(var M=0;M<Q.content.length;++M){if(Q.content[M].type!==B.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting content constructed of only OCTET STRING objects.");U+=Q.content[M].value}else U=Q.content;$.content=p.util.createBuffer(U)}return $.version=Q.version.charCodeAt(0),$.rawCapture=Q,Q}function TW($){if($.encryptedContent.key===void 0)throw Error("Symmetric key not available.");if($.content===void 0){var J;switch($.encryptedContent.algorithm){case p.pki.oids["aes128-CBC"]:case p.pki.oids["aes192-CBC"]:case p.pki.oids["aes256-CBC"]:J=p.aes.createDecryptionCipher($.encryptedContent.key);break;case p.pki.oids.desCBC:case p.pki.oids["des-EDE3-CBC"]:J=p.des.createDecryptionCipher($.encryptedContent.key);break;default:throw Error("Unsupported symmetric cipher, OID "+$.encryptedContent.algorithm)}if(J.start($.encryptedContent.parameter),J.update($.encryptedContent.content),!J.finish())throw Error("Symmetric decryption failed.");$.content=J.output}}});var wW=H$((pF,CW)=>{var YJ=F$();P0();TQ();TY();wQ();_$();var aY=CW.exports=YJ.ssh=YJ.ssh||{};aY.privateKeyToPutty=function($,J,X){X=X||"",J=J||"";var Q="ssh-rsa",Y=J===""?"none":"aes256-cbc",G="PuTTY-User-Key-File-2: "+Q+`\r
+`+U+J.substr(W+1);G=Y-W-1,W=-1,++Y}else if(J[Y]===" "||J[Y]==="\t"||J[Y]===",")W=Y;return J}function HM($){return $.replace(/^\s+/,"")}});var BX=q$((TF,aG)=>{var o$=F$();AY();t9();_$();aG.exports=o$.des=o$.des||{};o$.des.startEncrypting=function($,J,X,Q){var Y=wY({key:$,output:X,decrypt:!1,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};o$.des.createEncryptionCipher=function($,J){return wY({key:$,output:null,decrypt:!1,mode:J})};o$.des.startDecrypting=function($,J,X,Q){var Y=wY({key:$,output:X,decrypt:!0,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};o$.des.createDecryptionCipher=function($,J){return wY({key:$,output:null,decrypt:!0,mode:J})};o$.des.Algorithm=function($,J){var X=this;X.name=$,X.mode=new J({blockSize:8,cipher:{encrypt:function(Q,Y){return oG(X._keys,Q,Y,!1)},decrypt:function(Q,Y){return oG(X._keys,Q,Y,!0)}}}),X._init=!1};o$.des.Algorithm.prototype.initialize=function($){if(this._init)return;var J=o$.util.createBuffer($.key);if(this.name.indexOf("3DES")===0){if(J.length()!==24)throw Error("Invalid Triple-DES key size: "+J.length()*8)}this._keys=DM(J),this._init=!0};Q0("DES-ECB",o$.cipher.modes.ecb);Q0("DES-CBC",o$.cipher.modes.cbc);Q0("DES-CFB",o$.cipher.modes.cfb);Q0("DES-OFB",o$.cipher.modes.ofb);Q0("DES-CTR",o$.cipher.modes.ctr);Q0("3DES-ECB",o$.cipher.modes.ecb);Q0("3DES-CBC",o$.cipher.modes.cbc);Q0("3DES-CFB",o$.cipher.modes.cfb);Q0("3DES-OFB",o$.cipher.modes.ofb);Q0("3DES-CTR",o$.cipher.modes.ctr);function Q0($,J){var X=function(){return new o$.des.Algorithm($,J)};o$.cipher.registerAlgorithm($,X)}var KM=[16843776,0,65536,16843780,16842756,66564,4,65536,1024,16843776,16843780,1024,16778244,16842756,16777216,4,1028,16778240,16778240,66560,66560,16842752,16842752,16778244,65540,16777220,16777220,65540,0,1028,66564,16777216,65536,16843780,4,16842752,16843776,16777216,16777216,1024,16842756,65536,66560,16777220,1024,4,16778244,66564,16843780,65540,16842752,16778244,16777220,1028,66564,16843776,1028,16778240,16778240,0,65540,66560,0,16842756],zM=[-2146402272,-2147450880,32768,1081376,1048576,32,-2146435040,-2147450848,-2147483616,-2146402272,-2146402304,-2147483648,-2147450880,1048576,32,-2146435040,1081344,1048608,-2147450848,0,-2147483648,32768,1081376,-2146435072,1048608,-2147483616,0,1081344,32800,-2146402304,-2146435072,32800,0,1081376,-2146435040,1048576,-2147450848,-2146435072,-2146402304,32768,-2146435072,-2147450880,32,-2146402272,1081376,32,32768,-2147483648,32800,-2146402304,1048576,-2147483616,1048608,-2147450848,-2147483616,1048608,1081344,0,-2147450880,32800,-2147483648,-2146435040,-2146402272,1081344],EM=[520,134349312,0,134348808,134218240,0,131592,134218240,131080,134217736,134217736,131072,134349320,131080,134348800,520,134217728,8,134349312,512,131584,134348800,134348808,131592,134218248,131584,131072,134218248,8,134349320,512,134217728,134349312,134217728,131080,520,131072,134349312,134218240,0,512,131080,134349320,134218240,134217736,512,0,134348808,134218248,131072,134217728,134349320,8,131592,131584,134217736,134348800,134218248,520,134348800,131592,8,134348808,131584],FM=[8396801,8321,8321,128,8396928,8388737,8388609,8193,0,8396800,8396800,8396929,129,0,8388736,8388609,1,8192,8388608,8396801,128,8388608,8193,8320,8388737,1,8320,8388736,8192,8396928,8396929,129,8388736,8388609,8396800,8396929,129,0,0,8396800,8320,8388736,8388737,1,8396801,8321,8321,128,8396929,129,1,8192,8388609,8193,8396928,8388737,8193,8320,8388608,8396801,128,8388608,8192,8396928],NM=[256,34078976,34078720,1107296512,524288,256,1073741824,34078720,1074266368,524288,33554688,1074266368,1107296512,1107820544,524544,1073741824,33554432,1074266112,1074266112,0,1073742080,1107820800,1107820800,33554688,1107820544,1073742080,0,1107296256,34078976,33554432,1107296256,524544,524288,1107296512,256,33554432,1073741824,34078720,1107296512,1074266368,33554688,1073741824,1107820544,34078976,1074266368,256,33554432,1107820544,1107820800,524544,1107296256,1107820800,34078720,0,1074266112,1107296256,524544,33554688,1073742080,524288,0,1074266112,34078976,1073742080],LM=[536870928,541065216,16384,541081616,541065216,16,541081616,4194304,536887296,4210704,4194304,536870928,4194320,536887296,536870912,16400,0,4194320,536887312,16384,4210688,536887312,16,541065232,541065232,0,4210704,541081600,16400,4210688,541081600,536870912,536887296,16,541065232,4210688,541081616,4194304,16400,536870928,4194304,536887296,536870912,16400,536870928,541081616,4210688,541065216,4210704,541081600,0,541065232,16,16384,541065216,4210704,16384,4194320,536887312,0,541081600,536870912,4194320,536887312],AM=[2097152,69206018,67110914,0,2048,67110914,2099202,69208064,69208066,2097152,0,67108866,2,67108864,69206018,2050,67110912,2099202,2097154,67110912,67108866,69206016,69208064,2097154,69206016,2048,2050,69208066,2099200,2,67108864,2099200,67108864,2099200,2097152,67110914,67110914,69206018,69206018,2,2097154,67108864,67110912,2097152,69208064,2050,2099202,69208064,2050,67108866,69208066,69206016,2099200,0,2,69208066,0,2099202,69206016,2048,67108866,67110912,2048,2097154],RM=[268439616,4096,262144,268701760,268435456,268439616,64,268435456,262208,268697600,268701760,266240,268701696,266304,4096,64,268697600,268435520,268439552,4160,266240,262208,268697664,268701696,4160,0,0,268697664,268435520,268439552,266304,262144,266304,262144,268701696,4096,64,268697664,4096,266304,268439552,64,268435520,268697600,268697664,268435456,262144,268439616,0,268701760,262208,268435520,268697600,268439552,268439616,0,268701760,266240,266240,4160,4160,262208,268435456,268701696];function DM($){var J=[0,4,536870912,536870916,65536,65540,536936448,536936452,512,516,536871424,536871428,66048,66052,536936960,536936964],X=[0,1,1048576,1048577,67108864,67108865,68157440,68157441,256,257,1048832,1048833,67109120,67109121,68157696,68157697],Q=[0,8,2048,2056,16777216,16777224,16779264,16779272,0,8,2048,2056,16777216,16777224,16779264,16779272],Y=[0,2097152,134217728,136314880,8192,2105344,134225920,136323072,131072,2228224,134348800,136445952,139264,2236416,134356992,136454144],G=[0,262144,16,262160,0,262144,16,262160,4096,266240,4112,266256,4096,266240,4112,266256],W=[0,1024,32,1056,0,1024,32,1056,33554432,33555456,33554464,33555488,33554432,33555456,33554464,33555488],U=[0,268435456,524288,268959744,2,268435458,524290,268959746,0,268435456,524288,268959744,2,268435458,524290,268959746],M=[0,65536,2048,67584,536870912,536936448,536872960,536938496,131072,196608,133120,198656,537001984,537067520,537004032,537069568],O=[0,262144,0,262144,2,262146,2,262146,33554432,33816576,33554432,33816576,33554434,33816578,33554434,33816578],V=[0,268435456,8,268435464,0,268435456,8,268435464,1024,268436480,1032,268436488,1024,268436480,1032,268436488],q=[0,32,0,32,1048576,1048608,1048576,1048608,8192,8224,8192,8224,1056768,1056800,1056768,1056800],H=[0,16777216,512,16777728,2097152,18874368,2097664,18874880,67108864,83886080,67109376,83886592,69206016,85983232,69206528,85983744],N=[0,4096,134217728,134221824,524288,528384,134742016,134746112,16,4112,134217744,134221840,524304,528400,134742032,134746128],K=[0,4,256,260,0,4,256,260,1,5,257,261,1,5,257,261],L=$.length()>8?3:1,A=[],D=[0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0],S=0,B;for(var C=0;C<L;C++){var w=$.getInt32(),P=$.getInt32();B=(w>>>4^P)&252645135,P^=B,w^=B<<4,B=(P>>>-16^w)&65535,w^=B,P^=B<<-16,B=(w>>>2^P)&858993459,P^=B,w^=B<<2,B=(P>>>-16^w)&65535,w^=B,P^=B<<-16,B=(w>>>1^P)&1431655765,P^=B,w^=B<<1,B=(P>>>8^w)&16711935,w^=B,P^=B<<8,B=(w>>>1^P)&1431655765,P^=B,w^=B<<1,B=w<<8|P>>>20&240,w=P<<24|P<<8&16711680|P>>>8&65280|P>>>24&240,P=B;for(var l=0;l<D.length;++l){if(D[l])w=w<<2|w>>>26,P=P<<2|P>>>26;else w=w<<1|w>>>27,P=P<<1|P>>>27;w&=-15,P&=-15;var e=J[w>>>28]|X[w>>>24&15]|Q[w>>>20&15]|Y[w>>>16&15]|G[w>>>12&15]|W[w>>>8&15]|U[w>>>4&15],y=M[P>>>28]|O[P>>>24&15]|V[P>>>20&15]|q[P>>>16&15]|H[P>>>12&15]|N[P>>>8&15]|K[P>>>4&15];B=(y>>>16^e)&65535,A[S++]=e^B,A[S++]=y^B<<16}}return A}function oG($,J,X,Q){var Y=$.length===32?3:9,G;if(Y===3)G=Q?[30,-2,-2]:[0,32,2];else G=Q?[94,62,-2,32,64,2,30,-2,-2]:[0,32,2,62,30,-2,64,96,2];var W,U=J[0],M=J[1];W=(U>>>4^M)&252645135,M^=W,U^=W<<4,W=(U>>>16^M)&65535,M^=W,U^=W<<16,W=(M>>>2^U)&858993459,U^=W,M^=W<<2,W=(M>>>8^U)&16711935,U^=W,M^=W<<8,W=(U>>>1^M)&1431655765,M^=W,U^=W<<1,U=U<<1|U>>>31,M=M<<1|M>>>31;for(var O=0;O<Y;O+=3){var V=G[O+1],q=G[O+2];for(var H=G[O];H!=V;H+=q){var N=M^$[H],K=(M>>>4|M<<28)^$[H+1];W=U,U=M,M=W^(zM[N>>>24&63]|FM[N>>>16&63]|LM[N>>>8&63]|RM[N&63]|KM[K>>>24&63]|EM[K>>>16&63]|NM[K>>>8&63]|AM[K&63])}W=U,U=M,M=W}U=U>>>1|U<<31,M=M>>>1|M<<31,W=(U>>>1^M)&1431655765,M^=W,U^=W<<1,W=(M>>>8^U)&16711935,U^=W,M^=W<<8,W=(M>>>2^U)&858993459,U^=W,M^=W<<2,W=(U>>>16^M)&65535,M^=W,U^=W<<16,W=(U>>>4^M)&252645135,M^=W,U^=W<<4,X[0]=U,X[1]=M}function wY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="DES-"+J,Q;if($.decrypt)Q=o$.cipher.createDecipher(X,$.key);else Q=o$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var U=null;if(W instanceof o$.util.ByteBuffer)U=W,W={};W=W||{},W.output=U,W.iv=G,Y.call(Q,W)},Q}});var PY=q$((SF,sG)=>{var AJ=F$();TQ();$0();_$();var ZM=AJ.pkcs5=AJ.pkcs5||{},L0;if(AJ.util.isNodejs&&!AJ.options.usePureJavaScript)L0=KX("crypto");sG.exports=AJ.pbkdf2=ZM.pbkdf2=function($,J,X,Q,Y,G){if(typeof Y==="function")G=Y,Y=null;if(AJ.util.isNodejs&&!AJ.options.usePureJavaScript&&L0.pbkdf2&&(Y===null||typeof Y!=="object")&&(L0.pbkdf2Sync.length>4||(!Y||Y==="sha1"))){if(typeof Y!=="string")Y="sha1";if($=Buffer.from($,"binary"),J=Buffer.from(J,"binary"),!G){if(L0.pbkdf2Sync.length===4)return L0.pbkdf2Sync($,J,X,Q).toString("binary");return L0.pbkdf2Sync($,J,X,Q,Y).toString("binary")}if(L0.pbkdf2Sync.length===4)return L0.pbkdf2($,J,X,Q,function(B,C){if(B)return G(B);G(null,C.toString("binary"))});return L0.pbkdf2($,J,X,Q,Y,function(B,C){if(B)return G(B);G(null,C.toString("binary"))})}if(typeof Y>"u"||Y===null)Y="sha1";if(typeof Y==="string"){if(!(Y in AJ.md.algorithms))throw Error("Unknown hash algorithm: "+Y);Y=AJ.md[Y].create()}var W=Y.digestLength;if(Q>4294967295*W){var U=Error("Derived key is too long.");if(G)return G(U);throw U}var M=Math.ceil(Q/W),O=Q-(M-1)*W,V=AJ.hmac.create();V.start(Y,$);var q="",H,N,K;if(!G){for(var L=1;L<=M;++L){V.start(null,null),V.update(J),V.update(AJ.util.int32ToBytes(L)),H=K=V.digest().getBytes();for(var A=2;A<=X;++A)V.start(null,null),V.update(K),N=V.digest().getBytes(),H=AJ.util.xorBytes(H,N,W),K=N;q+=L<M?H:H.substr(0,O)}return q}var L=1,A;function D(){if(L>M)return G(null,q);V.start(null,null),V.update(J),V.update(AJ.util.int32ToBytes(L)),H=K=V.digest().getBytes(),A=2,S()}function S(){if(A<=X)return V.start(null,null),V.update(K),N=V.digest().getBytes(),H=AJ.util.xorBytes(H,N,W),K=N,++A,AJ.util.setImmediate(S);q+=L<M?H:H.substr(0,O),++L,D()}D()}});var G8=q$((IF,J1)=>{var X0=F$();$0();_$();var tG=J1.exports=X0.sha256=X0.sha256||{};X0.md.sha256=X0.md.algorithms.sha256=tG;tG.create=function(){if(!eG)BM();var $=null,J=X0.util.createBuffer(),X=Array(64),Q={algorithm:"sha256",blockLength:64,digestLength:32,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=X0.util.createBuffer(),$={h0:1779033703,h1:3144134277,h2:1013904242,h3:2773480762,h4:1359893119,h5:2600822924,h6:528734635,h7:1541459225},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=X0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),rG($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=X0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(Y8.substr(0,Q.blockLength-W));var U,M,O=Q.fullMessageLength[0]*8;for(var V=0;V<Q.fullMessageLength.length-1;++V)U=Q.fullMessageLength[V+1]*8,M=U/4294967296>>>0,O+=M,Y.putInt32(O>>>0),O=U>>>0;Y.putInt32(O);var q={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4,h5:$.h5,h6:$.h6,h7:$.h7};rG(q,X,Y);var H=X0.util.createBuffer();return H.putInt32(q.h0),H.putInt32(q.h1),H.putInt32(q.h2),H.putInt32(q.h3),H.putInt32(q.h4),H.putInt32(q.h5),H.putInt32(q.h6),H.putInt32(q.h7),H},Q};var Y8=null,eG=!1,$1=null;function BM(){Y8=String.fromCharCode(128),Y8+=X0.util.fillString(String.fromCharCode(0),64),$1=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],eG=!0}function rG($,J,X){var Q,Y,G,W,U,M,O,V,q,H,N,K,L,A,D,S=X.length();while(S>=64){for(O=0;O<16;++O)J[O]=X.getInt32();for(;O<64;++O)Q=J[O-2],Q=(Q>>>17|Q<<15)^(Q>>>19|Q<<13)^Q>>>10,Y=J[O-15],Y=(Y>>>7|Y<<25)^(Y>>>18|Y<<14)^Y>>>3,J[O]=Q+J[O-7]+Y+J[O-16]|0;V=$.h0,q=$.h1,H=$.h2,N=$.h3,K=$.h4,L=$.h5,A=$.h6,D=$.h7;for(O=0;O<64;++O)W=(K>>>6|K<<26)^(K>>>11|K<<21)^(K>>>25|K<<7),U=A^K&(L^A),G=(V>>>2|V<<30)^(V>>>13|V<<19)^(V>>>22|V<<10),M=V&q|H&(V^q),Q=D+W+U+$1[O]+J[O],Y=G+M,D=A,A=L,L=K,K=N+Q>>>0,N=H,H=q,q=V,V=Q+Y>>>0;$.h0=$.h0+V|0,$.h1=$.h1+q|0,$.h2=$.h2+H|0,$.h3=$.h3+N|0,$.h4=$.h4+K|0,$.h5=$.h5+L|0,$.h6=$.h6+A|0,$.h7=$.h7+D|0,S-=64}}});var W8=q$((CF,Q1)=>{var Y0=F$();_$();var _Y=null;if(Y0.util.isNodejs&&!Y0.options.usePureJavaScript&&!process.versions["node-webkit"])_Y=KX("crypto");var jM=Q1.exports=Y0.prng=Y0.prng||{};jM.create=function($){var J={plugin:$,key:null,seed:null,time:null,reseeds:0,generated:0,keyBytes:""},X=$.md,Q=Array(32);for(var Y=0;Y<32;++Y)Q[Y]=X.create();J.pools=Q,J.pool=0,J.generate=function(O,V){if(!V)return J.generateSync(O);var q=J.plugin.cipher,H=J.plugin.increment,N=J.plugin.formatKey,K=J.plugin.formatSeed,L=Y0.util.createBuffer();J.key=null,A();function A(D){if(D)return V(D);if(L.length()>=O)return V(null,L.getBytes(O));if(J.generated>1048575)J.key=null;if(J.key===null)return Y0.util.nextTick(function(){G(A)});var S=q(J.key,J.seed);J.generated+=S.length,L.putBytes(S),J.key=N(q(J.key,H(J.seed))),J.seed=K(q(J.key,J.seed)),Y0.util.setImmediate(A)}},J.generateSync=function(O){var V=J.plugin.cipher,q=J.plugin.increment,H=J.plugin.formatKey,N=J.plugin.formatSeed;J.key=null;var K=Y0.util.createBuffer();while(K.length()<O){if(J.generated>1048575)J.key=null;if(J.key===null)W();var L=V(J.key,J.seed);J.generated+=L.length,K.putBytes(L),J.key=H(V(J.key,q(J.seed))),J.seed=N(V(J.key,J.seed))}return K.getBytes(O)};function G(O){if(J.pools[0].messageLength>=32)return U(),O();var V=32-J.pools[0].messageLength<<5;J.seedFile(V,function(q,H){if(q)return O(q);J.collect(H),U(),O()})}function W(){if(J.pools[0].messageLength>=32)return U();var O=32-J.pools[0].messageLength<<5;J.collect(J.seedFileSync(O)),U()}function U(){J.reseeds=J.reseeds===4294967295?0:J.reseeds+1;var O=J.plugin.md.create();O.update(J.keyBytes);var V=1;for(var q=0;q<32;++q){if(J.reseeds%V===0)O.update(J.pools[q].digest().getBytes()),J.pools[q].start();V=V<<1}J.keyBytes=O.digest().getBytes(),O.start(),O.update(J.keyBytes);var H=O.digest().getBytes();J.key=J.plugin.formatKey(J.keyBytes),J.seed=J.plugin.formatSeed(H),J.generated=0}function M(O){var V=null,q=Y0.util.globalScope,H=q.crypto||q.msCrypto;if(H&&H.getRandomValues)V=function(w){return H.getRandomValues(w)};var N=Y0.util.createBuffer();if(V)while(N.length()<O){var K=Math.max(1,Math.min(O-N.length(),65536)/4),L=new Uint32Array(Math.floor(K));try{V(L);for(var A=0;A<L.length;++A)N.putInt32(L[A])}catch(w){if(!(typeof QuotaExceededError<"u"&&w instanceof QuotaExceededError))throw w}}if(N.length()<O){var D,S,B,C=Math.floor(Math.random()*65536);while(N.length()<O){S=16807*(C&65535),D=16807*(C>>16),S+=(D&32767)<<16,S+=D>>15,S=(S&2147483647)+(S>>31),C=S&4294967295;for(var A=0;A<3;++A)B=C>>>(A<<3),B^=Math.floor(Math.random()*256),N.putByte(B&255)}}return N.getBytes(O)}if(_Y)J.seedFile=function(O,V){_Y.randomBytes(O,function(q,H){if(q)return V(q);V(null,H.toString())})},J.seedFileSync=function(O){return _Y.randomBytes(O).toString()};else J.seedFile=function(O,V){try{V(null,M(O))}catch(q){V(q)}},J.seedFileSync=M;return J.collect=function(O){var V=O.length;for(var q=0;q<V;++q)J.pools[J.pool].update(O.substr(q,1)),J.pool=J.pool===31?0:J.pool+1},J.collectInt=function(O,V){var q="";for(var H=0;H<V;H+=8)q+=String.fromCharCode(O>>H&255);J.collect(q)},J.registerWorker=function(O){if(O===self)J.seedFile=function(q,H){function N(K){var L=K.data;if(L.forge&&L.forge.prng)self.removeEventListener("message",N),H(L.forge.prng.err,L.forge.prng.bytes)}self.addEventListener("message",N),self.postMessage({forge:{prng:{needed:q}}})};else{var V=function(q){var H=q.data;if(H.forge&&H.forge.prng)J.seedFile(H.forge.prng.needed,function(N,K){O.postMessage({forge:{prng:{err:N,bytes:K}}})})};O.addEventListener("message",V)}},J}});var _J=q$((wF,U8)=>{var VJ=F$();P0();G8();W8();_$();(function(){if(VJ.random&&VJ.random.getBytes){U8.exports=VJ.random;return}(function($){var J={},X=[,,,,],Q=VJ.util.createBuffer();J.formatKey=function(q){var H=VJ.util.createBuffer(q);return q=[,,,,],q[0]=H.getInt32(),q[1]=H.getInt32(),q[2]=H.getInt32(),q[3]=H.getInt32(),VJ.aes._expandKey(q,!1)},J.formatSeed=function(q){var H=VJ.util.createBuffer(q);return q=[,,,,],q[0]=H.getInt32(),q[1]=H.getInt32(),q[2]=H.getInt32(),q[3]=H.getInt32(),q},J.cipher=function(q,H){return VJ.aes._updateBlock(q,H,X,!1),Q.putInt32(X[0]),Q.putInt32(X[1]),Q.putInt32(X[2]),Q.putInt32(X[3]),Q.getBytes()},J.increment=function(q){return++q[3],q},J.md=VJ.md.sha256;function Y(){var q=VJ.prng.create(J);return q.getBytes=function(H,N){return q.generate(H,N)},q.getBytesSync=function(H){return q.generate(H)},q}var G=Y(),W=null,U=VJ.util.globalScope,M=U.crypto||U.msCrypto;if(M&&M.getRandomValues)W=function(q){return M.getRandomValues(q)};if(VJ.options.usePureJavaScript||!VJ.util.isNodejs&&!W){if(typeof window>"u"||window.document===void 0);if(G.collectInt(+new Date,32),typeof navigator<"u"){var O="";for(var V in navigator)try{if(typeof navigator[V]=="string")O+=navigator[V]}catch(q){}G.collect(O),O=null}if($)$().mousemove(function(q){G.collectInt(q.clientX,16),G.collectInt(q.clientY,16)}),$().keypress(function(q){G.collectInt(q.charCode,8)})}if(!VJ.random)VJ.random=G;else for(var V in G)VJ.random[V]=G[V];VJ.random.createInstance=Y,U8.exports=VJ.random})(typeof jQuery<"u"?jQuery:null)})()});var O8=q$((PF,G1)=>{var ZJ=F$();_$();var M8=[217,120,249,196,25,221,181,237,40,233,253,121,74,160,216,157,198,126,55,131,43,118,83,142,98,76,100,136,68,139,251,162,23,154,89,245,135,179,79,19,97,69,109,141,9,129,125,50,189,143,64,235,134,183,123,11,240,149,33,34,92,107,78,130,84,214,101,147,206,96,178,28,115,86,192,20,167,140,241,220,18,117,202,31,59,190,228,209,66,61,212,48,163,60,182,38,111,191,14,218,70,105,7,87,39,242,29,155,188,148,67,3,248,17,199,246,144,239,62,231,6,195,213,47,200,102,30,215,8,232,234,222,128,82,238,247,132,170,114,172,53,77,106,42,150,26,210,113,90,21,73,116,75,159,208,94,4,24,164,236,194,224,65,110,15,81,203,204,36,145,175,80,161,244,112,57,153,124,58,133,35,184,180,122,252,2,54,91,37,85,151,49,45,93,250,152,227,138,146,174,5,223,41,16,103,108,186,201,211,0,230,207,225,158,168,44,99,22,1,63,88,226,137,169,13,56,52,27,171,51,255,176,187,72,12,95,185,177,205,46,197,243,219,71,229,165,156,119,10,166,32,104,254,127,193,173],X1=[1,2,3,5],TM=function($,J){return $<<J&65535|($&65535)>>16-J},SM=function($,J){return($&65535)>>J|$<<16-J&65535};G1.exports=ZJ.rc2=ZJ.rc2||{};ZJ.rc2.expandKey=function($,J){if(typeof $==="string")$=ZJ.util.createBuffer($);J=J||128;var X=$,Q=$.length(),Y=J,G=Math.ceil(Y/8),W=255>>(Y&7),U;for(U=Q;U<128;U++)X.putByte(M8[X.at(U-1)+X.at(U-Q)&255]);X.setAt(128-G,M8[X.at(128-G)&W]);for(U=127-G;U>=0;U--)X.setAt(U,M8[X.at(U+1)^X.at(U+G)]);return X};var Y1=function($,J,X){var Q=!1,Y=null,G=null,W=null,U,M,O,V,q=[];$=ZJ.rc2.expandKey($,J);for(O=0;O<64;O++)q.push($.getInt16Le());if(X)U=function(K){for(O=0;O<4;O++)K[O]+=q[V]+(K[(O+3)%4]&K[(O+2)%4])+(~K[(O+3)%4]&K[(O+1)%4]),K[O]=TM(K[O],X1[O]),V++},M=function(K){for(O=0;O<4;O++)K[O]+=q[K[(O+3)%4]&63]};else U=function(K){for(O=3;O>=0;O--)K[O]=SM(K[O],X1[O]),K[O]-=q[V]+(K[(O+3)%4]&K[(O+2)%4])+(~K[(O+3)%4]&K[(O+1)%4]),V--},M=function(K){for(O=3;O>=0;O--)K[O]-=q[K[(O+3)%4]&63]};var H=function(K){var L=[];for(O=0;O<4;O++){var A=Y.getInt16Le();if(W!==null)if(X)A^=W.getInt16Le();else W.putInt16Le(A);L.push(A&65535)}V=X?0:63;for(var D=0;D<K.length;D++)for(var S=0;S<K[D][0];S++)K[D][1](L);for(O=0;O<4;O++){if(W!==null)if(X)W.putInt16Le(L[O]);else L[O]^=W.getInt16Le();G.putInt16Le(L[O])}},N=null;return N={start:function(K,L){if(K){if(typeof K==="string")K=ZJ.util.createBuffer(K)}Q=!1,Y=ZJ.util.createBuffer(),G=L||new ZJ.util.createBuffer,W=K,N.output=G},update:function(K){if(!Q)Y.putBuffer(K);while(Y.length()>=8)H([[5,U],[1,M],[6,U],[1,M],[5,U]])},finish:function(K){var L=!0;if(X)if(K)L=K(8,Y,!X);else{var A=Y.length()===8?8:8-Y.length();Y.fillWithByte(A,A)}if(L)Q=!0,N.update();if(!X){if(L=Y.length()===0,L)if(K)L=K(8,G,!X);else{var D=G.length(),S=G.at(D-1);if(S>D)L=!1;else G.truncate(S)}}return L}},N};ZJ.rc2.startEncrypting=function($,J,X){var Q=ZJ.rc2.createEncryptionCipher($,128);return Q.start(J,X),Q};ZJ.rc2.createEncryptionCipher=function($,J){return Y1($,J,!0)};ZJ.rc2.startDecrypting=function($,J,X){var Q=ZJ.rc2.createDecryptionCipher($,128);return Q.start(J,X),Q};ZJ.rc2.createDecryptionCipher=function($,J){return Y1($,J,!1)}});var TX=q$((_F,K1)=>{var V8=F$();K1.exports=V8.jsbn=V8.jsbn||{};var A0,IM=244837814094590,W1=(IM&16777215)==15715070;function k($,J,X){if(this.data=[],$!=null)if(typeof $=="number")this.fromNumber($,J,X);else if(J==null&&typeof $!="string")this.fromString($,256);else this.fromString($,J)}V8.jsbn.BigInteger=k;function C$(){return new k(null)}function CM($,J,X,Q,Y,G){while(--G>=0){var W=J*this.data[$++]+X.data[Q]+Y;Y=Math.floor(W/67108864),X.data[Q++]=W&67108863}return Y}function wM($,J,X,Q,Y,G){var W=J&32767,U=J>>15;while(--G>=0){var M=this.data[$]&32767,O=this.data[$++]>>15,V=U*M+O*W;M=W*M+((V&32767)<<15)+X.data[Q]+(Y&1073741823),Y=(M>>>30)+(V>>>15)+U*O+(Y>>>30),X.data[Q++]=M&1073741823}return Y}function U1($,J,X,Q,Y,G){var W=J&16383,U=J>>14;while(--G>=0){var M=this.data[$]&16383,O=this.data[$++]>>14,V=U*M+O*W;M=W*M+((V&16383)<<14)+X.data[Q]+Y,Y=(M>>28)+(V>>14)+U*O,X.data[Q++]=M&268435455}return Y}if(typeof navigator>"u")k.prototype.am=U1,A0=28;else if(W1&&navigator.appName=="Microsoft Internet Explorer")k.prototype.am=wM,A0=30;else if(W1&&navigator.appName!="Netscape")k.prototype.am=CM,A0=26;else k.prototype.am=U1,A0=28;k.prototype.DB=A0;k.prototype.DM=(1<<A0)-1;k.prototype.DV=1<<A0;var q8=52;k.prototype.FV=Math.pow(2,q8);k.prototype.F1=q8-A0;k.prototype.F2=2*A0-q8;var PM="0123456789abcdefghijklmnopqrstuvwxyz",xY=[],IQ,xJ;IQ=48;for(xJ=0;xJ<=9;++xJ)xY[IQ++]=xJ;IQ=97;for(xJ=10;xJ<36;++xJ)xY[IQ++]=xJ;IQ=65;for(xJ=10;xJ<36;++xJ)xY[IQ++]=xJ;function M1($){return PM.charAt($)}function O1($,J){var X=xY[$.charCodeAt(J)];return X==null?-1:X}function _M($){for(var J=this.t-1;J>=0;--J)$.data[J]=this.data[J];$.t=this.t,$.s=this.s}function xM($){if(this.t=1,this.s=$<0?-1:0,$>0)this.data[0]=$;else if($<-1)this.data[0]=$+this.DV;else this.t=0}function x0($){var J=C$();return J.fromInt($),J}function vM($,J){var X;if(J==16)X=4;else if(J==8)X=3;else if(J==256)X=8;else if(J==2)X=1;else if(J==32)X=5;else if(J==4)X=2;else{this.fromRadix($,J);return}this.t=0,this.s=0;var Q=$.length,Y=!1,G=0;while(--Q>=0){var W=X==8?$[Q]&255:O1($,Q);if(W<0){if($.charAt(Q)=="-")Y=!0;continue}if(Y=!1,G==0)this.data[this.t++]=W;else if(G+X>this.DB)this.data[this.t-1]|=(W&(1<<this.DB-G)-1)<<G,this.data[this.t++]=W>>this.DB-G;else this.data[this.t-1]|=W<<G;if(G+=X,G>=this.DB)G-=this.DB}if(X==8&&($[0]&128)!=0){if(this.s=-1,G>0)this.data[this.t-1]|=(1<<this.DB-G)-1<<G}if(this.clamp(),Y)k.ZERO.subTo(this,this)}function kM(){var $=this.s&this.DM;while(this.t>0&&this.data[this.t-1]==$)--this.t}function fM($){if(this.s<0)return"-"+this.negate().toString($);var J;if($==16)J=4;else if($==8)J=3;else if($==2)J=1;else if($==32)J=5;else if($==4)J=2;else return this.toRadix($);var X=(1<<J)-1,Q,Y=!1,G="",W=this.t,U=this.DB-W*this.DB%J;if(W-- >0){if(U<this.DB&&(Q=this.data[W]>>U)>0)Y=!0,G=M1(Q);while(W>=0){if(U<J)Q=(this.data[W]&(1<<U)-1)<<J-U,Q|=this.data[--W]>>(U+=this.DB-J);else if(Q=this.data[W]>>(U-=J)&X,U<=0)U+=this.DB,--W;if(Q>0)Y=!0;if(Y)G+=M1(Q)}}return Y?G:"0"}function yM(){var $=C$();return k.ZERO.subTo(this,$),$}function bM(){return this.s<0?this.negate():this}function hM($){var J=this.s-$.s;if(J!=0)return J;var X=this.t;if(J=X-$.t,J!=0)return this.s<0?-J:J;while(--X>=0)if((J=this.data[X]-$.data[X])!=0)return J;return 0}function vY($){var J=1,X;if((X=$>>>16)!=0)$=X,J+=16;if((X=$>>8)!=0)$=X,J+=8;if((X=$>>4)!=0)$=X,J+=4;if((X=$>>2)!=0)$=X,J+=2;if((X=$>>1)!=0)$=X,J+=1;return J}function uM(){if(this.t<=0)return 0;return this.DB*(this.t-1)+vY(this.data[this.t-1]^this.s&this.DM)}function gM($,J){var X;for(X=this.t-1;X>=0;--X)J.data[X+$]=this.data[X];for(X=$-1;X>=0;--X)J.data[X]=0;J.t=this.t+$,J.s=this.s}function mM($,J){for(var X=$;X<this.t;++X)J.data[X-$]=this.data[X];J.t=Math.max(this.t-$,0),J.s=this.s}function lM($,J){var X=$%this.DB,Q=this.DB-X,Y=(1<<Q)-1,G=Math.floor($/this.DB),W=this.s<<X&this.DM,U;for(U=this.t-1;U>=0;--U)J.data[U+G+1]=this.data[U]>>Q|W,W=(this.data[U]&Y)<<X;for(U=G-1;U>=0;--U)J.data[U]=0;J.data[G]=W,J.t=this.t+G+1,J.s=this.s,J.clamp()}function pM($,J){J.s=this.s;var X=Math.floor($/this.DB);if(X>=this.t){J.t=0;return}var Q=$%this.DB,Y=this.DB-Q,G=(1<<Q)-1;J.data[0]=this.data[X]>>Q;for(var W=X+1;W<this.t;++W)J.data[W-X-1]|=(this.data[W]&G)<<Y,J.data[W-X]=this.data[W]>>Q;if(Q>0)J.data[this.t-X-1]|=(this.s&G)<<Y;J.t=this.t-X,J.clamp()}function dM($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]-$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q-=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q-=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q-=$.s}if(J.s=Q<0?-1:0,Q<-1)J.data[X++]=this.DV+Q;else if(Q>0)J.data[X++]=Q;J.t=X,J.clamp()}function cM($,J){var X=this.abs(),Q=$.abs(),Y=X.t;J.t=Y+Q.t;while(--Y>=0)J.data[Y]=0;for(Y=0;Y<Q.t;++Y)J.data[Y+X.t]=X.am(0,Q.data[Y],J,Y,0,X.t);if(J.s=0,J.clamp(),this.s!=$.s)k.ZERO.subTo(J,J)}function nM($){var J=this.abs(),X=$.t=2*J.t;while(--X>=0)$.data[X]=0;for(X=0;X<J.t-1;++X){var Q=J.am(X,J.data[X],$,2*X,0,1);if(($.data[X+J.t]+=J.am(X+1,2*J.data[X],$,2*X+1,Q,J.t-X-1))>=J.DV)$.data[X+J.t]-=J.DV,$.data[X+J.t+1]=1}if($.t>0)$.data[$.t-1]+=J.am(X,J.data[X],$,2*X,0,1);$.s=0,$.clamp()}function iM($,J,X){var Q=$.abs();if(Q.t<=0)return;var Y=this.abs();if(Y.t<Q.t){if(J!=null)J.fromInt(0);if(X!=null)this.copyTo(X);return}if(X==null)X=C$();var G=C$(),W=this.s,U=$.s,M=this.DB-vY(Q.data[Q.t-1]);if(M>0)Q.lShiftTo(M,G),Y.lShiftTo(M,X);else Q.copyTo(G),Y.copyTo(X);var O=G.t,V=G.data[O-1];if(V==0)return;var q=V*(1<<this.F1)+(O>1?G.data[O-2]>>this.F2:0),H=this.FV/q,N=(1<<this.F1)/q,K=1<<this.F2,L=X.t,A=L-O,D=J==null?C$():J;if(G.dlShiftTo(A,D),X.compareTo(D)>=0)X.data[X.t++]=1,X.subTo(D,X);k.ONE.dlShiftTo(O,D),D.subTo(G,G);while(G.t<O)G.data[G.t++]=0;while(--A>=0){var S=X.data[--L]==V?this.DM:Math.floor(X.data[L]*H+(X.data[L-1]+K)*N);if((X.data[L]+=G.am(0,S,X,A,0,O))<S){G.dlShiftTo(A,D),X.subTo(D,X);while(X.data[L]<--S)X.subTo(D,X)}}if(J!=null){if(X.drShiftTo(O,J),W!=U)k.ZERO.subTo(J,J)}if(X.t=O,X.clamp(),M>0)X.rShiftTo(M,X);if(W<0)k.ZERO.subTo(X,X)}function oM($){var J=C$();if(this.abs().divRemTo($,null,J),this.s<0&&J.compareTo(k.ZERO)>0)$.subTo(J,J);return J}function XQ($){this.m=$}function aM($){if($.s<0||$.compareTo(this.m)>=0)return $.mod(this.m);else return $}function sM($){return $}function rM($){$.divRemTo(this.m,null,$)}function tM($,J,X){$.multiplyTo(J,X),this.reduce(X)}function eM($,J){$.squareTo(J),this.reduce(J)}XQ.prototype.convert=aM;XQ.prototype.revert=sM;XQ.prototype.reduce=rM;XQ.prototype.mulTo=tM;XQ.prototype.sqrTo=eM;function $O(){if(this.t<1)return 0;var $=this.data[0];if(($&1)==0)return 0;var J=$&3;return J=J*(2-($&15)*J)&15,J=J*(2-($&255)*J)&255,J=J*(2-(($&65535)*J&65535))&65535,J=J*(2-$*J%this.DV)%this.DV,J>0?this.DV-J:-J}function YQ($){this.m=$,this.mp=$.invDigit(),this.mpl=this.mp&32767,this.mph=this.mp>>15,this.um=(1<<$.DB-15)-1,this.mt2=2*$.t}function JO($){var J=C$();if($.abs().dlShiftTo(this.m.t,J),J.divRemTo(this.m,null,J),$.s<0&&J.compareTo(k.ZERO)>0)this.m.subTo(J,J);return J}function QO($){var J=C$();return $.copyTo(J),this.reduce(J),J}function XO($){while($.t<=this.mt2)$.data[$.t++]=0;for(var J=0;J<this.m.t;++J){var X=$.data[J]&32767,Q=X*this.mpl+((X*this.mph+($.data[J]>>15)*this.mpl&this.um)<<15)&$.DM;X=J+this.m.t,$.data[X]+=this.m.am(0,Q,$,J,0,this.m.t);while($.data[X]>=$.DV)$.data[X]-=$.DV,$.data[++X]++}if($.clamp(),$.drShiftTo(this.m.t,$),$.compareTo(this.m)>=0)$.subTo(this.m,$)}function YO($,J){$.squareTo(J),this.reduce(J)}function GO($,J,X){$.multiplyTo(J,X),this.reduce(X)}YQ.prototype.convert=JO;YQ.prototype.revert=QO;YQ.prototype.reduce=XO;YQ.prototype.mulTo=GO;YQ.prototype.sqrTo=YO;function WO(){return(this.t>0?this.data[0]&1:this.s)==0}function UO($,J){if($>4294967295||$<1)return k.ONE;var X=C$(),Q=C$(),Y=J.convert(this),G=vY($)-1;Y.copyTo(X);while(--G>=0)if(J.sqrTo(X,Q),($&1<<G)>0)J.mulTo(Q,Y,X);else{var W=X;X=Q,Q=W}return J.revert(X)}function MO($,J){var X;if($<256||J.isEven())X=new XQ(J);else X=new YQ(J);return this.exp($,X)}k.prototype.copyTo=_M;k.prototype.fromInt=xM;k.prototype.fromString=vM;k.prototype.clamp=kM;k.prototype.dlShiftTo=gM;k.prototype.drShiftTo=mM;k.prototype.lShiftTo=lM;k.prototype.rShiftTo=pM;k.prototype.subTo=dM;k.prototype.multiplyTo=cM;k.prototype.squareTo=nM;k.prototype.divRemTo=iM;k.prototype.invDigit=$O;k.prototype.isEven=WO;k.prototype.exp=UO;k.prototype.toString=fM;k.prototype.negate=yM;k.prototype.abs=bM;k.prototype.compareTo=hM;k.prototype.bitLength=uM;k.prototype.mod=oM;k.prototype.modPowInt=MO;k.ZERO=x0(0);k.ONE=x0(1);function OO(){var $=C$();return this.copyTo($),$}function VO(){if(this.s<0){if(this.t==1)return this.data[0]-this.DV;else if(this.t==0)return-1}else if(this.t==1)return this.data[0];else if(this.t==0)return 0;return(this.data[1]&(1<<32-this.DB)-1)<<this.DB|this.data[0]}function qO(){return this.t==0?this.s:this.data[0]<<24>>24}function HO(){return this.t==0?this.s:this.data[0]<<16>>16}function KO($){return Math.floor(Math.LN2*this.DB/Math.log($))}function zO(){if(this.s<0)return-1;else if(this.t<=0||this.t==1&&this.data[0]<=0)return 0;else return 1}function EO($){if($==null)$=10;if(this.signum()==0||$<2||$>36)return"0";var J=this.chunkSize($),X=Math.pow($,J),Q=x0(X),Y=C$(),G=C$(),W="";this.divRemTo(Q,Y,G);while(Y.signum()>0)W=(X+G.intValue()).toString($).substr(1)+W,Y.divRemTo(Q,Y,G);return G.intValue().toString($)+W}function FO($,J){if(this.fromInt(0),J==null)J=10;var X=this.chunkSize(J),Q=Math.pow(J,X),Y=!1,G=0,W=0;for(var U=0;U<$.length;++U){var M=O1($,U);if(M<0){if($.charAt(U)=="-"&&this.signum()==0)Y=!0;continue}if(W=J*W+M,++G>=X)this.dMultiply(Q),this.dAddOffset(W,0),G=0,W=0}if(G>0)this.dMultiply(Math.pow(J,G)),this.dAddOffset(W,0);if(Y)k.ZERO.subTo(this,this)}function NO($,J,X){if(typeof J=="number")if($<2)this.fromInt(1);else{if(this.fromNumber($,X),!this.testBit($-1))this.bitwiseTo(k.ONE.shiftLeft($-1),H8,this);if(this.isEven())this.dAddOffset(1,0);while(!this.isProbablePrime(J))if(this.dAddOffset(2,0),this.bitLength()>$)this.subTo(k.ONE.shiftLeft($-1),this)}else{var Q=[],Y=$&7;if(Q.length=($>>3)+1,J.nextBytes(Q),Y>0)Q[0]&=(1<<Y)-1;else Q[0]=0;this.fromString(Q,256)}}function LO(){var $=this.t,J=[];J[0]=this.s;var X=this.DB-$*this.DB%8,Q,Y=0;if($-- >0){if(X<this.DB&&(Q=this.data[$]>>X)!=(this.s&this.DM)>>X)J[Y++]=Q|this.s<<this.DB-X;while($>=0){if(X<8)Q=(this.data[$]&(1<<X)-1)<<8-X,Q|=this.data[--$]>>(X+=this.DB-8);else if(Q=this.data[$]>>(X-=8)&255,X<=0)X+=this.DB,--$;if((Q&128)!=0)Q|=-256;if(Y==0&&(this.s&128)!=(Q&128))++Y;if(Y>0||Q!=this.s)J[Y++]=Q}}return J}function AO($){return this.compareTo($)==0}function RO($){return this.compareTo($)<0?this:$}function DO($){return this.compareTo($)>0?this:$}function ZO($,J,X){var Q,Y,G=Math.min($.t,this.t);for(Q=0;Q<G;++Q)X.data[Q]=J(this.data[Q],$.data[Q]);if($.t<this.t){Y=$.s&this.DM;for(Q=G;Q<this.t;++Q)X.data[Q]=J(this.data[Q],Y);X.t=this.t}else{Y=this.s&this.DM;for(Q=G;Q<$.t;++Q)X.data[Q]=J(Y,$.data[Q]);X.t=$.t}X.s=J(this.s,$.s),X.clamp()}function BO($,J){return $&J}function jO($){var J=C$();return this.bitwiseTo($,BO,J),J}function H8($,J){return $|J}function TO($){var J=C$();return this.bitwiseTo($,H8,J),J}function V1($,J){return $^J}function SO($){var J=C$();return this.bitwiseTo($,V1,J),J}function q1($,J){return $&~J}function IO($){var J=C$();return this.bitwiseTo($,q1,J),J}function CO(){var $=C$();for(var J=0;J<this.t;++J)$.data[J]=this.DM&~this.data[J];return $.t=this.t,$.s=~this.s,$}function wO($){var J=C$();if($<0)this.rShiftTo(-$,J);else this.lShiftTo($,J);return J}function PO($){var J=C$();if($<0)this.lShiftTo(-$,J);else this.rShiftTo($,J);return J}function _O($){if($==0)return-1;var J=0;if(($&65535)==0)$>>=16,J+=16;if(($&255)==0)$>>=8,J+=8;if(($&15)==0)$>>=4,J+=4;if(($&3)==0)$>>=2,J+=2;if(($&1)==0)++J;return J}function xO(){for(var $=0;$<this.t;++$)if(this.data[$]!=0)return $*this.DB+_O(this.data[$]);if(this.s<0)return this.t*this.DB;return-1}function vO($){var J=0;while($!=0)$&=$-1,++J;return J}function kO(){var $=0,J=this.s&this.DM;for(var X=0;X<this.t;++X)$+=vO(this.data[X]^J);return $}function fO($){var J=Math.floor($/this.DB);if(J>=this.t)return this.s!=0;return(this.data[J]&1<<$%this.DB)!=0}function yO($,J){var X=k.ONE.shiftLeft($);return this.bitwiseTo(X,J,X),X}function bO($){return this.changeBit($,H8)}function hO($){return this.changeBit($,q1)}function uO($){return this.changeBit($,V1)}function gO($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]+$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q+=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q+=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=$.s}if(J.s=Q<0?-1:0,Q>0)J.data[X++]=Q;else if(Q<-1)J.data[X++]=this.DV+Q;J.t=X,J.clamp()}function mO($){var J=C$();return this.addTo($,J),J}function lO($){var J=C$();return this.subTo($,J),J}function pO($){var J=C$();return this.multiplyTo($,J),J}function dO(){var $=C$();return this.squareTo($),$}function cO($){var J=C$();return this.divRemTo($,J,null),J}function nO($){var J=C$();return this.divRemTo($,null,J),J}function iO($){var J=C$(),X=C$();return this.divRemTo($,J,X),[J,X]}function oO($){this.data[this.t]=this.am(0,$-1,this,0,0,this.t),++this.t,this.clamp()}function aO($,J){if($==0)return;while(this.t<=J)this.data[this.t++]=0;this.data[J]+=$;while(this.data[J]>=this.DV){if(this.data[J]-=this.DV,++J>=this.t)this.data[this.t++]=0;++this.data[J]}}function jX(){}function H1($){return $}function sO($,J,X){$.multiplyTo(J,X)}function rO($,J){$.squareTo(J)}jX.prototype.convert=H1;jX.prototype.revert=H1;jX.prototype.mulTo=sO;jX.prototype.sqrTo=rO;function tO($){return this.exp($,new jX)}function eO($,J,X){var Q=Math.min(this.t+$.t,J);X.s=0,X.t=Q;while(Q>0)X.data[--Q]=0;var Y;for(Y=X.t-this.t;Q<Y;++Q)X.data[Q+this.t]=this.am(0,$.data[Q],X,Q,0,this.t);for(Y=Math.min($.t,J);Q<Y;++Q)this.am(0,$.data[Q],X,Q,0,J-Q);X.clamp()}function $V($,J,X){--J;var Q=X.t=this.t+$.t-J;X.s=0;while(--Q>=0)X.data[Q]=0;for(Q=Math.max(J-this.t,0);Q<$.t;++Q)X.data[this.t+Q-J]=this.am(J-Q,$.data[Q],X,0,0,this.t+Q-J);X.clamp(),X.drShiftTo(1,X)}function CQ($){this.r2=C$(),this.q3=C$(),k.ONE.dlShiftTo(2*$.t,this.r2),this.mu=this.r2.divide($),this.m=$}function JV($){if($.s<0||$.t>2*this.m.t)return $.mod(this.m);else if($.compareTo(this.m)<0)return $;else{var J=C$();return $.copyTo(J),this.reduce(J),J}}function QV($){return $}function XV($){if($.drShiftTo(this.m.t-1,this.r2),$.t>this.m.t+1)$.t=this.m.t+1,$.clamp();this.mu.multiplyUpperTo(this.r2,this.m.t+1,this.q3),this.m.multiplyLowerTo(this.q3,this.m.t+1,this.r2);while($.compareTo(this.r2)<0)$.dAddOffset(1,this.m.t+1);$.subTo(this.r2,$);while($.compareTo(this.m)>=0)$.subTo(this.m,$)}function YV($,J){$.squareTo(J),this.reduce(J)}function GV($,J,X){$.multiplyTo(J,X),this.reduce(X)}CQ.prototype.convert=JV;CQ.prototype.revert=QV;CQ.prototype.reduce=XV;CQ.prototype.mulTo=GV;CQ.prototype.sqrTo=YV;function WV($,J){var X=$.bitLength(),Q,Y=x0(1),G;if(X<=0)return Y;else if(X<18)Q=1;else if(X<48)Q=3;else if(X<144)Q=4;else if(X<768)Q=5;else Q=6;if(X<8)G=new XQ(J);else if(J.isEven())G=new CQ(J);else G=new YQ(J);var W=[],U=3,M=Q-1,O=(1<<Q)-1;if(W[1]=G.convert(this),Q>1){var V=C$();G.sqrTo(W[1],V);while(U<=O)W[U]=C$(),G.mulTo(V,W[U-2],W[U]),U+=2}var q=$.t-1,H,N=!0,K=C$(),L;X=vY($.data[q])-1;while(q>=0){if(X>=M)H=$.data[q]>>X-M&O;else if(H=($.data[q]&(1<<X+1)-1)<<M-X,q>0)H|=$.data[q-1]>>this.DB+X-M;U=Q;while((H&1)==0)H>>=1,--U;if((X-=U)<0)X+=this.DB,--q;if(N)W[H].copyTo(Y),N=!1;else{while(U>1)G.sqrTo(Y,K),G.sqrTo(K,Y),U-=2;if(U>0)G.sqrTo(Y,K);else L=Y,Y=K,K=L;G.mulTo(K,W[H],Y)}while(q>=0&&($.data[q]&1<<X)==0)if(G.sqrTo(Y,K),L=Y,Y=K,K=L,--X<0)X=this.DB-1,--q}return G.revert(Y)}function UV($){var J=this.s<0?this.negate():this.clone(),X=$.s<0?$.negate():$.clone();if(J.compareTo(X)<0){var Q=J;J=X,X=Q}var Y=J.getLowestSetBit(),G=X.getLowestSetBit();if(G<0)return J;if(Y<G)G=Y;if(G>0)J.rShiftTo(G,J),X.rShiftTo(G,X);while(J.signum()>0){if((Y=J.getLowestSetBit())>0)J.rShiftTo(Y,J);if((Y=X.getLowestSetBit())>0)X.rShiftTo(Y,X);if(J.compareTo(X)>=0)J.subTo(X,J),J.rShiftTo(1,J);else X.subTo(J,X),X.rShiftTo(1,X)}if(G>0)X.lShiftTo(G,X);return X}function MV($){if($<=0)return 0;var J=this.DV%$,X=this.s<0?$-1:0;if(this.t>0)if(J==0)X=this.data[0]%$;else for(var Q=this.t-1;Q>=0;--Q)X=(J*X+this.data[Q])%$;return X}function OV($){if(this.signum()==0)return k.ZERO;var J=$.isEven();if(this.isEven()&&J||$.signum()==0)return k.ZERO;var X=$.clone(),Q=this.clone(),Y=x0(1),G=x0(0),W=x0(0),U=x0(1);while(X.signum()!=0){while(X.isEven()){if(X.rShiftTo(1,X),J){if(!Y.isEven()||!G.isEven())Y.addTo(this,Y),G.subTo($,G);Y.rShiftTo(1,Y)}else if(!G.isEven())G.subTo($,G);G.rShiftTo(1,G)}while(Q.isEven()){if(Q.rShiftTo(1,Q),J){if(!W.isEven()||!U.isEven())W.addTo(this,W),U.subTo($,U);W.rShiftTo(1,W)}else if(!U.isEven())U.subTo($,U);U.rShiftTo(1,U)}if(X.compareTo(Q)>=0){if(X.subTo(Q,X),J)Y.subTo(W,Y);G.subTo(U,G)}else{if(Q.subTo(X,Q),J)W.subTo(Y,W);U.subTo(G,U)}}if(Q.compareTo(k.ONE)!=0)return k.ZERO;if(U.compareTo($)>=0)return U.subtract($);if(U.signum()<0)U.addTo($,U);else return U;if(U.signum()<0)return U.add($);else return U}var lJ=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997],VV=67108864/lJ[lJ.length-1];function qV($){var J,X=this.abs();if(X.t==1&&X.data[0]<=lJ[lJ.length-1]){for(J=0;J<lJ.length;++J)if(X.data[0]==lJ[J])return!0;return!1}if(X.isEven())return!1;J=1;while(J<lJ.length){var Q=lJ[J],Y=J+1;while(Y<lJ.length&&Q<VV)Q*=lJ[Y++];Q=X.modInt(Q);while(J<Y)if(Q%lJ[J++]==0)return!1}return X.millerRabin($)}function HV($){var J=this.subtract(k.ONE),X=J.getLowestSetBit();if(X<=0)return!1;var Q=J.shiftRight(X),Y=KV(),G;for(var W=0;W<$;++W){do G=new k(this.bitLength(),Y);while(G.compareTo(k.ONE)<=0||G.compareTo(J)>=0);var U=G.modPow(Q,this);if(U.compareTo(k.ONE)!=0&&U.compareTo(J)!=0){var M=1;while(M++<X&&U.compareTo(J)!=0)if(U=U.modPowInt(2,this),U.compareTo(k.ONE)==0)return!1;if(U.compareTo(J)!=0)return!1}}return!0}function KV(){return{nextBytes:function($){for(var J=0;J<$.length;++J)$[J]=Math.floor(Math.random()*256)}}}k.prototype.chunkSize=KO;k.prototype.toRadix=EO;k.prototype.fromRadix=FO;k.prototype.fromNumber=NO;k.prototype.bitwiseTo=ZO;k.prototype.changeBit=yO;k.prototype.addTo=gO;k.prototype.dMultiply=oO;k.prototype.dAddOffset=aO;k.prototype.multiplyLowerTo=eO;k.prototype.multiplyUpperTo=$V;k.prototype.modInt=MV;k.prototype.millerRabin=HV;k.prototype.clone=OO;k.prototype.intValue=VO;k.prototype.byteValue=qO;k.prototype.shortValue=HO;k.prototype.signum=zO;k.prototype.toByteArray=LO;k.prototype.equals=AO;k.prototype.min=RO;k.prototype.max=DO;k.prototype.and=jO;k.prototype.or=TO;k.prototype.xor=SO;k.prototype.andNot=IO;k.prototype.not=CO;k.prototype.shiftLeft=wO;k.prototype.shiftRight=PO;k.prototype.getLowestSetBit=xO;k.prototype.bitCount=kO;k.prototype.testBit=fO;k.prototype.setBit=bO;k.prototype.clearBit=hO;k.prototype.flipBit=uO;k.prototype.add=mO;k.prototype.subtract=lO;k.prototype.multiply=pO;k.prototype.divide=cO;k.prototype.remainder=nO;k.prototype.divideAndRemainder=iO;k.prototype.modPow=WV;k.prototype.modInverse=OV;k.prototype.pow=tO;k.prototype.gcd=UV;k.prototype.isProbablePrime=qV;k.prototype.square=dO});var wQ=q$((xF,N1)=>{var G0=F$();$0();_$();var E1=N1.exports=G0.sha1=G0.sha1||{};G0.md.sha1=G0.md.algorithms.sha1=E1;E1.create=function(){if(!F1)zV();var $=null,J=G0.util.createBuffer(),X=Array(80),Q={algorithm:"sha1",blockLength:64,digestLength:20,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=G0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878,h4:3285377520},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=G0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var U=Q.fullMessageLength.length-1;U>=0;--U)Q.fullMessageLength[U]+=W[1],W[1]=W[0]+(Q.fullMessageLength[U]/4294967296>>>0),Q.fullMessageLength[U]=Q.fullMessageLength[U]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),z1($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=G0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(K8.substr(0,Q.blockLength-W));var U,M,O=Q.fullMessageLength[0]*8;for(var V=0;V<Q.fullMessageLength.length-1;++V)U=Q.fullMessageLength[V+1]*8,M=U/4294967296>>>0,O+=M,Y.putInt32(O>>>0),O=U>>>0;Y.putInt32(O);var q={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4};z1(q,X,Y);var H=G0.util.createBuffer();return H.putInt32(q.h0),H.putInt32(q.h1),H.putInt32(q.h2),H.putInt32(q.h3),H.putInt32(q.h4),H},Q};var K8=null,F1=!1;function zV(){K8=String.fromCharCode(128),K8+=G0.util.fillString(String.fromCharCode(0),64),F1=!0}function z1($,J,X){var Q,Y,G,W,U,M,O,V,q=X.length();while(q>=64){Y=$.h0,G=$.h1,W=$.h2,U=$.h3,M=$.h4;for(V=0;V<16;++V)Q=X.getInt32(),J[V]=Q,O=U^G&(W^U),Q=(Y<<5|Y>>>27)+O+M+1518500249+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<20;++V)Q=J[V-3]^J[V-8]^J[V-14]^J[V-16],Q=Q<<1|Q>>>31,J[V]=Q,O=U^G&(W^U),Q=(Y<<5|Y>>>27)+O+M+1518500249+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<32;++V)Q=J[V-3]^J[V-8]^J[V-14]^J[V-16],Q=Q<<1|Q>>>31,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+1859775393+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<40;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+1859775393+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<60;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G&W|U&(G^W),Q=(Y<<5|Y>>>27)+O+M+2400959708+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;V<80;++V)Q=J[V-6]^J[V-16]^J[V-28]^J[V-32],Q=Q<<2|Q>>>30,J[V]=Q,O=G^W^U,Q=(Y<<5|Y>>>27)+O+M+3395469782+Q,M=U,U=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+U|0,$.h4=$.h4+M|0,q-=64}}});var z8=q$((vF,A1)=>{var W0=F$();_$();_J();wQ();var L1=A1.exports=W0.pkcs1=W0.pkcs1||{};L1.encode_rsa_oaep=function($,J,X){var Q,Y,G,W;if(typeof X==="string")Q=X,Y=arguments[3]||void 0,G=arguments[4]||void 0;else if(X){if(Q=X.label||void 0,Y=X.seed||void 0,G=X.md||void 0,X.mgf1&&X.mgf1.md)W=X.mgf1.md}if(!G)G=W0.md.sha1.create();else G.start();if(!W)W=G;var U=Math.ceil($.n.bitLength()/8),M=U-2*G.digestLength-2;if(J.length>M){var O=Error("RSAES-OAEP input message length is too long.");throw O.length=J.length,O.maxLength=M,O}if(!Q)Q="";G.update(Q,"raw");var V=G.digest(),q="",H=M-J.length;for(var N=0;N<H;N++)q+="\x00";var K=V.getBytes()+q+"\x01"+J;if(!Y)Y=W0.random.getBytes(G.digestLength);else if(Y.length!==G.digestLength){var O=Error("Invalid RSAES-OAEP seed. The seed length must match the digest length.");throw O.seedLength=Y.length,O.digestLength=G.digestLength,O}var L=kY(Y,U-G.digestLength-1,W),A=W0.util.xorBytes(K,L,K.length),D=kY(A,G.digestLength,W),S=W0.util.xorBytes(Y,D,Y.length);return"\x00"+S+A};L1.decode_rsa_oaep=function($,J,X){var Q,Y,G;if(typeof X==="string")Q=X,Y=arguments[3]||void 0;else if(X){if(Q=X.label||void 0,Y=X.md||void 0,X.mgf1&&X.mgf1.md)G=X.mgf1.md}var W=Math.ceil($.n.bitLength()/8);if(J.length!==W){var A=Error("RSAES-OAEP encoded message length is invalid.");throw A.length=J.length,A.expectedLength=W,A}if(Y===void 0)Y=W0.md.sha1.create();else Y.start();if(!G)G=Y;if(W<2*Y.digestLength+2)throw Error("RSAES-OAEP key is too short for the hash function.");if(!Q)Q="";Y.update(Q,"raw");var U=Y.digest().getBytes(),M=J.charAt(0),O=J.substring(1,Y.digestLength+1),V=J.substring(1+Y.digestLength),q=kY(V,Y.digestLength,G),H=W0.util.xorBytes(O,q,O.length),N=kY(H,W-Y.digestLength-1,G),K=W0.util.xorBytes(V,N,V.length),L=K.substring(0,Y.digestLength),A=M!=="\x00";for(var D=0;D<Y.digestLength;++D)A|=U.charAt(D)!==L.charAt(D);var S=1,B=Y.digestLength;for(var C=Y.digestLength;C<K.length;C++){var w=K.charCodeAt(C),P=w&1^1,l=S?65534:0;A|=w&l,S=S&P,B+=S}if(A||K.charCodeAt(B)!==1)throw Error("Invalid RSAES-OAEP padding.");return K.substring(B+1)};function kY($,J,X){if(!X)X=W0.md.sha1.create();var Q="",Y=Math.ceil(J/X.digestLength);for(var G=0;G<Y;++G){var W=String.fromCharCode(G>>24&255,G>>16&255,G>>8&255,G&255);X.start(),X.update($+W),Q+=X.digest().getBytes()}return Q.substring(0,J)}});var F8=q$((kF,E8)=>{var v0=F$();_$();TX();_J();(function(){if(v0.prime){E8.exports=v0.prime;return}var $=E8.exports=v0.prime=v0.prime||{},J=v0.jsbn.BigInteger,X=[6,4,2,4,2,4,6,2],Q=new J(null);Q.fromInt(30);var Y=function(q,H){return q|H};$.generateProbablePrime=function(q,H,N){if(typeof H==="function")N=H,H={};H=H||{};var K=H.algorithm||"PRIMEINC";if(typeof K==="string")K={name:K};K.options=K.options||{};var L=H.prng||v0.random,A={nextBytes:function(D){var S=L.getBytesSync(D.length);for(var B=0;B<D.length;++B)D[B]=S.charCodeAt(B)}};if(K.name==="PRIMEINC")return G(q,A,K.options,N);throw Error("Invalid prime generation algorithm: "+K.name)};function G(q,H,N,K){if("workers"in N)return M(q,H,N,K);return W(q,H,N,K)}function W(q,H,N,K){var L=O(q,H),A=0,D=V(L.bitLength());if("millerRabinTests"in N)D=N.millerRabinTests;var S=10;if("maxBlockTime"in N)S=N.maxBlockTime;U(L,q,H,A,D,S,K)}function U(q,H,N,K,L,A,D){var S=+new Date;do{if(q.bitLength()>H)q=O(H,N);if(q.isProbablePrime(L))return D(null,q);q.dAddOffset(X[K++%8],0)}while(A<0||+new Date-S<A);v0.util.setImmediate(function(){U(q,H,N,K,L,A,D)})}function M(q,H,N,K){if(typeof Worker>"u")return W(q,H,N,K);var L=O(q,H),A=N.workers,D=N.workLoad||100,S=D*30/8,B=N.workerScript||"forge/prime.worker.js";if(A===-1)return v0.util.estimateCores(function(w,P){if(w)P=2;A=P-1,C()});C();function C(){A=Math.max(1,A);var w=[];for(var P=0;P<A;++P)w[P]=new Worker(B);var l=A;for(var P=0;P<A;++P)w[P].addEventListener("message",y);var e=!1;function y(n){if(e)return;--l;var Y$=n.data;if(Y$.found){for(var L$=0;L$<w.length;++L$)w[L$].terminate();return e=!0,K(null,new J(Y$.prime,16))}if(L.bitLength()>q)L=O(q,H);var j$=L.toString(16);n.target.postMessage({hex:j$,workLoad:D}),L.dAddOffset(S,0)}}}function O(q,H){var N=new J(q,H),K=q-1;if(!N.testBit(K))N.bitwiseTo(J.ONE.shiftLeft(K),Y,N);return N.dAddOffset(31-N.mod(Q).byteValue(),0),N}function V(q){if(q<=100)return 27;if(q<=150)return 18;if(q<=200)return 15;if(q<=250)return 12;if(q<=300)return 9;if(q<=350)return 8;if(q<=400)return 7;if(q<=500)return 6;if(q<=600)return 5;if(q<=800)return 4;if(q<=1250)return 3;return 2}})()});var SX=q$((fF,S1)=>{var Q$=F$();mJ();TX();_0();z8();F8();_J();_$();if(typeof I$>"u")I$=Q$.jsbn.BigInteger;var I$,N8=Q$.util.isNodejs?KX("crypto"):null,I=Q$.asn1,vJ=Q$.util;Q$.pki=Q$.pki||{};S1.exports=Q$.pki.rsa=Q$.rsa=Q$.rsa||{};var H$=Q$.pki,EV=[6,4,2,4,2,4,6,2],FV={name:"PrivateKeyInfo",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:I.Class.UNIVERSAL,type:I.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:I.Class.UNIVERSAL,type:I.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]},NV={name:"RSAPrivateKey",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPrivateKey.version",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"RSAPrivateKey.modulus",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyModulus"},{name:"RSAPrivateKey.publicExponent",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyPublicExponent"},{name:"RSAPrivateKey.privateExponent",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyPrivateExponent"},{name:"RSAPrivateKey.prime1",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyPrime1"},{name:"RSAPrivateKey.prime2",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyPrime2"},{name:"RSAPrivateKey.exponent1",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyExponent1"},{name:"RSAPrivateKey.exponent2",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyExponent2"},{name:"RSAPrivateKey.coefficient",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyCoefficient"}]},LV={name:"RSAPublicKey",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPublicKey.modulus",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"publicKeyModulus"},{name:"RSAPublicKey.exponent",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"publicKeyExponent"}]},AV=Q$.pki.rsa.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:I.Class.UNIVERSAL,type:I.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{name:"SubjectPublicKeyInfo.subjectPublicKey",tagClass:I.Class.UNIVERSAL,type:I.Type.BITSTRING,constructed:!1,value:[{name:"SubjectPublicKeyInfo.subjectPublicKey.RSAPublicKey",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"rsaPublicKey"}]}]},RV={name:"DigestInfo",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm.algorithmIdentifier",tagClass:I.Class.UNIVERSAL,type:I.Type.OID,constructed:!1,capture:"algorithmIdentifier"},{name:"DigestInfo.DigestAlgorithm.parameters",tagClass:I.Class.UNIVERSAL,type:I.Type.NULL,capture:"parameters",optional:!0,constructed:!1}]},{name:"DigestInfo.digest",tagClass:I.Class.UNIVERSAL,type:I.Type.OCTETSTRING,constructed:!1,capture:"digest"}]},DV=function($){var J;if($.algorithm in H$.oids)J=H$.oids[$.algorithm];else{var X=Error("Unknown message digest algorithm.");throw X.algorithm=$.algorithm,X}var Q=I.oidToDer(J).getBytes(),Y=I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[]),G=I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[]);G.value.push(I.create(I.Class.UNIVERSAL,I.Type.OID,!1,Q)),G.value.push(I.create(I.Class.UNIVERSAL,I.Type.NULL,!1,""));var W=I.create(I.Class.UNIVERSAL,I.Type.OCTETSTRING,!1,$.digest().getBytes());return Y.value.push(G),Y.value.push(W),I.toDer(Y).getBytes()},j1=function($,J,X){if(X)return $.modPow(J.e,J.n);if(!J.p||!J.q)return $.modPow(J.d,J.n);if(!J.dP)J.dP=J.d.mod(J.p.subtract(I$.ONE));if(!J.dQ)J.dQ=J.d.mod(J.q.subtract(I$.ONE));if(!J.qInv)J.qInv=J.q.modInverse(J.p);var Q;do Q=new I$(Q$.util.bytesToHex(Q$.random.getBytes(J.n.bitLength()/8)),16);while(Q.compareTo(J.n)>=0||!Q.gcd(J.n).equals(I$.ONE));$=$.multiply(Q.modPow(J.e,J.n)).mod(J.n);var Y=$.mod(J.p).modPow(J.dP,J.p),G=$.mod(J.q).modPow(J.dQ,J.q);while(Y.compareTo(G)<0)Y=Y.add(J.p);var W=Y.subtract(G).multiply(J.qInv).mod(J.p).multiply(J.q).add(G);return W=W.multiply(Q.modInverse(J.n)).mod(J.n),W};H$.rsa.encrypt=function($,J,X){var Q=X,Y,G=Math.ceil(J.n.bitLength()/8);if(X!==!1&&X!==!0)Q=X===2,Y=T1($,J,X);else Y=Q$.util.createBuffer(),Y.putBytes($);var W=new I$(Y.toHex(),16),U=j1(W,J,Q),M=U.toString(16),O=Q$.util.createBuffer(),V=G-Math.ceil(M.length/2);while(V>0)O.putByte(0),--V;return O.putBytes(Q$.util.hexToBytes(M)),O.getBytes()};H$.rsa.decrypt=function($,J,X,Q){var Y=Math.ceil(J.n.bitLength()/8);if($.length!==Y){var G=Error("Encrypted message length is invalid.");throw G.length=$.length,G.expected=Y,G}var W=new I$(Q$.util.createBuffer($).toHex(),16);if(W.compareTo(J.n)>=0)throw Error("Encrypted message is invalid.");var U=j1(W,J,X),M=U.toString(16),O=Q$.util.createBuffer(),V=Y-Math.ceil(M.length/2);while(V>0)O.putByte(0),--V;if(O.putBytes(Q$.util.hexToBytes(M)),Q!==!1)return fY(O.getBytes(),J,X);return O.getBytes()};H$.rsa.createKeyPairGenerationState=function($,J,X){if(typeof $==="string")$=parseInt($,10);$=$||2048,X=X||{};var Q=X.prng||Q$.random,Y={nextBytes:function(U){var M=Q.getBytesSync(U.length);for(var O=0;O<U.length;++O)U[O]=M.charCodeAt(O)}},G=X.algorithm||"PRIMEINC",W;if(G==="PRIMEINC")W={algorithm:G,state:0,bits:$,rng:Y,eInt:J||65537,e:new I$(null),p:null,q:null,qBits:$>>1,pBits:$-($>>1),pqState:0,num:null,keys:null},W.e.fromInt(W.eInt);else throw Error("Invalid key generation algorithm: "+G);return W};H$.rsa.stepKeyPairGenerationState=function($,J){if(!("algorithm"in $))$.algorithm="PRIMEINC";var X=new I$(null);X.fromInt(30);var Q=0,Y=function(q,H){return q|H},G=+new Date,W,U=0;while($.keys===null&&(J<=0||U<J)){if($.state===0){var M=$.p===null?$.pBits:$.qBits,O=M-1;if($.pqState===0){if($.num=new I$(M,$.rng),!$.num.testBit(O))$.num.bitwiseTo(I$.ONE.shiftLeft(O),Y,$.num);$.num.dAddOffset(31-$.num.mod(X).byteValue(),0),Q=0,++$.pqState}else if($.pqState===1)if($.num.bitLength()>M)$.pqState=0;else if($.num.isProbablePrime(BV($.num.bitLength())))++$.pqState;else $.num.dAddOffset(EV[Q++%8],0);else if($.pqState===2)$.pqState=$.num.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)===0?3:0;else if($.pqState===3){if($.pqState=0,$.p===null)$.p=$.num;else $.q=$.num;if($.p!==null&&$.q!==null)++$.state;$.num=null}}else if($.state===1){if($.p.compareTo($.q)<0)$.num=$.p,$.p=$.q,$.q=$.num;++$.state}else if($.state===2)$.p1=$.p.subtract(I$.ONE),$.q1=$.q.subtract(I$.ONE),$.phi=$.p1.multiply($.q1),++$.state;else if($.state===3)if($.phi.gcd($.e).compareTo(I$.ONE)===0)++$.state;else $.p=null,$.q=null,$.state=0;else if($.state===4)if($.n=$.p.multiply($.q),$.n.bitLength()===$.bits)++$.state;else $.q=null,$.state=0;else if($.state===5){var V=$.e.modInverse($.phi);$.keys={privateKey:H$.rsa.setPrivateKey($.n,$.e,V,$.p,$.q,V.mod($.p1),V.mod($.q1),$.q.modInverse($.p)),publicKey:H$.rsa.setPublicKey($.n,$.e)}}W=+new Date,U+=W-G,G=W}return $.keys!==null};H$.rsa.generateKeyPair=function($,J,X,Q){if(arguments.length===1){if(typeof $==="object")X=$,$=void 0;else if(typeof $==="function")Q=$,$=void 0}else if(arguments.length===2)if(typeof $==="number"){if(typeof J==="function")Q=J,J=void 0;else if(typeof J!=="number")X=J,J=void 0}else X=$,Q=J,$=void 0,J=void 0;else if(arguments.length===3)if(typeof J==="number"){if(typeof X==="function")Q=X,X=void 0}else Q=X,X=J,J=void 0;if(X=X||{},$===void 0)$=X.bits||2048;if(J===void 0)J=X.e||65537;if(!Q$.options.usePureJavaScript&&!X.prng&&$>=256&&$<=16384&&(J===65537||J===3)){if(Q){if(R1("generateKeyPair"))return N8.generateKeyPair("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}},function(U,M,O){if(U)return Q(U);Q(null,{privateKey:H$.privateKeyFromPem(O),publicKey:H$.publicKeyFromPem(M)})});if(D1("generateKey")&&D1("exportKey"))return vJ.globalScope.crypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:B1(J),hash:{name:"SHA-256"}},!0,["sign","verify"]).then(function(U){return vJ.globalScope.crypto.subtle.exportKey("pkcs8",U.privateKey)}).then(void 0,function(U){Q(U)}).then(function(U){if(U){var M=H$.privateKeyFromAsn1(I.fromDer(Q$.util.createBuffer(U)));Q(null,{privateKey:M,publicKey:H$.setRsaPublicKey(M.n,M.e)})}});if(Z1("generateKey")&&Z1("exportKey")){var Y=vJ.globalScope.msCrypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:B1(J),hash:{name:"SHA-256"}},!0,["sign","verify"]);Y.oncomplete=function(U){var M=U.target.result,O=vJ.globalScope.msCrypto.subtle.exportKey("pkcs8",M.privateKey);O.oncomplete=function(V){var q=V.target.result,H=H$.privateKeyFromAsn1(I.fromDer(Q$.util.createBuffer(q)));Q(null,{privateKey:H,publicKey:H$.setRsaPublicKey(H.n,H.e)})},O.onerror=function(V){Q(V)}},Y.onerror=function(U){Q(U)};return}}else if(R1("generateKeyPairSync")){var G=N8.generateKeyPairSync("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{privateKey:H$.privateKeyFromPem(G.privateKey),publicKey:H$.publicKeyFromPem(G.publicKey)}}}var W=H$.rsa.createKeyPairGenerationState($,J,X);if(!Q)return H$.rsa.stepKeyPairGenerationState(W,0),W.keys;ZV(W,X,Q)};H$.setRsaPublicKey=H$.rsa.setPublicKey=function($,J){var X={n:$,e:J};return X.encrypt=function(Q,Y,G){if(typeof Y==="string")Y=Y.toUpperCase();else if(Y===void 0)Y="RSAES-PKCS1-V1_5";if(Y==="RSAES-PKCS1-V1_5")Y={encode:function(U,M,O){return T1(U,M,2).getBytes()}};else if(Y==="RSA-OAEP"||Y==="RSAES-OAEP")Y={encode:function(U,M){return Q$.pkcs1.encode_rsa_oaep(M,U,G)}};else if(["RAW","NONE","NULL",null].indexOf(Y)!==-1)Y={encode:function(U){return U}};else if(typeof Y==="string")throw Error('Unsupported encryption scheme: "'+Y+'".');var W=Y.encode(Q,X,!0);return H$.rsa.encrypt(W,X,!0)},X.verify=function(Q,Y,G,W){if(typeof G==="string")G=G.toUpperCase();else if(G===void 0)G="RSASSA-PKCS1-V1_5";if(W===void 0)W={_parseAllDigestBytes:!0,_skipPaddingChecks:!1};if(!("_parseAllDigestBytes"in W))W._parseAllDigestBytes=!0;if(!("_skipPaddingChecks"in W))W._skipPaddingChecks=!1;if(G==="RSASSA-PKCS1-V1_5")G={verify:function(M,O){O=fY(O,X,!0,void 0,W);var V=I.fromDer(O,{parseAllBytes:W._parseAllDigestBytes}),q={},H=[];if(!I.validate(V,RV,q,H)||V.value.length!==2){var N=Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.");throw N.errors=H,N}var K=I.derToOid(q.algorithmIdentifier);if(!(K===Q$.oids.md2||K===Q$.oids.md5||K===Q$.oids.sha1||K===Q$.oids.sha224||K===Q$.oids.sha256||K===Q$.oids.sha384||K===Q$.oids.sha512||K===Q$.oids["sha512-224"]||K===Q$.oids["sha512-256"])){var N=Error("Unknown RSASSA-PKCS1-v1_5 DigestAlgorithm identifier.");throw N.oid=K,N}if(K===Q$.oids.md2||K===Q$.oids.md5){if(!("parameters"in q))throw Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value. Missing algorithm identifier NULL parameters.")}return M===q.digest}};else if(G==="NONE"||G==="NULL"||G===null)G={verify:function(M,O){return O=fY(O,X,!0,void 0,W),M===O}};var U=H$.rsa.decrypt(Y,X,!0,!1);return G.verify(Q,U,X.n.bitLength())},X};H$.setRsaPrivateKey=H$.rsa.setPrivateKey=function($,J,X,Q,Y,G,W,U){var M={n:$,e:J,d:X,p:Q,q:Y,dP:G,dQ:W,qInv:U};return M.decrypt=function(O,V,q){if(typeof V==="string")V=V.toUpperCase();else if(V===void 0)V="RSAES-PKCS1-V1_5";var H=H$.rsa.decrypt(O,M,!1,!1);if(V==="RSAES-PKCS1-V1_5")V={decode:fY};else if(V==="RSA-OAEP"||V==="RSAES-OAEP")V={decode:function(N,K){return Q$.pkcs1.decode_rsa_oaep(K,N,q)}};else if(["RAW","NONE","NULL",null].indexOf(V)!==-1)V={decode:function(N){return N}};else throw Error('Unsupported encryption scheme: "'+V+'".');return V.decode(H,M,!1)},M.sign=function(O,V){var q=!1;if(typeof V==="string")V=V.toUpperCase();if(V===void 0||V==="RSASSA-PKCS1-V1_5")V={encode:DV},q=1;else if(V==="NONE"||V==="NULL"||V===null)V={encode:function(){return O}},q=1;var H=V.encode(O,M.n.bitLength());return H$.rsa.encrypt(H,M,q)},M};H$.wrapRsaPrivateKey=function($){return I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,I.integerToDer(0).getBytes()),I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.OID,!1,I.oidToDer(H$.oids.rsaEncryption).getBytes()),I.create(I.Class.UNIVERSAL,I.Type.NULL,!1,"")]),I.create(I.Class.UNIVERSAL,I.Type.OCTETSTRING,!1,I.toDer($).getBytes())])};H$.privateKeyFromAsn1=function($){var J={},X=[];if(I.validate($,FV,J,X))$=I.fromDer(Q$.util.createBuffer(J.privateKey));if(J={},X=[],!I.validate($,NV,J,X)){var Q=Error("Cannot read private key. ASN.1 object does not contain an RSAPrivateKey.");throw Q.errors=X,Q}var Y,G,W,U,M,O,V,q;return Y=Q$.util.createBuffer(J.privateKeyModulus).toHex(),G=Q$.util.createBuffer(J.privateKeyPublicExponent).toHex(),W=Q$.util.createBuffer(J.privateKeyPrivateExponent).toHex(),U=Q$.util.createBuffer(J.privateKeyPrime1).toHex(),M=Q$.util.createBuffer(J.privateKeyPrime2).toHex(),O=Q$.util.createBuffer(J.privateKeyExponent1).toHex(),V=Q$.util.createBuffer(J.privateKeyExponent2).toHex(),q=Q$.util.createBuffer(J.privateKeyCoefficient).toHex(),H$.setRsaPrivateKey(new I$(Y,16),new I$(G,16),new I$(W,16),new I$(U,16),new I$(M,16),new I$(O,16),new I$(V,16),new I$(q,16))};H$.privateKeyToAsn1=H$.privateKeyToRSAPrivateKey=function($){return I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,I.integerToDer(0).getBytes()),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.n)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.e)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.d)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.p)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.q)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.dP)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.dQ)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.qInv))])};H$.publicKeyFromAsn1=function($){var J={},X=[];if(I.validate($,AV,J,X)){var Q=I.derToOid(J.publicKeyOid);if(Q!==H$.oids.rsaEncryption){var Y=Error("Cannot read public key. Unknown OID.");throw Y.oid=Q,Y}$=J.rsaPublicKey}if(X=[],!I.validate($,LV,J,X)){var Y=Error("Cannot read public key. ASN.1 object does not contain an RSAPublicKey.");throw Y.errors=X,Y}var G=Q$.util.createBuffer(J.publicKeyModulus).toHex(),W=Q$.util.createBuffer(J.publicKeyExponent).toHex();return H$.setRsaPublicKey(new I$(G,16),new I$(W,16))};H$.publicKeyToAsn1=H$.publicKeyToSubjectPublicKeyInfo=function($){return I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.OID,!1,I.oidToDer(H$.oids.rsaEncryption).getBytes()),I.create(I.Class.UNIVERSAL,I.Type.NULL,!1,"")]),I.create(I.Class.UNIVERSAL,I.Type.BITSTRING,!1,[H$.publicKeyToRSAPublicKey($)])])};H$.publicKeyToRSAPublicKey=function($){return I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.n)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,U0($.e))])};function T1($,J,X){var Q=Q$.util.createBuffer(),Y=Math.ceil(J.n.bitLength()/8);if($.length>Y-11){var G=Error("Message is too long for PKCS#1 v1.5 padding.");throw G.length=$.length,G.max=Y-11,G}Q.putByte(0),Q.putByte(X);var W=Y-3-$.length,U;if(X===0||X===1){U=X===0?0:255;for(var M=0;M<W;++M)Q.putByte(U)}else while(W>0){var O=0,V=Q$.random.getBytes(W);for(var M=0;M<W;++M)if(U=V.charCodeAt(M),U===0)++O;else Q.putByte(U);W=O}return Q.putByte(0),Q.putBytes($),Q}function fY($,J,X,Q,Y){var G=Math.ceil(J.n.bitLength()/8),W=Q$.util.createBuffer($),U=W.getByte(),M=W.getByte();if(U!==0||X&&M!==0&&M!==1||!X&&M!==2||X&&M===0&&typeof Q>"u")throw Error("Encryption block is invalid.");var O=0;if(M===0){O=G-3-Q;for(var V=0;V<O;++V)if(W.getByte()!==0)throw Error("Encryption block is invalid.")}else if(M===1){O=0;while(W.length()>1){if(W.getByte()!==255){--W.read;break}++O}if(O<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}else if(M===2){O=0;while(W.length()>1){if(W.getByte()===0){--W.read;break}++O}if(O<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}var q=W.getByte();if(q!==0||O!==G-3-W.length())throw Error("Encryption block is invalid.");return W.getBytes()}function ZV($,J,X){if(typeof J==="function")X=J,J={};J=J||{};var Q={algorithm:{name:J.algorithm||"PRIMEINC",options:{workers:J.workers||2,workLoad:J.workLoad||100,workerScript:J.workerScript}}};if("prng"in J)Q.prng=J.prng;Y();function Y(){G($.pBits,function(U,M){if(U)return X(U);if($.p=M,$.q!==null)return W(U,$.q);G($.qBits,W)})}function G(U,M){Q$.prime.generateProbablePrime(U,Q,M)}function W(U,M){if(U)return X(U);if($.q=M,$.p.compareTo($.q)<0){var O=$.p;$.p=$.q,$.q=O}if($.p.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)!==0){$.p=null,Y();return}if($.q.subtract(I$.ONE).gcd($.e).compareTo(I$.ONE)!==0){$.q=null,G($.qBits,W);return}if($.p1=$.p.subtract(I$.ONE),$.q1=$.q.subtract(I$.ONE),$.phi=$.p1.multiply($.q1),$.phi.gcd($.e).compareTo(I$.ONE)!==0){$.p=$.q=null,Y();return}if($.n=$.p.multiply($.q),$.n.bitLength()!==$.bits){$.q=null,G($.qBits,W);return}var V=$.e.modInverse($.phi);$.keys={privateKey:H$.rsa.setPrivateKey($.n,$.e,V,$.p,$.q,V.mod($.p1),V.mod($.q1),$.q.modInverse($.p)),publicKey:H$.rsa.setPublicKey($.n,$.e)},X(null,$.keys)}}function U0($){var J=$.toString(16);if(J[0]>="8")J="00"+J;var X=Q$.util.hexToBytes(J);if(X.length>1&&(X.charCodeAt(0)===0&&(X.charCodeAt(1)&128)===0||X.charCodeAt(0)===255&&(X.charCodeAt(1)&128)===128))return X.substr(1);return X}function BV($){if($<=100)return 27;if($<=150)return 18;if($<=200)return 15;if($<=250)return 12;if($<=300)return 9;if($<=350)return 8;if($<=400)return 7;if($<=500)return 6;if($<=600)return 5;if($<=800)return 4;if($<=1250)return 3;return 2}function R1($){return Q$.util.isNodejs&&typeof N8[$]==="function"}function D1($){return typeof vJ.globalScope<"u"&&typeof vJ.globalScope.crypto==="object"&&typeof vJ.globalScope.crypto.subtle==="object"&&typeof vJ.globalScope.crypto.subtle[$]==="function"}function Z1($){return typeof vJ.globalScope<"u"&&typeof vJ.globalScope.msCrypto==="object"&&typeof vJ.globalScope.msCrypto.subtle==="object"&&typeof vJ.globalScope.msCrypto.subtle[$]==="function"}function B1($){var J=Q$.util.hexToBytes($.toString(16)),X=new Uint8Array(J.length);for(var Q=0;Q<J.length;++Q)X[Q]=J.charCodeAt(Q);return X}});var A8=q$((yF,P1)=>{var o=F$();P0();mJ();BX();$0();_0();PY();QQ();_J();O8();SX();_$();if(typeof L8>"u")L8=o.jsbn.BigInteger;var L8,_=o.asn1,z$=o.pki=o.pki||{};P1.exports=z$.pbe=o.pbe=o.pbe||{};var GQ=z$.oids,jV={name:"EncryptedPrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedPrivateKeyInfo.encryptionAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encryptionOid"},{name:"AlgorithmIdentifier.parameters",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,captureAsn1:"encryptionParams"}]},{name:"EncryptedPrivateKeyInfo.encryptedData",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encryptedData"}]},TV={name:"PBES2Algorithms",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"kdfOid"},{name:"PBES2Algorithms.params",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.params.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"kdfSalt"},{name:"PBES2Algorithms.params.iterationCount",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"kdfIterationCount"},{name:"PBES2Algorithms.params.keyLength",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,optional:!0,capture:"keyLength"},{name:"PBES2Algorithms.params.prf",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,optional:!0,value:[{name:"PBES2Algorithms.params.prf.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"prfOid"}]}]}]},{name:"PBES2Algorithms.encryptionScheme",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.encryptionScheme.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encOid"},{name:"PBES2Algorithms.encryptionScheme.iv",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encIv"}]}]},SV={name:"pkcs-12PbeParams",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"pkcs-12PbeParams.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"salt"},{name:"pkcs-12PbeParams.iterations",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"iterations"}]};z$.encryptPrivateKeyInfo=function($,J,X){X=X||{},X.saltSize=X.saltSize||8,X.count=X.count||2048,X.algorithm=X.algorithm||"aes128",X.prfAlgorithm=X.prfAlgorithm||"sha1";var Q=o.random.getBytesSync(X.saltSize),Y=X.count,G=_.integerToDer(Y),W,U,M;if(X.algorithm.indexOf("aes")===0||X.algorithm==="des"){var O,V,q;switch(X.algorithm){case"aes128":W=16,O=16,V=GQ["aes128-CBC"],q=o.aes.createEncryptionCipher;break;case"aes192":W=24,O=16,V=GQ["aes192-CBC"],q=o.aes.createEncryptionCipher;break;case"aes256":W=32,O=16,V=GQ["aes256-CBC"],q=o.aes.createEncryptionCipher;break;case"des":W=8,O=8,V=GQ.desCBC,q=o.des.createEncryptionCipher;break;default:var H=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw H.algorithm=X.algorithm,H}var N="hmacWith"+X.prfAlgorithm.toUpperCase(),K=w1(N),L=o.pkcs5.pbkdf2(J,Q,Y,W,K),A=o.random.getBytesSync(O),D=q(L);D.start(A),D.update(_.toDer($)),D.finish(),M=D.output.getBytes();var S=IV(Q,G,W,N);U=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(GQ.pkcs5PBES2).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(GQ.pkcs5PBKDF2).getBytes()),S]),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(V).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,A)])])])}else if(X.algorithm==="3des"){W=24;var B=new o.util.ByteBuffer(Q),L=z$.pbe.generatePkcs12Key(J,B,1,Y,W),A=z$.pbe.generatePkcs12Key(J,B,2,Y,W),D=o.des.createEncryptionCipher(L);D.start(A),D.update(_.toDer($)),D.finish(),M=D.output.getBytes(),U=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(GQ["pbeWithSHAAnd3-KeyTripleDES-CBC"]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,Q),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,G.getBytes())])])}else{var H=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw H.algorithm=X.algorithm,H}var C=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[U,_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,M)]);return C};z$.decryptPrivateKeyInfo=function($,J){var X=null,Q={},Y=[];if(!_.validate($,jV,Q,Y)){var G=Error("Cannot read encrypted private key. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=_.derToOid(Q.encryptionOid),U=z$.pbe.getCipher(W,Q.encryptionParams,J),M=o.util.createBuffer(Q.encryptedData);if(U.update(M),U.finish())X=_.fromDer(U.output);return X};z$.encryptedPrivateKeyToPem=function($,J){var X={type:"ENCRYPTED PRIVATE KEY",body:_.toDer($).getBytes()};return o.pem.encode(X,{maxline:J})};z$.encryptedPrivateKeyFromPem=function($){var J=o.pem.decode($)[0];if(J.type!=="ENCRYPTED PRIVATE KEY"){var X=Error('Could not convert encrypted private key from PEM; PEM header type is "ENCRYPTED PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert encrypted private key from PEM; PEM is encrypted.");return _.fromDer(J.body)};z$.encryptRsaPrivateKey=function($,J,X){if(X=X||{},!X.legacy){var Q=z$.wrapRsaPrivateKey(z$.privateKeyToAsn1($));return Q=z$.encryptPrivateKeyInfo(Q,J,X),z$.encryptedPrivateKeyToPem(Q)}var Y,G,W,U;switch(X.algorithm){case"aes128":Y="AES-128-CBC",W=16,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"aes192":Y="AES-192-CBC",W=24,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"aes256":Y="AES-256-CBC",W=32,G=o.random.getBytesSync(16),U=o.aes.createEncryptionCipher;break;case"3des":Y="DES-EDE3-CBC",W=24,G=o.random.getBytesSync(8),U=o.des.createEncryptionCipher;break;case"des":Y="DES-CBC",W=8,G=o.random.getBytesSync(8),U=o.des.createEncryptionCipher;break;default:var M=Error('Could not encrypt RSA private key; unsupported encryption algorithm "'+X.algorithm+'".');throw M.algorithm=X.algorithm,M}var O=o.pbe.opensslDeriveBytes(J,G.substr(0,8),W),V=U(O);V.start(G),V.update(_.toDer(z$.privateKeyToAsn1($))),V.finish();var q={type:"RSA PRIVATE KEY",procType:{version:"4",type:"ENCRYPTED"},dekInfo:{algorithm:Y,parameters:o.util.bytesToHex(G).toUpperCase()},body:V.output.getBytes()};return o.pem.encode(q)};z$.decryptRsaPrivateKey=function($,J){var X=null,Q=o.pem.decode($)[0];if(Q.type!=="ENCRYPTED PRIVATE KEY"&&Q.type!=="PRIVATE KEY"&&Q.type!=="RSA PRIVATE KEY"){var Y=Error('Could not convert private key from PEM; PEM header type is not "ENCRYPTED PRIVATE KEY", "PRIVATE KEY", or "RSA PRIVATE KEY".');throw Y.headerType=Y,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED"){var G,W;switch(Q.dekInfo.algorithm){case"DES-CBC":G=8,W=o.des.createDecryptionCipher;break;case"DES-EDE3-CBC":G=24,W=o.des.createDecryptionCipher;break;case"AES-128-CBC":G=16,W=o.aes.createDecryptionCipher;break;case"AES-192-CBC":G=24,W=o.aes.createDecryptionCipher;break;case"AES-256-CBC":G=32,W=o.aes.createDecryptionCipher;break;case"RC2-40-CBC":G=5,W=function(q){return o.rc2.createDecryptionCipher(q,40)};break;case"RC2-64-CBC":G=8,W=function(q){return o.rc2.createDecryptionCipher(q,64)};break;case"RC2-128-CBC":G=16,W=function(q){return o.rc2.createDecryptionCipher(q,128)};break;default:var Y=Error('Could not decrypt private key; unsupported encryption algorithm "'+Q.dekInfo.algorithm+'".');throw Y.algorithm=Q.dekInfo.algorithm,Y}var U=o.util.hexToBytes(Q.dekInfo.parameters),M=o.pbe.opensslDeriveBytes(J,U.substr(0,8),G),O=W(M);if(O.start(U),O.update(o.util.createBuffer(Q.body)),O.finish())X=O.output.getBytes();else return X}else X=Q.body;if(Q.type==="ENCRYPTED PRIVATE KEY")X=z$.decryptPrivateKeyInfo(_.fromDer(X),J);else X=_.fromDer(X);if(X!==null)X=z$.privateKeyFromAsn1(X);return X};z$.pbe.generatePkcs12Key=function($,J,X,Q,Y,G){var W,U;if(typeof G>"u"||G===null){if(!("sha1"in o.md))throw Error('"sha1" hash algorithm unavailable.');G=o.md.sha1.create()}var{digestLength:M,blockLength:O}=G,V=new o.util.ByteBuffer,q=new o.util.ByteBuffer;if($!==null&&$!==void 0){for(U=0;U<$.length;U++)q.putInt16($.charCodeAt(U));q.putInt16(0)}var H=q.length(),N=J.length(),K=new o.util.ByteBuffer;K.fillWithByte(X,O);var L=O*Math.ceil(N/O),A=new o.util.ByteBuffer;for(U=0;U<L;U++)A.putByte(J.at(U%N));var D=O*Math.ceil(H/O),S=new o.util.ByteBuffer;for(U=0;U<D;U++)S.putByte(q.at(U%H));var B=A;B.putBuffer(S);var C=Math.ceil(Y/M);for(var w=1;w<=C;w++){var P=new o.util.ByteBuffer;P.putBytes(K.bytes()),P.putBytes(B.bytes());for(var l=0;l<Q;l++)G.start(),G.update(P.getBytes()),P=G.digest();var e=new o.util.ByteBuffer;for(U=0;U<O;U++)e.putByte(P.at(U%M));var y=Math.ceil(N/O)+Math.ceil(H/O),n=new o.util.ByteBuffer;for(W=0;W<y;W++){var Y$=new o.util.ByteBuffer(B.getBytes(O)),L$=511;for(U=e.length()-1;U>=0;U--)L$=L$>>8,L$+=e.at(U)+Y$.at(U),Y$.setAt(U,L$&255);n.putBuffer(Y$)}B=n,V.putBuffer(P)}return V.truncate(V.length()-Y),V};z$.pbe.getCipher=function($,J,X){switch($){case z$.oids.pkcs5PBES2:return z$.pbe.getCipherForPBES2($,J,X);case z$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:case z$.oids["pbewithSHAAnd40BitRC2-CBC"]:return z$.pbe.getCipherForPKCS12PBE($,J,X);default:var Q=Error("Cannot read encrypted PBE data block. Unsupported OID.");throw Q.oid=$,Q.supportedOids=["pkcs5PBES2","pbeWithSHAAnd3-KeyTripleDES-CBC","pbewithSHAAnd40BitRC2-CBC"],Q}};z$.pbe.getCipherForPBES2=function($,J,X){var Q={},Y=[];if(!_.validate(J,TV,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}if($=_.derToOid(Q.kdfOid),$!==z$.oids.pkcs5PBKDF2){var G=Error("Cannot read encrypted private key. Unsupported key derivation function OID.");throw G.oid=$,G.supportedOids=["pkcs5PBKDF2"],G}if($=_.derToOid(Q.encOid),$!==z$.oids["aes128-CBC"]&&$!==z$.oids["aes192-CBC"]&&$!==z$.oids["aes256-CBC"]&&$!==z$.oids["des-EDE3-CBC"]&&$!==z$.oids.desCBC){var G=Error("Cannot read encrypted private key. Unsupported encryption scheme OID.");throw G.oid=$,G.supportedOids=["aes128-CBC","aes192-CBC","aes256-CBC","des-EDE3-CBC","desCBC"],G}var W=Q.kdfSalt,U=o.util.createBuffer(Q.kdfIterationCount);U=U.getInt(U.length()<<3);var M,O;switch(z$.oids[$]){case"aes128-CBC":M=16,O=o.aes.createDecryptionCipher;break;case"aes192-CBC":M=24,O=o.aes.createDecryptionCipher;break;case"aes256-CBC":M=32,O=o.aes.createDecryptionCipher;break;case"des-EDE3-CBC":M=24,O=o.des.createDecryptionCipher;break;case"desCBC":M=8,O=o.des.createDecryptionCipher;break}var V=C1(Q.prfOid),q=o.pkcs5.pbkdf2(X,W,U,M,V),H=Q.encIv,N=O(q);return N.start(H),N};z$.pbe.getCipherForPKCS12PBE=function($,J,X){var Q={},Y=[];if(!_.validate(J,SV,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=o.util.createBuffer(Q.salt),U=o.util.createBuffer(Q.iterations);U=U.getInt(U.length()<<3);var M,O,V;switch($){case z$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:M=24,O=8,V=o.des.startDecrypting;break;case z$.oids["pbewithSHAAnd40BitRC2-CBC"]:M=5,O=8,V=function(L,A){var D=o.rc2.createDecryptionCipher(L,40);return D.start(A,null),D};break;default:var G=Error("Cannot read PKCS #12 PBE data block. Unsupported OID.");throw G.oid=$,G}var q=C1(Q.prfOid),H=z$.pbe.generatePkcs12Key(X,W,1,U,M,q);q.start();var N=z$.pbe.generatePkcs12Key(X,W,2,U,O,q);return V(H,N)};z$.pbe.opensslDeriveBytes=function($,J,X,Q){if(typeof Q>"u"||Q===null){if(!("md5"in o.md))throw Error('"md5" hash algorithm unavailable.');Q=o.md.md5.create()}if(J===null)J="";var Y=[I1(Q,$+J)];for(var G=16,W=1;G<X;++W,G+=16)Y.push(I1(Q,Y[W-1]+$+J));return Y.join("").substr(0,X)};function I1($,J){return $.start().update(J).digest().getBytes()}function C1($){var J;if(!$)J="hmacWithSHA1";else if(J=z$.oids[_.derToOid($)],!J){var X=Error("Unsupported PRF OID.");throw X.oid=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}return w1(J)}function w1($){var J=o.md;switch($){case"hmacWithSHA224":J=o.md.sha512;case"hmacWithSHA1":case"hmacWithSHA256":case"hmacWithSHA384":case"hmacWithSHA512":$=$.substr(8).toLowerCase();break;default:var X=Error("Unsupported PRF algorithm.");throw X.algorithm=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}if(!J||!($ in J))throw Error("Unknown hash algorithm: "+$);return J[$].create()}function IV($,J,X,Q){var Y=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,$),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,J.getBytes())]);if(Q!=="hmacWithSHA1")Y.value.push(_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,o.util.hexToBytes(X.toString(16))),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(z$.oids[Q]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]));return Y}});var R8=q$((bF,v1)=>{var PQ=F$();mJ();_$();var i=PQ.asn1,_Q=v1.exports=PQ.pkcs7asn1=PQ.pkcs7asn1||{};PQ.pkcs7=PQ.pkcs7||{};PQ.pkcs7.asn1=_Q;var _1={name:"ContentInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.ContentType",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,captureAsn1:"content"}]};_Q.contentInfoValidator=_1;var x1={name:"EncryptedContentInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentType",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"contentType"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentEncryptionAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,captureAsn1:"encParameter"}]},{name:"EncryptedContentInfo.encryptedContent",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,capture:"encryptedContent",captureAsn1:"encryptedContentAsn1"}]};_Q.envelopedDataValidator={name:"EnvelopedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EnvelopedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"EnvelopedData.RecipientInfos",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,constructed:!0,captureAsn1:"recipientInfos"}].concat(x1)};_Q.encryptedDataValidator={name:"EncryptedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"}].concat(x1)};var CV={name:"SignerInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1},{name:"SignerInfo.issuerAndSerialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.issuerAndSerialNumber.issuer",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"SignerInfo.issuerAndSerialNumber.serialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"SignerInfo.digestAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.digestAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"digestAlgorithm"},{name:"SignerInfo.digestAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,constructed:!1,captureAsn1:"digestParameter",optional:!0}]},{name:"SignerInfo.authenticatedAttributes",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"authenticatedAttributes"},{name:"SignerInfo.digestEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,capture:"signatureAlgorithm"},{name:"SignerInfo.encryptedDigest",tagClass:i.Class.UNIVERSAL,type:i.Type.OCTETSTRING,constructed:!1,capture:"signature"},{name:"SignerInfo.unauthenticatedAttributes",tagClass:i.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,capture:"unauthenticatedAttributes"}]};_Q.signedDataValidator={name:"SignedData",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"SignedData.Version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"SignedData.DigestAlgorithms",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,constructed:!0,captureAsn1:"digestAlgorithms"},_1,{name:"SignedData.Certificates",tagClass:i.Class.CONTEXT_SPECIFIC,type:0,optional:!0,captureAsn1:"certificates"},{name:"SignedData.CertificateRevocationLists",tagClass:i.Class.CONTEXT_SPECIFIC,type:1,optional:!0,captureAsn1:"crls"},{name:"SignedData.SignerInfos",tagClass:i.Class.UNIVERSAL,type:i.Type.SET,capture:"signerInfos",optional:!0,value:[CV]}]};_Q.recipientInfoValidator={name:"RecipientInfo",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.version",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"version"},{name:"RecipientInfo.issuerAndSerial",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.issuerAndSerial.issuer",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"RecipientInfo.issuerAndSerial.serialNumber",tagClass:i.Class.UNIVERSAL,type:i.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"RecipientInfo.keyEncryptionAlgorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.keyEncryptionAlgorithm.algorithm",tagClass:i.Class.UNIVERSAL,type:i.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"RecipientInfo.keyEncryptionAlgorithm.parameter",tagClass:i.Class.UNIVERSAL,constructed:!1,captureAsn1:"encParameter",optional:!0}]},{name:"RecipientInfo.encryptedKey",tagClass:i.Class.UNIVERSAL,type:i.Type.OCTETSTRING,constructed:!1,capture:"encKey"}]}});var D8=q$((hF,k1)=>{var WQ=F$();_$();WQ.mgf=WQ.mgf||{};var wV=k1.exports=WQ.mgf.mgf1=WQ.mgf1=WQ.mgf1||{};wV.create=function($){var J={generate:function(X,Q){var Y=new WQ.util.ByteBuffer,G=Math.ceil(Q/$.digestLength);for(var W=0;W<G;W++){var U=new WQ.util.ByteBuffer;U.putInt32(W),$.start(),$.update(X+U.getBytes()),Y.putBuffer($.digest())}return Y.truncate(Y.length()-Q),Y.getBytes()}};return J}});var y1=q$((uF,f1)=>{var yY=F$();D8();f1.exports=yY.mgf=yY.mgf||{};yY.mgf.mgf1=yY.mgf1});var bY=q$((gF,b1)=>{var UQ=F$();_J();_$();var PV=b1.exports=UQ.pss=UQ.pss||{};PV.create=function($){if(arguments.length===3)$={md:arguments[0],mgf:arguments[1],saltLength:arguments[2]};var{md:J,mgf:X}=$,Q=J.digestLength,Y=$.salt||null;if(typeof Y==="string")Y=UQ.util.createBuffer(Y);var G;if("saltLength"in $)G=$.saltLength;else if(Y!==null)G=Y.length();else throw Error("Salt length not specified or specific salt not given.");if(Y!==null&&Y.length()!==G)throw Error("Given salt length does not match length of given salt.");var W=$.prng||UQ.random,U={};return U.encode=function(M,O){var V,q=O-1,H=Math.ceil(q/8),N=M.digest().getBytes();if(H<Q+G+2)throw Error("Message is too long to encrypt.");var K;if(Y===null)K=W.getBytesSync(G);else K=Y.bytes();var L=new UQ.util.ByteBuffer;L.fillWithByte(0,8),L.putBytes(N),L.putBytes(K),J.start(),J.update(L.getBytes());var A=J.digest().getBytes(),D=new UQ.util.ByteBuffer;D.fillWithByte(0,H-G-Q-2),D.putByte(1),D.putBytes(K);var S=D.getBytes(),B=H-Q-1,C=X.generate(A,B),w="";for(V=0;V<B;V++)w+=String.fromCharCode(S.charCodeAt(V)^C.charCodeAt(V));var P=65280>>8*H-q&255;return w=String.fromCharCode(w.charCodeAt(0)&~P)+w.substr(1),w+A+String.fromCharCode(188)},U.verify=function(M,O,V){var q,H=V-1,N=Math.ceil(H/8);if(O=O.substr(-N),N<Q+G+2)throw Error("Inconsistent parameters to PSS signature verification.");if(O.charCodeAt(N-1)!==188)throw Error("Encoded message does not end in 0xBC.");var K=N-Q-1,L=O.substr(0,K),A=O.substr(K,Q),D=65280>>8*N-H&255;if((L.charCodeAt(0)&D)!==0)throw Error("Bits beyond keysize not zero as expected.");var S=X.generate(A,K),B="";for(q=0;q<K;q++)B+=String.fromCharCode(L.charCodeAt(q)^S.charCodeAt(q));B=String.fromCharCode(B.charCodeAt(0)&~D)+B.substr(1);var C=N-Q-G-2;for(q=0;q<C;q++)if(B.charCodeAt(q)!==0)throw Error("Leftmost octets not zero as expected");if(B.charCodeAt(C)!==1)throw Error("Inconsistent PSS signature, 0x01 marker not found");var w=B.substr(-G),P=new UQ.util.ByteBuffer;P.fillWithByte(0,8),P.putBytes(M),P.putBytes(w),J.start(),J.update(P.getBytes());var l=J.digest().getBytes();return A===l},U}});var gY=q$((mF,l1)=>{var X$=F$();P0();mJ();BX();$0();y1();_0();QQ();bY();SX();_$();var z=X$.asn1,g=l1.exports=X$.pki=X$.pki||{},w$=g.oids,r$={};r$.CN=w$.commonName;r$.commonName="CN";r$.C=w$.countryName;r$.countryName="C";r$.L=w$.localityName;r$.localityName="L";r$.ST=w$.stateOrProvinceName;r$.stateOrProvinceName="ST";r$.O=w$.organizationName;r$.organizationName="O";r$.OU=w$.organizationalUnitName;r$.organizationalUnitName="OU";r$.E=w$.emailAddress;r$.emailAddress="E";var u1=X$.pki.rsa.publicKeyValidator,_V={name:"Certificate",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"tbsCertificate",value:[{name:"Certificate.TBSCertificate.version",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.version.integer",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certVersion"}]},{name:"Certificate.TBSCertificate.serialNumber",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certSerialNumber"},{name:"Certificate.TBSCertificate.signature",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.signature.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"certinfoSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"certinfoSignatureParams"}]},{name:"Certificate.TBSCertificate.issuer",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certIssuer"},{name:"Certificate.TBSCertificate.validity",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.validity.notBefore (utc)",tagClass:z.Class.UNIVERSAL,type:z.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity1UTCTime"},{name:"Certificate.TBSCertificate.validity.notBefore (generalized)",tagClass:z.Class.UNIVERSAL,type:z.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity2GeneralizedTime"},{name:"Certificate.TBSCertificate.validity.notAfter (utc)",tagClass:z.Class.UNIVERSAL,type:z.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity3UTCTime"},{name:"Certificate.TBSCertificate.validity.notAfter (generalized)",tagClass:z.Class.UNIVERSAL,type:z.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity4GeneralizedTime"}]},{name:"Certificate.TBSCertificate.subject",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certSubject"},u1,{name:"Certificate.TBSCertificate.issuerUniqueID",tagClass:z.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.issuerUniqueID.id",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certIssuerUniqueId"}]},{name:"Certificate.TBSCertificate.subjectUniqueID",tagClass:z.Class.CONTEXT_SPECIFIC,type:2,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.subjectUniqueID.id",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSubjectUniqueId"}]},{name:"Certificate.TBSCertificate.extensions",tagClass:z.Class.CONTEXT_SPECIFIC,type:3,constructed:!0,captureAsn1:"certExtensions",optional:!0}]},{name:"Certificate.signatureAlgorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.signatureAlgorithm.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"certSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"certSignatureParams"}]},{name:"Certificate.signatureValue",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSignature"}]},xV={name:"rsapss",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.hashAlgorithm",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier",tagClass:z.Class.UNIVERSAL,type:z.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"hashOid"}]}]},{name:"rsapss.maskGenAlgorithm",tagClass:z.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier",tagClass:z.Class.UNIVERSAL,type:z.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"maskGenOid"},{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"maskGenHashOid"}]}]}]},{name:"rsapss.saltLength",tagClass:z.Class.CONTEXT_SPECIFIC,type:2,optional:!0,value:[{name:"rsapss.saltLength.saltLength",tagClass:z.Class.UNIVERSAL,type:z.Class.INTEGER,constructed:!1,capture:"saltLength"}]},{name:"rsapss.trailerField",tagClass:z.Class.CONTEXT_SPECIFIC,type:3,optional:!0,value:[{name:"rsapss.trailer.trailer",tagClass:z.Class.UNIVERSAL,type:z.Class.INTEGER,constructed:!1,capture:"trailer"}]}]},vV={name:"CertificationRequestInfo",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfo",value:[{name:"CertificationRequestInfo.integer",tagClass:z.Class.UNIVERSAL,type:z.Type.INTEGER,constructed:!1,capture:"certificationRequestInfoVersion"},{name:"CertificationRequestInfo.subject",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfoSubject"},u1,{name:"CertificationRequestInfo.attributes",tagClass:z.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"certificationRequestInfoAttributes",value:[{name:"CertificationRequestInfo.attributes",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequestInfo.attributes.type",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1},{name:"CertificationRequestInfo.attributes.value",tagClass:z.Class.UNIVERSAL,type:z.Type.SET,constructed:!0}]}]}]},kV={name:"CertificationRequest",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,captureAsn1:"csr",value:[vV,{name:"CertificationRequest.signatureAlgorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequest.signatureAlgorithm.algorithm",tagClass:z.Class.UNIVERSAL,type:z.Type.OID,constructed:!1,capture:"csrSignatureOid"},{name:"CertificationRequest.signatureAlgorithm.parameters",tagClass:z.Class.UNIVERSAL,optional:!0,captureAsn1:"csrSignatureParams"}]},{name:"CertificationRequest.signature",tagClass:z.Class.UNIVERSAL,type:z.Type.BITSTRING,constructed:!1,captureBitStringValue:"csrSignature"}]};g.RDNAttributesAsArray=function($,J){var X=[],Q,Y,G;for(var W=0;W<$.value.length;++W){Q=$.value[W];for(var U=0;U<Q.value.length;++U){if(G={},Y=Q.value[U],G.type=z.derToOid(Y.value[0].value),G.value=Y.value[1].value,G.valueTagClass=Y.value[1].type,G.type in w$){if(G.name=w$[G.type],G.name in r$)G.shortName=r$[G.name]}if(J)J.update(G.type),J.update(G.value);X.push(G)}}return X};g.CRIAttributesAsArray=function($){var J=[];for(var X=0;X<$.length;++X){var Q=$[X],Y=z.derToOid(Q.value[0].value),G=Q.value[1].value;for(var W=0;W<G.length;++W){var U={};if(U.type=Y,U.value=G[W].value,U.valueTagClass=G[W].type,U.type in w$){if(U.name=w$[U.type],U.name in r$)U.shortName=r$[U.name]}if(U.type===w$.extensionRequest){U.extensions=[];for(var M=0;M<U.value.length;++M)U.extensions.push(g.certificateExtensionFromAsn1(U.value[M]))}J.push(U)}}return J};function k0($,J){if(typeof J==="string")J={shortName:J};var X=null,Q;for(var Y=0;X===null&&Y<$.attributes.length;++Y)if(Q=$.attributes[Y],J.type&&J.type===Q.type)X=Q;else if(J.name&&J.name===Q.name)X=Q;else if(J.shortName&&J.shortName===Q.shortName)X=Q;return X}var hY=function($,J,X){var Q={};if($!==w$["RSASSA-PSS"])return Q;if(X)Q={hash:{algorithmOid:w$.sha1},mgf:{algorithmOid:w$.mgf1,hash:{algorithmOid:w$.sha1}},saltLength:20};var Y={},G=[];if(!z.validate(J,xV,Y,G)){var W=Error("Cannot read RSASSA-PSS parameter block.");throw W.errors=G,W}if(Y.hashOid!==void 0)Q.hash=Q.hash||{},Q.hash.algorithmOid=z.derToOid(Y.hashOid);if(Y.maskGenOid!==void 0)Q.mgf=Q.mgf||{},Q.mgf.algorithmOid=z.derToOid(Y.maskGenOid),Q.mgf.hash=Q.mgf.hash||{},Q.mgf.hash.algorithmOid=z.derToOid(Y.maskGenHashOid);if(Y.saltLength!==void 0)Q.saltLength=Y.saltLength.charCodeAt(0);return Q},uY=function($){switch(w$[$.signatureOid]){case"sha1WithRSAEncryption":case"sha1WithRSASignature":return X$.md.sha1.create();case"md5WithRSAEncryption":return X$.md.md5.create();case"sha256WithRSAEncryption":return X$.md.sha256.create();case"sha384WithRSAEncryption":return X$.md.sha384.create();case"sha512WithRSAEncryption":return X$.md.sha512.create();case"RSASSA-PSS":return X$.md.sha256.create();default:var J=Error("Could not compute "+$.type+" digest. Unknown signature OID.");throw J.signatureOid=$.signatureOid,J}},g1=function($){var J=$.certificate,X;switch(J.signatureOid){case w$.sha1WithRSAEncryption:case w$.sha1WithRSASignature:break;case w$["RSASSA-PSS"]:var Q,Y;if(Q=w$[J.signatureParameters.mgf.hash.algorithmOid],Q===void 0||X$.md[Q]===void 0){var G=Error("Unsupported MGF hash function.");throw G.oid=J.signatureParameters.mgf.hash.algorithmOid,G.name=Q,G}if(Y=w$[J.signatureParameters.mgf.algorithmOid],Y===void 0||X$.mgf[Y]===void 0){var G=Error("Unsupported MGF function.");throw G.oid=J.signatureParameters.mgf.algorithmOid,G.name=Y,G}if(Y=X$.mgf[Y].create(X$.md[Q].create()),Q=w$[J.signatureParameters.hash.algorithmOid],Q===void 0||X$.md[Q]===void 0){var G=Error("Unsupported RSASSA-PSS hash function.");throw G.oid=J.signatureParameters.hash.algorithmOid,G.name=Q,G}X=X$.pss.create(X$.md[Q].create(),Y,J.signatureParameters.saltLength);break}return J.publicKey.verify($.md.digest().getBytes(),$.signature,X)};g.certificateFromPem=function($,J,X){var Q=X$.pem.decode($)[0];if(Q.type!=="CERTIFICATE"&&Q.type!=="X509 CERTIFICATE"&&Q.type!=="TRUSTED CERTIFICATE"){var Y=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var G=z.fromDer(Q.body,X);return g.certificateFromAsn1(G,J)};g.certificateToPem=function($,J){var X={type:"CERTIFICATE",body:z.toDer(g.certificateToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.publicKeyFromPem=function($){var J=X$.pem.decode($)[0];if(J.type!=="PUBLIC KEY"&&J.type!=="RSA PUBLIC KEY"){var X=Error('Could not convert public key from PEM; PEM header type is not "PUBLIC KEY" or "RSA PUBLIC KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert public key from PEM; PEM is encrypted.");var Q=z.fromDer(J.body);return g.publicKeyFromAsn1(Q)};g.publicKeyToPem=function($,J){var X={type:"PUBLIC KEY",body:z.toDer(g.publicKeyToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.publicKeyToRSAPublicKeyPem=function($,J){var X={type:"RSA PUBLIC KEY",body:z.toDer(g.publicKeyToRSAPublicKey($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||X$.md.sha1.create(),Q=J.type||"RSAPublicKey",Y;switch(Q){case"RSAPublicKey":Y=z.toDer(g.publicKeyToRSAPublicKey($)).getBytes();break;case"SubjectPublicKeyInfo":Y=z.toDer(g.publicKeyToAsn1($)).getBytes();break;default:throw Error('Unknown fingerprint type "'+J.type+'".')}X.start(),X.update(Y);var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};g.certificationRequestFromPem=function($,J,X){var Q=X$.pem.decode($)[0];if(Q.type!=="CERTIFICATE REQUEST"){var Y=Error('Could not convert certification request from PEM; PEM header type is not "CERTIFICATE REQUEST".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certification request from PEM; PEM is encrypted.");var G=z.fromDer(Q.body,X);return g.certificationRequestFromAsn1(G,J)};g.certificationRequestToPem=function($,J){var X={type:"CERTIFICATE REQUEST",body:z.toDer(g.certificationRequestToAsn1($)).getBytes()};return X$.pem.encode(X,{maxline:J})};g.createCertificate=function(){var $={};return $.version=2,$.serialNumber="00",$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.validity={},$.validity.notBefore=new Date,$.validity.notAfter=new Date,$.issuer={},$.issuer.getField=function(J){return k0($.issuer,J)},$.issuer.addField=function(J){kJ([J]),$.issuer.attributes.push(J)},$.issuer.attributes=[],$.issuer.hash=null,$.subject={},$.subject.getField=function(J){return k0($.subject,J)},$.subject.addField=function(J){kJ([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.extensions=[],$.publicKey=null,$.md=null,$.setSubject=function(J,X){if(kJ(J),$.subject.attributes=J,delete $.subject.uniqueId,X)$.subject.uniqueId=X;$.subject.hash=null},$.setIssuer=function(J,X){if(kJ(J),$.issuer.attributes=J,delete $.issuer.uniqueId,X)$.issuer.uniqueId=X;$.issuer.hash=null},$.setExtensions=function(J){for(var X=0;X<J.length;++X)m1(J[X],{cert:$});$.extensions=J},$.getExtension=function(J){if(typeof J==="string")J={name:J};var X=null,Q;for(var Y=0;X===null&&Y<$.extensions.length;++Y)if(Q=$.extensions[Y],J.id&&Q.id===J.id)X=Q;else if(J.name&&Q.name===J.name)X=Q;return X},$.sign=function(J,X){$.md=X||X$.md.sha1.create();var Q=w$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certificate digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.tbsCertificate=g.getTBSCertificate($);var G=z.toDer($.tbsCertificate);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(J){var X=!1;if(!$.issued(J)){var Q=J.issuer,Y=$.subject,G=Error("The parent certificate did not issue the given child certificate; the child certificate's issuer does not match the parent's subject.");throw G.expectedIssuer=Y.attributes,G.actualIssuer=Q.attributes,G}var W=J.md;if(W===null){W=uY({signatureOid:J.signatureOid,type:"certificate"});var U=J.tbsCertificate||g.getTBSCertificate(J),M=z.toDer(U);W.update(M.getBytes())}if(W!==null)X=g1({certificate:$,md:W,signature:J.signature});return X},$.isIssuer=function(J){var X=!1,Q=$.issuer,Y=J.subject;if(Q.hash&&Y.hash)X=Q.hash===Y.hash;else if(Q.attributes.length===Y.attributes.length){X=!0;var G,W;for(var U=0;X&&U<Q.attributes.length;++U)if(G=Q.attributes[U],W=Y.attributes[U],G.type!==W.type||G.value!==W.value)X=!1}return X},$.issued=function(J){return J.isIssuer($)},$.generateSubjectKeyIdentifier=function(){return g.getPublicKeyFingerprint($.publicKey,{type:"RSAPublicKey"})},$.verifySubjectKeyIdentifier=function(){var J=w$.subjectKeyIdentifier;for(var X=0;X<$.extensions.length;++X){var Q=$.extensions[X];if(Q.id===J){var Y=$.generateSubjectKeyIdentifier().getBytes();return X$.util.hexToBytes(Q.subjectKeyIdentifier)===Y}}return!1},$};g.certificateFromAsn1=function($,J){var X={},Q=[];if(!z.validate($,_V,X,Q)){var Y=Error("Cannot read X.509 certificate. ASN.1 object is not an X509v3 Certificate.");throw Y.errors=Q,Y}var G=z.derToOid(X.publicKeyOid);if(G!==g.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=g.createCertificate();W.version=X.certVersion?X.certVersion.charCodeAt(0):0;var U=X$.util.createBuffer(X.certSerialNumber);W.serialNumber=U.toHex(),W.signatureOid=X$.asn1.derToOid(X.certSignatureOid),W.signatureParameters=hY(W.signatureOid,X.certSignatureParams,!0),W.siginfo.algorithmOid=X$.asn1.derToOid(X.certinfoSignatureOid),W.siginfo.parameters=hY(W.siginfo.algorithmOid,X.certinfoSignatureParams,!1),W.signature=X.certSignature;var M=[];if(X.certValidity1UTCTime!==void 0)M.push(z.utcTimeToDate(X.certValidity1UTCTime));if(X.certValidity2GeneralizedTime!==void 0)M.push(z.generalizedTimeToDate(X.certValidity2GeneralizedTime));if(X.certValidity3UTCTime!==void 0)M.push(z.utcTimeToDate(X.certValidity3UTCTime));if(X.certValidity4GeneralizedTime!==void 0)M.push(z.generalizedTimeToDate(X.certValidity4GeneralizedTime));if(M.length>2)throw Error("Cannot read notBefore/notAfter validity times; more than two times were provided in the certificate.");if(M.length<2)throw Error("Cannot read notBefore/notAfter validity times; they were not provided as either UTCTime or GeneralizedTime.");if(W.validity.notBefore=M[0],W.validity.notAfter=M[1],W.tbsCertificate=X.tbsCertificate,J){W.md=uY({signatureOid:W.signatureOid,type:"certificate"});var O=z.toDer(W.tbsCertificate);W.md.update(O.getBytes())}var V=X$.md.sha1.create(),q=z.toDer(X.certIssuer);if(V.update(q.getBytes()),W.issuer.getField=function(K){return k0(W.issuer,K)},W.issuer.addField=function(K){kJ([K]),W.issuer.attributes.push(K)},W.issuer.attributes=g.RDNAttributesAsArray(X.certIssuer),X.certIssuerUniqueId)W.issuer.uniqueId=X.certIssuerUniqueId;W.issuer.hash=V.digest().toHex();var H=X$.md.sha1.create(),N=z.toDer(X.certSubject);if(H.update(N.getBytes()),W.subject.getField=function(K){return k0(W.subject,K)},W.subject.addField=function(K){kJ([K]),W.subject.attributes.push(K)},W.subject.attributes=g.RDNAttributesAsArray(X.certSubject),X.certSubjectUniqueId)W.subject.uniqueId=X.certSubjectUniqueId;if(W.subject.hash=H.digest().toHex(),X.certExtensions)W.extensions=g.certificateExtensionsFromAsn1(X.certExtensions);else W.extensions=[];return W.publicKey=g.publicKeyFromAsn1(X.subjectPublicKeyInfo),W};g.certificateExtensionsFromAsn1=function($){var J=[];for(var X=0;X<$.value.length;++X){var Q=$.value[X];for(var Y=0;Y<Q.value.length;++Y)J.push(g.certificateExtensionFromAsn1(Q.value[Y]))}return J};g.certificateExtensionFromAsn1=function($){var J={};if(J.id=z.derToOid($.value[0].value),J.critical=!1,$.value[1].type===z.Type.BOOLEAN)J.critical=$.value[1].value.charCodeAt(0)!==0,J.value=$.value[2].value;else J.value=$.value[1].value;if(J.id in w$){if(J.name=w$[J.id],J.name==="keyUsage"){var X=z.fromDer(J.value),Q=0,Y=0;if(X.value.length>1)Q=X.value.charCodeAt(1),Y=X.value.length>2?X.value.charCodeAt(2):0;J.digitalSignature=(Q&128)===128,J.nonRepudiation=(Q&64)===64,J.keyEncipherment=(Q&32)===32,J.dataEncipherment=(Q&16)===16,J.keyAgreement=(Q&8)===8,J.keyCertSign=(Q&4)===4,J.cRLSign=(Q&2)===2,J.encipherOnly=(Q&1)===1,J.decipherOnly=(Y&128)===128}else if(J.name==="basicConstraints"){var X=z.fromDer(J.value);if(X.value.length>0&&X.value[0].type===z.Type.BOOLEAN)J.cA=X.value[0].value.charCodeAt(0)!==0;else J.cA=!1;var G=null;if(X.value.length>0&&X.value[0].type===z.Type.INTEGER)G=X.value[0].value;else if(X.value.length>1)G=X.value[1].value;if(G!==null)J.pathLenConstraint=z.derToInteger(G)}else if(J.name==="extKeyUsage"){var X=z.fromDer(J.value);for(var W=0;W<X.value.length;++W){var U=z.derToOid(X.value[W].value);if(U in w$)J[w$[U]]=!0;else J[U]=!0}}else if(J.name==="nsCertType"){var X=z.fromDer(J.value),Q=0;if(X.value.length>1)Q=X.value.charCodeAt(1);J.client=(Q&128)===128,J.server=(Q&64)===64,J.email=(Q&32)===32,J.objsign=(Q&16)===16,J.reserved=(Q&8)===8,J.sslCA=(Q&4)===4,J.emailCA=(Q&2)===2,J.objCA=(Q&1)===1}else if(J.name==="subjectAltName"||J.name==="issuerAltName"){J.altNames=[];var M,X=z.fromDer(J.value);for(var O=0;O<X.value.length;++O){M=X.value[O];var V={type:M.type,value:M.value};switch(J.altNames.push(V),M.type){case 1:case 2:case 6:break;case 7:V.ip=X$.util.bytesToIP(M.value);break;case 8:V.oid=z.derToOid(M.value);break;default:}}}else if(J.name==="subjectKeyIdentifier"){var X=z.fromDer(J.value);J.subjectKeyIdentifier=X$.util.bytesToHex(X.value)}}return J};g.certificationRequestFromAsn1=function($,J){var X={},Q=[];if(!z.validate($,kV,X,Q)){var Y=Error("Cannot read PKCS#10 certificate request. ASN.1 object is not a PKCS#10 CertificationRequest.");throw Y.errors=Q,Y}var G=z.derToOid(X.publicKeyOid);if(G!==g.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=g.createCertificationRequest();if(W.version=X.csrVersion?X.csrVersion.charCodeAt(0):0,W.signatureOid=X$.asn1.derToOid(X.csrSignatureOid),W.signatureParameters=hY(W.signatureOid,X.csrSignatureParams,!0),W.siginfo.algorithmOid=X$.asn1.derToOid(X.csrSignatureOid),W.siginfo.parameters=hY(W.siginfo.algorithmOid,X.csrSignatureParams,!1),W.signature=X.csrSignature,W.certificationRequestInfo=X.certificationRequestInfo,J){W.md=uY({signatureOid:W.signatureOid,type:"certification request"});var U=z.toDer(W.certificationRequestInfo);W.md.update(U.getBytes())}var M=X$.md.sha1.create();return W.subject.getField=function(O){return k0(W.subject,O)},W.subject.addField=function(O){kJ([O]),W.subject.attributes.push(O)},W.subject.attributes=g.RDNAttributesAsArray(X.certificationRequestInfoSubject,M),W.subject.hash=M.digest().toHex(),W.publicKey=g.publicKeyFromAsn1(X.subjectPublicKeyInfo),W.getAttribute=function(O){return k0(W,O)},W.addAttribute=function(O){kJ([O]),W.attributes.push(O)},W.attributes=g.CRIAttributesAsArray(X.certificationRequestInfoAttributes||[]),W};g.createCertificationRequest=function(){var $={};return $.version=0,$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.subject={},$.subject.getField=function(J){return k0($.subject,J)},$.subject.addField=function(J){kJ([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.publicKey=null,$.attributes=[],$.getAttribute=function(J){return k0($,J)},$.addAttribute=function(J){kJ([J]),$.attributes.push(J)},$.md=null,$.setSubject=function(J){kJ(J),$.subject.attributes=J,$.subject.hash=null},$.setAttributes=function(J){kJ(J),$.attributes=J},$.sign=function(J,X){$.md=X||X$.md.sha1.create();var Q=w$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certification request digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.certificationRequestInfo=g.getCertificationRequestInfo($);var G=z.toDer($.certificationRequestInfo);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(){var J=!1,X=$.md;if(X===null){X=uY({signatureOid:$.signatureOid,type:"certification request"});var Q=$.certificationRequestInfo||g.getCertificationRequestInfo($),Y=z.toDer(Q);X.update(Y.getBytes())}if(X!==null)J=g1({certificate:$,md:X,signature:$.signature});return J},$};function xQ($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),X,Q,Y=$.attributes;for(var G=0;G<Y.length;++G){X=Y[G];var W=X.value,U=z.Type.PRINTABLESTRING;if("valueTagClass"in X){if(U=X.valueTagClass,U===z.Type.UTF8)W=X$.util.encodeUtf8(W)}Q=z.create(z.Class.UNIVERSAL,z.Type.SET,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(X.type).getBytes()),z.create(z.Class.UNIVERSAL,U,!1,W)])]),J.value.push(Q)}return J}function kJ($){var J;for(var X=0;X<$.length;++X){if(J=$[X],typeof J.name>"u"){if(J.type&&J.type in g.oids)J.name=g.oids[J.type];else if(J.shortName&&J.shortName in r$)J.name=g.oids[r$[J.shortName]]}if(typeof J.type>"u")if(J.name&&J.name in g.oids)J.type=g.oids[J.name];else{var Q=Error("Attribute type not specified.");throw Q.attribute=J,Q}if(typeof J.shortName>"u"){if(J.name&&J.name in r$)J.shortName=r$[J.name]}if(J.type===w$.extensionRequest){if(J.valueConstructed=!0,J.valueTagClass=z.Type.SEQUENCE,!J.value&&J.extensions){J.value=[];for(var Y=0;Y<J.extensions.length;++Y)J.value.push(g.certificateExtensionToAsn1(m1(J.extensions[Y])))}}if(typeof J.value>"u"){var Q=Error("Attribute value not specified.");throw Q.attribute=J,Q}}}function m1($,J){if(J=J||{},typeof $.name>"u"){if($.id&&$.id in g.oids)$.name=g.oids[$.id]}if(typeof $.id>"u")if($.name&&$.name in g.oids)$.id=g.oids[$.name];else{var X=Error("Extension ID not specified.");throw X.extension=$,X}if(typeof $.value<"u")return $;if($.name==="keyUsage"){var Q=0,Y=0,G=0;if($.digitalSignature)Y|=128,Q=7;if($.nonRepudiation)Y|=64,Q=6;if($.keyEncipherment)Y|=32,Q=5;if($.dataEncipherment)Y|=16,Q=4;if($.keyAgreement)Y|=8,Q=3;if($.keyCertSign)Y|=4,Q=2;if($.cRLSign)Y|=2,Q=1;if($.encipherOnly)Y|=1,Q=0;if($.decipherOnly)G|=128,Q=7;var W=String.fromCharCode(Q);if(G!==0)W+=String.fromCharCode(Y)+String.fromCharCode(G);else if(Y!==0)W+=String.fromCharCode(Y);$.value=z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,W)}else if($.name==="basicConstraints"){if($.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),$.cA)$.value.value.push(z.create(z.Class.UNIVERSAL,z.Type.BOOLEAN,!1,String.fromCharCode(255)));if("pathLenConstraint"in $)$.value.value.push(z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.pathLenConstraint).getBytes()))}else if($.name==="extKeyUsage"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value;for(var M in $){if($[M]!==!0)continue;if(M in w$)U.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(w$[M]).getBytes()));else if(M.indexOf(".")!==-1)U.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(M).getBytes()))}}else if($.name==="nsCertType"){var Q=0,Y=0;if($.client)Y|=128,Q=7;if($.server)Y|=64,Q=6;if($.email)Y|=32,Q=5;if($.objsign)Y|=16,Q=4;if($.reserved)Y|=8,Q=3;if($.sslCA)Y|=4,Q=2;if($.emailCA)Y|=2,Q=1;if($.objCA)Y|=1,Q=0;var W=String.fromCharCode(Q);if(Y!==0)W+=String.fromCharCode(Y);$.value=z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,W)}else if($.name==="subjectAltName"||$.name==="issuerAltName"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var O;for(var V=0;V<$.altNames.length;++V){O=$.altNames[V];var W=O.value;if(O.type===7&&O.ip){if(W=X$.util.bytesFromIP(O.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(O.type===8)if(O.oid)W=z.oidToDer(z.oidToDer(O.oid));else W=z.oidToDer(W);$.value.value.push(z.create(z.Class.CONTEXT_SPECIFIC,O.type,!1,W))}}else if($.name==="nsComment"&&J.cert){if(!/^[\x00-\x7F]*$/.test($.comment)||$.comment.length<1||$.comment.length>128)throw Error('Invalid "nsComment" content.');$.value=z.create(z.Class.UNIVERSAL,z.Type.IA5STRING,!1,$.comment)}else if($.name==="subjectKeyIdentifier"&&J.cert){var q=J.cert.generateSubjectKeyIdentifier();$.subjectKeyIdentifier=q.toHex(),$.value=z.create(z.Class.UNIVERSAL,z.Type.OCTETSTRING,!1,q.getBytes())}else if($.name==="authorityKeyIdentifier"&&J.cert){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value;if($.keyIdentifier){var H=$.keyIdentifier===!0?J.cert.generateSubjectKeyIdentifier().getBytes():$.keyIdentifier;U.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!1,H))}if($.authorityCertIssuer){var N=[z.create(z.Class.CONTEXT_SPECIFIC,4,!0,[xQ($.authorityCertIssuer===!0?J.cert.issuer:$.authorityCertIssuer)])];U.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,N))}if($.serialNumber){var K=X$.util.hexToBytes($.serialNumber===!0?J.cert.serialNumber:$.serialNumber);U.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!1,K))}}else if($.name==="cRLDistributionPoints"){$.value=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);var U=$.value.value,L=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]),A=z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[]),O;for(var V=0;V<$.altNames.length;++V){O=$.altNames[V];var W=O.value;if(O.type===7&&O.ip){if(W=X$.util.bytesFromIP(O.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(O.type===8)if(O.oid)W=z.oidToDer(z.oidToDer(O.oid));else W=z.oidToDer(W);A.value.push(z.create(z.Class.CONTEXT_SPECIFIC,O.type,!1,W))}L.value.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[A])),U.push(L)}if(typeof $.value>"u"){var X=Error("Extension value not specified.");throw X.extension=$,X}return $}function Z8($,J){switch($){case w$["RSASSA-PSS"]:var X=[];if(J.hash.algorithmOid!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.hash.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")])]));if(J.mgf.algorithmOid!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,[z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.mgf.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(J.mgf.hash.algorithmOid).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")])])]));if(J.saltLength!==void 0)X.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer(J.saltLength).getBytes())]));return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,X);default:return z.create(z.Class.UNIVERSAL,z.Type.NULL,!1,"")}}function fV($){var J=z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[]);if($.attributes.length===0)return J;var X=$.attributes;for(var Q=0;Q<X.length;++Q){var Y=X[Q],G=Y.value,W=z.Type.UTF8;if("valueTagClass"in Y)W=Y.valueTagClass;if(W===z.Type.UTF8)G=X$.util.encodeUtf8(G);var U=!1;if("valueConstructed"in Y)U=Y.valueConstructed;var M=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer(Y.type).getBytes()),z.create(z.Class.UNIVERSAL,z.Type.SET,!0,[z.create(z.Class.UNIVERSAL,W,U,G)])]);J.value.push(M)}return J}var yV=new Date("1950-01-01T00:00:00Z"),bV=new Date("2050-01-01T00:00:00Z");function h1($){if($>=yV&&$<bV)return z.create(z.Class.UNIVERSAL,z.Type.UTCTIME,!1,z.dateToUtcTime($));else return z.create(z.Class.UNIVERSAL,z.Type.GENERALIZEDTIME,!1,z.dateToGeneralizedTime($))}g.getTBSCertificate=function($){var J=h1($.validity.notBefore),X=h1($.validity.notAfter),Q=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.CONTEXT_SPECIFIC,0,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.version).getBytes())]),z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,X$.util.hexToBytes($.serialNumber)),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.siginfo.algorithmOid).getBytes()),Z8($.siginfo.algorithmOid,$.siginfo.parameters)]),xQ($.issuer),z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,X]),xQ($.subject),g.publicKeyToAsn1($.publicKey)]);if($.issuer.uniqueId)Q.value.push(z.create(z.Class.CONTEXT_SPECIFIC,1,!0,[z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.issuer.uniqueId)]));if($.subject.uniqueId)Q.value.push(z.create(z.Class.CONTEXT_SPECIFIC,2,!0,[z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.subject.uniqueId)]));if($.extensions.length>0)Q.value.push(g.certificateExtensionsToAsn1($.extensions));return Q};g.getCertificationRequestInfo=function($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.INTEGER,!1,z.integerToDer($.version).getBytes()),xQ($.subject),g.publicKeyToAsn1($.publicKey),fV($)]);return J};g.distinguishedNameToAsn1=function($){return xQ($)};g.certificateToAsn1=function($){var J=$.tbsCertificate||g.getTBSCertificate($);return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.signatureOid).getBytes()),Z8($.signatureOid,$.signatureParameters)]),z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};g.certificateExtensionsToAsn1=function($){var J=z.create(z.Class.CONTEXT_SPECIFIC,3,!0,[]),X=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);J.value.push(X);for(var Q=0;Q<$.length;++Q)X.value.push(g.certificateExtensionToAsn1($[Q]));return J};g.certificateExtensionToAsn1=function($){var J=z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[]);if(J.value.push(z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.id).getBytes())),$.critical)J.value.push(z.create(z.Class.UNIVERSAL,z.Type.BOOLEAN,!1,String.fromCharCode(255)));var X=$.value;if(typeof $.value!=="string")X=z.toDer(X).getBytes();return J.value.push(z.create(z.Class.UNIVERSAL,z.Type.OCTETSTRING,!1,X)),J};g.certificationRequestToAsn1=function($){var J=$.certificationRequestInfo||g.getCertificationRequestInfo($);return z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[J,z.create(z.Class.UNIVERSAL,z.Type.SEQUENCE,!0,[z.create(z.Class.UNIVERSAL,z.Type.OID,!1,z.oidToDer($.signatureOid).getBytes()),Z8($.signatureOid,$.signatureParameters)]),z.create(z.Class.UNIVERSAL,z.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};g.createCaStore=function($){var J={certs:{}};J.getIssuer=function(W){var U=X(W.issuer);return U},J.addCertificate=function(W){if(typeof W==="string")W=X$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))if(W.subject.hash in J.certs){var U=J.certs[W.subject.hash];if(!X$.util.isArray(U))U=[U];U.push(W),J.certs[W.subject.hash]=U}else J.certs[W.subject.hash]=W},J.hasCertificate=function(W){if(typeof W==="string")W=X$.pki.certificateFromPem(W);var U=X(W.subject);if(!U)return!1;if(!X$.util.isArray(U))U=[U];var M=z.toDer(g.certificateToAsn1(W)).getBytes();for(var O=0;O<U.length;++O){var V=z.toDer(g.certificateToAsn1(U[O])).getBytes();if(M===V)return!0}return!1},J.listAllCertificates=function(){var W=[];for(var U in J.certs)if(J.certs.hasOwnProperty(U)){var M=J.certs[U];if(!X$.util.isArray(M))W.push(M);else for(var O=0;O<M.length;++O)W.push(M[O])}return W},J.removeCertificate=function(W){var U;if(typeof W==="string")W=X$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))return null;var M=X(W.subject);if(!X$.util.isArray(M))return U=J.certs[W.subject.hash],delete J.certs[W.subject.hash],U;var O=z.toDer(g.certificateToAsn1(W)).getBytes();for(var V=0;V<M.length;++V){var q=z.toDer(g.certificateToAsn1(M[V])).getBytes();if(O===q)U=M[V],M.splice(V,1)}if(M.length===0)delete J.certs[W.subject.hash];return U};function X(W){return Q(W),J.certs[W.hash]||null}function Q(W){if(!W.hash){var U=X$.md.sha1.create();W.attributes=g.RDNAttributesAsArray(xQ(W),U),W.hash=U.digest().toHex()}}if($)for(var Y=0;Y<$.length;++Y){var G=$[Y];J.addCertificate(G)}return J};g.certificateError={bad_certificate:"forge.pki.BadCertificate",unsupported_certificate:"forge.pki.UnsupportedCertificate",certificate_revoked:"forge.pki.CertificateRevoked",certificate_expired:"forge.pki.CertificateExpired",certificate_unknown:"forge.pki.CertificateUnknown",unknown_ca:"forge.pki.UnknownCertificateAuthority"};g.verifyCertificateChain=function($,J,X){if(typeof X==="function")X={verify:X};X=X||{},J=J.slice(0);var Q=J.slice(0),Y=X.validityCheckDate;if(typeof Y>"u")Y=new Date;var G=!0,W=null,U=0;do{var M=J.shift(),O=null,V=!1;if(Y){if(Y<M.validity.notBefore||Y>M.validity.notAfter)W={message:"Certificate is not valid yet or has expired.",error:g.certificateError.certificate_expired,notBefore:M.validity.notBefore,notAfter:M.validity.notAfter,now:Y}}if(W===null){if(O=J[0]||$.getIssuer(M),O===null){if(M.isIssuer(M))V=!0,O=M}if(O){var q=O;if(!X$.util.isArray(q))q=[q];var H=!1;while(!H&&q.length>0){O=q.shift();try{H=O.verify(M)}catch(w){}}if(!H)W={message:"Certificate signature is invalid.",error:g.certificateError.bad_certificate}}if(W===null&&(!O||V)&&!$.hasCertificate(M))W={message:"Certificate is not trusted.",error:g.certificateError.unknown_ca}}if(W===null&&O&&!M.isIssuer(O))W={message:"Certificate issuer is invalid.",error:g.certificateError.bad_certificate};if(W===null){var N={keyUsage:!0,basicConstraints:!0};for(var K=0;W===null&&K<M.extensions.length;++K){var L=M.extensions[K];if(L.critical&&!(L.name in N))W={message:"Certificate has an unsupported critical extension.",error:g.certificateError.unsupported_certificate}}}if(W===null&&(!G||J.length===0&&(!O||V))){var A=M.getExtension("basicConstraints"),D=M.getExtension("keyUsage");if(D!==null){if(!D.keyCertSign||A===null)W={message:"Certificate keyUsage or basicConstraints conflict or indicate that the certificate is not a CA. If the certificate is the only one in the chain or isn't the first then the certificate must be a valid CA.",error:g.certificateError.bad_certificate}}if(W===null&&A===null)W={message:"Certificate is missing basicConstraints extension and cannot be used as a CA.",error:g.certificateError.bad_certificate};if(W===null&&A!==null&&!A.cA)W={message:"Certificate basicConstraints indicates the certificate is not a CA.",error:g.certificateError.bad_certificate};if(W===null&&D!==null&&"pathLenConstraint"in A){var S=U-1;if(S>A.pathLenConstraint)W={message:"Certificate basicConstraints pathLenConstraint violated.",error:g.certificateError.bad_certificate}}}var B=W===null?!0:W.error,C=X.verify?X.verify(B,U,Q):B;if(C===!0)W=null;else{if(B===!0)W={message:"The application rejected the certificate.",error:g.certificateError.bad_certificate};if(C||C===0){if(typeof C==="object"&&!X$.util.isArray(C)){if(C.message)W.message=C.message;if(C.error)W.error=C.error}else if(typeof C==="string")W.error=C}throw W}G=!1,++U}while(J.length>0);return!0}});var j8=q$((lF,d1)=>{var l$=F$();mJ();TQ();_0();R8();A8();_J();SX();wQ();_$();gY();var{asn1:R,pki:D$}=l$,CX=d1.exports=l$.pkcs12=l$.pkcs12||{},p1={name:"ContentInfo",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.contentType",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:R.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"content"}]},hV={name:"PFX",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.version",tagClass:R.Class.UNIVERSAL,type:R.Type.INTEGER,constructed:!1,capture:"version"},p1,{name:"PFX.macData",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"mac",value:[{name:"PFX.macData.mac",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm.algorithm",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"macAlgorithm"},{name:"PFX.macData.mac.digestAlgorithm.parameters",optional:!0,tagClass:R.Class.UNIVERSAL,captureAsn1:"macAlgorithmParameters"}]},{name:"PFX.macData.mac.digest",tagClass:R.Class.UNIVERSAL,type:R.Type.OCTETSTRING,constructed:!1,capture:"macDigest"}]},{name:"PFX.macData.macSalt",tagClass:R.Class.UNIVERSAL,type:R.Type.OCTETSTRING,constructed:!1,capture:"macSalt"},{name:"PFX.macData.iterations",tagClass:R.Class.UNIVERSAL,type:R.Type.INTEGER,constructed:!1,optional:!0,capture:"macIterations"}]}]},uV={name:"SafeBag",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"SafeBag.bagId",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"bagId"},{name:"SafeBag.bagValue",tagClass:R.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"bagValue"},{name:"SafeBag.bagAttributes",tagClass:R.Class.UNIVERSAL,type:R.Type.SET,constructed:!0,optional:!0,capture:"bagAttributes"}]},gV={name:"Attribute",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"Attribute.attrId",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"oid"},{name:"Attribute.attrValues",tagClass:R.Class.UNIVERSAL,type:R.Type.SET,constructed:!0,capture:"values"}]},mV={name:"CertBag",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"CertBag.certId",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"certId"},{name:"CertBag.certValue",tagClass:R.Class.CONTEXT_SPECIFIC,constructed:!0,value:[{name:"CertBag.certValue[0]",tagClass:R.Class.UNIVERSAL,type:R.Class.OCTETSTRING,constructed:!1,capture:"cert"}]}]};function IX($,J,X,Q){var Y=[];for(var G=0;G<$.length;G++)for(var W=0;W<$[G].safeBags.length;W++){var U=$[G].safeBags[W];if(Q!==void 0&&U.type!==Q)continue;if(J===null){Y.push(U);continue}if(U.attributes[J]!==void 0&&U.attributes[J].indexOf(X)>=0)Y.push(U)}return Y}CX.pkcs12FromAsn1=function($,J,X){if(typeof J==="string")X=J,J=!0;else if(J===void 0)J=!0;var Q={},Y=[];if(!R.validate($,hV,Q,Y)){var G=Error("Cannot read PKCS#12 PFX. ASN.1 object is not an PKCS#12 PFX.");throw G.errors=G,G}var W={version:Q.version.charCodeAt(0),safeContents:[],getBags:function(A){var D={},S;if("localKeyId"in A)S=A.localKeyId;else if("localKeyIdHex"in A)S=l$.util.hexToBytes(A.localKeyIdHex);if(S===void 0&&!("friendlyName"in A)&&"bagType"in A)D[A.bagType]=IX(W.safeContents,null,null,A.bagType);if(S!==void 0)D.localKeyId=IX(W.safeContents,"localKeyId",S,A.bagType);if("friendlyName"in A)D.friendlyName=IX(W.safeContents,"friendlyName",A.friendlyName,A.bagType);return D},getBagsByFriendlyName:function(A,D){return IX(W.safeContents,"friendlyName",A,D)},getBagsByLocalKeyId:function(A,D){return IX(W.safeContents,"localKeyId",A,D)}};if(Q.version.charCodeAt(0)!==3){var G=Error("PKCS#12 PFX of version other than 3 not supported.");throw G.version=Q.version.charCodeAt(0),G}if(R.derToOid(Q.contentType)!==D$.oids.data){var G=Error("Only PKCS#12 PFX in password integrity mode supported.");throw G.oid=R.derToOid(Q.contentType),G}var U=Q.content.value[0];if(U.tagClass!==R.Class.UNIVERSAL||U.type!==R.Type.OCTETSTRING)throw Error("PKCS#12 authSafe content data is not an OCTET STRING.");if(U=B8(U),Q.mac){var M=null,O=0,V=R.derToOid(Q.macAlgorithm);switch(V){case D$.oids.sha1:M=l$.md.sha1.create(),O=20;break;case D$.oids.sha256:M=l$.md.sha256.create(),O=32;break;case D$.oids.sha384:M=l$.md.sha384.create(),O=48;break;case D$.oids.sha512:M=l$.md.sha512.create(),O=64;break;case D$.oids.md5:M=l$.md.md5.create(),O=16;break}if(M===null)throw Error("PKCS#12 uses unsupported MAC algorithm: "+V);var q=new l$.util.ByteBuffer(Q.macSalt),H="macIterations"in Q?parseInt(l$.util.bytesToHex(Q.macIterations),16):1,N=CX.generateKey(X,q,3,H,O,M),K=l$.hmac.create();K.start(M,N),K.update(U.value);var L=K.getMac();if(L.getBytes()!==Q.macDigest)throw Error("PKCS#12 MAC could not be verified. Invalid password?")}else if(Array.isArray($.value)&&$.value.length>2)throw Error("Invalid PKCS#12. macData field present but MAC was not validated.");return lV(W,U.value,J,X),W};function B8($){if($.composed||$.constructed){var J=l$.util.createBuffer();for(var X=0;X<$.value.length;++X)J.putBytes($.value[X].value);$.composed=$.constructed=!1,$.value=J.getBytes()}return $}function lV($,J,X,Q){if(J=R.fromDer(J,X),J.tagClass!==R.Class.UNIVERSAL||J.type!==R.Type.SEQUENCE||J.constructed!==!0)throw Error("PKCS#12 AuthenticatedSafe expected to be a SEQUENCE OF ContentInfo");for(var Y=0;Y<J.value.length;Y++){var G=J.value[Y],W={},U=[];if(!R.validate(G,p1,W,U)){var M=Error("Cannot read ContentInfo.");throw M.errors=U,M}var O={encrypted:!1},V=null,q=W.content.value[0];switch(R.derToOid(W.contentType)){case D$.oids.data:if(q.tagClass!==R.Class.UNIVERSAL||q.type!==R.Type.OCTETSTRING)throw Error("PKCS#12 SafeContents Data is not an OCTET STRING.");V=B8(q).value;break;case D$.oids.encryptedData:V=pV(q,Q),O.encrypted=!0;break;default:var M=Error("Unsupported PKCS#12 contentType.");throw M.contentType=R.derToOid(W.contentType),M}O.safeBags=dV(V,X,Q),$.safeContents.push(O)}}function pV($,J){var X={},Q=[];if(!R.validate($,l$.pkcs7.asn1.encryptedDataValidator,X,Q)){var Y=Error("Cannot read EncryptedContentInfo.");throw Y.errors=Q,Y}var G=R.derToOid(X.contentType);if(G!==D$.oids.data){var Y=Error("PKCS#12 EncryptedContentInfo ContentType is not Data.");throw Y.oid=G,Y}G=R.derToOid(X.encAlgorithm);var W=D$.pbe.getCipher(G,X.encParameter,J),U=B8(X.encryptedContentAsn1),M=l$.util.createBuffer(U.value);if(W.update(M),!W.finish())throw Error("Failed to decrypt PKCS#12 SafeContents.");return W.output.getBytes()}function dV($,J,X){if(!J&&$.length===0)return[];if($=R.fromDer($,J),$.tagClass!==R.Class.UNIVERSAL||$.type!==R.Type.SEQUENCE||$.constructed!==!0)throw Error("PKCS#12 SafeContents expected to be a SEQUENCE OF SafeBag.");var Q=[];for(var Y=0;Y<$.value.length;Y++){var G=$.value[Y],W={},U=[];if(!R.validate(G,uV,W,U)){var M=Error("Cannot read SafeBag.");throw M.errors=U,M}var O={type:R.derToOid(W.bagId),attributes:cV(W.bagAttributes)};Q.push(O);var V,q,H=W.bagValue.value[0];switch(O.type){case D$.oids.pkcs8ShroudedKeyBag:if(H=D$.decryptPrivateKeyInfo(H,X),H===null)throw Error("Unable to decrypt PKCS#8 ShroudedKeyBag, wrong password?");case D$.oids.keyBag:try{O.key=D$.privateKeyFromAsn1(H)}catch(K){O.key=null,O.asn1=H}continue;case D$.oids.certBag:V=mV,q=function(){if(R.derToOid(W.certId)!==D$.oids.x509Certificate){var K=Error("Unsupported certificate type, only X.509 supported.");throw K.oid=R.derToOid(W.certId),K}var L=R.fromDer(W.cert,J);try{O.cert=D$.certificateFromAsn1(L,!0)}catch(A){O.cert=null,O.asn1=L}};break;default:var M=Error("Unsupported PKCS#12 SafeBag type.");throw M.oid=O.type,M}if(V!==void 0&&!R.validate(H,V,W,U)){var M=Error("Cannot read PKCS#12 "+V.name);throw M.errors=U,M}q()}return Q}function cV($){var J={};if($!==void 0)for(var X=0;X<$.length;++X){var Q={},Y=[];if(!R.validate($[X],gV,Q,Y)){var G=Error("Cannot read PKCS#12 BagAttribute.");throw G.errors=Y,G}var W=R.derToOid(Q.oid);if(D$.oids[W]===void 0)continue;J[D$.oids[W]]=[];for(var U=0;U<Q.values.length;++U)J[D$.oids[W]].push(Q.values[U].value)}return J}CX.toPkcs12Asn1=function($,J,X,Q){if(Q=Q||{},Q.saltSize=Q.saltSize||8,Q.count=Q.count||2048,Q.algorithm=Q.algorithm||Q.encAlgorithm||"aes128",!("useMac"in Q))Q.useMac=!0;if(!("localKeyId"in Q))Q.localKeyId=null;if(!("generateLocalKeyId"in Q))Q.generateLocalKeyId=!0;var Y=Q.localKeyId,G;if(Y!==null)Y=l$.util.hexToBytes(Y);else if(Q.generateLocalKeyId)if(J){var W=l$.util.isArray(J)?J[0]:J;if(typeof W==="string")W=D$.certificateFromPem(W);var U=l$.md.sha1.create();U.update(R.toDer(D$.certificateToAsn1(W)).getBytes()),Y=U.digest().getBytes()}else Y=l$.random.getBytes(20);var M=[];if(Y!==null)M.push(R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.localKeyId).getBytes()),R.create(R.Class.UNIVERSAL,R.Type.SET,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,Y)])]));if("friendlyName"in Q)M.push(R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.friendlyName).getBytes()),R.create(R.Class.UNIVERSAL,R.Type.SET,!0,[R.create(R.Class.UNIVERSAL,R.Type.BMPSTRING,!1,Q.friendlyName)])]));if(M.length>0)G=R.create(R.Class.UNIVERSAL,R.Type.SET,!0,M);var O=[],V=[];if(J!==null)if(l$.util.isArray(J))V=J;else V=[J];var q=[];for(var H=0;H<V.length;++H){if(J=V[H],typeof J==="string")J=D$.certificateFromPem(J);var N=H===0?G:void 0,K=D$.certificateToAsn1(J),L=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.certBag).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.x509Certificate).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,R.toDer(K).getBytes())])])]),N]);q.push(L)}if(q.length>0){var A=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,q),D=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.data).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,R.toDer(A).getBytes())])]);O.push(D)}var S=null;if($!==null){var B=D$.wrapRsaPrivateKey(D$.privateKeyToAsn1($));if(X===null)S=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.keyBag).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[B]),G]);else S=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.pkcs8ShroudedKeyBag).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[D$.encryptPrivateKeyInfo(B,X,Q)]),G]);var C=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[S]),w=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.data).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,R.toDer(C).getBytes())])]);O.push(w)}var P=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,O),l;if(Q.useMac){var U=l$.md.sha1.create(),e=new l$.util.ByteBuffer(l$.random.getBytes(Q.saltSize)),y=Q.count,$=CX.generateKey(X,e,3,y,20),n=l$.hmac.create();n.start(U,$),n.update(R.toDer(P).getBytes());var Y$=n.getMac();l=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.sha1).getBytes()),R.create(R.Class.UNIVERSAL,R.Type.NULL,!1,"")]),R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,Y$.getBytes())]),R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,e.getBytes()),R.create(R.Class.UNIVERSAL,R.Type.INTEGER,!1,R.integerToDer(y).getBytes())])}return R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.INTEGER,!1,R.integerToDer(3).getBytes()),R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(D$.oids.data).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,R.toDer(P).getBytes())])]),l])};CX.generateKey=l$.pbe.generatePkcs12Key});var S8=q$((pF,c1)=>{var f0=F$();mJ();_0();A8();QQ();PY();j8();bY();SX();_$();gY();var T8=f0.asn1,vQ=c1.exports=f0.pki=f0.pki||{};vQ.pemToDer=function($){var J=f0.pem.decode($)[0];if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PEM to DER; PEM is encrypted.");return f0.util.createBuffer(J.body)};vQ.privateKeyFromPem=function($){var J=f0.pem.decode($)[0];if(J.type!=="PRIVATE KEY"&&J.type!=="RSA PRIVATE KEY"){var X=Error('Could not convert private key from PEM; PEM header type is not "PRIVATE KEY" or "RSA PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert private key from PEM; PEM is encrypted.");var Q=T8.fromDer(J.body);return vQ.privateKeyFromAsn1(Q)};vQ.privateKeyToPem=function($,J){var X={type:"RSA PRIVATE KEY",body:T8.toDer(vQ.privateKeyToAsn1($)).getBytes()};return f0.pem.encode(X,{maxline:J})};vQ.privateKeyInfoToPem=function($,J){var X={type:"PRIVATE KEY",body:T8.toDer($).getBytes()};return f0.pem.encode(X,{maxline:J})}});var x8=q$((dF,e1)=>{var f=F$();mJ();TQ();SY();QQ();S8();_J();wQ();_$();var pY=function($,J,X,Q){var Y=f.util.createBuffer(),G=$.length>>1,W=G+($.length&1),U=$.substr(0,W),M=$.substr(G,W),O=f.util.createBuffer(),V=f.hmac.create();X=J+X;var q=Math.ceil(Q/16),H=Math.ceil(Q/20);V.start("MD5",U);var N=f.util.createBuffer();O.putBytes(X);for(var K=0;K<q;++K)V.start(null,null),V.update(O.getBytes()),O.putBuffer(V.digest()),V.start(null,null),V.update(O.bytes()+X),N.putBuffer(V.digest());V.start("SHA1",M);var L=f.util.createBuffer();O.clear(),O.putBytes(X);for(var K=0;K<H;++K)V.start(null,null),V.update(O.getBytes()),O.putBuffer(V.digest()),V.start(null,null),V.update(O.bytes()+X),L.putBuffer(V.digest());return Y.putBytes(f.util.xorBytes(N.getBytes(),L.getBytes(),Q)),Y},nV=function($,J,X){var Q=f.hmac.create();Q.start("SHA1",$);var Y=f.util.createBuffer();return Y.putInt32(J[0]),Y.putInt32(J[1]),Y.putByte(X.type),Y.putByte(X.version.major),Y.putByte(X.version.minor),Y.putInt16(X.length),Y.putBytes(X.fragment.bytes()),Q.update(Y.getBytes()),Q.digest().getBytes()},iV=function($,J,X){var Q=!1;try{var Y=$.deflate(J.fragment.getBytes());J.fragment=f.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},oV=function($,J,X){var Q=!1;try{var Y=$.inflate(J.fragment.getBytes());J.fragment=f.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},SJ=function($,J){var X=0;switch(J){case 1:X=$.getByte();break;case 2:X=$.getInt16();break;case 3:X=$.getInt24();break;case 4:X=$.getInt32();break}return f.util.createBuffer($.getBytes(X))},fJ=function($,J,X){$.putInt(X.length(),J<<3),$.putBuffer(X)},F={};F.Versions={TLS_1_0:{major:3,minor:1},TLS_1_1:{major:3,minor:2},TLS_1_2:{major:3,minor:3}};F.SupportedVersions=[F.Versions.TLS_1_1,F.Versions.TLS_1_0];F.Version=F.SupportedVersions[0];F.MaxFragment=15360;F.ConnectionEnd={server:0,client:1};F.PRFAlgorithm={tls_prf_sha256:0};F.BulkCipherAlgorithm={none:null,rc4:0,des3:1,aes:2};F.CipherType={stream:0,block:1,aead:2};F.MACAlgorithm={none:null,hmac_md5:0,hmac_sha1:1,hmac_sha256:2,hmac_sha384:3,hmac_sha512:4};F.CompressionMethod={none:0,deflate:1};F.ContentType={change_cipher_spec:20,alert:21,handshake:22,application_data:23,heartbeat:24};F.HandshakeType={hello_request:0,client_hello:1,server_hello:2,certificate:11,server_key_exchange:12,certificate_request:13,server_hello_done:14,certificate_verify:15,client_key_exchange:16,finished:20};F.Alert={};F.Alert.Level={warning:1,fatal:2};F.Alert.Description={close_notify:0,unexpected_message:10,bad_record_mac:20,decryption_failed:21,record_overflow:22,decompression_failure:30,handshake_failure:40,bad_certificate:42,unsupported_certificate:43,certificate_revoked:44,certificate_expired:45,certificate_unknown:46,illegal_parameter:47,unknown_ca:48,access_denied:49,decode_error:50,decrypt_error:51,export_restriction:60,protocol_version:70,insufficient_security:71,internal_error:80,user_canceled:90,no_renegotiation:100};F.HeartbeatMessageType={heartbeat_request:1,heartbeat_response:2};F.CipherSuites={};F.getCipherSuite=function($){var J=null;for(var X in F.CipherSuites){var Q=F.CipherSuites[X];if(Q.id[0]===$.charCodeAt(0)&&Q.id[1]===$.charCodeAt(1)){J=Q;break}}return J};F.handleUnexpected=function($,J){var X=!$.open&&$.entity===F.ConnectionEnd.client;if(!X)$.error($,{message:"Unexpected message. Received TLS record out of order.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.unexpected_message}})};F.handleHelloRequest=function($,J,X){if(!$.handshaking&&$.handshakes>0)F.queue($,F.createAlert($,{level:F.Alert.Level.warning,description:F.Alert.Description.no_renegotiation})),F.flush($);$.process()};F.parseHelloMessage=function($,J,X){var Q=null,Y=$.entity===F.ConnectionEnd.client;if(X<38)$.error($,{message:Y?"Invalid ServerHello message. Message too short.":"Invalid ClientHello message. Message too short.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.illegal_parameter}});else{var G=J.fragment,W=G.length();if(Q={version:{major:G.getByte(),minor:G.getByte()},random:f.util.createBuffer(G.getBytes(32)),session_id:SJ(G,1),extensions:[]},Y)Q.cipher_suite=G.getBytes(2),Q.compression_method=G.getByte();else Q.cipher_suites=SJ(G,2),Q.compression_methods=SJ(G,1);if(W=X-(W-G.length()),W>0){var U=SJ(G,2);while(U.length()>0)Q.extensions.push({type:[U.getByte(),U.getByte()],data:SJ(U,2)});if(!Y)for(var M=0;M<Q.extensions.length;++M){var O=Q.extensions[M];if(O.type[0]===0&&O.type[1]===0){var V=SJ(O.data,2);while(V.length()>0){var q=V.getByte();if(q!==0)break;$.session.extensions.server_name.serverNameList.push(SJ(V,2).getBytes())}}}}if($.session.version){if(Q.version.major!==$.session.version.major||Q.version.minor!==$.session.version.minor)return $.error($,{message:"TLS version change is disallowed during renegotiation.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.protocol_version}})}if(Y)$.session.cipherSuite=F.getCipherSuite(Q.cipher_suite);else{var H=f.util.createBuffer(Q.cipher_suites.bytes());while(H.length()>0)if($.session.cipherSuite=F.getCipherSuite(H.getBytes(2)),$.session.cipherSuite!==null)break}if($.session.cipherSuite===null)return $.error($,{message:"No cipher suites in common.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.handshake_failure},cipherSuite:f.util.bytesToHex(Q.cipher_suite)});if(Y)$.session.compressionMethod=Q.compression_method;else $.session.compressionMethod=F.CompressionMethod.none}return Q};F.createSecurityParameters=function($,J){var X=$.entity===F.ConnectionEnd.client,Q=J.random.bytes(),Y=X?$.session.sp.client_random:Q,G=X?Q:F.createRandom().getBytes();$.session.sp={entity:$.entity,prf_algorithm:F.PRFAlgorithm.tls_prf_sha256,bulk_cipher_algorithm:null,cipher_type:null,enc_key_length:null,block_length:null,fixed_iv_length:null,record_iv_length:null,mac_algorithm:null,mac_length:null,mac_key_length:null,compression_algorithm:$.session.compressionMethod,pre_master_secret:null,master_secret:null,client_random:Y,server_random:G}};F.handleServerHello=function($,J,X){var Q=F.parseHelloMessage($,J,X);if($.fail)return;if(Q.version.minor<=$.version.minor)$.version.minor=Q.version.minor;else return $.error($,{message:"Incompatible TLS version.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.protocol_version}});$.session.version=$.version;var Y=Q.session_id.bytes();if(Y.length>0&&Y===$.session.id)$.expect=o1,$.session.resuming=!0,$.session.sp.server_random=Q.random.bytes();else $.expect=sV,$.session.resuming=!1,F.createSecurityParameters($,Q);$.session.id=Y,$.process()};F.handleClientHello=function($,J,X){var Q=F.parseHelloMessage($,J,X);if($.fail)return;var Y=Q.session_id.bytes(),G=null;if($.sessionCache){if(G=$.sessionCache.getSession(Y),G===null)Y="";else if(G.version.major!==Q.version.major||G.version.minor>Q.version.minor)G=null,Y=""}if(Y.length===0)Y=f.random.getBytes(32);if($.session.id=Y,$.session.clientHelloVersion=Q.version,$.session.sp={},G)$.version=$.session.version=G.version,$.session.sp=G.sp;else{var W;for(var U=1;U<F.SupportedVersions.length;++U)if(W=F.SupportedVersions[U],W.minor<=Q.version.minor)break;$.version={major:W.major,minor:W.minor},$.session.version=$.version}if(G!==null)$.expect=P8,$.session.resuming=!0,$.session.sp.client_random=Q.random.bytes();else $.expect=$.verifyClient!==!1?Xq:w8,$.session.resuming=!1,F.createSecurityParameters($,Q);if($.open=!0,F.queue($,F.createRecord($,{type:F.ContentType.handshake,data:F.createServerHello($)})),$.session.resuming)F.queue($,F.createRecord($,{type:F.ContentType.change_cipher_spec,data:F.createChangeCipherSpec()})),$.state.pending=F.createConnectionState($),$.state.current.write=$.state.pending.write,F.queue($,F.createRecord($,{type:F.ContentType.handshake,data:F.createFinished($)}));else if(F.queue($,F.createRecord($,{type:F.ContentType.handshake,data:F.createCertificate($)})),!$.fail){if(F.queue($,F.createRecord($,{type:F.ContentType.handshake,data:F.createServerKeyExchange($)})),$.verifyClient!==!1)F.queue($,F.createRecord($,{type:F.ContentType.handshake,data:F.createCertificateRequest($)}));F.queue($,F.createRecord($,{type:F.ContentType.handshake,data:F.createServerHelloDone($)}))}F.flush($),$.process()};F.handleCertificate=function($,J,X){if(X<3)return $.error($,{message:"Invalid Certificate message. Message too short.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_list:SJ(Q,3)},G,W,U=[];try{while(Y.certificate_list.length()>0)G=SJ(Y.certificate_list,3),W=f.asn1.fromDer(G),G=f.pki.certificateFromAsn1(W,!0),U.push(G)}catch(O){return $.error($,{message:"Could not parse certificate list.",cause:O,send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.bad_certificate}})}var M=$.entity===F.ConnectionEnd.client;if((M||$.verifyClient===!0)&&U.length===0)$.error($,{message:M?"No server certificate provided.":"No client certificate provided.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.illegal_parameter}});else if(U.length===0)$.expect=M?n1:w8;else{if(M)$.session.serverCertificate=U[0];else $.session.clientCertificate=U[0];if(F.verifyCertificateChain($,U))$.expect=M?n1:w8}$.process()};F.handleServerKeyExchange=function($,J,X){if(X>0)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.unsupported_certificate}});$.expect=rV,$.process()};F.handleClientKeyExchange=function($,J,X){if(X<48)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.unsupported_certificate}});var Q=J.fragment,Y={enc_pre_master_secret:SJ(Q,2).getBytes()},G=null;if($.getPrivateKey)try{G=$.getPrivateKey($,$.session.serverCertificate),G=f.pki.privateKeyFromPem(G)}catch(M){$.error($,{message:"Could not get private key.",cause:M,send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.internal_error}})}if(G===null)return $.error($,{message:"No private key set.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.internal_error}});try{var W=$.session.sp;W.pre_master_secret=G.decrypt(Y.enc_pre_master_secret);var U=$.session.clientHelloVersion;if(U.major!==W.pre_master_secret.charCodeAt(0)||U.minor!==W.pre_master_secret.charCodeAt(1))throw Error("TLS version rollback attack detected.")}catch(M){W.pre_master_secret=f.random.getBytes(48)}if($.expect=P8,$.session.clientCertificate!==null)$.expect=Yq;$.process()};F.handleCertificateRequest=function($,J,X){if(X<3)return $.error($,{message:"Invalid CertificateRequest. Message too short.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_types:SJ(Q,1),certificate_authorities:SJ(Q,2)};$.session.certificateRequest=Y,$.expect=tV,$.process()};F.handleCertificateVerify=function($,J,X){if(X<2)return $.error($,{message:"Invalid CertificateVerify. Message too short.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.illegal_parameter}});var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G={signature:SJ(Q,2).getBytes()},W=f.util.createBuffer();W.putBuffer($.session.md5.digest()),W.putBuffer($.session.sha1.digest()),W=W.getBytes();try{var U=$.session.clientCertificate;if(!U.publicKey.verify(W,G.signature,"NONE"))throw Error("CertificateVerify signature does not match.");$.session.md5.update(Y),$.session.sha1.update(Y)}catch(M){return $.error($,{message:"Bad signature in CertificateVerify.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.handshake_failure}})}$.expect=P8,$.process()};F.handleServerHelloDone=function($,J,X){if(X>0)return $.error($,{message:"Invalid ServerHelloDone message. Invalid length.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.record_overflow}});if($.serverCertificate===null){var Q={message:"No server certificate provided. Not enough security.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.insufficient_security}},Y=0,G=$.verify($,Q.alert.description,Y,[]);if(G!==!0){if(G||G===0){if(typeof G==="object"&&!f.util.isArray(G)){if(G.message)Q.message=G.message;if(G.alert)Q.alert.description=G.alert}else if(typeof G==="number")Q.alert.description=G}return $.error($,Q)}}if($.session.certificateRequest!==null)J=F.createRecord($,{type:F.ContentType.handshake,data:F.createCertificate($)}),F.queue($,J);J=F.createRecord($,{type:F.ContentType.handshake,data:F.createClientKeyExchange($)}),F.queue($,J),$.expect=Jq;var W=function(U,M){if(U.session.certificateRequest!==null&&U.session.clientCertificate!==null)F.queue(U,F.createRecord(U,{type:F.ContentType.handshake,data:F.createCertificateVerify(U,M)}));F.queue(U,F.createRecord(U,{type:F.ContentType.change_cipher_spec,data:F.createChangeCipherSpec()})),U.state.pending=F.createConnectionState(U),U.state.current.write=U.state.pending.write,F.queue(U,F.createRecord(U,{type:F.ContentType.handshake,data:F.createFinished(U)})),U.expect=o1,F.flush(U),U.process()};if($.session.certificateRequest===null||$.session.clientCertificate===null)return W($,null);F.getClientSignature($,W)};F.handleChangeCipherSpec=function($,J){if(J.fragment.getByte()!==1)return $.error($,{message:"Invalid ChangeCipherSpec message received.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.illegal_parameter}});var X=$.entity===F.ConnectionEnd.client;if($.session.resuming&&X||!$.session.resuming&&!X)$.state.pending=F.createConnectionState($);if($.state.current.read=$.state.pending.read,!$.session.resuming&&X||$.session.resuming&&!X)$.state.pending=null;$.expect=X?eV:Gq,$.process()};F.handleFinished=function($,J,X){var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G=J.fragment.getBytes();Q=f.util.createBuffer(),Q.putBuffer($.session.md5.digest()),Q.putBuffer($.session.sha1.digest());var W=$.entity===F.ConnectionEnd.client,U=W?"server finished":"client finished",M=$.session.sp,O=12,V=pY;if(Q=V(M.master_secret,U,Q.getBytes(),O),Q.getBytes()!==G)return $.error($,{message:"Invalid verify_data in Finished message.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.decrypt_error}});if($.session.md5.update(Y),$.session.sha1.update(Y),$.session.resuming&&W||!$.session.resuming&&!W)F.queue($,F.createRecord($,{type:F.ContentType.change_cipher_spec,data:F.createChangeCipherSpec()})),$.state.current.write=$.state.pending.write,$.state.pending=null,F.queue($,F.createRecord($,{type:F.ContentType.handshake,data:F.createFinished($)}));$.expect=W?$q:Wq,$.handshaking=!1,++$.handshakes,$.peerCertificate=W?$.session.serverCertificate:$.session.clientCertificate,F.flush($),$.isConnected=!0,$.connected($),$.process()};F.handleAlert=function($,J){var X=J.fragment,Q={level:X.getByte(),description:X.getByte()},Y;switch(Q.description){case F.Alert.Description.close_notify:Y="Connection closed.";break;case F.Alert.Description.unexpected_message:Y="Unexpected message.";break;case F.Alert.Description.bad_record_mac:Y="Bad record MAC.";break;case F.Alert.Description.decryption_failed:Y="Decryption failed.";break;case F.Alert.Description.record_overflow:Y="Record overflow.";break;case F.Alert.Description.decompression_failure:Y="Decompression failed.";break;case F.Alert.Description.handshake_failure:Y="Handshake failure.";break;case F.Alert.Description.bad_certificate:Y="Bad certificate.";break;case F.Alert.Description.unsupported_certificate:Y="Unsupported certificate.";break;case F.Alert.Description.certificate_revoked:Y="Certificate revoked.";break;case F.Alert.Description.certificate_expired:Y="Certificate expired.";break;case F.Alert.Description.certificate_unknown:Y="Certificate unknown.";break;case F.Alert.Description.illegal_parameter:Y="Illegal parameter.";break;case F.Alert.Description.unknown_ca:Y="Unknown certificate authority.";break;case F.Alert.Description.access_denied:Y="Access denied.";break;case F.Alert.Description.decode_error:Y="Decode error.";break;case F.Alert.Description.decrypt_error:Y="Decrypt error.";break;case F.Alert.Description.export_restriction:Y="Export restriction.";break;case F.Alert.Description.protocol_version:Y="Unsupported protocol version.";break;case F.Alert.Description.insufficient_security:Y="Insufficient security.";break;case F.Alert.Description.internal_error:Y="Internal error.";break;case F.Alert.Description.user_canceled:Y="User canceled.";break;case F.Alert.Description.no_renegotiation:Y="Renegotiation not supported.";break;default:Y="Unknown error.";break}if(Q.description===F.Alert.Description.close_notify)return $.close();$.error($,{message:Y,send:!1,origin:$.entity===F.ConnectionEnd.client?"server":"client",alert:Q}),$.process()};F.handleHandshake=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt24();if(Y>X.length())return $.fragmented=J,J.fragment=f.util.createBuffer(),X.read-=4,$.process();$.fragmented=null,X.read-=4;var G=X.bytes(Y+4);if(X.read+=4,Q in lY[$.entity][$.expect]){if($.entity===F.ConnectionEnd.server&&!$.open&&!$.fail)$.handshaking=!0,$.session={version:null,extensions:{server_name:{serverNameList:[]}},cipherSuite:null,compressionMethod:null,serverCertificate:null,clientCertificate:null,md5:f.md.md5.create(),sha1:f.md.sha1.create()};if(Q!==F.HandshakeType.hello_request&&Q!==F.HandshakeType.certificate_verify&&Q!==F.HandshakeType.finished)$.session.md5.update(G),$.session.sha1.update(G);lY[$.entity][$.expect][Q]($,J,Y)}else F.handleUnexpected($,J)};F.handleApplicationData=function($,J){$.data.putBuffer(J.fragment),$.dataReady($),$.process()};F.handleHeartbeat=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt16(),G=X.getBytes(Y);if(Q===F.HeartbeatMessageType.heartbeat_request){if($.handshaking||Y>G.length)return $.process();F.queue($,F.createRecord($,{type:F.ContentType.heartbeat,data:F.createHeartbeat(F.HeartbeatMessageType.heartbeat_response,G)})),F.flush($)}else if(Q===F.HeartbeatMessageType.heartbeat_response){if(G!==$.expectedHeartbeatPayload)return $.process();if($.heartbeatReceived)$.heartbeatReceived($,f.util.createBuffer(G))}$.process()};var aV=0,sV=1,n1=2,rV=3,tV=4,o1=5,eV=6,$q=7,Jq=8,Qq=0,Xq=1,w8=2,Yq=3,P8=4,Gq=5,Wq=6,E=F.handleUnexpected,a1=F.handleChangeCipherSpec,HJ=F.handleAlert,RJ=F.handleHandshake,s1=F.handleApplicationData,KJ=F.handleHeartbeat,_8=[];_8[F.ConnectionEnd.client]=[[E,HJ,RJ,E,KJ],[E,HJ,RJ,E,KJ],[E,HJ,RJ,E,KJ],[E,HJ,RJ,E,KJ],[E,HJ,RJ,E,KJ],[a1,HJ,E,E,KJ],[E,HJ,RJ,E,KJ],[E,HJ,RJ,s1,KJ],[E,HJ,RJ,E,KJ]];_8[F.ConnectionEnd.server]=[[E,HJ,RJ,E,KJ],[E,HJ,RJ,E,KJ],[E,HJ,RJ,E,KJ],[E,HJ,RJ,E,KJ],[a1,HJ,E,E,KJ],[E,HJ,RJ,E,KJ],[E,HJ,RJ,s1,KJ],[E,HJ,RJ,E,KJ]];var{handleHelloRequest:y0,handleServerHello:Uq,handleCertificate:r1,handleServerKeyExchange:i1,handleCertificateRequest:I8,handleServerHelloDone:mY,handleFinished:t1}=F,lY=[];lY[F.ConnectionEnd.client]=[[E,E,Uq,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,r1,i1,I8,mY,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,i1,I8,mY,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,I8,mY,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,mY,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,t1],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[y0,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E]];var{handleClientHello:Mq,handleClientKeyExchange:Oq,handleCertificateVerify:Vq}=F;lY[F.ConnectionEnd.server]=[[E,Mq,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,r1,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,Oq,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,Vq,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,t1],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E],[E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E,E]];F.generateKeys=function($,J){var X=pY,Q=J.client_random+J.server_random;if(!$.session.resuming)J.master_secret=X(J.pre_master_secret,"master secret",Q,48).bytes(),J.pre_master_secret=null;Q=J.server_random+J.client_random;var Y=2*J.mac_key_length+2*J.enc_key_length,G=$.version.major===F.Versions.TLS_1_0.major&&$.version.minor===F.Versions.TLS_1_0.minor;if(G)Y+=2*J.fixed_iv_length;var W=X(J.master_secret,"key expansion",Q,Y),U={client_write_MAC_key:W.getBytes(J.mac_key_length),server_write_MAC_key:W.getBytes(J.mac_key_length),client_write_key:W.getBytes(J.enc_key_length),server_write_key:W.getBytes(J.enc_key_length)};if(G)U.client_write_IV=W.getBytes(J.fixed_iv_length),U.server_write_IV=W.getBytes(J.fixed_iv_length);return U};F.createConnectionState=function($){var J=$.entity===F.ConnectionEnd.client,X=function(){var G={sequenceNumber:[0,0],macKey:null,macLength:0,macFunction:null,cipherState:null,cipherFunction:function(W){return!0},compressionState:null,compressFunction:function(W){return!0},updateSequenceNumber:function(){if(G.sequenceNumber[1]===4294967295)G.sequenceNumber[1]=0,++G.sequenceNumber[0];else++G.sequenceNumber[1]}};return G},Q={read:X(),write:X()};if(Q.read.update=function(G,W){if(!Q.read.cipherFunction(W,Q.read))G.error(G,{message:"Could not decrypt record or bad MAC.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.bad_record_mac}});else if(!Q.read.compressFunction(G,W,Q.read))G.error(G,{message:"Could not decompress record.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.decompression_failure}});return!G.fail},Q.write.update=function(G,W){if(!Q.write.compressFunction(G,W,Q.write))G.error(G,{message:"Could not compress record.",send:!1,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.internal_error}});else if(!Q.write.cipherFunction(W,Q.write))G.error(G,{message:"Could not encrypt record.",send:!1,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.internal_error}});return!G.fail},$.session){var Y=$.session.sp;switch($.session.cipherSuite.initSecurityParameters(Y),Y.keys=F.generateKeys($,Y),Q.read.macKey=J?Y.keys.server_write_MAC_key:Y.keys.client_write_MAC_key,Q.write.macKey=J?Y.keys.client_write_MAC_key:Y.keys.server_write_MAC_key,$.session.cipherSuite.initConnectionState(Q,$,Y),Y.compression_algorithm){case F.CompressionMethod.none:break;case F.CompressionMethod.deflate:Q.read.compressFunction=oV,Q.write.compressFunction=iV;break;default:throw Error("Unsupported compression algorithm.")}}return Q};F.createRandom=function(){var $=new Date,J=+$+$.getTimezoneOffset()*60000,X=f.util.createBuffer();return X.putInt32(J),X.putBytes(f.random.getBytes(28)),X};F.createRecord=function($,J){if(!J.data)return null;var X={type:J.type,version:{major:$.version.major,minor:$.version.minor},length:J.data.length(),fragment:J.data};return X};F.createAlert=function($,J){var X=f.util.createBuffer();return X.putByte(J.level),X.putByte(J.description),F.createRecord($,{type:F.ContentType.alert,data:X})};F.createClientHello=function($){$.session.clientHelloVersion={major:$.version.major,minor:$.version.minor};var J=f.util.createBuffer();for(var X=0;X<$.cipherSuites.length;++X){var Q=$.cipherSuites[X];J.putByte(Q.id[0]),J.putByte(Q.id[1])}var Y=J.length(),G=f.util.createBuffer();G.putByte(F.CompressionMethod.none);var W=G.length(),U=f.util.createBuffer();if($.virtualHost){var M=f.util.createBuffer();M.putByte(0),M.putByte(0);var O=f.util.createBuffer();O.putByte(0),fJ(O,2,f.util.createBuffer($.virtualHost));var V=f.util.createBuffer();fJ(V,2,O),fJ(M,2,V),U.putBuffer(M)}var q=U.length();if(q>0)q+=2;var H=$.session.id,N=H.length+1+2+4+28+2+Y+1+W+q,K=f.util.createBuffer();if(K.putByte(F.HandshakeType.client_hello),K.putInt24(N),K.putByte($.version.major),K.putByte($.version.minor),K.putBytes($.session.sp.client_random),fJ(K,1,f.util.createBuffer(H)),fJ(K,2,J),fJ(K,1,G),q>0)fJ(K,2,U);return K};F.createServerHello=function($){var J=$.session.id,X=J.length+1+2+4+28+2+1,Q=f.util.createBuffer();return Q.putByte(F.HandshakeType.server_hello),Q.putInt24(X),Q.putByte($.version.major),Q.putByte($.version.minor),Q.putBytes($.session.sp.server_random),fJ(Q,1,f.util.createBuffer(J)),Q.putByte($.session.cipherSuite.id[0]),Q.putByte($.session.cipherSuite.id[1]),Q.putByte($.session.compressionMethod),Q};F.createCertificate=function($){var J=$.entity===F.ConnectionEnd.client,X=null;if($.getCertificate){var Q;if(J)Q=$.session.certificateRequest;else Q=$.session.extensions.server_name.serverNameList;X=$.getCertificate($,Q)}var Y=f.util.createBuffer();if(X!==null)try{if(!f.util.isArray(X))X=[X];var G=null;for(var W=0;W<X.length;++W){var U=f.pem.decode(X[W])[0];if(U.type!=="CERTIFICATE"&&U.type!=="X509 CERTIFICATE"&&U.type!=="TRUSTED CERTIFICATE"){var M=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw M.headerType=U.type,M}if(U.procType&&U.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var O=f.util.createBuffer(U.body);if(G===null)G=f.asn1.fromDer(O.bytes(),!1);var V=f.util.createBuffer();fJ(V,3,O),Y.putBuffer(V)}if(X=f.pki.certificateFromAsn1(G),J)$.session.clientCertificate=X;else $.session.serverCertificate=X}catch(N){return $.error($,{message:"Could not send certificate list.",cause:N,send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.bad_certificate}})}var q=3+Y.length(),H=f.util.createBuffer();return H.putByte(F.HandshakeType.certificate),H.putInt24(q),fJ(H,3,Y),H};F.createClientKeyExchange=function($){var J=f.util.createBuffer();J.putByte($.session.clientHelloVersion.major),J.putByte($.session.clientHelloVersion.minor),J.putBytes(f.random.getBytes(46));var X=$.session.sp;X.pre_master_secret=J.getBytes();var Q=$.session.serverCertificate.publicKey;J=Q.encrypt(X.pre_master_secret);var Y=J.length+2,G=f.util.createBuffer();return G.putByte(F.HandshakeType.client_key_exchange),G.putInt24(Y),G.putInt16(J.length),G.putBytes(J),G};F.createServerKeyExchange=function($){var J=0,X=f.util.createBuffer();if(J>0)X.putByte(F.HandshakeType.server_key_exchange),X.putInt24(J);return X};F.getClientSignature=function($,J){var X=f.util.createBuffer();X.putBuffer($.session.md5.digest()),X.putBuffer($.session.sha1.digest()),X=X.getBytes(),$.getSignature=$.getSignature||function(Q,Y,G){var W=null;if(Q.getPrivateKey)try{W=Q.getPrivateKey(Q,Q.session.clientCertificate),W=f.pki.privateKeyFromPem(W)}catch(U){Q.error(Q,{message:"Could not get private key.",cause:U,send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.internal_error}})}if(W===null)Q.error(Q,{message:"No private key set.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.internal_error}});else Y=W.sign(Y,null);G(Q,Y)},$.getSignature($,X,J)};F.createCertificateVerify=function($,J){var X=J.length+2,Q=f.util.createBuffer();return Q.putByte(F.HandshakeType.certificate_verify),Q.putInt24(X),Q.putInt16(J.length),Q.putBytes(J),Q};F.createCertificateRequest=function($){var J=f.util.createBuffer();J.putByte(1);var X=f.util.createBuffer();for(var Q in $.caStore.certs){var Y=$.caStore.certs[Q],G=f.pki.distinguishedNameToAsn1(Y.subject),W=f.asn1.toDer(G);X.putInt16(W.length()),X.putBuffer(W)}var U=1+J.length()+2+X.length(),M=f.util.createBuffer();return M.putByte(F.HandshakeType.certificate_request),M.putInt24(U),fJ(M,1,J),fJ(M,2,X),M};F.createServerHelloDone=function($){var J=f.util.createBuffer();return J.putByte(F.HandshakeType.server_hello_done),J.putInt24(0),J};F.createChangeCipherSpec=function(){var $=f.util.createBuffer();return $.putByte(1),$};F.createFinished=function($){var J=f.util.createBuffer();J.putBuffer($.session.md5.digest()),J.putBuffer($.session.sha1.digest());var X=$.entity===F.ConnectionEnd.client,Q=$.session.sp,Y=12,G=pY,W=X?"client finished":"server finished";J=G(Q.master_secret,W,J.getBytes(),Y);var U=f.util.createBuffer();return U.putByte(F.HandshakeType.finished),U.putInt24(J.length()),U.putBuffer(J),U};F.createHeartbeat=function($,J,X){if(typeof X>"u")X=J.length;var Q=f.util.createBuffer();Q.putByte($),Q.putInt16(X),Q.putBytes(J);var Y=Q.length(),G=Math.max(16,Y-X-3);return Q.putBytes(f.random.getBytes(G)),Q};F.queue=function($,J){if(!J)return;if(J.fragment.length()===0){if(J.type===F.ContentType.handshake||J.type===F.ContentType.alert||J.type===F.ContentType.change_cipher_spec)return}if(J.type===F.ContentType.handshake){var X=J.fragment.bytes();$.session.md5.update(X),$.session.sha1.update(X),X=null}var Q;if(J.fragment.length()<=F.MaxFragment)Q=[J];else{Q=[];var Y=J.fragment.bytes();while(Y.length>F.MaxFragment)Q.push(F.createRecord($,{type:J.type,data:f.util.createBuffer(Y.slice(0,F.MaxFragment))})),Y=Y.slice(F.MaxFragment);if(Y.length>0)Q.push(F.createRecord($,{type:J.type,data:f.util.createBuffer(Y)}))}for(var G=0;G<Q.length&&!$.fail;++G){var W=Q[G],U=$.state.current.write;if(U.update($,W))$.records.push(W)}};F.flush=function($){for(var J=0;J<$.records.length;++J){var X=$.records[J];$.tlsData.putByte(X.type),$.tlsData.putByte(X.version.major),$.tlsData.putByte(X.version.minor),$.tlsData.putInt16(X.fragment.length()),$.tlsData.putBuffer($.records[J].fragment)}return $.records=[],$.tlsDataReady($)};var C8=function($){switch($){case!0:return!0;case f.pki.certificateError.bad_certificate:return F.Alert.Description.bad_certificate;case f.pki.certificateError.unsupported_certificate:return F.Alert.Description.unsupported_certificate;case f.pki.certificateError.certificate_revoked:return F.Alert.Description.certificate_revoked;case f.pki.certificateError.certificate_expired:return F.Alert.Description.certificate_expired;case f.pki.certificateError.certificate_unknown:return F.Alert.Description.certificate_unknown;case f.pki.certificateError.unknown_ca:return F.Alert.Description.unknown_ca;default:return F.Alert.Description.bad_certificate}},qq=function($){switch($){case!0:return!0;case F.Alert.Description.bad_certificate:return f.pki.certificateError.bad_certificate;case F.Alert.Description.unsupported_certificate:return f.pki.certificateError.unsupported_certificate;case F.Alert.Description.certificate_revoked:return f.pki.certificateError.certificate_revoked;case F.Alert.Description.certificate_expired:return f.pki.certificateError.certificate_expired;case F.Alert.Description.certificate_unknown:return f.pki.certificateError.certificate_unknown;case F.Alert.Description.unknown_ca:return f.pki.certificateError.unknown_ca;default:return f.pki.certificateError.bad_certificate}};F.verifyCertificateChain=function($,J){try{var X={};for(var Q in $.verifyOptions)X[Q]=$.verifyOptions[Q];X.verify=function(G,W,U){var M=C8(G),O=$.verify($,G,W,U);if(O!==!0){if(typeof O==="object"&&!f.util.isArray(O)){var V=Error("The application rejected the certificate.");if(V.send=!0,V.alert={level:F.Alert.Level.fatal,description:F.Alert.Description.bad_certificate},O.message)V.message=O.message;if(O.alert)V.alert.description=O.alert;throw V}if(O!==G)O=qq(O)}return O},f.pki.verifyCertificateChain($.caStore,J,X)}catch(G){var Y=G;if(typeof Y!=="object"||f.util.isArray(Y))Y={send:!0,alert:{level:F.Alert.Level.fatal,description:C8(G)}};if(!("send"in Y))Y.send=!0;if(!("alert"in Y))Y.alert={level:F.Alert.Level.fatal,description:C8(Y.error)};$.error($,Y)}return!$.fail};F.createSessionCache=function($,J){var X=null;if($&&$.getSession&&$.setSession&&$.order)X=$;else{X={},X.cache=$||{},X.capacity=Math.max(J||100,1),X.order=[];for(var Q in $)if(X.order.length<=J)X.order.push(Q);else delete $[Q];X.getSession=function(Y){var G=null,W=null;if(Y)W=f.util.bytesToHex(Y);else if(X.order.length>0)W=X.order[0];if(W!==null&&W in X.cache){G=X.cache[W],delete X.cache[W];for(var U in X.order)if(X.order[U]===W){X.order.splice(U,1);break}}return G},X.setSession=function(Y,G){if(X.order.length===X.capacity){var W=X.order.shift();delete X.cache[W]}var W=f.util.bytesToHex(Y);X.order.push(W),X.cache[W]=G}}return X};F.createConnection=function($){var J=null;if($.caStore)if(f.util.isArray($.caStore))J=f.pki.createCaStore($.caStore);else J=$.caStore;else J=f.pki.createCaStore();var X=$.cipherSuites||null;if(X===null){X=[];for(var Q in F.CipherSuites)X.push(F.CipherSuites[Q])}var Y=$.server?F.ConnectionEnd.server:F.ConnectionEnd.client,G=$.sessionCache?F.createSessionCache($.sessionCache):null,W={version:{major:F.Version.major,minor:F.Version.minor},entity:Y,sessionId:$.sessionId,caStore:J,sessionCache:G,cipherSuites:X,connected:$.connected,virtualHost:$.virtualHost||null,verifyClient:$.verifyClient||!1,verify:$.verify||function(V,q,H,N){return q},verifyOptions:$.verifyOptions||{},getCertificate:$.getCertificate||null,getPrivateKey:$.getPrivateKey||null,getSignature:$.getSignature||null,input:f.util.createBuffer(),tlsData:f.util.createBuffer(),data:f.util.createBuffer(),tlsDataReady:$.tlsDataReady,dataReady:$.dataReady,heartbeatReceived:$.heartbeatReceived,closed:$.closed,error:function(V,q){if(q.origin=q.origin||(V.entity===F.ConnectionEnd.client?"client":"server"),q.send)F.queue(V,F.createAlert(V,q.alert)),F.flush(V);var H=q.fatal!==!1;if(H)V.fail=!0;if($.error(V,q),H)V.close(!1)},deflate:$.deflate||null,inflate:$.inflate||null};W.reset=function(V){W.version={major:F.Version.major,minor:F.Version.minor},W.record=null,W.session=null,W.peerCertificate=null,W.state={pending:null,current:null},W.expect=W.entity===F.ConnectionEnd.client?aV:Qq,W.fragmented=null,W.records=[],W.open=!1,W.handshakes=0,W.handshaking=!1,W.isConnected=!1,W.fail=!(V||typeof V>"u"),W.input.clear(),W.tlsData.clear(),W.data.clear(),W.state.current=F.createConnectionState(W)},W.reset();var U=function(V,q){var H=q.type-F.ContentType.change_cipher_spec,N=_8[V.entity][V.expect];if(H in N)N[H](V,q);else F.handleUnexpected(V,q)},M=function(V){var q=0,H=V.input,N=H.length();if(N<5)q=5-N;else{V.record={type:H.getByte(),version:{major:H.getByte(),minor:H.getByte()},length:H.getInt16(),fragment:f.util.createBuffer(),ready:!1};var K=V.record.version.major===V.version.major;if(K&&V.session&&V.session.version)K=V.record.version.minor===V.version.minor;if(!K)V.error(V,{message:"Incompatible TLS version.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.protocol_version}})}return q},O=function(V){var q=0,H=V.input,N=H.length();if(N<V.record.length)q=V.record.length-N;else{V.record.fragment.putBytes(H.getBytes(V.record.length)),H.compact();var K=V.state.current.read;if(K.update(V,V.record)){if(V.fragmented!==null)if(V.fragmented.type===V.record.type)V.fragmented.fragment.putBuffer(V.record.fragment),V.record=V.fragmented;else V.error(V,{message:"Invalid fragmented record.",send:!0,alert:{level:F.Alert.Level.fatal,description:F.Alert.Description.unexpected_message}});V.record.ready=!0}}return q};return W.handshake=function(V){if(W.entity!==F.ConnectionEnd.client)W.error(W,{message:"Cannot initiate handshake as a server.",fatal:!1});else if(W.handshaking)W.error(W,{message:"Handshake already in progress.",fatal:!1});else{if(W.fail&&!W.open&&W.handshakes===0)W.fail=!1;W.handshaking=!0,V=V||"";var q=null;if(V.length>0){if(W.sessionCache)q=W.sessionCache.getSession(V);if(q===null)V=""}if(V.length===0&&W.sessionCache){if(q=W.sessionCache.getSession(),q!==null)V=q.id}if(W.session={id:V,version:null,cipherSuite:null,compressionMethod:null,serverCertificate:null,certificateRequest:null,clientCertificate:null,sp:{},md5:f.md.md5.create(),sha1:f.md.sha1.create()},q)W.version=q.version,W.session.sp=q.sp;W.session.sp.client_random=F.createRandom().getBytes(),W.open=!0,F.queue(W,F.createRecord(W,{type:F.ContentType.handshake,data:F.createClientHello(W)})),F.flush(W)}},W.process=function(V){var q=0;if(V)W.input.putBytes(V);if(!W.fail){if(W.record!==null&&W.record.ready&&W.record.fragment.isEmpty())W.record=null;if(W.record===null)q=M(W);if(!W.fail&&W.record!==null&&!W.record.ready)q=O(W);if(!W.fail&&W.record!==null&&W.record.ready)U(W,W.record)}return q},W.prepare=function(V){return F.queue(W,F.createRecord(W,{type:F.ContentType.application_data,data:f.util.createBuffer(V)})),F.flush(W)},W.prepareHeartbeatRequest=function(V,q){if(V instanceof f.util.ByteBuffer)V=V.bytes();if(typeof q>"u")q=V.length;return W.expectedHeartbeatPayload=V,F.queue(W,F.createRecord(W,{type:F.ContentType.heartbeat,data:F.createHeartbeat(F.HeartbeatMessageType.heartbeat_request,V,q)})),F.flush(W)},W.close=function(V){if(!W.fail&&W.sessionCache&&W.session){var q={id:W.session.id,version:W.session.version,sp:W.session.sp};q.sp.keys=null,W.sessionCache.setSession(q.id,q)}if(W.open){if(W.open=!1,W.input.clear(),W.isConnected||W.handshaking)W.isConnected=W.handshaking=!1,F.queue(W,F.createAlert(W,{level:F.Alert.Level.warning,description:F.Alert.Description.close_notify})),F.flush(W);W.closed(W)}W.reset(V)},W};e1.exports=f.tls=f.tls||{};for(wX in F)if(typeof F[wX]!=="function")f.tls[wX]=F[wX];var wX;f.tls.prf_tls1=pY;f.tls.hmac_sha1=nV;f.tls.createSessionCache=F.createSessionCache;f.tls.createConnection=F.createConnection});var QW=q$((cF,JW)=>{var b0=F$();P0();x8();var yJ=JW.exports=b0.tls;yJ.CipherSuites.TLS_RSA_WITH_AES_128_CBC_SHA={id:[0,47],name:"TLS_RSA_WITH_AES_128_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=yJ.BulkCipherAlgorithm.aes,$.cipher_type=yJ.CipherType.block,$.enc_key_length=16,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=yJ.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:$W};yJ.CipherSuites.TLS_RSA_WITH_AES_256_CBC_SHA={id:[0,53],name:"TLS_RSA_WITH_AES_256_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=yJ.BulkCipherAlgorithm.aes,$.cipher_type=yJ.CipherType.block,$.enc_key_length=32,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=yJ.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:$W};function $W($,J,X){var Q=J.entity===b0.tls.ConnectionEnd.client;$.read.cipherState={init:!1,cipher:b0.cipher.createDecipher("AES-CBC",Q?X.keys.server_write_key:X.keys.client_write_key),iv:Q?X.keys.server_write_IV:X.keys.client_write_IV},$.write.cipherState={init:!1,cipher:b0.cipher.createCipher("AES-CBC",Q?X.keys.client_write_key:X.keys.server_write_key),iv:Q?X.keys.client_write_IV:X.keys.server_write_IV},$.read.cipherFunction=Eq,$.write.cipherFunction=Hq,$.read.macLength=$.write.macLength=X.mac_length,$.read.macFunction=$.write.macFunction=yJ.hmac_sha1}function Hq($,J){var X=!1,Q=J.macFunction(J.macKey,J.sequenceNumber,$);$.fragment.putBytes(Q),J.updateSequenceNumber();var Y;if($.version.minor===yJ.Versions.TLS_1_0.minor)Y=J.cipherState.init?null:J.cipherState.iv;else Y=b0.random.getBytesSync(16);J.cipherState.init=!0;var G=J.cipherState.cipher;if(G.start({iv:Y}),$.version.minor>=yJ.Versions.TLS_1_1.minor)G.output.putBytes(Y);if(G.update($.fragment),G.finish(Kq))$.fragment=G.output,$.length=$.fragment.length(),X=!0;return X}function Kq($,J,X){if(!X){var Q=$-J.length()%$;J.fillWithByte(Q-1,Q)}return!0}function zq($,J,X){var Q=!0;if(X){var Y=J.length(),G=J.last();for(var W=Y-1-G;W<Y-1;++W)Q=Q&&J.at(W)==G;if(Q)J.truncate(G+1)}return Q}function Eq($,J){var X=!1,Q;if($.version.minor===yJ.Versions.TLS_1_0.minor)Q=J.cipherState.init?null:J.cipherState.iv;else Q=$.fragment.getBytes(16);J.cipherState.init=!0;var Y=J.cipherState.cipher;Y.start({iv:Q}),Y.update($.fragment),X=Y.finish(zq);var G=J.macLength,W=b0.random.getBytesSync(G),U=Y.output.length();if(U>=G)$.fragment=Y.output.getBytes(U-G),W=Y.output.getBytes(G);else $.fragment=Y.output.getBytes();$.fragment=b0.util.createBuffer($.fragment),$.length=$.fragment.length();var M=J.macFunction(J.macKey,J.sequenceNumber,$);return J.updateSequenceNumber(),X=Fq(J.macKey,W,M)&&X,X}function Fq($,J,X){var Q=b0.hmac.create();return Q.start("SHA1",$),Q.update(J),J=Q.digest().getBytes(),Q.start(null,null),Q.update(X),X=Q.digest().getBytes(),J===X}});var f8=q$((nF,WW)=>{var d$=F$();$0();_$();var PX=WW.exports=d$.sha512=d$.sha512||{};d$.md.sha512=d$.md.algorithms.sha512=PX;var YW=d$.sha384=d$.sha512.sha384=d$.sha512.sha384||{};YW.create=function(){return PX.create("SHA-384")};d$.md.sha384=d$.md.algorithms.sha384=YW;d$.sha512.sha256=d$.sha512.sha256||{create:function(){return PX.create("SHA-512/256")}};d$.md["sha512/256"]=d$.md.algorithms["sha512/256"]=d$.sha512.sha256;d$.sha512.sha224=d$.sha512.sha224||{create:function(){return PX.create("SHA-512/224")}};d$.md["sha512/224"]=d$.md.algorithms["sha512/224"]=d$.sha512.sha224;PX.create=function($){if(!GW)Nq();if(typeof $>"u")$="SHA-512";if(!($ in MQ))throw Error("Invalid SHA-512 algorithm: "+$);var J=MQ[$],X=null,Q=d$.util.createBuffer(),Y=Array(80);for(var G=0;G<80;++G)Y[G]=[,,];var W=64;switch($){case"SHA-384":W=48;break;case"SHA-512/256":W=32;break;case"SHA-512/224":W=28;break}var U={algorithm:$.replace("-","").toLowerCase(),blockLength:128,digestLength:W,messageLength:0,fullMessageLength:null,messageLengthSize:16};return U.start=function(){U.messageLength=0,U.fullMessageLength=U.messageLength128=[];var M=U.messageLengthSize/4;for(var O=0;O<M;++O)U.fullMessageLength.push(0);Q=d$.util.createBuffer(),X=Array(J.length);for(var O=0;O<J.length;++O)X[O]=J[O].slice(0);return U},U.start(),U.update=function(M,O){if(O==="utf8")M=d$.util.encodeUtf8(M);var V=M.length;U.messageLength+=V,V=[V/4294967296>>>0,V>>>0];for(var q=U.fullMessageLength.length-1;q>=0;--q)U.fullMessageLength[q]+=V[1],V[1]=V[0]+(U.fullMessageLength[q]/4294967296>>>0),U.fullMessageLength[q]=U.fullMessageLength[q]>>>0,V[0]=V[1]/4294967296>>>0;if(Q.putBytes(M),XW(X,Y,Q),Q.read>2048||Q.length()===0)Q.compact();return U},U.digest=function(){var M=d$.util.createBuffer();M.putBytes(Q.bytes());var O=U.fullMessageLength[U.fullMessageLength.length-1]+U.messageLengthSize,V=O&U.blockLength-1;M.putBytes(v8.substr(0,U.blockLength-V));var q,H,N=U.fullMessageLength[0]*8;for(var K=0;K<U.fullMessageLength.length-1;++K)q=U.fullMessageLength[K+1]*8,H=q/4294967296>>>0,N+=H,M.putInt32(N>>>0),N=q>>>0;M.putInt32(N);var L=Array(X.length);for(var K=0;K<X.length;++K)L[K]=X[K].slice(0);XW(L,Y,M);var A=d$.util.createBuffer(),D;if($==="SHA-512")D=L.length;else if($==="SHA-384")D=L.length-2;else D=L.length-4;for(var K=0;K<D;++K)if(A.putInt32(L[K][0]),K!==D-1||$!=="SHA-512/224")A.putInt32(L[K][1]);return A},U};var v8=null,GW=!1,k8=null,MQ=null;function Nq(){v8=String.fromCharCode(128),v8+=d$.util.fillString(String.fromCharCode(0),128),k8=[[1116352408,3609767458],[1899447441,602891725],[3049323471,3964484399],[3921009573,2173295548],[961987163,4081628472],[1508970993,3053834265],[2453635748,2937671579],[2870763221,3664609560],[3624381080,2734883394],[310598401,1164996542],[607225278,1323610764],[1426881987,3590304994],[1925078388,4068182383],[2162078206,991336113],[2614888103,633803317],[3248222580,3479774868],[3835390401,2666613458],[4022224774,944711139],[264347078,2341262773],[604807628,2007800933],[770255983,1495990901],[1249150122,1856431235],[1555081692,3175218132],[1996064986,2198950837],[2554220882,3999719339],[2821834349,766784016],[2952996808,2566594879],[3210313671,3203337956],[3336571891,1034457026],[3584528711,2466948901],[113926993,3758326383],[338241895,168717936],[666307205,1188179964],[773529912,1546045734],[1294757372,1522805485],[1396182291,2643833823],[1695183700,2343527390],[1986661051,1014477480],[2177026350,1206759142],[2456956037,344077627],[2730485921,1290863460],[2820302411,3158454273],[3259730800,3505952657],[3345764771,106217008],[3516065817,3606008344],[3600352804,1432725776],[4094571909,1467031594],[275423344,851169720],[430227734,3100823752],[506948616,1363258195],[659060556,3750685593],[883997877,3785050280],[958139571,3318307427],[1322822218,3812723403],[1537002063,2003034995],[1747873779,3602036899],[1955562222,1575990012],[2024104815,1125592928],[2227730452,2716904306],[2361852424,442776044],[2428436474,593698344],[2756734187,3733110249],[3204031479,2999351573],[3329325298,3815920427],[3391569614,3928383900],[3515267271,566280711],[3940187606,3454069534],[4118630271,4000239992],[116418474,1914138554],[174292421,2731055270],[289380356,3203993006],[460393269,320620315],[685471733,587496836],[852142971,1086792851],[1017036298,365543100],[1126000580,2618297676],[1288033470,3409855158],[1501505948,4234509866],[1607167915,987167468],[1816402316,1246189591]],MQ={},MQ["SHA-512"]=[[1779033703,4089235720],[3144134277,2227873595],[1013904242,4271175723],[2773480762,1595750129],[1359893119,2917565137],[2600822924,725511199],[528734635,4215389547],[1541459225,327033209]],MQ["SHA-384"]=[[3418070365,3238371032],[1654270250,914150663],[2438529370,812702999],[355462360,4144912697],[1731405415,4290775857],[2394180231,1750603025],[3675008525,1694076839],[1203062813,3204075428]],MQ["SHA-512/256"]=[[573645204,4230739756],[2673172387,3360449730],[596883563,1867755857],[2520282905,1497426621],[2519219938,2827943907],[3193839141,1401305490],[721525244,746961066],[246885852,2177182882]],MQ["SHA-512/224"]=[[2352822216,424955298],[1944164710,2312950998],[502970286,855612546],[1738396948,1479516111],[258812777,2077511080],[2011393907,79989058],[1067287976,1780299464],[286451373,2446758561]],GW=!0}function XW($,J,X){var Q,Y,G,W,U,M,O,V,q,H,N,K,L,A,D,S,B,C,w,P,l,e,y,n,Y$,L$,j$,QJ,S$,h$,u,J$,a,V$,O$,$$=X.length();while($$>=128){for(S$=0;S$<16;++S$)J[S$][0]=X.getInt32()>>>0,J[S$][1]=X.getInt32()>>>0;for(;S$<80;++S$)J$=J[S$-2],h$=J$[0],u=J$[1],Q=((h$>>>19|u<<13)^(u>>>29|h$<<3)^h$>>>6)>>>0,Y=((h$<<13|u>>>19)^(u<<3|h$>>>29)^(h$<<26|u>>>6))>>>0,V$=J[S$-15],h$=V$[0],u=V$[1],G=((h$>>>1|u<<31)^(h$>>>8|u<<24)^h$>>>7)>>>0,W=((h$<<31|u>>>1)^(h$<<24|u>>>8)^(h$<<25|u>>>7))>>>0,a=J[S$-7],O$=J[S$-16],u=Y+a[1]+W+O$[1],J[S$][0]=Q+a[0]+G+O$[0]+(u/4294967296>>>0)>>>0,J[S$][1]=u>>>0;L=$[0][0],A=$[0][1],D=$[1][0],S=$[1][1],B=$[2][0],C=$[2][1],w=$[3][0],P=$[3][1],l=$[4][0],e=$[4][1],y=$[5][0],n=$[5][1],Y$=$[6][0],L$=$[6][1],j$=$[7][0],QJ=$[7][1];for(S$=0;S$<80;++S$)O=((l>>>14|e<<18)^(l>>>18|e<<14)^(e>>>9|l<<23))>>>0,V=((l<<18|e>>>14)^(l<<14|e>>>18)^(e<<23|l>>>9))>>>0,q=(Y$^l&(y^Y$))>>>0,H=(L$^e&(n^L$))>>>0,U=((L>>>28|A<<4)^(A>>>2|L<<30)^(A>>>7|L<<25))>>>0,M=((L<<4|A>>>28)^(A<<30|L>>>2)^(A<<25|L>>>7))>>>0,N=(L&D|B&(L^D))>>>0,K=(A&S|C&(A^S))>>>0,u=QJ+V+H+k8[S$][1]+J[S$][1],Q=j$+O+q+k8[S$][0]+J[S$][0]+(u/4294967296>>>0)>>>0,Y=u>>>0,u=M+K,G=U+N+(u/4294967296>>>0)>>>0,W=u>>>0,j$=Y$,QJ=L$,Y$=y,L$=n,y=l,n=e,u=P+Y,l=w+Q+(u/4294967296>>>0)>>>0,e=u>>>0,w=B,P=C,B=D,C=S,D=L,S=A,u=Y+W,L=Q+G+(u/4294967296>>>0)>>>0,A=u>>>0;u=$[0][1]+A,$[0][0]=$[0][0]+L+(u/4294967296>>>0)>>>0,$[0][1]=u>>>0,u=$[1][1]+S,$[1][0]=$[1][0]+D+(u/4294967296>>>0)>>>0,$[1][1]=u>>>0,u=$[2][1]+C,$[2][0]=$[2][0]+B+(u/4294967296>>>0)>>>0,$[2][1]=u>>>0,u=$[3][1]+P,$[3][0]=$[3][0]+w+(u/4294967296>>>0)>>>0,$[3][1]=u>>>0,u=$[4][1]+e,$[4][0]=$[4][0]+l+(u/4294967296>>>0)>>>0,$[4][1]=u>>>0,u=$[5][1]+n,$[5][0]=$[5][0]+y+(u/4294967296>>>0)>>>0,$[5][1]=u>>>0,u=$[6][1]+L$,$[6][0]=$[6][0]+Y$+(u/4294967296>>>0)>>>0,$[6][1]=u>>>0,u=$[7][1]+QJ,$[7][0]=$[7][0]+j$+(u/4294967296>>>0)>>>0,$[7][1]=u>>>0,$$-=128}}});var UW=q$((Aq)=>{var Lq=F$();mJ();var qJ=Lq.asn1;Aq.privateKeyValidator={name:"PrivateKeyInfo",tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]};Aq.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{tagClass:qJ.Class.UNIVERSAL,type:qJ.Type.BITSTRING,constructed:!1,composed:!0,captureBitStringValue:"ed25519PublicKey"}]}});var AW=q$((oF,LW)=>{var zJ=F$();TX();_J();f8();_$();var HW=UW(),Zq=HW.publicKeyValidator,Bq=HW.privateKeyValidator;if(typeof b8>"u")b8=zJ.jsbn.BigInteger;var b8,h8=zJ.util.ByteBuffer,BJ=typeof Buffer>"u"?Uint8Array:Buffer;zJ.pki=zJ.pki||{};LW.exports=zJ.pki.ed25519=zJ.ed25519=zJ.ed25519||{};var Z$=zJ.ed25519;Z$.constants={};Z$.constants.PUBLIC_KEY_BYTE_LENGTH=32;Z$.constants.PRIVATE_KEY_BYTE_LENGTH=64;Z$.constants.SEED_BYTE_LENGTH=32;Z$.constants.SIGN_BYTE_LENGTH=64;Z$.constants.HASH_BYTE_LENGTH=64;Z$.generateKeyPair=function($){$=$||{};var J=$.seed;if(J===void 0)J=zJ.random.getBytesSync(Z$.constants.SEED_BYTE_LENGTH);else if(typeof J==="string"){if(J.length!==Z$.constants.SEED_BYTE_LENGTH)throw TypeError('"seed" must be '+Z$.constants.SEED_BYTE_LENGTH+" bytes in length.")}else if(!(J instanceof Uint8Array))throw TypeError('"seed" must be a node.js Buffer, Uint8Array, or a binary string.');J=R0({message:J,encoding:"binary"});var X=new BJ(Z$.constants.PUBLIC_KEY_BYTE_LENGTH),Q=new BJ(Z$.constants.PRIVATE_KEY_BYTE_LENGTH);for(var Y=0;Y<32;++Y)Q[Y]=J[Y];return Iq(X,Q),{publicKey:X,privateKey:Q}};Z$.privateKeyFromAsn1=function($){var J={},X=[],Q=zJ.asn1.validate($,Bq,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=zJ.asn1.derToOid(J.privateKeyOid),W=zJ.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var U=J.privateKey,M=R0({message:zJ.asn1.fromDer(U).value,encoding:"binary"});return{privateKeyBytes:M}};Z$.publicKeyFromAsn1=function($){var J={},X=[],Q=zJ.asn1.validate($,Zq,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=zJ.asn1.derToOid(J.publicKeyOid),W=zJ.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var U=J.ed25519PublicKey;if(U.length!==Z$.constants.PUBLIC_KEY_BYTE_LENGTH)throw Error("Key length is invalid.");return R0({message:U,encoding:"binary"})};Z$.publicKeyFromPrivateKey=function($){$=$||{};var J=R0({message:$.privateKey,encoding:"binary"});if(J.length!==Z$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Z$.constants.PRIVATE_KEY_BYTE_LENGTH);var X=new BJ(Z$.constants.PUBLIC_KEY_BYTE_LENGTH);for(var Q=0;Q<X.length;++Q)X[Q]=J[32+Q];return X};Z$.sign=function($){$=$||{};var J=R0($),X=R0({message:$.privateKey,encoding:"binary"});if(X.length===Z$.constants.SEED_BYTE_LENGTH){var Q=Z$.generateKeyPair({seed:X});X=Q.privateKey}else if(X.length!==Z$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Z$.constants.SEED_BYTE_LENGTH+" or "+Z$.constants.PRIVATE_KEY_BYTE_LENGTH);var Y=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length);Cq(Y,J,J.length,X);var G=new BJ(Z$.constants.SIGN_BYTE_LENGTH);for(var W=0;W<G.length;++W)G[W]=Y[W];return G};Z$.verify=function($){$=$||{};var J=R0($);if($.signature===void 0)throw TypeError('"options.signature" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a binary string.');var X=R0({message:$.signature,encoding:"binary"});if(X.length!==Z$.constants.SIGN_BYTE_LENGTH)throw TypeError('"options.signature" must have a byte length of '+Z$.constants.SIGN_BYTE_LENGTH);var Q=R0({message:$.publicKey,encoding:"binary"});if(Q.length!==Z$.constants.PUBLIC_KEY_BYTE_LENGTH)throw TypeError('"options.publicKey" must have a byte length of '+Z$.constants.PUBLIC_KEY_BYTE_LENGTH);var Y=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length),G=new BJ(Z$.constants.SIGN_BYTE_LENGTH+J.length),W;for(W=0;W<Z$.constants.SIGN_BYTE_LENGTH;++W)Y[W]=X[W];for(W=0;W<J.length;++W)Y[W+Z$.constants.SIGN_BYTE_LENGTH]=J[W];return wq(G,Y,Y.length,Q)>=0};function R0($){var J=$.message;if(J instanceof Uint8Array||J instanceof BJ)return J;var X=$.encoding;if(J===void 0)if($.md)J=$.md.digest().getBytes(),X="binary";else throw TypeError('"options.message" or "options.md" not specified.');if(typeof J==="string"&&!X)throw TypeError('"options.encoding" must be "binary" or "utf8".');if(typeof J==="string"){if(typeof Buffer<"u")return Buffer.from(J,X);J=new h8(J,X)}else if(!(J instanceof h8))throw TypeError('"options.message" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a string with "options.encoding" specifying its encoding.');var Q=new BJ(J.length());for(var Y=0;Y<Q.length;++Y)Q[Y]=J.at(Y);return Q}var u8=U$(),dY=U$([1]),jq=U$([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),Tq=U$([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),MW=U$([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),OW=U$([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),_X=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]),Sq=U$([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function xX($,J){var X=zJ.md.sha512.create(),Q=new h8($);X.update(Q.getBytes(J),"binary");var Y=X.digest().getBytes();if(typeof Buffer<"u")return Buffer.from(Y,"binary");var G=new BJ(Z$.constants.HASH_BYTE_LENGTH);for(var W=0;W<64;++W)G[W]=Y.charCodeAt(W);return G}function Iq($,J){var X=[U$(),U$(),U$(),U$()],Q,Y=xX(J,32);Y[0]&=248,Y[31]&=127,Y[31]|=64,p8(X,Y),l8($,X);for(Q=0;Q<32;++Q)J[Q+32]=$[Q];return 0}function Cq($,J,X,Q){var Y,G,W=new Float64Array(64),U=[U$(),U$(),U$(),U$()],M=xX(Q,32);M[0]&=248,M[31]&=127,M[31]|=64;var O=X+64;for(Y=0;Y<X;++Y)$[64+Y]=J[Y];for(Y=0;Y<32;++Y)$[32+Y]=M[32+Y];var V=xX($.subarray(32),X+32);g8(V),p8(U,V),l8($,U);for(Y=32;Y<64;++Y)$[Y]=Q[Y];var q=xX($,X+64);g8(q);for(Y=32;Y<64;++Y)W[Y]=0;for(Y=0;Y<32;++Y)W[Y]=V[Y];for(Y=0;Y<32;++Y)for(G=0;G<32;G++)W[Y+G]+=q[Y]*M[G];return KW($.subarray(32),W),O}function wq($,J,X,Q){var Y,G,W=new BJ(32),U=[U$(),U$(),U$(),U$()],M=[U$(),U$(),U$(),U$()];if(G=-1,X<64)return-1;if(_q(M,Q))return-1;if(!Pq(J,32))return-1;for(Y=0;Y<X;++Y)$[Y]=J[Y];for(Y=0;Y<32;++Y)$[Y+32]=Q[Y];var O=xX($,X);if(g8(O),FW(U,M,O),p8(M,J.subarray(32)),m8(U,M),l8(W,U),X-=64,zW(J,0,W,0)){for(Y=0;Y<X;++Y)$[Y]=0;return-1}for(Y=0;Y<X;++Y)$[Y]=J[Y+64];return G=X,G}function Pq($,J){var X;for(X=31;X>=0;--X){if($[J+X]<_X[X])return!0;if($[J+X]>_X[X])return!1}return!1}function KW($,J){var X,Q,Y,G;for(Q=63;Q>=32;--Q){X=0;for(Y=Q-32,G=Q-12;Y<G;++Y)J[Y]+=X-16*J[Q]*_X[Y-(Q-32)],X=J[Y]+128>>8,J[Y]-=X*256;J[Y]+=X,J[Q]=0}X=0;for(Y=0;Y<32;++Y)J[Y]+=X-(J[31]>>4)*_X[Y],X=J[Y]>>8,J[Y]&=255;for(Y=0;Y<32;++Y)J[Y]-=X*_X[Y];for(Q=0;Q<32;++Q)J[Q+1]+=J[Q]>>8,$[Q]=J[Q]&255}function g8($){var J=new Float64Array(64);for(var X=0;X<64;++X)J[X]=$[X],$[X]=0;KW($,J)}function m8($,J){var X=U$(),Q=U$(),Y=U$(),G=U$(),W=U$(),U=U$(),M=U$(),O=U$(),V=U$();fQ(X,$[1],$[0]),fQ(V,J[1],J[0]),u$(X,X,V),kQ(Q,$[0],$[1]),kQ(V,J[0],J[1]),u$(Q,Q,V),u$(Y,$[3],J[3]),u$(Y,Y,Tq),u$(G,$[2],J[2]),kQ(G,G,G),fQ(W,Q,X),fQ(U,G,Y),kQ(M,G,Y),kQ(O,Q,X),u$($[0],W,U),u$($[1],O,M),u$($[2],M,U),u$($[3],W,O)}function VW($,J,X){for(var Q=0;Q<4;++Q)NW($[Q],J[Q],X)}function l8($,J){var X=U$(),Q=U$(),Y=U$();fq(Y,J[2]),u$(X,J[0],Y),u$(Q,J[1],Y),cY($,Q),$[31]^=EW(X)<<7}function cY($,J){var X,Q,Y,G=U$(),W=U$();for(X=0;X<16;++X)W[X]=J[X];y8(W),y8(W),y8(W);for(Q=0;Q<2;++Q){G[0]=W[0]-65517;for(X=1;X<15;++X)G[X]=W[X]-65535-(G[X-1]>>16&1),G[X-1]&=65535;G[15]=W[15]-32767-(G[14]>>16&1),Y=G[15]>>16&1,G[14]&=65535,NW(W,G,1-Y)}for(X=0;X<16;X++)$[2*X]=W[X]&255,$[2*X+1]=W[X]>>8}function _q($,J){var X=U$(),Q=U$(),Y=U$(),G=U$(),W=U$(),U=U$(),M=U$();if(h0($[2],dY),xq($[1],J),OQ(Y,$[1]),u$(G,Y,jq),fQ(Y,Y,$[2]),kQ(G,$[2],G),OQ(W,G),OQ(U,W),u$(M,U,W),u$(X,M,Y),u$(X,X,G),vq(X,X),u$(X,X,Y),u$(X,X,G),u$(X,X,G),u$($[0],X,G),OQ(Q,$[0]),u$(Q,Q,G),qW(Q,Y))u$($[0],$[0],Sq);if(OQ(Q,$[0]),u$(Q,Q,G),qW(Q,Y))return-1;if(EW($[0])===J[31]>>7)fQ($[0],u8,$[0]);return u$($[3],$[0],$[1]),0}function xq($,J){var X;for(X=0;X<16;++X)$[X]=J[2*X]+(J[2*X+1]<<8);$[15]&=32767}function vq($,J){var X=U$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=250;Q>=0;--Q)if(OQ(X,X),Q!==1)u$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function qW($,J){var X=new BJ(32),Q=new BJ(32);return cY(X,$),cY(Q,J),zW(X,0,Q,0)}function zW($,J,X,Q){return kq($,J,X,Q,32)}function kq($,J,X,Q,Y){var G,W=0;for(G=0;G<Y;++G)W|=$[J+G]^X[Q+G];return(1&W-1>>>8)-1}function EW($){var J=new BJ(32);return cY(J,$),J[0]&1}function FW($,J,X){var Q,Y;h0($[0],u8),h0($[1],dY),h0($[2],dY),h0($[3],u8);for(Y=255;Y>=0;--Y)Q=X[Y/8|0]>>(Y&7)&1,VW($,J,Q),m8(J,$),m8($,$),VW($,J,Q)}function p8($,J){var X=[U$(),U$(),U$(),U$()];h0(X[0],MW),h0(X[1],OW),h0(X[2],dY),u$(X[3],MW,OW),FW($,X,J)}function h0($,J){var X;for(X=0;X<16;X++)$[X]=J[X]|0}function fq($,J){var X=U$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=253;Q>=0;--Q)if(OQ(X,X),Q!==2&&Q!==4)u$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function y8($){var J,X,Q=1;for(J=0;J<16;++J)X=$[J]+Q+65535,Q=Math.floor(X/65536),$[J]=X-Q*65536;$[0]+=Q-1+37*(Q-1)}function NW($,J,X){var Q,Y=~(X-1);for(var G=0;G<16;++G)Q=Y&($[G]^J[G]),$[G]^=Q,J[G]^=Q}function U$($){var J,X=new Float64Array(16);if($)for(J=0;J<$.length;++J)X[J]=$[J];return X}function kQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]+X[Q]}function fQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]-X[Q]}function OQ($,J){u$($,J,J)}function u$($,J,X){var Q,Y,G=0,W=0,U=0,M=0,O=0,V=0,q=0,H=0,N=0,K=0,L=0,A=0,D=0,S=0,B=0,C=0,w=0,P=0,l=0,e=0,y=0,n=0,Y$=0,L$=0,j$=0,QJ=0,S$=0,h$=0,u=0,J$=0,a=0,V$=X[0],O$=X[1],$$=X[2],P$=X[3],G$=X[4],c$=X[5],x$=X[6],E$=X[7],n$=X[8],y$=X[9],e$=X[10],GJ=X[11],WJ=X[12],s$=X[13],b$=X[14],i$=X[15];Q=J[0],G+=Q*V$,W+=Q*O$,U+=Q*$$,M+=Q*P$,O+=Q*G$,V+=Q*c$,q+=Q*x$,H+=Q*E$,N+=Q*n$,K+=Q*y$,L+=Q*e$,A+=Q*GJ,D+=Q*WJ,S+=Q*s$,B+=Q*b$,C+=Q*i$,Q=J[1],W+=Q*V$,U+=Q*O$,M+=Q*$$,O+=Q*P$,V+=Q*G$,q+=Q*c$,H+=Q*x$,N+=Q*E$,K+=Q*n$,L+=Q*y$,A+=Q*e$,D+=Q*GJ,S+=Q*WJ,B+=Q*s$,C+=Q*b$,w+=Q*i$,Q=J[2],U+=Q*V$,M+=Q*O$,O+=Q*$$,V+=Q*P$,q+=Q*G$,H+=Q*c$,N+=Q*x$,K+=Q*E$,L+=Q*n$,A+=Q*y$,D+=Q*e$,S+=Q*GJ,B+=Q*WJ,C+=Q*s$,w+=Q*b$,P+=Q*i$,Q=J[3],M+=Q*V$,O+=Q*O$,V+=Q*$$,q+=Q*P$,H+=Q*G$,N+=Q*c$,K+=Q*x$,L+=Q*E$,A+=Q*n$,D+=Q*y$,S+=Q*e$,B+=Q*GJ,C+=Q*WJ,w+=Q*s$,P+=Q*b$,l+=Q*i$,Q=J[4],O+=Q*V$,V+=Q*O$,q+=Q*$$,H+=Q*P$,N+=Q*G$,K+=Q*c$,L+=Q*x$,A+=Q*E$,D+=Q*n$,S+=Q*y$,B+=Q*e$,C+=Q*GJ,w+=Q*WJ,P+=Q*s$,l+=Q*b$,e+=Q*i$,Q=J[5],V+=Q*V$,q+=Q*O$,H+=Q*$$,N+=Q*P$,K+=Q*G$,L+=Q*c$,A+=Q*x$,D+=Q*E$,S+=Q*n$,B+=Q*y$,C+=Q*e$,w+=Q*GJ,P+=Q*WJ,l+=Q*s$,e+=Q*b$,y+=Q*i$,Q=J[6],q+=Q*V$,H+=Q*O$,N+=Q*$$,K+=Q*P$,L+=Q*G$,A+=Q*c$,D+=Q*x$,S+=Q*E$,B+=Q*n$,C+=Q*y$,w+=Q*e$,P+=Q*GJ,l+=Q*WJ,e+=Q*s$,y+=Q*b$,n+=Q*i$,Q=J[7],H+=Q*V$,N+=Q*O$,K+=Q*$$,L+=Q*P$,A+=Q*G$,D+=Q*c$,S+=Q*x$,B+=Q*E$,C+=Q*n$,w+=Q*y$,P+=Q*e$,l+=Q*GJ,e+=Q*WJ,y+=Q*s$,n+=Q*b$,Y$+=Q*i$,Q=J[8],N+=Q*V$,K+=Q*O$,L+=Q*$$,A+=Q*P$,D+=Q*G$,S+=Q*c$,B+=Q*x$,C+=Q*E$,w+=Q*n$,P+=Q*y$,l+=Q*e$,e+=Q*GJ,y+=Q*WJ,n+=Q*s$,Y$+=Q*b$,L$+=Q*i$,Q=J[9],K+=Q*V$,L+=Q*O$,A+=Q*$$,D+=Q*P$,S+=Q*G$,B+=Q*c$,C+=Q*x$,w+=Q*E$,P+=Q*n$,l+=Q*y$,e+=Q*e$,y+=Q*GJ,n+=Q*WJ,Y$+=Q*s$,L$+=Q*b$,j$+=Q*i$,Q=J[10],L+=Q*V$,A+=Q*O$,D+=Q*$$,S+=Q*P$,B+=Q*G$,C+=Q*c$,w+=Q*x$,P+=Q*E$,l+=Q*n$,e+=Q*y$,y+=Q*e$,n+=Q*GJ,Y$+=Q*WJ,L$+=Q*s$,j$+=Q*b$,QJ+=Q*i$,Q=J[11],A+=Q*V$,D+=Q*O$,S+=Q*$$,B+=Q*P$,C+=Q*G$,w+=Q*c$,P+=Q*x$,l+=Q*E$,e+=Q*n$,y+=Q*y$,n+=Q*e$,Y$+=Q*GJ,L$+=Q*WJ,j$+=Q*s$,QJ+=Q*b$,S$+=Q*i$,Q=J[12],D+=Q*V$,S+=Q*O$,B+=Q*$$,C+=Q*P$,w+=Q*G$,P+=Q*c$,l+=Q*x$,e+=Q*E$,y+=Q*n$,n+=Q*y$,Y$+=Q*e$,L$+=Q*GJ,j$+=Q*WJ,QJ+=Q*s$,S$+=Q*b$,h$+=Q*i$,Q=J[13],S+=Q*V$,B+=Q*O$,C+=Q*$$,w+=Q*P$,P+=Q*G$,l+=Q*c$,e+=Q*x$,y+=Q*E$,n+=Q*n$,Y$+=Q*y$,L$+=Q*e$,j$+=Q*GJ,QJ+=Q*WJ,S$+=Q*s$,h$+=Q*b$,u+=Q*i$,Q=J[14],B+=Q*V$,C+=Q*O$,w+=Q*$$,P+=Q*P$,l+=Q*G$,e+=Q*c$,y+=Q*x$,n+=Q*E$,Y$+=Q*n$,L$+=Q*y$,j$+=Q*e$,QJ+=Q*GJ,S$+=Q*WJ,h$+=Q*s$,u+=Q*b$,J$+=Q*i$,Q=J[15],C+=Q*V$,w+=Q*O$,P+=Q*$$,l+=Q*P$,e+=Q*G$,y+=Q*c$,n+=Q*x$,Y$+=Q*E$,L$+=Q*n$,j$+=Q*y$,QJ+=Q*e$,S$+=Q*GJ,h$+=Q*WJ,u+=Q*s$,J$+=Q*b$,a+=Q*i$,G+=38*w,W+=38*P,U+=38*l,M+=38*e,O+=38*y,V+=38*n,q+=38*Y$,H+=38*L$,N+=38*j$,K+=38*QJ,L+=38*S$,A+=38*h$,D+=38*u,S+=38*J$,B+=38*a,Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=N+Y+65535,Y=Math.floor(Q/65536),N=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=D+Y+65535,Y=Math.floor(Q/65536),D=Q-Y*65536,Q=S+Y+65535,Y=Math.floor(Q/65536),S=Q-Y*65536,Q=B+Y+65535,Y=Math.floor(Q/65536),B=Q-Y*65536,Q=C+Y+65535,Y=Math.floor(Q/65536),C=Q-Y*65536,G+=Y-1+37*(Y-1),Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=N+Y+65535,Y=Math.floor(Q/65536),N=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=D+Y+65535,Y=Math.floor(Q/65536),D=Q-Y*65536,Q=S+Y+65535,Y=Math.floor(Q/65536),S=Q-Y*65536,Q=B+Y+65535,Y=Math.floor(Q/65536),B=Q-Y*65536,Q=C+Y+65535,Y=Math.floor(Q/65536),C=Q-Y*65536,G+=Y-1+37*(Y-1),$[0]=G,$[1]=W,$[2]=U,$[3]=M,$[4]=O,$[5]=V,$[6]=q,$[7]=H,$[8]=N,$[9]=K,$[10]=L,$[11]=A,$[12]=D,$[13]=S,$[14]=B,$[15]=C}});var BW=q$((aF,ZW)=>{var IJ=F$();_$();_J();TX();ZW.exports=IJ.kem=IJ.kem||{};var RW=IJ.jsbn.BigInteger;IJ.kem.rsa={};IJ.kem.rsa.create=function($,J){J=J||{};var X=J.prng||IJ.random,Q={};return Q.encrypt=function(Y,G){var W=Math.ceil(Y.n.bitLength()/8),U;do U=new RW(IJ.util.bytesToHex(X.getBytesSync(W)),16).mod(Y.n);while(U.compareTo(RW.ONE)<=0);U=IJ.util.hexToBytes(U.toString(16));var M=W-U.length;if(M>0)U=IJ.util.fillString(String.fromCharCode(0),M)+U;var O=Y.encrypt(U,"NONE"),V=$.generate(U,G);return{encapsulation:O,key:V}},Q.decrypt=function(Y,G,W){var U=Y.decrypt(G,"NONE");return $.generate(U,W)},Q};IJ.kem.kdf1=function($,J){DW(this,$,0,J||$.digestLength)};IJ.kem.kdf2=function($,J){DW(this,$,1,J||$.digestLength)};function DW($,J,X,Q){$.generate=function(Y,G){var W=new IJ.util.ByteBuffer,U=Math.ceil(G/Q)+X,M=new IJ.util.ByteBuffer;for(var O=X;O<U;++O){M.putInt32(O),J.start(),J.update(Y+M.getBytes());var V=J.digest();W.putBytes(V.getBytes(Q))}return W.truncate(W.length()-G),W.getBytes()}}});var TW=q$((sF,jW)=>{var T$=F$();_$();jW.exports=T$.log=T$.log||{};T$.log.levels=["none","error","warning","info","debug","verbose","max"];var oY={},d8=[],vX=null;T$.log.LEVEL_LOCKED=2;T$.log.NO_LEVEL_CHECK=4;T$.log.INTERPOLATE=8;for(bJ=0;bJ<T$.log.levels.length;++bJ)nY=T$.log.levels[bJ],oY[nY]={index:bJ,name:nY.toUpperCase()};var nY,bJ;T$.log.logMessage=function($){var J=oY[$.level].index;for(var X=0;X<d8.length;++X){var Q=d8[X];if(Q.flags&T$.log.NO_LEVEL_CHECK)Q.f($);else{var Y=oY[Q.level].index;if(J<=Y)Q.f(Q,$)}}};T$.log.prepareStandard=function($){if(!("standard"in $))$.standard=oY[$.level].name+" ["+$.category+"] "+$.message};T$.log.prepareFull=function($){if(!("full"in $)){var J=[$.message];J=J.concat([]),$.full=T$.util.format.apply(this,J)}};T$.log.prepareStandardFull=function($){if(!("standardFull"in $))T$.log.prepareStandard($),$.standardFull=$.standard};iY=["error","warning","info","debug","verbose"];for(bJ=0;bJ<iY.length;++bJ)(function(J){T$.log[J]=function(X,Q){var Y=Array.prototype.slice.call(arguments).slice(2),G={timestamp:new Date,level:J,category:X,message:Q,arguments:Y};T$.log.logMessage(G)}})(iY[bJ]);var iY,bJ;T$.log.makeLogger=function($){var J={flags:0,f:$};return T$.log.setLevel(J,"none"),J};T$.log.setLevel=function($,J){var X=!1;if($&&!($.flags&T$.log.LEVEL_LOCKED))for(var Q=0;Q<T$.log.levels.length;++Q){var Y=T$.log.levels[Q];if(J==Y){$.level=J,X=!0;break}}return X};T$.log.lock=function($,J){if(typeof J>"u"||J)$.flags|=T$.log.LEVEL_LOCKED;else $.flags&=~T$.log.LEVEL_LOCKED};T$.log.addLogger=function($){d8.push($)};if(typeof console<"u"&&"log"in console){if(console.error&&console.warn&&console.info&&console.debug)c8={error:console.error,warning:console.warn,info:console.info,debug:console.debug,verbose:console.debug},bQ=function($,J){T$.log.prepareStandard(J);var X=c8[J.level],Q=[J.standard];Q=Q.concat(J.arguments.slice()),X.apply(console,Q)},VQ=T$.log.makeLogger(bQ);else bQ=function(J,X){T$.log.prepareStandardFull(X),console.log(X.standardFull)},VQ=T$.log.makeLogger(bQ);T$.log.setLevel(VQ,"debug"),T$.log.addLogger(VQ),vX=VQ}else console={log:function(){}};var VQ,c8,bQ;if(vX!==null&&typeof window<"u"&&window.location){if(yQ=new URL(window.location.href).searchParams,yQ.has("console.level"))T$.log.setLevel(vX,yQ.get("console.level").slice(-1)[0]);if(yQ.has("console.lock")){if(n8=yQ.get("console.lock").slice(-1)[0],n8=="true")T$.log.lock(vX)}}var yQ,n8;T$.log.consoleLogger=vX});var IW=q$((rF,SW)=>{SW.exports=$0();SY();wQ();G8();f8()});var PW=q$((tF,wW)=>{var p=F$();P0();mJ();BX();_0();QQ();R8();_J();_$();gY();var j=p.asn1,DJ=wW.exports=p.pkcs7=p.pkcs7||{};DJ.messageFromPem=function($){var J=p.pem.decode($)[0];if(J.type!=="PKCS7"){var X=Error('Could not convert PKCS#7 message from PEM; PEM header type is not "PKCS#7".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PKCS#7 message from PEM; PEM is encrypted.");var Q=j.fromDer(J.body);return DJ.messageFromAsn1(Q)};DJ.messageToPem=function($,J){var X={type:"PKCS7",body:j.toDer($.toAsn1()).getBytes()};return p.pem.encode(X,{maxline:J})};DJ.messageFromAsn1=function($){var J={},X=[];if(!j.validate($,DJ.asn1.contentInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 message. ASN.1 object is not an PKCS#7 ContentInfo.");throw Q.errors=X,Q}var Y=j.derToOid(J.contentType),G;switch(Y){case p.pki.oids.envelopedData:G=DJ.createEnvelopedData();break;case p.pki.oids.encryptedData:G=DJ.createEncryptedData();break;case p.pki.oids.signedData:G=DJ.createSignedData();break;default:throw Error("Cannot read PKCS#7 message. ContentType with OID "+Y+" is not (yet) supported.")}return G.fromAsn1(J.content.value[0]),G};DJ.createSignedData=function(){var $=null;return $={type:p.pki.oids.signedData,version:1,certificates:[],crls:[],signers:[],digestAlgorithmIdentifiers:[],contentInfo:null,signerInfos:[],fromAsn1:function(Q){if(o8($,Q,DJ.asn1.signedDataValidator),$.certificates=[],$.crls=[],$.digestAlgorithmIdentifiers=[],$.contentInfo=null,$.signerInfos=[],$.rawCapture.certificates){var Y=$.rawCapture.certificates.value;for(var G=0;G<Y.length;++G)$.certificates.push(p.pki.certificateFromAsn1(Y[G]))}},toAsn1:function(){if(!$.contentInfo)$.sign();var Q=[];for(var Y=0;Y<$.certificates.length;++Y)Q.push(p.pki.certificateToAsn1($.certificates[Y]));var G=[],W=j.create(j.Class.CONTEXT_SPECIFIC,0,!0,[j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.INTEGER,!1,j.integerToDer($.version).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.SET,!0,$.digestAlgorithmIdentifiers),$.contentInfo])]);if(Q.length>0)W.value[0].value.push(j.create(j.Class.CONTEXT_SPECIFIC,0,!0,Q));if(G.length>0)W.value[0].value.push(j.create(j.Class.CONTEXT_SPECIFIC,1,!0,G));return W.value[0].value.push(j.create(j.Class.UNIVERSAL,j.Type.SET,!0,$.signerInfos)),j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer($.type).getBytes()),W])},addSigner:function(Q){var{issuer:Y,serialNumber:G}=Q;if(Q.certificate){var W=Q.certificate;if(typeof W==="string")W=p.pki.certificateFromPem(W);Y=W.issuer.attributes,G=W.serialNumber}var U=Q.key;if(!U)throw Error("Could not add PKCS#7 signer; no private key specified.");if(typeof U==="string")U=p.pki.privateKeyFromPem(U);var M=Q.digestAlgorithm||p.pki.oids.sha1;switch(M){case p.pki.oids.sha1:case p.pki.oids.sha256:case p.pki.oids.sha384:case p.pki.oids.sha512:case p.pki.oids.md5:break;default:throw Error("Could not add PKCS#7 signer; unknown message digest algorithm: "+M)}var O=Q.authenticatedAttributes||[];if(O.length>0){var V=!1,q=!1;for(var H=0;H<O.length;++H){var N=O[H];if(!V&&N.type===p.pki.oids.contentType){if(V=!0,q)break;continue}if(!q&&N.type===p.pki.oids.messageDigest){if(q=!0,V)break;continue}}if(!V||!q)throw Error("Invalid signer.authenticatedAttributes. If signer.authenticatedAttributes is specified, then it must contain at least two attributes, PKCS #9 content-type and PKCS #9 message-digest.")}$.signers.push({key:U,version:1,issuer:Y,serialNumber:G,digestAlgorithm:M,signatureAlgorithm:p.pki.oids.rsaEncryption,signature:null,authenticatedAttributes:O,unauthenticatedAttributes:[]})},sign:function(Q){if(Q=Q||{},typeof $.content!=="object"||$.contentInfo===null){if($.contentInfo=j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer(p.pki.oids.data).getBytes())]),"content"in $){var Y;if($.content instanceof p.util.ByteBuffer)Y=$.content.bytes();else if(typeof $.content==="string")Y=p.util.encodeUtf8($.content);if(Q.detached)$.detachedContent=j.create(j.Class.UNIVERSAL,j.Type.OCTETSTRING,!1,Y);else $.contentInfo.value.push(j.create(j.Class.CONTEXT_SPECIFIC,0,!0,[j.create(j.Class.UNIVERSAL,j.Type.OCTETSTRING,!1,Y)]))}}if($.signers.length===0)return;var G=J();X(G)},verify:function(){throw Error("PKCS#7 signature verification not yet implemented.")},addCertificate:function(Q){if(typeof Q==="string")Q=p.pki.certificateFromPem(Q);$.certificates.push(Q)},addCertificateRevokationList:function(Q){throw Error("PKCS#7 CRL support not yet implemented.")}},$;function J(){var Q={};for(var Y=0;Y<$.signers.length;++Y){var G=$.signers[Y],W=G.digestAlgorithm;if(!(W in Q))Q[W]=p.md[p.pki.oids[W]].create();if(G.authenticatedAttributes.length===0)G.md=Q[W];else G.md=p.md[p.pki.oids[W]].create()}$.digestAlgorithmIdentifiers=[];for(var W in Q)$.digestAlgorithmIdentifiers.push(j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer(W).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.NULL,!1,"")]));return Q}function X(Q){var Y;if($.detachedContent)Y=$.detachedContent;else Y=$.contentInfo.value[1],Y=Y.value[0];if(!Y)throw Error("Could not sign PKCS#7 message; there is no content to sign.");var G=j.derToOid($.contentInfo.value[0].value),W=j.toDer(Y);W.getByte(),j.getBerValueLength(W),W=W.getBytes();for(var U in Q)Q[U].start().update(W);var M=new Date;for(var O=0;O<$.signers.length;++O){var V=$.signers[O];if(V.authenticatedAttributes.length===0){if(G!==p.pki.oids.data)throw Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.")}else{V.authenticatedAttributesAsn1=j.create(j.Class.CONTEXT_SPECIFIC,0,!0,[]);var q=j.create(j.Class.UNIVERSAL,j.Type.SET,!0,[]);for(var H=0;H<V.authenticatedAttributes.length;++H){var N=V.authenticatedAttributes[H];if(N.type===p.pki.oids.messageDigest)N.value=Q[V.digestAlgorithm].digest();else if(N.type===p.pki.oids.signingTime){if(!N.value)N.value=M}q.value.push(i8(N)),V.authenticatedAttributesAsn1.value.push(i8(N))}W=j.toDer(q).getBytes(),V.md.start().update(W)}V.signature=V.key.sign(V.md,"RSASSA-PKCS1-V1_5")}$.signerInfos=mq($.signers)}};DJ.createEncryptedData=function(){var $=null;return $={type:p.pki.oids.encryptedData,version:0,encryptedContent:{algorithm:p.pki.oids["aes256-CBC"]},fromAsn1:function(J){o8($,J,DJ.asn1.encryptedDataValidator)},decrypt:function(J){if(J!==void 0)$.encryptedContent.key=J;CW($)}},$};DJ.createEnvelopedData=function(){var $=null;return $={type:p.pki.oids.envelopedData,version:0,recipients:[],encryptedContent:{algorithm:p.pki.oids["aes256-CBC"]},fromAsn1:function(J){var X=o8($,J,DJ.asn1.envelopedDataValidator);$.recipients=hq(X.recipientInfos.value)},toAsn1:function(){return j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer($.type).getBytes()),j.create(j.Class.CONTEXT_SPECIFIC,0,!0,[j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.INTEGER,!1,j.integerToDer($.version).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.SET,!0,uq($.recipients)),j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,lq($.encryptedContent))])])])},findRecipient:function(J){var X=J.issuer.attributes;for(var Q=0;Q<$.recipients.length;++Q){var Y=$.recipients[Q],G=Y.issuer;if(Y.serialNumber!==J.serialNumber)continue;if(G.length!==X.length)continue;var W=!0;for(var U=0;U<X.length;++U)if(G[U].type!==X[U].type||G[U].value!==X[U].value){W=!1;break}if(W)return Y}return null},decrypt:function(J,X){if($.encryptedContent.key===void 0&&J!==void 0&&X!==void 0)switch(J.encryptedContent.algorithm){case p.pki.oids.rsaEncryption:case p.pki.oids.desCBC:var Q=X.decrypt(J.encryptedContent.content);$.encryptedContent.key=p.util.createBuffer(Q);break;default:throw Error("Unsupported asymmetric cipher, OID "+J.encryptedContent.algorithm)}CW($)},addRecipient:function(J){$.recipients.push({version:0,issuer:J.issuer.attributes,serialNumber:J.serialNumber,encryptedContent:{algorithm:p.pki.oids.rsaEncryption,key:J.publicKey}})},encrypt:function(J,X){if($.encryptedContent.content===void 0){X=X||$.encryptedContent.algorithm,J=J||$.encryptedContent.key;var Q,Y,G;switch(X){case p.pki.oids["aes128-CBC"]:Q=16,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["aes192-CBC"]:Q=24,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["aes256-CBC"]:Q=32,Y=16,G=p.aes.createEncryptionCipher;break;case p.pki.oids["des-EDE3-CBC"]:Q=24,Y=8,G=p.des.createEncryptionCipher;break;default:throw Error("Unsupported symmetric cipher, OID "+X)}if(J===void 0)J=p.util.createBuffer(p.random.getBytes(Q));else if(J.length()!=Q)throw Error("Symmetric key has wrong length; got "+J.length()+" bytes, expected "+Q+".");$.encryptedContent.algorithm=X,$.encryptedContent.key=J,$.encryptedContent.parameter=p.util.createBuffer(p.random.getBytes(Y));var W=G(J);if(W.start($.encryptedContent.parameter.copy()),W.update($.content),!W.finish())throw Error("Symmetric encryption failed.");$.encryptedContent.content=W.output}for(var U=0;U<$.recipients.length;++U){var M=$.recipients[U];if(M.encryptedContent.content!==void 0)continue;switch(M.encryptedContent.algorithm){case p.pki.oids.rsaEncryption:M.encryptedContent.content=M.encryptedContent.key.encrypt($.encryptedContent.key.data);break;default:throw Error("Unsupported asymmetric cipher, OID "+M.encryptedContent.algorithm)}}}},$};function yq($){var J={},X=[];if(!j.validate($,DJ.asn1.recipientInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 RecipientInfo. ASN.1 object is not an PKCS#7 RecipientInfo.");throw Q.errors=X,Q}return{version:J.version.charCodeAt(0),issuer:p.pki.RDNAttributesAsArray(J.issuer),serialNumber:p.util.createBuffer(J.serial).toHex(),encryptedContent:{algorithm:j.derToOid(J.encAlgorithm),parameter:J.encParameter?J.encParameter.value:void 0,content:J.encKey}}}function bq($){return j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.INTEGER,!1,j.integerToDer($.version).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[p.pki.distinguishedNameToAsn1({attributes:$.issuer}),j.create(j.Class.UNIVERSAL,j.Type.INTEGER,!1,p.util.hexToBytes($.serialNumber))]),j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer($.encryptedContent.algorithm).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.NULL,!1,"")]),j.create(j.Class.UNIVERSAL,j.Type.OCTETSTRING,!1,$.encryptedContent.content)])}function hq($){var J=[];for(var X=0;X<$.length;++X)J.push(yq($[X]));return J}function uq($){var J=[];for(var X=0;X<$.length;++X)J.push(bq($[X]));return J}function gq($){var J=j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.INTEGER,!1,j.integerToDer($.version).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[p.pki.distinguishedNameToAsn1({attributes:$.issuer}),j.create(j.Class.UNIVERSAL,j.Type.INTEGER,!1,p.util.hexToBytes($.serialNumber))]),j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer($.digestAlgorithm).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.NULL,!1,"")])]);if($.authenticatedAttributesAsn1)J.value.push($.authenticatedAttributesAsn1);if(J.value.push(j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer($.signatureAlgorithm).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.NULL,!1,"")])),J.value.push(j.create(j.Class.UNIVERSAL,j.Type.OCTETSTRING,!1,$.signature)),$.unauthenticatedAttributes.length>0){var X=j.create(j.Class.CONTEXT_SPECIFIC,1,!0,[]);for(var Q=0;Q<$.unauthenticatedAttributes.length;++Q){var Y=$.unauthenticatedAttributes[Q];X.values.push(i8(Y))}J.value.push(X)}return J}function mq($){var J=[];for(var X=0;X<$.length;++X)J.push(gq($[X]));return J}function i8($){var J;if($.type===p.pki.oids.contentType)J=j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer($.value).getBytes());else if($.type===p.pki.oids.messageDigest)J=j.create(j.Class.UNIVERSAL,j.Type.OCTETSTRING,!1,$.value.bytes());else if($.type===p.pki.oids.signingTime){var X=new Date("1950-01-01T00:00:00Z"),Q=new Date("2050-01-01T00:00:00Z"),Y=$.value;if(typeof Y==="string"){var G=Date.parse(Y);if(!isNaN(G))Y=new Date(G);else if(Y.length===13)Y=j.utcTimeToDate(Y);else Y=j.generalizedTimeToDate(Y)}if(Y>=X&&Y<Q)J=j.create(j.Class.UNIVERSAL,j.Type.UTCTIME,!1,j.dateToUtcTime(Y));else J=j.create(j.Class.UNIVERSAL,j.Type.GENERALIZEDTIME,!1,j.dateToGeneralizedTime(Y))}return j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer($.type).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.SET,!0,[J])])}function lq($){return[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer(p.pki.oids.data).getBytes()),j.create(j.Class.UNIVERSAL,j.Type.SEQUENCE,!0,[j.create(j.Class.UNIVERSAL,j.Type.OID,!1,j.oidToDer($.algorithm).getBytes()),!$.parameter?void 0:j.create(j.Class.UNIVERSAL,j.Type.OCTETSTRING,!1,$.parameter.getBytes())]),j.create(j.Class.CONTEXT_SPECIFIC,0,!0,[j.create(j.Class.UNIVERSAL,j.Type.OCTETSTRING,!1,$.content.getBytes())])]}function o8($,J,X){var Q={},Y=[];if(!j.validate(J,X,Q,Y)){var G=Error("Cannot read PKCS#7 message. ASN.1 object is not a supported PKCS#7 message.");throw G.errors=G,G}var W=j.derToOid(Q.contentType);if(W!==p.pki.oids.data)throw Error("Unsupported PKCS#7 message. Only wrapped ContentType Data supported.");if(Q.encryptedContent){var U="";if(p.util.isArray(Q.encryptedContent))for(var M=0;M<Q.encryptedContent.length;++M){if(Q.encryptedContent[M].type!==j.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting encrypted content constructed of only OCTET STRING objects.");U+=Q.encryptedContent[M].value}else U=Q.encryptedContent;$.encryptedContent={algorithm:j.derToOid(Q.encAlgorithm),parameter:p.util.createBuffer(Q.encParameter.value),content:p.util.createBuffer(U)}}if(Q.content){var U="";if(p.util.isArray(Q.content))for(var M=0;M<Q.content.length;++M){if(Q.content[M].type!==j.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting content constructed of only OCTET STRING objects.");U+=Q.content[M].value}else U=Q.content;$.content=p.util.createBuffer(U)}return $.version=Q.version.charCodeAt(0),$.rawCapture=Q,Q}function CW($){if($.encryptedContent.key===void 0)throw Error("Symmetric key not available.");if($.content===void 0){var J;switch($.encryptedContent.algorithm){case p.pki.oids["aes128-CBC"]:case p.pki.oids["aes192-CBC"]:case p.pki.oids["aes256-CBC"]:J=p.aes.createDecryptionCipher($.encryptedContent.key);break;case p.pki.oids.desCBC:case p.pki.oids["des-EDE3-CBC"]:J=p.des.createDecryptionCipher($.encryptedContent.key);break;default:throw Error("Unsupported symmetric cipher, OID "+$.encryptedContent.algorithm)}if(J.start($.encryptedContent.parameter),J.update($.encryptedContent.content),!J.finish())throw Error("Symmetric decryption failed.");$.content=J.output}}});var xW=q$((eF,_W)=>{var YJ=F$();P0();TQ();SY();wQ();_$();var sY=_W.exports=YJ.ssh=YJ.ssh||{};sY.privateKeyToPutty=function($,J,X){X=X||"",J=J||"";var Q="ssh-rsa",Y=J===""?"none":"aes256-cbc",G="PuTTY-User-Key-File-2: "+Q+`\r
 `;G+="Encryption: "+Y+`\r
 `,G+="Comment: "+X+`\r
 `;var W=YJ.util.createBuffer();hQ(W,Q),M0(W,$.e),M0(W,$.n);var U=YJ.util.encode64(W.bytes(),64),M=Math.floor(U.length/66)+1;G+="Public-Lines: "+M+`\r
-`,G+=U;var O=YJ.util.createBuffer();M0(O,$.d),M0(O,$.p),M0(O,$.q),M0(O,$.qInv);var V;if(!J)V=YJ.util.encode64(O.bytes(),64);else{var H=O.length()+16-1;H-=H%16;var q=oY(O.bytes());q.truncate(q.length()-H+O.length()),O.putBuffer(q);var F=YJ.util.createBuffer();F.putBuffer(oY("\x00\x00\x00\x00",J)),F.putBuffer(oY("\x00\x00\x00\x01",J));var K=YJ.aes.createEncryptionCipher(F.truncate(8),"CBC");K.start(YJ.util.createBuffer().fillWithByte(0,16)),K.update(O.copy()),K.finish();var A=K.output;A.truncate(16),V=YJ.util.encode64(A.bytes(),64)}M=Math.floor(V.length/66)+1,G+=`\r
+`,G+=U;var O=YJ.util.createBuffer();M0(O,$.d),M0(O,$.p),M0(O,$.q),M0(O,$.qInv);var V;if(!J)V=YJ.util.encode64(O.bytes(),64);else{var q=O.length()+16-1;q-=q%16;var H=aY(O.bytes());H.truncate(H.length()-q+O.length()),O.putBuffer(H);var N=YJ.util.createBuffer();N.putBuffer(aY("\x00\x00\x00\x00",J)),N.putBuffer(aY("\x00\x00\x00\x01",J));var K=YJ.aes.createEncryptionCipher(N.truncate(8),"CBC");K.start(YJ.util.createBuffer().fillWithByte(0,16)),K.update(O.copy()),K.finish();var L=K.output;L.truncate(16),V=YJ.util.encode64(L.bytes(),64)}M=Math.floor(V.length/66)+1,G+=`\r
 Private-Lines: `+M+`\r
-`,G+=V;var L=oY("putty-private-key-file-mac-key",J),R=YJ.util.createBuffer();hQ(R,Q),hQ(R,Y),hQ(R,X),R.putInt32(W.length()),R.putBuffer(W),R.putInt32(O.length()),R.putBuffer(O);var I=YJ.hmac.create();return I.start("sha1",L),I.update(R.bytes()),G+=`\r
-Private-MAC: `+I.digest().toHex()+`\r
-`,G};aY.publicKeyToOpenSSH=function($,J){var X="ssh-rsa";J=J||"";var Q=YJ.util.createBuffer();return hQ(Q,X),M0(Q,$.e),M0(Q,$.n),X+" "+YJ.util.encode64(Q.bytes())+" "+J};aY.privateKeyToOpenSSH=function($,J){if(!J)return YJ.pki.privateKeyToPem($);return YJ.pki.encryptRsaPrivateKey($,J,{legacy:!0,algorithm:"aes128"})};aY.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||YJ.md.md5.create(),Q="ssh-rsa",Y=YJ.util.createBuffer();hQ(Y,Q),M0(Y,$.e),M0(Y,$.n),X.start(),X.update(Y.getBytes());var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};function M0($,J){var X=J.toString(16);if(X[0]>="8")X="00"+X;var Q=YJ.util.hexToBytes(X);$.putInt32(Q.length),$.putBytes(Q)}function hQ($,J){$.putInt32(J.length),$.putString(J)}function oY(){var $=YJ.md.sha1.create(),J=arguments.length;for(var X=0;X<J;++X)$.update(arguments[X]);return $.digest()}});var o8=H$((dF,PW)=>{PW.exports=F$();P0();e1();mJ();LY();ZX();FW();TQ();RW();ZW();jW();R8();wY();QQ();K8();B8();IW();T8();E8();G8();yY();_J();M8();wW();_8();_$()});var z4=H$((dN,K4)=>{var{create:yq,defineProperty:G9,getOwnPropertyDescriptor:bq,getOwnPropertyNames:hq,getPrototypeOf:uq}=Object,gq=Object.prototype.hasOwnProperty,mq=($,J)=>{for(var X in J)G9($,X,{get:J[X],enumerable:!0})},M4=($,J,X,Q)=>{if(J&&typeof J==="object"||typeof J==="function"){for(let Y of hq(J))if(!gq.call($,Y)&&Y!==X)G9($,Y,{get:()=>J[Y],enumerable:!(Q=bq(J,Y))||Q.enumerable})}return $},O4=($,J,X)=>(X=$!=null?yq(uq($)):{},M4(J||!$||!$.__esModule?G9(X,"default",{value:$,enumerable:!0}):X,$)),lq=($)=>M4(G9({},"__esModule",{value:!0}),$),V4={};mq(V4,{Socks5Server:()=>q4,createServer:()=>nq,defaultConnectionHandler:()=>N7});K4.exports=lq(V4);var pq=O4(qX("net")),H4=(($)=>{return $[$.connect=1]="connect",$[$.bind=2]="bind",$[$.udp=3]="udp",$})(H4||{}),F7=(($)=>{return $[$.REQUEST_GRANTED=0]="REQUEST_GRANTED",$[$.GENERAL_FAILURE=1]="GENERAL_FAILURE",$[$.CONNECTION_NOT_ALLOWED=2]="CONNECTION_NOT_ALLOWED",$[$.NETWORK_UNREACHABLE=3]="NETWORK_UNREACHABLE",$[$.HOST_UNREACHABLE=4]="HOST_UNREACHABLE",$[$.CONNECTION_REFUSED=5]="CONNECTION_REFUSED",$[$.TTL_EXPIRED=6]="TTL_EXPIRED",$[$.COMMAND_NOT_SUPPORTED=7]="COMMAND_NOT_SUPPORTED",$[$.ADDRESS_TYPE_NOT_SUPPORTED=8]="ADDRESS_TYPE_NOT_SUPPORTED",$})(F7||{}),dq=class{constructor($,J){this.errorHandler=()=>{},this.metadata={},this.socket=J,this.server=$,J.on("error",this.errorHandler),J.pause(),this.handleGreeting()}readBytes($){return new Promise((J)=>{let X=Buffer.allocUnsafe($),Q=0,Y=(G)=>{let W=Math.min(G.length,$-Q);if(G.copy(X,Q,0,W),Q+=W,Q<$)return;this.socket.removeListener("data",Y),this.socket.push(G.subarray(W)),J(X),this.socket.pause()};this.socket.on("data",Y),this.socket.resume()})}async handleGreeting(){if((await this.readBytes(1)).readUInt8()!==5)return this.socket.destroy();let J=(await this.readBytes(1)).readUInt8();if(J>128||J===0)return this.socket.destroy();let X=await this.readBytes(J),Q=this.server.authHandler?2:0;if(!X.includes(Q))return this.socket.write(Buffer.from([5,255])),this.socket.destroy();if(this.socket.write(Buffer.from([5,Q])),this.server.authHandler)this.handleUserPassword();else this.handleConnectionRequest()}async handleUserPassword(){await this.readBytes(1);let $=(await this.readBytes(1)).readUint8(),J=(await this.readBytes($)).toString(),X=(await this.readBytes(1)).readUint8(),Q=(await this.readBytes(X)).toString();this.username=J,this.password=Q;let Y=!1,G=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,0])),this.handleConnectionRequest()},W=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,1])),this.socket.destroy()},U=await this.server.authHandler(this,G,W);if(U===!0)G();else if(U===!1)W()}async handleConnectionRequest(){await this.readBytes(1);let $=(await this.readBytes(1))[0],J=H4[$];if(!J)return this.socket.destroy();this.command=J,await this.readBytes(1);let X=(await this.readBytes(1)).readUInt8(),Q="";switch(X){case 1:Q=(await this.readBytes(4)).join(".");break;case 3:let O=(await this.readBytes(1)).readUInt8();Q=(await this.readBytes(O)).toString();break;case 4:let V=await this.readBytes(16);for(let H=0;H<16;H++){if(H%2===0&&H>0)Q+=":";Q+=`${V[H]<16?"0":""}${V[H].toString(16)}`}break;default:this.socket.destroy();return}let Y=(await this.readBytes(2)).readUInt16BE();if(!this.server.supportedCommands.has(J))return this.socket.write(Buffer.from([5,7])),this.socket.destroy();this.destAddress=Q,this.destPort=Y;let G=!1,W=()=>{if(G)return;G=!0,this.connect()};if(!this.server.rulesetValidator)return W();let U=()=>{if(G)return;G=!0,this.socket.write(Buffer.from([5,2,0,1,0,0,0,0,0,0])),this.socket.destroy()},M=await this.server.rulesetValidator(this,W,U);if(M===!0)W();else if(M===!1)U()}connect(){this.socket.removeListener("error",this.errorHandler),this.server.connectionHandler(this,($)=>{if(F7[$]===void 0)throw Error(`"${$}" is not a valid status.`);if(this.socket.write(Buffer.from([5,F7[$],0,1,0,0,0,0,0,0])),$!=="REQUEST_GRANTED")this.socket.destroy()}),this.socket.resume()}},cq=O4(qX("net"));function N7($,J){if($.command!=="connect")return J("COMMAND_NOT_SUPPORTED");$.socket.on("error",()=>{});let X=cq.default.createConnection({host:$.destAddress,port:$.destPort});X.setNoDelay();let Q=!1;return X.on("error",(Y)=>{if(!Q)switch(Y.code){case"EINVAL":case"ENOENT":case"ENOTFOUND":case"ETIMEDOUT":case"EADDRNOTAVAIL":case"EHOSTUNREACH":J("HOST_UNREACHABLE");break;case"ENETUNREACH":J("NETWORK_UNREACHABLE");break;case"ECONNREFUSED":J("CONNECTION_REFUSED");break;default:J("GENERAL_FAILURE")}}),X.on("ready",()=>{Q=!0,J("REQUEST_GRANTED"),$.socket.pipe(X).pipe($.socket)}),$.socket.on("close",()=>X.destroy()),X}var q4=class{constructor(){this.supportedCommands=new Set(["connect"]),this.connectionHandler=N7,this.server=pq.default.createServer(($)=>{$.setNoDelay(),this._handleConnection($)})}listen(...$){return this.server.listen(...$),this}close($){return this.server.close($),this}setAuthHandler($){return this.authHandler=$,this}disableAuthHandler(){return this.authHandler=void 0,this}setRulesetValidator($){return this.rulesetValidator=$,this}disableRulesetValidator(){return this.rulesetValidator=void 0,this}setConnectionHandler($){return this.connectionHandler=$,this}useDefaultConnectionHandler(){return this.connectionHandler=N7,this}_handleConnection($){return new dq(this,$),this}};function nq($){let J=new q4;if($?.auth)J.setAuthHandler((X)=>{return X.username===$.auth.username&&X.password===$.auth.password});if($?.port)J.listen($.port,$.hostname);return J}});import{Agent as Pq,createServer as _q}from"http";import{request as E7}from"http";import{request as G4}from"https";import{connect as xq,isIP as vq}from"net";import{URL as W4}from"url";function Z($,J){if(!process.env.SRT_DEBUG)return;let X=J?.level||"info",Q="[SandboxDebug]";switch(X){case"error":console.error(`${Q} ${$}`);break;case"warn":console.warn(`${Q} ${$}`);break;default:console.error(`${Q} ${$}`)}}import{timingSafeEqual as pU}from"crypto";function HY($,J){let X=Buffer.from($),Q=Buffer.from(J);if(X.length!==Q.length)return!1;return pU(X,Q)}import{homedir as qY}from"os";import*as UJ from"path";import*as t0 from"fs";import*as NG from"fs";function p9(){if(process.platform!=="linux")return;try{let $=NG.readFileSync("/proc/version",{encoding:"utf8"}),J=$.match(/WSL(\d+)/i);if(J&&J[1])return J[1];if($.toLowerCase().includes("microsoft"))return"1";return}catch{return}}function v$(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"unknown"}}var KX=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json"],dU=[".git",".vscode",".idea"];function zY(){return[...dU.filter(($)=>$!==".git"),".claude/commands",".claude/agents"]}function d9($){return $.toLowerCase()}function NJ($){return $.includes("*")||$.includes("?")||$.includes("[")||$.includes("]")}function zX($){return $.includes("*")||$.includes("?")}function LG($){return v$()==="windows"?zX($):NJ($)}function AG($){if(/^\\\\\?\\unc\\/i.test($))return"\\\\"+$.slice(8);if($.startsWith("\\\\?\\"))return $.slice(4);return $}function EX($){let J=UJ.win32.toNamespacedPath($);return/^[\\/]{2}[?.][\\/]unc[\\/]/i.test(J)}function F0($){return $.replace(/\/\*\*$/,"")||"/"}function KY($,J){let X=UJ.normalize($),Q=UJ.normalize(J);if(Q===X)return!1;if(X.startsWith("/tmp/")&&Q==="/private"+X)return!1;if(X.startsWith("/var/")&&Q==="/private"+X)return!1;if(X.startsWith("/private/tmp/")&&Q===X)return!1;if(X.startsWith("/private/var/")&&Q===X)return!1;if(Q==="/")return!0;if(Q.split("/").filter(Boolean).length<=1)return!0;if(X.startsWith(Q+"/"))return!0;let G=X;if(X.startsWith("/tmp/"))G="/private"+X;else if(X.startsWith("/var/"))G="/private"+X;if(G!==X&&G.startsWith(Q+"/"))return!0;let W=Q.startsWith(X+"/"),U=G!==X&&Q.startsWith(G+"/");if(Q!==X&&!(G!==X&&Q===G)&&!W&&!U)return!0;return!1}function cU($){if($==="~")return qY();if($.startsWith("~/")||process.platform==="win32"&&$.startsWith("~\\"))return qY()+$.slice(1);return $}function nU($){let J=qY(),X=/^[A-Za-z]:/.test(J)?J.slice(0,2):"",Q=X?J.slice(2):J;return $.replace(/%USERPROFILE%/gi,J).replace(/%HOMEDRIVE%/gi,X).replace(/%HOMEPATH%/gi,Q)}function XJ($){let J=process.cwd();if(v$()==="windows"){if($=AG(nU($)),/^[a-z]:/.test($))$=$[0].toUpperCase()+$.slice(1);if(EX($)&&!zX($))return UJ.win32.normalize($)}if(v$()!=="windows"&&$.endsWith("/")&&$!=="/"&&!LG($))$=$.replace(/\/+$/,"")||"/";let X=cU($);if(X!==$);else if($.startsWith("./")||$.startsWith("../"))X=UJ.resolve(J,$);else if(!UJ.isAbsolute($))X=UJ.resolve(J,$);if(LG(X)){let Q=v$()==="windows"?/[*?]/:/[*?[\]]/,Y=X.split(Q)[0];if(Y&&Y!=="/"){let G=Y.endsWith("/")?Y.slice(0,-1):UJ.dirname(Y);try{let W=t0.realpathSync(G);if(!KY(G,W)){let U=X.slice(G.length);return W+U}}catch{}}return X}try{let Q=t0.realpathSync(X);if(KY(X,Q));else X=Q}catch{}return X}function DQ($){let J=$??qY();return["/dev/stdout","/dev/stderr","/dev/null","/dev/tty","/dev/dtracehelper","/dev/autofs_nowait","/tmp/claude","/private/tmp/claude",UJ.join(J,".npm/_logs"),UJ.join(J,".claude/debug")]}var iU=["NODE_EXTRA_CA_CERTS","SSL_CERT_FILE","CURL_CA_BUNDLE","REQUESTS_CA_BUNDLE","PIP_CERT","GIT_SSL_CAINFO","AWS_CA_BUNDLE","CARGO_HTTP_CAINFO","DENO_CERT","CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","NIX_SSL_CERT_FILE"];function ZQ($,J,X,Q,Y,G){let W=aU(G),U=W===E0?W:encodeURIComponent(W),M=Q?`${U}:${Q}@`:"",O=v$()==="linux"?"127.0.0.1":"localhost",V=["SANDBOX_RUNTIME=1"];if(!Y){let F=process.env.CLAUDE_CODE_TMPDIR||process.env.CLAUDE_TMPDIR||"/tmp/claude";V.push(`TMPDIR=${F}`)}if(X)for(let F of iU)V.push(`${F}=${X}`);if(!$&&!J)return V;let H=["localhost","127.0.0.1","::1","169.254.0.0/16","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"].join(",");if(V.push(`NO_PROXY=${H}`),V.push(`no_proxy=${H}`),$){if(V.push(`HTTP_PROXY=http://${M}${O}:${$}`),V.push(`HTTPS_PROXY=http://${M}${O}:${$}`),V.push(`http_proxy=http://${M}${O}:${$}`),V.push(`https_proxy=http://${M}${O}:${$}`),Q)V.push("GIT_CONFIG_PARAMETERS='http.proxyAuthMethod=basic'")}let q=$?`http://${M}${O}:${$}`:`socks5h://${M}${O}:${J}`;if(V.push(`ALL_PROXY=${q}`),V.push(`all_proxy=${q}`),V.push(`GRPC_PROXY=${q}`),V.push(`grpc_proxy=${q}`),J){let K=v$();if(K==="macos")V.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:${J} %h %p'`);else if(K==="linux"&&$){let A=Q?`,proxyauth=${W}:${Q}`:"";V.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='socat - PROXY:${O}:%h:%p,proxyport=${$}${A}'`)}if(V.push(`FTP_PROXY=socks5h://${M}${O}:${J}`),V.push(`ftp_proxy=socks5h://${M}${O}:${J}`),V.push(`RSYNC_PROXY=${O}:${J}`),V.push(`DOCKER_HTTP_PROXY=http://${M}${O}:${$||J}`),V.push(`DOCKER_HTTPS_PROXY=http://${M}${O}:${$||J}`),$){if(V.push("CLOUDSDK_PROXY_TYPE=http"),V.push(`CLOUDSDK_PROXY_ADDRESS=${O}`),V.push(`CLOUDSDK_PROXY_PORT=${$}`),Q)V.push(`CLOUDSDK_PROXY_USERNAME=${W}`),V.push(`CLOUDSDK_PROXY_PASSWORD=${Q}`)}}return V}var oU=8;function FX($){if($.baseEnv?.GIT_CONFIG_COUNT==="0")return{};let J=Number.parseInt($.baseEnv?.GIT_CONFIG_COUNT??"",10),X=Number.isFinite(J)&&J>=0?J:0,Q=X,Y={},G=(U,M)=>{Y[`GIT_CONFIG_KEY_${Q}`]=U,Y[`GIT_CONFIG_VALUE_${Q}`]=M,Q++},W=[...new Set($.safeDirs.filter((U)=>!!U).map((U)=>{let O=U.replace(/\\/g,"/").replace(/\/+$/,"");if(O===""||/^[A-Za-z]:$/.test(O))return`${O}/`;return O}))];if(W.length>oU)G("safe.directory","*");else for(let U of W)G("safe.directory",U),G("safe.directory",U.endsWith("/")?`${U}*`:`${U}/*`);if($.schannelCa)G("http.schannelUseSSLCAInfo","true"),G("http.schannelCheckRevoke","false");if(Q===X)return{};return Y.GIT_CONFIG_COUNT=String(Q),Y}function EY($){let J={GIT_CONFIG_COUNT:process.env.GIT_CONFIG_COUNT};for(let X of $.unsetEnvVars??[])delete J[X];return Object.assign(J,$.setEnvVars??{}),FX({safeDirs:$.safeDirs,baseEnv:J})}function PJ($){let J=$.slice(0,100);return Buffer.from(J).toString("base64")}function e0($){return Buffer.from($,"base64").toString("utf8")}var E0="srt";function aU($){if(!$)return E0;let J=`${E0}.${$}`;return Buffer.byteLength(J)<=255?J:E0}function FY($){if(!$||!$.startsWith(`${E0}.`))return;return $.slice(E0.length+1)||void 0}function NX($){return"^"+$.replace(/[.^$+{}()|\\]/g,"\\$&").replace(/\[([^\]]*?)$/g,"\\[$1").replace(/\*\*\//g,"__GLOBSTAR_SLASH__").replace(/\*\*/g,"__GLOBSTAR__").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/__GLOBSTAR_SLASH__/g,"(.*/)?").replace(/__GLOBSTAR__/g,".*")+"$"}function $Q($,J={}){let X=(M)=>process.platform==="win32"?M.replace(/\\/g,"/"):M,Q=X(XJ($)),Y=Q.split(/[*?[\]]/)[0];if(!Y||Y==="/")return Z(`[Sandbox] Glob pattern too broad, skipping: ${$}`),[];let G=Y.endsWith("/")?Y.slice(0,-1):UJ.dirname(Y);if(!t0.existsSync(G))return Z(`[Sandbox] Base directory for glob does not exist: ${G}`),[];let W=new RegExp(NX(Q),J.caseInsensitive?"i":""),U=[];try{let M=t0.readdirSync(G,{recursive:!0,withFileTypes:!0});for(let O of M){let V=O.parentPath??O.path??G,H=UJ.join(V,O.name);if(W.test(X(H)))U.push(H)}}catch(M){Z(`[Sandbox] Error expanding glob pattern ${$}: ${M}`)}return U}var vW=l9(o8(),1);import{sign as bH,X509Certificate as hH}from"crypto";import{mkdtempSync as s8,readFileSync as r8,writeFileSync as t8}from"fs";import{rm as uH}from"fs/promises";import{tmpdir as e8}from"os";import{join as gQ,dirname as a8}from"path";import{rootCertificates as gH}from"tls";var{asn1:t$,pki:pJ,md:mH,random:lH,util:kW}=vW.default,pH=pJ.getTBSCertificate,dH=/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g,sY="/srt.crl";function $7($){let J=$.getExtension("subjectKeyIdentifier");return J?.subjectKeyIdentifier?kW.hexToBytes(J.subjectKeyIdentifier):$.generateSubjectKeyIdentifier().getBytes()}function J7($,J){let X=pJ.oids.sha256WithRSAEncryption;$.siginfo.algorithmOid=X,$.signatureOid=X,$.tbsCertificate=pH($);let Q=t$.toDer($.tbsCertificate).getBytes();$.signature=fW(Q,J),$.md=mH.sha256.create(),$.md.update(Q)}function fW($,J){return bH("sha256",Buffer.from($,"binary"),J).toString("binary")}function Q7($){if($.caCertPem&&$.caKeyPem){let J=kX($.caCertPem,$.caKeyPem);if(!J.ok)throw Error(`tlsTerminate: CA PEM pair: ${J.reason}`);return X7($.caCertPem,$.caKeyPem,J.cert,J.key,{certPath:$.caCertPath??"",keyPath:$.caKeyPath??"",extraCaCertPaths:$.extraCaCertPaths})}if($.caCertPath&&$.caKeyPath)return iH($.caCertPath,$.caKeyPath,$.extraCaCertPaths);if($.caCertPath||$.caKeyPath)throw Error("tlsTerminate: caCertPath and caKeyPath must be provided together");return oH($.extraCaCertPaths)}async function yW($){let J=new Set([a8($.trustBundlePath)]);if($.ephemeral){if(J.add(a8($.certPath)),$.keyPath)J.add(a8($.keyPath))}for(let X of J)try{await uH(X,{recursive:!0,force:!0})}catch(Q){Z(`[mitm-ca] cleanup failed: ${Q.message}`,{level:"warn"})}}function cH($,J,X){let Q=[J.trim(),...gH],Y=process.env.NODE_EXTRA_CA_CERTS;if(Y)try{Q.push(r8(Y,"utf8").trim())}catch{}for(let W of X??[]){let U;try{U=r8(W,"utf8")}catch(O){let V=O.code??String(O);Z(`[mitm-ca] extraCaCertPaths: cannot read ${W} (${V}); skipping`,{level:"warn"});continue}let M=U.match(dH);if(!M){Z(`[mitm-ca] extraCaCertPaths: ${W} has no PEM CERTIFICATE block; skipping`,{level:"warn"});continue}Q.push(...M)}let G=gQ($,"trust-bundle.crt");return t8(G,Q.join(`
+`,G+=V;var A=aY("putty-private-key-file-mac-key",J),D=YJ.util.createBuffer();hQ(D,Q),hQ(D,Y),hQ(D,X),D.putInt32(W.length()),D.putBuffer(W),D.putInt32(O.length()),D.putBuffer(O);var S=YJ.hmac.create();return S.start("sha1",A),S.update(D.bytes()),G+=`\r
+Private-MAC: `+S.digest().toHex()+`\r
+`,G};sY.publicKeyToOpenSSH=function($,J){var X="ssh-rsa";J=J||"";var Q=YJ.util.createBuffer();return hQ(Q,X),M0(Q,$.e),M0(Q,$.n),X+" "+YJ.util.encode64(Q.bytes())+" "+J};sY.privateKeyToOpenSSH=function($,J){if(!J)return YJ.pki.privateKeyToPem($);return YJ.pki.encryptRsaPrivateKey($,J,{legacy:!0,algorithm:"aes128"})};sY.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||YJ.md.md5.create(),Q="ssh-rsa",Y=YJ.util.createBuffer();hQ(Y,Q),M0(Y,$.e),M0(Y,$.n),X.start(),X.update(Y.getBytes());var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};function M0($,J){var X=J.toString(16);if(X[0]>="8")X="00"+X;var Q=YJ.util.hexToBytes(X);$.putInt32(Q.length),$.putBytes(Q)}function hQ($,J){$.putInt32(J.length),$.putString(J)}function aY(){var $=YJ.md.sha1.create(),J=arguments.length;for(var X=0;X<J;++X)$.update(arguments[X]);return $.digest()}});var a8=q$(($N,vW)=>{vW.exports=F$();P0();QW();mJ();AY();BX();AW();TQ();BW();TW();IW();D8();PY();QQ();z8();j8();PW();S8();F8();W8();bY();_J();O8();xW();x8();_$()});var L4=q$((QL,N4)=>{var{create:p6,defineProperty:W9,getOwnPropertyDescriptor:d6,getOwnPropertyNames:c6,getPrototypeOf:n6}=Object,i6=Object.prototype.hasOwnProperty,o6=($,J)=>{for(var X in J)W9($,X,{get:J[X],enumerable:!0})},H4=($,J,X,Q)=>{if(J&&typeof J==="object"||typeof J==="function"){for(let Y of c6(J))if(!i6.call($,Y)&&Y!==X)W9($,Y,{get:()=>J[Y],enumerable:!(Q=d6(J,Y))||Q.enumerable})}return $},K4=($,J,X)=>(X=$!=null?p6(n6($)):{},H4(J||!$||!$.__esModule?W9(X,"default",{value:$,enumerable:!0}):X,$)),a6=($)=>H4(W9({},"__esModule",{value:!0}),$),z4={};o6(z4,{Socks5Server:()=>F4,createServer:()=>e6,defaultConnectionHandler:()=>R7});N4.exports=a6(z4);var s6=K4(KX("net")),E4=(($)=>{return $[$.connect=1]="connect",$[$.bind=2]="bind",$[$.udp=3]="udp",$})(E4||{}),A7=(($)=>{return $[$.REQUEST_GRANTED=0]="REQUEST_GRANTED",$[$.GENERAL_FAILURE=1]="GENERAL_FAILURE",$[$.CONNECTION_NOT_ALLOWED=2]="CONNECTION_NOT_ALLOWED",$[$.NETWORK_UNREACHABLE=3]="NETWORK_UNREACHABLE",$[$.HOST_UNREACHABLE=4]="HOST_UNREACHABLE",$[$.CONNECTION_REFUSED=5]="CONNECTION_REFUSED",$[$.TTL_EXPIRED=6]="TTL_EXPIRED",$[$.COMMAND_NOT_SUPPORTED=7]="COMMAND_NOT_SUPPORTED",$[$.ADDRESS_TYPE_NOT_SUPPORTED=8]="ADDRESS_TYPE_NOT_SUPPORTED",$})(A7||{}),r6=class{constructor($,J){this.errorHandler=()=>{},this.metadata={},this.socket=J,this.server=$,J.on("error",this.errorHandler),J.pause(),this.handleGreeting()}readBytes($){return new Promise((J)=>{let X=Buffer.allocUnsafe($),Q=0,Y=(G)=>{let W=Math.min(G.length,$-Q);if(G.copy(X,Q,0,W),Q+=W,Q<$)return;this.socket.removeListener("data",Y),this.socket.push(G.subarray(W)),J(X),this.socket.pause()};this.socket.on("data",Y),this.socket.resume()})}async handleGreeting(){if((await this.readBytes(1)).readUInt8()!==5)return this.socket.destroy();let J=(await this.readBytes(1)).readUInt8();if(J>128||J===0)return this.socket.destroy();let X=await this.readBytes(J),Q=this.server.authHandler?2:0;if(!X.includes(Q))return this.socket.write(Buffer.from([5,255])),this.socket.destroy();if(this.socket.write(Buffer.from([5,Q])),this.server.authHandler)this.handleUserPassword();else this.handleConnectionRequest()}async handleUserPassword(){await this.readBytes(1);let $=(await this.readBytes(1)).readUint8(),J=(await this.readBytes($)).toString(),X=(await this.readBytes(1)).readUint8(),Q=(await this.readBytes(X)).toString();this.username=J,this.password=Q;let Y=!1,G=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,0])),this.handleConnectionRequest()},W=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,1])),this.socket.destroy()},U=await this.server.authHandler(this,G,W);if(U===!0)G();else if(U===!1)W()}async handleConnectionRequest(){await this.readBytes(1);let $=(await this.readBytes(1))[0],J=E4[$];if(!J)return this.socket.destroy();this.command=J,await this.readBytes(1);let X=(await this.readBytes(1)).readUInt8(),Q="";switch(X){case 1:Q=(await this.readBytes(4)).join(".");break;case 3:let O=(await this.readBytes(1)).readUInt8();Q=(await this.readBytes(O)).toString();break;case 4:let V=await this.readBytes(16);for(let q=0;q<16;q++){if(q%2===0&&q>0)Q+=":";Q+=`${V[q]<16?"0":""}${V[q].toString(16)}`}break;default:this.socket.destroy();return}let Y=(await this.readBytes(2)).readUInt16BE();if(!this.server.supportedCommands.has(J))return this.socket.write(Buffer.from([5,7])),this.socket.destroy();this.destAddress=Q,this.destPort=Y;let G=!1,W=()=>{if(G)return;G=!0,this.connect()};if(!this.server.rulesetValidator)return W();let U=()=>{if(G)return;G=!0,this.socket.write(Buffer.from([5,2,0,1,0,0,0,0,0,0])),this.socket.destroy()},M=await this.server.rulesetValidator(this,W,U);if(M===!0)W();else if(M===!1)U()}connect(){this.socket.removeListener("error",this.errorHandler),this.server.connectionHandler(this,($)=>{if(A7[$]===void 0)throw Error(`"${$}" is not a valid status.`);if(this.socket.write(Buffer.from([5,A7[$],0,1,0,0,0,0,0,0])),$!=="REQUEST_GRANTED")this.socket.destroy()}),this.socket.resume()}},t6=K4(KX("net"));function R7($,J){if($.command!=="connect")return J("COMMAND_NOT_SUPPORTED");$.socket.on("error",()=>{});let X=t6.default.createConnection({host:$.destAddress,port:$.destPort});X.setNoDelay();let Q=!1;return X.on("error",(Y)=>{if(!Q)switch(Y.code){case"EINVAL":case"ENOENT":case"ENOTFOUND":case"ETIMEDOUT":case"EADDRNOTAVAIL":case"EHOSTUNREACH":J("HOST_UNREACHABLE");break;case"ENETUNREACH":J("NETWORK_UNREACHABLE");break;case"ECONNREFUSED":J("CONNECTION_REFUSED");break;default:J("GENERAL_FAILURE")}}),X.on("ready",()=>{Q=!0,J("REQUEST_GRANTED"),$.socket.pipe(X).pipe($.socket)}),$.socket.on("close",()=>X.destroy()),X}var F4=class{constructor(){this.supportedCommands=new Set(["connect"]),this.connectionHandler=R7,this.server=s6.default.createServer(($)=>{$.setNoDelay(),this._handleConnection($)})}listen(...$){return this.server.listen(...$),this}close($){return this.server.close($),this}setAuthHandler($){return this.authHandler=$,this}disableAuthHandler(){return this.authHandler=void 0,this}setRulesetValidator($){return this.rulesetValidator=$,this}disableRulesetValidator(){return this.rulesetValidator=void 0,this}setConnectionHandler($){return this.connectionHandler=$,this}useDefaultConnectionHandler(){return this.connectionHandler=R7,this}_handleConnection($){return new r6(this,$),this}};function e6($){let J=new F4;if($?.auth)J.setAuthHandler((X)=>{return X.username===$.auth.username&&X.password===$.auth.password});if($?.port)J.listen($.port,$.hostname);return J}});import{Agent as b6,createServer as h6}from"http";import{request as L7}from"http";import{request as O4}from"https";import{connect as u6,isIP as g6}from"net";import{URL as V4}from"url";function Z($,J){if(!process.env.SRT_DEBUG)return;let X=J?.level||"info",Q="[SandboxDebug]";switch(X){case"error":console.error(`${Q} ${$}`);break;case"warn":console.warn(`${Q} ${$}`);break;default:console.error(`${Q} ${$}`)}}import{timingSafeEqual as aU}from"crypto";function HY($,J){let X=Buffer.from($),Q=Buffer.from(J);if(X.length!==Q.length)return!1;return aU(X,Q)}import{homedir as KY}from"os";import*as UJ from"path";import*as t0 from"fs";import*as RG from"fs";function d9(){if(process.platform!=="linux")return;try{let $=RG.readFileSync("/proc/version",{encoding:"utf8"}),J=$.match(/WSL(\d+)/i);if(J&&J[1])return J[1];if($.toLowerCase().includes("microsoft"))return"1";return}catch{return}}function v$(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"unknown"}}var zX=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json"],sU=[".git",".vscode",".idea"];function EY(){return[...sU.filter(($)=>$!==".git"),".claude/commands",".claude/agents"]}function c9($){return $.toLowerCase()}function NJ($){return $.includes("*")||$.includes("?")||$.includes("[")||$.includes("]")}function EX($){return $.includes("*")||$.includes("?")}function DG($){return v$()==="windows"?EX($):NJ($)}function ZG($){if(/^\\\\\?\\unc\\/i.test($))return"\\\\"+$.slice(8);if($.startsWith("\\\\?\\"))return $.slice(4);return $}function FX($){let J=UJ.win32.toNamespacedPath($);return/^[\\/]{2}[?.][\\/]unc[\\/]/i.test(J)}function F0($){return $.replace(/\/\*\*$/,"")||"/"}function zY($,J){let X=UJ.normalize($),Q=UJ.normalize(J);if(Q===X)return!1;if(X.startsWith("/tmp/")&&Q==="/private"+X)return!1;if(X.startsWith("/var/")&&Q==="/private"+X)return!1;if(X.startsWith("/private/tmp/")&&Q===X)return!1;if(X.startsWith("/private/var/")&&Q===X)return!1;if(Q==="/")return!0;if(Q.split("/").filter(Boolean).length<=1)return!0;if(X.startsWith(Q+"/"))return!0;let G=X;if(X.startsWith("/tmp/"))G="/private"+X;else if(X.startsWith("/var/"))G="/private"+X;if(G!==X&&G.startsWith(Q+"/"))return!0;let W=Q.startsWith(X+"/"),U=G!==X&&Q.startsWith(G+"/");if(Q!==X&&!(G!==X&&Q===G)&&!W&&!U)return!0;return!1}function rU($){if($==="~")return KY();if($.startsWith("~/")||process.platform==="win32"&&$.startsWith("~\\"))return KY()+$.slice(1);return $}function tU($){let J=KY(),X=/^[A-Za-z]:/.test(J)?J.slice(0,2):"",Q=X?J.slice(2):J;return $.replace(/%USERPROFILE%/gi,J).replace(/%HOMEDRIVE%/gi,X).replace(/%HOMEPATH%/gi,Q)}function XJ($){let J=process.cwd();if(v$()==="windows"){if($=ZG(tU($)),/^[a-z]:/.test($))$=$[0].toUpperCase()+$.slice(1);if(FX($)&&!EX($))return UJ.win32.normalize($)}if(v$()!=="windows"&&$.endsWith("/")&&$!=="/"&&!DG($))$=$.replace(/\/+$/,"")||"/";let X=rU($);if(X!==$);else if($.startsWith("./")||$.startsWith("../"))X=UJ.resolve(J,$);else if(!UJ.isAbsolute($))X=UJ.resolve(J,$);if(DG(X)){let Q=v$()==="windows"?/[*?]/:/[*?[\]]/,Y=X.split(Q)[0];if(Y&&Y!=="/"){let G=Y.endsWith("/")?Y.slice(0,-1):UJ.dirname(Y);try{let W=t0.realpathSync(G);if(!zY(G,W)){let U=X.slice(G.length);return W+U}}catch{}}return X}try{let Q=t0.realpathSync(X);if(zY(X,Q));else X=Q}catch{}return X}function DQ($){let J=$??KY();return["/dev/stdout","/dev/stderr","/dev/null","/dev/tty","/dev/dtracehelper","/dev/autofs_nowait","/tmp/claude","/private/tmp/claude",UJ.join(J,".npm/_logs"),UJ.join(J,".claude/debug")]}var eU=["NODE_EXTRA_CA_CERTS","SSL_CERT_FILE","CURL_CA_BUNDLE","REQUESTS_CA_BUNDLE","PIP_CERT","GIT_SSL_CAINFO","AWS_CA_BUNDLE","CARGO_HTTP_CAINFO","DENO_CERT","CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","NIX_SSL_CERT_FILE"];function ZQ($,J,X,Q,Y,G){let W=JM(G),U=W===E0?W:encodeURIComponent(W),M=Q?`${U}:${Q}@`:"",O=v$()==="linux"?"127.0.0.1":"localhost",V=["SANDBOX_RUNTIME=1"];if(!Y){let N=process.env.CLAUDE_CODE_TMPDIR||process.env.CLAUDE_TMPDIR||"/tmp/claude";V.push(`TMPDIR=${N}`)}if(X)for(let N of eU)V.push(`${N}=${X}`);if(!$&&!J)return V;let q=["localhost","127.0.0.1","::1","169.254.0.0/16","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"].join(",");if(V.push(`NO_PROXY=${q}`),V.push(`no_proxy=${q}`),$){if(V.push(`HTTP_PROXY=http://${M}${O}:${$}`),V.push(`HTTPS_PROXY=http://${M}${O}:${$}`),V.push(`http_proxy=http://${M}${O}:${$}`),V.push(`https_proxy=http://${M}${O}:${$}`),Q)V.push("GIT_CONFIG_PARAMETERS='http.proxyAuthMethod=basic'")}let H=$?`http://${M}${O}:${$}`:`socks5h://${M}${O}:${J}`;if(V.push(`ALL_PROXY=${H}`),V.push(`all_proxy=${H}`),V.push(`GRPC_PROXY=${H}`),V.push(`grpc_proxy=${H}`),J){let K=v$();if(K==="macos")V.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:${J} %h %p'`);else if(K==="linux"&&$){let L=Q?`,proxyauth=${W}:${Q}`:"";V.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='socat - PROXY:${O}:%h:%p,proxyport=${$}${L}'`)}if(V.push(`FTP_PROXY=socks5h://${M}${O}:${J}`),V.push(`ftp_proxy=socks5h://${M}${O}:${J}`),V.push(`RSYNC_PROXY=${O}:${J}`),V.push(`DOCKER_HTTP_PROXY=http://${M}${O}:${$||J}`),V.push(`DOCKER_HTTPS_PROXY=http://${M}${O}:${$||J}`),$){if(V.push("CLOUDSDK_PROXY_TYPE=http"),V.push(`CLOUDSDK_PROXY_ADDRESS=${O}`),V.push(`CLOUDSDK_PROXY_PORT=${$}`),Q)V.push(`CLOUDSDK_PROXY_USERNAME=${W}`),V.push(`CLOUDSDK_PROXY_PASSWORD=${Q}`)}}return V}var $M=8;function NX($){if($.baseEnv?.GIT_CONFIG_COUNT==="0")return{};let J=Number.parseInt($.baseEnv?.GIT_CONFIG_COUNT??"",10),X=Number.isFinite(J)&&J>=0?J:0,Q=X,Y={},G=(U,M)=>{Y[`GIT_CONFIG_KEY_${Q}`]=U,Y[`GIT_CONFIG_VALUE_${Q}`]=M,Q++},W=[...new Set($.safeDirs.filter((U)=>!!U).map((U)=>{let O=U.replace(/\\/g,"/").replace(/\/+$/,"");if(O===""||/^[A-Za-z]:$/.test(O))return`${O}/`;return O}))];if(W.length>$M)G("safe.directory","*");else for(let U of W)G("safe.directory",U),G("safe.directory",U.endsWith("/")?`${U}*`:`${U}/*`);if($.schannelCa)G("http.schannelUseSSLCAInfo","true"),G("http.schannelCheckRevoke","false");if(Q===X)return{};return Y.GIT_CONFIG_COUNT=String(Q),Y}function FY($){let J={GIT_CONFIG_COUNT:process.env.GIT_CONFIG_COUNT};for(let X of $.unsetEnvVars??[])delete J[X];return Object.assign(J,$.setEnvVars??{}),NX({safeDirs:$.safeDirs,baseEnv:J})}function PJ($){let J=$.slice(0,100);return Buffer.from(J).toString("base64")}function e0($){return Buffer.from($,"base64").toString("utf8")}var E0="srt";function JM($){if(!$)return E0;let J=`${E0}.${$}`;return Buffer.byteLength(J)<=255?J:E0}function NY($){if(!$||!$.startsWith(`${E0}.`))return;return $.slice(E0.length+1)||void 0}function LX($){return"^"+$.replace(/[.^$+{}()|\\]/g,"\\$&").replace(/\[([^\]]*?)$/g,"\\[$1").replace(/\*\*\//g,"__GLOBSTAR_SLASH__").replace(/\*\*/g,"__GLOBSTAR__").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/__GLOBSTAR_SLASH__/g,"(.*/)?").replace(/__GLOBSTAR__/g,".*")+"$"}function $Q($,J={}){let X=(M)=>process.platform==="win32"?M.replace(/\\/g,"/"):M,Q=X(XJ($)),Y=Q.split(/[*?[\]]/)[0];if(!Y||Y==="/")return Z(`[Sandbox] Glob pattern too broad, skipping: ${$}`),[];let G=Y.endsWith("/")?Y.slice(0,-1):UJ.dirname(Y);if(!t0.existsSync(G))return Z(`[Sandbox] Base directory for glob does not exist: ${G}`),[];let W=new RegExp(LX(Q),J.caseInsensitive?"i":""),U=[];try{let M=t0.readdirSync(G,{recursive:!0,withFileTypes:!0});for(let O of M){let V=O.parentPath??O.path??G,q=UJ.join(V,O.name);if(W.test(X(q)))U.push(q)}}catch(M){Z(`[Sandbox] Error expanding glob pattern ${$}: ${M}`)}return U}var yW=p9(a8(),1);import{sign as pq,X509Certificate as dq}from"crypto";import{mkdtempSync as r8,readFileSync as t8,writeFileSync as e8}from"fs";import{rm as cq}from"fs/promises";import{tmpdir as $7}from"os";import{join as gQ,dirname as s8}from"path";import{rootCertificates as nq}from"tls";var{asn1:t$,pki:pJ,md:iq,random:oq,util:bW}=yW.default,aq=pJ.getTBSCertificate,sq=/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g,rY="/srt.crl";function J7($){let J=$.getExtension("subjectKeyIdentifier");return J?.subjectKeyIdentifier?bW.hexToBytes(J.subjectKeyIdentifier):$.generateSubjectKeyIdentifier().getBytes()}function Q7($,J){let X=pJ.oids.sha256WithRSAEncryption;$.siginfo.algorithmOid=X,$.signatureOid=X,$.tbsCertificate=aq($);let Q=t$.toDer($.tbsCertificate).getBytes();$.signature=hW(Q,J),$.md=iq.sha256.create(),$.md.update(Q)}function hW($,J){return pq("sha256",Buffer.from($,"binary"),J).toString("binary")}function X7($){if($.caCertPem&&$.caKeyPem){let J=fX($.caCertPem,$.caKeyPem);if(!J.ok)throw Error(`tlsTerminate: CA PEM pair: ${J.reason}`);return Y7($.caCertPem,$.caKeyPem,J.cert,J.key,{certPath:$.caCertPath??"",keyPath:$.caKeyPath??"",extraCaCertPaths:$.extraCaCertPaths})}if($.caCertPath&&$.caKeyPath)return eq($.caCertPath,$.caKeyPath,$.extraCaCertPaths);if($.caCertPath||$.caKeyPath)throw Error("tlsTerminate: caCertPath and caKeyPath must be provided together");return $6($.extraCaCertPaths)}async function uW($){let J=new Set([s8($.trustBundlePath)]);if($.ephemeral){if(J.add(s8($.certPath)),$.keyPath)J.add(s8($.keyPath))}for(let X of J)try{await cq(X,{recursive:!0,force:!0})}catch(Q){Z(`[mitm-ca] cleanup failed: ${Q.message}`,{level:"warn"})}}function rq($,J,X){let Q=[J.trim(),...nq],Y=process.env.NODE_EXTRA_CA_CERTS;if(Y)try{Q.push(t8(Y,"utf8").trim())}catch{}for(let W of X??[]){let U;try{U=t8(W,"utf8")}catch(O){let V=O.code??String(O);Z(`[mitm-ca] extraCaCertPaths: cannot read ${W} (${V}); skipping`,{level:"warn"});continue}let M=U.match(sq);if(!M){Z(`[mitm-ca] extraCaCertPaths: ${W} has no PEM CERTIFICATE block; skipping`,{level:"warn"});continue}Q.push(...M)}let G=gQ($,"trust-bundle.crt");return e8(G,Q.join(`
 `)+`
-`,{mode:420}),G}function nH($,J){let X=pJ.oids.sha256WithRSAEncryption,Q=()=>uQ([t$.create(hJ.UNIVERSAL,O0.OID,!1,t$.oidToDer(X).getBytes()),t$.create(hJ.UNIVERSAL,O0.NULL,!1,"")]),Y=(q,F)=>uQ([t$.create(hJ.UNIVERSAL,O0.OID,!1,t$.oidToDer(q).getBytes()),t$.create(hJ.UNIVERSAL,O0.OCTETSTRING,!1,t$.toDer(F).getBytes())]),G=t$.create(hJ.CONTEXT_SPECIFIC,0,!0,[uQ([Y(pJ.oids.authorityKeyIdentifier,uQ([t$.create(hJ.CONTEXT_SPECIFIC,0,!1,$7($))])),Y("2.5.29.20",t$.create(hJ.UNIVERSAL,O0.INTEGER,!1,"\x01"))])]),W=new Date,U=$.validity.notAfter,M=U>W?U:vX(1),O=uQ([t$.create(hJ.UNIVERSAL,O0.INTEGER,!1,"\x01"),Q(),pJ.distinguishedNameToAsn1($.subject),_W(W),_W(M),G]),V=fW(t$.toDer(O).getBytes(),J),H=uQ([O,Q(),t$.create(hJ.UNIVERSAL,O0.BITSTRING,!1,"\x00"+V)]);return Buffer.from(t$.toDer(H).getBytes(),"binary")}var{Class:hJ,Type:O0}=t$;function uQ($){return t$.create(hJ.UNIVERSAL,O0.SEQUENCE,!0,$)}function _W($){return $.getUTCFullYear()<2050?t$.create(hJ.UNIVERSAL,O0.UTCTIME,!1,t$.dateToUtcTime($)):t$.create(hJ.UNIVERSAL,O0.GENERALIZEDTIME,!1,t$.dateToGeneralizedTime($))}function iH($,J,X){let Q=xW($,"CERTIFICATE","tlsTerminate.caCertPath"),Y=xW(J,"PRIVATE KEY","tlsTerminate.caKeyPath"),G=kX(Q,Y);if(!G.ok)throw Error(`tlsTerminate: CA at ${$}: ${G.reason}`);return Z(`[mitm-ca] loaded CA from ${$}`),X7(Q,Y,G.cert,G.key,{certPath:$,keyPath:J,extraCaCertPaths:X})}function X7($,J,X,Q,Y){let G=s8(gQ(e8(),"srt-ca-"));return{certPath:Y.certPath,keyPath:Y.keyPath,trustBundlePath:cH(G,$,Y.extraCaCertPaths),certPem:$,keyPem:J,cert:X,key:Q,leafCerts:new Map,secureContexts:new Map,crlDer:nH(X,J),ephemeral:Y.ephemeral??!1}}function rY($={}){let J=pJ.rsa.generateKeyPair(2048),X=pJ.createCertificate();X.publicKey=J.publicKey,X.serialNumber=Y7(),X.validity.notBefore=vX(-1),X.validity.notAfter=vX($.validityDays??825);let Q=[{name:"commonName",value:$.cn??"sandbox-runtime ephemeral CA"},{name:"organizationName",value:"sandbox-runtime"}];X.setSubject(Q),X.setIssuer(Q),X.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",critical:!0,keyCertSign:!0,cRLSign:!0,digitalSignature:!0},{name:"subjectKeyIdentifier"}]);let Y=pJ.privateKeyToPem(J.privateKey);return J7(X,Y),{certPem:pJ.certificateToPem(X),keyPem:Y,cert:X,key:J.privateKey}}function mQ($){return new hH($).fingerprint.replace(/:/g,"").toUpperCase()}function kX($,J){let X,Q;try{X=pJ.certificateFromPem($),Q=pJ.privateKeyFromPem(J)}catch(W){return{ok:!1,reason:`parse: ${W.message}`}}if(!("n"in Q)||!("d"in Q))return{ok:!1,reason:"key is not RSA"};if(X.validity.notBefore.getTime()>Date.now())return{ok:!1,reason:`notBefore ${X.validity.notBefore.toISOString()} is in the future (clock skew?)`};let Y=X.publicKey;if(!("n"in Y)||Y.n.compareTo(Q.n))return{ok:!1,reason:"key does not match certificate public key"};let G;try{G=mQ($)}catch(W){return{ok:!1,reason:`thumbprint: ${W.message}`}}return{ok:!0,thumbprint:G,notAfter:X.validity.notAfter,cert:X,key:Q}}function oH($){let{certPem:J,keyPem:X,cert:Q,key:Y}=rY(),G=s8(gQ(e8(),"srt-ca-")),W=gQ(G,"ca.crt"),U=gQ(s8(gQ(e8(),"srt-ca-key-")),"ca.key");return t8(W,J,{mode:420}),t8(U,X,{mode:384}),Z(`[mitm-ca] generated ephemeral CA at ${W}`),X7(J,X,Q,Y,{certPath:W,keyPath:U,extraCaCertPaths:$,ephemeral:!0})}function xW($,J,X){let Q;try{Q=r8($,"utf8")}catch(Y){let G=Y.code??String(Y);throw Error(`${X}: cannot read ${$} (${G})`)}if(!new RegExp(`-----BEGIN [A-Z ]*${J}-----`).test(Q))throw Error(`${X}: ${$} is not a PEM ${J}`);return Q}function Y7(){let $=lH.getBytesSync(16),J=kW.bytesToHex($);return(parseInt(J[0],16)&7).toString(16)+J.slice(1)}function vX($){let J=new Date;return J.setDate(J.getDate()+$),J}import{PassThrough as aH,Readable as bW}from"stream";var G7=new Set(["GET","HEAD","OPTIONS"]),gW="denied by sandbox policy";function hW($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}async function tY($,J,X,Q,Y,G){let W=J.method??"GET",U,M=J,O=Boolean(J.headers["content-length"]||J.headers["transfer-encoding"]),V=G7.has(W);if(!V||O){let F=new aH;F.on("error",()=>{}),J.pipe(F);let K=bW.toWeb(F),[A,L]=K.tee();U=A,M=bW.fromWeb(L);let R=M;R.on("error",()=>{}),J.on("error",(I)=>{F.end(),R.destroy(I)})}let H;try{if(U&&!(U instanceof ReadableStream))throw TypeError("Unexpected request body stream");let F=U&&!V?{body:U,duplex:"half"}:{};H=new Request(Q,{method:W,headers:sH(J),signal:Y,...F})}catch(F){let K=`malformed request: ${F.message}`;if(G?.(W,Q,K),uW(X,{action:"deny",reason:K}),U?.cancel().catch(()=>{}),M.destroy(),M!==J)hW(J,X);return null}let q;try{q=await $(H)}catch(F){q={action:"deny",reason:`sandbox policy check failed: ${F.message}`}}if(U&&!H.bodyUsed)U.cancel().catch(()=>{});if(q.action==="allow")return Z(`[request-filter] allow ${W} ${Q}`),M;if(G?.(W,Q,q.reason??gW),uW(X,q),M.destroy(),M!==J)hW(J,X);return null}function uW($,J){fX($,J.reason??gW)}function fX($,J){if(Z(`[request-filter] deny: ${J}`),$.headersSent){$.destroy();return}$.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-sandbox-runtime"}),$.end(J+`
-`)}function sH($){let J=new Headers;for(let[X,Q]of Object.entries($.headers)){if(Q===void 0)continue;if(Array.isArray(Q))for(let Y of Q)J.append(X,Y);else J.append(X,Q)}return J}import{createServer as Nq,request as Lq}from"https";import{connect as Aq,isIP as eW}from"net";import{unlink as Rq}from"fs";import{tmpdir as Dq}from"os";import{join as Zq}from"path";import{Transform as rH}from"stream";function tH($){return $.every((J)=>J.sentinel.length===J.realValue.length)}function eY($,J,X,Q){if($===void 0)return;let Y=J.headers["content-length"]!==void 0||J.headers["transfer-encoding"]!==void 0;if(G7.has(J.method??"GET")&&!Y)return;let G=$(Q);if(!G?.length)return;if(J.headers["content-encoding"]!==void 0){Z(`[body-substitution] ${Q}: request body has Content-Encoding "${String(J.headers["content-encoding"])}"; masked-credential `+"substitution skipped \u2014 a sentinel in this body reaches the "+"upstream as the fake value",{level:"warn"});return}if(!tH(G))delete X["content-length"];return eH(G)}function eH($){let J=Math.max(...$.map((Q)=>Q.sentinel.length)),X;return new rH({transform(Q,Y,G){let W=Buffer.isBuffer(Q)?Q:Buffer.from(Q,Y),U=X?.length?Buffer.concat([X,W]):W,{out:M,tail:O}=$q(U,$,J);X=O,G(null,M)},flush(Q){Q(null,X?.length?X:void 0)}})}function $q($,J,X){let Q=[],Y=0;for(;;){let W=-1,U;for(let M of J){let O=$.indexOf(M.sentinel,Y);if(O!==-1&&(W===-1||O<W))W=O,U=M}if(U===void 0)break;Q.push($.subarray(Y,W),U.realValue),Y=W+U.sentinel.length}let G=Math.max(Y,$.length-(X-1));return Q.push($.subarray(Y,G)),{out:Buffer.concat(Q),tail:Buffer.from($.subarray(G))}}var mW=l9(o8(),1);import{isIP as Jq}from"net";import{createSecureContext as Qq}from"tls";var{pki:$9}=mW.default;function W7($,J){let X=$.leafCerts.get(J);if(X)return X;let Q=$9.rsa.generateKeyPair(2048),Y=$9.createCertificate();Y.publicKey=Q.publicKey,Y.serialNumber=Y7();let G=vX(-1);Y.validity.notBefore=G,Y.validity.notAfter=Yq($.cert,G),Y.setSubject([{name:"commonName",value:J}]),Y.setIssuer($.cert.subject.attributes),Y.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",critical:!0,digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[Xq(J)]},{name:"subjectKeyIdentifier"},{name:"authorityKeyIdentifier",keyIdentifier:$7($.cert)},...$.crlUrl?[{name:"cRLDistributionPoints",altNames:[{type:6,value:$.crlUrl}]}]:[]]),J7(Y,$.keyPem);let W={certPem:$9.certificateToPem(Y)+$.certPem,keyPem:$9.privateKeyToPem(Q.privateKey)};return $.leafCerts.set(J,W),Z(`[mitm-leaf] minted RSA leaf for ${J}`),W}function lW($,J){let X=$.secureContexts.get(J);if(X)return X;let{certPem:Q,keyPem:Y}=W7($,J),G=Qq({cert:Q,key:Y});return $.secureContexts.set(J,G),G}function Xq($){return Jq($)!==0?{type:7,ip:$}:{type:2,value:$}}function Yq($,J){let X=$.validity.notAfter,Q=new Date(J);return Q.setDate(Q.getDate()+99),X<Q?new Date(X):Q}import{BlockList as pW,connect as dW,isIP as HQ}from"net";import{connect as Gq}from"tls";import{URL as U7}from"url";var cW=30000,Wq=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);function M7($){let J=$?.http??process.env.HTTP_PROXY??process.env.http_proxy??void 0,X=$?.https??process.env.HTTPS_PROXY??process.env.https_proxy??J,Q=$?.noProxy??process.env.NO_PROXY??process.env.no_proxy??"";if(!J&&!X)return;let Y=(U)=>{if(!U)return;let O=/^[a-z][a-z0-9+.-]*:\/\//i.test(U)?U:`http://${U}`;try{let V=new U7(O);if(V.protocol!=="http:"&&V.protocol!=="https:"||!V.hostname)throw Error("unsupported scheme or empty host");return V}catch{Z(`Invalid parent proxy URL, ignoring: ${Oq(U)}`,{level:"error"});return}},G=Y(J),W=Y(X);if(!G&&!W)return;return{httpUrl:G,httpsUrl:W,noProxy:Uq(Q)}}function Uq($){let J={all:!1,suffixes:[],cidr:new pW};for(let X of $.split(",")){if(X=X.trim(),!X)continue;if(X==="*"){J.all=!0;continue}let Q=X.indexOf("/");if(Q!==-1){let U=X.slice(0,Q),M=X.slice(Q+1),O=HQ(U);if(O&&M!==""&&/^\d+$/.test(M)){let V=Number(M),H=O===6?128:32;if(V>=0&&V<=H){try{J.cidr.addSubnet(U,V,O===6?"ipv6":"ipv4")}catch{}continue}}continue}let Y=X.toLowerCase(),G=/^\[([^\]]+)\](?::\d+)?$/.exec(Y);if(G)Y=G[1];if(Y.startsWith("*."))Y=Y.slice(1);let W=HQ(Y);if(!W){let U=Y.lastIndexOf(":");if(U!==-1&&/^\d+$/.test(Y.slice(U+1)))Y=Y.slice(0,U)}else try{J.cidr.addAddress(Y,W===6?"ipv6":"ipv4");continue}catch{}J.suffixes.push(Y)}return J}function yX($,J){let X=dJ(J.toLowerCase().replace(/\.$/,""));if(X==="localhost")return!0;let Q=HQ(X);if(Q){if(Mq.check(X,Q===6?"ipv6":"ipv4"))return!0}if($.noProxy.all)return!0;if(Q){if($.noProxy.cidr.check(X,Q===6?"ipv6":"ipv4"))return!0}for(let Y of $.noProxy.suffixes)if(Y.startsWith(".")){if(X===Y.slice(1)||X.endsWith(Y))return!0}else if(X===Y||X.endsWith("."+Y))return!0;return!1}var Mq=(()=>{let $=new pW;return $.addSubnet("127.0.0.0",8,"ipv4"),$.addAddress("::1","ipv6"),$.addSubnet("::ffff:127.0.0.0",104,"ipv6"),$})();function bX($,J){if(J.isHttps)return $.httpsUrl??$.httpUrl;return $.httpUrl}function O7($){let{destHost:J,destPort:X}=$,Q=dJ(J);if(!lQ(Q))return Promise.reject(Error(`Invalid destination host for CONNECT: ${JSON.stringify(J)}`));if(!Number.isInteger(X)||X<1||X>65535)return Promise.reject(Error(`Invalid destination port: ${X}`));let Y=HQ(Q)===6?`[${Q}]:${X}`:`${Q}:${X}`;return new Promise((G,W)=>{let U=$.dial(),M=!1,O=(H)=>{if(M)return;M=!0,U.destroy(),W(H)},V=()=>O(Error("Proxy closed during CONNECT handshake"));U.setTimeout($.timeoutMs??cW,()=>O(Error("CONNECT handshake timed out"))),U.once("error",O),U.once("close",V),U.once($.readyEvent,()=>{U.write(`CONNECT ${Y} HTTP/1.1\r
+`,{mode:420}),G}function tq($,J){let X=pJ.oids.sha256WithRSAEncryption,Q=()=>uQ([t$.create(hJ.UNIVERSAL,O0.OID,!1,t$.oidToDer(X).getBytes()),t$.create(hJ.UNIVERSAL,O0.NULL,!1,"")]),Y=(H,N)=>uQ([t$.create(hJ.UNIVERSAL,O0.OID,!1,t$.oidToDer(H).getBytes()),t$.create(hJ.UNIVERSAL,O0.OCTETSTRING,!1,t$.toDer(N).getBytes())]),G=t$.create(hJ.CONTEXT_SPECIFIC,0,!0,[uQ([Y(pJ.oids.authorityKeyIdentifier,uQ([t$.create(hJ.CONTEXT_SPECIFIC,0,!1,J7($))])),Y("2.5.29.20",t$.create(hJ.UNIVERSAL,O0.INTEGER,!1,"\x01"))])]),W=new Date,U=$.validity.notAfter,M=U>W?U:kX(1),O=uQ([t$.create(hJ.UNIVERSAL,O0.INTEGER,!1,"\x01"),Q(),pJ.distinguishedNameToAsn1($.subject),kW(W),kW(M),G]),V=hW(t$.toDer(O).getBytes(),J),q=uQ([O,Q(),t$.create(hJ.UNIVERSAL,O0.BITSTRING,!1,"\x00"+V)]);return Buffer.from(t$.toDer(q).getBytes(),"binary")}var{Class:hJ,Type:O0}=t$;function uQ($){return t$.create(hJ.UNIVERSAL,O0.SEQUENCE,!0,$)}function kW($){return $.getUTCFullYear()<2050?t$.create(hJ.UNIVERSAL,O0.UTCTIME,!1,t$.dateToUtcTime($)):t$.create(hJ.UNIVERSAL,O0.GENERALIZEDTIME,!1,t$.dateToGeneralizedTime($))}function eq($,J,X){let Q=fW($,"CERTIFICATE","tlsTerminate.caCertPath"),Y=fW(J,"PRIVATE KEY","tlsTerminate.caKeyPath"),G=fX(Q,Y);if(!G.ok)throw Error(`tlsTerminate: CA at ${$}: ${G.reason}`);return Z(`[mitm-ca] loaded CA from ${$}`),Y7(Q,Y,G.cert,G.key,{certPath:$,keyPath:J,extraCaCertPaths:X})}function Y7($,J,X,Q,Y){let G=r8(gQ($7(),"srt-ca-"));return{certPath:Y.certPath,keyPath:Y.keyPath,trustBundlePath:rq(G,$,Y.extraCaCertPaths),certPem:$,keyPem:J,cert:X,key:Q,leafCerts:new Map,secureContexts:new Map,crlDer:tq(X,J),ephemeral:Y.ephemeral??!1}}function tY($={}){let J=pJ.rsa.generateKeyPair(2048),X=pJ.createCertificate();X.publicKey=J.publicKey,X.serialNumber=G7(),X.validity.notBefore=kX(-1),X.validity.notAfter=kX($.validityDays??825);let Q=[{name:"commonName",value:$.cn??"sandbox-runtime ephemeral CA"},{name:"organizationName",value:"sandbox-runtime"}];X.setSubject(Q),X.setIssuer(Q),X.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",critical:!0,keyCertSign:!0,cRLSign:!0,digitalSignature:!0},{name:"subjectKeyIdentifier"}]);let Y=pJ.privateKeyToPem(J.privateKey);return Q7(X,Y),{certPem:pJ.certificateToPem(X),keyPem:Y,cert:X,key:J.privateKey}}function mQ($){return new dq($).fingerprint.replace(/:/g,"").toUpperCase()}function fX($,J){let X,Q;try{X=pJ.certificateFromPem($),Q=pJ.privateKeyFromPem(J)}catch(W){return{ok:!1,reason:`parse: ${W.message}`}}if(!("n"in Q)||!("d"in Q))return{ok:!1,reason:"key is not RSA"};if(X.validity.notBefore.getTime()>Date.now())return{ok:!1,reason:`notBefore ${X.validity.notBefore.toISOString()} is in the future (clock skew?)`};let Y=X.publicKey;if(!("n"in Y)||Y.n.compareTo(Q.n))return{ok:!1,reason:"key does not match certificate public key"};let G;try{G=mQ($)}catch(W){return{ok:!1,reason:`thumbprint: ${W.message}`}}return{ok:!0,thumbprint:G,notAfter:X.validity.notAfter,cert:X,key:Q}}function $6($){let{certPem:J,keyPem:X,cert:Q,key:Y}=tY(),G=r8(gQ($7(),"srt-ca-")),W=gQ(G,"ca.crt"),U=gQ(r8(gQ($7(),"srt-ca-key-")),"ca.key");return e8(W,J,{mode:420}),e8(U,X,{mode:384}),Z(`[mitm-ca] generated ephemeral CA at ${W}`),Y7(J,X,Q,Y,{certPath:W,keyPath:U,extraCaCertPaths:$,ephemeral:!0})}function fW($,J,X){let Q;try{Q=t8($,"utf8")}catch(Y){let G=Y.code??String(Y);throw Error(`${X}: cannot read ${$} (${G})`)}if(!new RegExp(`-----BEGIN [A-Z ]*${J}-----`).test(Q))throw Error(`${X}: ${$} is not a PEM ${J}`);return Q}function G7(){let $=oq.getBytesSync(16),J=bW.bytesToHex($);return(parseInt(J[0],16)&7).toString(16)+J.slice(1)}function kX($){let J=new Date;return J.setDate(J.getDate()+$),J}import{PassThrough as J6,Readable as gW}from"stream";var W7=new Set(["GET","HEAD","OPTIONS"]),pW="denied by sandbox policy";function mW($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}async function eY($,J,X,Q,Y,G){let W=J.method??"GET",U,M=J,O=Boolean(J.headers["content-length"]||J.headers["transfer-encoding"]),V=W7.has(W);if(!V||O){let N=new J6;N.on("error",()=>{}),J.pipe(N);let K=gW.toWeb(N),[L,A]=K.tee();U=L,M=gW.fromWeb(A);let D=M;D.on("error",()=>{}),J.on("error",(S)=>{N.end(),D.destroy(S)})}let q;try{if(U&&!(U instanceof ReadableStream))throw TypeError("Unexpected request body stream");let N=U&&!V?{body:U,duplex:"half"}:{};q=new Request(Q,{method:W,headers:Q6(J),signal:Y,...N})}catch(N){let K=`malformed request: ${N.message}`;if(G?.(W,Q,K),lW(X,{action:"deny",reason:K}),U?.cancel().catch(()=>{}),M.destroy(),M!==J)mW(J,X);return null}let H;try{H=await $(q)}catch(N){H={action:"deny",reason:`sandbox policy check failed: ${N.message}`}}if(U&&!q.bodyUsed)U.cancel().catch(()=>{});if(H.action==="allow")return Z(`[request-filter] allow ${W} ${Q}`),M;if(G?.(W,Q,H.reason??pW),lW(X,H),M.destroy(),M!==J)mW(J,X);return null}function lW($,J){yX($,J.reason??pW)}function yX($,J){if(Z(`[request-filter] deny: ${J}`),$.headersSent){$.destroy();return}$.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-sandbox-runtime"}),$.end(J+`
+`)}function Q6($){let J=new Headers;for(let[X,Q]of Object.entries($.headers)){if(Q===void 0)continue;if(Array.isArray(Q))for(let Y of Q)J.append(X,Y);else J.append(X,Q)}return J}import{createServer as j6,request as T6}from"https";import{connect as S6,isIP as F7}from"net";import{unlink as I6}from"fs";import{tmpdir as C6}from"os";import{join as w6}from"path";import{Transform as X6}from"stream";function Y6($){return $.every((J)=>J.sentinel.length===J.realValue.length)}function $9($,J,X,Q){if($===void 0)return;let Y=J.headers["content-length"]!==void 0||J.headers["transfer-encoding"]!==void 0;if(W7.has(J.method??"GET")&&!Y)return;let G=$(Q);if(!G?.length)return;if(J.headers["content-encoding"]!==void 0){Z(`[body-substitution] ${Q}: request body has Content-Encoding "${String(J.headers["content-encoding"])}"; masked-credential `+"substitution skipped \u2014 a sentinel in this body reaches the "+"upstream as the fake value",{level:"warn"});return}if(!Y6(G))delete X["content-length"];return G6(G)}function G6($){let J=Math.max(...$.map((Q)=>Q.sentinel.length)),X;return new X6({transform(Q,Y,G){let W=Buffer.isBuffer(Q)?Q:Buffer.from(Q,Y),U=X?.length?Buffer.concat([X,W]):W,{out:M,tail:O}=W6(U,$,J);X=O,G(null,M)},flush(Q){Q(null,X?.length?X:void 0)}})}function W6($,J,X){let Q=[],Y=0;for(;;){let W=-1,U;for(let M of J){let O=$.indexOf(M.sentinel,Y);if(O!==-1&&(W===-1||O<W))W=O,U=M}if(U===void 0)break;Q.push($.subarray(Y,W),U.realValue),Y=W+U.sentinel.length}let G=Math.max(Y,$.length-(X-1));return Q.push($.subarray(Y,G)),{out:Buffer.concat(Q),tail:Buffer.from($.subarray(G))}}var dW=p9(a8(),1);import{isIP as U6}from"net";import{createSecureContext as M6}from"tls";var{pki:J9}=dW.default;function U7($,J){let X=$.leafCerts.get(J);if(X)return X;let Q=J9.rsa.generateKeyPair(2048),Y=J9.createCertificate();Y.publicKey=Q.publicKey,Y.serialNumber=G7();let G=kX(-1);Y.validity.notBefore=G,Y.validity.notAfter=V6($.cert,G),Y.setSubject([{name:"commonName",value:J}]),Y.setIssuer($.cert.subject.attributes),Y.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",critical:!0,digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[O6(J)]},{name:"subjectKeyIdentifier"},{name:"authorityKeyIdentifier",keyIdentifier:J7($.cert)},...$.crlUrl?[{name:"cRLDistributionPoints",altNames:[{type:6,value:$.crlUrl}]}]:[]]),Q7(Y,$.keyPem);let W={certPem:J9.certificateToPem(Y)+$.certPem,keyPem:J9.privateKeyToPem(Q.privateKey)};return $.leafCerts.set(J,W),Z(`[mitm-leaf] minted RSA leaf for ${J}`),W}function cW($,J){let X=$.secureContexts.get(J);if(X)return X;let{certPem:Q,keyPem:Y}=U7($,J),G=M6({cert:Q,key:Y});return $.secureContexts.set(J,G),G}function O6($){return U6($)!==0?{type:7,ip:$}:{type:2,value:$}}function V6($,J){let X=$.validity.notAfter,Q=new Date(J);return Q.setDate(Q.getDate()+99),X<Q?new Date(X):Q}import{BlockList as nW,connect as iW,isIP as qQ}from"net";import{connect as q6}from"tls";import{URL as M7}from"url";var oW=30000,H6=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);function O7($){let J=$?.http??process.env.HTTP_PROXY??process.env.http_proxy??void 0,X=$?.https??process.env.HTTPS_PROXY??process.env.https_proxy??J,Q=$?.noProxy??process.env.NO_PROXY??process.env.no_proxy??"";if(!J&&!X)return;let Y=(U)=>{if(!U)return;let O=/^[a-z][a-z0-9+.-]*:\/\//i.test(U)?U:`http://${U}`;try{let V=new M7(O);if(V.protocol!=="http:"&&V.protocol!=="https:"||!V.hostname)throw Error("unsupported scheme or empty host");return V}catch{Z(`Invalid parent proxy URL, ignoring: ${E6(U)}`,{level:"error"});return}},G=Y(J),W=Y(X);if(!G&&!W)return;return{httpUrl:G,httpsUrl:W,noProxy:K6(Q)}}function K6($){let J={all:!1,suffixes:[],cidr:new nW};for(let X of $.split(",")){if(X=X.trim(),!X)continue;if(X==="*"){J.all=!0;continue}let Q=X.indexOf("/");if(Q!==-1){let U=X.slice(0,Q),M=X.slice(Q+1),O=qQ(U);if(O&&M!==""&&/^\d+$/.test(M)){let V=Number(M),q=O===6?128:32;if(V>=0&&V<=q){try{J.cidr.addSubnet(U,V,O===6?"ipv6":"ipv4")}catch{}continue}}continue}let Y=X.toLowerCase(),G=/^\[([^\]]+)\](?::\d+)?$/.exec(Y);if(G)Y=G[1];if(Y.startsWith("*."))Y=Y.slice(1);let W=qQ(Y);if(!W){let U=Y.lastIndexOf(":");if(U!==-1&&/^\d+$/.test(Y.slice(U+1)))Y=Y.slice(0,U)}else try{J.cidr.addAddress(Y,W===6?"ipv6":"ipv4");continue}catch{}J.suffixes.push(Y)}return J}function bX($,J){let X=dJ(J.toLowerCase().replace(/\.$/,""));if(X==="localhost")return!0;let Q=qQ(X);if(Q){if(z6.check(X,Q===6?"ipv6":"ipv4"))return!0}if($.noProxy.all)return!0;if(Q){if($.noProxy.cidr.check(X,Q===6?"ipv6":"ipv4"))return!0}for(let Y of $.noProxy.suffixes)if(Y.startsWith(".")){if(X===Y.slice(1)||X.endsWith(Y))return!0}else if(X===Y||X.endsWith("."+Y))return!0;return!1}var z6=(()=>{let $=new nW;return $.addSubnet("127.0.0.0",8,"ipv4"),$.addAddress("::1","ipv6"),$.addSubnet("::ffff:127.0.0.0",104,"ipv6"),$})();function hX($,J){if(J.isHttps)return $.httpsUrl??$.httpUrl;return $.httpUrl}function V7($){let{destHost:J,destPort:X}=$,Q=dJ(J);if(!lQ(Q))return Promise.reject(Error(`Invalid destination host for CONNECT: ${JSON.stringify(J)}`));if(!Number.isInteger(X)||X<1||X>65535)return Promise.reject(Error(`Invalid destination port: ${X}`));let Y=qQ(Q)===6?`[${Q}]:${X}`:`${Q}:${X}`;return new Promise((G,W)=>{let U=$.dial(),M=!1,O=(q)=>{if(M)return;M=!0,U.destroy(),W(q)},V=()=>O(Error("Proxy closed during CONNECT handshake"));U.setTimeout($.timeoutMs??oW,()=>O(Error("CONNECT handshake timed out"))),U.once("error",O),U.once("close",V),U.once($.readyEvent,()=>{U.write(`CONNECT ${Y} HTTP/1.1\r
 Host: ${Y}\r
 `+($.authHeader?`Proxy-Authorization: ${$.authHeader}\r
 `:"")+`\r
-`);let H="",q=(F)=>{H+=F.toString("latin1");let K=H.indexOf(`\r
+`);let q="",H=(N)=>{q+=N.toString("latin1");let K=q.indexOf(`\r
 \r
-`);if(K===-1){if(H.length>16384)O(Error("CONNECT response header too large"));return}U.pause(),U.removeListener("data",q);let A=H.slice(0,H.indexOf(`\r
-`));if(!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(A))return O(Error(`Proxy refused CONNECT: ${A.trim()}`));let L=H.slice(K+4);if(L.length)U.unshift(Buffer.from(L,"latin1"));M=!0,U.setTimeout(0),U.removeListener("error",O),U.removeListener("close",V),G(U)};U.on("data",q)})})}function J9($,J,X){let Q=dJ($.hostname),Y=Number($.port)||($.protocol==="https:"?443:80),G=$.protocol==="https:";return O7({destHost:J,destPort:X,authHeader:V7($),readyEvent:G?"secureConnect":"connect",dial:()=>G?Gq({host:Q,port:Y,...HQ(Q)?{}:{servername:Q}}):dW(Y,Q)})}function V7($){if(!$.username&&!$.password)return;try{let J=`${decodeURIComponent($.username)}:${decodeURIComponent($.password)}`;return`Basic ${Buffer.from(J).toString("base64")}`}catch{let J=`${$.username}:${$.password}`;return`Basic ${Buffer.from(J).toString("base64")}`}}function u0($){let J=new Set,X=$.connection;if(X)for(let Y of String(X).split(","))J.add(Y.trim().toLowerCase());let Q={};for(let[Y,G]of Object.entries($)){let W=Y.toLowerCase();if(!Wq.has(W)&&!J.has(W))Q[Y]=G}return Q}function dJ($){return $.startsWith("[")&&$.endsWith("]")?$.slice(1,-1):$}function H7($){if(!$)return"-";if(!$.username&&!$.password)return $.href;let J=new U7($.href);return J.username="***",J.password="***",J.href}function Oq($){return $.replace(/\/\/[^@/]*@/,"//***:***@")}function lQ($){if(!$||$.length>255)return!1;let J=dJ($);if(J.includes("%"))return!1;if(HQ(J))return!0;return/^[A-Za-z0-9._-]+$/.test(J)}function jJ($){try{let J=dJ($),X=HQ(J)===6?`[${J}]`:J,Q=new U7(`http://${X}/`).hostname;return dJ(Q).replace(/\.$/,"")}catch{return}}function Q9($,J,X=cW){return new Promise((Q,Y)=>{let G=dW(J,$),W=!1,U=(M)=>{if(W)return;if(W=!0,G.setTimeout(0),M)G.destroy(),Y(M);else Q(G)};G.setTimeout(X,()=>U(Error("connect timed out"))),G.once("connect",()=>U()),G.once("error",U),G.once("close",()=>U(Error("socket closed before connect")))})}import{createHash as Vq,createHmac as aW}from"crypto";var hX="AWS4-HMAC-SHA256",Hq="AWS4-ECDSA-P256-SHA256",Y9="UNSIGNED-PAYLOAD";function sW($,J){let X=pQ($.authorization);if(X!==void 0&&X.startsWith(Hq)){let U=nW(X);if(U!==void 0)return{kind:"sigv4a",accessKeyId:U}}else if(X!==void 0&&X.startsWith(hX)){let U=nW(X);if(U!==void 0)return{kind:pQ($["x-amz-content-sha256"])?.startsWith("STREAMING-")?"streaming":"header-sigv4",accessKeyId:U}}let Q=J.indexOf("?");if(Q===-1)return null;let Y=new URLSearchParams(J.slice(Q+1));if(Y.get("X-Amz-Algorithm")!==hX)return null;if(!Y.has("X-Amz-Signature"))return null;let G=Y.get("X-Amz-Credential");if(!G)return null;let W=G.split("/")[0];return W?{kind:"presigned",accessKeyId:W}:null}function nW($){return/Credential=([^/,\s]+)\//.exec($)?.[1]}function rW($){if(!$.startsWith(hX))return null;let J=/Credential=([^,\s]+)/.exec($)?.[1],X=/SignedHeaders=([^,\s]+)/.exec($)?.[1],Q=/Signature=([0-9a-fA-F]+)/.exec($)?.[1];if(!J||!X||!Q)return null;let Y=J.split("/");if(Y.length!==5||Y[4]!=="aws4_request")return null;let[G,W,U,M]=Y;if(!G||!W||!U||!M)return null;return{accessKeyId:G,date:W,region:U,service:M,signedHeaders:X.split(";").map((O)=>O.toLowerCase()),signature:Q}}function q7($){return encodeURIComponent($).replace(/[!'()*]/g,(J)=>"%"+J.charCodeAt(0).toString(16).toUpperCase())}function qq($,J){if($==="")return"/";if(J==="s3")return $;let X=[];for(let G of $.split("/")){if(G===""||G===".")continue;if(G==="..")X.pop();else X.push(G)}let Q=X.length>0&&$.endsWith("/")?"/":"",Y=`/${X.join("/")}${Q}`;return q7(Y).replace(/%2F/gi,"/")}function Kq($){if($==="")return"";let J=[];for(let X of $.split("&")){if(X==="")continue;let Q=X.indexOf("="),Y=Q===-1?X:X.slice(0,Q),G=Q===-1?"":X.slice(Q+1);J.push([q7(iW(Y)),q7(iW(G))])}return J.sort(([X,Q],[Y,G])=>X<Y?-1:X>Y?1:Q<G?-1:Q>G?1:0),J.map(([X,Q])=>`${X}=${Q}`).join("&")}function iW($){try{return decodeURIComponent($)}catch{return $}}function oW($){return $.trim().replace(/[ \t]+/g," ")}function zq($){let J=$.requestTarget.indexOf("?"),X=J===-1?$.requestTarget:$.requestTarget.slice(0,J),Q=J===-1?"":$.requestTarget.slice(J+1),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=[];for(let W of Y){let U=W==="host"?$.hostHeader:$.headers[W];if(U===void 0)throw Error(`signed header "${W}" is missing from the request`);let M=Array.isArray(U)?U.map(oW).join(","):oW(String(U));G.push(`${W}:${M}`)}return[$.method.toUpperCase(),qq(X,$.scope.service),Kq(Q),G.join(`
+`);if(K===-1){if(q.length>16384)O(Error("CONNECT response header too large"));return}U.pause(),U.removeListener("data",H);let L=q.slice(0,q.indexOf(`\r
+`));if(!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(L))return O(Error(`Proxy refused CONNECT: ${L.trim()}`));let A=q.slice(K+4);if(A.length)U.unshift(Buffer.from(A,"latin1"));M=!0,U.setTimeout(0),U.removeListener("error",O),U.removeListener("close",V),G(U)};U.on("data",H)})})}function Q9($,J,X){let Q=dJ($.hostname),Y=Number($.port)||($.protocol==="https:"?443:80),G=$.protocol==="https:";return V7({destHost:J,destPort:X,authHeader:q7($),readyEvent:G?"secureConnect":"connect",dial:()=>G?q6({host:Q,port:Y,...qQ(Q)?{}:{servername:Q}}):iW(Y,Q)})}function q7($){if(!$.username&&!$.password)return;try{let J=`${decodeURIComponent($.username)}:${decodeURIComponent($.password)}`;return`Basic ${Buffer.from(J).toString("base64")}`}catch{let J=`${$.username}:${$.password}`;return`Basic ${Buffer.from(J).toString("base64")}`}}function u0($){let J=new Set,X=$.connection;if(X)for(let Y of String(X).split(","))J.add(Y.trim().toLowerCase());let Q={};for(let[Y,G]of Object.entries($)){let W=Y.toLowerCase();if(!H6.has(W)&&!J.has(W))Q[Y]=G}return Q}function dJ($){return $.startsWith("[")&&$.endsWith("]")?$.slice(1,-1):$}function H7($){if(!$)return"-";if(!$.username&&!$.password)return $.href;let J=new M7($.href);return J.username="***",J.password="***",J.href}function E6($){return $.replace(/\/\/[^@/]*@/,"//***:***@")}function lQ($){if(!$||$.length>255)return!1;let J=dJ($);if(J.includes("%"))return!1;if(qQ(J))return!0;return/^[A-Za-z0-9._-]+$/.test(J)}function jJ($){try{let J=dJ($),X=qQ(J)===6?`[${J}]`:J,Q=new M7(`http://${X}/`).hostname;return dJ(Q).replace(/\.$/,"")}catch{return}}function X9($,J,X=oW){return new Promise((Q,Y)=>{let G=iW(J,$),W=!1,U=(M)=>{if(W)return;if(W=!0,G.setTimeout(0),M)G.destroy(),Y(M);else Q(G)};G.setTimeout(X,()=>U(Error("connect timed out"))),G.once("connect",()=>U()),G.once("error",U),G.once("close",()=>U(Error("socket closed before connect")))})}import{createHash as F6,createHmac as tW}from"crypto";var uX="AWS4-HMAC-SHA256",N6="AWS4-ECDSA-P256-SHA256",G9="UNSIGNED-PAYLOAD";function eW($,J){let X=pQ($.authorization);if(X!==void 0&&X.startsWith(N6)){let U=aW(X);if(U!==void 0)return{kind:"sigv4a",accessKeyId:U}}else if(X!==void 0&&X.startsWith(uX)){let U=aW(X);if(U!==void 0)return{kind:pQ($["x-amz-content-sha256"])?.startsWith("STREAMING-")?"streaming":"header-sigv4",accessKeyId:U}}let Q=J.indexOf("?");if(Q===-1)return null;let Y=new URLSearchParams(J.slice(Q+1));if(Y.get("X-Amz-Algorithm")!==uX)return null;if(!Y.has("X-Amz-Signature"))return null;let G=Y.get("X-Amz-Credential");if(!G)return null;let W=G.split("/")[0];return W?{kind:"presigned",accessKeyId:W}:null}function aW($){return/Credential=([^/,\s]+)\//.exec($)?.[1]}function $4($){if(!$.startsWith(uX))return null;let J=/Credential=([^,\s]+)/.exec($)?.[1],X=/SignedHeaders=([^,\s]+)/.exec($)?.[1],Q=/Signature=([0-9a-fA-F]+)/.exec($)?.[1];if(!J||!X||!Q)return null;let Y=J.split("/");if(Y.length!==5||Y[4]!=="aws4_request")return null;let[G,W,U,M]=Y;if(!G||!W||!U||!M)return null;return{accessKeyId:G,date:W,region:U,service:M,signedHeaders:X.split(";").map((O)=>O.toLowerCase()),signature:Q}}function K7($){return encodeURIComponent($).replace(/[!'()*]/g,(J)=>"%"+J.charCodeAt(0).toString(16).toUpperCase())}function L6($,J){if($==="")return"/";if(J==="s3")return $;let X=[];for(let G of $.split("/")){if(G===""||G===".")continue;if(G==="..")X.pop();else X.push(G)}let Q=X.length>0&&$.endsWith("/")?"/":"",Y=`/${X.join("/")}${Q}`;return K7(Y).replace(/%2F/gi,"/")}function A6($){if($==="")return"";let J=[];for(let X of $.split("&")){if(X==="")continue;let Q=X.indexOf("="),Y=Q===-1?X:X.slice(0,Q),G=Q===-1?"":X.slice(Q+1);J.push([K7(sW(Y)),K7(sW(G))])}return J.sort(([X,Q],[Y,G])=>X<Y?-1:X>Y?1:Q<G?-1:Q>G?1:0),J.map(([X,Q])=>`${X}=${Q}`).join("&")}function sW($){try{return decodeURIComponent($)}catch{return $}}function rW($){return $.trim().replace(/[ \t]+/g," ")}function R6($){let J=$.requestTarget.indexOf("?"),X=J===-1?$.requestTarget:$.requestTarget.slice(0,J),Q=J===-1?"":$.requestTarget.slice(J+1),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=[];for(let W of Y){let U=W==="host"?$.hostHeader:$.headers[W];if(U===void 0)throw Error(`signed header "${W}" is missing from the request`);let M=Array.isArray(U)?U.map(rW).join(","):rW(String(U));G.push(`${W}:${M}`)}return[$.method.toUpperCase(),L6(X,$.scope.service),A6(Q),G.join(`
 `)+`
 `,Y.join(";"),$.payloadHash].join(`
-`)}function Eq($,J,X){return[hX,J,`${X.date}/${X.region}/${X.service}/aws4_request`,K7($)].join(`
-`)}function Fq($,J){let X=X9(`AWS4${$}`,J.date),Q=X9(X,J.region),Y=X9(Q,J.service);return X9(Y,"aws4_request")}function tW($){let J=zq($),X=Eq(J,$.amzDate,$.scope),Q=aW("sha256",Fq($.secretAccessKey,$.scope)).update(X,"utf8").digest("hex"),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=`${$.scope.date}/${$.scope.region}/${$.scope.service}/aws4_request`;return{authorization:`${hX} Credential=${$.accessKeyId}/${G}, SignedHeaders=${Y.join(";")}, Signature=${Q}`,signature:Q,canonicalRequest:J,stringToSign:X}}function K7($){return Vq("sha256").update($).digest("hex")}function X9($,J){return aW("sha256",$).update(J,"utf8").digest()}function pQ($){return Array.isArray($)?$[0]:$}var Q4=67108864;class z7 extends Error{}function $4($){return $.length>=3&&$[0]===22&&$[1]===3&&$[2]<=3}function X4($,J){if(J.length>=3)return Promise.resolve({isTLS:$4(J),head:J});return new Promise((X)=>{let Q=J,Y=()=>{$.removeListener("data",G),$.removeListener("close",Y),X({isTLS:$4(Q),head:Q})},G=(W)=>{if($.pause(),Q=Q.length?Buffer.concat([Q,W]):W,Q.length>=3)return Y();$.resume()};$.on("data",G),$.once("close",Y)})}function Bq($,J){let X=()=>{let Q;while((Q=$.read())!==null)if(!J.write(Q)){J.once("drain",X);return}$.once("readable",X)};X(),$.once("end",()=>J.end())}function Y4($,J,X,Q,Y,G,W,U,M=Q4){let O=W7($,W.hostname),V=Nq({ALPNProtocols:["http/1.1"],cert:O.certPem,key:O.keyPem,SNICallback:(F,K)=>{try{K(null,lW($,F||W.hostname))}catch(A){K(A)}}});V.on("request",(F,K)=>{F.on("error",(A)=>{Z(`[tls-terminate] client request error: ${A.message}`,{level:"error"})}),K.on("error",(A)=>{Z(`[tls-terminate] client response error: ${A.message}`,{level:"error"})}),jq(J,X,Q,F,K,W,U,M)}),V.on("clientError",(F,K)=>{Z(`[tls-terminate] client connection error for ${W.hostname}: ${F.message}`,{level:"error"}),K.destroy()}),V.on("tlsClientError",(F,K)=>{Z(`[tls-terminate] client TLS error for ${W.hostname}: ${F.message}`,{level:"error"}),K.destroy()}),V.on("upgrade",(F,K)=>{Z("[tls-terminate] upgrade request refused",{level:"warn"}),K.destroy()});let H=wq(),q=()=>{V.close(),Rq(H,()=>{})};V.on("error",(F)=>{Z(`[tls-terminate] inner server listen failed: ${F.message}`,{level:"error"}),Y.destroy(),q()}),V.listen(H,()=>{let F=Aq({path:H});F.on("error",(K)=>{Z(`[tls-terminate] inner loopback failed: ${K.message}`,{level:"error"}),Y.destroy(),q()}),F.once("connect",()=>{if(G.length)F.write(G);Bq(Y,F),F.pipe(Y)}),Y.on("error",()=>F.destroy()),Y.once("close",()=>{F.destroy(),q()}),F.once("close",()=>Y.destroy())}),V.unref()}function J4($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}function jq(...$){Tq(...$).catch((J)=>{Z(`[tls-terminate] forwardUpstream failed: ${J.message}`,{level:"error"})})}async function Tq($,J,X,Q,Y,G,W,U=Q4){let M=Iq(Q.url),O=Q;if($){let L=new AbortController;Y.once("close",()=>L.abort());let R=G.port===443?G.hostname:`${G.hostname}:${G.port}`,I=await tY($,Q,Y,`https://${R}${M}`,L.signal,G.onFilterRequestDeny);if(I===null)return;if(O=I,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||O.destroyed){O.destroy();return}}let V=u0(Q.headers);delete V.host;let H=W?.(Q.method??"GET",M,V,G.hostname);J?.(V,G.hostname);let q=eY(X,Q,V,G.hostname),F;if(H?.action==="deny"){if(fX(Y,H.reason),O.destroy(),O!==Q)J4(Q,Y);return}if(H?.action==="resign"){let L=H.payloadHash;if(L===void 0){let j=q?O.pipe(q):O;if(q)O.on("error",(C)=>q.destroy(C));try{F=await Sq(j,U)}catch(C){if(C instanceof z7){fX(Y,`AWS SigV4 request uses a masked credential and signs a literal body hash, so the proxy must buffer the body to re-sign it, but the body exceeds the ${U}-byte buffering limit; denied. Sign the payload as UNSIGNED-PAYLOAD to stream it without buffering, or use an unmasked credential to have the request forwarded untouched.`),j.resume();return}Z(`[tls-terminate] failed to buffer body for SigV4 re-sign: ${C.message}`,{level:"error"}),Y.destroy();return}L=K7(F),V["content-length"]=String(F.length)}let R=eW(G.hostname)===6?`[${G.hostname}]`:G.hostname,I=G.port===443?R:`${R}:${G.port}`;try{H.apply(V,I,L)}catch(j){if(fX(Y,`AWS SigV4 re-signing failed: ${j.message}`),O.destroy(),O!==Q)J4(Q,Y);return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&F===void 0&&V["content-length"]===void 0&&V["transfer-encoding"]===void 0)V["transfer-encoding"]="chunked";let A=Lq({host:G.hostname,port:G.port,path:M,method:Q.method,headers:V,...eW(G.hostname)?{}:{servername:G.hostname},...G.upstreamCA?{ca:G.upstreamCA}:{},agent:!1},(L)=>{L.on("error",(R)=>{Z(`[tls-terminate] upstream response error: ${R.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(L.statusCode??502,u0(L.headers)),L.pipe(Y)});if(A.on("error",(L)=>{if(Z(`[tls-terminate] upstream ${G.hostname}:${G.port} failed: ${L.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>A.destroy()),F!==void 0)A.end(F);else if(q)q.on("error",(L)=>A.destroy(L)),O.on("error",(L)=>q.destroy(L)),Y.on("close",()=>q.destroy()),O.pipe(q).pipe(A);else O.on("error",(L)=>A.destroy(L)),O.pipe(A)}function Sq($,J){return new Promise((X,Q)=>{let Y=[],G=0,W=(U)=>{if(G+=U.length,G>J){Y.length=0,$.removeListener("data",W),Q(new z7(`request body exceeds ${J} bytes`));return}Y.push(U)};$.on("data",W),$.once("end",()=>X(Buffer.concat(Y))),$.once("error",Q)})}function Iq($){let J=$??"/";if(J.startsWith("/"))return J;try{let X=new URL(J);return`${X.pathname}${X.search}`||"/"}catch{return J}}var Cq=0;function wq(){return Zq(Dq(),`srt-tt-${process.pid}-${(Cq++).toString(36)}.sock`)}function kq($,J){if(!J)return{ok:!0};let X=/^basic\s+([a-z0-9+/=]+)\s*$/i.exec($??"");if(!X)return{ok:!1};let Q=Buffer.from(X[1],"base64").toString("utf8"),Y=Q.indexOf(":");if(Y<=0||!HY(Q.slice(Y+1),J))return{ok:!1};return{ok:!0,encodedCommand:FY(Q.slice(0,Y))}}function U4($){let J=_q();J.on("clientError",(Q,Y)=>{if(Z(`Client connection error: ${Q.message}`,{level:"error"}),Y.on("error",()=>{}),Q.code!=="ECONNRESET"&&Y.writable){let G=Q.code==="HPE_HEADER_OVERFLOW"?"431 Request Header Fields Too Large":"400 Bad Request";Y.end(`HTTP/1.1 ${G}\r
+`)}function D6($,J,X){return[uX,J,`${X.date}/${X.region}/${X.service}/aws4_request`,z7($)].join(`
+`)}function Z6($,J){let X=Y9(`AWS4${$}`,J.date),Q=Y9(X,J.region),Y=Y9(Q,J.service);return Y9(Y,"aws4_request")}function J4($){let J=R6($),X=D6(J,$.amzDate,$.scope),Q=tW("sha256",Z6($.secretAccessKey,$.scope)).update(X,"utf8").digest("hex"),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=`${$.scope.date}/${$.scope.region}/${$.scope.service}/aws4_request`;return{authorization:`${uX} Credential=${$.accessKeyId}/${G}, SignedHeaders=${Y.join(";")}, Signature=${Q}`,signature:Q,canonicalRequest:J,stringToSign:X}}function z7($){return F6("sha256").update($).digest("hex")}function Y9($,J){return tW("sha256",$).update(J,"utf8").digest()}function pQ($){return Array.isArray($)?$[0]:$}var Q4="reason-egress-target",X4="reason-egress-token";class E7{entries=new Map;refs=new Map;lease=null;register($,J,X,Q){if(!$||!J||X.length===0)return;if(this.entries.set($,{placeholder:$,token:J,hosts:[...X],url:Q}),this.lease&&!this.lease.has($))this.lease.add($),this.refs.set($,(this.refs.get($)??0)+1)}beginLease(){this.lease=new Set}endLease(){let $=[...this.lease??[]];return this.lease=null,$}release($){for(let J of $){let X=(this.refs.get(J)??1)-1;if(X>0){this.refs.set(J,X);continue}this.refs.delete(J),this.entries.delete(J)}$.length=0}clear(){this.entries.clear(),this.refs.clear()}forwardFor($,J){for(let X of this.entries.values()){if(!X.hosts.includes(J))continue;for(let Q of Object.values($))if((Array.isArray(Q)?Q:Q===void 0?[]:[Q]).some((G)=>G.includes(X.placeholder)||B6(G,X.placeholder)))return{url:new URL(X.url),token:X.token}}return}}function B6($,J){let X=/^\s*basic\s+([A-Za-z0-9+/=_-]+)\s*$/i.exec($);return X?Buffer.from(X[1],"base64").toString("utf8").includes(J):!1}var W4=67108864;class N7 extends Error{}function Y4($){return $.length>=3&&$[0]===22&&$[1]===3&&$[2]<=3}function U4($,J){if(J.length>=3)return Promise.resolve({isTLS:Y4(J),head:J});return new Promise((X)=>{let Q=J,Y=()=>{$.removeListener("data",G),$.removeListener("close",Y),X({isTLS:Y4(Q),head:Q})},G=(W)=>{if($.pause(),Q=Q.length?Buffer.concat([Q,W]):W,Q.length>=3)return Y();$.resume()};$.on("data",G),$.once("close",Y)})}function P6($,J){let X=()=>{let Q;while((Q=$.read())!==null)if(!J.write(Q)){J.once("drain",X);return}$.once("readable",X)};X(),$.once("end",()=>J.end())}function M4($,J,X,Q,Y,G,W,U,M=W4,O){let V=U7($,W.hostname),q=j6({ALPNProtocols:["http/1.1"],cert:V.certPem,key:V.keyPem,SNICallback:(K,L)=>{try{L(null,cW($,K||W.hostname))}catch(A){L(A)}}});q.on("request",(K,L)=>{K.on("error",(A)=>{Z(`[tls-terminate] client request error: ${A.message}`,{level:"error"})}),L.on("error",(A)=>{Z(`[tls-terminate] client response error: ${A.message}`,{level:"error"})}),_6(J,X,Q,K,L,W,U,M,O)}),q.on("clientError",(K,L)=>{Z(`[tls-terminate] client connection error for ${W.hostname}: ${K.message}`,{level:"error"}),L.destroy()}),q.on("tlsClientError",(K,L)=>{Z(`[tls-terminate] client TLS error for ${W.hostname}: ${K.message}`,{level:"error"}),L.destroy()}),q.on("upgrade",(K,L)=>{Z("[tls-terminate] upgrade request refused",{level:"warn"}),L.destroy()});let H=y6(),N=()=>{q.close(),I6(H,()=>{})};q.on("error",(K)=>{Z(`[tls-terminate] inner server listen failed: ${K.message}`,{level:"error"}),Y.destroy(),N()}),q.listen(H,()=>{let K=S6({path:H});K.on("error",(L)=>{Z(`[tls-terminate] inner loopback failed: ${L.message}`,{level:"error"}),Y.destroy(),N()}),K.once("connect",()=>{if(G.length)K.write(G);P6(Y,K),K.pipe(Y)}),Y.on("error",()=>K.destroy()),Y.once("close",()=>{K.destroy(),N()}),K.once("close",()=>Y.destroy())}),q.unref()}function G4($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}function _6(...$){x6(...$).catch((J)=>{Z(`[tls-terminate] forwardUpstream failed: ${J.message}`,{level:"error"})})}async function x6($,J,X,Q,Y,G,W,U=W4,M){let O=k6(Q.url),V=Q;if($){let B=new AbortController;Y.once("close",()=>B.abort());let C=G.port===443?G.hostname:`${G.hostname}:${G.port}`,w=await eY($,Q,Y,`https://${C}${O}`,B.signal,G.onFilterRequestDeny);if(w===null)return;if(V=w,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||V.destroyed){V.destroy();return}}let q=u0(Q.headers);delete q.host;let H=M?.(q,G.hostname),N=W?.(Q.method??"GET",O,q,G.hostname);J?.(q,G.hostname);let K=$9(X,Q,q,G.hostname),L;if(N?.action==="deny"){if(yX(Y,N.reason),V.destroy(),V!==Q)G4(Q,Y);return}if(N?.action==="resign"){let B=N.payloadHash;if(B===void 0){let P=K?V.pipe(K):V;if(K)V.on("error",(l)=>K.destroy(l));try{L=await v6(P,U)}catch(l){if(l instanceof N7){yX(Y,`AWS SigV4 request uses a masked credential and signs a literal body hash, so the proxy must buffer the body to re-sign it, but the body exceeds the ${U}-byte buffering limit; denied. Sign the payload as UNSIGNED-PAYLOAD to stream it without buffering, or use an unmasked credential to have the request forwarded untouched.`),P.resume();return}Z(`[tls-terminate] failed to buffer body for SigV4 re-sign: ${l.message}`,{level:"error"}),Y.destroy();return}B=z7(L),q["content-length"]=String(L.length)}let C=F7(G.hostname)===6?`[${G.hostname}]`:G.hostname,w=G.port===443?C:`${C}:${G.port}`;try{N.apply(q,w,B)}catch(P){if(yX(Y,`AWS SigV4 re-signing failed: ${P.message}`),V.destroy(),V!==Q)G4(Q,Y);return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&L===void 0&&q["content-length"]===void 0&&q["transfer-encoding"]===void 0)q["transfer-encoding"]="chunked";if(H){let B=F7(G.hostname)===6?`[${G.hostname}]`:G.hostname;q[Q4]=`https://${G.port===443?B:`${B}:${G.port}`}${O}`,q[X4]=H.token}let D=H?H.url.hostname:G.hostname,S=T6({host:D,port:H?Number(H.url.port||443):G.port,path:H?`${H.url.pathname}${H.url.search}`:O,method:Q.method,headers:q,...F7(D)?{}:{servername:D},...G.upstreamCA?{ca:G.upstreamCA}:{},agent:!1},(B)=>{B.on("error",(C)=>{Z(`[tls-terminate] upstream response error: ${C.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(B.statusCode??502,u0(B.headers)),B.pipe(Y)});if(S.on("error",(B)=>{if(Z(`[tls-terminate] upstream ${G.hostname}:${G.port} failed: ${B.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>S.destroy()),L!==void 0)S.end(L);else if(K)K.on("error",(B)=>S.destroy(B)),V.on("error",(B)=>K.destroy(B)),Y.on("close",()=>K.destroy()),V.pipe(K).pipe(S);else V.on("error",(B)=>S.destroy(B)),V.pipe(S)}function v6($,J){return new Promise((X,Q)=>{let Y=[],G=0,W=(U)=>{if(G+=U.length,G>J){Y.length=0,$.removeListener("data",W),Q(new N7(`request body exceeds ${J} bytes`));return}Y.push(U)};$.on("data",W),$.once("end",()=>X(Buffer.concat(Y))),$.once("error",Q)})}function k6($){let J=$??"/";if(J.startsWith("/"))return J;try{let X=new URL(J);return`${X.pathname}${X.search}`||"/"}catch{return J}}var f6=0;function y6(){return w6(C6(),`srt-tt-${process.pid}-${(f6++).toString(36)}.sock`)}function m6($,J){if(!J)return{ok:!0};let X=/^basic\s+([a-z0-9+/=]+)\s*$/i.exec($??"");if(!X)return{ok:!1};let Q=Buffer.from(X[1],"base64").toString("utf8"),Y=Q.indexOf(":");if(Y<=0||!HY(Q.slice(Y+1),J))return{ok:!1};return{ok:!0,encodedCommand:NY(Q.slice(0,Y))}}function q4($){let J=h6();J.on("clientError",(Q,Y)=>{if(Z(`Client connection error: ${Q.message}`,{level:"error"}),Y.on("error",()=>{}),Q.code!=="ECONNRESET"&&Y.writable){let G=Q.code==="HPE_HEADER_OVERFLOW"?"431 Request Header Fields Too Large":"400 Bad Request";Y.end(`HTTP/1.1 ${G}\r
 \r
-`,()=>Y.destroy()),setTimeout(()=>Y.destroy(),1000).unref?.();return}Y.destroy()});let X=(Q)=>kq(Q,$.proxyAuthToken);return J.on("connect",async(Q,Y,G)=>{Y.on("error",(R)=>{Z(`Client socket error: ${R.message}`,{level:"error"}),Y.destroy()});let W=!1;Y.once("close",()=>{W=!0});let U=()=>{W=!0,Y.destroy()},M=65536,O=0,V=!1,H=[],q=(R)=>{if(!V)return;if(O+=R.length,O>M){Z("CONNECT client exceeded pre-establishment capture cap; destroying",{level:"error"}),U();return}H.push(R)};if(!$.mitmCA)V=!0,Y.on("data",q);if(Y.readableEnded)U();else Y.once("end",U);let F=()=>{if(V=!1,H.length)G=Buffer.concat([G,...H]),H.length=0},K=()=>{Y.removeListener("end",U),F()},A=(R)=>{if(W||Y.destroyed||Y.readableEnded||!Y.writable){Z("CONNECT client gone before status write; dropping verdict and destroying socket"),Y.destroy();return}K(),Y.end(R)};if(W||Y.destroyed)return;let L=!1;try{let R=X(Q.headers["proxy-authorization"]);if(!R.ok){A(`HTTP/1.1 407 Proxy Authentication Required\r
+`,()=>Y.destroy()),setTimeout(()=>Y.destroy(),1000).unref?.();return}Y.destroy()});let X=(Q)=>m6(Q,$.proxyAuthToken);return J.on("connect",async(Q,Y,G)=>{Y.on("error",(D)=>{Z(`Client socket error: ${D.message}`,{level:"error"}),Y.destroy()});let W=!1;Y.once("close",()=>{W=!0});let U=()=>{W=!0,Y.destroy()},M=65536,O=0,V=!1,q=[],H=(D)=>{if(!V)return;if(O+=D.length,O>M){Z("CONNECT client exceeded pre-establishment capture cap; destroying",{level:"error"}),U();return}q.push(D)};if(!$.mitmCA)V=!0,Y.on("data",H);if(Y.readableEnded)U();else Y.once("end",U);let N=()=>{if(V=!1,q.length)G=Buffer.concat([G,...q]),q.length=0},K=()=>{Y.removeListener("end",U),N()},L=(D)=>{if(W||Y.destroyed||Y.readableEnded||!Y.writable){Z("CONNECT client gone before status write; dropping verdict and destroying socket"),Y.destroy();return}K(),Y.end(D)};if(W||Y.destroyed)return;let A=!1;try{let D=X(Q.headers["proxy-authorization"]);if(!D.ok){L(`HTTP/1.1 407 Proxy Authentication Required\r
 Proxy-Authenticate: Basic realm="srt"\r
 \r
-`);return}let I=fq(Q.url);if(!I){Z(`Invalid CONNECT request: ${Q.url}`,{level:"error"}),A(`HTTP/1.1 400 Bad Request\r
+`);return}let S=l6(Q.url);if(!S){Z(`Invalid CONNECT request: ${Q.url}`,{level:"error"}),L(`HTTP/1.1 400 Bad Request\r
 \r
-`);return}let{hostname:j,port:C}=I;if(!await $.filter(C,j,Y,R.encodedCommand)){Z(`Connection blocked to ${j}:${C}`,{level:"error"}),A(`HTTP/1.1 403 Forbidden\r
+`);return}let{hostname:B,port:C}=S;if(!await $.filter(C,B,Y,D.encodedCommand)){Z(`Connection blocked to ${B}:${C}`,{level:"error"}),L(`HTTP/1.1 403 Forbidden\r
 Content-Type: text/plain\r
 X-Proxy-Error: blocked-by-allowlist\r
 \r
-Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(j)??j;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connection Established\r
+Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let P=jJ(B)??B;if($.mitmCA&&($.shouldTerminateTLS?.(P,C)??!0)){Y.write(`HTTP/1.1 200 Connection Established\r
 \r
-`),L=!0;let n=await X4(Y,G);if(W||Y.destroyed){Y.destroy();return}if(n.isTLS){K(),Y4($.mitmCA,$.filterRequest,$.mutateHeaders,$.getBodySubstitutions,Y,n.head,{hostname:P,port:C,upstreamCA:$.tlsTerminateUpstreamCA,onFilterRequestDeny:$.onFilterRequestDenied?(Y$,L$,j$)=>$.onFilterRequestDenied({method:Y$,url:L$,reason:j$,encodedCommand:R.encodedCommand}):void 0},$.planSigv4,$.maxSigv4ResignBodyBytes);return}Z(`[tls-terminate] non-TLS bytes on CONNECT ${P}:${C}; opaque-tunnelling`),G=n.head}else if($.mitmCA)Z(`[tls-terminate] policy exempts ${P}:${C}; opaque-tunnelling`);let l=$.getMitmSocketPath?.(P),e=!l&&$.parentProxy&&!yX($.parentProxy,P)?bX($.parentProxy,{isHttps:!0}):void 0,y;try{if(l)Z(`Routing CONNECT ${P}:${C} through MITM proxy at ${l}`),y=await O7({dial:()=>xq({path:l}),readyEvent:"connect",destHost:P,destPort:C});else if(e)y=await J9(e,P,C);else y=await Q9(P,C)}catch(n){if(Z(`CONNECT tunnel failed: ${n.message}`,{level:"error"}),L)Y.destroy();else A(`HTTP/1.1 502 Bad Gateway\r
+`),A=!0;let n=await U4(Y,G);if(W||Y.destroyed){Y.destroy();return}if(n.isTLS){K(),M4($.mitmCA,$.filterRequest,$.mutateHeaders,$.getBodySubstitutions,Y,n.head,{hostname:P,port:C,upstreamCA:$.tlsTerminateUpstreamCA,onFilterRequestDeny:$.onFilterRequestDenied?(Y$,L$,j$)=>$.onFilterRequestDenied({method:Y$,url:L$,reason:j$,encodedCommand:D.encodedCommand}):void 0},$.planSigv4,$.maxSigv4ResignBodyBytes,$.getBrokerForward);return}Z(`[tls-terminate] non-TLS bytes on CONNECT ${P}:${C}; opaque-tunnelling`),G=n.head}else if($.mitmCA)Z(`[tls-terminate] policy exempts ${P}:${C}; opaque-tunnelling`);let l=$.getMitmSocketPath?.(P),e=!l&&$.parentProxy&&!bX($.parentProxy,P)?hX($.parentProxy,{isHttps:!0}):void 0,y;try{if(l)Z(`Routing CONNECT ${P}:${C} through MITM proxy at ${l}`),y=await V7({dial:()=>u6({path:l}),readyEvent:"connect",destHost:P,destPort:C});else if(e)y=await Q9(e,P,C);else y=await X9(P,C)}catch(n){if(Z(`CONNECT tunnel failed: ${n.message}`,{level:"error"}),A)Y.destroy();else L(`HTTP/1.1 502 Bad Gateway\r
 \r
-`);return}if(W||Y.destroyed){y.on("error",()=>{}),y.destroy(),Y.destroy();return}if(!L)Y.write(`HTTP/1.1 200 Connection Established\r
+`);return}if(W||Y.destroyed){y.on("error",()=>{}),y.destroy(),Y.destroy();return}if(!A)Y.write(`HTTP/1.1 200 Connection Established\r
 \r
-`);if(K(),Y.allowHalfOpen=!0,G.length)y.write(G);y.pipe(Y),Y.pipe(y),y.on("error",(n)=>{Z(`CONNECT tunnel failed: ${n.message}`,{level:"error"}),Y.destroy()}),Y.on("close",()=>y.destroy()),y.on("close",()=>Y.destroy())}catch(R){if(Z(`Error handling CONNECT: ${R}`,{level:"error"}),L)Y.destroy();else A(`HTTP/1.1 500 Internal Server Error\r
+`);if(K(),Y.allowHalfOpen=!0,G.length)y.write(G);y.pipe(Y),Y.pipe(y),y.on("error",(n)=>{Z(`CONNECT tunnel failed: ${n.message}`,{level:"error"}),Y.destroy()}),Y.on("close",()=>y.destroy()),y.on("close",()=>Y.destroy())}catch(D){if(Z(`Error handling CONNECT: ${D}`,{level:"error"}),A)Y.destroy();else L(`HTTP/1.1 500 Internal Server Error\r
 \r
-`)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"error"}),Y.socket?.destroy()});try{if($.mitmCA&&Q.method==="GET"&&new W4(Q.url??"","http://x").pathname===sY){Y.writeHead(200,{"Content-Type":"application/pkix-crl","Content-Length":$.mitmCA.crlDer.length}),Y.end($.mitmCA.crlDer);return}let G=X(Q.headers["proxy-authorization"]);if(!G.ok){Y.writeHead(407,{"Proxy-Authenticate":'Basic realm="srt"'}),Y.end();return}let W=new W4(Q.url),U=dJ(W.hostname),M=W.port?parseInt(W.port,10):W.protocol==="https:"?443:80;if(!await $.filter(M,U,Q.socket,G.encodedCommand)){if(Z(`HTTP request blocked to ${U}:${M}`,{level:"error"}),Q.socket.destroyed||Y.destroyed){Y.destroy();return}Y.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-allowlist"}),Y.end("Connection blocked by network allowlist");return}if(Q.socket.destroyed)return;let V=jJ(U)??U,H=(vq(V)===6?`[${V}]`:V)+(W.port?`:${W.port}`:""),q={...u0(Q.headers),host:H};$.mutateHeadersPlaintext?.(q,V);let F=eY($.getBodySubstitutionsPlaintext,Q,q,V),K=$.getMitmSocketPath?.(V),A=!K&&$.parentProxy&&!yX($.parentProxy,V)?bX($.parentProxy,{isHttps:W.protocol==="https:"}):void 0,L=`${W.protocol}//${H}${W.pathname}${W.search}`,R=Q;if($.filterRequest){let C=new AbortController;Y.once("close",()=>C.abort());let w=await tY($.filterRequest,Q,Y,L,C.signal,$.onFilterRequestDenied?(P,l,e)=>$.onFilterRequestDenied({method:P,url:l,reason:e,encodedCommand:G.encodedCommand}):void 0);if(w===null)return;if(R=w,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||R.destroyed){R.destroy();return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&q["content-length"]===void 0&&q["transfer-encoding"]===void 0)q["transfer-encoding"]="chunked";let j;if(K){Z(`Routing HTTP ${Q.method} ${V}:${M} through MITM proxy at ${K}`);let C=new Pq({socketPath:K});j=E7({agent:C,path:L,method:Q.method,headers:q},(w)=>{w.on("error",(P)=>{Z(`Upstream response error: ${P.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(w.statusCode,u0(w.headers)),w.pipe(Y)})}else if(A){let C=dJ(A.hostname),w=Number(A.port)||(A.protocol==="https:"?443:80),P=V7(A);j=(A.protocol==="https:"?G4:E7)({hostname:C,port:w,path:L,method:Q.method,headers:P?{...q,"proxy-authorization":P}:q},(e)=>{e.on("error",(y)=>{Z(`Upstream response error: ${y.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(e.statusCode,u0(e.headers)),e.pipe(Y)})}else j=(W.protocol==="https:"?G4:E7)({hostname:V,port:M,path:W.pathname+W.search,method:Q.method,headers:q},(w)=>{w.on("error",(P)=>{Z(`Upstream response error: ${P.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(w.statusCode,u0(w.headers)),w.pipe(Y)});if(j.on("error",(C)=>{if(Z(`Proxy request failed: ${C.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>j.destroy()),F)F.on("error",(C)=>j.destroy(C)),R.on("error",(C)=>F.destroy(C)),Y.on("close",()=>F.destroy()),R.pipe(F).pipe(j);else R.on("error",(C)=>j.destroy(C)),R.pipe(j)}catch(G){if(Z(`Error handling HTTP request: ${G}`,{level:"error"}),!Y.headersSent)Y.writeHead(500,{"Content-Type":"text/plain"}),Y.end("Internal Server Error");else Y.destroy()}}),J}function fq($){let J=/^\[([^\]]+)\]:(\d+)$/.exec($)??/^([^:]+):(\d+)$/.exec($);if(!J)return;let X=Number(J[2]);if(!Number.isInteger(X)||X<1||X>65535)return;return{hostname:J[1],port:X}}var E4=l9(z4(),1);function iq($,J,X){if(!X||J===void 0)return!1;return $!==void 0&&($===E0||$.startsWith(`${E0}.`))&&HY(J,X)}function F4($){let J=E4.createServer();if($.proxyAuthToken)J.setAuthHandler((Q,Y,G)=>{if(iq(Q.username,Q.password,$.proxyAuthToken))Y();else Z("SOCKS auth rejected",{level:"error"}),G()});J.setRulesetValidator(async(Q)=>{try{let{destAddress:Y,destPort:G}=Q;if(!lQ(Y))return Z(`Rejecting malformed SOCKS host: ${JSON.stringify(Y)}`,{level:"error"}),!1;if(Z(`Connection request to ${Y}:${G}`),!await $.filter(G,Y,FY(Q.username)))return Z(`Connection blocked to ${Y}:${G}`,{level:"error"}),!1;return Z(`Connection allowed to ${Y}:${G}`),!0}catch(Y){return Z(`Error validating connection: ${Y}`,{level:"error"}),!1}}),J.setConnectionHandler((Q,Y)=>{let G=jJ(Q.destAddress)??Q.destAddress,W=Q.destPort,U=!1,M;Q.socket.once("close",()=>{U=!0,M?.destroy()}),Q.socket.on("error",()=>M?.destroy());let O=$.parentProxy&&!yX($.parentProxy,G)?bX($.parentProxy,{isHttps:!0}):void 0;(O?J9(O,G,W):Q9(G,W)).then((H)=>{if(M=H,H.on("error",()=>Q.socket.destroy()),U){H.destroy();return}Y("REQUEST_GRANTED"),H.pipe(Q.socket),Q.socket.pipe(H),H.on("close",()=>Q.socket.destroy())}).catch((H)=>{if(Z(`SOCKS connect to ${G}:${W} failed: ${H.message}`,{level:"error"}),!U)try{Y("HOST_UNREACHABLE")}catch{}})});let X=new Set;return{handleConnection(Q){if(Q.setNoDelay(),X.add(Q),Q.once("close",()=>X.delete(Q)),!$.proxyAuthToken){J._handleConnection(Q);return}sq(Q,(Y)=>{if(Y){J._handleConnection(Q);return}rq(Q,$).catch(()=>Q.destroy())})},async close(){for(let Q of X)Q.destroy();X.clear()}}}var oq=0,aq=2;function sq($,J){let X=Buffer.alloc(0),Q=(Y)=>{if(X=Buffer.concat([X,Y]),X.length<2)return;if(X[0]!==5){$.off("data",Q),$.destroy();return}let G=X[1];if(X.length<2+G)return;$.off("data",Q),$.pause();let U=X.subarray(2,2+G).includes(aq),M=U?X:X.subarray(2+G);if(M.length>0)$.unshift(M);J(U)};$.on("data",Q),$.once("error",()=>$.off("data",Q))}async function rq($,J){$.write(Buffer.from([5,oq]));let X=await tq($);if(X===void 0){$.destroy();return}let{host:Q,port:Y}=X;if(!lQ(Q)){$.end(L7(2));return}let G=J.probeUnauthenticated?await J.probeUnauthenticated(Y,Q):{};if(Z(`SOCKS unauthenticated client refused for ${Q}:${Y}`+(G.deniedReason!==void 0?" (denied by policy)":"")),Y!==22){$.end(L7(2));return}let W=G.deniedReason??"This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.";$.write(L7(0)),$.write(Buffer.from(`SSH-2.0-policy_refusal\r
-`)),$.end(eq(W))}function L7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function tq($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)},Y=setTimeout(()=>Q(void 0),5000),G=(W)=>{if(X=Buffer.concat([X,W]),X.length<4)return;if(X[0]!==5||X[1]!==1){Q(void 0);return}let U=X[3];if(U===1){if(X.length<10)return;let M=Array.from(X.subarray(4,8)).join(".");Q({host:M,port:X.readUInt16BE(8)})}else if(U===3){if(X.length<5)return;let M=X[4];if(X.length<5+M+2)return;Q({host:X.subarray(5,5+M).toString("utf8"),port:X.readUInt16BE(5+M)})}else if(U===4){if(X.length<22)return;let M=[];for(let O=0;O<16;O+=2)M.push(X.readUInt16BE(4+O).toString(16));Q({host:M.join(":"),port:X.readUInt16BE(20)})}else Q(void 0)};$.on("data",G),$.resume(),$.once("error",()=>Q(void 0)),$.once("close",()=>Q(void 0))})}function eq($){let J=$.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").slice(0,1000),X=Buffer.from(J,"utf8"),Q=Buffer.alloc(0),Y=Buffer.concat([Buffer.from([1]),W9(1),W9(X.length),X,W9(Q.length),Q]),G=8-(5+Y.length)%8;if(G<4)G+=8;return Buffer.concat([W9(1+Y.length+G),Buffer.from([G]),Y,Buffer.alloc(G)])}function W9($){let J=Buffer.alloc(4);return J.writeUInt32BE($,0),J}import{createServer as $6,connect as N4}from"net";import{join as J6}from"path";import{tmpdir as Q6}from"os";import{unlink as L4}from"fs/promises";function U9($,J,X,Q){return new Promise((Y,G)=>{let[W,U]=X??[0,0],M=W,O=()=>{while(Q.has(M)&&M<=U)M++;if(M>U){G(Error(`No free port in range ${W}-${U} (excluding ${[...Q].join(",")})`));return}let V=()=>{$.removeListener("error",H),Y()},H=(q)=>{if($.removeListener("listening",V),X&&q?.code==="EADDRINUSE"&&M<U){M++,O();return}G(q??Error("listen error"))};$.once("error",H),$.once("listening",V),J(X?M:0)};O()})}var X6=new Set([4,5]),Y6=1e4,G6=0;function W6(){return J6(Q6(),`srt-mux-${process.pid}-${(G6++).toString(36)}.sock`)}function A4($){let J=$.firstByteTimeoutMs??Y6,X=v$()==="windows",Q,Y,G=new Set;function W(M){if(Q===void 0&&Y===void 0){Z("mux: HTTP dispatch before backend bound; dropping",{level:"error"}),M.destroy();return}let O=Q?N4(Q):N4(Y,"127.0.0.1");O.on("error",(V)=>{let H=V.code??"ERR";if(Z(`mux: HTTP backend dial failed: ${V.message}`,{level:"error"}),!M.destroyed)M.end(`HTTP/1.1 502 Bad Gateway\r
+`)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"error"}),Y.socket?.destroy()});try{if($.mitmCA&&Q.method==="GET"&&new V4(Q.url??"","http://x").pathname===rY){Y.writeHead(200,{"Content-Type":"application/pkix-crl","Content-Length":$.mitmCA.crlDer.length}),Y.end($.mitmCA.crlDer);return}let G=X(Q.headers["proxy-authorization"]);if(!G.ok){Y.writeHead(407,{"Proxy-Authenticate":'Basic realm="srt"'}),Y.end();return}let W=new V4(Q.url),U=dJ(W.hostname),M=W.port?parseInt(W.port,10):W.protocol==="https:"?443:80;if(!await $.filter(M,U,Q.socket,G.encodedCommand)){if(Z(`HTTP request blocked to ${U}:${M}`,{level:"error"}),Q.socket.destroyed||Y.destroyed){Y.destroy();return}Y.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-allowlist"}),Y.end("Connection blocked by network allowlist");return}if(Q.socket.destroyed)return;let V=jJ(U)??U,q=(g6(V)===6?`[${V}]`:V)+(W.port?`:${W.port}`:""),H={...u0(Q.headers),host:q};$.mutateHeadersPlaintext?.(H,V);let N=$9($.getBodySubstitutionsPlaintext,Q,H,V),K=$.getMitmSocketPath?.(V),L=!K&&$.parentProxy&&!bX($.parentProxy,V)?hX($.parentProxy,{isHttps:W.protocol==="https:"}):void 0,A=`${W.protocol}//${q}${W.pathname}${W.search}`,D=Q;if($.filterRequest){let C=new AbortController;Y.once("close",()=>C.abort());let w=await eY($.filterRequest,Q,Y,A,C.signal,$.onFilterRequestDenied?(P,l,e)=>$.onFilterRequestDenied({method:P,url:l,reason:e,encodedCommand:G.encodedCommand}):void 0);if(w===null)return;if(D=w,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||D.destroyed){D.destroy();return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&H["content-length"]===void 0&&H["transfer-encoding"]===void 0)H["transfer-encoding"]="chunked";let B;if(K){Z(`Routing HTTP ${Q.method} ${V}:${M} through MITM proxy at ${K}`);let C=new b6({socketPath:K});B=L7({agent:C,path:A,method:Q.method,headers:H},(w)=>{w.on("error",(P)=>{Z(`Upstream response error: ${P.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(w.statusCode,u0(w.headers)),w.pipe(Y)})}else if(L){let C=dJ(L.hostname),w=Number(L.port)||(L.protocol==="https:"?443:80),P=q7(L);B=(L.protocol==="https:"?O4:L7)({hostname:C,port:w,path:A,method:Q.method,headers:P?{...H,"proxy-authorization":P}:H},(e)=>{e.on("error",(y)=>{Z(`Upstream response error: ${y.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(e.statusCode,u0(e.headers)),e.pipe(Y)})}else B=(W.protocol==="https:"?O4:L7)({hostname:V,port:M,path:W.pathname+W.search,method:Q.method,headers:H},(w)=>{w.on("error",(P)=>{Z(`Upstream response error: ${P.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(w.statusCode,u0(w.headers)),w.pipe(Y)});if(B.on("error",(C)=>{if(Z(`Proxy request failed: ${C.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>B.destroy()),N)N.on("error",(C)=>B.destroy(C)),D.on("error",(C)=>N.destroy(C)),Y.on("close",()=>N.destroy()),D.pipe(N).pipe(B);else D.on("error",(C)=>B.destroy(C)),D.pipe(B)}catch(G){if(Z(`Error handling HTTP request: ${G}`,{level:"error"}),!Y.headersSent)Y.writeHead(500,{"Content-Type":"text/plain"}),Y.end("Internal Server Error");else Y.destroy()}}),J}function l6($){let J=/^\[([^\]]+)\]:(\d+)$/.exec($)??/^([^:]+):(\d+)$/.exec($);if(!J)return;let X=Number(J[2]);if(!Number.isInteger(X)||X<1||X>65535)return;return{hostname:J[1],port:X}}var A4=p9(L4(),1);function $H($,J,X){if(!X||J===void 0)return!1;return $!==void 0&&($===E0||$.startsWith(`${E0}.`))&&HY(J,X)}function R4($){let J=A4.createServer();if($.proxyAuthToken)J.setAuthHandler((Q,Y,G)=>{if($H(Q.username,Q.password,$.proxyAuthToken))Y();else Z("SOCKS auth rejected",{level:"error"}),G()});J.setRulesetValidator(async(Q)=>{try{let{destAddress:Y,destPort:G}=Q;if(!lQ(Y))return Z(`Rejecting malformed SOCKS host: ${JSON.stringify(Y)}`,{level:"error"}),!1;if(Z(`Connection request to ${Y}:${G}`),!await $.filter(G,Y,NY(Q.username)))return Z(`Connection blocked to ${Y}:${G}`,{level:"error"}),!1;return Z(`Connection allowed to ${Y}:${G}`),!0}catch(Y){return Z(`Error validating connection: ${Y}`,{level:"error"}),!1}}),J.setConnectionHandler((Q,Y)=>{let G=jJ(Q.destAddress)??Q.destAddress,W=Q.destPort,U=!1,M;Q.socket.once("close",()=>{U=!0,M?.destroy()}),Q.socket.on("error",()=>M?.destroy());let O=$.parentProxy&&!bX($.parentProxy,G)?hX($.parentProxy,{isHttps:!0}):void 0;(O?Q9(O,G,W):X9(G,W)).then((q)=>{if(M=q,q.on("error",()=>Q.socket.destroy()),U){q.destroy();return}Y("REQUEST_GRANTED"),q.pipe(Q.socket),Q.socket.pipe(q),q.on("close",()=>Q.socket.destroy())}).catch((q)=>{if(Z(`SOCKS connect to ${G}:${W} failed: ${q.message}`,{level:"error"}),!U)try{Y("HOST_UNREACHABLE")}catch{}})});let X=new Set;return{handleConnection(Q){if(Q.setNoDelay(),X.add(Q),Q.once("close",()=>X.delete(Q)),!$.proxyAuthToken){J._handleConnection(Q);return}XH(Q,(Y)=>{if(Y){J._handleConnection(Q);return}YH(Q,$).catch(()=>Q.destroy())})},async close(){for(let Q of X)Q.destroy();X.clear()}}}var JH=0,QH=2;function XH($,J){let X=Buffer.alloc(0),Q=(Y)=>{if(X=Buffer.concat([X,Y]),X.length<2)return;if(X[0]!==5){$.off("data",Q),$.destroy();return}let G=X[1];if(X.length<2+G)return;$.off("data",Q),$.pause();let U=X.subarray(2,2+G).includes(QH),M=U?X:X.subarray(2+G);if(M.length>0)$.unshift(M);J(U)};$.on("data",Q),$.once("error",()=>$.off("data",Q))}async function YH($,J){$.write(Buffer.from([5,JH]));let X=await GH($);if(X===void 0){$.destroy();return}let{host:Q,port:Y}=X;if(!lQ(Q)){$.end(D7(2));return}let G=J.probeUnauthenticated?await J.probeUnauthenticated(Y,Q):{};if(Z(`SOCKS unauthenticated client refused for ${Q}:${Y}`+(G.deniedReason!==void 0?" (denied by policy)":"")),Y!==22){$.end(D7(2));return}let W=G.deniedReason??"This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.";$.write(D7(0)),$.write(Buffer.from(`SSH-2.0-policy_refusal\r
+`)),$.end(WH(W))}function D7($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function GH($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)},Y=setTimeout(()=>Q(void 0),5000),G=(W)=>{if(X=Buffer.concat([X,W]),X.length<4)return;if(X[0]!==5||X[1]!==1){Q(void 0);return}let U=X[3];if(U===1){if(X.length<10)return;let M=Array.from(X.subarray(4,8)).join(".");Q({host:M,port:X.readUInt16BE(8)})}else if(U===3){if(X.length<5)return;let M=X[4];if(X.length<5+M+2)return;Q({host:X.subarray(5,5+M).toString("utf8"),port:X.readUInt16BE(5+M)})}else if(U===4){if(X.length<22)return;let M=[];for(let O=0;O<16;O+=2)M.push(X.readUInt16BE(4+O).toString(16));Q({host:M.join(":"),port:X.readUInt16BE(20)})}else Q(void 0)};$.on("data",G),$.resume(),$.once("error",()=>Q(void 0)),$.once("close",()=>Q(void 0))})}function WH($){let J=$.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").slice(0,1000),X=Buffer.from(J,"utf8"),Q=Buffer.alloc(0),Y=Buffer.concat([Buffer.from([1]),U9(1),U9(X.length),X,U9(Q.length),Q]),G=8-(5+Y.length)%8;if(G<4)G+=8;return Buffer.concat([U9(1+Y.length+G),Buffer.from([G]),Y,Buffer.alloc(G)])}function U9($){let J=Buffer.alloc(4);return J.writeUInt32BE($,0),J}import{createServer as UH,connect as D4}from"net";import{join as MH}from"path";import{tmpdir as OH}from"os";import{unlink as Z4}from"fs/promises";function M9($,J,X,Q){return new Promise((Y,G)=>{let[W,U]=X??[0,0],M=W,O=()=>{while(Q.has(M)&&M<=U)M++;if(M>U){G(Error(`No free port in range ${W}-${U} (excluding ${[...Q].join(",")})`));return}let V=()=>{$.removeListener("error",q),Y()},q=(H)=>{if($.removeListener("listening",V),X&&H?.code==="EADDRINUSE"&&M<U){M++,O();return}G(H??Error("listen error"))};$.once("error",q),$.once("listening",V),J(X?M:0)};O()})}var VH=new Set([4,5]),qH=1e4,HH=0;function KH(){return MH(OH(),`srt-mux-${process.pid}-${(HH++).toString(36)}.sock`)}function B4($){let J=$.firstByteTimeoutMs??qH,X=v$()==="windows",Q,Y,G=new Set;function W(M){if(Q===void 0&&Y===void 0){Z("mux: HTTP dispatch before backend bound; dropping",{level:"error"}),M.destroy();return}let O=Q?D4(Q):D4(Y,"127.0.0.1");O.on("error",(V)=>{let q=V.code??"ERR";if(Z(`mux: HTTP backend dial failed: ${V.message}`,{level:"error"}),!M.destroyed)M.end(`HTTP/1.1 502 Bad Gateway\r
 Connection: close\r
 \r
-mux backend dial failed (${H})
-`)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=$6((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on("error",(V)=>Z(`mux: client socket error: ${V.message}`));let O=setTimeout(()=>{Z("mux: first-byte timeout; destroying connection"),M.destroy()},J);if(typeof O.unref==="function")O.unref();M.once("readable",()=>{clearTimeout(O);let V=M.read(1);if(!V||V.length===0){M.destroy();return}if(M.unshift(V),X6.has(V[0]))$.handleSocksConnection(M);else W(M)})});return{server:U,getPort(){let M=U.address();return M&&typeof M==="object"?M.port:void 0},async listenHttpBackend(){if(!X){let O=W6();await L4(O).catch(()=>{}),await new Promise((V,H)=>{$.httpServer.once("error",H),$.httpServer.listen(O,()=>{$.httpServer.removeListener("error",H),V()})}),Q=O,Z(`mux: HTTP backend listening on ${O}`);return}await U9($.httpServer,(O)=>$.httpServer.listen(O,"127.0.0.1"),$.httpBackendPortRange,new Set);let M=$.httpServer.address();return Y=M&&typeof M==="object"?M.port:void 0,Z(`mux: HTTP backend listening on 127.0.0.1:${Y}`),Y},async close(){for(let M of G)M.destroy();if(G.clear(),await new Promise((M)=>U.close(()=>M())),await new Promise((M)=>$.httpServer.close(()=>M())),Q)await L4(Q).catch(()=>{}),Q=void 0;Y=void 0},unref(){U.unref(),$.httpServer.unref()}}}import{randomBytes as U6,randomUUID as M6}from"crypto";var dQ="fake_value_",R4="abcdefghijklmnopqrstuvwxyz0123456789_-";function O6($){let J=dQ+M6(),X=Buffer.byteLength($)-J.length;if(X<=0)return J;let Q=J;for(let Y of U6(X))Q+=R4[Y%R4.length];return Q}class A7{byName=new Map;bySentinel=new Map;allSentinelsPrefixed=!0;refs=new Map;lease=null;register($,J,X){return this.registerWithSentinel($,O6(J),J,X)}registerWithSentinel($,J,X,Q){let Y=this.byName.get($);if(Y!==void 0&&Y.realValue===X)return Y.injectHosts=Q,this.lease?.add(Y),Y.sentinel;if(this.bySentinel.has(J))throw Error("credential sentinel collision");if(!J.startsWith(dQ))this.allSentinelsPrefixed=!1;let G={name:$,sentinel:J,realValue:X,injectHosts:Q};return this.byName.set($,G),this.bySentinel.set(J,G),this.lease?.add(G),J}beginLease(){this.lease=new Set}endLease(){let $=[...this.lease??[]];this.lease=null;for(let J of $)this.refs.set(J,(this.refs.get(J)??0)+1);return{entries:$}}release($){let J=[];for(let X of $.entries){let Q=(this.refs.get(X)??1)-1;if(Q>0){this.refs.set(X,Q);continue}if(this.refs.delete(X),this.bySentinel.get(X.sentinel)===X)this.bySentinel.delete(X.sentinel);if(this.byName.get(X.name)===X)this.byName.delete(X.name);J.push(X.sentinel)}if($.entries.length=0,J.length>0&&!this.allSentinelsPrefixed)this.allSentinelsPrefixed=[...this.bySentinel.keys()].every((X)=>X.startsWith(dQ));return J}lookupReal($){return this.bySentinel.get($)?.realValue}namesInjectableAt($,J){let X=[];for(let Q of this.byName.values())if(Q.injectHosts.some((Y)=>J($,Y)))X.push(Q.name);return X}sentinelsForHost($,J){let X=[];for(let Q of this.bySentinel.values()){if(!Q.injectHosts.some((Y)=>J($,Y)))continue;X.push({sentinel:Buffer.from(Q.sentinel),realValue:Buffer.from(Q.realValue)})}return X}*entries(){for(let $ of this.bySentinel.values())yield[$.sentinel,$.realValue]}get size(){return this.bySentinel.size}clear(){this.byName.clear(),this.bySentinel.clear(),this.refs.clear(),this.lease=null,this.allSentinelsPrefixed=!0}substituteInHeaders($,J,X){if(this.bySentinel.size===0)return;for(let[Q,Y]of Object.entries($)){if(Y===void 0)continue;if(Array.isArray(Y))for(let G=0;G<Y.length;G++)Y[G]=this.substituteInHeaderValue(Q,Y[G],J,X);else $[Q]=this.substituteInHeaderValue(Q,Y,J,X)}}substituteInHeaderValue($,J,X,Q){let Y=this.substituteInString(J,X,Q);if($.toLowerCase()!=="authorization")return Y;let G=/^(\s*basic\s+)([a-z0-9+/]+={0,2})(\s*)$/i.exec(Y);if(G===null)return Y;let W=G[2],U=Buffer.from(W,"base64");if(W.length%4!==0||U.toString("base64")!==W)return Y;let M=U.toString("utf8");if(!Buffer.from(M,"utf8").equals(U))return Y;let O=this.substituteInString(M,X,Q);if(O===M)return Y;return`${G[1]}${Buffer.from(O,"utf8").toString("base64")}${G[3]}`}substituteInString($,J,X){if(this.allSentinelsPrefixed&&!$.includes(dQ))return $;let Q=$;for(let Y of this.bySentinel.values()){if(!Q.includes(Y.sentinel))continue;if(!Y.injectHosts.some((G)=>X(J,G)))continue;Q=Q.split(Y.sentinel).join(Y.realValue)}return Q}}import{randomUUID as N6}from"crypto";import*as cJ from"fs";import{tmpdir as L6}from"os";import{join as j4}from"path";function V6($,J){let X=!1;for(let Q=J+1;Q<$.length;Q++){let Y=$[Q];if(X){X=!1;continue}if(Y==="\\")X=!0;else if(Y==="]")return Q+1}return $.length}function H6($){switch($){case"s":return{kind:"whitespace"};case"S":return{kind:"non-whitespace"};case"d":return{kind:"digit"};case"D":return{kind:"non-digit"};case"w":return{kind:"word"};case"W":return{kind:"non-word"};default:return{kind:"unknown"}}}function D4($,J){if($===null||J===null)return!0;if($.kind==="literal"&&J.kind==="literal")return $.value===J.value;if($.kind==="whitespace"&&J.kind==="non-whitespace"||$.kind==="non-whitespace"&&J.kind==="whitespace"||$.kind==="digit"&&J.kind==="non-digit"||$.kind==="non-digit"&&J.kind==="digit"||$.kind==="word"&&J.kind==="non-word"||$.kind==="non-word"&&J.kind==="word")return!1;return!0}function q6($,J){if($[J+1]!=="?")return{next:J+1,capturing:!0};if($[J+2]==="<"){let Q=$[J+3];if(Q==="="||Q==="!")return{next:J+4,capturing:!1};let Y=$.indexOf(">",J+3);return{next:Y===-1?J+3:Y+1,capturing:!0}}return{next:J+3,capturing:!1}}function K6($,J){let X=$[J];if(X==="*"||X==="+")return{next:$[J+1]==="?"?J+2:J+1,unbounded:!0};if(X==="?")return{next:$[J+1]==="?"?J+2:J+1,unbounded:!1};if(X!=="{")return null;let Q=J+1,Y=Q;while(/[0-9]/.test($[Q]??""))Q++;if(Q===Y)return null;let G=Number($.slice(Y,Q)),W=G,U=!1;if($[Q]===","){Q++;let M=Q;while(/[0-9]/.test($[Q]??""))Q++;if(Q===M)U=!0,W=void 0;else W=Number($.slice(M,Q))}if($[Q]!=="}")return null;if(!Number.isFinite(G)||G>4096||W!==void 0&&(!Number.isFinite(W)||W>4096))return{next:Q+1,unbounded:U,error:"finite repetitions must be at most 4096"};if(Q++,$[Q]==="?")Q++;return{next:Q,unbounded:U}}function z6($){let J=[{previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}],X=0,Q=()=>J[J.length-1],Y=(G)=>{let W=Q();if(W.lastAtom?.hasUnboundedQuantifier&&G.hasUnboundedQuantifier&&W.lastAtom.repeatClass!==null&&G.repeatClass!==null&&D4(W.lastAtom.repeatClass,G.repeatClass))W.error="adjacent unbounded repetition with overlapping input is not supported";if(W.previousAtom=W.lastAtom,W.lastAtom=G,W.atomCount===0)W.simpleClass=G.repeatClass;else W.simpleClass=null;if(W.atomCount++,G.kind==="group")W.containsQuantifier||=G.containsQuantifier,W.containsAlternation||=G.containsAlternation;W.hasUnboundedQuantifier||=G.hasUnboundedQuantifier};for(let G=0;G<$.length;){if(Q().error!==void 0)return{groupCount:X,error:Q().error};let W=$[G];if(W==="\\"){let M=$[G+1];if(M!==void 0&&/[1-9]/.test(M)||M==="k"&&$[G+2]==="<")return{groupCount:X,error:"backreferences are not supported by the safe extractor"};let O=M==="b"||M==="B";if(Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:H6(M)}),G+=M===void 0?1:2,O)Q().previousAtom=null,Q().lastAtom=null;continue}if(W==="["){Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:{kind:"unknown"}}),G=V6($,G);continue}if(W==="("){let M=q6($,G);if(M.capturing)X++;J.push({previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}),G=M.next;continue}if(W===")"){if(J.length>1){let M=J.pop();if(M.error!==void 0)return{groupCount:X,error:M.error};Y({kind:"group",containsQuantifier:M.containsQuantifier,containsAlternation:M.containsAlternation,hasUnboundedQuantifier:M.hasUnboundedQuantifier,repeatClass:M.atomCount===1&&!M.containsAlternation?M.simpleClass:null})}G++;continue}if(W==="|"){Q().containsAlternation=!0,Q().previousAtom=null,Q().lastAtom=null,G++;continue}let U=K6($,G);if(U!==null){if(U.error)return{groupCount:X,error:U.error};let M=Q(),O=M.lastAtom;if(U.unbounded&&O?.kind==="group"&&(O.containsQuantifier||O.containsAlternation))return{groupCount:X,error:"nested unbounded repetition or unbounded alternation is not supported"};if(U.unbounded&&M.previousAtom?.hasUnboundedQuantifier&&O!==null&&M.previousAtom.repeatClass!==null&&O.repeatClass!==null&&D4(M.previousAtom.repeatClass,O.repeatClass))return{groupCount:X,error:"adjacent unbounded repetition with overlapping input is not supported"};if(M.containsQuantifier=!0,O!==null)M.lastAtom={...O,containsQuantifier:!0,hasUnboundedQuantifier:O.hasUnboundedQuantifier||U.unbounded};M.hasUnboundedQuantifier||=U.unbounded,G=U.next;continue}if(W!=="^"&&W!=="$")Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:W==="."?{kind:"any"}:{kind:"literal",value:W}});else Q().previousAtom=null,Q().lastAtom=null;G++}return{groupCount:X,error:Q().error}}function R7($){if($.length>2048)throw Error("Credential extract pattern exceeds the 2048-character limit");let J;try{J=new RegExp($)}catch{throw Error("Credential extract pattern is not a valid regular expression")}let X=z6($);if(X.error!==void 0)throw Error(`Credential extract pattern rejected: ${X.error}`);return{regex:J,groupCount:X.groupCount}}function E6($,J=""){R7($);try{return new RegExp($,J)}catch{throw Error("Credential extract pattern is not supported by this runtime")}}function M9($,J,X,Q={}){if($.length>1048576)throw Error("Credential extraction input exceeds the 1048576-character limit");let Y=E6(J,"gd"),G=new Map,W=new Map,U=[],M=0;for(let H of $.matchAll(Y)){if(M++,M>4096)throw Error("Credential extraction exceeds the 4096-match limit");let q=H[1];if(q===void 0)throw Error(`Credential extraction matched at offset ${H.index} without a group-1 capture; group 1 must capture the credential value on every match.`);if(q.length===0)continue;let F=G.get(q);if(F===void 0)G.set(q,F=G.size);let[K,A]=H.indices[1],L=X(q,F);if(!W.has(q))W.set(q,L);U.push({start:K,end:A,sentinel:L})}if(G.size===0)return null;if(Q.maskDuplicates){let H=[...G.keys()].sort((q,F)=>F.length-q.length);for(let q of H){let F=W.get(q);if(F===q)continue;for(let K=$.indexOf(q);K!==-1;K=$.indexOf(q,K+1)){let A=K+q.length;if(U.some((L)=>K<L.end&&L.start<A))continue;U.push({start:K,end:A,sentinel:F})}}U.sort((q,F)=>q.start-F.start)}let O="",V=0;for(let H of U)O+=$.slice(V,H.start)+H.sentinel,V=H.end;return{fakeContent:O+$.slice(V),captures:[...G.keys()]}}var Z4="(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";function D7($){try{return JSON.parse(Buffer.from($,"base64url").toString("utf8"))}catch{return}}function O9($){let J=$.split(".");if(J.length!==3)return!1;let X=D7(J[0]);if(typeof X!=="object"||X===null||!("alg"in X))return!1;return D7(J[1])!==void 0}var F6=9999999999,B4="c3J0LWZha2U";function Z7($){return Buffer.from($,"utf8").toString("base64url")}function V9($){let J=Z7(JSON.stringify({alg:"HS256",typ:"JWT"})),X=Z7(JSON.stringify({sub:dQ+$,exp:F6}));return`${J}.${X}.${B4}`}function H9($,J,X){let[Q,Y]=$.split("."),G=D7(Y??"");if(typeof G!=="object"||G===null||Array.isArray(G))return null;let W=G,U=[];for(let O of J){let V=W[O];if(typeof V==="string")U.push([O,V])}if(U.length===0)return null;let M=new Map;for(let[O,V]of U){let H=X(O,V);W[O]=H,M.set(O,H)}return{fakeToken:`${Q}.${Z7(JSON.stringify(W))}.${B4}`,claimSentinels:M}}var A6="file:";class B7{dir;byKey=new Map;write($,J){if(this.dir===void 0)this.dir=cJ.mkdtempSync(j4(L6(),"srt-credmask-"));let X=this.byKey.get($);if(X===void 0)X=j4(this.dir,`${this.byKey.size}.fake`),this.byKey.set($,X);return cJ.rmSync(X,{force:!0}),cJ.writeFileSync(X,J,{mode:384}),X}dispose(){if(this.dir!==void 0)try{cJ.rmSync(this.dir,{recursive:!0,force:!0})}catch($){Z(`MaskedFileStore cleanup failed: ${$}`,{level:"error"})}this.dir=void 0,this.byKey.clear()}get dirPath(){return this.dir}}function T4($,J,X,Q){let Y=[],G=[];for(let W of $){if(W.mode!=="mask")continue;let U=XJ(W.path),M;try{if(cJ.statSync(U).isDirectory()){Z(`[credential-mask] Skipping masked file entry that resolves to a directory: ${W.path} \u2014 use mode "deny" for directories.`,{level:"warn"});continue}let K=cJ.readFileSync(U);if(M=K.toString("utf8"),Buffer.byteLength(M,"utf8")!==K.length){Z(`[credential-mask] Skipping masked file with non-UTF-8 content (binary credential files are not supported in mask mode): ${W.path}`,{level:"warn"});continue}}catch(F){Z(`[credential-mask] Skipping masked file (unreadable on host): ${W.path} \u2014 ${F.message}`);continue}let O=W.injectHosts??J,V=A6+U,H;if(W.extract===void 0&&W.decode===void 0)H=X.register(V,M,O);else{let F=W.extract??Z4,K=0,A=M9(M,F,(L,R)=>{if(W.decode==="jwt"&&!O9(L))return L;let I=`${V}#${R}`;if(W.decode==="jwt"&&W.maskClaims?.length){let j=H9(L,W.maskClaims,(w,P)=>X.register(`${V}#jwt${R}.${w}`,P,O));if(j===null)return Z(`[credential-mask] ${W.path}: verified JWT candidate has none of maskClaims ${JSON.stringify(W.maskClaims)} as `+"string claims \u2014 left unmasked."),L;let C=W.maskClaims.filter((w)=>!j.claimSentinels.has(w));if(C.length>0)Z(`[credential-mask] ${W.path}: maskClaims ${JSON.stringify(C)} absent or non-string in a `+"verified JWT \u2014 skipped.");return K++,X.registerWithSentinel(I,j.fakeToken,L,O)}return K++,W.decode==="jwt"?X.registerWithSentinel(I,V9(N6()),L,O):X.register(I,L,O)},{maskDuplicates:W.maskDuplicates??!1});if(A===null||K===0){let L=W.decode==="jwt"?W.maskClaims?.length?`decode "jwt" with pattern "${F}" that matched no verified JWT with maskable claims (maskClaims: ${JSON.stringify(W.maskClaims)})`:`decode "jwt" with pattern "${F}" that matched no verified JWT`:`extract pattern "${F}" that matched nothing`,R=W.onExtractNoMatch??"warn";if(R==="error")throw Error(`credentials.files entry "${W.path}": ${L} (onExtractNoMatch: "error"). Fix the config, change to "warn"/"deny", or remove the entry.`);if(R==="deny"){Z(`[credential-mask] ${W.path} has ${L} \u2014 degrading to `+'mode "deny".',{level:"warn"}),G.push(U);continue}let I=`[sandbox-runtime] WARNING: credentials.files entry "${W.path}" has ${L} in the file. The file is left UNPROTECTED (readable as-is inside the sandbox). Fix the config, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(I),Z(I,{level:"warn"});continue}H=A.fakeContent}let q=Q.write(V,H);Y.push({realPath:U,fakePath:q})}return{binds:Y,degradeToDenyPaths:G}}import{randomUUID as R6}from"crypto";var q9="env:";function S4($,J,X,Q=process.env){let Y={},G=[];for(let W of $){if(W.mode!=="mask")continue;let U=Q[W.name];if(U===void 0)continue;let M=W.injectHosts??J;if(W.decode==="jwt"){if(!O9(U)){let V=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has decode "jwt" but its value did not verify as a JWT. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(V),Z(V,{level:"warn"});continue}if(W.maskClaims?.length){let V=H9(U,W.maskClaims,(q,F)=>X.register(`${q9}${W.name}#${q}`,F,M));if(V===null){let q=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has maskClaims ${JSON.stringify(W.maskClaims)} but none is present as a string claim in its JWT value. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(q),Z(q,{level:"warn"});continue}let H=W.maskClaims.filter((q)=>!V.claimSentinels.has(q));if(H.length>0)Z(`[credential-mask] env var "${W.name}": maskClaims ${JSON.stringify(H)} absent or non-string in the `+"JWT \u2014 skipped.");Y[W.name]=X.registerWithSentinel(`${q9}${W.name}`,V.fakeToken,U,M);continue}Y[W.name]=X.registerWithSentinel(`${q9}${W.name}`,V9(R6()),U,M);continue}if(W.extract===void 0){Y[W.name]=X.register(W.name,U,M);continue}let O=M9(U,W.extract,(V,H)=>X.register(`${q9}${W.name}#${H}`,V,M));if(O===null){let V=W.onExtractNoMatch??"warn";if(V==="error")throw Error(`credentials.envVars entry "${W.name}": extract pattern "${W.extract}" matched nothing (onExtractNoMatch: "error"). Fix the regex, change to "warn"/"deny", or remove the entry.`);if(V==="deny"){Z(`[credential-mask] extract pattern /${W.extract}/ matched nothing in the value of ${W.name} \u2014 unsetting the variable.`,{level:"warn"}),G.push(W.name);continue}let H=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has extract pattern "${W.extract}" that matched nothing in the variable's value. The variable is left UNPROTECTED (visible as-is inside the sandbox). Fix the regex, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(H),Z(H,{level:"warn"});continue}Y[W.name]=O.fakeContent}return{setEnvVars:Y,degradeToUnsetNames:G}}var I4="AWS_ACCESS_KEY_ID",C4="AWS_SECRET_ACCESS_KEY",w4="AWS_SESSION_TOKEN";class j7{bySentinel=new Map;register($){this.bySentinel.set($.accessKeyIdSentinel,$)}lookup($){return this.bySentinel.get($)}get size(){return this.bySentinel.size}forget($){for(let J of $)this.bySentinel.delete(J)}clear(){this.bySentinel.clear()}}function P4($,J,X,Q,Y,G=process.env){let W=[...J??[]],U=new Set(W.flatMap((H)=>[H.accessKeyIdVar,H.secretAccessKeyVar,...H.sessionTokenVar?[H.sessionTokenVar]:[]]));if(![I4,C4,w4].some((H)=>U.has(H)))W.push({accessKeyIdVar:I4,secretAccessKeyVar:C4,sessionTokenVar:w4});let O=(H)=>$.find((q)=>q.name===H&&q.mode==="mask"&&q.extract===void 0&&q.decode===void 0),V=(H)=>O(H)!==void 0?Q[H]:void 0;for(let H of W){let q=V(H.accessKeyIdVar),F=V(H.secretAccessKeyVar)!==void 0,K=G[H.accessKeyIdVar],A=G[H.secretAccessKeyVar];if(q===void 0||!F||K===void 0||A===void 0){if(F&&q===void 0){let j=`[sandbox-runtime] WARNING: "${H.secretAccessKeyVar}" is masked but "${H.accessKeyIdVar}" is not, so no AWS credential pair was registered. SigV4 requests will be signed with the masked placeholder secret and the proxy cannot `+"detect or re-sign them \u2014 they will fail upstream. Mask both "+"variables (whole-value) to enable re-signing.";console.warn(j),Z(j,{level:"warn"})}continue}let L=O(H.accessKeyIdVar),I=(H.sessionTokenVar!==void 0?V(H.sessionTokenVar):void 0)!==void 0&&H.sessionTokenVar!==void 0?G[H.sessionTokenVar]:void 0;Y.register({accessKeyIdSentinel:q,realAccessKeyId:K,realSecretAccessKey:A,...I!==void 0?{realSessionToken:I}:{},injectHosts:L.injectHosts??X}),Z(`[credential-aws] registered SigV4 pair for ${H.accessKeyIdVar}/${H.secretAccessKeyVar}`+(I!==void 0?" (+session token)":""))}}function D6($){return{streaming:$?.streaming??"deny",presigned:$?.presigned??"deny",sigv4a:$?.sigv4a??"deny"}}function _4($,J,X){let Q=D6(J);return(Y,G,W,U)=>{if($.size===0)return;let M=sW(W,G);if(M===null)return;let O=$.lookup(M.accessKeyId);if(O===void 0)return;if(!O.injectHosts.some((K)=>X(U,K)))return;if(M.kind!=="header-sigv4"){if(Q[M.kind]==="passthrough"){Z(`[credential-aws] ${M.kind} request with masked credential passed through un-resigned per credentials.sigv4.${M.kind} (its signature covers the placeholder secret and will fail upstream)`);return}return{action:"deny",reason:`AWS SigV4 ${M.kind} request uses a masked credential but cannot be re-signed by the sandbox proxy; denied by policy. Set credentials.sigv4.${M.kind} to "passthrough" to forward it unmodified (it will fail upstream: the signature covers the masked placeholder).`}}let V=rW(pQ(W.authorization));if(V===null)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but its Authorization header is malformed; the proxy cannot re-sign it."};let H=pQ(W["x-amz-date"]);if(H===void 0)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it."};let q=[...V.signedHeaders];for(let K of q){if(K==="host")continue;if(K==="x-amz-security-token"&&O.realSessionToken!==void 0)continue;if(W[K]===void 0)return{action:"deny",reason:`AWS SigV4 request uses a masked credential but signed header "${K}" is missing; the proxy cannot re-sign it.`}}if(O.realSessionToken!==void 0&&!q.includes("x-amz-security-token"))q.push("x-amz-security-token");let F=pQ(W["x-amz-content-sha256"]);return{action:"resign",payloadHash:F===Y9?Y9:void 0,apply(K,A,L){if(O.realSessionToken!==void 0)K["x-amz-security-token"]=O.realSessionToken;if(K["x-amz-content-sha256"]!==void 0&&F!==Y9)K["x-amz-content-sha256"]=L;let{authorization:R}=tW({method:Y,requestTarget:G,headers:K,hostHeader:A,signedHeaders:q,payloadHash:L,amzDate:H,scope:{date:V.date,region:V.region,service:V.service},accessKeyId:O.realAccessKeyId,secretAccessKey:O.realSecretAccessKey});K.authorization=R}}}}import{spawnSync as Z6}from"child_process";function D0($){if(typeof globalThis.Bun<"u")return globalThis.Bun.which($);let J=Z6("which",[$],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000});if(J.status===0&&J.stdout)return J.stdout.trim();return null}import*as d0 from"fs";import{randomBytes as bK}from"crypto";function CJ($){return $.map((J)=>{if(J==="")return"''";if(/^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/.test(J))return J;return"'"+J.replace(/'/g,`'"'"'`)+"'"}).join(" ")}import{randomBytes as i6}from"crypto";import*as r from"fs";import{spawn as s4}from"child_process";import{tmpdir as L9}from"os";import f$,{join as r4}from"path";import{spawn as B6}from"child_process";import{text as x4}from"stream/consumers";var j6={ms:1e4};class K9 extends Error{constructor($){super(`ripgrep timed out after ${$} ms`);this.name="RipgrepTimeoutError"}}async function T7($,J,X,Q={command:"rg"}){let{command:Y,args:G=[],argv0:W}=Q,U=B6(Y,[...G,...$,J],{argv0:W,env:{PATH:process.env.PATH??"/usr/bin:/bin"},signal:X,windowsHide:!0}),M=j6.ms,O=!1,V=setTimeout(()=>{O=!0,U.kill("SIGKILL")},M),H,q,F;try{[H,q,F]=await Promise.all([x4(U.stdout),x4(U.stderr),new Promise((K,A)=>{U.on("close",K),U.on("error",A)})])}finally{clearTimeout(V)}if(O)throw new K9(M);if(F===0)return H.trim().split(`
-`).filter(Boolean);if(F===1)return[];throw Error(`ripgrep failed with exit code ${F}: ${q}`)}import{join as V0,dirname as T6}from"path";import{fileURLToPath as S6}from"url";import*as z9 from"fs";import{homedir as I6}from"os";var S7=new Map,I7=null;function C6(){if(I7)return I7;let $=[],J=I6();return $.push(V0("/usr","lib","node_modules","@anthropic-ai","sandbox-runtime"),V0("/usr","local","lib","node_modules","@anthropic-ai","sandbox-runtime"),V0("/opt","homebrew","lib","node_modules","@anthropic-ai","sandbox-runtime"),V0(J,".npm","lib","node_modules","@anthropic-ai","sandbox-runtime"),V0(J,".npm-global","lib","node_modules","@anthropic-ai","sandbox-runtime")),I7=$,$}function v4(){let $=process.arch;switch($){case"x64":case"x86_64":return"x64";case"arm64":case"aarch64":return"arm64";case"ia32":case"x86":return Z("[SeccompFilter] 32-bit x86 (ia32) is not currently supported due to missing socketcall() syscall blocking. The current seccomp filter only blocks socket(AF_UNIX, ...), but on 32-bit x86, socketcall() can be used to bypass this.",{level:"error"}),null;default:return Z(`[SeccompFilter] Unsupported architecture: ${$}. Only x64 and arm64 are supported.`),null}}function w6($){let J=v4();if(!J)return[];let X=T6(S6(import.meta.url)),Q=V0("vendor","seccomp",J,$);return[V0(X,Q),V0(X,"..","..",Q),V0(X,"..",Q)]}function C7($){let J=$??"";if(S7.has(J))return S7.get(J);let X=P6($);return S7.set(J,X),X}function P6($){if($){if(z9.existsSync($))return Z(`[SeccompFilter] Using apply-seccomp binary from explicit path: ${$}`),$;Z(`[SeccompFilter] Explicit path provided but file not found: ${$}`)}let J=v4();if(!J)return Z(`[SeccompFilter] Cannot find apply-seccomp binary: unsupported architecture ${process.arch}`),null;Z(`[SeccompFilter] Looking for apply-seccomp binary for architecture: ${J}`);for(let X of w6("apply-seccomp"))if(z9.existsSync(X))return Z(`[SeccompFilter] Found apply-seccomp binary: ${X} (${J})`),X;for(let X of C6()){let Q=V0(X,"vendor","seccomp",J,"apply-seccomp");if(z9.existsSync(Q))return Z(`[SeccompFilter] Found apply-seccomp binary in global install: ${Q} (${J})`),Q}return Z(`[SeccompFilter] apply-seccomp binary not found in any expected location (${J})`),null}import{spawnSync as _6}from"child_process";import{createHash as x6}from"crypto";import*as s from"fs";import nJ from"path";class gX extends Error{}var v6={dir:"/run/srt-stubs",uid:0,lockWaitMs:2000,flockPath:"/usr/bin/flock"},cQ=v6,k6,y4;var E9=s.constants.O_CLOEXEC??524288,w7={kind:"masked"},k4={kind:"real"},uX={kind:"unregistered"},f6=new Set(["ENOENT","EACCES"]),y6=new Set(["ENOENT","ENOTDIR","EROFS"]),H0=null,qQ=null,b6=0;function mX($){return $?.code}function _7($){return x6("sha256").update($).digest("hex")}function x7(){if(process.platform!=="linux")return"off";let{dir:$,uid:J,flockPath:X}=cQ;if(process.geteuid?.()!==J)return"off";try{s.accessSync(X,s.constants.X_OK)}catch(Y){return f6.has(mX(Y)??"")?"off":"error"}try{s.mkdirSync($,{mode:448}),s.chmodSync($,448)}catch(Y){let G=mX(Y)??"";if(G!=="EEXIST")return y6.has(G)?"off":"error"}let Q;try{Q=s.lstatSync($)}catch{return"error"}if(!Q.isDirectory()||Q.uid!==J||(Q.mode&511)!==448)return Z(`[Sandbox Linux] ${$} is not a 0700 directory owned by uid ${J}; mask stubs are not shared`,{level:"warn"}),"off";return $}function b4($,J){try{return s.openSync(nJ.join($,J),s.constants.O_RDONLY|s.constants.O_CREAT|s.constants.O_NOFOLLOW|E9,384)}catch{return null}}function h4($,J){try{return _6(cQ.flockPath,[...J,"3"],{stdio:["ignore","ignore","ignore",$],timeout:cQ.lockWaitMs+5000}).status===0}catch{return!1}}function f4($,J,X){let Q=b4($,J);if(Q===null)return null;let Y=(cQ.lockWaitMs/1000).toFixed(3);if(h4(Q,[X,"-w",Y]))return Q;return s.closeSync(Q),null}function u4($){try{s.closeSync($)}catch{}}function g4(){let $=x7();if($==="off")return!1;if($==="error")throw new gX(`srt: cannot read the mask stub registry ${cQ.dir}; refusing to start the sandbox`);if(H0===null)H0=f4($,"lock","-s");if(H0!==null&&qQ===null)qQ=f4($,"claims","-x");if(H0===null||qQ===null)throw new gX(`srt: mask stub registry ${$} is busy (no ${H0===null?"shared":"claims"} lock within ${cQ.lockWaitMs} ms); refusing to start the sandbox rather than risk a mask another call removes`);return!0}function F9(){if(qQ===null)return;u4(qQ),qQ=null}function h6(){if(H0===null)return;u4(H0),H0=null}function m4(){let $=x7();if($==="off")return null;if($==="error"||H0===null||qQ===null)throw new gX("srt: mask stub claimed without holding the registry; refusing to start the sandbox");return $}function lX($){try{return s.lstatSync($,{bigint:!0})}catch(J){return mX(J)==="ENOENT"?"absent":"unknown"}}function l4($){try{let J=JSON.parse(s.readFileSync($,"utf8")),{v:X,type:Q,uid:Y,dev:G,ino:W,ctimeNs:U,path:M}=J,O=(V)=>typeof V==="string"&&/^\d+$/.test(V);if(X!==1||Q!=="f"&&Q!=="d"||typeof Y!=="number"||!O(G)||!O(W)||!O(U)||typeof M!=="string"||!M.startsWith("/"))return null;return{type:Q,uid:Y,dev:BigInt(G),ino:BigInt(W),ctimeNs:BigInt(U),dest:M}}catch{return null}}function p4($,J){return nJ.join($,`${_7(J)}.stub`)}function u6($,J){let X=_7(J.dest),Q=nJ.join($,`${X}.stub.${process.pid}-${++b6}`),Y=JSON.stringify({v:1,type:J.type,uid:J.uid,dev:String(J.dev),ino:String(J.ino),ctimeNs:String(J.ctimeNs),path:J.dest});s.writeFileSync(Q,Y+`
-`,{flag:"wx",mode:384}),s.renameSync(Q,nJ.join($,`${X}.stub`))}function d4($,J){return(J.type==="f"?$.isFile()&&$.size===BigInt(0):$.isDirectory())&&$.uid===BigInt(J.uid)&&$.dev===J.dev&&$.ino===J.ino&&$.ctimeNs===J.ctimeNs}function v7($){let J=nJ.dirname($),X;try{X=s.openSync(J,s.constants.O_RDONLY|s.constants.O_DIRECTORY|s.constants.O_NOFOLLOW|E9)}catch{return null}try{if(s.readlinkSync(`/proc/self/fd/${X}`)===J)return X}catch{}return s.closeSync(X),null}function c4($,J,X){return{type:$,uid:Number(J.uid),dev:J.dev,ino:J.ino,ctimeNs:J.ctimeNs,dest:X}}function g6($){let J=v7($);if(J===null)return null;try{let X;try{X=s.openSync(`/proc/self/fd/${J}/${nJ.basename($)}`,s.constants.O_RDONLY|s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_NOFOLLOW|E9,292)}catch(Q){return mX(Q)==="EEXIST"?"exists":null}try{return y4?.($),c4("f",s.fstatSync(X,{bigint:!0}),$)}finally{s.closeSync(X)}}finally{s.closeSync(J)}}function m6($,J){let X=v7($);if(X===null)return null;try{let Q=`/proc/self/fd/${X}/${nJ.basename($)}`;try{s.mkdirSync(Q,{mode:493})}catch(G){return mX(G)==="EEXIST"?"exists":null}y4?.($);let Y;try{Y=s.openSync(Q,s.constants.O_RDONLY|s.constants.O_DIRECTORY|s.constants.O_NOFOLLOW|E9)}catch{return null}try{let G=s.fstatSync(Y,{bigint:!0});if(!G.isDirectory()||G.uid!==BigInt(process.geteuid?.()??-1)||G.nlink>BigInt(2)||s.readdirSync(`/proc/self/fd/${Y}`).length!==0)return null;if(J)s.fchownSync(Y,J.uid,J.gid);return c4("d",s.fstatSync(Y,{bigint:!0}),$)}catch{return null}finally{s.closeSync(Y)}}finally{s.closeSync(X)}}function l6($){let J=v7($.dest);if(J===null)return;try{let X=`/proc/self/fd/${J}/${nJ.basename($.dest)}`,Q=lX(X);if(typeof Q==="object"&&d4(Q,$)){if($.type==="d")s.rmdirSync(X);else s.unlinkSync(X);Z(`[Sandbox Linux] Removed shared mask stub: ${$.dest}`)}}catch{}finally{s.closeSync(J)}}function p6($){try{s.unlinkSync($)}catch{}}function P7($,J,X,Q){let Y=l4(p4($,J));return Y!==null&&Y.type===Q&&Y.dest===J&&d4(X,Y)}function n4($,J,X){let Q=m4();if(Q===null)return uX;if(k6?.($)==="unregistered")return uX;let Y=lX($);if(Y==="unknown")return uX;if(Y!=="absent")return P7(Q,$,Y,J)?w7:k4;let G=X();if(G==="exists"){let W=lX($);return typeof W==="object"&&P7(Q,$,W,J)?w7:k4}if(G===null)return uX;try{u6(Q,G)}catch(W){Z(`[Sandbox Linux] mask stub marker not written for ${$}: ${W}`,{level:"warn"})}return w7}function d6($){return n4($,"f",()=>g6($))}function c6($,J){return n4($,"d",()=>m6($,J))}function i4($,J){let X=m4();if(X===null)return null;let Q=(G)=>J.some((W)=>G.startsWith(W+"/")),Y=[];for(let G=nJ.dirname($);Q(G);G=nJ.dirname(G))Y.unshift(G);for(let G of Y){let W=lX(G);if(typeof W==="object"&&P7(X,G,W,"d"))return G}return null}function o4($,J){try{return $()}catch(X){if(X instanceof gX)throw X;return Z(`[Sandbox Linux] mask stub not recorded for ${J}: ${X}`,{level:"warn"}),uX}}function k7($){return o4(()=>d6($),$)}function a4($,J){return o4(()=>c6($,J),$)}function n6($){let J;try{J=s.readdirSync($)}catch{return}let X=[],Q=[];for(let G of J){let W=/^([0-9a-f]{64})\.stub(\..*)?$/.exec(G);if(W===null)continue;let U=nJ.join($,G);if(Q.push(U),W[2]===void 0){let M=l4(U);if(M!==null&&_7(M.dest)===W[1])X.push(M)}}let Y=(G)=>G.dest.split("/").length;X.sort((G,W)=>G.type===W.type?Y(W)-Y(G):G.type==="f"?-1:1);for(let G of X)l6(G);for(let G of Q)p6(G)}function f7($,J){let X=x7(),Q=H0!==null;if(F9(),h6(),X==="off"){for(let G of $)J(G);return[]}if(X==="error")return[...$];if(!Q&&$.length===0)return[];let Y=b4(X,"lock");if(Y===null)return[...$];try{if(!h4(Y,["-x","-n"]))return[...$];for(let G of $)if(lX(p4(X,G))==="absent")J(G);return n6(X),[]}catch(G){return Z(`[Sandbox Linux] mask stub sweep failed: ${G}`,{level:"warn"}),[...$]}finally{s.closeSync(Y)}}var h7=3;function o6($){let J=$.uid===void 0?$.bwrapCommand:[$.setprivPath??"/usr/bin/setpriv",`--reuid=${$.uid}`,`--regid=${$.gid??$.uid}`,"--clear-groups","--inh-caps=-all","--ambient-caps=-all","--bounding-set=-all",...$.bwrapCommand],X=$.unsetEnvVars??[],Q=Object.entries($.setEnvVars??{});if(X.length===0&&Q.length===0)return J;return["/usr/bin/env",...X.flatMap((Y)=>["-u",Y]),...Q.map(([Y,G])=>`${Y}=${G}`),...J]}function y7($,J){let X=$.split(f$.sep),Q="";for(let Y of X){if(!Y)continue;let G=Q+f$.sep+Y;try{if(r.lstatSync(G).isSymbolicLink()){if(J.some((M)=>G.startsWith(M+"/")||G===M))return G}}catch{break}Q=G}return null}var a6=40;function t4($){let J=$;for(let X=0;X<a6;X++){try{return r.realpathSync(J)}catch{}let Q=J,Y=[],G=null;while(G===null){let M=f$.dirname(Q);if(M===Q)return null;Y.unshift(f$.basename(Q)),Q=M;try{G=r.realpathSync(Q)}catch{}}let W=f$.join(G,Y[0]),U=null;try{U=r.readlinkSync(W)}catch{}if(U===null)return f$.join(G,...Y);J=f$.join(f$.resolve(f$.dirname(W),U),...Y.slice(1))}return null}function s6($){let J=$.split(f$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+f$.sep+Q;try{let G=r.statSync(Y);if(G.isFile()||G.isSymbolicLink())return!0}catch{break}X=Y}return!1}function r6($){let J=$.split(f$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+f$.sep+Q;if(!r.existsSync(Y))return Y;X=Y}return $}async function t6($={command:"rg"},J=h7,X=!1,Q){let Y=process.cwd(),G=new AbortController,W=Q??G.signal,U=zY(),M=[...KX.map((K)=>f$.resolve(Y,K)),...U.map((K)=>f$.resolve(Y,K))],O=f$.resolve(Y,".git"),V=!1;try{V=r.statSync(O).isDirectory()}catch{}if(V){if(M.push(f$.resolve(Y,".git/hooks")),!X)M.push(f$.resolve(Y,".git/config"))}let H=[];for(let K of KX)H.push("--iglob",K);for(let K of U)H.push("--iglob",`**/${K}/**`);if(H.push("--iglob","**/.git/hooks/**"),!X)H.push("--iglob","**/.git/config");let q=["--files","--hidden","--no-ignore","--max-depth",String(J),...H,"-g","!**/node_modules/**"],F;try{F=await T7(q,Y,W,$)}catch(K){if(K instanceof K9)throw Error(`mandatory deny scan failed: ${K}`);Z(`[Sandbox] ripgrep scan failed, retrying once: ${K}`);try{F=await T7(q,Y,W,$)}catch(A){throw Error(`mandatory deny scan failed: ${A}`)}}for(let K of F){let A=f$.resolve(Y,K),L=!1;for(let R of[...U,".git"]){let I=d9(R),j=A.split(f$.sep),C=j.findIndex((w)=>d9(w)===I);if(C!==-1){if(R===".git"){let w=j.slice(0,C+1).join(f$.sep);if(K.includes(".git/hooks"))M.push(f$.join(w,"hooks"));else if(K.includes(".git/config"))M.push(f$.join(w,"config"))}else M.push(j.slice(0,C+1).join(f$.sep));L=!0;break}}if(!L)M.push(A)}return[...new Set(M)]}var pX;function e6(){if(process.getuid?.()!==0||process.env.ARA_SRT_FILE_MASK!=="empty")return"/dev/null";if(pX)try{let X=r.lstatSync(pX);if(X.isFile()&&X.size===0&&X.uid===0&&(X.mode&146)===0)return pX}catch{}let $=r.mkdtempSync(f$.join(L9(),"claude-empty-file-"));A9.add($),r.chmodSync($,493);let J=f$.join($,"empty");return r.writeFileSync(J,"",{flag:"wx",mode:292}),r.chmodSync(J,292),pX=J,J}var dX=new Set,A9=new Set;function e4($,J){return $===J?e6():"/dev/null"}var $K="ARA_SRT_MASKED_PATHS",JK=16384;function QK($,J,X=JK){let Q=[],Y=0;for(let G of new Set($)){if(G.includes(`
+mux backend dial failed (${q})
+`)}),M.on("error",()=>O.destroy()),M.once("close",()=>O.destroy()),O.once("close",()=>M.destroy()),M.pipe(O),O.pipe(M)}let U=UH((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on("error",(V)=>Z(`mux: client socket error: ${V.message}`));let O=setTimeout(()=>{Z("mux: first-byte timeout; destroying connection"),M.destroy()},J);if(typeof O.unref==="function")O.unref();M.once("readable",()=>{clearTimeout(O);let V=M.read(1);if(!V||V.length===0){M.destroy();return}if(M.unshift(V),VH.has(V[0]))$.handleSocksConnection(M);else W(M)})});return{server:U,getPort(){let M=U.address();return M&&typeof M==="object"?M.port:void 0},async listenHttpBackend(){if(!X){let O=KH();await Z4(O).catch(()=>{}),await new Promise((V,q)=>{$.httpServer.once("error",q),$.httpServer.listen(O,()=>{$.httpServer.removeListener("error",q),V()})}),Q=O,Z(`mux: HTTP backend listening on ${O}`);return}await M9($.httpServer,(O)=>$.httpServer.listen(O,"127.0.0.1"),$.httpBackendPortRange,new Set);let M=$.httpServer.address();return Y=M&&typeof M==="object"?M.port:void 0,Z(`mux: HTTP backend listening on 127.0.0.1:${Y}`),Y},async close(){for(let M of G)M.destroy();if(G.clear(),await new Promise((M)=>U.close(()=>M())),await new Promise((M)=>$.httpServer.close(()=>M())),Q)await Z4(Q).catch(()=>{}),Q=void 0;Y=void 0},unref(){U.unref(),$.httpServer.unref()}}}import{randomBytes as zH,randomUUID as EH}from"crypto";var dQ="fake_value_",j4="abcdefghijklmnopqrstuvwxyz0123456789_-";function FH($){let J=dQ+EH(),X=Buffer.byteLength($)-J.length;if(X<=0)return J;let Q=J;for(let Y of zH(X))Q+=j4[Y%j4.length];return Q}class Z7{byName=new Map;bySentinel=new Map;allSentinelsPrefixed=!0;refs=new Map;lease=null;register($,J,X){return this.registerWithSentinel($,FH(J),J,X)}registerWithSentinel($,J,X,Q){let Y=this.byName.get($);if(Y!==void 0&&Y.realValue===X)return Y.injectHosts=Q,this.lease?.add(Y),Y.sentinel;if(this.bySentinel.has(J))throw Error("credential sentinel collision");if(!J.startsWith(dQ))this.allSentinelsPrefixed=!1;let G={name:$,sentinel:J,realValue:X,injectHosts:Q};return this.byName.set($,G),this.bySentinel.set(J,G),this.lease?.add(G),J}beginLease(){this.lease=new Set}endLease(){let $=[...this.lease??[]];this.lease=null;for(let J of $)this.refs.set(J,(this.refs.get(J)??0)+1);return{entries:$}}release($){let J=[];for(let X of $.entries){let Q=(this.refs.get(X)??1)-1;if(Q>0){this.refs.set(X,Q);continue}if(this.refs.delete(X),this.bySentinel.get(X.sentinel)===X)this.bySentinel.delete(X.sentinel);if(this.byName.get(X.name)===X)this.byName.delete(X.name);J.push(X.sentinel)}if($.entries.length=0,J.length>0&&!this.allSentinelsPrefixed)this.allSentinelsPrefixed=[...this.bySentinel.keys()].every((X)=>X.startsWith(dQ));return J}lookupReal($){return this.bySentinel.get($)?.realValue}namesInjectableAt($,J){let X=[];for(let Q of this.byName.values())if(Q.injectHosts.some((Y)=>J($,Y)))X.push(Q.name);return X}sentinelsForHost($,J){let X=[];for(let Q of this.bySentinel.values()){if(!Q.injectHosts.some((Y)=>J($,Y)))continue;X.push({sentinel:Buffer.from(Q.sentinel),realValue:Buffer.from(Q.realValue)})}return X}*entries(){for(let $ of this.bySentinel.values())yield[$.sentinel,$.realValue]}get size(){return this.bySentinel.size}clear(){this.byName.clear(),this.bySentinel.clear(),this.refs.clear(),this.lease=null,this.allSentinelsPrefixed=!0}substituteInHeaders($,J,X){if(this.bySentinel.size===0)return;for(let[Q,Y]of Object.entries($)){if(Y===void 0)continue;if(Array.isArray(Y))for(let G=0;G<Y.length;G++)Y[G]=this.substituteInHeaderValue(Q,Y[G],J,X);else $[Q]=this.substituteInHeaderValue(Q,Y,J,X)}}substituteInHeaderValue($,J,X,Q){let Y=this.substituteInString(J,X,Q);if($.toLowerCase()!=="authorization")return Y;let G=/^(\s*basic\s+)([a-z0-9+/]+={0,2})(\s*)$/i.exec(Y);if(G===null)return Y;let W=G[2],U=Buffer.from(W,"base64");if(W.length%4!==0||U.toString("base64")!==W)return Y;let M=U.toString("utf8");if(!Buffer.from(M,"utf8").equals(U))return Y;let O=this.substituteInString(M,X,Q);if(O===M)return Y;return`${G[1]}${Buffer.from(O,"utf8").toString("base64")}${G[3]}`}substituteInString($,J,X){if(this.allSentinelsPrefixed&&!$.includes(dQ))return $;let Q=$;for(let Y of this.bySentinel.values()){if(!Q.includes(Y.sentinel))continue;if(!Y.injectHosts.some((G)=>X(J,G)))continue;Q=Q.split(Y.sentinel).join(Y.realValue)}return Q}}import{randomUUID as jH}from"crypto";import*as cJ from"fs";import{tmpdir as TH}from"os";import{join as C4}from"path";function NH($,J){let X=!1;for(let Q=J+1;Q<$.length;Q++){let Y=$[Q];if(X){X=!1;continue}if(Y==="\\")X=!0;else if(Y==="]")return Q+1}return $.length}function LH($){switch($){case"s":return{kind:"whitespace"};case"S":return{kind:"non-whitespace"};case"d":return{kind:"digit"};case"D":return{kind:"non-digit"};case"w":return{kind:"word"};case"W":return{kind:"non-word"};default:return{kind:"unknown"}}}function T4($,J){if($===null||J===null)return!0;if($.kind==="literal"&&J.kind==="literal")return $.value===J.value;if($.kind==="whitespace"&&J.kind==="non-whitespace"||$.kind==="non-whitespace"&&J.kind==="whitespace"||$.kind==="digit"&&J.kind==="non-digit"||$.kind==="non-digit"&&J.kind==="digit"||$.kind==="word"&&J.kind==="non-word"||$.kind==="non-word"&&J.kind==="word")return!1;return!0}function AH($,J){if($[J+1]!=="?")return{next:J+1,capturing:!0};if($[J+2]==="<"){let Q=$[J+3];if(Q==="="||Q==="!")return{next:J+4,capturing:!1};let Y=$.indexOf(">",J+3);return{next:Y===-1?J+3:Y+1,capturing:!0}}return{next:J+3,capturing:!1}}function RH($,J){let X=$[J];if(X==="*"||X==="+")return{next:$[J+1]==="?"?J+2:J+1,unbounded:!0};if(X==="?")return{next:$[J+1]==="?"?J+2:J+1,unbounded:!1};if(X!=="{")return null;let Q=J+1,Y=Q;while(/[0-9]/.test($[Q]??""))Q++;if(Q===Y)return null;let G=Number($.slice(Y,Q)),W=G,U=!1;if($[Q]===","){Q++;let M=Q;while(/[0-9]/.test($[Q]??""))Q++;if(Q===M)U=!0,W=void 0;else W=Number($.slice(M,Q))}if($[Q]!=="}")return null;if(!Number.isFinite(G)||G>4096||W!==void 0&&(!Number.isFinite(W)||W>4096))return{next:Q+1,unbounded:U,error:"finite repetitions must be at most 4096"};if(Q++,$[Q]==="?")Q++;return{next:Q,unbounded:U}}function DH($){let J=[{previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}],X=0,Q=()=>J[J.length-1],Y=(G)=>{let W=Q();if(W.lastAtom?.hasUnboundedQuantifier&&G.hasUnboundedQuantifier&&W.lastAtom.repeatClass!==null&&G.repeatClass!==null&&T4(W.lastAtom.repeatClass,G.repeatClass))W.error="adjacent unbounded repetition with overlapping input is not supported";if(W.previousAtom=W.lastAtom,W.lastAtom=G,W.atomCount===0)W.simpleClass=G.repeatClass;else W.simpleClass=null;if(W.atomCount++,G.kind==="group")W.containsQuantifier||=G.containsQuantifier,W.containsAlternation||=G.containsAlternation;W.hasUnboundedQuantifier||=G.hasUnboundedQuantifier};for(let G=0;G<$.length;){if(Q().error!==void 0)return{groupCount:X,error:Q().error};let W=$[G];if(W==="\\"){let M=$[G+1];if(M!==void 0&&/[1-9]/.test(M)||M==="k"&&$[G+2]==="<")return{groupCount:X,error:"backreferences are not supported by the safe extractor"};let O=M==="b"||M==="B";if(Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:LH(M)}),G+=M===void 0?1:2,O)Q().previousAtom=null,Q().lastAtom=null;continue}if(W==="["){Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:{kind:"unknown"}}),G=NH($,G);continue}if(W==="("){let M=AH($,G);if(M.capturing)X++;J.push({previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}),G=M.next;continue}if(W===")"){if(J.length>1){let M=J.pop();if(M.error!==void 0)return{groupCount:X,error:M.error};Y({kind:"group",containsQuantifier:M.containsQuantifier,containsAlternation:M.containsAlternation,hasUnboundedQuantifier:M.hasUnboundedQuantifier,repeatClass:M.atomCount===1&&!M.containsAlternation?M.simpleClass:null})}G++;continue}if(W==="|"){Q().containsAlternation=!0,Q().previousAtom=null,Q().lastAtom=null,G++;continue}let U=RH($,G);if(U!==null){if(U.error)return{groupCount:X,error:U.error};let M=Q(),O=M.lastAtom;if(U.unbounded&&O?.kind==="group"&&(O.containsQuantifier||O.containsAlternation))return{groupCount:X,error:"nested unbounded repetition or unbounded alternation is not supported"};if(U.unbounded&&M.previousAtom?.hasUnboundedQuantifier&&O!==null&&M.previousAtom.repeatClass!==null&&O.repeatClass!==null&&T4(M.previousAtom.repeatClass,O.repeatClass))return{groupCount:X,error:"adjacent unbounded repetition with overlapping input is not supported"};if(M.containsQuantifier=!0,O!==null)M.lastAtom={...O,containsQuantifier:!0,hasUnboundedQuantifier:O.hasUnboundedQuantifier||U.unbounded};M.hasUnboundedQuantifier||=U.unbounded,G=U.next;continue}if(W!=="^"&&W!=="$")Y({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:W==="."?{kind:"any"}:{kind:"literal",value:W}});else Q().previousAtom=null,Q().lastAtom=null;G++}return{groupCount:X,error:Q().error}}function B7($){if($.length>2048)throw Error("Credential extract pattern exceeds the 2048-character limit");let J;try{J=new RegExp($)}catch{throw Error("Credential extract pattern is not a valid regular expression")}let X=DH($);if(X.error!==void 0)throw Error(`Credential extract pattern rejected: ${X.error}`);return{regex:J,groupCount:X.groupCount}}function ZH($,J=""){B7($);try{return new RegExp($,J)}catch{throw Error("Credential extract pattern is not supported by this runtime")}}function O9($,J,X,Q={}){if($.length>1048576)throw Error("Credential extraction input exceeds the 1048576-character limit");let Y=ZH(J,"gd"),G=new Map,W=new Map,U=[],M=0;for(let q of $.matchAll(Y)){if(M++,M>4096)throw Error("Credential extraction exceeds the 4096-match limit");let H=q[1];if(H===void 0)throw Error(`Credential extraction matched at offset ${q.index} without a group-1 capture; group 1 must capture the credential value on every match.`);if(H.length===0)continue;let N=G.get(H);if(N===void 0)G.set(H,N=G.size);let[K,L]=q.indices[1],A=X(H,N);if(!W.has(H))W.set(H,A);U.push({start:K,end:L,sentinel:A})}if(G.size===0)return null;if(Q.maskDuplicates){let q=[...G.keys()].sort((H,N)=>N.length-H.length);for(let H of q){let N=W.get(H);if(N===H)continue;for(let K=$.indexOf(H);K!==-1;K=$.indexOf(H,K+1)){let L=K+H.length;if(U.some((A)=>K<A.end&&A.start<L))continue;U.push({start:K,end:L,sentinel:N})}}U.sort((H,N)=>H.start-N.start)}let O="",V=0;for(let q of U)O+=$.slice(V,q.start)+q.sentinel,V=q.end;return{fakeContent:O+$.slice(V),captures:[...G.keys()]}}var S4="(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";function j7($){try{return JSON.parse(Buffer.from($,"base64url").toString("utf8"))}catch{return}}function V9($){let J=$.split(".");if(J.length!==3)return!1;let X=j7(J[0]);if(typeof X!=="object"||X===null||!("alg"in X))return!1;return j7(J[1])!==void 0}var BH=9999999999,I4="c3J0LWZha2U";function T7($){return Buffer.from($,"utf8").toString("base64url")}function q9($){let J=T7(JSON.stringify({alg:"HS256",typ:"JWT"})),X=T7(JSON.stringify({sub:dQ+$,exp:BH}));return`${J}.${X}.${I4}`}function H9($,J,X){let[Q,Y]=$.split("."),G=j7(Y??"");if(typeof G!=="object"||G===null||Array.isArray(G))return null;let W=G,U=[];for(let O of J){let V=W[O];if(typeof V==="string")U.push([O,V])}if(U.length===0)return null;let M=new Map;for(let[O,V]of U){let q=X(O,V);W[O]=q,M.set(O,q)}return{fakeToken:`${Q}.${T7(JSON.stringify(W))}.${I4}`,claimSentinels:M}}var SH="file:";class S7{dir;byKey=new Map;write($,J){if(this.dir===void 0)this.dir=cJ.mkdtempSync(C4(TH(),"srt-credmask-"));let X=this.byKey.get($);if(X===void 0)X=C4(this.dir,`${this.byKey.size}.fake`),this.byKey.set($,X);return cJ.rmSync(X,{force:!0}),cJ.writeFileSync(X,J,{mode:384}),X}dispose(){if(this.dir!==void 0)try{cJ.rmSync(this.dir,{recursive:!0,force:!0})}catch($){Z(`MaskedFileStore cleanup failed: ${$}`,{level:"error"})}this.dir=void 0,this.byKey.clear()}get dirPath(){return this.dir}}function w4($,J,X,Q){let Y=[],G=[];for(let W of $){if(W.mode!=="mask")continue;let U=XJ(W.path),M;try{if(cJ.statSync(U).isDirectory()){Z(`[credential-mask] Skipping masked file entry that resolves to a directory: ${W.path} \u2014 use mode "deny" for directories.`,{level:"warn"});continue}let K=cJ.readFileSync(U);if(M=K.toString("utf8"),Buffer.byteLength(M,"utf8")!==K.length){Z(`[credential-mask] Skipping masked file with non-UTF-8 content (binary credential files are not supported in mask mode): ${W.path}`,{level:"warn"});continue}}catch(N){Z(`[credential-mask] Skipping masked file (unreadable on host): ${W.path} \u2014 ${N.message}`);continue}let O=W.injectHosts??J,V=SH+U,q;if(W.extract===void 0&&W.decode===void 0)q=X.register(V,M,O);else{let N=W.extract??S4,K=0,L=O9(M,N,(A,D)=>{if(W.decode==="jwt"&&!V9(A))return A;let S=`${V}#${D}`;if(W.decode==="jwt"&&W.maskClaims?.length){let B=H9(A,W.maskClaims,(w,P)=>X.register(`${V}#jwt${D}.${w}`,P,O));if(B===null)return Z(`[credential-mask] ${W.path}: verified JWT candidate has none of maskClaims ${JSON.stringify(W.maskClaims)} as `+"string claims \u2014 left unmasked."),A;let C=W.maskClaims.filter((w)=>!B.claimSentinels.has(w));if(C.length>0)Z(`[credential-mask] ${W.path}: maskClaims ${JSON.stringify(C)} absent or non-string in a `+"verified JWT \u2014 skipped.");return K++,X.registerWithSentinel(S,B.fakeToken,A,O)}return K++,W.decode==="jwt"?X.registerWithSentinel(S,q9(jH()),A,O):X.register(S,A,O)},{maskDuplicates:W.maskDuplicates??!1});if(L===null||K===0){let A=W.decode==="jwt"?W.maskClaims?.length?`decode "jwt" with pattern "${N}" that matched no verified JWT with maskable claims (maskClaims: ${JSON.stringify(W.maskClaims)})`:`decode "jwt" with pattern "${N}" that matched no verified JWT`:`extract pattern "${N}" that matched nothing`,D=W.onExtractNoMatch??"warn";if(D==="error")throw Error(`credentials.files entry "${W.path}": ${A} (onExtractNoMatch: "error"). Fix the config, change to "warn"/"deny", or remove the entry.`);if(D==="deny"){Z(`[credential-mask] ${W.path} has ${A} \u2014 degrading to `+'mode "deny".',{level:"warn"}),G.push(U);continue}let S=`[sandbox-runtime] WARNING: credentials.files entry "${W.path}" has ${A} in the file. The file is left UNPROTECTED (readable as-is inside the sandbox). Fix the config, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(S),Z(S,{level:"warn"});continue}q=L.fakeContent}let H=Q.write(V,q);Y.push({realPath:U,fakePath:H})}return{binds:Y,degradeToDenyPaths:G}}import{randomUUID as IH}from"crypto";var K9="env:";function P4($,J,X,Q=process.env){let Y={},G=[];for(let W of $){if(W.mode!=="mask")continue;let U=Q[W.name];if(U===void 0)continue;let M=W.injectHosts??J;if(W.decode==="jwt"){if(!V9(U)){let V=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has decode "jwt" but its value did not verify as a JWT. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(V),Z(V,{level:"warn"});continue}if(W.maskClaims?.length){let V=H9(U,W.maskClaims,(H,N)=>X.register(`${K9}${W.name}#${H}`,N,M));if(V===null){let H=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has maskClaims ${JSON.stringify(W.maskClaims)} but none is present as a string claim in its JWT value. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(H),Z(H,{level:"warn"});continue}let q=W.maskClaims.filter((H)=>!V.claimSentinels.has(H));if(q.length>0)Z(`[credential-mask] env var "${W.name}": maskClaims ${JSON.stringify(q)} absent or non-string in the `+"JWT \u2014 skipped.");Y[W.name]=X.registerWithSentinel(`${K9}${W.name}`,V.fakeToken,U,M);continue}Y[W.name]=X.registerWithSentinel(`${K9}${W.name}`,q9(IH()),U,M);continue}if(W.extract===void 0){Y[W.name]=X.register(W.name,U,M);continue}let O=O9(U,W.extract,(V,q)=>X.register(`${K9}${W.name}#${q}`,V,M));if(O===null){let V=W.onExtractNoMatch??"warn";if(V==="error")throw Error(`credentials.envVars entry "${W.name}": extract pattern "${W.extract}" matched nothing (onExtractNoMatch: "error"). Fix the regex, change to "warn"/"deny", or remove the entry.`);if(V==="deny"){Z(`[credential-mask] extract pattern /${W.extract}/ matched nothing in the value of ${W.name} \u2014 unsetting the variable.`,{level:"warn"}),G.push(W.name);continue}let q=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has extract pattern "${W.extract}" that matched nothing in the variable's value. The variable is left UNPROTECTED (visible as-is inside the sandbox). Fix the regex, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(q),Z(q,{level:"warn"});continue}Y[W.name]=O.fakeContent}return{setEnvVars:Y,degradeToUnsetNames:G}}var _4="AWS_ACCESS_KEY_ID",x4="AWS_SECRET_ACCESS_KEY",v4="AWS_SESSION_TOKEN";class I7{bySentinel=new Map;register($){this.bySentinel.set($.accessKeyIdSentinel,$)}lookup($){return this.bySentinel.get($)}get size(){return this.bySentinel.size}forget($){for(let J of $)this.bySentinel.delete(J)}clear(){this.bySentinel.clear()}}function k4($,J,X,Q,Y,G=process.env){let W=[...J??[]],U=new Set(W.flatMap((q)=>[q.accessKeyIdVar,q.secretAccessKeyVar,...q.sessionTokenVar?[q.sessionTokenVar]:[]]));if(![_4,x4,v4].some((q)=>U.has(q)))W.push({accessKeyIdVar:_4,secretAccessKeyVar:x4,sessionTokenVar:v4});let O=(q)=>$.find((H)=>H.name===q&&H.mode==="mask"&&H.extract===void 0&&H.decode===void 0),V=(q)=>O(q)!==void 0?Q[q]:void 0;for(let q of W){let H=V(q.accessKeyIdVar),N=V(q.secretAccessKeyVar)!==void 0,K=G[q.accessKeyIdVar],L=G[q.secretAccessKeyVar];if(H===void 0||!N||K===void 0||L===void 0){if(N&&H===void 0){let B=`[sandbox-runtime] WARNING: "${q.secretAccessKeyVar}" is masked but "${q.accessKeyIdVar}" is not, so no AWS credential pair was registered. SigV4 requests will be signed with the masked placeholder secret and the proxy cannot `+"detect or re-sign them \u2014 they will fail upstream. Mask both "+"variables (whole-value) to enable re-signing.";console.warn(B),Z(B,{level:"warn"})}continue}let A=O(q.accessKeyIdVar),S=(q.sessionTokenVar!==void 0?V(q.sessionTokenVar):void 0)!==void 0&&q.sessionTokenVar!==void 0?G[q.sessionTokenVar]:void 0;Y.register({accessKeyIdSentinel:H,realAccessKeyId:K,realSecretAccessKey:L,...S!==void 0?{realSessionToken:S}:{},injectHosts:A.injectHosts??X}),Z(`[credential-aws] registered SigV4 pair for ${q.accessKeyIdVar}/${q.secretAccessKeyVar}`+(S!==void 0?" (+session token)":""))}}function CH($){return{streaming:$?.streaming??"deny",presigned:$?.presigned??"deny",sigv4a:$?.sigv4a??"deny"}}function f4($,J,X){let Q=CH(J);return(Y,G,W,U)=>{if($.size===0)return;let M=eW(W,G);if(M===null)return;let O=$.lookup(M.accessKeyId);if(O===void 0)return;if(!O.injectHosts.some((K)=>X(U,K)))return;if(M.kind!=="header-sigv4"){if(Q[M.kind]==="passthrough"){Z(`[credential-aws] ${M.kind} request with masked credential passed through un-resigned per credentials.sigv4.${M.kind} (its signature covers the placeholder secret and will fail upstream)`);return}return{action:"deny",reason:`AWS SigV4 ${M.kind} request uses a masked credential but cannot be re-signed by the sandbox proxy; denied by policy. Set credentials.sigv4.${M.kind} to "passthrough" to forward it unmodified (it will fail upstream: the signature covers the masked placeholder).`}}let V=$4(pQ(W.authorization));if(V===null)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but its Authorization header is malformed; the proxy cannot re-sign it."};let q=pQ(W["x-amz-date"]);if(q===void 0)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it."};let H=[...V.signedHeaders];for(let K of H){if(K==="host")continue;if(K==="x-amz-security-token"&&O.realSessionToken!==void 0)continue;if(W[K]===void 0)return{action:"deny",reason:`AWS SigV4 request uses a masked credential but signed header "${K}" is missing; the proxy cannot re-sign it.`}}if(O.realSessionToken!==void 0&&!H.includes("x-amz-security-token"))H.push("x-amz-security-token");let N=pQ(W["x-amz-content-sha256"]);return{action:"resign",payloadHash:N===G9?G9:void 0,apply(K,L,A){if(O.realSessionToken!==void 0)K["x-amz-security-token"]=O.realSessionToken;if(K["x-amz-content-sha256"]!==void 0&&N!==G9)K["x-amz-content-sha256"]=A;let{authorization:D}=J4({method:Y,requestTarget:G,headers:K,hostHeader:L,signedHeaders:H,payloadHash:A,amzDate:q,scope:{date:V.date,region:V.region,service:V.service},accessKeyId:O.realAccessKeyId,secretAccessKey:O.realSecretAccessKey});K.authorization=D}}}}import{spawnSync as wH}from"child_process";function D0($){if(typeof globalThis.Bun<"u")return globalThis.Bun.which($);let J=wH("which",[$],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000});if(J.status===0&&J.stdout)return J.stdout.trim();return null}import*as d0 from"fs";import{randomBytes as dK}from"crypto";function CJ($){return $.map((J)=>{if(J==="")return"''";if(/^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/.test(J))return J;return"'"+J.replace(/'/g,`'"'"'`)+"'"}).join(" ")}import{randomBytes as $K}from"crypto";import*as r from"fs";import{spawn as $5}from"child_process";import{tmpdir as A9}from"os";import f$,{join as J5}from"path";import{spawn as PH}from"child_process";import{text as y4}from"stream/consumers";var _H={ms:1e4};class z9 extends Error{constructor($){super(`ripgrep timed out after ${$} ms`);this.name="RipgrepTimeoutError"}}async function C7($,J,X,Q={command:"rg"}){let{command:Y,args:G=[],argv0:W}=Q,U=PH(Y,[...G,...$,J],{argv0:W,env:{PATH:process.env.PATH??"/usr/bin:/bin"},signal:X,windowsHide:!0}),M=_H.ms,O=!1,V=setTimeout(()=>{O=!0,U.kill("SIGKILL")},M),q,H,N;try{[q,H,N]=await Promise.all([y4(U.stdout),y4(U.stderr),new Promise((K,L)=>{U.on("close",K),U.on("error",L)})])}finally{clearTimeout(V)}if(O)throw new z9(M);if(N===0)return q.trim().split(`
+`).filter(Boolean);if(N===1)return[];throw Error(`ripgrep failed with exit code ${N}: ${H}`)}import{join as V0,dirname as xH}from"path";import{fileURLToPath as vH}from"url";import*as E9 from"fs";import{homedir as kH}from"os";var w7=new Map,P7=null;function fH(){if(P7)return P7;let $=[],J=kH();return $.push(V0("/usr","lib","node_modules","@anthropic-ai","sandbox-runtime"),V0("/usr","local","lib","node_modules","@anthropic-ai","sandbox-runtime"),V0("/opt","homebrew","lib","node_modules","@anthropic-ai","sandbox-runtime"),V0(J,".npm","lib","node_modules","@anthropic-ai","sandbox-runtime"),V0(J,".npm-global","lib","node_modules","@anthropic-ai","sandbox-runtime")),P7=$,$}function b4(){let $=process.arch;switch($){case"x64":case"x86_64":return"x64";case"arm64":case"aarch64":return"arm64";case"ia32":case"x86":return Z("[SeccompFilter] 32-bit x86 (ia32) is not currently supported due to missing socketcall() syscall blocking. The current seccomp filter only blocks socket(AF_UNIX, ...), but on 32-bit x86, socketcall() can be used to bypass this.",{level:"error"}),null;default:return Z(`[SeccompFilter] Unsupported architecture: ${$}. Only x64 and arm64 are supported.`),null}}function yH($){let J=b4();if(!J)return[];let X=xH(vH(import.meta.url)),Q=V0("vendor","seccomp",J,$);return[V0(X,Q),V0(X,"..","..",Q),V0(X,"..",Q)]}function _7($){let J=$??"";if(w7.has(J))return w7.get(J);let X=bH($);return w7.set(J,X),X}function bH($){if($){if(E9.existsSync($))return Z(`[SeccompFilter] Using apply-seccomp binary from explicit path: ${$}`),$;Z(`[SeccompFilter] Explicit path provided but file not found: ${$}`)}let J=b4();if(!J)return Z(`[SeccompFilter] Cannot find apply-seccomp binary: unsupported architecture ${process.arch}`),null;Z(`[SeccompFilter] Looking for apply-seccomp binary for architecture: ${J}`);for(let X of yH("apply-seccomp"))if(E9.existsSync(X))return Z(`[SeccompFilter] Found apply-seccomp binary: ${X} (${J})`),X;for(let X of fH()){let Q=V0(X,"vendor","seccomp",J,"apply-seccomp");if(E9.existsSync(Q))return Z(`[SeccompFilter] Found apply-seccomp binary in global install: ${Q} (${J})`),Q}return Z(`[SeccompFilter] apply-seccomp binary not found in any expected location (${J})`),null}import{spawnSync as hH}from"child_process";import{createHash as uH}from"crypto";import*as s from"fs";import nJ from"path";class mX extends Error{}var gH={dir:"/run/srt-stubs",uid:0,lockWaitMs:2000,flockPath:"/usr/bin/flock"},cQ=gH,mH,g4;var F9=s.constants.O_CLOEXEC??524288,x7={kind:"masked"},h4={kind:"real"},gX={kind:"unregistered"},lH=new Set(["ENOENT","EACCES"]),pH=new Set(["ENOENT","ENOTDIR","EROFS"]),q0=null,HQ=null,dH=0;function lX($){return $?.code}function k7($){return uH("sha256").update($).digest("hex")}function f7(){if(process.platform!=="linux")return"off";let{dir:$,uid:J,flockPath:X}=cQ;if(process.geteuid?.()!==J)return"off";try{s.accessSync(X,s.constants.X_OK)}catch(Y){return lH.has(lX(Y)??"")?"off":"error"}try{s.mkdirSync($,{mode:448}),s.chmodSync($,448)}catch(Y){let G=lX(Y)??"";if(G!=="EEXIST")return pH.has(G)?"off":"error"}let Q;try{Q=s.lstatSync($)}catch{return"error"}if(!Q.isDirectory()||Q.uid!==J||(Q.mode&511)!==448)return Z(`[Sandbox Linux] ${$} is not a 0700 directory owned by uid ${J}; mask stubs are not shared`,{level:"warn"}),"off";return $}function m4($,J){try{return s.openSync(nJ.join($,J),s.constants.O_RDONLY|s.constants.O_CREAT|s.constants.O_NOFOLLOW|F9,384)}catch{return null}}function l4($,J){try{return hH(cQ.flockPath,[...J,"3"],{stdio:["ignore","ignore","ignore",$],timeout:cQ.lockWaitMs+5000}).status===0}catch{return!1}}function u4($,J,X){let Q=m4($,J);if(Q===null)return null;let Y=(cQ.lockWaitMs/1000).toFixed(3);if(l4(Q,[X,"-w",Y]))return Q;return s.closeSync(Q),null}function p4($){try{s.closeSync($)}catch{}}function d4(){let $=f7();if($==="off")return!1;if($==="error")throw new mX(`srt: cannot read the mask stub registry ${cQ.dir}; refusing to start the sandbox`);if(q0===null)q0=u4($,"lock","-s");if(q0!==null&&HQ===null)HQ=u4($,"claims","-x");if(q0===null||HQ===null)throw new mX(`srt: mask stub registry ${$} is busy (no ${q0===null?"shared":"claims"} lock within ${cQ.lockWaitMs} ms); refusing to start the sandbox rather than risk a mask another call removes`);return!0}function N9(){if(HQ===null)return;p4(HQ),HQ=null}function cH(){if(q0===null)return;p4(q0),q0=null}function c4(){let $=f7();if($==="off")return null;if($==="error"||q0===null||HQ===null)throw new mX("srt: mask stub claimed without holding the registry; refusing to start the sandbox");return $}function pX($){try{return s.lstatSync($,{bigint:!0})}catch(J){return lX(J)==="ENOENT"?"absent":"unknown"}}function n4($){try{let J=JSON.parse(s.readFileSync($,"utf8")),{v:X,type:Q,uid:Y,dev:G,ino:W,ctimeNs:U,path:M}=J,O=(V)=>typeof V==="string"&&/^\d+$/.test(V);if(X!==1||Q!=="f"&&Q!=="d"||typeof Y!=="number"||!O(G)||!O(W)||!O(U)||typeof M!=="string"||!M.startsWith("/"))return null;return{type:Q,uid:Y,dev:BigInt(G),ino:BigInt(W),ctimeNs:BigInt(U),dest:M}}catch{return null}}function i4($,J){return nJ.join($,`${k7(J)}.stub`)}function nH($,J){let X=k7(J.dest),Q=nJ.join($,`${X}.stub.${process.pid}-${++dH}`),Y=JSON.stringify({v:1,type:J.type,uid:J.uid,dev:String(J.dev),ino:String(J.ino),ctimeNs:String(J.ctimeNs),path:J.dest});s.writeFileSync(Q,Y+`
+`,{flag:"wx",mode:384}),s.renameSync(Q,nJ.join($,`${X}.stub`))}function o4($,J){return(J.type==="f"?$.isFile()&&$.size===BigInt(0):$.isDirectory())&&$.uid===BigInt(J.uid)&&$.dev===J.dev&&$.ino===J.ino&&$.ctimeNs===J.ctimeNs}function y7($){let J=nJ.dirname($),X;try{X=s.openSync(J,s.constants.O_RDONLY|s.constants.O_DIRECTORY|s.constants.O_NOFOLLOW|F9)}catch{return null}try{if(s.readlinkSync(`/proc/self/fd/${X}`)===J)return X}catch{}return s.closeSync(X),null}function a4($,J,X){return{type:$,uid:Number(J.uid),dev:J.dev,ino:J.ino,ctimeNs:J.ctimeNs,dest:X}}function iH($){let J=y7($);if(J===null)return null;try{let X;try{X=s.openSync(`/proc/self/fd/${J}/${nJ.basename($)}`,s.constants.O_RDONLY|s.constants.O_CREAT|s.constants.O_EXCL|s.constants.O_NOFOLLOW|F9,292)}catch(Q){return lX(Q)==="EEXIST"?"exists":null}try{return g4?.($),a4("f",s.fstatSync(X,{bigint:!0}),$)}finally{s.closeSync(X)}}finally{s.closeSync(J)}}function oH($,J){let X=y7($);if(X===null)return null;try{let Q=`/proc/self/fd/${X}/${nJ.basename($)}`;try{s.mkdirSync(Q,{mode:493})}catch(G){return lX(G)==="EEXIST"?"exists":null}g4?.($);let Y;try{Y=s.openSync(Q,s.constants.O_RDONLY|s.constants.O_DIRECTORY|s.constants.O_NOFOLLOW|F9)}catch{return null}try{let G=s.fstatSync(Y,{bigint:!0});if(!G.isDirectory()||G.uid!==BigInt(process.geteuid?.()??-1)||G.nlink>BigInt(2)||s.readdirSync(`/proc/self/fd/${Y}`).length!==0)return null;if(J)s.fchownSync(Y,J.uid,J.gid);return a4("d",s.fstatSync(Y,{bigint:!0}),$)}catch{return null}finally{s.closeSync(Y)}}finally{s.closeSync(X)}}function aH($){let J=y7($.dest);if(J===null)return;try{let X=`/proc/self/fd/${J}/${nJ.basename($.dest)}`,Q=pX(X);if(typeof Q==="object"&&o4(Q,$)){if($.type==="d")s.rmdirSync(X);else s.unlinkSync(X);Z(`[Sandbox Linux] Removed shared mask stub: ${$.dest}`)}}catch{}finally{s.closeSync(J)}}function sH($){try{s.unlinkSync($)}catch{}}function v7($,J,X,Q){let Y=n4(i4($,J));return Y!==null&&Y.type===Q&&Y.dest===J&&o4(X,Y)}function s4($,J,X){let Q=c4();if(Q===null)return gX;if(mH?.($)==="unregistered")return gX;let Y=pX($);if(Y==="unknown")return gX;if(Y!=="absent")return v7(Q,$,Y,J)?x7:h4;let G=X();if(G==="exists"){let W=pX($);return typeof W==="object"&&v7(Q,$,W,J)?x7:h4}if(G===null)return gX;try{nH(Q,G)}catch(W){Z(`[Sandbox Linux] mask stub marker not written for ${$}: ${W}`,{level:"warn"})}return x7}function rH($){return s4($,"f",()=>iH($))}function tH($,J){return s4($,"d",()=>oH($,J))}function r4($,J){let X=c4();if(X===null)return null;let Q=(G)=>J.some((W)=>G.startsWith(W+"/")),Y=[];for(let G=nJ.dirname($);Q(G);G=nJ.dirname(G))Y.unshift(G);for(let G of Y){let W=pX(G);if(typeof W==="object"&&v7(X,G,W,"d"))return G}return null}function t4($,J){try{return $()}catch(X){if(X instanceof mX)throw X;return Z(`[Sandbox Linux] mask stub not recorded for ${J}: ${X}`,{level:"warn"}),gX}}function b7($){return t4(()=>rH($),$)}function e4($,J){return t4(()=>tH($,J),$)}function eH($){let J;try{J=s.readdirSync($)}catch{return}let X=[],Q=[];for(let G of J){let W=/^([0-9a-f]{64})\.stub(\..*)?$/.exec(G);if(W===null)continue;let U=nJ.join($,G);if(Q.push(U),W[2]===void 0){let M=n4(U);if(M!==null&&k7(M.dest)===W[1])X.push(M)}}let Y=(G)=>G.dest.split("/").length;X.sort((G,W)=>G.type===W.type?Y(W)-Y(G):G.type==="f"?-1:1);for(let G of X)aH(G);for(let G of Q)sH(G)}function h7($,J){let X=f7(),Q=q0!==null;if(N9(),cH(),X==="off"){for(let G of $)J(G);return[]}if(X==="error")return[...$];if(!Q&&$.length===0)return[];let Y=m4(X,"lock");if(Y===null)return[...$];try{if(!l4(Y,["-x","-n"]))return[...$];for(let G of $)if(pX(i4(X,G))==="absent")J(G);return eH(X),[]}catch(G){return Z(`[Sandbox Linux] mask stub sweep failed: ${G}`,{level:"warn"}),[...$]}finally{s.closeSync(Y)}}var m7=3;function JK($){let J=$.uid===void 0?$.bwrapCommand:[$.setprivPath??"/usr/bin/setpriv",`--reuid=${$.uid}`,`--regid=${$.gid??$.uid}`,"--clear-groups","--inh-caps=-all","--ambient-caps=-all","--bounding-set=-all",...$.bwrapCommand],X=$.unsetEnvVars??[],Q=Object.entries($.setEnvVars??{});if(X.length===0&&Q.length===0)return J;return["/usr/bin/env",...X.flatMap((Y)=>["-u",Y]),...Q.map(([Y,G])=>`${Y}=${G}`),...J]}function u7($,J){let X=$.split(f$.sep),Q="";for(let Y of X){if(!Y)continue;let G=Q+f$.sep+Y;try{if(r.lstatSync(G).isSymbolicLink()){if(J.some((M)=>G.startsWith(M+"/")||G===M))return G}}catch{break}Q=G}return null}var QK=40;function Q5($){let J=$;for(let X=0;X<QK;X++){try{return r.realpathSync(J)}catch{}let Q=J,Y=[],G=null;while(G===null){let M=f$.dirname(Q);if(M===Q)return null;Y.unshift(f$.basename(Q)),Q=M;try{G=r.realpathSync(Q)}catch{}}let W=f$.join(G,Y[0]),U=null;try{U=r.readlinkSync(W)}catch{}if(U===null)return f$.join(G,...Y);J=f$.join(f$.resolve(f$.dirname(W),U),...Y.slice(1))}return null}function XK($){let J=$.split(f$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+f$.sep+Q;try{let G=r.statSync(Y);if(G.isFile()||G.isSymbolicLink())return!0}catch{break}X=Y}return!1}function YK($){let J=$.split(f$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+f$.sep+Q;if(!r.existsSync(Y))return Y;X=Y}return $}async function GK($={command:"rg"},J=m7,X=!1,Q){let Y=process.cwd(),G=new AbortController,W=Q??G.signal,U=EY(),M=[...zX.map((K)=>f$.resolve(Y,K)),...U.map((K)=>f$.resolve(Y,K))],O=f$.resolve(Y,".git"),V=!1;try{V=r.statSync(O).isDirectory()}catch{}if(V){if(M.push(f$.resolve(Y,".git/hooks")),!X)M.push(f$.resolve(Y,".git/config"))}let q=[];for(let K of zX)q.push("--iglob",K);for(let K of U)q.push("--iglob",`**/${K}/**`);if(q.push("--iglob","**/.git/hooks/**"),!X)q.push("--iglob","**/.git/config");let H=["--files","--hidden","--no-ignore","--max-depth",String(J),...q,"-g","!**/node_modules/**"],N;try{N=await C7(H,Y,W,$)}catch(K){if(K instanceof z9)throw Error(`mandatory deny scan failed: ${K}`);Z(`[Sandbox] ripgrep scan failed, retrying once: ${K}`);try{N=await C7(H,Y,W,$)}catch(L){throw Error(`mandatory deny scan failed: ${L}`)}}for(let K of N){let L=f$.resolve(Y,K),A=!1;for(let D of[...U,".git"]){let S=c9(D),B=L.split(f$.sep),C=B.findIndex((w)=>c9(w)===S);if(C!==-1){if(D===".git"){let w=B.slice(0,C+1).join(f$.sep);if(K.includes(".git/hooks"))M.push(f$.join(w,"hooks"));else if(K.includes(".git/config"))M.push(f$.join(w,"config"))}else M.push(B.slice(0,C+1).join(f$.sep));A=!0;break}}if(!A)M.push(L)}return[...new Set(M)]}var dX;function WK(){if(process.getuid?.()!==0||process.env.ARA_SRT_FILE_MASK!=="empty")return"/dev/null";if(dX)try{let X=r.lstatSync(dX);if(X.isFile()&&X.size===0&&X.uid===0&&(X.mode&146)===0)return dX}catch{}let $=r.mkdtempSync(f$.join(A9(),"claude-empty-file-"));R9.add($),r.chmodSync($,493);let J=f$.join($,"empty");return r.writeFileSync(J,"",{flag:"wx",mode:292}),r.chmodSync(J,292),dX=J,J}var cX=new Set,R9=new Set;function X5($,J){return $===J?WK():"/dev/null"}var UK="ARA_SRT_MASKED_PATHS",MK=16384;function OK($,J,X=MK){let Q=[],Y=0;for(let G of new Set($)){if(G.includes(`
 `))continue;if(G!==J&&!G.startsWith(J==="/"?"/":J+"/"))continue;let W=G.split("'").length-1,U=Buffer.byteLength(G)+4*W+(Q.length>0?1:0);if(Y+U>X)break;Q.push(G),Y+=U}return Q.length>0?Q.join(`
-`):void 0}function XK($){try{let J=r.lstatSync($);return J.isFile()&&J.size===0}catch{return!1}}var Z0=0,$5=!1;function N9(){if($5)return;process.on("exit",()=>{R9({force:!0})}),$5=!0}function R9($){if(!$?.force){if(Z0>0)Z0--;if(Z0>0){Z(`[Sandbox Linux] Deferring mount point cleanup \u2014 ${Z0} sandbox(es) still active`);return}}else Z0=0;let J=[],X=[];for(let G of dX)try{let W=r.statSync(G);if(W.isFile()&&W.size===0)J.push(G);else if(W.isDirectory())X.push(G)}catch{}let Q=(G)=>G.split("/").length;X.sort((G,W)=>Q(W)-Q(G));let Y=f7([...J,...X],(G)=>{try{let W=r.statSync(G);if(W.isFile()&&W.size===0)r.unlinkSync(G),Z(`[Sandbox Linux] Cleaned up bwrap mount point (file): ${G}`);else if(W.isDirectory()){if(r.readdirSync(G).length!==0)return;r.rmdirSync(G),Z(`[Sandbox Linux] Cleaned up bwrap mount point (dir): ${G}`)}}catch{}});dX.clear();for(let G of Y)dX.add(G);for(let G of A9)try{r.rmSync(G,{recursive:!0,force:!0})}catch{}A9.clear(),pX=void 0}function J5($){try{return r.accessSync($,r.constants.X_OK),!0}catch{return!1}}function X5($){let{seccompConfig:J,bwrapPath:X,socatPath:Q}=$??{},Y=[],G=[];if(X){if(!J5(X))Y.push(`bubblewrap (bwrap) not executable at ${X}`)}else if(D0("bwrap")===null)Y.push("bubblewrap (bwrap) not installed");if(Q){if(!J5(Q))Y.push(`socat not executable at ${Q}`)}else if(D0("socat")===null)Y.push("socat not installed");if(!J?.argv0&&C7(J?.applyPath)===null)G.push("seccomp not available - unix socket access not restricted");return{warnings:G,errors:Y}}async function Y5($,J,X,Q,Y){let G=X??"socat",W=i6(8).toString("hex"),U=r4(L9(),`claude-http-${W}.sock`),M=r4(L9(),`claude-socks-${W}.sock`),O=[`UNIX-LISTEN:${U},fork,reuseaddr`,`TCP:localhost:${$},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];Z(`Starting HTTP bridge: ${G} ${O.join(" ")}`);let V=s4(G,O,{stdio:"ignore"});if(V.on("error",(K)=>{Z(`HTTP bridge process error: ${K}`,{level:"error"})}),V.on("exit",(K,A)=>{Z(`HTTP bridge process exited with code ${K}, signal ${A}`,{level:K===0?"info":"error"})}),!V.pid)throw Error("Failed to start HTTP bridge process");let H,q;if(J===$)H=V,q=U;else{q=M;let K=[`UNIX-LISTEN:${M},fork,reuseaddr`,`TCP:localhost:${J},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];if(Z(`Starting SOCKS bridge: ${G} ${K.join(" ")}`),H=s4(G,K,{stdio:"ignore"}),H.on("error",(A)=>{Z(`SOCKS bridge process error: ${A}`,{level:"error"})}),H.on("exit",(A,L)=>{Z(`SOCKS bridge process exited with code ${A}, signal ${L}`,{level:A===0?"info":"error"})}),!H.pid){if(V.pid)try{process.kill(V.pid,"SIGTERM")}catch{}throw Error("Failed to start SOCKS bridge process")}}let F=200;for(let K=0;K<F;K++){if(!V.pid||V.killed||!H.pid||H.killed)throw Error("Linux bridge process died unexpectedly");try{if(r.existsSync(U)&&r.existsSync(q)){if(Q!==void 0){let A=Y??Q;for(let L of new Set([U,q]))r.chownSync(L,Q,A),r.chmodSync(L,384)}Z(`Linux bridges ready after ${K+1} attempts`);break}}catch(A){Z(`Error checking sockets (attempt ${K+1}): ${A}`,{level:"error"})}if(K===F-1){if(V.pid)try{process.kill(V.pid,"SIGTERM")}catch{}if(H.pid)try{process.kill(H.pid,"SIGTERM")}catch{}throw Error(`Failed to create bridge sockets after ${F} attempts`)}await new Promise((A)=>setTimeout(A,5))}return{httpSocketPath:U,socksSocketPath:q,httpBridgeProcess:V,socksBridgeProcess:H,httpProxyPort:$,socksProxyPort:J}}function YK($,J){if(J){if(!$)throw Error("seccompConfig.argv0 requires seccompConfig.applyPath");return`ARGV0=${CJ([J])} ${CJ([$])} `}let X=C7($);return X?`${CJ([X])} `:void 0}function GK($,J,X,Q,Y,G){let W=Y||"bash",U=CJ([G??"socat"]),M=["srt_payload_pid=",`${U} TCP4-LISTEN:3128,bind=127.0.0.1,fork,reuseaddr ${CJ([`UNIX-CONNECT:${$}`])} >/dev/null 2>&1 &`,"srt_http_proxy_pid=$!",`${U} TCP4-LISTEN:1080,bind=127.0.0.1,fork,reuseaddr ${CJ([`UNIX-CONNECT:${J}`])} >/dev/null 2>&1 &`,"srt_socks_proxy_pid=$!","srt_cleanup_command() {","  srt_status=$?","  trap - EXIT INT TERM",'  if [ -n "$srt_payload_pid" ]; then','    kill -KILL "$srt_payload_pid" 2>/dev/null','    wait "$srt_payload_pid" 2>/dev/null',"  fi",'  kill -KILL "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null','  wait "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null','  exit "$srt_status"',"}","trap srt_cleanup_command EXIT","trap 'exit 143' TERM","trap 'exit 130' INT",...[3128,1080].map((H)=>`${U} -u OPEN:/dev/null TCP4:127.0.0.1:${H},connect-timeout=0.1,retry=480,interval=0.005 >/dev/null 2>&1 || { printf '%s\\n' 'Sandbox proxy listener readiness failed' >&2; exit 1; }`),`kill -0 "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null || { printf '%s\\n' 'Sandbox proxy listener exited before command' >&2; exit 1; }`],O=(Q??"")+CJ([W,"-c",X]),V=[...M,`${O} <&0 &`,"srt_payload_pid=$!",'wait "$srt_payload_pid"',"srt_payload_status=$?","srt_payload_pid=",'exit "$srt_payload_status"'].join(`
-`);return`${W} -c ${CJ([V])}`}function b7($){try{if(r.lstatSync($).isSymbolicLink())return r.realpathSync($)}catch{}return $}function Q5($,J,X,Q){let Y=J==="/"?"/":J+"/";$.push("--tmpfs",J);for(let G of X)if(G.startsWith(Y)||G===J)$.push("--bind",G,G),Z(`[Sandbox Linux] Re-bound write path wiped by denyRead tmpfs: ${G}`);for(let G of Q)if(G.startsWith(Y)||G===J){if(!r.existsSync(G)){Z(`[Sandbox Linux] Skipping non-existent read allow path: ${G}`);continue}if(X.some((W)=>(W.startsWith(Y)||W===J)&&(G===W||G.startsWith(W+"/"))))continue;$.push("--ro-bind",G,G),Z(`[Sandbox Linux] Re-allowed read access within denied region: ${G}`)}}async function WK($,J,X,Q,Y={command:"rg"},G=h7,W=!1,U,M,O=[]){let V=[],H=[],q=[],F=new Set,K=new Map,A=new Map;if(J){V.push("--ro-bind","/","/");for(let u of J.allowOnly||[]){let J$=XJ(u).replace(/\/+$/,"")||"/";if(Z(`[Sandbox Linux] Processing write path: ${u} -> ${J$}`),J$.startsWith("/dev/")){Z(`[Sandbox Linux] Skipping /dev path: ${J$}`);continue}if(!r.existsSync(J$)){Z(`[Sandbox Linux] Skipping non-existent write path: ${J$}`);continue}try{let a=r.realpathSync(J$),V$=J$.replace(/\/+$/,"");if(a!==V$&&KY(J$,a)){Z(`[Sandbox Linux] Skipping symlink write path pointing outside expected location: ${u} -> ${a}`);continue}}catch{Z(`[Sandbox Linux] Skipping write path that could not be resolved: ${J$}`);continue}V.push("--bind",J$,J$),H.push(J$)}let y,n=()=>{if(y!==void 0)return y;let u=[];for(let a of H){u.push(a);try{let V$=r.realpathSync(a);if(V$!==a)u.push(V$)}catch{}}let J$=[];if($){let a=[],V$=new Set(["proc","dev","sys"]);for(let O$ of $.denyOnly||[])if(XJ(O$)==="/")try{for(let $$ of r.readdirSync("/"))if(!V$.has($$))a.push("/"+$$)}catch{}else a.push(O$);if(r.existsSync("/etc/ssh/ssh_config.d"))a.push("/etc/ssh/ssh_config.d");for(let O$ of a){let $$=XJ(O$),P$=!1;try{P$=r.statSync($$).isDirectory()}catch{continue}if(!P$)continue;J$.push($$);try{let G$=r.realpathSync($$);if(G$!==$$)J$.push(G$)}catch{}}}return y={allowedWritePathsBothForms:u,prospectiveReadDenyTmpfsDirsBothForms:J$},y},Y$=(u)=>H.some((J$)=>u.startsWith(J$+"/")||u===J$),L$=[...J.denyWithinAllow||[],...await t6(Y,G,W,U)];g4();let j$=new Set;for(let u of L$){let J$=XJ(u);if(J$.startsWith("/dev/"))continue;let a=t4(J$);if(a===null||a.startsWith("/dev/"))continue;if(y7(a,H))continue;let V$=!1;try{V$=r.statSync(a).isDirectory()}catch{continue}if(!V$)continue;if(Y$(a)){let O$=K.get(a);if(O$===void 0)O$=new Set,K.set(a,O$);O$.add(J$)}}let QJ=new Map,S$=(u)=>{let J$=QJ.get(u);if(J$!==void 0)return J$;let{allowedWritePathsBothForms:a,prospectiveReadDenyTmpfsDirsBothForms:V$}=n(),O$=a.some(($$)=>$$.startsWith(u+"/"))||V$.some(($$)=>$$===u||$$.startsWith(u+"/"))||V$.some(($$)=>[u,...K.get(u)??[]].some((P$)=>P$===$$||P$.startsWith($$+"/")));return QJ.set(u,O$),O$},h$=[...K.keys()];for(let u of L$){let J$=XJ(u);if(J$.startsWith("/dev/"))continue;let a=t4(J$);if(a===null){let $$=y7(J$,H);if($$&&!j$.has($$))j$.add($$),q.push("--ro-bind","/dev/null",$$),A.set($$,J$);Z(`[Sandbox Linux] Deny path could not be resolved through symlinks, failing closed: ${J$}`);continue}if(a!==J$)Z(`[Sandbox Linux] Resolved symlinked deny path: ${J$} -> ${a}`);if(a.startsWith("/dev/"))continue;if(j$.has(a))continue;j$.add(a);let V$=y7(a,H);if(V$){if(!j$.has(V$))j$.add(V$),q.push("--ro-bind","/dev/null",V$),A.set(V$,J$);Z(`[Sandbox Linux] Mounted /dev/null at symlink ${V$} to prevent symlink replacement attack`);continue}if(!r.existsSync(a)){if(s6(a)){Z(`[Sandbox Linux] Skipping deny path with file ancestor (cannot create paths under a file): ${a}`);continue}let $$=f$.dirname(a);while($$!=="/"&&!r.existsSync($$))$$=f$.dirname($$);let P$=Y$($$)||Y$(a),G$=h$.filter((x$)=>$$===x$||$$.startsWith(x$+"/")),c$=G$.length>0&&!G$.some(S$);if(P$&&!c$){let x$=r6(a),E$=i4(x$,H)??x$;if(E$!==a){if(!F.has(E$)){let n$=a4(E$,M),y$=r.mkdtempSync(f$.join(L9(),"claude-empty-"));if(r.chmodSync(y$,365),A9.add(y$),q.push("--ro-bind",y$,E$),A.set(E$,J$),F.add(E$),n$.kind==="unregistered")dX.add(E$);N9(),Z(`[Sandbox Linux] Mounted empty dir at ${E$} to block creation of ${a}`)}}else{let n$=k7(E$),y$=e4(a,J$);if(n$.kind==="masked")q.push("--ro-bind",y$,E$),A.set(E$,J$),N9(),Z(`[Sandbox Linux] Masked shared stub at ${E$} with ${y$} to block creation of ${a}`);else if(n$.kind==="real")q.push("--ro-bind",E$,E$),A.set(E$,J$);else q.push("--ro-bind",y$,E$),A.set(E$,J$),dX.add(E$),N9(),Z(`[Sandbox Linux] Mounted ${y$} at ${E$} to block creation of ${a}`)}}else if(c$)Z(`[Sandbox Linux] Skipping non-existent deny path inside a read-only denied directory (already uncreatable): ${a}`);else Z(`[Sandbox Linux] Skipping non-existent deny path not within allowed paths: ${a}`);continue}if(Y$(a)){if((XK(a)?k7(a):void 0)?.kind==="masked")q.push("--ro-bind",e4(a,J$),a),N9();else q.push("--ro-bind",a,a);A.set(a,J$)}else Z(`[Sandbox Linux] Skipping deny path not within allowed paths: ${a}`)}}else V.push("--bind","/","/");let L=[],R=($?.allowWithinDeny||[]).map((y)=>XJ(y)),I=new Map,j=[],C=new Set(["proc","dev","sys"]);for(let y of $?.denyOnly||[])if(XJ(y)==="/"){for(let n of r.readdirSync("/"))if(!C.has(n))L.push("/"+n)}else L.push(y);if($&&r.existsSync("/etc/ssh/ssh_config.d"))L.push("/etc/ssh/ssh_config.d");let w=L.map((y)=>XJ(y)).sort((y,n)=>y.split("/").length-n.split("/").length);for(let y of w){if(!r.existsSync(y)){Z(`[Sandbox Linux] Skipping non-existent read deny path: ${y}`);continue}if(r.statSync(y).isDirectory())j.push(y),Q5(V,y,H,R);else{if(R.includes(y)){Z(`[Sandbox Linux] Skipping read deny for re-allowed path: ${y}`);continue}let Y$=b7(y);V.push("--ro-bind","/dev/null",Y$),I.set(Y$,"/dev/null"),I.set(y,"/dev/null")}}for(let{realPath:y,fakePath:n}of X??[]){let Y$=b7(y);V.push("--ro-bind",n,Y$),I.set(Y$,n),I.set(y,n)}let P=(y)=>j.some((n)=>{if(!(y===n||y.startsWith(n+"/")))return!1;return!H.some((j$)=>(j$===n||j$.startsWith(n+"/"))&&(y===j$||y.startsWith(j$+"/")))}),l=[...F].filter((y)=>{let n=A.get(y)??y;return!I.has(y)&&!P(y)&&!P(n)&&!H.some((Y$)=>Y$===y||Y$.startsWith(y+"/"))}),e=[];for(let y=0;y<q.length;y+=3){let n=q[y+2],Y$=A.get(n)??n;if(I.has(n))continue;if(P(n)||P(Y$)){Z(`[Sandbox Linux] Skipping denyWrite bind already hidden by denyRead tmpfs: ${n}`);continue}if(l.some((L$)=>n.startsWith(L$+"/"))){Z(`[Sandbox Linux] Skipping denyWrite bind under an empty-directory mask: ${n}`);continue}if(V.push(q[y],q[y+1],n),e.push(n),q[y+1]!==n)O.push(n);if(Y$!==n)e.push(Y$)}for(let y of j)if(e.some((n)=>y.startsWith(n+"/")))Z(`[Sandbox Linux] Re-applying denyRead tmpfs re-exposed by denyWrite bind: ${y}`),Q5(V,y,H,R);for(let[y,n]of I)if(e.some((Y$)=>y.startsWith(Y$+"/"))){if(b7(y)!==y)continue;Z(`[Sandbox Linux] Re-applying file mask re-exposed by denyWrite bind: ${y}`),V.push("--ro-bind",n,y)}if(Q!==void 0)V.push("--ro-bind",Q,Q);return V}async function G5($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpSocketPath:Y,socksSocketPath:G,httpProxyPort:W,socksProxyPort:U,proxyAuthToken:M,caCertPath:O,readConfig:V,writeConfig:H,unsetEnvVars:q,setEnvVars:F,maskedFileBinds:K,maskedFileStoreDir:A,enableWeakerNestedSandbox:L,runAsUid:R,runAsGid:I,runAsHostUid:j,runAsHostGid:C,runAsHostHome:w,runAsHostUser:P,setprivPath:l,allowAllUnixSockets:e,binShell:y,ripgrepConfig:n={command:"rg"},mandatoryDenySearchDepth:Y$=h7,allowGitConfig:L$=!1,gitSafeDirectories:j$,seccompConfig:QJ,bwrapPath:S$,socatPath:h$,observeSocketPath:u,abortSignal:J$}=$,a=V&&V.denyOnly.length>0||K!==void 0&&K.length>0,V$=H!==void 0,O$=q!==void 0&&q.length>0||F!==void 0&&Object.keys(F).length>0,$$=(j$?.length??0)>0;if(!Q&&!a&&!V$&&!O$&&!$$)return J;Z0++;let P$=[],G$=["--new-session","--die-with-parent"],c$=[],x$;try{if(!e)if(x$=YK(QJ?.applyPath,QJ?.argv0),!x$)throw Error("seccomp_unavailable: the policy requires the unix-socket filter (allowAllUnixSockets is false) but apply-seccomp is not installed beside srt (vendor/seccomp/<arch>/apply-seccomp; build it with `bun run build:seccomp` in packages/sandbox-runtime)");else Z("[Sandbox Linux] Applying seccomp filter for Unix socket blocking");else Z("[Sandbox Linux] Skipping seccomp filter - allowAllUnixSockets is enabled");if(u&&x$)if(r.existsSync(u))c$.push("--bind",u,u),G$.push("--setenv","SRT_OBSERVE_SOCK",u),G$.push("--setenv","SRT_ENCODED_CMD",PJ(X??J));else Z("[Sandbox Linux] observe socket missing \u2014 supervisor not running; "+"continuing without violation monitoring");if(O$){for(let b$ of q??[])G$.push("--unsetenv",b$);for(let[b$,i$]of Object.entries(F??{}))G$.push("--setenv",b$,i$)}if(j$&&j$.length>0){let b$=EY({safeDirs:j$,unsetEnvVars:q,setEnvVars:F});for(let[i$,VY]of Object.entries(b$))G$.push("--setenv",i$,VY)}if(Q){if(G$.push("--unshare-net"),Y&&G){if(!r.existsSync(Y))throw Error(`Linux HTTP bridge socket does not exist: ${Y}. The bridge process may have died. Try reinitializing the sandbox.`);if(!r.existsSync(G))throw Error(`Linux SOCKS bridge socket does not exist: ${G}. The bridge process may have died. Try reinitializing the sandbox.`);if(c$.push("--bind",Y,Y),G!==Y)c$.push("--bind",G,G);let b$=ZQ(3128,1080,O,M,H===void 0,PJ(X??J));if(G$.push(...b$.flatMap((i$)=>{let VY=i$.indexOf("="),_U=i$.slice(0,VY),xU=i$.slice(VY+1);return["--setenv",_U,xU]})),W!==void 0)G$.push("--setenv","CLAUDE_CODE_HOST_HTTP_PROXY_PORT",String(W));if(U!==void 0)G$.push("--setenv","CLAUDE_CODE_HOST_SOCKS_PROXY_PORT",String(U))}}let E$=await WK(V,H,K,A,n,Y$,L$,J$,j===void 0?void 0:{uid:j,gid:C??j},P$);F9(),G$.push(...E$);let n$=QK(P$,process.cwd());if(n$!==void 0)G$.push("--setenv",$K,n$);if(G$.push(...c$),G$.push("--dev","/dev"),G$.push("--unshare-pid"),!L){if(G$.push("--unshare-user","--cap-drop","ALL","--proc","/proc"),!x$)G$.push("--ro-bind","/dev/null","/proc/sysrq-trigger")}else G$.push("--unshare-user","--bind","/proc","/proc");if(R!==void 0)G$.push("--uid",String(R)),G$.push("--gid",String(I??R));if(j!==void 0){if(w)G$.push("--setenv","HOME",w);if(P)G$.push("--setenv","USER",P),G$.push("--setenv","LOGNAME",P)}let y$=y||"bash",e$=D0(y$);if(!e$)throw Error(`Shell '${y$}' not found in PATH`);if(G$.push("--",e$,"-c"),Q&&Y&&G){let b$=GK(Y,G,J,x$,e$,h$);G$.push(b$)}else if(x$){let b$=x$+CJ([e$,"-c",J]);G$.push(b$)}else G$.push(J);let GJ=[S$??"bwrap",...G$],WJ=CJ(o6({bwrapCommand:GJ,uid:j,gid:C,setprivPath:l,unsetEnvVars:q,setEnvVars:F})),s$=[];if(Q)s$.push("network");if(a||V$)s$.push("filesystem");if(O$)s$.push("env");if(x$)s$.push("seccomp(unix-block)");return Z(`[Sandbox Linux] Wrapped command with bwrap (${s$.join(", ")} restrictions)`),WJ}catch(E$){if(Z0>0)Z0--;if(F9(),Z0===0)f7([],()=>{});throw E$}}import{spawn as UK}from"child_process";import*as B0 from"path";class D9{violations=[];totalCount=0;maxSize=100;listeners=new Set;addViolation($){if(this.violations.push({...$,line:u7($.line).replace(/[<>]/g,"")}),this.totalCount++,this.violations.length>this.maxSize)this.violations=this.violations.slice(-this.maxSize);this.notifyListeners()}getViolations($){if($===void 0)return[...this.violations];return this.violations.slice(-$)}getCount(){return this.violations.length}getTotalCount(){return this.totalCount}getViolationsForCommand($){let J=PJ($);return this.violations.filter((X)=>X.encodedCommand===J)}clear(){this.violations=[],this.notifyListeners()}subscribe($){return this.listeners.add($),$(this.getViolations()),()=>{this.listeners.delete($)}}notifyListeners(){let $=this.getViolations();this.listeners.forEach((J)=>J($))}}function nQ($,J,X){if(!X)return!1;if((X["*"]??[]).some((Y)=>$.includes(Y)))return!0;if(J===void 0)return!1;for(let[Y,G]of Object.entries(X))if(Y!=="*"&&J.includes(Y)&&G.some((W)=>$.includes(W)))return!0;return!1}function u7($){return $.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").trim()}function MK($=!1){let J=process.cwd(),X=[];for(let Q of KX)X.push(B0.resolve(J,Q)),X.push(`**/${Q}`);for(let Q of zY())X.push(B0.resolve(J,Q)),X.push(`**/${Q}/**`);if(X.push(B0.resolve(J,".git/hooks")),X.push("**/.git/hooks/**"),!$)X.push(B0.resolve(J,".git/config")),X.push("**/.git/config");return[...new Set(X)]}var W5=`_${Math.random().toString(36).slice(2,11)}_SBX`;function OK($){return`CMD64_${PJ($)}_END_${W5}`}function iQ($){return NJ($)?`(regex ${iJ(NX($))})`:`(subpath ${iJ($)})`}function p7($){return NX($).slice(0,-1)+"(/.*)?$"}function KQ($){return NJ($)?`(regex ${iJ(p7($))})`:`(subpath ${iJ($)})`}function U5($){return $.replace(/\[[^\]]*\]|[*?]+/g,"x")}function m7($,J){let X=[...new Set(J)];if(X.length===0)return $;let Q=X.map((Y)=>`(require-not ${Y})`).join(" ");return`(require-all ${$} ${Q})`}function g7($){let J=XJ($);return{path:J,glob:NJ(J)}}function M5($,J){return $.test(J.glob?U5(J.path):J.path)}function Z9($,J){let X=$.glob?U5($.path):$.path;return X.startsWith(J==="/"?"/":J+"/")&&X!==J}function VK($,J){return{denies:($.denyOnly||[]).map(g7),allows:($.allowWithinDeny||[]).map(g7),writeRoots:(J||[]).map(g7)}}function HK($){let J=[],X=!1,Q=$.allows.filter((Y)=>!Y.glob).map((Y)=>Y.path);for(let Y of $.denies){if(!Y.glob){if(Q.some((U)=>Y.path.startsWith(U+"/")))J.push(KQ(Y.path));continue}let G=new RegExp(p7(Y.path));if(G.test("/"))X=!0;let W=$.allows.filter((U)=>M5(G,U)).map((U)=>iQ(U.path));J.push(m7(KQ(Y.path),W))}return{filters:J,coversRoot:X}}function O5($){let J=$.split(/[*?[\]]/)[0];if(!J||J==="/")return"/";return J.endsWith("/")?J.slice(0,-1):B0.dirname(J)}function qK($,J){let{denies:X,allows:Q,writeRoots:Y}=$;if(Y.length===0)return[];let G=Y.filter((H)=>H.glob).map((H)=>new RegExp(NX(H.path))),W=Y.filter((H)=>!H.glob).map((H)=>H.path),U=(H)=>W.some((q)=>Z9({path:H,glob:!1},q))||G.some((q)=>q.test(H)),M=(H)=>[...Q,...Y].filter((q)=>Z9(q,H)).map((q)=>iQ(q.path)),O=new Set,V=(H)=>{for(let q of H)if(U(q))O.add(`(literal ${iJ(q)})`)};for(let H of X)if(H.glob){let q=O5(H.path);if(!(G.length>0||W.some((L)=>q===L||Z9({path:q,glob:!1},L)||Z9({path:L,glob:!1},q))))continue;let K=new RegExp(p7(H.path)),A=[...Q,...Y].filter((L)=>M5(K,L)).map((L)=>iQ(L.path));if(O.add(m7(KQ(H.path),A)),q!=="/")V([q,...l7(q)])}else{if(!U(H.path))continue;O.add(m7(KQ(H.path),M(H.path))),V(l7(H.path))}return g0("deny",["file-write-unlink"],O,J)}function g0($,J,X,Q){if(X.size===0)return[];return[`(${$} ${J.join(" ")}`,...[...X].map((Y)=>`  ${Y}`),`  (with message "${Q}"))`]}function l7($){let J=[],X=B0.dirname($);while(X!=="/"&&X!=="."){J.push(X);let Q=B0.dirname(X);if(Q===X)break;X=Q}return J}function V5($,J){let X=new Set;for(let Q of $){let Y=XJ(Q);X.add(KQ(Y));let G;if(NJ(Y)){if(G=O5(Y),G==="/")continue;X.add(`(literal ${iJ(G)})`)}else G=Y;for(let W of l7(G))X.add(`(literal ${iJ(W)})`)}return g0("deny",["file-write-unlink","file-write-create"],X,J)}function KK($,J){if(!$)return["(allow file-read*)"];let X=[];X.push("(allow file-read*)");let Q=$.denies.some((M)=>M.path==="/"),Y=new Set($.denies.map((M)=>KQ(M.path)));X.push(...g0("deny",["file-read*"],Y,J));let G=new Set($.allows.map((M)=>iQ(M.path)));X.push(...g0("allow",["file-read*"],G,J));let W=HK($);if(X.push(...g0("deny",["file-read*"],new Set(W.filters),J)),Q||W.coversRoot)X.push('(allow file-read* (literal "/"))');if($.denies.length>0)X.push("(allow file-read-metadata","  (vnode-type DIRECTORY))");X.push(...V5($.denies.map((M)=>M.path),J));let U=new Set($.writeRoots.map((M)=>iQ(M.path)));return X.push(...g0("allow",["file-write-unlink","file-write-create"],U,J)),X}function zK($,J,X=!1){if(!$)return["(allow file-write*)"];let Q=[],Y=new Set;for(let U of $.allowOnly||[])Y.add(iQ(XJ(U)));Q.push(...g0("allow",["file-write*"],Y,J));let G=[...$.denyWithinAllow||[],...MK(X)],W=new Set;for(let U of G)W.add(KQ(XJ(U)));return Q.push(...g0("deny",["file-write*"],W,J)),Q.push(...V5(G,J)),Q}function EK({readConfig:$,writeConfig:J,httpProxyPort:X,socksProxyPort:Q,needsNetworkRestriction:Y,allowUnixSockets:G,allowAllUnixSockets:W,allowLocalBinding:U,allowMachLookup:M,allowPty:O,allowGitConfig:V=!1,enableWeakerNetworkIsolation:H=!1,allowAppleEvents:q=!1,logTag:F}){let K=["(version 1)",`(deny default (with message "${F}"))`,"",`; LogTag: ${F}`,"","; Essential permissions - based on Chrome sandbox policy","; Process permissions","(allow process-exec)","(allow process-fork)","(allow process-info* (target same-sandbox))","(allow signal (target same-sandbox))","(allow mach-priv-task-port (target same-sandbox))","","; User preferences","(allow user-preference-read)","","; Mach IPC - specific services only (no wildcard)","(allow mach-lookup",'  (global-name "com.apple.audio.systemsoundserver")','  (global-name "com.apple.distributed_notifications@Uv3")','  (global-name "com.apple.FontObjectsServer")','  (global-name "com.apple.fonts")','  (global-name "com.apple.logd")','  (global-name "com.apple.lsd.mapdb")','  (global-name "com.apple.PowerManagement.control")','  (global-name "com.apple.system.logger")','  (global-name "com.apple.system.notification_center")','  (global-name "com.apple.system.opendirectoryd.libinfo")','  (global-name "com.apple.system.opendirectoryd.membership")','  (global-name "com.apple.bsd.dirhelper")','  (global-name "com.apple.securityd.xpc")','  (global-name "com.apple.coreservices.launchservicesd")',")","",...H?["; trustd.agent - needed for Go TLS certificate verification (weaker network isolation)",'(allow mach-lookup (global-name "com.apple.trustd.agent"))']:[],...q?["; Apple Events - opt-in; needed for open/osascript to talk to other apps (appleeventsd)","(allow appleevent-send)",'(allow mach-lookup (global-name "com.apple.coreservices.appleevents"))',"; Launch Services open requests need the lsopen operation plus, on","; macOS 14/15, coreservicesd and the quarantine resolver - without","; these open fails with -10822 kLSServerCommunicationErr or -54","(allow lsopen)",'(allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))','(allow mach-lookup (global-name "com.apple.coreservices.quarantine-resolver"))']:[],...M&&M.length>0?["; User-specified XPC/Mach services",...M.map((L)=>L.endsWith("*")?`(allow mach-lookup (global-name-prefix ${iJ(L.slice(0,-1))}))`:`(allow mach-lookup (global-name ${iJ(L)}))`)]:[],"","; POSIX IPC - shared memory","(allow ipc-posix-shm)","","; POSIX IPC - semaphores for Python multiprocessing","(allow ipc-posix-sem)","","; IOKit - specific operations only","(allow iokit-open",'  (iokit-registry-entry-class "IOSurfaceRootUserClient")','  (iokit-registry-entry-class "RootDomainUserClient")','  (iokit-user-client-class "IOSurfaceSendRight")',")","","; IOKit properties","(allow iokit-get-properties)","","; Specific safe system-sockets, doesn't allow network access","(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))","","; sysctl - specific sysctls only","(allow sysctl-read",'  (sysctl-name "hw.activecpu")','  (sysctl-name "hw.busfrequency_compat")','  (sysctl-name "hw.byteorder")','  (sysctl-name "hw.cacheconfig")','  (sysctl-name "hw.cachelinesize_compat")','  (sysctl-name "hw.cpufamily")','  (sysctl-name "hw.cpufrequency")','  (sysctl-name "hw.cpufrequency_compat")','  (sysctl-name "hw.cputype")','  (sysctl-name "hw.l1dcachesize_compat")','  (sysctl-name "hw.l1icachesize_compat")','  (sysctl-name "hw.l2cachesize_compat")','  (sysctl-name "hw.l3cachesize_compat")','  (sysctl-name "hw.logicalcpu")','  (sysctl-name "hw.logicalcpu_max")','  (sysctl-name "hw.machine")','  (sysctl-name "hw.memsize")','  (sysctl-name "hw.ncpu")','  (sysctl-name "hw.nperflevels")','  (sysctl-name "hw.packages")','  (sysctl-name "hw.pagesize_compat")','  (sysctl-name "hw.pagesize")','  (sysctl-name "hw.physicalcpu")','  (sysctl-name "hw.physicalcpu_max")','  (sysctl-name "hw.tbfrequency_compat")','  (sysctl-name "hw.vectorunit")','  (sysctl-name "kern.argmax")','  (sysctl-name "kern.bootargs")','  (sysctl-name "kern.hostname")','  (sysctl-name "kern.maxfiles")','  (sysctl-name "kern.maxfilesperproc")','  (sysctl-name "kern.maxproc")','  (sysctl-name "kern.ngroups")','  (sysctl-name "kern.osproductversion")','  (sysctl-name "kern.osrelease")','  (sysctl-name "kern.ostype")','  (sysctl-name "kern.osvariant_status")','  (sysctl-name "kern.osversion")','  (sysctl-name "kern.secure_kernel")','  (sysctl-name "kern.tcsm_available")','  (sysctl-name "kern.tcsm_enable")','  (sysctl-name "kern.usrstack64")','  (sysctl-name "kern.version")','  (sysctl-name "kern.willshutdown")','  (sysctl-name "machdep.cpu.brand_string")','  (sysctl-name "machdep.ptrauth_enabled")','  (sysctl-name "security.mac.lockdown_mode_state")','  (sysctl-name "sysctl.proc_cputype")','  (sysctl-name "vm.loadavg")','  (sysctl-name-prefix "hw.optional.arm")','  (sysctl-name-prefix "hw.optional.arm.")','  (sysctl-name-prefix "hw.optional.armv8_")','  (sysctl-name-prefix "hw.perflevel")','  (sysctl-name-prefix "kern.proc.all")','  (sysctl-name-prefix "kern.proc.pgrp.")','  (sysctl-name-prefix "kern.proc.pid.")','  (sysctl-name-prefix "machdep.cpu.")','  (sysctl-name-prefix "net.routetable.")',")","","; V8 thread calculations","(allow sysctl-write",'  (sysctl-name "kern.tcsm_enable")',")","","; Distributed notifications","(allow distributed-notification-post)","","; Specific mach-lookup permissions for security operations",'(allow mach-lookup (global-name "com.apple.SecurityServer"))',"","; File I/O on device files",'(allow file-ioctl (literal "/dev/null"))','(allow file-ioctl (literal "/dev/zero"))','(allow file-ioctl (literal "/dev/random"))','(allow file-ioctl (literal "/dev/urandom"))','(allow file-ioctl (literal "/dev/dtracehelper"))','(allow file-ioctl (literal "/dev/tty"))',"","(allow file-ioctl file-read-data file-write-data","  (require-all",'    (literal "/dev/null")',"    (vnode-type CHARACTER-DEVICE)","  )",")",""];if(K.push("; Network"),!Y)K.push("(allow network*)");else{if(U)K.push('(allow network-bind (local ip "*:*"))'),K.push('(allow network-inbound (local ip "*:*"))'),K.push('(allow network-outbound (remote ip "localhost:*"))');if(W)K.push("(allow system-socket (socket-domain AF_UNIX))"),K.push('(allow network-bind (local unix-socket (path-regex #"^/")))'),K.push('(allow network-outbound (remote unix-socket (path-regex #"^/")))');else if(G&&G.length>0){K.push("(allow system-socket (socket-domain AF_UNIX))");for(let L of G){let R=XJ(L);K.push(`(allow network-bind (local unix-socket (subpath ${iJ(R)})))`),K.push(`(allow network-outbound (remote unix-socket (subpath ${iJ(R)})))`)}}if(X!==void 0)K.push(`(allow network-bind (local ip "localhost:${X}"))`),K.push(`(allow network-inbound (local ip "localhost:${X}"))`),K.push(`(allow network-outbound (remote ip "localhost:${X}"))`);if(Q!==void 0&&Q!==X)K.push(`(allow network-bind (local ip "localhost:${Q}"))`),K.push(`(allow network-inbound (local ip "localhost:${Q}"))`),K.push(`(allow network-outbound (remote ip "localhost:${Q}"))`)}K.push("");let A=$?VK($,J?.allowOnly):void 0;if(K.push("; File read"),K.push(...KK(A,F)),K.push(""),K.push("; File write"),K.push(...zK(J,F,V)),A){let L=qK(A,F);if(L.length>0)K.push(""),K.push("; File read: keep read-denied paths inside write roots in place"),K.push(...L)}if(O)K.push(""),K.push("; Pseudo-terminal (pty) support"),K.push("(allow pseudo-tty)"),K.push("(allow file-ioctl"),K.push('  (literal "/dev/ptmx")'),K.push('  (regex #"^/dev/ttys")'),K.push(")"),K.push("(allow file-read* file-write*"),K.push('  (literal "/dev/ptmx")'),K.push('  (regex #"^/dev/ttys")'),K.push(")");return K.join(`
-`)}function iJ($){return JSON.stringify($)}function H5($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpProxyPort:Y,socksProxyPort:G,proxyAuthToken:W,caCertPath:U,allowUnixSockets:M,allowAllUnixSockets:O,allowLocalBinding:V,allowMachLookup:H,readConfig:q,writeConfig:F,unsetEnvVars:K,setEnvVars:A,maskedFileBinds:L,allowPty:R,allowGitConfig:I=!1,gitSafeDirectories:j,enableWeakerNetworkIsolation:C=!1,allowAppleEvents:w=!1,binShell:P}=$,l=q;if(L&&L.length>0)Z("[Sandbox macOS] file mask degrades to deny on macOS until the interposer lands"),l={denyOnly:[...q?.denyOnly??[],...L.map((O$)=>O$.realPath)],allowWithinDeny:q?.allowWithinDeny};let e=l&&l.denyOnly.length>0,y=F!==void 0,n=K!==void 0&&K.length>0||A!==void 0&&Object.keys(A).length>0,Y$=(j?.length??0)>0;if(!Q&&!e&&!y&&!n&&!Y$)return J;let L$=X??J,j$=OK(L$),QJ=EK({readConfig:l,writeConfig:F,httpProxyPort:Y,socksProxyPort:G,needsNetworkRestriction:Q,allowUnixSockets:M,allowAllUnixSockets:O,allowLocalBinding:V,allowMachLookup:H,allowPty:R,allowGitConfig:I,enableWeakerNetworkIsolation:C,allowAppleEvents:w,logTag:j$}),S$=ZQ(Y,G,U,W,F===void 0,PJ(L$));if(V&&Q){let P$=(K??[]).includes("JAVA_TOOL_OPTIONS")?"":process.env.JAVA_TOOL_OPTIONS??"",G$=P$.includes("-Djava.net.preferIPv4Stack=true")?P$:[P$,"-Djava.net.preferIPv4Stack=true"].filter(Boolean).join(" ");S$.push(`JAVA_TOOL_OPTIONS=${G$}`)}if(j&&j.length>0){let O$=EY({safeDirs:j,unsetEnvVars:K,setEnvVars:A});for(let[$$,P$]of Object.entries(O$))S$.push(`${$$}=${P$}`)}let h$=P||"bash",u=D0(h$);if(!u)throw Error(`Shell '${h$}' not found in PATH`);let J$=(K??[]).flatMap((O$)=>["-u",O$]),a=Object.entries(A??{}).map(([O$,$$])=>`${O$}=${$$}`),V$=CJ(["env",...J$,...a,...S$,"/usr/bin/sandbox-exec","-p",QJ,u,"-c",J]);return Z(`[Sandbox macOS] Applied restrictions - network: ${!!(Y||G)}, read: ${l?"allowAllExcept"in l?"allowAllExcept":"denyAllExcept":"none"}, write: ${F?"allowAllExcept"in F?"allowAllExcept":"denyAllExcept":"none"}`),V$}function q5($,J,X=(Q)=>Q){let Q=/CMD64_(.+?)_END/,Y=/Sandbox:\s+(.+)$/,G=UK("log",["stream","--predicate",`(eventMessage ENDSWITH "${W5}")`,"--style","compact"]);return G.stdout?.on("data",(W)=>{let U=W.toString().split(`
-`),M=U.find((K)=>K.includes("Sandbox:")&&K.includes("deny")),O=U.find((K)=>K.startsWith("CMD64_"));if(!M)return;let V=M.match(Y);if(!V?.[1])return;let H=V[1],q,F;if(O){if(F=O.match(Q)?.[1],F)try{q=X(e0(F))}catch{}}if(H.includes("mDNSResponder")||H.includes("mach-lookup com.apple.diagnosticd")||H.includes("mach-lookup com.apple.analyticsd"))return;if(nQ(H,q,J))return;$({line:H,command:q,encodedCommand:F,timestamp:new Date})}),G.stderr?.on("data",(W)=>{Z(`[Sandbox Monitor] Log stream stderr: ${W.toString()}`)}),G.on("error",(W)=>{Z(`[Sandbox Monitor] Failed to start log stream: ${W.message}`)}),G.on("exit",(W)=>{Z(`[Sandbox Monitor] Log stream exited with code: ${W}`)}),()=>{Z("[Sandbox Monitor] Stopping log monitor"),G.kill("SIGTERM")}}import{randomBytes as FK}from"crypto";import{chmodSync as K5,chownSync as NK,mkdtempSync as LK,rmSync as AK}from"fs";import{createServer as RK}from"net";import{tmpdir as DK}from"os";import{join as z5,posix as ZK}from"path";import{createInterface as BK}from"readline";function E5($,J){let{allowWritePaths:X,denyWritePaths:Q,ignoreViolations:Y,resolveCommandText:G=(j)=>j,consumerUid:W,consumerGid:U}=J,M=LK(z5(DK(),"srt-obs-")),O=z5(M,`s${FK(4).toString("hex")}.sock`),V=(j,C)=>j===C||j.startsWith(C.endsWith("/")?C:C+"/"),H=(j)=>{let C=ZK.normalize(j);if(Q.some((w)=>V(C,w)))return!0;return!X.some((w)=>V(C,w))},q=(j,C)=>{if(j.observe_init_error){Z(`[Sandbox Linux Monitor] observe filter not installed: ${j.observe_init_error}`);return}if(typeof j.path!=="string")return;if(!j.path.startsWith("/"))return;if(!H(j.path))return;let w;if(C)try{w=G(e0(C))}catch{}if(nQ(j.path,w,Y))return;let P={line:`deny ${j.syscall??"syscall"} ${j.path}`,command:w,encodedCommand:C,timestamp:new Date};$(P)},F,K=new Promise((j)=>{F=j}),A=O,L=RK((j)=>{let C,w=BK({input:j});w.on("line",(P)=>{if(!P)return;let l;try{l=JSON.parse(P)}catch{return}if(l.encodedCommand&&C===void 0)C=l.encodedCommand;q(l,C??l.encodedCommand)}),j.on("error",()=>w.close()),j.on("close",()=>w.close())});L.on("error",(j)=>{Z(`[Sandbox Linux Monitor] listen failed: ${j.message} - violation monitoring disabled`,{level:"warn"}),A=void 0,F()}),L.listen(O,()=>{if(W!==void 0)K5(M,457),NK(O,W,U??W),K5(O,384);F()});let R=new Set;return L.on("connection",(j)=>{R.add(j),j.on("close",()=>R.delete(j))}),{get observeSocketPath(){return A},ready:K,stop:()=>{Z("[Sandbox Linux Monitor] stopping");for(let j of R)j.destroy();L.close();try{AK(M,{recursive:!0,force:!0})}catch{}}}}import*as JJ from"fs";import*as L5 from"net";import*as $J from"path";import{spawn as jK,spawnSync as TK}from"child_process";import{once as SK}from"events";import{fileURLToPath as IK}from"url";class A$ extends Error{code;subcommand;constructor($,J,X){super(J);this.name="WindowsSandboxError",this.code=$,this.subcommand=X}}var B9=[60080,60089],F5=["-NoProfile","-Command"];function j9($){let J=process.env.SystemRoot??"C:\\Windows",X={exe:$J.win32.join(J,"System32","cmd.exe"),args:["/d","/s","/c"]};if($===void 0||$===null)return X;if(typeof $==="object"){if(!$J.win32.isAbsolute($.exe))throw new A$("bin_shell_invalid",`binShell.exe must be an absolute path (got ${JSON.stringify($.exe)})`);if(!Array.isArray($.args))throw new A$("bin_shell_invalid",`binShell.args must be an array (got ${JSON.stringify($.args)})`);return $}let Q=$J.win32.basename($),Y=Q.toLowerCase(),G=$J.win32.isAbsolute($);if(!G&&$!==Q)throw new A$("bin_shell_invalid",`binShell string must be a bare token or an absolute path (got ${JSON.stringify($)})`);switch(Y){case"bash":case"bash.exe":case"sh":case"sh.exe":if(!G)throw new A$("bin_shell_invalid",`binShell bash path must be absolute (got ${JSON.stringify($)}); pass the resolved Git Bash install path`);return{exe:$,args:["-c"]};case"pwsh":case"pwsh.exe":return{exe:G?$:"pwsh.exe",args:F5};case"powershell":case"powershell.exe":return{exe:G?$:$J.win32.join(J,"System32","WindowsPowerShell","v1.0","powershell.exe"),args:F5};case"cmd":case"cmd.exe":return G?{exe:$,args:X.args}:X;default:throw new A$("bin_shell_invalid",`unrecognised binShell ${JSON.stringify($)}: expected 'cmd' | 'powershell' | 'pwsh' or an absolute path to bash.exe/sh.exe/pwsh.exe/powershell.exe`)}}function A5(){let $=$J.dirname(IK(import.meta.url));return $J.resolve($,"..","..")}var R5={x64:"x64",arm64:"arm64"},CK=$J.join(A5(),"vendor","srt-win",R5[process.arch]??process.arch,"srt-win.exe");function wK(){let $=A5(),J=R5[process.arch],X=[];if(J)X.push($J.join($,"vendor","srt-win",J,"srt-win.exe"));X.push($J.join($,"vendor","srt-win-src","target","release","srt-win.exe"));for(let Q of X)if(JJ.existsSync(Q))return Q;throw new A$("srt_win_not_found",`srt-win.exe not found. Set windows.srtWin.path or build with \`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. Looked in: ${X.join(", ")}`)}var D5="--srt-win";function wJ($){if($?.path===void 0)throw new A$("srt_win_not_found","no srt-win path configured; set windows.srtWin.path (e.g. to the exported VENDORED_SRT_WIN_EXE constant for the packaged binary)");if(!JJ.existsSync($.path))throw new A$("srt_win_not_found",`windows.srtWin.path is set to '${$.path}' but the file does not exist`);return{exe:$.path,prependArgs:[D5]}}function m0($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??wJ(),Y=TK(X,[...Q,...$],{encoding:"utf8",windowsHide:!0,timeout:J.timeoutMs??15000,...J.stdin!==void 0?{input:J.stdin}:{}});if(Y.error){if(Y.error.code==="ETIMEDOUT")throw new A$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${J.timeoutMs??15000}ms`+(Y.signal?` (killed by ${Y.signal})`:""),$[0]);throw new A$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${Y.error.message}`,$[0])}return{status:Y.status,signal:Y.signal,stdout:(Y.stdout??"").trim(),stderr:(Y.stderr??"").trim()}}function c7($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??wJ(),Y=J.timeoutMs??15000;return new Promise((G,W)=>{let U=jK(X,[...Q,...$],{windowsHide:!0}),M=!1,O=Y>0?setTimeout(()=>{M=!0,U.kill()},Y):void 0,V="",H="";U.stdout?.setEncoding("utf8").on("data",(q)=>V+=q),U.stderr?.setEncoding("utf8").on("data",(q)=>H+=q),U.stdin?.on("error",()=>{}).end(J.stdin),U.once("error",(q)=>{clearTimeout(O),W(new A$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${q.message}`,$[0]))}),U.once("close",(q,F)=>{if(clearTimeout(O),M){W(new A$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${Y}ms`+(F?` (killed by ${F})`:""),$[0]));return}G({status:q,signal:F,stdout:V.trim(),stderr:H.trim()})})})}function Z5($,J){if(J.status!==0)throw new A$("srt_win_nonzero",`srt-win ${$.join(" ")} exited ${J.status}: ${J.stderr||J.stdout}`,$[0]);try{return JSON.parse(J.stdout)}catch(X){throw new A$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(J.stdout)}: ${X.message}`,$[0])}}function n7($,J){return Z5($,m0($,J))}async function i7($,J){return Z5($,await c7($,J))}function B5($,J){let X=m0($,J),Q;try{Q=JSON.parse(X.stdout)}catch(Y){throw new A$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(X.stdout)}: ${Y.message}`,$[0])}return{ok:X.status===0,json:Q,stderr:X.stderr}}function j5($){let J=["wfp","status"];if($)J.push("--sublayer-guid",$);return J}function T9($){return{state:$.state,filters:$.filters,...$.port_range&&{portRange:$.port_range},...$.user_sid&&{userSid:$.user_sid},...$.hint&&{hint:$.hint}}}function S9($){return{provisioned:$.user.exists,...$.user.sid&&{sid:$.user.sid},groupExists:$.user.group_exists,...$.user.group_sid&&{groupSid:$.user.group_sid},inBuiltinUsers:$.user.in_builtin_users,inSandboxGroup:$.user.in_sandbox_group,hiddenFromLogon:$.user.hidden_from_logon,credPresent:$.cred_present,...typeof $.marker_version==="number"&&{markerVersion:$.marker_version},realUserSid:$.real_user_sid,...$.ca_cert_thumb&&{caCertThumb:$.ca_cert_thumb},...$.ca_cert_pem&&{caCertPem:$.ca_cert_pem}}}function T5($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=n7(J,{srtWin:$.srtWin});return{user:S9(X.user),wfp:T9(X.wfp)}}async function S5($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=await i7(J,{srtWin:$.srtWin});return{user:S9(X.user),wfp:T9(X.wfp)}}function I5($={}){return T9(n7(j5($.sublayerGuid),{srtWin:$.srtWin}))}async function C5($={}){return T9(await i7(j5($.sublayerGuid),{srtWin:$.srtWin}))}async function o7($={}){let J=$.target,X;if(!J){let[Q,Y]=$.proxyPortRange??B9;for(let G=0;G<5;G++){let W=L5.createServer();W.listen(0,"127.0.0.1"),await SK(W,"listening");let U=W.address().port;if(U<Q||U>Y){X=W,J=`127.0.0.1:${U}`;break}W.close()}if(!J)throw new A$("wfp_verify_bind_failed",`verifyWindowsWfpEgress: could not bind a loopback listener outside the WFP permit range [${Q},${Y}] in 5 attempts`)}try{let Q=m0(["wfp","verify","--target",J],{timeoutMs:30000,srtWin:$.srtWin});Z(`[Sandbox Windows] wfp verify exit=${Q.status}: ${Q.stderr||Q.stdout}`);let Y;try{Y=JSON.parse(Q.stdout)}catch{throw new A$("wfp_verify_unparseable","WFP egress fence could not be verified \u2014 `srt-win wfp "+`verify\` exited ${Q.status}`+(Q.signal?` (signal ${Q.signal})`:"")+` with unparseable output ${JSON.stringify(Q.stdout)} (stderr: ${JSON.stringify(Q.stderr)})`)}if(Q.status===3)throw new A$("wfp_fence_inactive","WFP egress fence is not active \u2014 direct outbound from the "+`sandbox user to ${Y.target} succeeded. Re-run \`srt-win install\` (one UAC prompt). (${Q.stderr})`);if(Q.status!==0)throw new A$("wfp_verify_inconclusive","WFP egress fence could not be verified \u2014 probe to "+`${Y.target} was '${Y.egress_probe}' (exit ${Q.status}). The fence may be absent. Re-run \`srt-win install\`. (${Q.stderr})`);return{target:Y.target,stderr:Q.stderr}}finally{X?.close()}}function a7($={}){return S9(n7(["user","status"],{srtWin:$.srtWin}))}async function cX($={}){return S9(await i7(["user","status"],{srtWin:$.srtWin}))}function s7($,J={}){let X=$??a7(J);if(!X.caCertThumb||!X.caCertPem)return null;return{pem:X.caCertPem,thumb:X.caCertThumb}}function PK($,J={}){let X=m0(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});P5($,X)}async function w5($,J={}){let X=await c7(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});P5($,X)}function P5($,J){if(Z(`[Sandbox Windows] user trust-ca exit=${J.status}: ${J.stderr||J.stdout}`),J.status!==0)throw new A$("trust_ca_failed",`srt-win user trust-ca '${$}' failed (exit ${J.status}): ${J.stderr||J.stdout}`)}function _5(){let $=process.env.ProgramData;if(!$)throw Error("ProgramData is not set");return $J.win32.join($,"sandbox-runtime")}async function r7($={}){let J=$.status??await cX({srtWin:$.srtWin});if(!J.provisioned||!J.credPresent)throw Error(`ensurePersistentWindowsCa: sandbox user is not provisioned (user=${J.provisioned}, cred=${J.credPresent}). Run \`npx sandbox-runtime windows-install\` first.`);let X=$.dir?void 0:_5();if(X&&!JJ.existsSync(X))throw Error(`ensurePersistentWindowsCa: state directory ${X} does not exist. Run \`npx sandbox-runtime windows-install\` first.`);let Q=$.dir??$J.win32.join(X,"ca"),Y=$J.join(Q,"ca.json"),G=$J.join(Q,"cert.pem"),W=$J.join(Q,"key.pem"),U=($.regenerateWithinDays??30)*24*60*60*1000,M=(L,R)=>{let I=`${L}.tmp.${process.pid}`;JJ.writeFileSync(I,R),JJ.renameSync(I,L)},O=async(L,R,I,j)=>{M(G,L),M(W,R);let C=j||J.caCertThumb!==I;if(C){let w=$J.join(Q,`.trust.${process.pid}.${Date.now()}.pem`);JJ.writeFileSync(w,L);try{await w5(w,{srtWin:$.srtWin})}finally{JJ.rmSync(w,{force:!0})}}return Z(`[Sandbox Windows] persistent CA ${j?"generated":"reused"} (thumb=${I}${C&&!j?", trust reconciled":""})`),{certPem:L,keyPem:R,certPath:G,keyPath:W,thumbprint:I,generated:j,trusted:C}},V=()=>{let L;try{L=JSON.parse(JJ.readFileSync(Y,"utf8"))}catch(I){Z(`[Sandbox Windows] persistent CA ca.json unreadable (${I.message})`,{level:"warn"});return}if(typeof L.certPem!=="string"||typeof L.keyPem!=="string")return;let R=kX(L.certPem,L.keyPem);if(!R.ok){Z(`[Sandbox Windows] persistent CA invalid (${R.reason})`,{level:"warn"});return}return{certPem:L.certPem,keyPem:L.keyPem,thumbprint:R.thumbprint,notAfter:R.notAfter}};if(!$.force){let L=V();if(L&&L.notAfter.getTime()-Date.now()>U)return await O(L.certPem,L.keyPem,L.thumbprint,!1);if(L)Z(`[Sandbox Windows] persistent CA expiring ${L.notAfter.toISOString()}; regenerating`,{level:"warn"})}JJ.mkdirSync(Q,{recursive:!0});try{let L=Date.now()-300000;for(let R of JJ.readdirSync(Q)){if(!R.includes(".tmp.")&&!R.startsWith(".trust."))continue;let I=$J.join(Q,R);if(JJ.statSync(I).mtimeMs<L)JJ.rmSync(I,{force:!0})}}catch{}let H=rY({cn:"sandbox-runtime persistent CA"});M(Y,JSON.stringify({certPem:H.certPem,keyPem:H.keyPem}));let q=V(),{certPem:F,keyPem:K,thumbprint:A}=q??{certPem:H.certPem,keyPem:H.keyPem,thumbprint:mQ(H.certPem)};return await O(F,K,A,!0)}function t7($){return $.timeoutMs??120000}function x5($){let J=["install"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.proxyPortRange)J.push("--proxy-port-range",`${$.proxyPortRange[0]}-${$.proxyPortRange[1]}`);if($.sandboxUser)J.push("--sandbox-user",$.sandboxUser);if($.force)J.push("--force");return J}function v5($){if($ instanceof A$&&$.code==="srt_win_timeout")throw new A$("install_timeout","srt-win install timed out \u2014 the UAC prompt may still be open. "+`Re-run when ready to grant elevation. (${$.message})`);throw $}function k5($){if(Z(`[Sandbox Windows] install exit=${$.status}: ${$.stderr||$.stdout}`),$.status===0||$.status===10)return;let J=$.stderr||$.stdout;switch($.status){case 12:throw new A$("install_wfp_failed",`srt-win install: WFP filter install failed: ${J}`);case 14:throw new A$("install_user_failed",`srt-win install: sandbox user provisioning failed: ${J}`);case 13:throw new A$("install_config_conflict",`srt-win install: filters already exist under this sublayer with a different port range or sandbox-user name. Pass {force: true} to replace, or pick a different sublayerGuid. Output: ${J}`);case 17:throw new A$("install_ambient_failed",`srt-win install: ambient write-deny stamping failed (stock world-writable system dirs could not be deny-stamped for the sandbox user): ${J}`);default:throw new A$("install_failed",`srt-win install failed (exit ${$.status}): ${J}`)}}function _K($={}){let J=$.srtWin??wJ(),X;try{X=m0(x5($),{timeoutMs:t7($),srtWin:J})}catch(Y){v5(Y)}k5(X);let Q=T5({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}async function xK($={}){let J=$.srtWin??wJ(),X;try{X=await c7(x5($),{timeoutMs:t7($),srtWin:J})}catch(Y){v5(Y)}k5(X);let Q=await S5({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}function vK($={}){let J=["uninstall"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.keepUser)J.push("--keep-user");let X=m0(J,{timeoutMs:t7($),srtWin:$.srtWin});if(Z(`[Sandbox Windows] uninstall exit=${X.status}: ${X.stderr||X.stdout}`),X.status===10)return{cancelled:!0};if(X.status!==0)throw new A$("uninstall_failed",`srt-win uninstall failed (exit ${X.status}): ${X.stderr||X.stdout}`);return{}}function I9($,J){let X=new Set;for(let Q of $){let Y=XJ(Q),G=zX(Y);if(EX(Y)&&!G){X.add(Y);continue}let W=G?$Q(Y,{caseInsensitive:!0}):[Y];for(let U of W){if(!JJ.statSync(U,{throwIfNoEntry:!1})){if(J?.mode==="deny"&&!G)X.add(/[\\/]$/.test(Q)&&!/[\\/]$/.test(U)?U+"\\":U);continue}X.add(U)}}return[...X]}function kK($){for(let J of $.split(/\r?\n/)){let X=J.trim();if(!X.startsWith("{")||!X.includes('"code"'))continue;try{let Q=JSON.parse(X);if(Q.code==="mapped_drive_cwd")return Object.assign(new A$("mapped_drive_cwd",Q.message??"mapped/network-drive working directory","exec"),{drive:Q.drive})}catch{}}return}function e7($){let J=$.holderPid??process.pid,X=JSON.stringify({denyRead:$.denyRead,denyWrite:$.denyWrite}),Q=m0(["acl","stamp","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl stamp exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new A$("acl_stamp_failed",`srt-win acl stamp exited ${Q.status} `+(Q.status===2?"(partial \u2014 some inputs skipped)":"(failed)")+`: ${Q.stderr||Q.stdout}`)}function C9($){let J=$.holderPid??process.pid;try{let X=B5(["acl","restore","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl restore exited non-zero (per-path outcomes preserved): ${X.stderr}`,{level:"error"});return Array.isArray(X.json)?X.json:[...X.json.paths??[],...X.json.parents??[]]}catch(X){Z(`[Sandbox Windows] acl restore: ${X.message}`,{level:"error"});return}}function $G($){let J=$.holderPid??process.pid,X=JSON.stringify({read:$.read,write:$.write}),Q=m0(["acl","grant","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl grant exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new A$("acl_grant_failed",`srt-win acl grant exited ${Q.status}: ${Q.stderr||Q.stdout}`)}function w9($){let J=$.holderPid??process.pid;try{let X=B5(["acl","revoke","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl revoke exited non-zero: ${X.stderr}`,{level:"error"});return X.json}catch(X){Z(`[Sandbox Windows] acl revoke: ${X.message}`,{level:"error"});return}}function f5($){let{exe:J,prependArgs:X}=$.srtWin??wJ(),Q=fK(ZQ($.httpProxyPort,$.socksProxyPort,$.caCertPath?.replace(/\\/g,"/"),$.proxyAuthToken,void 0,PJ($.commandId??$.command)));delete Q.TMPDIR,delete Q.NO_PROXY,delete Q.no_proxy;let Y=FX({safeDirs:[$.cwd??process.cwd(),...$.allowWrite??[],...$.gitSafeDirectories??[]],schannelCa:$.caCertPath!==void 0,baseEnv:$.setEnvVars}),G=[J,...X,"exec"];if($.quiet!==!1)G.push("--quiet");for(let V of $.denyRead??[])G.push("--deny-read",V);for(let V of $.denyWrite??[])G.push("--deny-write",V);let W={PATH:process.env.PATH,PATHEXT:process.env.PATHEXT,...$.setEnvVars??{},...Q,...Y};for(let[V,H]of Object.entries(W))if(H!==void 0)G.push("--env",`${V}=${H}`);G.push("--");let U=$.binShell??j9(void 0);G.push(U.exe,...U.args,$.command);let M=G.reduce((V,H)=>V+H.length+3,0);if(M>30000)throw new A$("argv_too_long",`Windows sandbox argv is ~${M} chars (CreateProcessW limit is 32 767).`);let O={...process.env,...Q};return{argv:G,env:O}}function fK($){let J={};for(let X of $){let Q=X.indexOf("=");if(Q===-1)continue;J[X.slice(0,Q)]=X.slice(Q+1)}return J}function d7($){let J=$?` --sublayer-guid ${$}`:"";return`Windows sandbox needs a one-time install (one UAC prompt):
+`):void 0}function VK($){try{let J=r.lstatSync($);return J.isFile()&&J.size===0}catch{return!1}}var Z0=0,Y5=!1;function L9(){if(Y5)return;process.on("exit",()=>{D9({force:!0})}),Y5=!0}function D9($){if(!$?.force){if(Z0>0)Z0--;if(Z0>0){Z(`[Sandbox Linux] Deferring mount point cleanup \u2014 ${Z0} sandbox(es) still active`);return}}else Z0=0;let J=[],X=[];for(let G of cX)try{let W=r.statSync(G);if(W.isFile()&&W.size===0)J.push(G);else if(W.isDirectory())X.push(G)}catch{}let Q=(G)=>G.split("/").length;X.sort((G,W)=>Q(W)-Q(G));let Y=h7([...J,...X],(G)=>{try{let W=r.statSync(G);if(W.isFile()&&W.size===0)r.unlinkSync(G),Z(`[Sandbox Linux] Cleaned up bwrap mount point (file): ${G}`);else if(W.isDirectory()){if(r.readdirSync(G).length!==0)return;r.rmdirSync(G),Z(`[Sandbox Linux] Cleaned up bwrap mount point (dir): ${G}`)}}catch{}});cX.clear();for(let G of Y)cX.add(G);for(let G of R9)try{r.rmSync(G,{recursive:!0,force:!0})}catch{}R9.clear(),dX=void 0}function G5($){try{return r.accessSync($,r.constants.X_OK),!0}catch{return!1}}function U5($){let{seccompConfig:J,bwrapPath:X,socatPath:Q}=$??{},Y=[],G=[];if(X){if(!G5(X))Y.push(`bubblewrap (bwrap) not executable at ${X}`)}else if(D0("bwrap")===null)Y.push("bubblewrap (bwrap) not installed");if(Q){if(!G5(Q))Y.push(`socat not executable at ${Q}`)}else if(D0("socat")===null)Y.push("socat not installed");if(!J?.argv0&&_7(J?.applyPath)===null)G.push("seccomp not available - unix socket access not restricted");return{warnings:G,errors:Y}}async function M5($,J,X,Q,Y){let G=X??"socat",W=$K(8).toString("hex"),U=J5(A9(),`claude-http-${W}.sock`),M=J5(A9(),`claude-socks-${W}.sock`),O=[`UNIX-LISTEN:${U},fork,reuseaddr`,`TCP:localhost:${$},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];Z(`Starting HTTP bridge: ${G} ${O.join(" ")}`);let V=$5(G,O,{stdio:"ignore"});if(V.on("error",(K)=>{Z(`HTTP bridge process error: ${K}`,{level:"error"})}),V.on("exit",(K,L)=>{Z(`HTTP bridge process exited with code ${K}, signal ${L}`,{level:K===0?"info":"error"})}),!V.pid)throw Error("Failed to start HTTP bridge process");let q,H;if(J===$)q=V,H=U;else{H=M;let K=[`UNIX-LISTEN:${M},fork,reuseaddr`,`TCP:localhost:${J},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];if(Z(`Starting SOCKS bridge: ${G} ${K.join(" ")}`),q=$5(G,K,{stdio:"ignore"}),q.on("error",(L)=>{Z(`SOCKS bridge process error: ${L}`,{level:"error"})}),q.on("exit",(L,A)=>{Z(`SOCKS bridge process exited with code ${L}, signal ${A}`,{level:L===0?"info":"error"})}),!q.pid){if(V.pid)try{process.kill(V.pid,"SIGTERM")}catch{}throw Error("Failed to start SOCKS bridge process")}}let N=200;for(let K=0;K<N;K++){if(!V.pid||V.killed||!q.pid||q.killed)throw Error("Linux bridge process died unexpectedly");try{if(r.existsSync(U)&&r.existsSync(H)){if(Q!==void 0){let L=Y??Q;for(let A of new Set([U,H]))r.chownSync(A,Q,L),r.chmodSync(A,384)}Z(`Linux bridges ready after ${K+1} attempts`);break}}catch(L){Z(`Error checking sockets (attempt ${K+1}): ${L}`,{level:"error"})}if(K===N-1){if(V.pid)try{process.kill(V.pid,"SIGTERM")}catch{}if(q.pid)try{process.kill(q.pid,"SIGTERM")}catch{}throw Error(`Failed to create bridge sockets after ${N} attempts`)}await new Promise((L)=>setTimeout(L,5))}return{httpSocketPath:U,socksSocketPath:H,httpBridgeProcess:V,socksBridgeProcess:q,httpProxyPort:$,socksProxyPort:J}}function qK($,J){if(J){if(!$)throw Error("seccompConfig.argv0 requires seccompConfig.applyPath");return`ARGV0=${CJ([J])} ${CJ([$])} `}let X=_7($);return X?`${CJ([X])} `:void 0}function HK($,J,X,Q,Y,G){let W=Y||"bash",U=CJ([G??"socat"]),M=["srt_payload_pid=",`${U} TCP4-LISTEN:3128,bind=127.0.0.1,fork,reuseaddr ${CJ([`UNIX-CONNECT:${$}`])} >/dev/null 2>&1 &`,"srt_http_proxy_pid=$!",`${U} TCP4-LISTEN:1080,bind=127.0.0.1,fork,reuseaddr ${CJ([`UNIX-CONNECT:${J}`])} >/dev/null 2>&1 &`,"srt_socks_proxy_pid=$!","srt_cleanup_command() {","  srt_status=$?","  trap - EXIT INT TERM",'  if [ -n "$srt_payload_pid" ]; then','    kill -KILL "$srt_payload_pid" 2>/dev/null','    wait "$srt_payload_pid" 2>/dev/null',"  fi",'  kill -KILL "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null','  wait "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null','  exit "$srt_status"',"}","trap srt_cleanup_command EXIT","trap 'exit 143' TERM","trap 'exit 130' INT",...[3128,1080].map((q)=>`${U} -u OPEN:/dev/null TCP4:127.0.0.1:${q},connect-timeout=0.1,retry=480,interval=0.005 >/dev/null 2>&1 || { printf '%s\\n' 'Sandbox proxy listener readiness failed' >&2; exit 1; }`),`kill -0 "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null || { printf '%s\\n' 'Sandbox proxy listener exited before command' >&2; exit 1; }`],O=(Q??"")+CJ([W,"-c",X]),V=[...M,`${O} <&0 &`,"srt_payload_pid=$!",'wait "$srt_payload_pid"',"srt_payload_status=$?","srt_payload_pid=",'exit "$srt_payload_status"'].join(`
+`);return`${W} -c ${CJ([V])}`}function g7($){try{if(r.lstatSync($).isSymbolicLink())return r.realpathSync($)}catch{}return $}function W5($,J,X,Q){let Y=J==="/"?"/":J+"/";$.push("--tmpfs",J);for(let G of X)if(G.startsWith(Y)||G===J)$.push("--bind",G,G),Z(`[Sandbox Linux] Re-bound write path wiped by denyRead tmpfs: ${G}`);for(let G of Q)if(G.startsWith(Y)||G===J){if(!r.existsSync(G)){Z(`[Sandbox Linux] Skipping non-existent read allow path: ${G}`);continue}if(X.some((W)=>(W.startsWith(Y)||W===J)&&(G===W||G.startsWith(W+"/"))))continue;$.push("--ro-bind",G,G),Z(`[Sandbox Linux] Re-allowed read access within denied region: ${G}`)}}async function KK($,J,X,Q,Y={command:"rg"},G=m7,W=!1,U,M,O=[]){let V=[],q=[],H=[],N=new Set,K=new Map,L=new Map;if(J){V.push("--ro-bind","/","/");for(let u of J.allowOnly||[]){let J$=XJ(u).replace(/\/+$/,"")||"/";if(Z(`[Sandbox Linux] Processing write path: ${u} -> ${J$}`),J$.startsWith("/dev/")){Z(`[Sandbox Linux] Skipping /dev path: ${J$}`);continue}if(!r.existsSync(J$)){Z(`[Sandbox Linux] Skipping non-existent write path: ${J$}`);continue}try{let a=r.realpathSync(J$),V$=J$.replace(/\/+$/,"");if(a!==V$&&zY(J$,a)){Z(`[Sandbox Linux] Skipping symlink write path pointing outside expected location: ${u} -> ${a}`);continue}}catch{Z(`[Sandbox Linux] Skipping write path that could not be resolved: ${J$}`);continue}V.push("--bind",J$,J$),q.push(J$)}let y,n=()=>{if(y!==void 0)return y;let u=[];for(let a of q){u.push(a);try{let V$=r.realpathSync(a);if(V$!==a)u.push(V$)}catch{}}let J$=[];if($){let a=[],V$=new Set(["proc","dev","sys"]);for(let O$ of $.denyOnly||[])if(XJ(O$)==="/")try{for(let $$ of r.readdirSync("/"))if(!V$.has($$))a.push("/"+$$)}catch{}else a.push(O$);if(r.existsSync("/etc/ssh/ssh_config.d"))a.push("/etc/ssh/ssh_config.d");for(let O$ of a){let $$=XJ(O$),P$=!1;try{P$=r.statSync($$).isDirectory()}catch{continue}if(!P$)continue;J$.push($$);try{let G$=r.realpathSync($$);if(G$!==$$)J$.push(G$)}catch{}}}return y={allowedWritePathsBothForms:u,prospectiveReadDenyTmpfsDirsBothForms:J$},y},Y$=(u)=>q.some((J$)=>u.startsWith(J$+"/")||u===J$),L$=[...J.denyWithinAllow||[],...await GK(Y,G,W,U)];d4();let j$=new Set;for(let u of L$){let J$=XJ(u);if(J$.startsWith("/dev/"))continue;let a=Q5(J$);if(a===null||a.startsWith("/dev/"))continue;if(u7(a,q))continue;let V$=!1;try{V$=r.statSync(a).isDirectory()}catch{continue}if(!V$)continue;if(Y$(a)){let O$=K.get(a);if(O$===void 0)O$=new Set,K.set(a,O$);O$.add(J$)}}let QJ=new Map,S$=(u)=>{let J$=QJ.get(u);if(J$!==void 0)return J$;let{allowedWritePathsBothForms:a,prospectiveReadDenyTmpfsDirsBothForms:V$}=n(),O$=a.some(($$)=>$$.startsWith(u+"/"))||V$.some(($$)=>$$===u||$$.startsWith(u+"/"))||V$.some(($$)=>[u,...K.get(u)??[]].some((P$)=>P$===$$||P$.startsWith($$+"/")));return QJ.set(u,O$),O$},h$=[...K.keys()];for(let u of L$){let J$=XJ(u);if(J$.startsWith("/dev/"))continue;let a=Q5(J$);if(a===null){let $$=u7(J$,q);if($$&&!j$.has($$))j$.add($$),H.push("--ro-bind","/dev/null",$$),L.set($$,J$);Z(`[Sandbox Linux] Deny path could not be resolved through symlinks, failing closed: ${J$}`);continue}if(a!==J$)Z(`[Sandbox Linux] Resolved symlinked deny path: ${J$} -> ${a}`);if(a.startsWith("/dev/"))continue;if(j$.has(a))continue;j$.add(a);let V$=u7(a,q);if(V$){if(!j$.has(V$))j$.add(V$),H.push("--ro-bind","/dev/null",V$),L.set(V$,J$);Z(`[Sandbox Linux] Mounted /dev/null at symlink ${V$} to prevent symlink replacement attack`);continue}if(!r.existsSync(a)){if(XK(a)){Z(`[Sandbox Linux] Skipping deny path with file ancestor (cannot create paths under a file): ${a}`);continue}let $$=f$.dirname(a);while($$!=="/"&&!r.existsSync($$))$$=f$.dirname($$);let P$=Y$($$)||Y$(a),G$=h$.filter((x$)=>$$===x$||$$.startsWith(x$+"/")),c$=G$.length>0&&!G$.some(S$);if(P$&&!c$){let x$=YK(a),E$=r4(x$,q)??x$;if(E$!==a){if(!N.has(E$)){let n$=e4(E$,M),y$=r.mkdtempSync(f$.join(A9(),"claude-empty-"));if(r.chmodSync(y$,365),R9.add(y$),H.push("--ro-bind",y$,E$),L.set(E$,J$),N.add(E$),n$.kind==="unregistered")cX.add(E$);L9(),Z(`[Sandbox Linux] Mounted empty dir at ${E$} to block creation of ${a}`)}}else{let n$=b7(E$),y$=X5(a,J$);if(n$.kind==="masked")H.push("--ro-bind",y$,E$),L.set(E$,J$),L9(),Z(`[Sandbox Linux] Masked shared stub at ${E$} with ${y$} to block creation of ${a}`);else if(n$.kind==="real")H.push("--ro-bind",E$,E$),L.set(E$,J$);else H.push("--ro-bind",y$,E$),L.set(E$,J$),cX.add(E$),L9(),Z(`[Sandbox Linux] Mounted ${y$} at ${E$} to block creation of ${a}`)}}else if(c$)Z(`[Sandbox Linux] Skipping non-existent deny path inside a read-only denied directory (already uncreatable): ${a}`);else Z(`[Sandbox Linux] Skipping non-existent deny path not within allowed paths: ${a}`);continue}if(Y$(a)){if((VK(a)?b7(a):void 0)?.kind==="masked")H.push("--ro-bind",X5(a,J$),a),L9();else H.push("--ro-bind",a,a);L.set(a,J$)}else Z(`[Sandbox Linux] Skipping deny path not within allowed paths: ${a}`)}}else V.push("--bind","/","/");let A=[],D=($?.allowWithinDeny||[]).map((y)=>XJ(y)),S=new Map,B=[],C=new Set(["proc","dev","sys"]);for(let y of $?.denyOnly||[])if(XJ(y)==="/"){for(let n of r.readdirSync("/"))if(!C.has(n))A.push("/"+n)}else A.push(y);if($&&r.existsSync("/etc/ssh/ssh_config.d"))A.push("/etc/ssh/ssh_config.d");let w=A.map((y)=>XJ(y)).sort((y,n)=>y.split("/").length-n.split("/").length);for(let y of w){if(!r.existsSync(y)){Z(`[Sandbox Linux] Skipping non-existent read deny path: ${y}`);continue}if(r.statSync(y).isDirectory())B.push(y),W5(V,y,q,D);else{if(D.includes(y)){Z(`[Sandbox Linux] Skipping read deny for re-allowed path: ${y}`);continue}let Y$=g7(y);V.push("--ro-bind","/dev/null",Y$),S.set(Y$,"/dev/null"),S.set(y,"/dev/null")}}for(let{realPath:y,fakePath:n}of X??[]){let Y$=g7(y);V.push("--ro-bind",n,Y$),S.set(Y$,n),S.set(y,n)}let P=(y)=>B.some((n)=>{if(!(y===n||y.startsWith(n+"/")))return!1;return!q.some((j$)=>(j$===n||j$.startsWith(n+"/"))&&(y===j$||y.startsWith(j$+"/")))}),l=[...N].filter((y)=>{let n=L.get(y)??y;return!S.has(y)&&!P(y)&&!P(n)&&!q.some((Y$)=>Y$===y||Y$.startsWith(y+"/"))}),e=[];for(let y=0;y<H.length;y+=3){let n=H[y+2],Y$=L.get(n)??n;if(S.has(n))continue;if(P(n)||P(Y$)){Z(`[Sandbox Linux] Skipping denyWrite bind already hidden by denyRead tmpfs: ${n}`);continue}if(l.some((L$)=>n.startsWith(L$+"/"))){Z(`[Sandbox Linux] Skipping denyWrite bind under an empty-directory mask: ${n}`);continue}if(V.push(H[y],H[y+1],n),e.push(n),H[y+1]!==n)O.push(n);if(Y$!==n)e.push(Y$)}for(let y of B)if(e.some((n)=>y.startsWith(n+"/")))Z(`[Sandbox Linux] Re-applying denyRead tmpfs re-exposed by denyWrite bind: ${y}`),W5(V,y,q,D);for(let[y,n]of S)if(e.some((Y$)=>y.startsWith(Y$+"/"))){if(g7(y)!==y)continue;Z(`[Sandbox Linux] Re-applying file mask re-exposed by denyWrite bind: ${y}`),V.push("--ro-bind",n,y)}if(Q!==void 0)V.push("--ro-bind",Q,Q);return V}async function O5($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpSocketPath:Y,socksSocketPath:G,httpProxyPort:W,socksProxyPort:U,proxyAuthToken:M,caCertPath:O,readConfig:V,writeConfig:q,unsetEnvVars:H,setEnvVars:N,maskedFileBinds:K,maskedFileStoreDir:L,enableWeakerNestedSandbox:A,runAsUid:D,runAsGid:S,runAsHostUid:B,runAsHostGid:C,runAsHostHome:w,runAsHostUser:P,setprivPath:l,allowAllUnixSockets:e,binShell:y,ripgrepConfig:n={command:"rg"},mandatoryDenySearchDepth:Y$=m7,allowGitConfig:L$=!1,gitSafeDirectories:j$,seccompConfig:QJ,bwrapPath:S$,socatPath:h$,observeSocketPath:u,abortSignal:J$}=$,a=V&&V.denyOnly.length>0||K!==void 0&&K.length>0,V$=q!==void 0,O$=H!==void 0&&H.length>0||N!==void 0&&Object.keys(N).length>0,$$=(j$?.length??0)>0;if(!Q&&!a&&!V$&&!O$&&!$$)return J;Z0++;let P$=[],G$=["--new-session","--die-with-parent"],c$=[],x$;try{if(!e)if(x$=qK(QJ?.applyPath,QJ?.argv0),!x$)throw Error("seccomp_unavailable: the policy requires the unix-socket filter (allowAllUnixSockets is false) but apply-seccomp is not installed beside srt (vendor/seccomp/<arch>/apply-seccomp; build it with `bun run build:seccomp` in packages/sandbox-runtime)");else Z("[Sandbox Linux] Applying seccomp filter for Unix socket blocking");else Z("[Sandbox Linux] Skipping seccomp filter - allowAllUnixSockets is enabled");if(u&&x$)if(r.existsSync(u))c$.push("--bind",u,u),G$.push("--setenv","SRT_OBSERVE_SOCK",u),G$.push("--setenv","SRT_ENCODED_CMD",PJ(X??J));else Z("[Sandbox Linux] observe socket missing \u2014 supervisor not running; "+"continuing without violation monitoring");if(O$){for(let b$ of H??[])G$.push("--unsetenv",b$);for(let[b$,i$]of Object.entries(N??{}))G$.push("--setenv",b$,i$)}if(j$&&j$.length>0){let b$=FY({safeDirs:j$,unsetEnvVars:H,setEnvVars:N});for(let[i$,qY]of Object.entries(b$))G$.push("--setenv",i$,qY)}if(Q){if(G$.push("--unshare-net"),Y&&G){if(!r.existsSync(Y))throw Error(`Linux HTTP bridge socket does not exist: ${Y}. The bridge process may have died. Try reinitializing the sandbox.`);if(!r.existsSync(G))throw Error(`Linux SOCKS bridge socket does not exist: ${G}. The bridge process may have died. Try reinitializing the sandbox.`);if(c$.push("--bind",Y,Y),G!==Y)c$.push("--bind",G,G);let b$=ZQ(3128,1080,O,M,q===void 0,PJ(X??J));if(G$.push(...b$.flatMap((i$)=>{let qY=i$.indexOf("="),bU=i$.slice(0,qY),hU=i$.slice(qY+1);return["--setenv",bU,hU]})),W!==void 0)G$.push("--setenv","CLAUDE_CODE_HOST_HTTP_PROXY_PORT",String(W));if(U!==void 0)G$.push("--setenv","CLAUDE_CODE_HOST_SOCKS_PROXY_PORT",String(U))}}let E$=await KK(V,q,K,L,n,Y$,L$,J$,B===void 0?void 0:{uid:B,gid:C??B},P$);N9(),G$.push(...E$);let n$=OK(P$,process.cwd());if(n$!==void 0)G$.push("--setenv",UK,n$);if(G$.push(...c$),G$.push("--dev","/dev"),G$.push("--unshare-pid"),!A){if(G$.push("--unshare-user","--cap-drop","ALL","--proc","/proc"),!x$)G$.push("--ro-bind","/dev/null","/proc/sysrq-trigger")}else G$.push("--unshare-user","--bind","/proc","/proc");if(D!==void 0)G$.push("--uid",String(D)),G$.push("--gid",String(S??D));if(B!==void 0){if(w)G$.push("--setenv","HOME",w);if(P)G$.push("--setenv","USER",P),G$.push("--setenv","LOGNAME",P)}let y$=y||"bash",e$=D0(y$);if(!e$)throw Error(`Shell '${y$}' not found in PATH`);if(G$.push("--",e$,"-c"),Q&&Y&&G){let b$=HK(Y,G,J,x$,e$,h$);G$.push(b$)}else if(x$){let b$=x$+CJ([e$,"-c",J]);G$.push(b$)}else G$.push(J);let GJ=[S$??"bwrap",...G$],WJ=CJ(JK({bwrapCommand:GJ,uid:B,gid:C,setprivPath:l,unsetEnvVars:H,setEnvVars:N})),s$=[];if(Q)s$.push("network");if(a||V$)s$.push("filesystem");if(O$)s$.push("env");if(x$)s$.push("seccomp(unix-block)");return Z(`[Sandbox Linux] Wrapped command with bwrap (${s$.join(", ")} restrictions)`),WJ}catch(E$){if(Z0>0)Z0--;if(N9(),Z0===0)h7([],()=>{});throw E$}}import{spawn as zK}from"child_process";import*as B0 from"path";class Z9{violations=[];totalCount=0;maxSize=100;listeners=new Set;addViolation($){if(this.violations.push({...$,line:l7($.line).replace(/[<>]/g,"")}),this.totalCount++,this.violations.length>this.maxSize)this.violations=this.violations.slice(-this.maxSize);this.notifyListeners()}getViolations($){if($===void 0)return[...this.violations];return this.violations.slice(-$)}getCount(){return this.violations.length}getTotalCount(){return this.totalCount}getViolationsForCommand($){let J=PJ($);return this.violations.filter((X)=>X.encodedCommand===J)}clear(){this.violations=[],this.notifyListeners()}subscribe($){return this.listeners.add($),$(this.getViolations()),()=>{this.listeners.delete($)}}notifyListeners(){let $=this.getViolations();this.listeners.forEach((J)=>J($))}}function nQ($,J,X){if(!X)return!1;if((X["*"]??[]).some((Y)=>$.includes(Y)))return!0;if(J===void 0)return!1;for(let[Y,G]of Object.entries(X))if(Y!=="*"&&J.includes(Y)&&G.some((W)=>$.includes(W)))return!0;return!1}function l7($){return $.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").trim()}function EK($=!1){let J=process.cwd(),X=[];for(let Q of zX)X.push(B0.resolve(J,Q)),X.push(`**/${Q}`);for(let Q of EY())X.push(B0.resolve(J,Q)),X.push(`**/${Q}/**`);if(X.push(B0.resolve(J,".git/hooks")),X.push("**/.git/hooks/**"),!$)X.push(B0.resolve(J,".git/config")),X.push("**/.git/config");return[...new Set(X)]}var V5=`_${Math.random().toString(36).slice(2,11)}_SBX`;function FK($){return`CMD64_${PJ($)}_END_${V5}`}function iQ($){return NJ($)?`(regex ${iJ(LX($))})`:`(subpath ${iJ($)})`}function n7($){return LX($).slice(0,-1)+"(/.*)?$"}function KQ($){return NJ($)?`(regex ${iJ(n7($))})`:`(subpath ${iJ($)})`}function q5($){return $.replace(/\[[^\]]*\]|[*?]+/g,"x")}function d7($,J){let X=[...new Set(J)];if(X.length===0)return $;let Q=X.map((Y)=>`(require-not ${Y})`).join(" ");return`(require-all ${$} ${Q})`}function p7($){let J=XJ($);return{path:J,glob:NJ(J)}}function H5($,J){return $.test(J.glob?q5(J.path):J.path)}function B9($,J){let X=$.glob?q5($.path):$.path;return X.startsWith(J==="/"?"/":J+"/")&&X!==J}function NK($,J){return{denies:($.denyOnly||[]).map(p7),allows:($.allowWithinDeny||[]).map(p7),writeRoots:(J||[]).map(p7)}}function LK($){let J=[],X=!1,Q=$.allows.filter((Y)=>!Y.glob).map((Y)=>Y.path);for(let Y of $.denies){if(!Y.glob){if(Q.some((U)=>Y.path.startsWith(U+"/")))J.push(KQ(Y.path));continue}let G=new RegExp(n7(Y.path));if(G.test("/"))X=!0;let W=$.allows.filter((U)=>H5(G,U)).map((U)=>iQ(U.path));J.push(d7(KQ(Y.path),W))}return{filters:J,coversRoot:X}}function K5($){let J=$.split(/[*?[\]]/)[0];if(!J||J==="/")return"/";return J.endsWith("/")?J.slice(0,-1):B0.dirname(J)}function AK($,J){let{denies:X,allows:Q,writeRoots:Y}=$;if(Y.length===0)return[];let G=Y.filter((q)=>q.glob).map((q)=>new RegExp(LX(q.path))),W=Y.filter((q)=>!q.glob).map((q)=>q.path),U=(q)=>W.some((H)=>B9({path:q,glob:!1},H))||G.some((H)=>H.test(q)),M=(q)=>[...Q,...Y].filter((H)=>B9(H,q)).map((H)=>iQ(H.path)),O=new Set,V=(q)=>{for(let H of q)if(U(H))O.add(`(literal ${iJ(H)})`)};for(let q of X)if(q.glob){let H=K5(q.path);if(!(G.length>0||W.some((A)=>H===A||B9({path:H,glob:!1},A)||B9({path:A,glob:!1},H))))continue;let K=new RegExp(n7(q.path)),L=[...Q,...Y].filter((A)=>H5(K,A)).map((A)=>iQ(A.path));if(O.add(d7(KQ(q.path),L)),H!=="/")V([H,...c7(H)])}else{if(!U(q.path))continue;O.add(d7(KQ(q.path),M(q.path))),V(c7(q.path))}return g0("deny",["file-write-unlink"],O,J)}function g0($,J,X,Q){if(X.size===0)return[];return[`(${$} ${J.join(" ")}`,...[...X].map((Y)=>`  ${Y}`),`  (with message "${Q}"))`]}function c7($){let J=[],X=B0.dirname($);while(X!=="/"&&X!=="."){J.push(X);let Q=B0.dirname(X);if(Q===X)break;X=Q}return J}function z5($,J){let X=new Set;for(let Q of $){let Y=XJ(Q);X.add(KQ(Y));let G;if(NJ(Y)){if(G=K5(Y),G==="/")continue;X.add(`(literal ${iJ(G)})`)}else G=Y;for(let W of c7(G))X.add(`(literal ${iJ(W)})`)}return g0("deny",["file-write-unlink","file-write-create"],X,J)}function RK($,J){if(!$)return["(allow file-read*)"];let X=[];X.push("(allow file-read*)");let Q=$.denies.some((M)=>M.path==="/"),Y=new Set($.denies.map((M)=>KQ(M.path)));X.push(...g0("deny",["file-read*"],Y,J));let G=new Set($.allows.map((M)=>iQ(M.path)));X.push(...g0("allow",["file-read*"],G,J));let W=LK($);if(X.push(...g0("deny",["file-read*"],new Set(W.filters),J)),Q||W.coversRoot)X.push('(allow file-read* (literal "/"))');if($.denies.length>0)X.push("(allow file-read-metadata","  (vnode-type DIRECTORY))");X.push(...z5($.denies.map((M)=>M.path),J));let U=new Set($.writeRoots.map((M)=>iQ(M.path)));return X.push(...g0("allow",["file-write-unlink","file-write-create"],U,J)),X}function DK($,J,X=!1){if(!$)return["(allow file-write*)"];let Q=[],Y=new Set;for(let U of $.allowOnly||[])Y.add(iQ(XJ(U)));Q.push(...g0("allow",["file-write*"],Y,J));let G=[...$.denyWithinAllow||[],...EK(X)],W=new Set;for(let U of G)W.add(KQ(XJ(U)));return Q.push(...g0("deny",["file-write*"],W,J)),Q.push(...z5(G,J)),Q}function ZK({readConfig:$,writeConfig:J,httpProxyPort:X,socksProxyPort:Q,needsNetworkRestriction:Y,allowUnixSockets:G,allowAllUnixSockets:W,allowLocalBinding:U,allowMachLookup:M,allowPty:O,allowGitConfig:V=!1,enableWeakerNetworkIsolation:q=!1,allowAppleEvents:H=!1,logTag:N}){let K=["(version 1)",`(deny default (with message "${N}"))`,"",`; LogTag: ${N}`,"","; Essential permissions - based on Chrome sandbox policy","; Process permissions","(allow process-exec)","(allow process-fork)","(allow process-info* (target same-sandbox))","(allow signal (target same-sandbox))","(allow mach-priv-task-port (target same-sandbox))","","; User preferences","(allow user-preference-read)","","; Mach IPC - specific services only (no wildcard)","(allow mach-lookup",'  (global-name "com.apple.audio.systemsoundserver")','  (global-name "com.apple.distributed_notifications@Uv3")','  (global-name "com.apple.FontObjectsServer")','  (global-name "com.apple.fonts")','  (global-name "com.apple.logd")','  (global-name "com.apple.lsd.mapdb")','  (global-name "com.apple.PowerManagement.control")','  (global-name "com.apple.system.logger")','  (global-name "com.apple.system.notification_center")','  (global-name "com.apple.system.opendirectoryd.libinfo")','  (global-name "com.apple.system.opendirectoryd.membership")','  (global-name "com.apple.bsd.dirhelper")','  (global-name "com.apple.securityd.xpc")','  (global-name "com.apple.coreservices.launchservicesd")',")","",...q?["; trustd.agent - needed for Go TLS certificate verification (weaker network isolation)",'(allow mach-lookup (global-name "com.apple.trustd.agent"))']:[],...H?["; Apple Events - opt-in; needed for open/osascript to talk to other apps (appleeventsd)","(allow appleevent-send)",'(allow mach-lookup (global-name "com.apple.coreservices.appleevents"))',"; Launch Services open requests need the lsopen operation plus, on","; macOS 14/15, coreservicesd and the quarantine resolver - without","; these open fails with -10822 kLSServerCommunicationErr or -54","(allow lsopen)",'(allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))','(allow mach-lookup (global-name "com.apple.coreservices.quarantine-resolver"))']:[],...M&&M.length>0?["; User-specified XPC/Mach services",...M.map((A)=>A.endsWith("*")?`(allow mach-lookup (global-name-prefix ${iJ(A.slice(0,-1))}))`:`(allow mach-lookup (global-name ${iJ(A)}))`)]:[],"","; POSIX IPC - shared memory","(allow ipc-posix-shm)","","; POSIX IPC - semaphores for Python multiprocessing","(allow ipc-posix-sem)","","; IOKit - specific operations only","(allow iokit-open",'  (iokit-registry-entry-class "IOSurfaceRootUserClient")','  (iokit-registry-entry-class "RootDomainUserClient")','  (iokit-user-client-class "IOSurfaceSendRight")',")","","; IOKit properties","(allow iokit-get-properties)","","; Specific safe system-sockets, doesn't allow network access","(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))","","; sysctl - specific sysctls only","(allow sysctl-read",'  (sysctl-name "hw.activecpu")','  (sysctl-name "hw.busfrequency_compat")','  (sysctl-name "hw.byteorder")','  (sysctl-name "hw.cacheconfig")','  (sysctl-name "hw.cachelinesize_compat")','  (sysctl-name "hw.cpufamily")','  (sysctl-name "hw.cpufrequency")','  (sysctl-name "hw.cpufrequency_compat")','  (sysctl-name "hw.cputype")','  (sysctl-name "hw.l1dcachesize_compat")','  (sysctl-name "hw.l1icachesize_compat")','  (sysctl-name "hw.l2cachesize_compat")','  (sysctl-name "hw.l3cachesize_compat")','  (sysctl-name "hw.logicalcpu")','  (sysctl-name "hw.logicalcpu_max")','  (sysctl-name "hw.machine")','  (sysctl-name "hw.memsize")','  (sysctl-name "hw.ncpu")','  (sysctl-name "hw.nperflevels")','  (sysctl-name "hw.packages")','  (sysctl-name "hw.pagesize_compat")','  (sysctl-name "hw.pagesize")','  (sysctl-name "hw.physicalcpu")','  (sysctl-name "hw.physicalcpu_max")','  (sysctl-name "hw.tbfrequency_compat")','  (sysctl-name "hw.vectorunit")','  (sysctl-name "kern.argmax")','  (sysctl-name "kern.bootargs")','  (sysctl-name "kern.hostname")','  (sysctl-name "kern.maxfiles")','  (sysctl-name "kern.maxfilesperproc")','  (sysctl-name "kern.maxproc")','  (sysctl-name "kern.ngroups")','  (sysctl-name "kern.osproductversion")','  (sysctl-name "kern.osrelease")','  (sysctl-name "kern.ostype")','  (sysctl-name "kern.osvariant_status")','  (sysctl-name "kern.osversion")','  (sysctl-name "kern.secure_kernel")','  (sysctl-name "kern.tcsm_available")','  (sysctl-name "kern.tcsm_enable")','  (sysctl-name "kern.usrstack64")','  (sysctl-name "kern.version")','  (sysctl-name "kern.willshutdown")','  (sysctl-name "machdep.cpu.brand_string")','  (sysctl-name "machdep.ptrauth_enabled")','  (sysctl-name "security.mac.lockdown_mode_state")','  (sysctl-name "sysctl.proc_cputype")','  (sysctl-name "vm.loadavg")','  (sysctl-name-prefix "hw.optional.arm")','  (sysctl-name-prefix "hw.optional.arm.")','  (sysctl-name-prefix "hw.optional.armv8_")','  (sysctl-name-prefix "hw.perflevel")','  (sysctl-name-prefix "kern.proc.all")','  (sysctl-name-prefix "kern.proc.pgrp.")','  (sysctl-name-prefix "kern.proc.pid.")','  (sysctl-name-prefix "machdep.cpu.")','  (sysctl-name-prefix "net.routetable.")',")","","; V8 thread calculations","(allow sysctl-write",'  (sysctl-name "kern.tcsm_enable")',")","","; Distributed notifications","(allow distributed-notification-post)","","; Specific mach-lookup permissions for security operations",'(allow mach-lookup (global-name "com.apple.SecurityServer"))',"","; File I/O on device files",'(allow file-ioctl (literal "/dev/null"))','(allow file-ioctl (literal "/dev/zero"))','(allow file-ioctl (literal "/dev/random"))','(allow file-ioctl (literal "/dev/urandom"))','(allow file-ioctl (literal "/dev/dtracehelper"))','(allow file-ioctl (literal "/dev/tty"))',"","(allow file-ioctl file-read-data file-write-data","  (require-all",'    (literal "/dev/null")',"    (vnode-type CHARACTER-DEVICE)","  )",")",""];if(K.push("; Network"),!Y)K.push("(allow network*)");else{if(U)K.push('(allow network-bind (local ip "*:*"))'),K.push('(allow network-inbound (local ip "*:*"))'),K.push('(allow network-outbound (remote ip "localhost:*"))');if(W)K.push("(allow system-socket (socket-domain AF_UNIX))"),K.push('(allow network-bind (local unix-socket (path-regex #"^/")))'),K.push('(allow network-outbound (remote unix-socket (path-regex #"^/")))');else if(G&&G.length>0){K.push("(allow system-socket (socket-domain AF_UNIX))");for(let A of G){let D=XJ(A);K.push(`(allow network-bind (local unix-socket (subpath ${iJ(D)})))`),K.push(`(allow network-outbound (remote unix-socket (subpath ${iJ(D)})))`)}}if(X!==void 0)K.push(`(allow network-bind (local ip "localhost:${X}"))`),K.push(`(allow network-inbound (local ip "localhost:${X}"))`),K.push(`(allow network-outbound (remote ip "localhost:${X}"))`);if(Q!==void 0&&Q!==X)K.push(`(allow network-bind (local ip "localhost:${Q}"))`),K.push(`(allow network-inbound (local ip "localhost:${Q}"))`),K.push(`(allow network-outbound (remote ip "localhost:${Q}"))`)}K.push("");let L=$?NK($,J?.allowOnly):void 0;if(K.push("; File read"),K.push(...RK(L,N)),K.push(""),K.push("; File write"),K.push(...DK(J,N,V)),L){let A=AK(L,N);if(A.length>0)K.push(""),K.push("; File read: keep read-denied paths inside write roots in place"),K.push(...A)}if(O)K.push(""),K.push("; Pseudo-terminal (pty) support"),K.push("(allow pseudo-tty)"),K.push("(allow file-ioctl"),K.push('  (literal "/dev/ptmx")'),K.push('  (regex #"^/dev/ttys")'),K.push(")"),K.push("(allow file-read* file-write*"),K.push('  (literal "/dev/ptmx")'),K.push('  (regex #"^/dev/ttys")'),K.push(")");return K.join(`
+`)}function iJ($){return JSON.stringify($)}function E5($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpProxyPort:Y,socksProxyPort:G,proxyAuthToken:W,caCertPath:U,allowUnixSockets:M,allowAllUnixSockets:O,allowLocalBinding:V,allowMachLookup:q,readConfig:H,writeConfig:N,unsetEnvVars:K,setEnvVars:L,maskedFileBinds:A,allowPty:D,allowGitConfig:S=!1,gitSafeDirectories:B,enableWeakerNetworkIsolation:C=!1,allowAppleEvents:w=!1,binShell:P}=$,l=H;if(A&&A.length>0)Z("[Sandbox macOS] file mask degrades to deny on macOS until the interposer lands"),l={denyOnly:[...H?.denyOnly??[],...A.map((O$)=>O$.realPath)],allowWithinDeny:H?.allowWithinDeny};let e=l&&l.denyOnly.length>0,y=N!==void 0,n=K!==void 0&&K.length>0||L!==void 0&&Object.keys(L).length>0,Y$=(B?.length??0)>0;if(!Q&&!e&&!y&&!n&&!Y$)return J;let L$=X??J,j$=FK(L$),QJ=ZK({readConfig:l,writeConfig:N,httpProxyPort:Y,socksProxyPort:G,needsNetworkRestriction:Q,allowUnixSockets:M,allowAllUnixSockets:O,allowLocalBinding:V,allowMachLookup:q,allowPty:D,allowGitConfig:S,enableWeakerNetworkIsolation:C,allowAppleEvents:w,logTag:j$}),S$=ZQ(Y,G,U,W,N===void 0,PJ(L$));if(V&&Q){let P$=(K??[]).includes("JAVA_TOOL_OPTIONS")?"":process.env.JAVA_TOOL_OPTIONS??"",G$=P$.includes("-Djava.net.preferIPv4Stack=true")?P$:[P$,"-Djava.net.preferIPv4Stack=true"].filter(Boolean).join(" ");S$.push(`JAVA_TOOL_OPTIONS=${G$}`)}if(B&&B.length>0){let O$=FY({safeDirs:B,unsetEnvVars:K,setEnvVars:L});for(let[$$,P$]of Object.entries(O$))S$.push(`${$$}=${P$}`)}let h$=P||"bash",u=D0(h$);if(!u)throw Error(`Shell '${h$}' not found in PATH`);let J$=(K??[]).flatMap((O$)=>["-u",O$]),a=Object.entries(L??{}).map(([O$,$$])=>`${O$}=${$$}`),V$=CJ(["env",...J$,...a,...S$,"/usr/bin/sandbox-exec","-p",QJ,u,"-c",J]);return Z(`[Sandbox macOS] Applied restrictions - network: ${!!(Y||G)}, read: ${l?"allowAllExcept"in l?"allowAllExcept":"denyAllExcept":"none"}, write: ${N?"allowAllExcept"in N?"allowAllExcept":"denyAllExcept":"none"}`),V$}function F5($,J,X=(Q)=>Q){let Q=/CMD64_(.+?)_END/,Y=/Sandbox:\s+(.+)$/,G=zK("log",["stream","--predicate",`(eventMessage ENDSWITH "${V5}")`,"--style","compact"]);return G.stdout?.on("data",(W)=>{let U=W.toString().split(`
+`),M=U.find((K)=>K.includes("Sandbox:")&&K.includes("deny")),O=U.find((K)=>K.startsWith("CMD64_"));if(!M)return;let V=M.match(Y);if(!V?.[1])return;let q=V[1],H,N;if(O){if(N=O.match(Q)?.[1],N)try{H=X(e0(N))}catch{}}if(q.includes("mDNSResponder")||q.includes("mach-lookup com.apple.diagnosticd")||q.includes("mach-lookup com.apple.analyticsd"))return;if(nQ(q,H,J))return;$({line:q,command:H,encodedCommand:N,timestamp:new Date})}),G.stderr?.on("data",(W)=>{Z(`[Sandbox Monitor] Log stream stderr: ${W.toString()}`)}),G.on("error",(W)=>{Z(`[Sandbox Monitor] Failed to start log stream: ${W.message}`)}),G.on("exit",(W)=>{Z(`[Sandbox Monitor] Log stream exited with code: ${W}`)}),()=>{Z("[Sandbox Monitor] Stopping log monitor"),G.kill("SIGTERM")}}import{randomBytes as BK}from"crypto";import{chmodSync as N5,chownSync as jK,mkdtempSync as TK,rmSync as SK}from"fs";import{createServer as IK}from"net";import{tmpdir as CK}from"os";import{join as L5,posix as wK}from"path";import{createInterface as PK}from"readline";function A5($,J){let{allowWritePaths:X,denyWritePaths:Q,ignoreViolations:Y,resolveCommandText:G=(B)=>B,consumerUid:W,consumerGid:U}=J,M=TK(L5(CK(),"srt-obs-")),O=L5(M,`s${BK(4).toString("hex")}.sock`),V=(B,C)=>B===C||B.startsWith(C.endsWith("/")?C:C+"/"),q=(B)=>{let C=wK.normalize(B);if(Q.some((w)=>V(C,w)))return!0;return!X.some((w)=>V(C,w))},H=(B,C)=>{if(B.observe_init_error){Z(`[Sandbox Linux Monitor] observe filter not installed: ${B.observe_init_error}`);return}if(typeof B.path!=="string")return;if(!B.path.startsWith("/"))return;if(!q(B.path))return;let w;if(C)try{w=G(e0(C))}catch{}if(nQ(B.path,w,Y))return;let P={line:`deny ${B.syscall??"syscall"} ${B.path}`,command:w,encodedCommand:C,timestamp:new Date};$(P)},N,K=new Promise((B)=>{N=B}),L=O,A=IK((B)=>{let C,w=PK({input:B});w.on("line",(P)=>{if(!P)return;let l;try{l=JSON.parse(P)}catch{return}if(l.encodedCommand&&C===void 0)C=l.encodedCommand;H(l,C??l.encodedCommand)}),B.on("error",()=>w.close()),B.on("close",()=>w.close())});A.on("error",(B)=>{Z(`[Sandbox Linux Monitor] listen failed: ${B.message} - violation monitoring disabled`,{level:"warn"}),L=void 0,N()}),A.listen(O,()=>{if(W!==void 0)N5(M,457),jK(O,W,U??W),N5(O,384);N()});let D=new Set;return A.on("connection",(B)=>{D.add(B),B.on("close",()=>D.delete(B))}),{get observeSocketPath(){return L},ready:K,stop:()=>{Z("[Sandbox Linux Monitor] stopping");for(let B of D)B.destroy();A.close();try{SK(M,{recursive:!0,force:!0})}catch{}}}}import*as JJ from"fs";import*as Z5 from"net";import*as $J from"path";import{spawn as _K,spawnSync as xK}from"child_process";import{once as vK}from"events";import{fileURLToPath as kK}from"url";class A$ extends Error{code;subcommand;constructor($,J,X){super(J);this.name="WindowsSandboxError",this.code=$,this.subcommand=X}}var j9=[60080,60089],R5=["-NoProfile","-Command"];function T9($){let J=process.env.SystemRoot??"C:\\Windows",X={exe:$J.win32.join(J,"System32","cmd.exe"),args:["/d","/s","/c"]};if($===void 0||$===null)return X;if(typeof $==="object"){if(!$J.win32.isAbsolute($.exe))throw new A$("bin_shell_invalid",`binShell.exe must be an absolute path (got ${JSON.stringify($.exe)})`);if(!Array.isArray($.args))throw new A$("bin_shell_invalid",`binShell.args must be an array (got ${JSON.stringify($.args)})`);return $}let Q=$J.win32.basename($),Y=Q.toLowerCase(),G=$J.win32.isAbsolute($);if(!G&&$!==Q)throw new A$("bin_shell_invalid",`binShell string must be a bare token or an absolute path (got ${JSON.stringify($)})`);switch(Y){case"bash":case"bash.exe":case"sh":case"sh.exe":if(!G)throw new A$("bin_shell_invalid",`binShell bash path must be absolute (got ${JSON.stringify($)}); pass the resolved Git Bash install path`);return{exe:$,args:["-c"]};case"pwsh":case"pwsh.exe":return{exe:G?$:"pwsh.exe",args:R5};case"powershell":case"powershell.exe":return{exe:G?$:$J.win32.join(J,"System32","WindowsPowerShell","v1.0","powershell.exe"),args:R5};case"cmd":case"cmd.exe":return G?{exe:$,args:X.args}:X;default:throw new A$("bin_shell_invalid",`unrecognised binShell ${JSON.stringify($)}: expected 'cmd' | 'powershell' | 'pwsh' or an absolute path to bash.exe/sh.exe/pwsh.exe/powershell.exe`)}}function B5(){let $=$J.dirname(kK(import.meta.url));return $J.resolve($,"..","..")}var j5={x64:"x64",arm64:"arm64"},fK=$J.join(B5(),"vendor","srt-win",j5[process.arch]??process.arch,"srt-win.exe");function yK(){let $=B5(),J=j5[process.arch],X=[];if(J)X.push($J.join($,"vendor","srt-win",J,"srt-win.exe"));X.push($J.join($,"vendor","srt-win-src","target","release","srt-win.exe"));for(let Q of X)if(JJ.existsSync(Q))return Q;throw new A$("srt_win_not_found",`srt-win.exe not found. Set windows.srtWin.path or build with \`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. Looked in: ${X.join(", ")}`)}var T5="--srt-win";function wJ($){if($?.path===void 0)throw new A$("srt_win_not_found","no srt-win path configured; set windows.srtWin.path (e.g. to the exported VENDORED_SRT_WIN_EXE constant for the packaged binary)");if(!JJ.existsSync($.path))throw new A$("srt_win_not_found",`windows.srtWin.path is set to '${$.path}' but the file does not exist`);return{exe:$.path,prependArgs:[T5]}}function m0($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??wJ(),Y=xK(X,[...Q,...$],{encoding:"utf8",windowsHide:!0,timeout:J.timeoutMs??15000,...J.stdin!==void 0?{input:J.stdin}:{}});if(Y.error){if(Y.error.code==="ETIMEDOUT")throw new A$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${J.timeoutMs??15000}ms`+(Y.signal?` (killed by ${Y.signal})`:""),$[0]);throw new A$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${Y.error.message}`,$[0])}return{status:Y.status,signal:Y.signal,stdout:(Y.stdout??"").trim(),stderr:(Y.stderr??"").trim()}}function o7($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??wJ(),Y=J.timeoutMs??15000;return new Promise((G,W)=>{let U=_K(X,[...Q,...$],{windowsHide:!0}),M=!1,O=Y>0?setTimeout(()=>{M=!0,U.kill()},Y):void 0,V="",q="";U.stdout?.setEncoding("utf8").on("data",(H)=>V+=H),U.stderr?.setEncoding("utf8").on("data",(H)=>q+=H),U.stdin?.on("error",()=>{}).end(J.stdin),U.once("error",(H)=>{clearTimeout(O),W(new A$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${H.message}`,$[0]))}),U.once("close",(H,N)=>{if(clearTimeout(O),M){W(new A$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${Y}ms`+(N?` (killed by ${N})`:""),$[0]));return}G({status:H,signal:N,stdout:V.trim(),stderr:q.trim()})})})}function S5($,J){if(J.status!==0)throw new A$("srt_win_nonzero",`srt-win ${$.join(" ")} exited ${J.status}: ${J.stderr||J.stdout}`,$[0]);try{return JSON.parse(J.stdout)}catch(X){throw new A$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(J.stdout)}: ${X.message}`,$[0])}}function a7($,J){return S5($,m0($,J))}async function s7($,J){return S5($,await o7($,J))}function I5($,J){let X=m0($,J),Q;try{Q=JSON.parse(X.stdout)}catch(Y){throw new A$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(X.stdout)}: ${Y.message}`,$[0])}return{ok:X.status===0,json:Q,stderr:X.stderr}}function C5($){let J=["wfp","status"];if($)J.push("--sublayer-guid",$);return J}function S9($){return{state:$.state,filters:$.filters,...$.port_range&&{portRange:$.port_range},...$.user_sid&&{userSid:$.user_sid},...$.hint&&{hint:$.hint}}}function I9($){return{provisioned:$.user.exists,...$.user.sid&&{sid:$.user.sid},groupExists:$.user.group_exists,...$.user.group_sid&&{groupSid:$.user.group_sid},inBuiltinUsers:$.user.in_builtin_users,inSandboxGroup:$.user.in_sandbox_group,hiddenFromLogon:$.user.hidden_from_logon,credPresent:$.cred_present,...typeof $.marker_version==="number"&&{markerVersion:$.marker_version},realUserSid:$.real_user_sid,...$.ca_cert_thumb&&{caCertThumb:$.ca_cert_thumb},...$.ca_cert_pem&&{caCertPem:$.ca_cert_pem}}}function w5($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=a7(J,{srtWin:$.srtWin});return{user:I9(X.user),wfp:S9(X.wfp)}}async function P5($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=await s7(J,{srtWin:$.srtWin});return{user:I9(X.user),wfp:S9(X.wfp)}}function _5($={}){return S9(a7(C5($.sublayerGuid),{srtWin:$.srtWin}))}async function x5($={}){return S9(await s7(C5($.sublayerGuid),{srtWin:$.srtWin}))}async function r7($={}){let J=$.target,X;if(!J){let[Q,Y]=$.proxyPortRange??j9;for(let G=0;G<5;G++){let W=Z5.createServer();W.listen(0,"127.0.0.1"),await vK(W,"listening");let U=W.address().port;if(U<Q||U>Y){X=W,J=`127.0.0.1:${U}`;break}W.close()}if(!J)throw new A$("wfp_verify_bind_failed",`verifyWindowsWfpEgress: could not bind a loopback listener outside the WFP permit range [${Q},${Y}] in 5 attempts`)}try{let Q=m0(["wfp","verify","--target",J],{timeoutMs:30000,srtWin:$.srtWin});Z(`[Sandbox Windows] wfp verify exit=${Q.status}: ${Q.stderr||Q.stdout}`);let Y;try{Y=JSON.parse(Q.stdout)}catch{throw new A$("wfp_verify_unparseable","WFP egress fence could not be verified \u2014 `srt-win wfp "+`verify\` exited ${Q.status}`+(Q.signal?` (signal ${Q.signal})`:"")+` with unparseable output ${JSON.stringify(Q.stdout)} (stderr: ${JSON.stringify(Q.stderr)})`)}if(Q.status===3)throw new A$("wfp_fence_inactive","WFP egress fence is not active \u2014 direct outbound from the "+`sandbox user to ${Y.target} succeeded. Re-run \`srt-win install\` (one UAC prompt). (${Q.stderr})`);if(Q.status!==0)throw new A$("wfp_verify_inconclusive","WFP egress fence could not be verified \u2014 probe to "+`${Y.target} was '${Y.egress_probe}' (exit ${Q.status}). The fence may be absent. Re-run \`srt-win install\`. (${Q.stderr})`);return{target:Y.target,stderr:Q.stderr}}finally{X?.close()}}function t7($={}){return I9(a7(["user","status"],{srtWin:$.srtWin}))}async function nX($={}){return I9(await s7(["user","status"],{srtWin:$.srtWin}))}function e7($,J={}){let X=$??t7(J);if(!X.caCertThumb||!X.caCertPem)return null;return{pem:X.caCertPem,thumb:X.caCertThumb}}function bK($,J={}){let X=m0(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});k5($,X)}async function v5($,J={}){let X=await o7(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});k5($,X)}function k5($,J){if(Z(`[Sandbox Windows] user trust-ca exit=${J.status}: ${J.stderr||J.stdout}`),J.status!==0)throw new A$("trust_ca_failed",`srt-win user trust-ca '${$}' failed (exit ${J.status}): ${J.stderr||J.stdout}`)}function f5(){let $=process.env.ProgramData;if(!$)throw Error("ProgramData is not set");return $J.win32.join($,"sandbox-runtime")}async function $G($={}){let J=$.status??await nX({srtWin:$.srtWin});if(!J.provisioned||!J.credPresent)throw Error(`ensurePersistentWindowsCa: sandbox user is not provisioned (user=${J.provisioned}, cred=${J.credPresent}). Run \`npx sandbox-runtime windows-install\` first.`);let X=$.dir?void 0:f5();if(X&&!JJ.existsSync(X))throw Error(`ensurePersistentWindowsCa: state directory ${X} does not exist. Run \`npx sandbox-runtime windows-install\` first.`);let Q=$.dir??$J.win32.join(X,"ca"),Y=$J.join(Q,"ca.json"),G=$J.join(Q,"cert.pem"),W=$J.join(Q,"key.pem"),U=($.regenerateWithinDays??30)*24*60*60*1000,M=(A,D)=>{let S=`${A}.tmp.${process.pid}`;JJ.writeFileSync(S,D),JJ.renameSync(S,A)},O=async(A,D,S,B)=>{M(G,A),M(W,D);let C=B||J.caCertThumb!==S;if(C){let w=$J.join(Q,`.trust.${process.pid}.${Date.now()}.pem`);JJ.writeFileSync(w,A);try{await v5(w,{srtWin:$.srtWin})}finally{JJ.rmSync(w,{force:!0})}}return Z(`[Sandbox Windows] persistent CA ${B?"generated":"reused"} (thumb=${S}${C&&!B?", trust reconciled":""})`),{certPem:A,keyPem:D,certPath:G,keyPath:W,thumbprint:S,generated:B,trusted:C}},V=()=>{let A;try{A=JSON.parse(JJ.readFileSync(Y,"utf8"))}catch(S){Z(`[Sandbox Windows] persistent CA ca.json unreadable (${S.message})`,{level:"warn"});return}if(typeof A.certPem!=="string"||typeof A.keyPem!=="string")return;let D=fX(A.certPem,A.keyPem);if(!D.ok){Z(`[Sandbox Windows] persistent CA invalid (${D.reason})`,{level:"warn"});return}return{certPem:A.certPem,keyPem:A.keyPem,thumbprint:D.thumbprint,notAfter:D.notAfter}};if(!$.force){let A=V();if(A&&A.notAfter.getTime()-Date.now()>U)return await O(A.certPem,A.keyPem,A.thumbprint,!1);if(A)Z(`[Sandbox Windows] persistent CA expiring ${A.notAfter.toISOString()}; regenerating`,{level:"warn"})}JJ.mkdirSync(Q,{recursive:!0});try{let A=Date.now()-300000;for(let D of JJ.readdirSync(Q)){if(!D.includes(".tmp.")&&!D.startsWith(".trust."))continue;let S=$J.join(Q,D);if(JJ.statSync(S).mtimeMs<A)JJ.rmSync(S,{force:!0})}}catch{}let q=tY({cn:"sandbox-runtime persistent CA"});M(Y,JSON.stringify({certPem:q.certPem,keyPem:q.keyPem}));let H=V(),{certPem:N,keyPem:K,thumbprint:L}=H??{certPem:q.certPem,keyPem:q.keyPem,thumbprint:mQ(q.certPem)};return await O(N,K,L,!0)}function JG($){return $.timeoutMs??120000}function y5($){let J=["install"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.proxyPortRange)J.push("--proxy-port-range",`${$.proxyPortRange[0]}-${$.proxyPortRange[1]}`);if($.sandboxUser)J.push("--sandbox-user",$.sandboxUser);if($.force)J.push("--force");return J}function b5($){if($ instanceof A$&&$.code==="srt_win_timeout")throw new A$("install_timeout","srt-win install timed out \u2014 the UAC prompt may still be open. "+`Re-run when ready to grant elevation. (${$.message})`);throw $}function h5($){if(Z(`[Sandbox Windows] install exit=${$.status}: ${$.stderr||$.stdout}`),$.status===0||$.status===10)return;let J=$.stderr||$.stdout;switch($.status){case 12:throw new A$("install_wfp_failed",`srt-win install: WFP filter install failed: ${J}`);case 14:throw new A$("install_user_failed",`srt-win install: sandbox user provisioning failed: ${J}`);case 13:throw new A$("install_config_conflict",`srt-win install: filters already exist under this sublayer with a different port range or sandbox-user name. Pass {force: true} to replace, or pick a different sublayerGuid. Output: ${J}`);case 17:throw new A$("install_ambient_failed",`srt-win install: ambient write-deny stamping failed (stock world-writable system dirs could not be deny-stamped for the sandbox user): ${J}`);default:throw new A$("install_failed",`srt-win install failed (exit ${$.status}): ${J}`)}}function hK($={}){let J=$.srtWin??wJ(),X;try{X=m0(y5($),{timeoutMs:JG($),srtWin:J})}catch(Y){b5(Y)}h5(X);let Q=w5({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}async function uK($={}){let J=$.srtWin??wJ(),X;try{X=await o7(y5($),{timeoutMs:JG($),srtWin:J})}catch(Y){b5(Y)}h5(X);let Q=await P5({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}function gK($={}){let J=["uninstall"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.keepUser)J.push("--keep-user");let X=m0(J,{timeoutMs:JG($),srtWin:$.srtWin});if(Z(`[Sandbox Windows] uninstall exit=${X.status}: ${X.stderr||X.stdout}`),X.status===10)return{cancelled:!0};if(X.status!==0)throw new A$("uninstall_failed",`srt-win uninstall failed (exit ${X.status}): ${X.stderr||X.stdout}`);return{}}function C9($,J){let X=new Set;for(let Q of $){let Y=XJ(Q),G=EX(Y);if(FX(Y)&&!G){X.add(Y);continue}let W=G?$Q(Y,{caseInsensitive:!0}):[Y];for(let U of W){if(!JJ.statSync(U,{throwIfNoEntry:!1})){if(J?.mode==="deny"&&!G)X.add(/[\\/]$/.test(Q)&&!/[\\/]$/.test(U)?U+"\\":U);continue}X.add(U)}}return[...X]}function mK($){for(let J of $.split(/\r?\n/)){let X=J.trim();if(!X.startsWith("{")||!X.includes('"code"'))continue;try{let Q=JSON.parse(X);if(Q.code==="mapped_drive_cwd")return Object.assign(new A$("mapped_drive_cwd",Q.message??"mapped/network-drive working directory","exec"),{drive:Q.drive})}catch{}}return}function QG($){let J=$.holderPid??process.pid,X=JSON.stringify({denyRead:$.denyRead,denyWrite:$.denyWrite}),Q=m0(["acl","stamp","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl stamp exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new A$("acl_stamp_failed",`srt-win acl stamp exited ${Q.status} `+(Q.status===2?"(partial \u2014 some inputs skipped)":"(failed)")+`: ${Q.stderr||Q.stdout}`)}function w9($){let J=$.holderPid??process.pid;try{let X=I5(["acl","restore","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl restore exited non-zero (per-path outcomes preserved): ${X.stderr}`,{level:"error"});return Array.isArray(X.json)?X.json:[...X.json.paths??[],...X.json.parents??[]]}catch(X){Z(`[Sandbox Windows] acl restore: ${X.message}`,{level:"error"});return}}function XG($){let J=$.holderPid??process.pid,X=JSON.stringify({read:$.read,write:$.write}),Q=m0(["acl","grant","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl grant exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new A$("acl_grant_failed",`srt-win acl grant exited ${Q.status}: ${Q.stderr||Q.stdout}`)}function P9($){let J=$.holderPid??process.pid;try{let X=I5(["acl","revoke","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl revoke exited non-zero: ${X.stderr}`,{level:"error"});return X.json}catch(X){Z(`[Sandbox Windows] acl revoke: ${X.message}`,{level:"error"});return}}function u5($){let{exe:J,prependArgs:X}=$.srtWin??wJ(),Q=lK(ZQ($.httpProxyPort,$.socksProxyPort,$.caCertPath?.replace(/\\/g,"/"),$.proxyAuthToken,void 0,PJ($.commandId??$.command)));delete Q.TMPDIR,delete Q.NO_PROXY,delete Q.no_proxy;let Y=NX({safeDirs:[$.cwd??process.cwd(),...$.allowWrite??[],...$.gitSafeDirectories??[]],schannelCa:$.caCertPath!==void 0,baseEnv:$.setEnvVars}),G=[J,...X,"exec"];if($.quiet!==!1)G.push("--quiet");for(let V of $.denyRead??[])G.push("--deny-read",V);for(let V of $.denyWrite??[])G.push("--deny-write",V);let W={PATH:process.env.PATH,PATHEXT:process.env.PATHEXT,...$.setEnvVars??{},...Q,...Y};for(let[V,q]of Object.entries(W))if(q!==void 0)G.push("--env",`${V}=${q}`);G.push("--");let U=$.binShell??T9(void 0);G.push(U.exe,...U.args,$.command);let M=G.reduce((V,q)=>V+q.length+3,0);if(M>30000)throw new A$("argv_too_long",`Windows sandbox argv is ~${M} chars (CreateProcessW limit is 32 767).`);let O={...process.env,...Q};return{argv:G,env:O}}function lK($){let J={};for(let X of $){let Q=X.indexOf("=");if(Q===-1)continue;J[X.slice(0,Q)]=X.slice(Q+1)}return J}function i7($){let J=$?` --sublayer-guid ${$}`:"";return`Windows sandbox needs a one-time install (one UAC prompt):
   npx sandbox-runtime windows-install
 `+"  \u2014 or call installWindowsSandbox(), or run "+`\`srt-win.exe install${J}\` directly.
-No logout is needed: the WFP filter keys on the dedicated \`srt-sandbox\` user's SID, so your network is unaffected.`}function N5($){try{return{status:"fulfilled",value:$()}}catch(J){return{status:"rejected",reason:J}}}function y5($,J,X){let Q=[],Y=[];if(J.status==="rejected")return Q.push(`srt-win user status failed: ${J.reason.message}`),{errors:Q,warnings:Y};let G=J.value;if(!G.provisioned||!G.credPresent)Q.push(`Sandbox user is not provisioned (user=${G.provisioned}, cred=${G.credPresent}). `+d7($));let W=X();if(W.status==="rejected")return Q.push(`srt-win wfp status failed: ${W.reason.message}`),{errors:Q,warnings:Y};let U=W.value;if(U.state==="cannot-read")Z(`[Sandbox Windows] wfp status cannot-read (non-elevated): ${U.hint}`);else if(U.state!=="installed"){if(G.provisioned&&G.credPresent)Q.push(`WFP filters not installed under sublayer ${$??"(default)"}. `+d7($))}else if(U.portRange)Z(`[Sandbox Windows] WFP installed: ${U.filters} filters, proxy port range ${U.portRange[0]}-${U.portRange[1]}`);return{errors:Q,warnings:Y}}function b5($={}){let J;try{J=$.srtWin??wJ()}catch(X){return{errors:[X.message],warnings:[]}}return Z(`[Sandbox Windows] using srt-win at ${J.exe}`),y5($.sublayerGuid,N5(()=>a7({srtWin:J})),()=>N5(()=>I5({sublayerGuid:$.sublayerGuid,srtWin:J})))}async function JG($={}){let J;try{J=$.srtWin??wJ()}catch(Y){return{errors:[Y.message],warnings:[]}}Z(`[Sandbox Windows] using srt-win at ${J.exe}`);let[X,Q]=await Promise.allSettled([cX({srtWin:J}),C5({sublayerGuid:$.sublayerGuid,srtWin:J})]);return y5($.sublayerGuid,X,()=>Q)}import{isIP as yK}from"net";function nX($){if($.startsWith("[")){let Q=$.indexOf("]");if(Q===-1)return{hostPattern:$,port:void 0};let Y=$.slice(1,Q),G=jJ(Y)??Y,W=$.slice(Q+1);if(W==="")return{hostPattern:G,port:void 0};let U=h5(W.startsWith(":")?W.slice(1):"");return U===void 0?{hostPattern:$,port:void 0}:{hostPattern:G,port:U}}let J=$.lastIndexOf(":");if(J===-1)return{hostPattern:$,port:void 0};if($.indexOf(":")!==J)return{hostPattern:jJ($)??$,port:void 0};let X=h5($.slice(J+1));if(X===void 0)return{hostPattern:$,port:void 0};return{hostPattern:$.slice(0,J),port:X}}function h5($){if(!/^[1-9][0-9]{0,4}$/.test($))return;let J=Number($);return J>65535?void 0:J}function iX($){return nX($).hostPattern}function j0($,J){let X=$.toLowerCase();if(J==="*")return!0;if(J.startsWith("*.")){if(yK(dJ(X)))return!1;let Q=J.substring(2).toLowerCase();return X.endsWith("."+Q)}return X===J.toLowerCase()}function oX($,J,X){let{hostPattern:Q,port:Y}=nX(X);if(Y!==void 0&&Y!==J)return!1;return j0($,Q)}function P9($,J){let X=J.map(iX);if(!$.startsWith("*."))return X.some((Y)=>j0($,Y));let Q=$.slice(2).toLowerCase();return X.some((Y)=>{if(!Y.startsWith("*."))return!1;let G=Y.slice(2).toLowerCase();return Q===G||Q.endsWith("."+G)})}function u5($,J,X,Q){if(!lQ(J))return{verdict:"deny",reason:"malformed host"};let Y=jJ(J)??J;for(let G of $.deniedDomains)if(oX(Y,X,G))return{verdict:"deny",reason:$.deniedDomainReasons?.[G]??"host is on the deny list",rule:G};for(let G of $.allowedDomains)if(oX(Y,X,G))return{verdict:"allow",rule:G};if(!Q||$.strictAllowlist)return{verdict:"deny",reason:"host is not on the allow list"};return{verdict:"ask"}}import{EOL as QG}from"os";import{dirname as XG}from"path";var k,rX,tX,eX,uJ,l0,aX,g5=!1,_9,oQ,c0,g$,n0,aQ,p0,x9,m5=!1,$Y,EQ=new D9,oJ=new A7,sQ=new j7,JY=new B7;function hK(){if(g5)return;let $=()=>VG().catch((J)=>{Z(`Cleanup failed in registerCleanup ${J}`,{level:"error"})});process.once("exit",$),process.once("SIGINT",$),process.once("SIGTERM",$),g5=!0}var uK=1024,zQ=new Map;function i5($,J){let X=J?.commandId,Q=J?.commandText??$;if(X===void 0||X===Q)return;let Y=e0(PJ(X));zQ.delete(Y),zQ.set(Y,Q);while(zQ.size>uK){let G=zQ.keys().next().value;if(G===void 0)break;zQ.delete(G)}}function l5($){return zQ.get($)??$}function YG($,J){let X=J?(()=>{let Q=e0(J);return zQ.get(Q)??u7(Q)})():void 0;if(nQ($,X,k?.ignoreViolations))return;EQ.addViolation({line:$,encodedCommand:J,command:X,timestamp:new Date})}function gK($){try{let J=new URL($);return`${J.origin}${J.pathname}${J.search?"?\u2026":""}`}catch{let J=$.indexOf("?");return J===-1?$:`${$.slice(0,J)}?\u2026`}}async function p5($,J,X,Q){let Y=(W)=>{return YG(`deny network-outbound ${J}:${$} (${W})`,Q),!1};if(!k)return Z("No config available, denying network request"),Y("sandbox policy unavailable");let G=u5(k.network,J,$,X!==void 0);if(G.verdict==="allow")return Z(`Allowed by config rule: ${J}:${$}`),!0;if(G.verdict==="deny"){if(G.reason==="malformed host")Z(`Denying malformed host: ${JSON.stringify(J)}:${$}`,{level:"error"});else if(G.rule!==void 0)Z(`Denied by config rule: ${J}:${$}`);else Z(`No matching config rule, denying: ${J}:${$}`);return Y(G.reason)}Z(`No matching config rule, asking user: ${J}:${$}`);try{if(await X({host:J,port:$}))return Z(`User allowed: ${J}:${$}`),!0;return Z(`User denied: ${J}:${$}`),Y("user denied")}catch(W){return Z(`Error in permission callback: ${W}`,{level:"error"}),Y("permission prompt failed")}}var v9=!1;function mK($){v9=$}function lK(){if(!v9&&!k?.credentials)return;return($,J)=>{if(!k?.credentials)return;oJ.substituteInHeaders($,J,j0)}}function pK(){if(!v9&&!k?.credentials)return;return($)=>k?.credentials?oJ.sentinelsForHost($,j0):void 0}function dK(){if(!v9&&!k?.credentials)return;return($,J,X,Q)=>!k?.credentials?void 0:_4(sQ,k?.credentials?.sigv4,j0)($,J,X,Q)}function cK($){if(!k?.network.mitmProxy)return;let{socketPath:J,domains:X}=k.network.mitmProxy,Q=jJ($)??$;for(let Y of X)if(j0(Q,Y))return Z(`Host ${$} matches MITM pattern ${Y}`),J;return}function nK($){let J=k?.network.tlsTerminate?.excludeDomains;if(!J?.length)return!0;let X=jJ($)??$;for(let Q of J){if(!j0(X,Q))continue;Z(`Host ${$} matches tlsTerminate.excludeDomains pattern ${Q}; skipping TLS termination`);let Y=oJ.namesInjectableAt(X,j0);if(Y.length>0)Z(`tlsTerminate.excludeDomains: masked credential(s) ${Y.join(", ")} are configured for injection at ${$}, but its connections are not terminated, so the upstream will receive the placeholder`,{level:"error"});return!1}return!0}async function iK($,J){let X=lK(),Q=pK();rX=U4({filter:(U,M,O,V)=>p5(U,M,$,V),getMitmSocketPath:cK,mitmCA:g$,shouldTerminateTLS:nK,filterRequest:k?.network.filterRequest,onFilterRequestDenied:({method:U,url:M,reason:O,encodedCommand:V})=>{YG(`deny http-request ${U} ${gK(M)} (${O})`,V)},mutateHeaders:X,mutateHeadersPlaintext:k?.credentials?.allowPlaintextInject?X:void 0,getBodySubstitutions:Q,getBodySubstitutionsPlaintext:k?.credentials?.allowPlaintextInject?Q:void 0,planSigv4:dK(),parentProxy:c0,proxyAuthToken:n0}),tX=F4({filter:(U,M,O)=>p5(U,M,$,O),parentProxy:c0,proxyAuthToken:n0,probeUnauthenticated:async(U,M)=>{if(!k)return{};let O=jJ(M)??M;for(let V of k.network.deniedDomains)if(oX(O,U,V)){let H=k.network.deniedDomainReasons?.[V]??"host is on the deny list";return YG(`deny network-outbound ${M}:${U} (${H})`,void 0),{deniedReason:H}}return{}}}),eX=A4({httpServer:rX,handleSocksConnection:(U)=>tX.handleConnection(U),httpBackendPortRange:J});let Y=eX,G=await Y.listenHttpBackend();await U9(Y.server,(U)=>Y.server.listen(U,"127.0.0.1"),J,G!==void 0?new Set([G]):new Set);let W=Y.getPort();if(W===void 0)throw Error("Failed to get mux proxy server port");return Y.unref(),Z(`Mux proxy (HTTP+SOCKS) listening on localhost:${W}`),W}async function oK($,J,X=!1){if(l0){await l0;return}if(k=$,c0=M7($.network.parentProxy),c0)Z(`Parent proxy configured: http=${H7(c0.httpUrl)} https=${H7(c0.httpsUrl)}`);if($.network.tlsTerminate&&$.network.mitmProxy)throw Error("network.tlsTerminate and network.mitmProxy are mutually exclusive");let Q=$.network.tlsTerminate,Y=v$()==="windows"&&Q!==void 0&&!Q.caCertPath&&!Q.caKeyPath;if(g$=Q&&!Y?Q7(Q):void 0,g$&&$.runAsHostUid!==void 0&&v$()==="linux"){if(d0.chmodSync(XG(g$.trustBundlePath),457),d0.chmodSync(g$.trustBundlePath,420),g$.ephemeral)d0.chmodSync(XG(g$.certPath),457),d0.chmodSync(g$.certPath,420)}let G=await s5();if(G.errors.length>0)throw Error(`Sandbox dependencies not available: ${G.errors.join(", ")}`);if(X&&v$()==="macos")_9=q5(EQ.addViolation.bind(EQ),k.ignoreViolations,l5),Z("Started macOS sandbox log monitor");if(X&&v$()==="linux")oQ=E5(EQ.addViolation.bind(EQ),{allowWritePaths:[...DQ($.runAsHostHome),...k.filesystem.allowWrite],denyWritePaths:k.filesystem.denyWrite,ignoreViolations:k.ignoreViolations,resolveCommandText:l5,consumerUid:$.runAsHostUid,consumerGid:$.runAsHostGid}),oQ.ready,Z("Started Linux seccomp violation monitor");if(hK(),v$()==="windows"){$Y=wJ($.windows?.srtWin);let W=$Y,U=await cX({srtWin:W});if(!U.provisioned||!U.credPresent)throw k=void 0,new A$("not_provisioned",`Windows sandbox user is not provisioned (user=${U.provisioned}, cred=${U.credPresent}). Run \`npx sandbox-runtime windows-install\` (one UAC prompt) to provision it.`);if(!m5){try{await o7({proxyPortRange:$.windows?.proxyPortRange,srtWin:W})}catch(M){throw k=void 0,M}m5=!0}if(Y&&Q)try{let M=await r7({status:U,srtWin:W});g$=Q7({caCertPem:M.certPem,caKeyPem:M.keyPem,caCertPath:M.certPath,caKeyPath:M.keyPath,extraCaCertPaths:Q.extraCaCertPaths})}catch(M){throw k=void 0,M}if(Q&&g$&&!Y){let M=s7(U),O=mQ(g$.certPem);if(!M)throw k=void 0,new A$("trust_ca_not_installed",`tlsTerminate on Windows requires the sandbox to be installed with this CA (thumb=${O}): run \`srt-win user trust-ca ${g$.certPath}\`. Per-exec installs into the sandbox user's Root store are not supported.`);if(M.thumb!==O)throw k=void 0,new A$("trust_ca_thumbprint_mismatch",`tlsTerminate on Windows: the sandbox's installed CA (thumb=${M.thumb}) doesn't match this session's CA (thumb=${O}). Run \`srt-win user trust-ca ${g$.certPath}\` to update it.`)}try{let M=eK($);if(g$)M.grantRead.push(XG(g$.trustBundlePath));if(!U.sid)throw Error("sandbox user SID missing from `srt-win user status` (provisioned but in an inconsistent state)");let O=U.sid;if(p0=O,M.grantRead.length>0||M.grantWrite.length>0)$G({sandboxUserSid:O,read:M.grantRead,write:M.grantWrite,srtWin:W});if(M.denyRead.length>0||M.denyWrite.length>0)e7({sandboxUserSid:O,denyRead:M.denyRead,denyWrite:M.denyWrite,srtWin:W});if(M.grantRead.length>0||M.grantWrite.length>0||M.denyRead.length>0||M.denyWrite.length>0)aQ=M,Z(`[Sandbox Windows] fs applied: ${M.grantWrite.length} grantWrite, ${M.grantRead.length} grantRead, ${M.denyRead.length} denyRead, ${M.denyWrite.length} denyWrite`);x9=t5($)}catch(M){if(p0)w9({sandboxUserSid:p0,srtWin:W}),C9({sandboxUserSid:p0,srtWin:W});throw p0=void 0,k=void 0,M}}l0=(async()=>{try{let W=v$()==="windows"?k.windows?.proxyPortRange??B9:void 0;n0=k.network.httpProxyPort!==void 0?void 0:bK(16).toString("hex");let M=k.network.httpProxyPort===void 0||k.network.socksProxyPort===void 0?await iK(J,W):void 0,O=k.network.httpProxyPort??M,V=k.network.socksProxyPort??M;if(g$&&M!==void 0&&v$()==="windows")g$.crlUrl=`http://127.0.0.1:${M}${sY}`;if(k.network.httpProxyPort!==void 0)Z(`Using external HTTP proxy on port ${O}`);if(k.network.socksProxyPort!==void 0)Z(`Using external SOCKS proxy on port ${V}`);let H;if(v$()==="linux")H=await Y5(O,V,k.socatPath,k.runAsHostUid,k.runAsHostGid);let q={httpProxyPort:O,socksProxyPort:V,linuxBridge:H};return uJ=q,Z("Network infrastructure initialized"),q}catch(W){throw l0=void 0,uJ=void 0,VG().catch((U)=>{Z(`Cleanup failed in initializationPromise ${U}`,{level:"error"})}),W}})(),await l0}function o5(){let $=v$();if($==="linux")return p9()!=="1";return $==="macos"||$==="windows"}function aK(){return k!==void 0}function a5($){if(!o5())return{done:{errors:["Unsupported platform"],warnings:[]}};let J=[],X=[],Q=v$();if(Q==="linux"){let Y=$??k?.ripgrep??{command:"rg"};if(D0(Y.command)===null)J.push(`ripgrep (${Y.command}) not found`);let G=X5({seccompConfig:k?.seccomp,bwrapPath:k?.bwrapPath,socatPath:k?.socatPath});J.push(...G.errors),X.push(...G.warnings)}else if(Q==="windows"){let Y;try{Y=wJ(k?.windows?.srtWin)}catch(G){return J.push(G.message),{done:{errors:J,warnings:X}}}return{windows:{sublayerGuid:k?.windows?.sublayerGuid??k?.windows?.wfpSublayerGuid,srtWin:Y}}}return{done:{errors:J,warnings:X}}}function sK($){let J=a5($);if("done"in J)return J.done;return b5(J.windows)}async function s5($){let J=a5($);if("done"in J)return J.done;return JG(J.windows)}function WG($,J){if(!$)return{denyReadPaths:[],unsetEnvVars:[],setEnvVars:{},maskedFileBinds:[],maskedFileStoreDir:void 0};let X=k9($),Q=[...new Set((J??[]).map(iX))],Y=[];for(let V of $.envVars??[])if(V.mode==="deny")Y.push(V.name);let{setEnvVars:G,degradeToUnsetNames:W}=S4($.envVars??[],Q,oJ);Y.push(...W),P4($.envVars??[],$.awsPairs,Q,G,sQ);let U=$.files??[],{binds:M,degradeToDenyPaths:O}=T4(U,Q,oJ,JY);return{denyReadPaths:[...new Set([...X,...O])],unsetEnvVars:[...new Set(Y)],setEnvVars:G,maskedFileBinds:M,maskedFileStoreDir:JY.dirPath}}function k9($){let J=$?.files??[];return[...new Set(J.filter((X)=>X.mode==="deny").map((X)=>X.path))]}function r5($,J){return[...new Set([...$,...J.denyReadPaths])]}function rK(){if(!k||k.filesystem.disabled)return{denyOnly:[],allowWithinDeny:[]};let $=r5(k.filesystem.denyRead,WG(k.credentials,k.network.allowedDomains)),J=[];for(let Q of $){let Y=F0(Q);if(v$()==="linux"&&NJ(Y)){let G=$Q(Q);Z(`[Sandbox] Expanded glob pattern "${Q}" to ${G.length} paths on Linux`),J.push(...G)}else J.push(Y)}let X=[];for(let Q of k.filesystem.allowRead??[]){let Y=F0(Q);if(v$()==="linux"&&NJ(Y)){let G=$Q(Q);Z(`[Sandbox] Expanded allowRead glob pattern "${Q}" to ${G.length} paths on Linux`),X.push(...G)}else X.push(Y)}return{denyOnly:J,allowWithinDeny:X}}function tK(){if(!k)return{allowOnly:DQ(),denyWithinAllow:[]};if(k.filesystem.disabled)return{allowOnly:["/"],denyWithinAllow:[]};let $=k.filesystem.allowWrite.map((Q)=>F0(Q)).filter((Q)=>{if(v$()==="linux"&&NJ(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0}),J=k.filesystem.denyWrite.map((Q)=>F0(Q)).filter((Q)=>{if(v$()==="linux"&&NJ(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0});return{allowOnly:[...DQ(GG()),...$],denyWithinAllow:J}}function eK($){let J=$.filesystem;if(J?.disabled)return{grantRead:[],grantWrite:[],denyRead:[],denyWrite:[]};let X=I9,Q=X([...new Set([...J?.denyRead??[],...k9($.credentials)])],{mode:"deny"}),Y=X(J?.denyWrite??[],{mode:"deny"});return{grantRead:X(J?.allowRead??[],{mode:"grant"}),grantWrite:X(J?.allowWrite??[],{mode:"grant"}),denyRead:Q,denyWrite:Y}}function t5($){return{disabled:$.filesystem.disabled??!1,denyRead:[...$.filesystem.denyRead],denyWrite:[...$.filesystem.denyWrite],allowRead:[...$.filesystem.allowRead??[]],allowWrite:[...$.filesystem.allowWrite],credFiles:k9($.credentials)}}function sX($,J){if($.length!==J.length)return!1;let X=new Set($);return J.every((Q)=>X.has(Q))}function $z($,J){return $.disabled===J.disabled&&sX($.denyRead,J.denyRead)&&sX($.denyWrite,J.denyWrite)&&sX($.allowRead,J.allowRead)&&sX($.allowWrite,J.allowWrite)&&sX($.credFiles,J.credFiles)}function Jz($){return x9!==void 0&&$z(x9,t5($))}function Qz(){if(!k)return{};let $=k.network.allowedDomains,J=k.network.deniedDomains;return{allowedHosts:$,...J.length>0&&{deniedHosts:J}}}function e5(){return k?.network?.allowUnixSockets}function d5(){return k?.network?.allowAllUnixSockets}function $U(){return k?.network?.allowLocalBinding}function JU(){return k?.network?.allowMachLookup}function QU(){return k?.ignoreViolations}function XU(){return k?.enableWeakerNestedSandbox}function Xz(){return k?.runAsUid}function Yz(){return k?.runAsGid}function Gz(){return k?.runAsHostUid}function Wz(){return k?.runAsHostGid}function GG(){return k?.runAsHostHome}function Uz(){return k?.runAsHostUser}function Mz(){return k?.enableWeakerNetworkIsolation}function Oz(){return k?.allowAppleEvents}function Vz(){return k?.ripgrep??{command:"rg"}}function Hz(){return k?.mandatoryDenySearchDepth??3}function c5(){return k?.filesystem?.allowGitConfig??!1}function YU($){return[...k?.git?.safeDirectories??[],...$?.git?.safeDirectories??[]]}function qz(){return k?.seccomp}function Kz(){return n0}function UG(){return uJ?.httpProxyPort}function MG(){return uJ?.socksProxyPort}function GU(){return uJ?.linuxBridge?.httpSocketPath}function WU(){return uJ?.linuxBridge?.socksSocketPath}async function OG(){if(!k)return!1;if(l0)try{return await l0,!0}catch{return!1}return uJ!==void 0}async function UU($,J,X,Q,Y){let G=v$(),W=Y?.commandId;i5($,Y);let U=X?.filesystem!==void 0?X.filesystem.disabled??!1:k?.filesystem.disabled??!1,M=WG(X?.credentials??k?.credentials,X?.network?.allowedDomains??k?.network?.allowedDomains),O,V;if(!U){let L=(P)=>P.map((l)=>F0(l)).filter((l)=>{if(v$()==="linux"&&NJ(l))return Z(`[Sandbox] Skipping glob write pattern on Linux: ${l}`),!1;return!0}),R=L(X?.filesystem?.allowWrite??k?.filesystem.allowWrite??[]);O={allowOnly:[...DQ(X?.runAsHostHome??GG()),...R],denyWithinAllow:L(X?.filesystem?.denyWrite??k?.filesystem.denyWrite??[])};let I=r5(X?.filesystem?.denyRead??k?.filesystem.denyRead??[],M),j=[];for(let P of I){let l=F0(P);if(v$()==="linux"&&NJ(l))j.push(...$Q(P));else j.push(l)}let C=X?.filesystem?.allowRead??k?.filesystem.allowRead??[],w=[];for(let P of C){let l=F0(P);if(v$()==="linux"&&NJ(l))w.push(...$Q(P));else w.push(l)}if(g$)w.push(g$.certPath,g$.trustBundlePath);V={denyOnly:j,allowWithinDeny:w}}let H=X?.network?.allowedDomains!==void 0||k?.network?.allowedDomains!==void 0,q=H,F=H;if(F)await OG();let K=X?.allowPty??k?.allowPty,A=YU(X);switch(G){case"macos":return H5({command:$,commandId:W,needsNetworkRestriction:q,httpProxyPort:F?UG():void 0,socksProxyPort:F?MG():void 0,proxyAuthToken:F?n0:void 0,caCertPath:g$?.trustBundlePath,readConfig:V,writeConfig:O,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,allowUnixSockets:e5(),allowAllUnixSockets:d5(),allowLocalBinding:$U(),allowMachLookup:JU(),ignoreViolations:QU(),allowPty:K,allowGitConfig:c5(),gitSafeDirectories:A,enableWeakerNetworkIsolation:Mz(),allowAppleEvents:Oz(),binShell:J});case"linux":return G5({command:$,commandId:W,needsNetworkRestriction:q,httpSocketPath:F?GU():void 0,socksSocketPath:F?WU():void 0,httpProxyPort:F?uJ?.httpProxyPort:void 0,socksProxyPort:F?uJ?.socksProxyPort:void 0,proxyAuthToken:F?n0:void 0,caCertPath:g$?.trustBundlePath,readConfig:V,writeConfig:O,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,maskedFileStoreDir:M.maskedFileStoreDir,enableWeakerNestedSandbox:XU(),runAsUid:Xz(),runAsGid:Yz(),runAsHostUid:Gz(),runAsHostGid:Wz(),runAsHostHome:GG(),runAsHostUser:Uz(),setprivPath:"/usr/bin/setpriv",allowAllUnixSockets:d5(),binShell:J,ripgrepConfig:Vz(),mandatoryDenySearchDepth:Hz(),allowGitConfig:c5(),gitSafeDirectories:A,seccompConfig:qz(),bwrapPath:k?.bwrapPath,socatPath:k?.socatPath,observeSocketPath:oQ?.observeSocketPath,abortSignal:Q});case"windows":throw Error("wrapWithSandbox() returns a shell string and is not supported on Windows. Use SandboxManager.wrapWithSandboxArgv() and spawn the result with {shell: false}.");default:throw Error(`Sandbox configuration is not supported on platform: ${G}`)}}async function zz($,J,X,Q,Y,G){if(v$()==="windows"){let O=X?.network?.allowedDomains!==void 0||k?.network?.allowedDomains!==void 0;if(O)await OG();let V=WG(X?.credentials??k?.credentials,X?.network?.allowedDomains??k?.network?.allowedDomains),H=X?.filesystem,q=[],F=[];if(!H?.disabled){if(H?.allowRead?.length||H?.allowWrite?.length)throw Error("Per-exec filesystem.allowRead/allowWrite is not supported "+"on Windows \u2014 `srt-win exec` only exposes per-exec "+"denies. Set them at the session level (initialize()).");let K=[...H?.denyRead??[],...k9(X?.credentials)],A=H?.denyWrite??[];if(K.length>0||A.length>0){let L=new Set(aQ?.denyRead??[]),R=new Set(aQ?.denyWrite??[]),I=I9;q=I(K,{mode:"deny"}).filter((j)=>!L.has(j)),F=I(A,{mode:"deny"}).filter((j)=>!L.has(j)&&!R.has(j))}}return i5($,G),f5({command:$,commandId:G?.commandId,httpProxyPort:O?UG():void 0,socksProxyPort:O?MG():void 0,proxyAuthToken:O?n0:void 0,setEnvVars:V.setEnvVars,denyRead:q,denyWrite:F,cwd:Y,allowWrite:aQ?.grantWrite,gitSafeDirectories:YU(X),caCertPath:g$?.trustBundlePath,binShell:j9(J),srtWin:X?.windows?.srtWin?wJ(X.windows.srtWin):$Y??wJ(k?.windows?.srtWin)})}if(typeof J==="object")throw Error("binShell object form is Windows-only; pass a shell path string on macOS/Linux");let U=await UU($,J,X,Q,G);return{argv:[J??"/bin/bash","-c",U],env:process.env}}function Ez(){return k}function Fz(){oJ.clear(),sQ.clear(),JY.dispose()}function Nz($){if(v$()==="windows"&&k&&!Jz($))Z("[Sandbox Windows] updateConfig: the resolved file-access set "+"(filesystem.* \u222A credentials.files) changed but the ACL "+"stamp/grant is session-wide \u2014 call reset() then initialize() "+"to apply. The previously-applied set stays in effect.",{level:"warn"});let{filterRequest:J,...X}=$.network;k=structuredClone({...$,network:X}),k.network.filterRequest=J,c0=M7($.network.parentProxy),Z("Sandbox configuration updated")}function Lz(){R9()}var Az=1500;function n5($,J){if(!$.pid||$.exitCode!==null||$.signalCode!==null)return Promise.resolve();try{process.kill($.pid,"SIGTERM"),Z(`Sent SIGTERM to ${J} bridge process`)}catch(X){if(X.code!=="ESRCH")Z(`Error killing ${J} bridge: ${X}`,{level:"error"});return Promise.resolve()}return new Promise((X)=>{let Q=!1,Y=()=>{if(Q)return;Q=!0,clearTimeout(G),X()};$.once("exit",()=>{Z(`${J} bridge process exited`),Y()});let G=setTimeout(()=>{if($.exitCode===null&&$.signalCode===null){Z(`${J} bridge did not exit, forcing SIGKILL`,{level:"warn"});try{if($.pid)process.kill($.pid,"SIGKILL")}catch{}}Y()},Az);G.unref?.()})}function Rz($){return new Promise((J)=>{if(typeof $.closeAllConnections==="function")$.closeAllConnections();$.close((X)=>{if(X&&X.message!=="Server is not running.")Z(`Error closing HTTP proxy server: ${X.message}`,{level:"error"});J()})})}async function Dz(){if(aQ&&p0){let J=p0,X=$Y,Q=new Set(["revoked","stillHeld","restored","alreadyOriginal"]),Y=(G,W)=>{if(!Q.has(W.status))Z(`[Sandbox Windows] ${G}: '${W.path}' ${W.status} \u2014 `+"ACE may be left in place; resolve and run `srt-win acl recover` to clear",{level:"warn"})};for(let G of w9({sandboxUserSid:J,srtWin:X})??[])Y("grant revoke",G);for(let G of C9({sandboxUserSid:J,srtWin:X})??[])Y("deny restore",G)}if(aQ=void 0,p0=void 0,x9=void 0,$Y=void 0,R9({force:!0}),_9)_9(),_9=void 0;if(oQ)oQ.stop(),oQ=void 0;if(uJ?.linuxBridge){let{httpSocketPath:J,socksSocketPath:X,httpBridgeProcess:Q,socksBridgeProcess:Y}=uJ.linuxBridge;if(await Promise.all([n5(Q,"HTTP"),n5(Y,"SOCKS")]),J)try{d0.rmSync(J,{force:!0}),Z("Cleaned up HTTP socket")}catch(G){Z(`HTTP socket cleanup error: ${G}`,{level:"error"})}if(X)try{d0.rmSync(X,{force:!0}),Z("Cleaned up SOCKS socket")}catch(G){Z(`SOCKS socket cleanup error: ${G}`,{level:"error"})}}let $=[];if(g$)$.push(yW(g$));if(eX)$.push(eX.close().catch((J)=>{Z(`Error closing mux proxy server: ${J.message}`,{level:"error"})}));if(rX)$.push(Rz(rX));if(tX){let J=tX.close().catch((X)=>{Z(`Error closing SOCKS proxy server: ${X.message}`,{level:"error"})});$.push(J)}await Promise.all($),eX=void 0,rX=void 0,n0=void 0,tX=void 0,uJ=void 0,l0=void 0,c0=void 0,g$=void 0,oJ.clear(),sQ.clear(),JY.dispose()}async function VG(){if(aX)return aX;aX=Dz();try{await aX}finally{aX=void 0}}function Zz(){return EQ}function Bz($,J){if(!k)return J;let X=EQ.getViolationsForCommand($);if(X.length===0)return J;let Q=J;Q+=QG+"<sandbox_violations>"+QG;for(let Y of X)Q+=Y.line+QG;return Q+="</sandbox_violations>",Q}function jz(){if(v$()!=="linux"||!k||k.filesystem.disabled)return[];let $=[],J=[...k.filesystem.allowWrite,...k.filesystem.denyWrite];for(let X of J){let Q=F0(X);if(NJ(Q))$.push(X)}return $}var Tz={initialize:oK,isSupportedPlatform:o5,isSandboxingEnabled:aK,checkDependencies:sK,checkDependenciesAsync:s5,getFsReadConfig:rK,getFsWriteConfig:tK,getNetworkRestrictionConfig:Qz,getAllowUnixSockets:e5,getAllowLocalBinding:$U,getAllowMachLookup:JU,getIgnoreViolations:QU,getEnableWeakerNestedSandbox:XU,getProxyPort:UG,getProxyAuthToken:Kz,getSocksProxyPort:MG,getLinuxHttpSocketPath:GU,getLinuxSocksSocketPath:WU,waitForNetworkInitialization:OG,wrapWithSandbox:UU,wrapWithSandboxArgv:zz,cleanupAfterCommand:Lz,beginCredentialLease:()=>oJ.beginLease(),endCredentialLease:()=>oJ.endLease(),releaseCredentialLease:($)=>sQ.forget(oJ.release($)),reset:VG,getMitmCA:()=>g$,getSentinelRegistry:()=>oJ,getAwsPairRegistry:()=>sQ,getMaskedFileStore:()=>JY,getSandboxViolationStore:Zz,annotateStderrWithSandboxFailures:Bz,getLinuxGlobPatternWarnings:jz,getConfig:Ez,updateConfig:Nz,clearMaskedCredentials:Fz,setLiveCredentialInjectors:mK};import{isIP as yE}from"net";import{isAbsolute as bE}from"path";var x={};lU(x,{void:()=>OE,util:()=>B$,unknown:()=>UE,union:()=>KE,undefined:()=>YE,tuple:()=>FE,transformer:()=>SE,symbol:()=>XE,string:()=>FU,strictObject:()=>qE,setErrorMap:()=>Cz,set:()=>AE,record:()=>NE,quotelessJson:()=>Sz,promise:()=>TE,preprocess:()=>wE,pipeline:()=>PE,ostring:()=>_E,optional:()=>IE,onumber:()=>xE,oboolean:()=>vE,objectUtil:()=>HG,object:()=>HE,number:()=>NU,nullable:()=>CE,null:()=>GE,never:()=>ME,nativeEnum:()=>jE,nan:()=>$E,map:()=>LE,makeIssue:()=>QY,literal:()=>ZE,lazy:()=>DE,late:()=>tz,isValid:()=>i0,isDirty:()=>y9,isAsync:()=>tQ,isAborted:()=>f9,intersection:()=>EE,instanceof:()=>ez,getParsedType:()=>q0,getErrorMap:()=>rQ,function:()=>RE,enum:()=>BE,effect:()=>SE,discriminatedUnion:()=>zE,defaultErrorMap:()=>T0,datetimeRegex:()=>KU,date:()=>QE,custom:()=>EU,coerce:()=>kE,boolean:()=>LU,bigint:()=>JE,array:()=>VE,any:()=>WE,addIssueToContext:()=>c,ZodVoid:()=>YY,ZodUnknown:()=>o0,ZodUnion:()=>YX,ZodUndefined:()=>QX,ZodType:()=>N$,ZodTuple:()=>z0,ZodTransformer:()=>eJ,ZodSymbol:()=>XY,ZodString:()=>aJ,ZodSet:()=>AQ,ZodSchema:()=>N$,ZodRecord:()=>GY,ZodReadonly:()=>HX,ZodPromise:()=>RQ,ZodPipeline:()=>MY,ZodParsedType:()=>m,ZodOptional:()=>rJ,ZodObject:()=>a$,ZodNumber:()=>a0,ZodNullable:()=>I0,ZodNull:()=>XX,ZodNever:()=>K0,ZodNativeEnum:()=>MX,ZodNaN:()=>UY,ZodMap:()=>WY,ZodLiteral:()=>UX,ZodLazy:()=>WX,ZodIssueCode:()=>h,ZodIntersection:()=>GX,ZodFunction:()=>$X,ZodFirstPartyTypeKind:()=>M$,ZodError:()=>TJ,ZodEnum:()=>r0,ZodEffects:()=>eJ,ZodDiscriminatedUnion:()=>b9,ZodDefault:()=>OX,ZodDate:()=>NQ,ZodCatch:()=>VX,ZodBranded:()=>h9,ZodBoolean:()=>JX,ZodBigInt:()=>s0,ZodArray:()=>sJ,ZodAny:()=>LQ,Schema:()=>N$,ParseStatus:()=>EJ,OK:()=>FJ,NEVER:()=>fE,INVALID:()=>W$,EMPTY_PATH:()=>wz,DIRTY:()=>FQ,BRAND:()=>rz});var B$;(function($){$.assertEqual=(Y)=>{};function J(Y){}$.assertIs=J;function X(Y){throw Error()}$.assertNever=X,$.arrayToEnum=(Y)=>{let G={};for(let W of Y)G[W]=W;return G},$.getValidEnumValues=(Y)=>{let G=$.objectKeys(Y).filter((U)=>typeof Y[Y[U]]!=="number"),W={};for(let U of G)W[U]=Y[U];return $.objectValues(W)},$.objectValues=(Y)=>{return $.objectKeys(Y).map(function(G){return Y[G]})},$.objectKeys=typeof Object.keys==="function"?(Y)=>Object.keys(Y):(Y)=>{let G=[];for(let W in Y)if(Object.prototype.hasOwnProperty.call(Y,W))G.push(W);return G},$.find=(Y,G)=>{for(let W of Y)if(G(W))return W;return},$.isInteger=typeof Number.isInteger==="function"?(Y)=>Number.isInteger(Y):(Y)=>typeof Y==="number"&&Number.isFinite(Y)&&Math.floor(Y)===Y;function Q(Y,G=" | "){return Y.map((W)=>typeof W==="string"?`'${W}'`:W).join(G)}$.joinValues=Q,$.jsonStringifyReplacer=(Y,G)=>{if(typeof G==="bigint")return G.toString();return G}})(B$||(B$={}));var HG;(function($){$.mergeShapes=(J,X)=>{return{...J,...X}}})(HG||(HG={}));var m=B$.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),q0=($)=>{switch(typeof $){case"undefined":return m.undefined;case"string":return m.string;case"number":return Number.isNaN($)?m.nan:m.number;case"boolean":return m.boolean;case"function":return m.function;case"bigint":return m.bigint;case"symbol":return m.symbol;case"object":if(Array.isArray($))return m.array;if($===null)return m.null;if($.then&&typeof $.then==="function"&&$.catch&&typeof $.catch==="function")return m.promise;if(typeof Map<"u"&&$ instanceof Map)return m.map;if(typeof Set<"u"&&$ instanceof Set)return m.set;if(typeof Date<"u"&&$ instanceof Date)return m.date;return m.object;default:return m.unknown}};var h=B$.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]),Sz=($)=>{return JSON.stringify($,null,2).replace(/"([^"]+)":/g,"$1:")};class TJ extends Error{get errors(){return this.issues}constructor($){super();this.issues=[],this.addIssue=(X)=>{this.issues=[...this.issues,X]},this.addIssues=(X=[])=>{this.issues=[...this.issues,...X]};let J=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,J);else this.__proto__=J;this.name="ZodError",this.issues=$}format($){let J=$||function(Y){return Y.message},X={_errors:[]},Q=(Y)=>{for(let G of Y.issues)if(G.code==="invalid_union")G.unionErrors.map(Q);else if(G.code==="invalid_return_type")Q(G.returnTypeError);else if(G.code==="invalid_arguments")Q(G.argumentsError);else if(G.path.length===0)X._errors.push(J(G));else{let W=X,U=0;while(U<G.path.length){let M=G.path[U];if(U!==G.path.length-1)W[M]=W[M]||{_errors:[]};else W[M]=W[M]||{_errors:[]},W[M]._errors.push(J(G));W=W[M],U++}}};return Q(this),X}static assert($){if(!($ instanceof TJ))throw Error(`Not a ZodError: ${$}`)}toString(){return this.message}get message(){return JSON.stringify(this.issues,B$.jsonStringifyReplacer,2)}get isEmpty(){return this.issues.length===0}flatten($=(J)=>J.message){let J={},X=[];for(let Q of this.issues)if(Q.path.length>0){let Y=Q.path[0];J[Y]=J[Y]||[],J[Y].push($(Q))}else X.push($(Q));return{formErrors:X,fieldErrors:J}}get formErrors(){return this.flatten()}}TJ.create=($)=>{return new TJ($)};var Iz=($,J)=>{let X;switch($.code){case h.invalid_type:if($.received===m.undefined)X="Required";else X=`Expected ${$.expected}, received ${$.received}`;break;case h.invalid_literal:X=`Invalid literal value, expected ${JSON.stringify($.expected,B$.jsonStringifyReplacer)}`;break;case h.unrecognized_keys:X=`Unrecognized key(s) in object: ${B$.joinValues($.keys,", ")}`;break;case h.invalid_union:X="Invalid input";break;case h.invalid_union_discriminator:X=`Invalid discriminator value. Expected ${B$.joinValues($.options)}`;break;case h.invalid_enum_value:X=`Invalid enum value. Expected ${B$.joinValues($.options)}, received '${$.received}'`;break;case h.invalid_arguments:X="Invalid function arguments";break;case h.invalid_return_type:X="Invalid function return type";break;case h.invalid_date:X="Invalid date";break;case h.invalid_string:if(typeof $.validation==="object")if("includes"in $.validation){if(X=`Invalid input: must include "${$.validation.includes}"`,typeof $.validation.position==="number")X=`${X} at one or more positions greater than or equal to ${$.validation.position}`}else if("startsWith"in $.validation)X=`Invalid input: must start with "${$.validation.startsWith}"`;else if("endsWith"in $.validation)X=`Invalid input: must end with "${$.validation.endsWith}"`;else B$.assertNever($.validation);else if($.validation!=="regex")X=`Invalid ${$.validation}`;else X="Invalid";break;case h.too_small:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at least":"more than"} ${$.minimum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at least":"over"} ${$.minimum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="bigint")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${new Date(Number($.minimum))}`;else X="Invalid input";break;case h.too_big:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at most":"less than"} ${$.maximum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at most":"under"} ${$.maximum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="bigint")X=`BigInt must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly":$.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number($.maximum))}`;else X="Invalid input";break;case h.custom:X="Invalid input";break;case h.invalid_intersection_types:X="Intersection results could not be merged";break;case h.not_multiple_of:X=`Number must be a multiple of ${$.multipleOf}`;break;case h.not_finite:X="Number must be finite";break;default:X=J.defaultError,B$.assertNever($)}return{message:X}},T0=Iz;var MU=T0;function Cz($){MU=$}function rQ(){return MU}var QY=($)=>{let{data:J,path:X,errorMaps:Q,issueData:Y}=$,G=[...X,...Y.path||[]],W={...Y,path:G};if(Y.message!==void 0)return{...Y,path:G,message:Y.message};let U="",M=Q.filter((O)=>!!O).slice().reverse();for(let O of M)U=O(W,{data:J,defaultError:U}).message;return{...Y,path:G,message:U}},wz=[];function c($,J){let X=rQ(),Q=QY({issueData:J,data:$.data,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,X,X===T0?void 0:T0].filter((Y)=>!!Y)});$.common.issues.push(Q)}class EJ{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray($,J){let X=[];for(let Q of J){if(Q.status==="aborted")return W$;if(Q.status==="dirty")$.dirty();X.push(Q.value)}return{status:$.value,value:X}}static async mergeObjectAsync($,J){let X=[];for(let Q of J){let Y=await Q.key,G=await Q.value;X.push({key:Y,value:G})}return EJ.mergeObjectSync($,X)}static mergeObjectSync($,J){let X={};for(let Q of J){let{key:Y,value:G}=Q;if(Y.status==="aborted")return W$;if(G.status==="aborted")return W$;if(Y.status==="dirty")$.dirty();if(G.status==="dirty")$.dirty();if(Y.value!=="__proto__"&&(typeof G.value<"u"||Q.alwaysSet))X[Y.value]=G.value}return{status:$.value,value:X}}}var W$=Object.freeze({status:"aborted"}),FQ=($)=>({status:"dirty",value:$}),FJ=($)=>({status:"valid",value:$}),f9=($)=>$.status==="aborted",y9=($)=>$.status==="dirty",i0=($)=>$.status==="valid",tQ=($)=>typeof Promise<"u"&&$ instanceof Promise;var t;(function($){$.errToObj=(J)=>typeof J==="string"?{message:J}:J||{},$.toString=(J)=>typeof J==="string"?J:J?.message})(t||(t={}));class tJ{constructor($,J,X,Q){this._cachedPath=[],this.parent=$,this.data=J,this._path=X,this._key=Q}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var OU=($,J)=>{if(i0(J))return{success:!0,data:J.value};else{if(!$.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let X=new TJ($.common.issues);return this._error=X,this._error}}}};function K$($){if(!$)return{};let{errorMap:J,invalid_type_error:X,required_error:Q,description:Y}=$;if(J&&(X||Q))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if(J)return{errorMap:J,description:Y};return{errorMap:(W,U)=>{let{message:M}=$;if(W.code==="invalid_enum_value")return{message:M??U.defaultError};if(typeof U.data>"u")return{message:M??Q??U.defaultError};if(W.code!=="invalid_type")return{message:U.defaultError};return{message:M??X??U.defaultError}},description:Y}}class N${get description(){return this._def.description}_getType($){return q0($.data)}_getOrReturnCtx($,J){return J||{common:$.parent.common,data:$.data,parsedType:q0($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}_processInputParams($){return{status:new EJ,ctx:{common:$.parent.common,data:$.data,parsedType:q0($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}}_parseSync($){let J=this._parse($);if(tQ(J))throw Error("Synchronous parse encountered promise.");return J}_parseAsync($){let J=this._parse($);return Promise.resolve(J)}parse($,J){let X=this.safeParse($,J);if(X.success)return X.data;throw X.error}safeParse($,J){let X={common:{issues:[],async:J?.async??!1,contextualErrorMap:J?.errorMap},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:q0($)},Q=this._parseSync({data:$,path:X.path,parent:X});return OU(X,Q)}"~validate"($){let J={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:q0($)};if(!this["~standard"].async)try{let X=this._parseSync({data:$,path:[],parent:J});return i0(X)?{value:X.value}:{issues:J.common.issues}}catch(X){if(X?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;J.common={issues:[],async:!0}}return this._parseAsync({data:$,path:[],parent:J}).then((X)=>i0(X)?{value:X.value}:{issues:J.common.issues})}async parseAsync($,J){let X=await this.safeParseAsync($,J);if(X.success)return X.data;throw X.error}async safeParseAsync($,J){let X={common:{issues:[],contextualErrorMap:J?.errorMap,async:!0},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:q0($)},Q=this._parse({data:$,path:X.path,parent:X}),Y=await(tQ(Q)?Q:Promise.resolve(Q));return OU(X,Y)}refine($,J){let X=(Q)=>{if(typeof J==="string"||typeof J>"u")return{message:J};else if(typeof J==="function")return J(Q);else return J};return this._refinement((Q,Y)=>{let G=$(Q),W=()=>Y.addIssue({code:h.custom,...X(Q)});if(typeof Promise<"u"&&G instanceof Promise)return G.then((U)=>{if(!U)return W(),!1;else return!0});if(!G)return W(),!1;else return!0})}refinement($,J){return this._refinement((X,Q)=>{if(!$(X))return Q.addIssue(typeof J==="function"?J(X,Q):J),!1;else return!0})}_refinement($){return new eJ({schema:this,typeName:M$.ZodEffects,effect:{type:"refinement",refinement:$}})}superRefine($){return this._refinement($)}constructor($){this.spa=this.safeParseAsync,this._def=$,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:(J)=>this["~validate"](J)}}optional(){return rJ.create(this,this._def)}nullable(){return I0.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return sJ.create(this)}promise(){return RQ.create(this,this._def)}or($){return YX.create([this,$],this._def)}and($){return GX.create(this,$,this._def)}transform($){return new eJ({...K$(this._def),schema:this,typeName:M$.ZodEffects,effect:{type:"transform",transform:$}})}default($){let J=typeof $==="function"?$:()=>$;return new OX({...K$(this._def),innerType:this,defaultValue:J,typeName:M$.ZodDefault})}brand(){return new h9({typeName:M$.ZodBranded,type:this,...K$(this._def)})}catch($){let J=typeof $==="function"?$:()=>$;return new VX({...K$(this._def),innerType:this,catchValue:J,typeName:M$.ZodCatch})}describe($){return new this.constructor({...this._def,description:$})}pipe($){return MY.create(this,$)}readonly(){return HX.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var Pz=/^c[^\s-]{8,}$/i,_z=/^[0-9a-z]+$/,xz=/^[0-9A-HJKMNP-TV-Z]{26}$/i,vz=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,kz=/^[a-z0-9_-]{21}$/i,fz=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,yz=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,bz=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,hz="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",qG,uz=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,gz=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,mz=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,lz=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,pz=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,dz=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,HU="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",cz=new RegExp(`^${HU}$`);function qU($){let J="[0-5]\\d";if($.precision)J=`${J}\\.\\d{${$.precision}}`;else if($.precision==null)J=`${J}(\\.\\d+)?`;let X=$.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${J})${X}`}function nz($){return new RegExp(`^${qU($)}$`)}function KU($){let J=`${HU}T${qU($)}`,X=[];if(X.push($.local?"Z?":"Z"),$.offset)X.push("([+-]\\d{2}:?\\d{2})");return J=`${J}(${X.join("|")})`,new RegExp(`^${J}$`)}function iz($,J){if((J==="v4"||!J)&&uz.test($))return!0;if((J==="v6"||!J)&&mz.test($))return!0;return!1}function oz($,J){if(!fz.test($))return!1;try{let[X]=$.split(".");if(!X)return!1;let Q=X.replace(/-/g,"+").replace(/_/g,"/").padEnd(X.length+(4-X.length%4)%4,"="),Y=JSON.parse(atob(Q));if(typeof Y!=="object"||Y===null)return!1;if("typ"in Y&&Y?.typ!=="JWT")return!1;if(!Y.alg)return!1;if(J&&Y.alg!==J)return!1;return!0}catch{return!1}}function az($,J){if((J==="v4"||!J)&&gz.test($))return!0;if((J==="v6"||!J)&&lz.test($))return!0;return!1}class aJ extends N${_parse($){if(this._def.coerce)$.data=String($.data);if(this._getType($)!==m.string){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.string,received:Y.parsedType}),W$}let X=new EJ,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.length<Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="max"){if($.data.length>Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="length"){let G=$.data.length>Y.value,W=$.data.length<Y.value;if(G||W){if(Q=this._getOrReturnCtx($,Q),G)c(Q,{code:h.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});else if(W)c(Q,{code:h.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});X.dirty()}}else if(Y.kind==="email"){if(!bz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"email",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="emoji"){if(!qG)qG=new RegExp(hz,"u");if(!qG.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"emoji",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="uuid"){if(!vz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"uuid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="nanoid"){if(!kz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"nanoid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid"){if(!Pz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cuid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid2"){if(!_z.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cuid2",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ulid"){if(!xz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"ulid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="url")try{new URL($.data)}catch{Q=this._getOrReturnCtx($,Q),c(Q,{validation:"url",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="regex"){if(Y.regex.lastIndex=0,!Y.regex.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"regex",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="trim")$.data=$.data.trim();else if(Y.kind==="includes"){if(!$.data.includes(Y.value,Y.position))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{includes:Y.value,position:Y.position},message:Y.message}),X.dirty()}else if(Y.kind==="toLowerCase")$.data=$.data.toLowerCase();else if(Y.kind==="toUpperCase")$.data=$.data.toUpperCase();else if(Y.kind==="startsWith"){if(!$.data.startsWith(Y.value))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{startsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="endsWith"){if(!$.data.endsWith(Y.value))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{endsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="datetime"){if(!KU(Y).test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"datetime",message:Y.message}),X.dirty()}else if(Y.kind==="date"){if(!cz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"date",message:Y.message}),X.dirty()}else if(Y.kind==="time"){if(!nz(Y).test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"time",message:Y.message}),X.dirty()}else if(Y.kind==="duration"){if(!yz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"duration",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ip"){if(!iz($.data,Y.version))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"ip",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="jwt"){if(!oz($.data,Y.alg))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"jwt",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cidr"){if(!az($.data,Y.version))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cidr",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64"){if(!pz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"base64",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64url"){if(!dz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"base64url",code:h.invalid_string,message:Y.message}),X.dirty()}else B$.assertNever(Y);return{status:X.value,value:$.data}}_regex($,J,X){return this.refinement((Q)=>$.test(Q),{validation:J,code:h.invalid_string,...t.errToObj(X)})}_addCheck($){return new aJ({...this._def,checks:[...this._def.checks,$]})}email($){return this._addCheck({kind:"email",...t.errToObj($)})}url($){return this._addCheck({kind:"url",...t.errToObj($)})}emoji($){return this._addCheck({kind:"emoji",...t.errToObj($)})}uuid($){return this._addCheck({kind:"uuid",...t.errToObj($)})}nanoid($){return this._addCheck({kind:"nanoid",...t.errToObj($)})}cuid($){return this._addCheck({kind:"cuid",...t.errToObj($)})}cuid2($){return this._addCheck({kind:"cuid2",...t.errToObj($)})}ulid($){return this._addCheck({kind:"ulid",...t.errToObj($)})}base64($){return this._addCheck({kind:"base64",...t.errToObj($)})}base64url($){return this._addCheck({kind:"base64url",...t.errToObj($)})}jwt($){return this._addCheck({kind:"jwt",...t.errToObj($)})}ip($){return this._addCheck({kind:"ip",...t.errToObj($)})}cidr($){return this._addCheck({kind:"cidr",...t.errToObj($)})}datetime($){if(typeof $==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:$});return this._addCheck({kind:"datetime",precision:typeof $?.precision>"u"?null:$?.precision,offset:$?.offset??!1,local:$?.local??!1,...t.errToObj($?.message)})}date($){return this._addCheck({kind:"date",message:$})}time($){if(typeof $==="string")return this._addCheck({kind:"time",precision:null,message:$});return this._addCheck({kind:"time",precision:typeof $?.precision>"u"?null:$?.precision,...t.errToObj($?.message)})}duration($){return this._addCheck({kind:"duration",...t.errToObj($)})}regex($,J){return this._addCheck({kind:"regex",regex:$,...t.errToObj(J)})}includes($,J){return this._addCheck({kind:"includes",value:$,position:J?.position,...t.errToObj(J?.message)})}startsWith($,J){return this._addCheck({kind:"startsWith",value:$,...t.errToObj(J)})}endsWith($,J){return this._addCheck({kind:"endsWith",value:$,...t.errToObj(J)})}min($,J){return this._addCheck({kind:"min",value:$,...t.errToObj(J)})}max($,J){return this._addCheck({kind:"max",value:$,...t.errToObj(J)})}length($,J){return this._addCheck({kind:"length",value:$,...t.errToObj(J)})}nonempty($){return this.min(1,t.errToObj($))}trim(){return new aJ({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new aJ({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new aJ({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find(($)=>$.kind==="datetime")}get isDate(){return!!this._def.checks.find(($)=>$.kind==="date")}get isTime(){return!!this._def.checks.find(($)=>$.kind==="time")}get isDuration(){return!!this._def.checks.find(($)=>$.kind==="duration")}get isEmail(){return!!this._def.checks.find(($)=>$.kind==="email")}get isURL(){return!!this._def.checks.find(($)=>$.kind==="url")}get isEmoji(){return!!this._def.checks.find(($)=>$.kind==="emoji")}get isUUID(){return!!this._def.checks.find(($)=>$.kind==="uuid")}get isNANOID(){return!!this._def.checks.find(($)=>$.kind==="nanoid")}get isCUID(){return!!this._def.checks.find(($)=>$.kind==="cuid")}get isCUID2(){return!!this._def.checks.find(($)=>$.kind==="cuid2")}get isULID(){return!!this._def.checks.find(($)=>$.kind==="ulid")}get isIP(){return!!this._def.checks.find(($)=>$.kind==="ip")}get isCIDR(){return!!this._def.checks.find(($)=>$.kind==="cidr")}get isBase64(){return!!this._def.checks.find(($)=>$.kind==="base64")}get isBase64url(){return!!this._def.checks.find(($)=>$.kind==="base64url")}get minLength(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxLength(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}aJ.create=($)=>{return new aJ({checks:[],typeName:M$.ZodString,coerce:$?.coerce??!1,...K$($)})};function sz($,J){let X=($.toString().split(".")[1]||"").length,Q=(J.toString().split(".")[1]||"").length,Y=X>Q?X:Q,G=Number.parseInt($.toFixed(Y).replace(".","")),W=Number.parseInt(J.toFixed(Y).replace(".",""));return G%W/10**Y}class a0 extends N${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse($){if(this._def.coerce)$.data=Number($.data);if(this._getType($)!==m.number){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.number,received:Y.parsedType}),W$}let X=void 0,Q=new EJ;for(let Y of this._def.checks)if(Y.kind==="int"){if(!B$.isInteger($.data))X=this._getOrReturnCtx($,X),c(X,{code:h.invalid_type,expected:"integer",received:"float",message:Y.message}),Q.dirty()}else if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_small,minimum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_big,maximum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if(sz($.data,Y.value)!==0)X=this._getOrReturnCtx($,X),c(X,{code:h.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else if(Y.kind==="finite"){if(!Number.isFinite($.data))X=this._getOrReturnCtx($,X),c(X,{code:h.not_finite,message:Y.message}),Q.dirty()}else B$.assertNever(Y);return{status:Q.value,value:$.data}}gte($,J){return this.setLimit("min",$,!0,t.toString(J))}gt($,J){return this.setLimit("min",$,!1,t.toString(J))}lte($,J){return this.setLimit("max",$,!0,t.toString(J))}lt($,J){return this.setLimit("max",$,!1,t.toString(J))}setLimit($,J,X,Q){return new a0({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:t.toString(Q)}]})}_addCheck($){return new a0({...this._def,checks:[...this._def.checks,$]})}int($){return this._addCheck({kind:"int",message:t.toString($)})}positive($){return this._addCheck({kind:"min",value:0,inclusive:!1,message:t.toString($)})}negative($){return this._addCheck({kind:"max",value:0,inclusive:!1,message:t.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:0,inclusive:!0,message:t.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:0,inclusive:!0,message:t.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:t.toString(J)})}finite($){return this._addCheck({kind:"finite",message:t.toString($)})}safe($){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:t.toString($)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:t.toString($)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}get isInt(){return!!this._def.checks.find(($)=>$.kind==="int"||$.kind==="multipleOf"&&B$.isInteger($.value))}get isFinite(){let $=null,J=null;for(let X of this._def.checks)if(X.kind==="finite"||X.kind==="int"||X.kind==="multipleOf")return!0;else if(X.kind==="min"){if(J===null||X.value>J)J=X.value}else if(X.kind==="max"){if($===null||X.value<$)$=X.value}return Number.isFinite(J)&&Number.isFinite($)}}a0.create=($)=>{return new a0({checks:[],typeName:M$.ZodNumber,coerce:$?.coerce||!1,...K$($)})};class s0 extends N${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse($){if(this._def.coerce)try{$.data=BigInt($.data)}catch{return this._getInvalidInput($)}if(this._getType($)!==m.bigint)return this._getInvalidInput($);let X=void 0,Q=new EJ;for(let Y of this._def.checks)if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_small,type:"bigint",minimum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_big,type:"bigint",maximum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if($.data%Y.value!==BigInt(0))X=this._getOrReturnCtx($,X),c(X,{code:h.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else B$.assertNever(Y);return{status:Q.value,value:$.data}}_getInvalidInput($){let J=this._getOrReturnCtx($);return c(J,{code:h.invalid_type,expected:m.bigint,received:J.parsedType}),W$}gte($,J){return this.setLimit("min",$,!0,t.toString(J))}gt($,J){return this.setLimit("min",$,!1,t.toString(J))}lte($,J){return this.setLimit("max",$,!0,t.toString(J))}lt($,J){return this.setLimit("max",$,!1,t.toString(J))}setLimit($,J,X,Q){return new s0({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:t.toString(Q)}]})}_addCheck($){return new s0({...this._def,checks:[...this._def.checks,$]})}positive($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:t.toString($)})}negative($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:t.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:t.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:t.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:t.toString(J)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}s0.create=($)=>{return new s0({checks:[],typeName:M$.ZodBigInt,coerce:$?.coerce??!1,...K$($)})};class JX extends N${_parse($){if(this._def.coerce)$.data=Boolean($.data);if(this._getType($)!==m.boolean){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.boolean,received:X.parsedType}),W$}return FJ($.data)}}JX.create=($)=>{return new JX({typeName:M$.ZodBoolean,coerce:$?.coerce||!1,...K$($)})};class NQ extends N${_parse($){if(this._def.coerce)$.data=new Date($.data);if(this._getType($)!==m.date){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.date,received:Y.parsedType}),W$}if(Number.isNaN($.data.getTime())){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_date}),W$}let X=new EJ,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.getTime()<Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_small,message:Y.message,inclusive:!0,exact:!1,minimum:Y.value,type:"date"}),X.dirty()}else if(Y.kind==="max"){if($.data.getTime()>Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_big,message:Y.message,inclusive:!0,exact:!1,maximum:Y.value,type:"date"}),X.dirty()}else B$.assertNever(Y);return{status:X.value,value:new Date($.data.getTime())}}_addCheck($){return new NQ({...this._def,checks:[...this._def.checks,$]})}min($,J){return this._addCheck({kind:"min",value:$.getTime(),message:t.toString(J)})}max($,J){return this._addCheck({kind:"max",value:$.getTime(),message:t.toString(J)})}get minDate(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $!=null?new Date($):null}get maxDate(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $!=null?new Date($):null}}NQ.create=($)=>{return new NQ({checks:[],coerce:$?.coerce||!1,typeName:M$.ZodDate,...K$($)})};class XY extends N${_parse($){if(this._getType($)!==m.symbol){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.symbol,received:X.parsedType}),W$}return FJ($.data)}}XY.create=($)=>{return new XY({typeName:M$.ZodSymbol,...K$($)})};class QX extends N${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.undefined,received:X.parsedType}),W$}return FJ($.data)}}QX.create=($)=>{return new QX({typeName:M$.ZodUndefined,...K$($)})};class XX extends N${_parse($){if(this._getType($)!==m.null){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.null,received:X.parsedType}),W$}return FJ($.data)}}XX.create=($)=>{return new XX({typeName:M$.ZodNull,...K$($)})};class LQ extends N${constructor(){super(...arguments);this._any=!0}_parse($){return FJ($.data)}}LQ.create=($)=>{return new LQ({typeName:M$.ZodAny,...K$($)})};class o0 extends N${constructor(){super(...arguments);this._unknown=!0}_parse($){return FJ($.data)}}o0.create=($)=>{return new o0({typeName:M$.ZodUnknown,...K$($)})};class K0 extends N${_parse($){let J=this._getOrReturnCtx($);return c(J,{code:h.invalid_type,expected:m.never,received:J.parsedType}),W$}}K0.create=($)=>{return new K0({typeName:M$.ZodNever,...K$($)})};class YY extends N${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.void,received:X.parsedType}),W$}return FJ($.data)}}YY.create=($)=>{return new YY({typeName:M$.ZodVoid,...K$($)})};class sJ extends N${_parse($){let{ctx:J,status:X}=this._processInputParams($),Q=this._def;if(J.parsedType!==m.array)return c(J,{code:h.invalid_type,expected:m.array,received:J.parsedType}),W$;if(Q.exactLength!==null){let G=J.data.length>Q.exactLength.value,W=J.data.length<Q.exactLength.value;if(G||W)c(J,{code:G?h.too_big:h.too_small,minimum:W?Q.exactLength.value:void 0,maximum:G?Q.exactLength.value:void 0,type:"array",inclusive:!0,exact:!0,message:Q.exactLength.message}),X.dirty()}if(Q.minLength!==null){if(J.data.length<Q.minLength.value)c(J,{code:h.too_small,minimum:Q.minLength.value,type:"array",inclusive:!0,exact:!1,message:Q.minLength.message}),X.dirty()}if(Q.maxLength!==null){if(J.data.length>Q.maxLength.value)c(J,{code:h.too_big,maximum:Q.maxLength.value,type:"array",inclusive:!0,exact:!1,message:Q.maxLength.message}),X.dirty()}if(J.common.async)return Promise.all([...J.data].map((G,W)=>{return Q.type._parseAsync(new tJ(J,G,J.path,W))})).then((G)=>{return EJ.mergeArray(X,G)});let Y=[...J.data].map((G,W)=>{return Q.type._parseSync(new tJ(J,G,J.path,W))});return EJ.mergeArray(X,Y)}get element(){return this._def.type}min($,J){return new sJ({...this._def,minLength:{value:$,message:t.toString(J)}})}max($,J){return new sJ({...this._def,maxLength:{value:$,message:t.toString(J)}})}length($,J){return new sJ({...this._def,exactLength:{value:$,message:t.toString(J)}})}nonempty($){return this.min(1,$)}}sJ.create=($,J)=>{return new sJ({type:$,minLength:null,maxLength:null,exactLength:null,typeName:M$.ZodArray,...K$(J)})};function eQ($){if($ instanceof a$){let J={};for(let X in $.shape){let Q=$.shape[X];J[X]=rJ.create(eQ(Q))}return new a$({...$._def,shape:()=>J})}else if($ instanceof sJ)return new sJ({...$._def,type:eQ($.element)});else if($ instanceof rJ)return rJ.create(eQ($.unwrap()));else if($ instanceof I0)return I0.create(eQ($.unwrap()));else if($ instanceof z0)return z0.create($.items.map((J)=>eQ(J)));else return $}class a$ extends N${constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let $=this._def.shape(),J=B$.objectKeys($);return this._cached={shape:$,keys:J},this._cached}_parse($){if(this._getType($)!==m.object){let M=this._getOrReturnCtx($);return c(M,{code:h.invalid_type,expected:m.object,received:M.parsedType}),W$}let{status:X,ctx:Q}=this._processInputParams($),{shape:Y,keys:G}=this._getCached(),W=[];if(!(this._def.catchall instanceof K0&&this._def.unknownKeys==="strip")){for(let M in Q.data)if(!G.includes(M))W.push(M)}let U=[];for(let M of G){let O=Y[M],V=Q.data[M];U.push({key:{status:"valid",value:M},value:O._parse(new tJ(Q,V,Q.path,M)),alwaysSet:M in Q.data})}if(this._def.catchall instanceof K0){let M=this._def.unknownKeys;if(M==="passthrough")for(let O of W)U.push({key:{status:"valid",value:O},value:{status:"valid",value:Q.data[O]}});else if(M==="strict"){if(W.length>0)c(Q,{code:h.unrecognized_keys,keys:W}),X.dirty()}else if(M==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let M=this._def.catchall;for(let O of W){let V=Q.data[O];U.push({key:{status:"valid",value:O},value:M._parse(new tJ(Q,V,Q.path,O)),alwaysSet:O in Q.data})}}if(Q.common.async)return Promise.resolve().then(async()=>{let M=[];for(let O of U){let V=await O.key,H=await O.value;M.push({key:V,value:H,alwaysSet:O.alwaysSet})}return M}).then((M)=>{return EJ.mergeObjectSync(X,M)});else return EJ.mergeObjectSync(X,U)}get shape(){return this._def.shape()}strict($){return t.errToObj,new a$({...this._def,unknownKeys:"strict",...$!==void 0?{errorMap:(J,X)=>{let Q=this._def.errorMap?.(J,X).message??X.defaultError;if(J.code==="unrecognized_keys")return{message:t.errToObj($).message??Q};return{message:Q}}}:{}})}strip(){return new a$({...this._def,unknownKeys:"strip"})}passthrough(){return new a$({...this._def,unknownKeys:"passthrough"})}extend($){return new a$({...this._def,shape:()=>({...this._def.shape(),...$})})}merge($){return new a$({unknownKeys:$._def.unknownKeys,catchall:$._def.catchall,shape:()=>({...this._def.shape(),...$._def.shape()}),typeName:M$.ZodObject})}setKey($,J){return this.augment({[$]:J})}catchall($){return new a$({...this._def,catchall:$})}pick($){let J={};for(let X of B$.objectKeys($))if($[X]&&this.shape[X])J[X]=this.shape[X];return new a$({...this._def,shape:()=>J})}omit($){let J={};for(let X of B$.objectKeys(this.shape))if(!$[X])J[X]=this.shape[X];return new a$({...this._def,shape:()=>J})}deepPartial(){return eQ(this)}partial($){let J={};for(let X of B$.objectKeys(this.shape)){let Q=this.shape[X];if($&&!$[X])J[X]=Q;else J[X]=Q.optional()}return new a$({...this._def,shape:()=>J})}required($){let J={};for(let X of B$.objectKeys(this.shape))if($&&!$[X])J[X]=this.shape[X];else{let Y=this.shape[X];while(Y instanceof rJ)Y=Y._def.innerType;J[X]=Y}return new a$({...this._def,shape:()=>J})}keyof(){return zU(B$.objectKeys(this.shape))}}a$.create=($,J)=>{return new a$({shape:()=>$,unknownKeys:"strip",catchall:K0.create(),typeName:M$.ZodObject,...K$(J)})};a$.strictCreate=($,J)=>{return new a$({shape:()=>$,unknownKeys:"strict",catchall:K0.create(),typeName:M$.ZodObject,...K$(J)})};a$.lazycreate=($,J)=>{return new a$({shape:$,unknownKeys:"strip",catchall:K0.create(),typeName:M$.ZodObject,...K$(J)})};class YX extends N${_parse($){let{ctx:J}=this._processInputParams($),X=this._def.options;function Q(Y){for(let W of Y)if(W.result.status==="valid")return W.result;for(let W of Y)if(W.result.status==="dirty")return J.common.issues.push(...W.ctx.common.issues),W.result;let G=Y.map((W)=>new TJ(W.ctx.common.issues));return c(J,{code:h.invalid_union,unionErrors:G}),W$}if(J.common.async)return Promise.all(X.map(async(Y)=>{let G={...J,common:{...J.common,issues:[]},parent:null};return{result:await Y._parseAsync({data:J.data,path:J.path,parent:G}),ctx:G}})).then(Q);else{let Y=void 0,G=[];for(let U of X){let M={...J,common:{...J.common,issues:[]},parent:null},O=U._parseSync({data:J.data,path:J.path,parent:M});if(O.status==="valid")return O;else if(O.status==="dirty"&&!Y)Y={result:O,ctx:M};if(M.common.issues.length)G.push(M.common.issues)}if(Y)return J.common.issues.push(...Y.ctx.common.issues),Y.result;let W=G.map((U)=>new TJ(U));return c(J,{code:h.invalid_union,unionErrors:W}),W$}}get options(){return this._def.options}}YX.create=($,J)=>{return new YX({options:$,typeName:M$.ZodUnion,...K$(J)})};var S0=($)=>{if($ instanceof WX)return S0($.schema);else if($ instanceof eJ)return S0($.innerType());else if($ instanceof UX)return[$.value];else if($ instanceof r0)return $.options;else if($ instanceof MX)return B$.objectValues($.enum);else if($ instanceof OX)return S0($._def.innerType);else if($ instanceof QX)return[void 0];else if($ instanceof XX)return[null];else if($ instanceof rJ)return[void 0,...S0($.unwrap())];else if($ instanceof I0)return[null,...S0($.unwrap())];else if($ instanceof h9)return S0($.unwrap());else if($ instanceof HX)return S0($.unwrap());else if($ instanceof VX)return S0($._def.innerType);else return[]};class b9 extends N${_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.object)return c(J,{code:h.invalid_type,expected:m.object,received:J.parsedType}),W$;let X=this.discriminator,Q=J.data[X],Y=this.optionsMap.get(Q);if(!Y)return c(J,{code:h.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[X]}),W$;if(J.common.async)return Y._parseAsync({data:J.data,path:J.path,parent:J});else return Y._parseSync({data:J.data,path:J.path,parent:J})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create($,J,X){let Q=new Map;for(let Y of J){let G=S0(Y.shape[$]);if(!G.length)throw Error(`A discriminator value for key \`${$}\` could not be extracted from all schema options`);for(let W of G){if(Q.has(W))throw Error(`Discriminator property ${String($)} has duplicate value ${String(W)}`);Q.set(W,Y)}}return new b9({typeName:M$.ZodDiscriminatedUnion,discriminator:$,options:J,optionsMap:Q,...K$(X)})}}function KG($,J){let X=q0($),Q=q0(J);if($===J)return{valid:!0,data:$};else if(X===m.object&&Q===m.object){let Y=B$.objectKeys(J),G=B$.objectKeys($).filter((U)=>Y.indexOf(U)!==-1),W={...$,...J};for(let U of G){let M=KG($[U],J[U]);if(!M.valid)return{valid:!1};W[U]=M.data}return{valid:!0,data:W}}else if(X===m.array&&Q===m.array){if($.length!==J.length)return{valid:!1};let Y=[];for(let G=0;G<$.length;G++){let W=$[G],U=J[G],M=KG(W,U);if(!M.valid)return{valid:!1};Y.push(M.data)}return{valid:!0,data:Y}}else if(X===m.date&&Q===m.date&&+$===+J)return{valid:!0,data:$};else return{valid:!1}}class GX extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=(Y,G)=>{if(f9(Y)||f9(G))return W$;let W=KG(Y.value,G.value);if(!W.valid)return c(X,{code:h.invalid_intersection_types}),W$;if(y9(Y)||y9(G))J.dirty();return{status:J.value,value:W.data}};if(X.common.async)return Promise.all([this._def.left._parseAsync({data:X.data,path:X.path,parent:X}),this._def.right._parseAsync({data:X.data,path:X.path,parent:X})]).then(([Y,G])=>Q(Y,G));else return Q(this._def.left._parseSync({data:X.data,path:X.path,parent:X}),this._def.right._parseSync({data:X.data,path:X.path,parent:X}))}}GX.create=($,J,X)=>{return new GX({left:$,right:J,typeName:M$.ZodIntersection,...K$(X)})};class z0 extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.array)return c(X,{code:h.invalid_type,expected:m.array,received:X.parsedType}),W$;if(X.data.length<this._def.items.length)return c(X,{code:h.too_small,minimum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),W$;if(!this._def.rest&&X.data.length>this._def.items.length)c(X,{code:h.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),J.dirty();let Y=[...X.data].map((G,W)=>{let U=this._def.items[W]||this._def.rest;if(!U)return null;return U._parse(new tJ(X,G,X.path,W))}).filter((G)=>!!G);if(X.common.async)return Promise.all(Y).then((G)=>{return EJ.mergeArray(J,G)});else return EJ.mergeArray(J,Y)}get items(){return this._def.items}rest($){return new z0({...this._def,rest:$})}}z0.create=($,J)=>{if(!Array.isArray($))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new z0({items:$,typeName:M$.ZodTuple,rest:null,...K$(J)})};class GY extends N${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.object)return c(X,{code:h.invalid_type,expected:m.object,received:X.parsedType}),W$;let Q=[],Y=this._def.keyType,G=this._def.valueType;for(let W in X.data)Q.push({key:Y._parse(new tJ(X,W,X.path,W)),value:G._parse(new tJ(X,X.data[W],X.path,W)),alwaysSet:W in X.data});if(X.common.async)return EJ.mergeObjectAsync(J,Q);else return EJ.mergeObjectSync(J,Q)}get element(){return this._def.valueType}static create($,J,X){if(J instanceof N$)return new GY({keyType:$,valueType:J,typeName:M$.ZodRecord,...K$(X)});return new GY({keyType:aJ.create(),valueType:$,typeName:M$.ZodRecord,...K$(J)})}}class WY extends N${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.map)return c(X,{code:h.invalid_type,expected:m.map,received:X.parsedType}),W$;let Q=this._def.keyType,Y=this._def.valueType,G=[...X.data.entries()].map(([W,U],M)=>{return{key:Q._parse(new tJ(X,W,X.path,[M,"key"])),value:Y._parse(new tJ(X,U,X.path,[M,"value"]))}});if(X.common.async){let W=new Map;return Promise.resolve().then(async()=>{for(let U of G){let M=await U.key,O=await U.value;if(M.status==="aborted"||O.status==="aborted")return W$;if(M.status==="dirty"||O.status==="dirty")J.dirty();W.set(M.value,O.value)}return{status:J.value,value:W}})}else{let W=new Map;for(let U of G){let{key:M,value:O}=U;if(M.status==="aborted"||O.status==="aborted")return W$;if(M.status==="dirty"||O.status==="dirty")J.dirty();W.set(M.value,O.value)}return{status:J.value,value:W}}}}WY.create=($,J,X)=>{return new WY({valueType:J,keyType:$,typeName:M$.ZodMap,...K$(X)})};class AQ extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.set)return c(X,{code:h.invalid_type,expected:m.set,received:X.parsedType}),W$;let Q=this._def;if(Q.minSize!==null){if(X.data.size<Q.minSize.value)c(X,{code:h.too_small,minimum:Q.minSize.value,type:"set",inclusive:!0,exact:!1,message:Q.minSize.message}),J.dirty()}if(Q.maxSize!==null){if(X.data.size>Q.maxSize.value)c(X,{code:h.too_big,maximum:Q.maxSize.value,type:"set",inclusive:!0,exact:!1,message:Q.maxSize.message}),J.dirty()}let Y=this._def.valueType;function G(U){let M=new Set;for(let O of U){if(O.status==="aborted")return W$;if(O.status==="dirty")J.dirty();M.add(O.value)}return{status:J.value,value:M}}let W=[...X.data.values()].map((U,M)=>Y._parse(new tJ(X,U,X.path,M)));if(X.common.async)return Promise.all(W).then((U)=>G(U));else return G(W)}min($,J){return new AQ({...this._def,minSize:{value:$,message:t.toString(J)}})}max($,J){return new AQ({...this._def,maxSize:{value:$,message:t.toString(J)}})}size($,J){return this.min($,J).max($,J)}nonempty($){return this.min(1,$)}}AQ.create=($,J)=>{return new AQ({valueType:$,minSize:null,maxSize:null,typeName:M$.ZodSet,...K$(J)})};class $X extends N${constructor(){super(...arguments);this.validate=this.implement}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.function)return c(J,{code:h.invalid_type,expected:m.function,received:J.parsedType}),W$;function X(W,U){return QY({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,rQ(),T0].filter((M)=>!!M),issueData:{code:h.invalid_arguments,argumentsError:U}})}function Q(W,U){return QY({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,rQ(),T0].filter((M)=>!!M),issueData:{code:h.invalid_return_type,returnTypeError:U}})}let Y={errorMap:J.common.contextualErrorMap},G=J.data;if(this._def.returns instanceof RQ){let W=this;return FJ(async function(...U){let M=new TJ([]),O=await W._def.args.parseAsync(U,Y).catch((q)=>{throw M.addIssue(X(U,q)),M}),V=await Reflect.apply(G,this,O);return await W._def.returns._def.type.parseAsync(V,Y).catch((q)=>{throw M.addIssue(Q(V,q)),M})})}else{let W=this;return FJ(function(...U){let M=W._def.args.safeParse(U,Y);if(!M.success)throw new TJ([X(U,M.error)]);let O=Reflect.apply(G,this,M.data),V=W._def.returns.safeParse(O,Y);if(!V.success)throw new TJ([Q(O,V.error)]);return V.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(...$){return new $X({...this._def,args:z0.create($).rest(o0.create())})}returns($){return new $X({...this._def,returns:$})}implement($){return this.parse($)}strictImplement($){return this.parse($)}static create($,J,X){return new $X({args:$?$:z0.create([]).rest(o0.create()),returns:J||o0.create(),typeName:M$.ZodFunction,...K$(X)})}}class WX extends N${get schema(){return this._def.getter()}_parse($){let{ctx:J}=this._processInputParams($);return this._def.getter()._parse({data:J.data,path:J.path,parent:J})}}WX.create=($,J)=>{return new WX({getter:$,typeName:M$.ZodLazy,...K$(J)})};class UX extends N${_parse($){if($.data!==this._def.value){let J=this._getOrReturnCtx($);return c(J,{received:J.data,code:h.invalid_literal,expected:this._def.value}),W$}return{status:"valid",value:$.data}}get value(){return this._def.value}}UX.create=($,J)=>{return new UX({value:$,typeName:M$.ZodLiteral,...K$(J)})};function zU($,J){return new r0({values:$,typeName:M$.ZodEnum,...K$(J)})}class r0 extends N${_parse($){if(typeof $.data!=="string"){let J=this._getOrReturnCtx($),X=this._def.values;return c(J,{expected:B$.joinValues(X),received:J.parsedType,code:h.invalid_type}),W$}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has($.data)){let J=this._getOrReturnCtx($),X=this._def.values;return c(J,{received:J.data,code:h.invalid_enum_value,options:X}),W$}return FJ($.data)}get options(){return this._def.values}get enum(){let $={};for(let J of this._def.values)$[J]=J;return $}get Values(){let $={};for(let J of this._def.values)$[J]=J;return $}get Enum(){let $={};for(let J of this._def.values)$[J]=J;return $}extract($,J=this._def){return r0.create($,{...this._def,...J})}exclude($,J=this._def){return r0.create(this.options.filter((X)=>!$.includes(X)),{...this._def,...J})}}r0.create=zU;class MX extends N${_parse($){let J=B$.getValidEnumValues(this._def.values),X=this._getOrReturnCtx($);if(X.parsedType!==m.string&&X.parsedType!==m.number){let Q=B$.objectValues(J);return c(X,{expected:B$.joinValues(Q),received:X.parsedType,code:h.invalid_type}),W$}if(!this._cache)this._cache=new Set(B$.getValidEnumValues(this._def.values));if(!this._cache.has($.data)){let Q=B$.objectValues(J);return c(X,{received:X.data,code:h.invalid_enum_value,options:Q}),W$}return FJ($.data)}get enum(){return this._def.values}}MX.create=($,J)=>{return new MX({values:$,typeName:M$.ZodNativeEnum,...K$(J)})};class RQ extends N${unwrap(){return this._def.type}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.promise&&J.common.async===!1)return c(J,{code:h.invalid_type,expected:m.promise,received:J.parsedType}),W$;let X=J.parsedType===m.promise?J.data:Promise.resolve(J.data);return FJ(X.then((Q)=>{return this._def.type.parseAsync(Q,{path:J.path,errorMap:J.common.contextualErrorMap})}))}}RQ.create=($,J)=>{return new RQ({type:$,typeName:M$.ZodPromise,...K$(J)})};class eJ extends N${innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===M$.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=this._def.effect||null,Y={addIssue:(G)=>{if(c(X,G),G.fatal)J.abort();else J.dirty()},get path(){return X.path}};if(Y.addIssue=Y.addIssue.bind(Y),Q.type==="preprocess"){let G=Q.transform(X.data,Y);if(X.common.async)return Promise.resolve(G).then(async(W)=>{if(J.value==="aborted")return W$;let U=await this._def.schema._parseAsync({data:W,path:X.path,parent:X});if(U.status==="aborted")return W$;if(U.status==="dirty")return FQ(U.value);if(J.value==="dirty")return FQ(U.value);return U});else{if(J.value==="aborted")return W$;let W=this._def.schema._parseSync({data:G,path:X.path,parent:X});if(W.status==="aborted")return W$;if(W.status==="dirty")return FQ(W.value);if(J.value==="dirty")return FQ(W.value);return W}}if(Q.type==="refinement"){let G=(W)=>{let U=Q.refinement(W,Y);if(X.common.async)return Promise.resolve(U);if(U instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return W};if(X.common.async===!1){let W=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(W.status==="aborted")return W$;if(W.status==="dirty")J.dirty();return G(W.value),{status:J.value,value:W.value}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((W)=>{if(W.status==="aborted")return W$;if(W.status==="dirty")J.dirty();return G(W.value).then(()=>{return{status:J.value,value:W.value}})})}if(Q.type==="transform")if(X.common.async===!1){let G=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(!i0(G))return W$;let W=Q.transform(G.value,Y);if(W instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:J.value,value:W}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((G)=>{if(!i0(G))return W$;return Promise.resolve(Q.transform(G.value,Y)).then((W)=>({status:J.value,value:W}))});B$.assertNever(Q)}}eJ.create=($,J,X)=>{return new eJ({schema:$,typeName:M$.ZodEffects,effect:J,...K$(X)})};eJ.createWithPreprocess=($,J,X)=>{return new eJ({schema:J,effect:{type:"preprocess",transform:$},typeName:M$.ZodEffects,...K$(X)})};class rJ extends N${_parse($){if(this._getType($)===m.undefined)return FJ(void 0);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}rJ.create=($,J)=>{return new rJ({innerType:$,typeName:M$.ZodOptional,...K$(J)})};class I0 extends N${_parse($){if(this._getType($)===m.null)return FJ(null);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}I0.create=($,J)=>{return new I0({innerType:$,typeName:M$.ZodNullable,...K$(J)})};class OX extends N${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;if(J.parsedType===m.undefined)X=this._def.defaultValue();return this._def.innerType._parse({data:X,path:J.path,parent:J})}removeDefault(){return this._def.innerType}}OX.create=($,J)=>{return new OX({innerType:$,typeName:M$.ZodDefault,defaultValue:typeof J.default==="function"?J.default:()=>J.default,...K$(J)})};class VX extends N${_parse($){let{ctx:J}=this._processInputParams($),X={...J,common:{...J.common,issues:[]}},Q=this._def.innerType._parse({data:X.data,path:X.path,parent:{...X}});if(tQ(Q))return Q.then((Y)=>{return{status:"valid",value:Y.status==="valid"?Y.value:this._def.catchValue({get error(){return new TJ(X.common.issues)},input:X.data})}});else return{status:"valid",value:Q.status==="valid"?Q.value:this._def.catchValue({get error(){return new TJ(X.common.issues)},input:X.data})}}removeCatch(){return this._def.innerType}}VX.create=($,J)=>{return new VX({innerType:$,typeName:M$.ZodCatch,catchValue:typeof J.catch==="function"?J.catch:()=>J.catch,...K$(J)})};class UY extends N${_parse($){if(this._getType($)!==m.nan){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.nan,received:X.parsedType}),W$}return{status:"valid",value:$.data}}}UY.create=($)=>{return new UY({typeName:M$.ZodNaN,...K$($)})};var rz=Symbol("zod_brand");class h9 extends N${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;return this._def.type._parse({data:X,path:J.path,parent:J})}unwrap(){return this._def.type}}class MY extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.common.async)return(async()=>{let Y=await this._def.in._parseAsync({data:X.data,path:X.path,parent:X});if(Y.status==="aborted")return W$;if(Y.status==="dirty")return J.dirty(),FQ(Y.value);else return this._def.out._parseAsync({data:Y.value,path:X.path,parent:X})})();else{let Q=this._def.in._parseSync({data:X.data,path:X.path,parent:X});if(Q.status==="aborted")return W$;if(Q.status==="dirty")return J.dirty(),{status:"dirty",value:Q.value};else return this._def.out._parseSync({data:Q.value,path:X.path,parent:X})}}static create($,J){return new MY({in:$,out:J,typeName:M$.ZodPipeline})}}class HX extends N${_parse($){let J=this._def.innerType._parse($),X=(Q)=>{if(i0(Q))Q.value=Object.freeze(Q.value);return Q};return tQ(J)?J.then((Q)=>X(Q)):X(J)}unwrap(){return this._def.innerType}}HX.create=($,J)=>{return new HX({innerType:$,typeName:M$.ZodReadonly,...K$(J)})};function VU($,J){let X=typeof $==="function"?$(J):typeof $==="string"?{message:$}:$;return typeof X==="string"?{message:X}:X}function EU($,J={},X){if($)return LQ.create().superRefine((Q,Y)=>{let G=$(Q);if(G instanceof Promise)return G.then((W)=>{if(!W){let U=VU(J,Q),M=U.fatal??X??!0;Y.addIssue({code:"custom",...U,fatal:M})}});if(!G){let W=VU(J,Q),U=W.fatal??X??!0;Y.addIssue({code:"custom",...W,fatal:U})}return});return LQ.create()}var tz={object:a$.lazycreate},M$;(function($){$.ZodString="ZodString",$.ZodNumber="ZodNumber",$.ZodNaN="ZodNaN",$.ZodBigInt="ZodBigInt",$.ZodBoolean="ZodBoolean",$.ZodDate="ZodDate",$.ZodSymbol="ZodSymbol",$.ZodUndefined="ZodUndefined",$.ZodNull="ZodNull",$.ZodAny="ZodAny",$.ZodUnknown="ZodUnknown",$.ZodNever="ZodNever",$.ZodVoid="ZodVoid",$.ZodArray="ZodArray",$.ZodObject="ZodObject",$.ZodUnion="ZodUnion",$.ZodDiscriminatedUnion="ZodDiscriminatedUnion",$.ZodIntersection="ZodIntersection",$.ZodTuple="ZodTuple",$.ZodRecord="ZodRecord",$.ZodMap="ZodMap",$.ZodSet="ZodSet",$.ZodFunction="ZodFunction",$.ZodLazy="ZodLazy",$.ZodLiteral="ZodLiteral",$.ZodEnum="ZodEnum",$.ZodEffects="ZodEffects",$.ZodNativeEnum="ZodNativeEnum",$.ZodOptional="ZodOptional",$.ZodNullable="ZodNullable",$.ZodDefault="ZodDefault",$.ZodCatch="ZodCatch",$.ZodPromise="ZodPromise",$.ZodBranded="ZodBranded",$.ZodPipeline="ZodPipeline",$.ZodReadonly="ZodReadonly"})(M$||(M$={}));var ez=($,J={message:`Input not instance of ${$.name}`})=>EU((X)=>X instanceof $,J),FU=aJ.create,NU=a0.create,$E=UY.create,JE=s0.create,LU=JX.create,QE=NQ.create,XE=XY.create,YE=QX.create,GE=XX.create,WE=LQ.create,UE=o0.create,ME=K0.create,OE=YY.create,VE=sJ.create,HE=a$.create,qE=a$.strictCreate,KE=YX.create,zE=b9.create,EE=GX.create,FE=z0.create,NE=GY.create,LE=WY.create,AE=AQ.create,RE=$X.create,DE=WX.create,ZE=UX.create,BE=r0.create,jE=MX.create,TE=RQ.create,SE=eJ.create,IE=rJ.create,CE=I0.create,wE=eJ.createWithPreprocess,PE=MY.create,_E=()=>FU().optional(),xE=()=>NU().optional(),vE=()=>LU().optional(),kE={string:($)=>aJ.create({...$,coerce:!0}),number:($)=>a0.create({...$,coerce:!0}),boolean:($)=>JX.create({...$,coerce:!0}),bigint:($)=>s0.create({...$,coerce:!0}),date:($)=>NQ.create({...$,coerce:!0})};var fE=W$;function EG($){if(yE($)===6)return!0;if($.includes("://")||$.includes("/")||$.includes(":"))return!1;if($==="localhost")return!0;if($.startsWith("*.")){let J=$.slice(2);if(!J.includes(".")||J.startsWith(".")||J.endsWith("."))return!1;let X=J.split(".");return X.length>=2&&X.every((Q)=>Q.length>0)}if($.includes("*"))return!1;return $.includes(".")&&!$.startsWith(".")&&!$.endsWith(".")}var FG='Invalid domain pattern. Must be a valid domain (e.g., "example.com"), a wildcard (e.g., "*.example.com"), or a bracketed IPv6 literal (e.g., "[::1]", "[2001:db8::1]:443"). Overly broad patterns like "*.com" or "*" are not allowed for security reasons.',g9=x.string().refine(EG,{message:FG});function RU($){let J=$.indexOf(":");return!(J!==-1&&$.indexOf(":",J+1)!==-1)||$.startsWith("[")}var hE=x.string().refine(($)=>RU($)&&EG(nX($).hostPattern),{message:FG+' An optional ":port" suffix (1-65535) restricts the entry to that port.'}),uE=x.string().refine(($)=>{if(!RU($))return!1;let{hostPattern:J}=nX($);return J==="*"||EG(J)},{message:FG+' In deniedDomains a bare "*" (deny-all) is also accepted, and an optional ":port" suffix (1-65535) restricts the entry to that port.'}),OY=x.string().min(1,"Path cannot be empty"),AU=x.string().min(1,"Path cannot be empty").refine(($)=>bE($),{message:"Binary path must be absolute"}),gE=x.object({socketPath:x.string().min(1).describe("Unix socket path to the MITM proxy"),domains:x.array(g9).min(1).describe('Domains to route through the MITM proxy (e.g., ["api.example.com", "*.internal.org"])')}),mE=x.object({http:x.string().url().optional().describe("Upstream proxy URL for plain HTTP traffic"),https:x.string().url().optional().describe("Upstream proxy URL for HTTPS/CONNECT traffic (falls back to http if unset)"),noProxy:x.string().optional().describe("Comma-separated NO_PROXY list (hostname suffixes and CIDR ranges). Matching destinations connect directly instead of via the parent proxy.")}),DU=x.enum(["deny","mask"]),u9=x.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/,"Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores"),ZU=x.string().superRefine(($,J)=>{try{let{groupCount:X}=R7($);if(X<1)J.addIssue({code:x.ZodIssueCode.custom,message:"extract must contain at least one capturing group \u2014 group 1 is "+'the credential value to mask (e.g. "token:\\s*(\\S+)").'})}catch(X){J.addIssue({code:x.ZodIssueCode.custom,message:X instanceof Error?X.message:"Credential extract pattern is invalid"})}}),lE=x.object({path:OY.describe("Path to a credential file or directory. Supports the same path forms as filesystem.denyRead (absolute paths and ~ expansion)."),mode:DU.describe("Access mode for this path"),extract:ZU.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the file is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe("What to do when extract matches nothing (or, with decode, no "+'candidate verifies): "warn" (default \u2014 stderr warning, file left '+'readable), "deny" (degrade to mode "deny" \u2014 file unreadable), or '+'"error" (throw at wrap time). Only meaningful with mode "mask" and extract or decode set.'),decode:x.enum(["jwt"]).optional().describe('Optional encoded-credential format. "jwt": decodes recognized JWTs so masking can target fields inside them (see maskClaims). Candidates are located with a built-in JWT regex (or the explicit extract pattern, if set) and verified to actually be JWTs before masking. Without maskClaims, the whole decoded value is treated as the credential and replaced with a structurally valid fake JWT, so client-side token parsing keeps working. If no candidate verifies, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches in any verified token, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskDuplicates:x.boolean().optional().describe("If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the "+"corresponding sentinel \u2014 for a secret repeated where the regex "+`does not reach (e.g. in a comment). Matches raw substrings: short or common credential values may corrupt unrelated content, so this is intended for long, high-entropy secrets. With decode, only values that passed verification are scanned; duplicates reuse the verified value's fake without re-verification. Defaults to false. Only meaningful with mode "mask" and extract or decode set; accepted but ignored otherwise.`),injectHosts:x.array(g9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),pE=x.object({name:u9.describe("Environment variable name"),mode:DU.describe("Access mode for this environment variable"),extract:ZU.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the value is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe('What to do when extract matches nothing: "warn" (default \u2014 stderr '+'warning, variable passes through unmasked), "deny" (variable unset inside the sandbox), or "error" (throw at wrap time). Only meaningful with mode "mask" and extract set.'),decode:x.enum(["jwt"]).optional().describe(`Optional encoded-credential format. "jwt": the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".`),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHosts:x.array(g9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),dE=x.object({accessKeyIdVar:u9.describe("Name of the masked env var holding the AWS access key id."),secretAccessKeyVar:u9.describe("Name of the masked env var holding the AWS secret access key."),sessionTokenVar:u9.optional().describe("Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.")}).strict(),zG=x.enum(["deny","passthrough"]),cE=x.object({streaming:zG.optional().describe('Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. Default "deny".'),presigned:zG.optional().describe('Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. Default "deny".'),sigv4a:zG.optional().describe('Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. Default "deny".')}).strict(),BU=x.object({files:x.array(lE).optional().describe("Credential files or directories to protect"),envVars:x.array(pE).optional().describe("Environment variables to protect"),allowPlaintextInject:x.boolean().optional().describe("Allow sentinel\u2192real substitution on the plain-HTTP proxy path. "+"Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures."),awsPairs:x.array(dE).optional().describe("Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked."),sigv4:cE.optional().describe('Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: "deny" (default) or "passthrough".')}).strict(),jU=x.object({allowedDomains:x.array(hE).describe('List of allowed domains (e.g., ["github.com", "*.npmjs.org", "api.example.com:443"]). An optional ":port" suffix restricts the entry to that destination port.'),deniedDomains:x.array(uE).describe('List of denied domains. Unlike allowedDomains, a bare "*" is accepted here (deny-all). An optional ":port" suffix (e.g., "*:22") restricts the entry to that destination port.'),deniedDomainReasons:x.record(x.string(),x.string().min(1)).optional().describe('Optional model-facing reason keyed by the exact deniedDomains entry it explains (e.g., {"github.com:22": "SSH pushes to GitHub are blocked; use an https remote"}). Reported in the <sandbox_violations> line when that entry denies a connection; entries without one use a generic reason. Keys are matched by exact entry string, so a key with no matching deniedDomains entry never fires.'),strictAllowlist:x.boolean().optional().describe("If true, hosts not in allowedDomains are denied without consulting the ask callback. Set this when allowedDomains is policy enforcement, not a prompt-suppression hint."),allowUnixSockets:x.array(x.string()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),allowAllUnixSockets:x.boolean().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),allowLocalBinding:x.boolean().optional().describe("Whether to allow binding to local ports (default: false)"),allowMachLookup:x.array(x.string().refine(($)=>{return!($.endsWith("*")?$.slice(0,-1):$).includes("*")},{message:'Wildcards are only allowed as a single trailing "*" (e.g., "com.example.*" or "*" for all services).'})).optional().describe('macOS only: Additional XPC/Mach service names to allow looking up. Supports trailing-wildcard prefix matching (e.g., "2BUA8C4S2C.com.1password.*"). Needed for tools like 1Password CLI, Playwright, or the iOS Simulator that communicate via XPC.'),httpProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external HTTP proxy to use instead of starting a local one. When provided, the library will skip starting its own HTTP proxy and use this port. The external proxy must handle domain filtering."),socksProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external SOCKS proxy to use instead of starting a local one. When provided, the library will skip starting its own SOCKS proxy and use this port. The external proxy must handle domain filtering."),mitmProxy:gE.optional().describe("Optional MITM proxy configuration. Routes matching domains through an upstream proxy via Unix socket while SRT still handles allow/deny filtering."),filterRequest:x.custom(($)=>typeof $==="function",{message:"filterRequest must be a function"}).optional().describe("Per-request filter callback. Receives the parsed HTTP request (web-standard Request) and returns {action, reason?}. Denied requests get a 403 with the reason. If the callback throws, the request is denied. Applies to plain HTTP through the proxy and, when tlsTerminate is configured, to terminated HTTPS. SRT does not provide a policy language; library consumers own matching."),tlsTerminate:x.object({caCertPath:x.string().min(1).optional().describe("Path to a PEM-encoded CA certificate. The sandboxed child is configured to trust this CA, and the TLS-terminating proxy uses it to sign per-host certificates. If omitted, on Windows SRT generates-if-absent a persistent CA under %ProgramData%\\sandbox-runtime\\ca\\ and trusts it in the sandbox user's Root store; on other platforms SRT generates an ephemeral CA into a temp directory for the lifetime of the session."),caKeyPath:x.string().min(1).optional().describe("Path to the PEM-encoded private key for caCertPath."),excludeDomains:x.array(g9).optional().describe("Domain patterns (same syntax as allowedDomains) whose HTTPS connections are NOT terminated. Matching CONNECTs are opaque byte tunnels: still subject to the allow/deny domain lists, but the sandboxed client completes its own TLS handshake with the upstream, so filterRequest and credential injection do not apply to their HTTPS traffic (plain-HTTP requests to the same hosts keep the normal request pipeline). Use for hosts the proxy must not re-originate: mTLS upstreams (only the client holds the client certificate) and clients that pin the upstream certificate and would reject the MITM CA. Hosts still need to be reachable via allowedDomains; this list only changes how they are tunnelled."),extraCaCertPaths:x.array(x.string().min(1)).optional().describe("Paths to PEM CA certificate files appended to the trust bundle the sandboxed child is pointed at, after the MITM CA and the host's regular roots. Use for site-local roots (e.g. an internal mTLS CA) presented by excluded/passthrough hosts, so the child can verify them itself. Only the CERTIFICATE blocks of each file are copied; files that are missing, unreadable, or contain no PEM CERTIFICATE block are skipped (with a debug log), so paths that exist on only some hosts are safe to list.")}).refine(($)=>!$.caCertPath===!$.caKeyPath,{message:"caCertPath and caKeyPath must be provided together"}).optional().describe("[EXPERIMENTAL] Enable in-process TLS termination so HTTPS request/response bodies are visible to SRT. Provide a CA cert+key, or omit both to have SRT generate an ephemeral one."),parentProxy:mE.optional().describe("Upstream HTTP proxy for outbound connections. When set, SRT's proxy tunnels non-mitmProxy traffic through this parent instead of connecting directly. Falls back to HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars if unset.")}),TU=x.object({disabled:x.boolean().optional().describe("Disable all filesystem policy enforcement. When true, no read or write rules are emitted: denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, .claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process is trusted with full host filesystem access. Network and credential-env restrictions still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs."),denyRead:x.array(OY).describe("Paths denied for reading"),allowRead:x.array(OY).optional().describe("Paths to re-allow reading within denied regions (takes precedence over denyRead). Use with denyRead to deny a broad region then allow back specific subdirectories."),allowWrite:x.array(OY).describe("Paths allowed for writing"),denyWrite:x.array(OY).describe("Paths denied for writing (takes precedence over allowWrite)"),allowGitConfig:x.boolean().optional().describe("Allow writes to .git/config files (default: false). Enables git remote URL updates while keeping .git/hooks protected.")}),SU=x.record(x.string(),x.array(x.string())).describe('Map of command patterns to filesystem paths to ignore violations for. Use "*" to match all commands'),IU=x.object({command:x.string().describe("The ripgrep command to execute"),args:x.array(x.string()).optional().describe("Additional arguments to pass before ripgrep args"),argv0:x.string().optional().describe("Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])")}),CU=x.object({safeDirectories:x.array(x.string()).default([]).describe("Directories git should treat as safe (`safe.directory`) even though they're owned by a different user inside the sandbox. Use for the repo top-level when launching from a subdirectory. Does NOT grant write.")}),wU=x.object({path:x.string().min(1).describe("Path to the srt-win binary. Pass the exported VENDORED_SRT_WIN_EXE constant to use the packaged vendor/srt-win/<arch>/srt-win.exe (see its WARNING: in a dev checkout that file may sit inside your sandbox write grant). The binary is spawned with the `--srt-win` argv[1] sentinel so a multicall dispatcher can route to srt-win's CLI.")}),PU=x.object({sandboxUser:x.string().min(1).max(20,"Windows local usernames are limited to 20 characters").optional().describe("Name for the dedicated sandbox user account that `srt-win install` creates and the sandboxed child runs as. Default: `srt-sandbox`. Install refuses if an account by this name already exists and srt-win did not create it (it will not rotate the password of an account it does not own). Must match what `srt-win install --sandbox-user` was run with."),sublayerGuid:x.string().uuid().optional().describe("WFP sublayer GUID under which the filters were installed. Omit to use the srt-win compile-time default. Set this when filters were installed by enterprise tooling under a custom sublayer."),wfpSublayerGuid:x.string().uuid().optional().describe("Deprecated alias for sublayerGuid."),proxyPortRange:x.tuple([x.number().int().min(1),x.number().int().max(65535)]).refine(([$,J])=>$<=J&&J-$<=64,{message:"low must be \u2264 high and range width \u2264 64"}).optional().describe("Inclusive [low, high] port range the JS mux proxy listeners bind inside. MUST match the range passed to `srt-win install "+"--proxy-port-range` (default 60080\u201360089) \u2014 the WFP loopback "+"permit only covers ports in that range."),srtWin:wU.optional().describe("How to locate/invoke the srt-win helper binary. `srtWin.path` is "+"required to use the Windows sandbox \u2014 your own (multicall) binary, "+"or the exported VENDORED_SRT_WIN_EXE constant for the packaged exe.")}),nE=x.object({applyPath:x.string().optional().describe("Path to the apply-seccomp binary"),argv0:x.string().optional().describe("Invoke apply-seccomp as a multicall binary that dispatches on the ARGV0 environment variable. When set, applyPath is used verbatim (no existence check) and the invocation inside bwrap is prefixed with ARGV0=<this value>. The caller is responsible for ensuring applyPath resolves inside the bwrap namespace and that the target binary implements the apply-seccomp interface when ARGV0 matches.")}),iE=x.object({network:jU.describe("Network restrictions configuration"),filesystem:TU.describe("Filesystem restrictions configuration"),credentials:BU.optional().describe("Credential handling configuration. Only the explicitly declared files and environment variables are restricted."),ignoreViolations:SU.optional().describe("Optional configuration for ignoring specific violations"),enableWeakerNestedSandbox:x.boolean().optional().describe("Enable weaker nested sandbox mode (for Docker environments)"),runAsUid:x.number().int().nonnegative().optional().describe("ARA: uid to drop the sandboxed command to (bwrap --uid)"),runAsGid:x.number().int().nonnegative().optional().describe("ARA: gid to drop the sandboxed command to (bwrap --gid)"),runAsHostUid:x.number().int().positive().optional().describe("ARA: real host uid used to launch the sandboxed bwrap child"),runAsHostGid:x.number().int().positive().optional().describe("ARA: real host gid used to launch the sandboxed bwrap child"),runAsHostHome:x.string().min(1).optional().describe("ARA: HOME set inside a real-host-uid sandbox child"),runAsHostUser:x.string().min(1).optional().describe("ARA: USER and LOGNAME set inside a real-host-uid sandbox child"),enableWeakerNetworkIsolation:x.boolean().optional().describe("Enable weaker network isolation to allow access to com.apple.trustd.agent (macOS only). This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data exfiltration vector through the trustd service. Only enable if you need Go TLS verification."),allowAppleEvents:x.boolean().optional().describe("Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or network restrictions), and can script running apps subject to TCC automation consent. Default: false."),ripgrep:IU.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),mandatoryDenySearchDepth:x.number().int().min(1).max(10).optional().describe("Maximum directory depth to search for dangerous files on Linux (default: 3). Higher values provide more protection but slower performance."),allowPty:x.boolean().optional().describe("Allow pseudo-terminal (pty) operations (macOS only)"),seccomp:nE.optional().describe("Custom seccomp binary paths (Linux only)."),bwrapPath:AU.optional().describe('Linux only: absolute path to the bwrap (bubblewrap) binary. When set, this path is used directly instead of resolving "bwrap" via PATH.'),socatPath:AU.optional().describe('Linux only: absolute path to the socat binary. When set, this path is used directly instead of resolving "socat" via PATH.'),windows:PU.optional().describe("Windows-specific settings (WFP sublayer, proxy port range)."),git:CU.optional().describe("Git configuration to inject via GIT_CONFIG_* env vars (cross-platform). `safeDirectories` marks paths as `safe.directory` without adding them to `filesystem.allowWrite`.")}).superRefine(($,J)=>{let X=$.credentials;if(!X)return;let Q=$.network.allowedDomains.map(iX),Y=(M,O)=>{for(let[V,H]of M.entries())if(!P9(H,Q))J.addIssue({code:x.ZodIssueCode.custom,path:[...O,V],message:`injectHosts entry "${H}" is not reachable via `+`network.allowedDomains \u2014 add "${H}" (or a covering wildcard) to allowedDomains, or remove it from injectHosts.`})},G=!1,W=(M,O)=>{if(M.injectHosts)Y(M.injectHosts,[...O,"injectHosts"]);if(M.mode!=="mask")return;G=!0;let V=$.network.tlsTerminate?.excludeDomains;if(V?.length){if(M.injectHosts){for(let[H,q]of M.injectHosts.entries())if(P9(q,V))J.addIssue({code:x.ZodIssueCode.custom,path:[...O,"injectHosts",H],message:`injectHosts entry "${q}" is entirely covered by network.tlsTerminate.excludeDomains. Credential injection only runs on TLS-terminated connections, so this host would receive the placeholder instead of the credential. Remove it from one of the two lists.`})}else if(Q.length>0&&Q.every((H)=>P9(H,V)))J.addIssue({code:x.ZodIssueCode.custom,path:O,message:"This masked credential has no injectHosts, so it defaults "+"to network.allowedDomains \u2014 but "+"network.tlsTerminate.excludeDomains covers every allowed domain, so it could never be injected anywhere. Credential injection only runs on TLS-terminated connections."})}if(M.injectHosts!==void 0&&M.injectHosts.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:O,message:"injectHosts is explicitly empty \u2014 the credential would be "+"masked but never injected. Omit injectHosts to default to network.allowedDomains, or list the intended hosts."})};for(let[M,O]of(X.envVars??[]).entries()){if(W(O,["credentials","envVars",M]),O.maskClaims!==void 0&&O.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the whole value.'});if(O.maskClaims!==void 0&&O.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."})}for(let[M,O]of(X.files??[]).entries()){if(W(O,["credentials","files",M]),O.maskClaims!==void 0&&O.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the extracted value whole.'});if(O.maskClaims!==void 0&&O.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."});if(O.mode==="mask"&&O.path.endsWith("/"))J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"path"],message:`Credential mode "mask" applies to a single file, not a directory. Use mode "deny" for "${O.path}", or point at the credential file inside it.`})}let U=new Set;for(let[M,O]of(X.awsPairs??[]).entries()){let V=[["accessKeyIdVar",O.accessKeyIdVar],["secretAccessKeyVar",O.secretAccessKeyVar]];if(O.sessionTokenVar!==void 0)V.push(["sessionTokenVar",O.sessionTokenVar]);for(let[H,q]of V){let F=["credentials","awsPairs",M,H];if(U.has(q)){J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" appears in more than one awsPairs slot (within `+"or across pairs) \u2014 each variable can fill exactly one slot."});continue}U.add(q);let K=(X.envVars??[]).find((A)=>A.name===q);if(K===void 0||K.mode!=="mask")J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" does not reference a credentials.envVars entry `+'with mode "mask" \u2014 an AWS pair links already-masked '+"variables; add the entry (masking is the opt-in for SigV4 re-signing)."});else if(K.extract!==void 0||K.decode!==void 0)J.addIssue({code:x.ZodIssueCode.custom,path:F,message:`"${q}" uses extract/decode, but an AWS pair member must be masked whole-value: the SigV4 trigger is an exact match of the fake access key id, and the signer needs the entire real value.`})}}if(G&&$.network.tlsTerminate===void 0&&!X.allowPlaintextInject)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials"],message:"Credential masking requires network.tlsTerminate so substitution runs only over a verified TLS connection. Enable tlsTerminate, or set credentials.allowPlaintextInject to opt out (not recommended)."})});export{w5 as windowsTrustCaAsync,PK as windowsTrustCa,_5 as windowsStateDir,d7 as windowsInstallInstructions,o7 as verifyWindowsWfpEgress,kX as validateCaPair,vK as uninstallWindowsSandbox,e7 as stampWindowsAcl,w9 as revokeWindowsAcl,C9 as restoreWindowsAcl,wJ as resolveSrtWin,kK as parseWindowsSandboxError,j9 as parseWindowsBinShell,EX as isUncPath,xK as installWindowsSandboxAsync,_K as installWindowsSandbox,$G as grantWindowsAcl,p9 as getWslVersion,C5 as getWindowsWfpStatusAsync,I5 as getWindowsWfpStatus,cX as getWindowsSandboxUserStatusAsync,a7 as getWindowsSandboxUserStatus,s7 as getWindowsSandboxCaCert,wK as getSrtWinPath,DQ as getDefaultWritePaths,rY as generateCa,I9 as expandWindowsFsPaths,r7 as ensurePersistentWindowsCa,S5 as checkWindowsSandboxStatusAsync,T5 as checkWindowsSandboxStatus,JG as checkWindowsDependenciesAsync,mQ as certThumbprint,FX as buildGitConfigEnv,A$ as WindowsSandboxError,PU as WindowsConfigSchema,CK as VENDORED_SRT_WIN_EXE,wU as SrtWinConfigSchema,D9 as SandboxViolationStore,iE as SandboxRuntimeConfigSchema,Tz as SandboxManager,D5 as SRT_WIN_DISPATCH_ARG1,IU as RipgrepConfigSchema,jU as NetworkConfigSchema,SU as IgnoreViolationsConfigSchema,CU as GitConfigSchema,TU as FilesystemConfigSchema,B9 as DEFAULT_WINDOWS_PROXY_PORT_RANGE,BU as CredentialsConfigSchema};
+No logout is needed: the WFP filter keys on the dedicated \`srt-sandbox\` user's SID, so your network is unaffected.`}function D5($){try{return{status:"fulfilled",value:$()}}catch(J){return{status:"rejected",reason:J}}}function g5($,J,X){let Q=[],Y=[];if(J.status==="rejected")return Q.push(`srt-win user status failed: ${J.reason.message}`),{errors:Q,warnings:Y};let G=J.value;if(!G.provisioned||!G.credPresent)Q.push(`Sandbox user is not provisioned (user=${G.provisioned}, cred=${G.credPresent}). `+i7($));let W=X();if(W.status==="rejected")return Q.push(`srt-win wfp status failed: ${W.reason.message}`),{errors:Q,warnings:Y};let U=W.value;if(U.state==="cannot-read")Z(`[Sandbox Windows] wfp status cannot-read (non-elevated): ${U.hint}`);else if(U.state!=="installed"){if(G.provisioned&&G.credPresent)Q.push(`WFP filters not installed under sublayer ${$??"(default)"}. `+i7($))}else if(U.portRange)Z(`[Sandbox Windows] WFP installed: ${U.filters} filters, proxy port range ${U.portRange[0]}-${U.portRange[1]}`);return{errors:Q,warnings:Y}}function m5($={}){let J;try{J=$.srtWin??wJ()}catch(X){return{errors:[X.message],warnings:[]}}return Z(`[Sandbox Windows] using srt-win at ${J.exe}`),g5($.sublayerGuid,D5(()=>t7({srtWin:J})),()=>D5(()=>_5({sublayerGuid:$.sublayerGuid,srtWin:J})))}async function YG($={}){let J;try{J=$.srtWin??wJ()}catch(Y){return{errors:[Y.message],warnings:[]}}Z(`[Sandbox Windows] using srt-win at ${J.exe}`);let[X,Q]=await Promise.allSettled([nX({srtWin:J}),x5({sublayerGuid:$.sublayerGuid,srtWin:J})]);return g5($.sublayerGuid,X,()=>Q)}import{isIP as pK}from"net";function iX($){if($.startsWith("[")){let Q=$.indexOf("]");if(Q===-1)return{hostPattern:$,port:void 0};let Y=$.slice(1,Q),G=jJ(Y)??Y,W=$.slice(Q+1);if(W==="")return{hostPattern:G,port:void 0};let U=l5(W.startsWith(":")?W.slice(1):"");return U===void 0?{hostPattern:$,port:void 0}:{hostPattern:G,port:U}}let J=$.lastIndexOf(":");if(J===-1)return{hostPattern:$,port:void 0};if($.indexOf(":")!==J)return{hostPattern:jJ($)??$,port:void 0};let X=l5($.slice(J+1));if(X===void 0)return{hostPattern:$,port:void 0};return{hostPattern:$.slice(0,J),port:X}}function l5($){if(!/^[1-9][0-9]{0,4}$/.test($))return;let J=Number($);return J>65535?void 0:J}function oX($){return iX($).hostPattern}function j0($,J){let X=$.toLowerCase();if(J==="*")return!0;if(J.startsWith("*.")){if(pK(dJ(X)))return!1;let Q=J.substring(2).toLowerCase();return X.endsWith("."+Q)}return X===J.toLowerCase()}function aX($,J,X){let{hostPattern:Q,port:Y}=iX(X);if(Y!==void 0&&Y!==J)return!1;return j0($,Q)}function _9($,J){let X=J.map(oX);if(!$.startsWith("*."))return X.some((Y)=>j0($,Y));let Q=$.slice(2).toLowerCase();return X.some((Y)=>{if(!Y.startsWith("*."))return!1;let G=Y.slice(2).toLowerCase();return Q===G||Q.endsWith("."+G)})}function p5($,J,X,Q){if(!lQ(J))return{verdict:"deny",reason:"malformed host"};let Y=jJ(J)??J;for(let G of $.deniedDomains)if(aX(Y,X,G))return{verdict:"deny",reason:$.deniedDomainReasons?.[G]??"host is on the deny list",rule:G};for(let G of $.allowedDomains)if(aX(Y,X,G))return{verdict:"allow",rule:G};if(!Q||$.strictAllowlist)return{verdict:"deny",reason:"host is not on the allow list"};return{verdict:"ask"}}import{EOL as GG}from"os";import{dirname as WG}from"path";var v,tX,eX,$Y,uJ,l0,sX,d5=!1,x9,oQ,c0,g$,n0,aQ,p0,v9,c5=!1,JY,EQ=new Z9,oJ=new Z7,rQ=new I7,sQ=new E7;function r5(){let $=v?.network.brokerForward;if(!$)return[];let J=process.env[$.tokenEnvVar];if(J)for(let X of $.rules){let Q=process.env[X.envVar];if(Q)sQ.register(Q,J,X.hosts,$.url)}return[$.tokenEnvVar]}function cK($){return v?.network.brokerForward?.rules.some((J)=>J.hosts.includes($))??!1}var QY=new S7;function nK(){if(d5)return;let $=()=>KG().catch((J)=>{Z(`Cleanup failed in registerCleanup ${J}`,{level:"error"})});process.once("exit",$),process.once("SIGINT",$),process.once("SIGTERM",$),d5=!0}var iK=1024,zQ=new Map;function t5($,J){let X=J?.commandId,Q=J?.commandText??$;if(X===void 0||X===Q)return;let Y=e0(PJ(X));zQ.delete(Y),zQ.set(Y,Q);while(zQ.size>iK){let G=zQ.keys().next().value;if(G===void 0)break;zQ.delete(G)}}function n5($){return zQ.get($)??$}function UG($,J){let X=J?(()=>{let Q=e0(J);return zQ.get(Q)??l7(Q)})():void 0;if(nQ($,X,v?.ignoreViolations))return;EQ.addViolation({line:$,encodedCommand:J,command:X,timestamp:new Date})}function oK($){try{let J=new URL($);return`${J.origin}${J.pathname}${J.search?"?\u2026":""}`}catch{let J=$.indexOf("?");return J===-1?$:`${$.slice(0,J)}?\u2026`}}async function i5($,J,X,Q){let Y=(W)=>{return UG(`deny network-outbound ${J}:${$} (${W})`,Q),!1};if(!v)return Z("No config available, denying network request"),Y("sandbox policy unavailable");let G=p5(v.network,J,$,X!==void 0);if(G.verdict==="allow")return Z(`Allowed by config rule: ${J}:${$}`),!0;if(G.verdict==="deny"){if(G.reason==="malformed host")Z(`Denying malformed host: ${JSON.stringify(J)}:${$}`,{level:"error"});else if(G.rule!==void 0)Z(`Denied by config rule: ${J}:${$}`);else Z(`No matching config rule, denying: ${J}:${$}`);return Y(G.reason)}Z(`No matching config rule, asking user: ${J}:${$}`);try{if(await X({host:J,port:$}))return Z(`User allowed: ${J}:${$}`),!0;return Z(`User denied: ${J}:${$}`),Y("user denied")}catch(W){return Z(`Error in permission callback: ${W}`,{level:"error"}),Y("permission prompt failed")}}var k9=!1;function aK($){k9=$}function sK(){if(!k9&&!v?.credentials)return;return($,J)=>{if(!v?.credentials)return;oJ.substituteInHeaders($,J,j0)}}function rK(){if(!k9&&!v?.credentials)return;return($)=>v?.credentials?oJ.sentinelsForHost($,j0):void 0}function tK(){if(!k9&&!v?.credentials)return;return($,J,X,Q)=>!v?.credentials?void 0:f4(rQ,v?.credentials?.sigv4,j0)($,J,X,Q)}function eK($){if(!v?.network.mitmProxy)return;let{socketPath:J,domains:X}=v.network.mitmProxy,Q=jJ($)??$;for(let Y of X)if(j0(Q,Y))return Z(`Host ${$} matches MITM pattern ${Y}`),J;return}function $z($){let J=v?.network.tlsTerminate?.excludeDomains;if(!J?.length)return!0;let X=jJ($)??$;if(cK(X))return!0;for(let Q of J){if(!j0(X,Q))continue;Z(`Host ${$} matches tlsTerminate.excludeDomains pattern ${Q}; skipping TLS termination`);let Y=oJ.namesInjectableAt(X,j0);if(Y.length>0)Z(`tlsTerminate.excludeDomains: masked credential(s) ${Y.join(", ")} are configured for injection at ${$}, but its connections are not terminated, so the upstream will receive the placeholder`,{level:"error"});return!1}return!0}async function Jz($,J){let X=sK(),Q=rK();tX=q4({filter:(U,M,O,V)=>i5(U,M,$,V),getMitmSocketPath:eK,mitmCA:g$,shouldTerminateTLS:$z,filterRequest:v?.network.filterRequest,onFilterRequestDenied:({method:U,url:M,reason:O,encodedCommand:V})=>{UG(`deny http-request ${U} ${oK(M)} (${O})`,V)},mutateHeaders:X,mutateHeadersPlaintext:v?.credentials?.allowPlaintextInject?X:void 0,getBrokerForward:(U,M)=>v?.network.brokerForward?sQ.forwardFor(U,M):void 0,getBodySubstitutions:Q,getBodySubstitutionsPlaintext:v?.credentials?.allowPlaintextInject?Q:void 0,planSigv4:tK(),parentProxy:c0,proxyAuthToken:n0}),eX=R4({filter:(U,M,O)=>i5(U,M,$,O),parentProxy:c0,proxyAuthToken:n0,probeUnauthenticated:async(U,M)=>{if(!v)return{};let O=jJ(M)??M;for(let V of v.network.deniedDomains)if(aX(O,U,V)){let q=v.network.deniedDomainReasons?.[V]??"host is on the deny list";return UG(`deny network-outbound ${M}:${U} (${q})`,void 0),{deniedReason:q}}return{}}}),$Y=B4({httpServer:tX,handleSocksConnection:(U)=>eX.handleConnection(U),httpBackendPortRange:J});let Y=$Y,G=await Y.listenHttpBackend();await M9(Y.server,(U)=>Y.server.listen(U,"127.0.0.1"),J,G!==void 0?new Set([G]):new Set);let W=Y.getPort();if(W===void 0)throw Error("Failed to get mux proxy server port");return Y.unref(),Z(`Mux proxy (HTTP+SOCKS) listening on localhost:${W}`),W}async function Qz($,J,X=!1){if(l0){await l0;return}if(v=$,c0=O7($.network.parentProxy),c0)Z(`Parent proxy configured: http=${H7(c0.httpUrl)} https=${H7(c0.httpsUrl)}`);if($.network.tlsTerminate&&$.network.mitmProxy)throw Error("network.tlsTerminate and network.mitmProxy are mutually exclusive");let Q=$.network.tlsTerminate,Y=v$()==="windows"&&Q!==void 0&&!Q.caCertPath&&!Q.caKeyPath;if(g$=Q&&!Y?X7(Q):void 0,g$&&$.runAsHostUid!==void 0&&v$()==="linux"){if(d0.chmodSync(WG(g$.trustBundlePath),457),d0.chmodSync(g$.trustBundlePath,420),g$.ephemeral)d0.chmodSync(WG(g$.certPath),457),d0.chmodSync(g$.certPath,420)}let G=await JU();if(G.errors.length>0)throw Error(`Sandbox dependencies not available: ${G.errors.join(", ")}`);if(X&&v$()==="macos")x9=F5(EQ.addViolation.bind(EQ),v.ignoreViolations,n5),Z("Started macOS sandbox log monitor");if(X&&v$()==="linux")oQ=A5(EQ.addViolation.bind(EQ),{allowWritePaths:[...DQ($.runAsHostHome),...v.filesystem.allowWrite],denyWritePaths:v.filesystem.denyWrite,ignoreViolations:v.ignoreViolations,resolveCommandText:n5,consumerUid:$.runAsHostUid,consumerGid:$.runAsHostGid}),oQ.ready,Z("Started Linux seccomp violation monitor");if(nK(),v$()==="windows"){JY=wJ($.windows?.srtWin);let W=JY,U=await nX({srtWin:W});if(!U.provisioned||!U.credPresent)throw v=void 0,new A$("not_provisioned",`Windows sandbox user is not provisioned (user=${U.provisioned}, cred=${U.credPresent}). Run \`npx sandbox-runtime windows-install\` (one UAC prompt) to provision it.`);if(!c5){try{await r7({proxyPortRange:$.windows?.proxyPortRange,srtWin:W})}catch(M){throw v=void 0,M}c5=!0}if(Y&&Q)try{let M=await $G({status:U,srtWin:W});g$=X7({caCertPem:M.certPem,caKeyPem:M.keyPem,caCertPath:M.certPath,caKeyPath:M.keyPath,extraCaCertPaths:Q.extraCaCertPaths})}catch(M){throw v=void 0,M}if(Q&&g$&&!Y){let M=e7(U),O=mQ(g$.certPem);if(!M)throw v=void 0,new A$("trust_ca_not_installed",`tlsTerminate on Windows requires the sandbox to be installed with this CA (thumb=${O}): run \`srt-win user trust-ca ${g$.certPath}\`. Per-exec installs into the sandbox user's Root store are not supported.`);if(M.thumb!==O)throw v=void 0,new A$("trust_ca_thumbprint_mismatch",`tlsTerminate on Windows: the sandbox's installed CA (thumb=${M.thumb}) doesn't match this session's CA (thumb=${O}). Run \`srt-win user trust-ca ${g$.certPath}\` to update it.`)}try{let M=Uz($);if(g$)M.grantRead.push(WG(g$.trustBundlePath));if(!U.sid)throw Error("sandbox user SID missing from `srt-win user status` (provisioned but in an inconsistent state)");let O=U.sid;if(p0=O,M.grantRead.length>0||M.grantWrite.length>0)XG({sandboxUserSid:O,read:M.grantRead,write:M.grantWrite,srtWin:W});if(M.denyRead.length>0||M.denyWrite.length>0)QG({sandboxUserSid:O,denyRead:M.denyRead,denyWrite:M.denyWrite,srtWin:W});if(M.grantRead.length>0||M.grantWrite.length>0||M.denyRead.length>0||M.denyWrite.length>0)aQ=M,Z(`[Sandbox Windows] fs applied: ${M.grantWrite.length} grantWrite, ${M.grantRead.length} grantRead, ${M.denyRead.length} denyRead, ${M.denyWrite.length} denyWrite`);v9=XU($)}catch(M){if(p0)P9({sandboxUserSid:p0,srtWin:W}),w9({sandboxUserSid:p0,srtWin:W});throw p0=void 0,v=void 0,M}}l0=(async()=>{try{let W=v$()==="windows"?v.windows?.proxyPortRange??j9:void 0;n0=v.network.httpProxyPort!==void 0?void 0:dK(16).toString("hex");let M=v.network.httpProxyPort===void 0||v.network.socksProxyPort===void 0?await Jz(J,W):void 0,O=v.network.httpProxyPort??M,V=v.network.socksProxyPort??M;if(g$&&M!==void 0&&v$()==="windows")g$.crlUrl=`http://127.0.0.1:${M}${rY}`;if(v.network.httpProxyPort!==void 0)Z(`Using external HTTP proxy on port ${O}`);if(v.network.socksProxyPort!==void 0)Z(`Using external SOCKS proxy on port ${V}`);let q;if(v$()==="linux")q=await M5(O,V,v.socatPath,v.runAsHostUid,v.runAsHostGid);let H={httpProxyPort:O,socksProxyPort:V,linuxBridge:q};return uJ=H,Z("Network infrastructure initialized"),H}catch(W){throw l0=void 0,uJ=void 0,KG().catch((U)=>{Z(`Cleanup failed in initializationPromise ${U}`,{level:"error"})}),W}})(),await l0}function e5(){let $=v$();if($==="linux")return d9()!=="1";return $==="macos"||$==="windows"}function Xz(){return v!==void 0}function $U($){if(!e5())return{done:{errors:["Unsupported platform"],warnings:[]}};let J=[],X=[],Q=v$();if(Q==="linux"){let Y=$??v?.ripgrep??{command:"rg"};if(D0(Y.command)===null)J.push(`ripgrep (${Y.command}) not found`);let G=U5({seccompConfig:v?.seccomp,bwrapPath:v?.bwrapPath,socatPath:v?.socatPath});J.push(...G.errors),X.push(...G.warnings)}else if(Q==="windows"){let Y;try{Y=wJ(v?.windows?.srtWin)}catch(G){return J.push(G.message),{done:{errors:J,warnings:X}}}return{windows:{sublayerGuid:v?.windows?.sublayerGuid??v?.windows?.wfpSublayerGuid,srtWin:Y}}}return{done:{errors:J,warnings:X}}}function Yz($){let J=$U($);if("done"in J)return J.done;return m5(J.windows)}async function JU($){let J=$U($);if("done"in J)return J.done;return YG(J.windows)}function OG($,J){if(!$)return{denyReadPaths:[],unsetEnvVars:[],setEnvVars:{},maskedFileBinds:[],maskedFileStoreDir:void 0};let X=f9($),Q=[...new Set((J??[]).map(oX))],Y=[];for(let V of $.envVars??[])if(V.mode==="deny")Y.push(V.name);let{setEnvVars:G,degradeToUnsetNames:W}=P4($.envVars??[],Q,oJ);Y.push(...W),k4($.envVars??[],$.awsPairs,Q,G,rQ);let U=$.files??[],{binds:M,degradeToDenyPaths:O}=w4(U,Q,oJ,QY);return{denyReadPaths:[...new Set([...X,...O])],unsetEnvVars:[...new Set(Y)],setEnvVars:G,maskedFileBinds:M,maskedFileStoreDir:QY.dirPath}}function f9($){let J=$?.files??[];return[...new Set(J.filter((X)=>X.mode==="deny").map((X)=>X.path))]}function QU($,J){return[...new Set([...$,...J.denyReadPaths])]}function Gz(){if(!v||v.filesystem.disabled)return{denyOnly:[],allowWithinDeny:[]};let $=QU(v.filesystem.denyRead,OG(v.credentials,v.network.allowedDomains)),J=[];for(let Q of $){let Y=F0(Q);if(v$()==="linux"&&NJ(Y)){let G=$Q(Q);Z(`[Sandbox] Expanded glob pattern "${Q}" to ${G.length} paths on Linux`),J.push(...G)}else J.push(Y)}let X=[];for(let Q of v.filesystem.allowRead??[]){let Y=F0(Q);if(v$()==="linux"&&NJ(Y)){let G=$Q(Q);Z(`[Sandbox] Expanded allowRead glob pattern "${Q}" to ${G.length} paths on Linux`),X.push(...G)}else X.push(Y)}return{denyOnly:J,allowWithinDeny:X}}function Wz(){if(!v)return{allowOnly:DQ(),denyWithinAllow:[]};if(v.filesystem.disabled)return{allowOnly:["/"],denyWithinAllow:[]};let $=v.filesystem.allowWrite.map((Q)=>F0(Q)).filter((Q)=>{if(v$()==="linux"&&NJ(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0}),J=v.filesystem.denyWrite.map((Q)=>F0(Q)).filter((Q)=>{if(v$()==="linux"&&NJ(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0});return{allowOnly:[...DQ(MG()),...$],denyWithinAllow:J}}function Uz($){let J=$.filesystem;if(J?.disabled)return{grantRead:[],grantWrite:[],denyRead:[],denyWrite:[]};let X=C9,Q=X([...new Set([...J?.denyRead??[],...f9($.credentials)])],{mode:"deny"}),Y=X(J?.denyWrite??[],{mode:"deny"});return{grantRead:X(J?.allowRead??[],{mode:"grant"}),grantWrite:X(J?.allowWrite??[],{mode:"grant"}),denyRead:Q,denyWrite:Y}}function XU($){return{disabled:$.filesystem.disabled??!1,denyRead:[...$.filesystem.denyRead],denyWrite:[...$.filesystem.denyWrite],allowRead:[...$.filesystem.allowRead??[]],allowWrite:[...$.filesystem.allowWrite],credFiles:f9($.credentials)}}function rX($,J){if($.length!==J.length)return!1;let X=new Set($);return J.every((Q)=>X.has(Q))}function Mz($,J){return $.disabled===J.disabled&&rX($.denyRead,J.denyRead)&&rX($.denyWrite,J.denyWrite)&&rX($.allowRead,J.allowRead)&&rX($.allowWrite,J.allowWrite)&&rX($.credFiles,J.credFiles)}function Oz($){return v9!==void 0&&Mz(v9,XU($))}function Vz(){if(!v)return{};let $=v.network.allowedDomains,J=v.network.deniedDomains;return{allowedHosts:$,...J.length>0&&{deniedHosts:J}}}function YU(){return v?.network?.allowUnixSockets}function o5(){return v?.network?.allowAllUnixSockets}function GU(){return v?.network?.allowLocalBinding}function WU(){return v?.network?.allowMachLookup}function UU(){return v?.ignoreViolations}function MU(){return v?.enableWeakerNestedSandbox}function qz(){return v?.runAsUid}function Hz(){return v?.runAsGid}function Kz(){return v?.runAsHostUid}function zz(){return v?.runAsHostGid}function MG(){return v?.runAsHostHome}function Ez(){return v?.runAsHostUser}function Fz(){return v?.enableWeakerNetworkIsolation}function Nz(){return v?.allowAppleEvents}function Lz(){return v?.ripgrep??{command:"rg"}}function Az(){return v?.mandatoryDenySearchDepth??3}function a5(){return v?.filesystem?.allowGitConfig??!1}function OU($){return[...v?.git?.safeDirectories??[],...$?.git?.safeDirectories??[]]}function Rz(){return v?.seccomp}function Dz(){return n0}function VG(){return uJ?.httpProxyPort}function qG(){return uJ?.socksProxyPort}function VU(){return uJ?.linuxBridge?.httpSocketPath}function qU(){return uJ?.linuxBridge?.socksSocketPath}async function HG(){if(!v)return!1;if(l0)try{return await l0,!0}catch{return!1}return uJ!==void 0}async function HU($,J,X,Q,Y){let G=v$(),W=Y?.commandId;t5($,Y);let U=X?.filesystem!==void 0?X.filesystem.disabled??!1:v?.filesystem.disabled??!1,M=OG(X?.credentials??v?.credentials,X?.network?.allowedDomains??v?.network?.allowedDomains);M.unsetEnvVars.push(...r5());let O,V;if(!U){let A=(P)=>P.map((l)=>F0(l)).filter((l)=>{if(v$()==="linux"&&NJ(l))return Z(`[Sandbox] Skipping glob write pattern on Linux: ${l}`),!1;return!0}),D=A(X?.filesystem?.allowWrite??v?.filesystem.allowWrite??[]);O={allowOnly:[...DQ(X?.runAsHostHome??MG()),...D],denyWithinAllow:A(X?.filesystem?.denyWrite??v?.filesystem.denyWrite??[])};let S=QU(X?.filesystem?.denyRead??v?.filesystem.denyRead??[],M),B=[];for(let P of S){let l=F0(P);if(v$()==="linux"&&NJ(l))B.push(...$Q(P));else B.push(l)}let C=X?.filesystem?.allowRead??v?.filesystem.allowRead??[],w=[];for(let P of C){let l=F0(P);if(v$()==="linux"&&NJ(l))w.push(...$Q(P));else w.push(l)}if(g$)w.push(g$.certPath,g$.trustBundlePath);V={denyOnly:B,allowWithinDeny:w}}let q=X?.network?.allowedDomains!==void 0||v?.network?.allowedDomains!==void 0,H=q,N=q;if(N)await HG();let K=X?.allowPty??v?.allowPty,L=OU(X);switch(G){case"macos":return E5({command:$,commandId:W,needsNetworkRestriction:H,httpProxyPort:N?VG():void 0,socksProxyPort:N?qG():void 0,proxyAuthToken:N?n0:void 0,caCertPath:g$?.trustBundlePath,readConfig:V,writeConfig:O,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,allowUnixSockets:YU(),allowAllUnixSockets:o5(),allowLocalBinding:GU(),allowMachLookup:WU(),ignoreViolations:UU(),allowPty:K,allowGitConfig:a5(),gitSafeDirectories:L,enableWeakerNetworkIsolation:Fz(),allowAppleEvents:Nz(),binShell:J});case"linux":return O5({command:$,commandId:W,needsNetworkRestriction:H,httpSocketPath:N?VU():void 0,socksSocketPath:N?qU():void 0,httpProxyPort:N?uJ?.httpProxyPort:void 0,socksProxyPort:N?uJ?.socksProxyPort:void 0,proxyAuthToken:N?n0:void 0,caCertPath:g$?.trustBundlePath,readConfig:V,writeConfig:O,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,maskedFileStoreDir:M.maskedFileStoreDir,enableWeakerNestedSandbox:MU(),runAsUid:qz(),runAsGid:Hz(),runAsHostUid:Kz(),runAsHostGid:zz(),runAsHostHome:MG(),runAsHostUser:Ez(),setprivPath:"/usr/bin/setpriv",allowAllUnixSockets:o5(),binShell:J,ripgrepConfig:Lz(),mandatoryDenySearchDepth:Az(),allowGitConfig:a5(),gitSafeDirectories:L,seccompConfig:Rz(),bwrapPath:v?.bwrapPath,socatPath:v?.socatPath,observeSocketPath:oQ?.observeSocketPath,abortSignal:Q});case"windows":throw Error("wrapWithSandbox() returns a shell string and is not supported on Windows. Use SandboxManager.wrapWithSandboxArgv() and spawn the result with {shell: false}.");default:throw Error(`Sandbox configuration is not supported on platform: ${G}`)}}async function Zz($,J,X,Q,Y,G){if(v$()==="windows"){let O=X?.network?.allowedDomains!==void 0||v?.network?.allowedDomains!==void 0;if(O)await HG();let V=OG(X?.credentials??v?.credentials,X?.network?.allowedDomains??v?.network?.allowedDomains);V.unsetEnvVars.push(...r5());let q=X?.filesystem,H=[],N=[];if(!q?.disabled){if(q?.allowRead?.length||q?.allowWrite?.length)throw Error("Per-exec filesystem.allowRead/allowWrite is not supported "+"on Windows \u2014 `srt-win exec` only exposes per-exec "+"denies. Set them at the session level (initialize()).");let K=[...q?.denyRead??[],...f9(X?.credentials)],L=q?.denyWrite??[];if(K.length>0||L.length>0){let A=new Set(aQ?.denyRead??[]),D=new Set(aQ?.denyWrite??[]),S=C9;H=S(K,{mode:"deny"}).filter((B)=>!A.has(B)),N=S(L,{mode:"deny"}).filter((B)=>!A.has(B)&&!D.has(B))}}return t5($,G),u5({command:$,commandId:G?.commandId,httpProxyPort:O?VG():void 0,socksProxyPort:O?qG():void 0,proxyAuthToken:O?n0:void 0,setEnvVars:V.setEnvVars,denyRead:H,denyWrite:N,cwd:Y,allowWrite:aQ?.grantWrite,gitSafeDirectories:OU(X),caCertPath:g$?.trustBundlePath,binShell:T9(J),srtWin:X?.windows?.srtWin?wJ(X.windows.srtWin):JY??wJ(v?.windows?.srtWin)})}if(typeof J==="object")throw Error("binShell object form is Windows-only; pass a shell path string on macOS/Linux");let U=await HU($,J,X,Q,G);return{argv:[J??"/bin/bash","-c",U],env:process.env}}function Bz(){return v}function jz(){oJ.clear(),rQ.clear(),sQ.clear(),QY.dispose()}function Tz($){if(v$()==="windows"&&v&&!Oz($))Z("[Sandbox Windows] updateConfig: the resolved file-access set "+"(filesystem.* \u222A credentials.files) changed but the ACL "+"stamp/grant is session-wide \u2014 call reset() then initialize() "+"to apply. The previously-applied set stays in effect.",{level:"warn"});let{filterRequest:J,...X}=$.network;v=structuredClone({...$,network:X}),v.network.filterRequest=J,c0=O7($.network.parentProxy),Z("Sandbox configuration updated")}function Sz(){D9()}var Iz=1500;function s5($,J){if(!$.pid||$.exitCode!==null||$.signalCode!==null)return Promise.resolve();try{process.kill($.pid,"SIGTERM"),Z(`Sent SIGTERM to ${J} bridge process`)}catch(X){if(X.code!=="ESRCH")Z(`Error killing ${J} bridge: ${X}`,{level:"error"});return Promise.resolve()}return new Promise((X)=>{let Q=!1,Y=()=>{if(Q)return;Q=!0,clearTimeout(G),X()};$.once("exit",()=>{Z(`${J} bridge process exited`),Y()});let G=setTimeout(()=>{if($.exitCode===null&&$.signalCode===null){Z(`${J} bridge did not exit, forcing SIGKILL`,{level:"warn"});try{if($.pid)process.kill($.pid,"SIGKILL")}catch{}}Y()},Iz);G.unref?.()})}function Cz($){return new Promise((J)=>{if(typeof $.closeAllConnections==="function")$.closeAllConnections();$.close((X)=>{if(X&&X.message!=="Server is not running.")Z(`Error closing HTTP proxy server: ${X.message}`,{level:"error"});J()})})}async function wz(){if(aQ&&p0){let J=p0,X=JY,Q=new Set(["revoked","stillHeld","restored","alreadyOriginal"]),Y=(G,W)=>{if(!Q.has(W.status))Z(`[Sandbox Windows] ${G}: '${W.path}' ${W.status} \u2014 `+"ACE may be left in place; resolve and run `srt-win acl recover` to clear",{level:"warn"})};for(let G of P9({sandboxUserSid:J,srtWin:X})??[])Y("grant revoke",G);for(let G of w9({sandboxUserSid:J,srtWin:X})??[])Y("deny restore",G)}if(aQ=void 0,p0=void 0,v9=void 0,JY=void 0,D9({force:!0}),x9)x9(),x9=void 0;if(oQ)oQ.stop(),oQ=void 0;if(uJ?.linuxBridge){let{httpSocketPath:J,socksSocketPath:X,httpBridgeProcess:Q,socksBridgeProcess:Y}=uJ.linuxBridge;if(await Promise.all([s5(Q,"HTTP"),s5(Y,"SOCKS")]),J)try{d0.rmSync(J,{force:!0}),Z("Cleaned up HTTP socket")}catch(G){Z(`HTTP socket cleanup error: ${G}`,{level:"error"})}if(X)try{d0.rmSync(X,{force:!0}),Z("Cleaned up SOCKS socket")}catch(G){Z(`SOCKS socket cleanup error: ${G}`,{level:"error"})}}let $=[];if(g$)$.push(uW(g$));if($Y)$.push($Y.close().catch((J)=>{Z(`Error closing mux proxy server: ${J.message}`,{level:"error"})}));if(tX)$.push(Cz(tX));if(eX){let J=eX.close().catch((X)=>{Z(`Error closing SOCKS proxy server: ${X.message}`,{level:"error"})});$.push(J)}await Promise.all($),$Y=void 0,tX=void 0,n0=void 0,eX=void 0,uJ=void 0,l0=void 0,c0=void 0,g$=void 0,oJ.clear(),rQ.clear(),QY.dispose()}async function KG(){if(sX)return sX;sX=wz();try{await sX}finally{sX=void 0}}function Pz(){return EQ}function _z($,J){if(!v)return J;let X=EQ.getViolationsForCommand($);if(X.length===0)return J;let Q=J;Q+=GG+"<sandbox_violations>"+GG;for(let Y of X)Q+=Y.line+GG;return Q+="</sandbox_violations>",Q}function xz(){if(v$()!=="linux"||!v||v.filesystem.disabled)return[];let $=[],J=[...v.filesystem.allowWrite,...v.filesystem.denyWrite];for(let X of J){let Q=F0(X);if(NJ(Q))$.push(X)}return $}var vz={initialize:Qz,isSupportedPlatform:e5,isSandboxingEnabled:Xz,checkDependencies:Yz,checkDependenciesAsync:JU,getFsReadConfig:Gz,getFsWriteConfig:Wz,getNetworkRestrictionConfig:Vz,getAllowUnixSockets:YU,getAllowLocalBinding:GU,getAllowMachLookup:WU,getIgnoreViolations:UU,getEnableWeakerNestedSandbox:MU,getProxyPort:VG,getProxyAuthToken:Dz,getSocksProxyPort:qG,getLinuxHttpSocketPath:VU,getLinuxSocksSocketPath:qU,waitForNetworkInitialization:HG,wrapWithSandbox:HU,wrapWithSandboxArgv:Zz,cleanupAfterCommand:Sz,beginCredentialLease:()=>{oJ.beginLease(),sQ.beginLease()},endCredentialLease:()=>Object.assign(oJ.endLease(),{brokerForward:sQ.endLease()}),releaseCredentialLease:($)=>{sQ.release($.brokerForward??[]),rQ.forget(oJ.release($))},reset:KG,getMitmCA:()=>g$,getSentinelRegistry:()=>oJ,getAwsPairRegistry:()=>rQ,getMaskedFileStore:()=>QY,getSandboxViolationStore:Pz,annotateStderrWithSandboxFailures:_z,getLinuxGlobPatternWarnings:xz,getConfig:Bz,updateConfig:Tz,clearMaskedCredentials:jz,setLiveCredentialInjectors:aK};import{isIP as dE}from"net";import{isAbsolute as cE}from"path";var x={};oU(x,{void:()=>NE,util:()=>B$,unknown:()=>EE,union:()=>DE,undefined:()=>HE,tuple:()=>jE,transformer:()=>kE,symbol:()=>qE,string:()=>DU,strictObject:()=>RE,setErrorMap:()=>yz,set:()=>IE,record:()=>TE,quotelessJson:()=>kz,promise:()=>vE,preprocess:()=>bE,pipeline:()=>hE,ostring:()=>uE,optional:()=>fE,onumber:()=>gE,oboolean:()=>mE,objectUtil:()=>zG,object:()=>AE,number:()=>ZU,nullable:()=>yE,null:()=>KE,never:()=>FE,nativeEnum:()=>xE,nan:()=>ME,map:()=>SE,makeIssue:()=>XY,literal:()=>PE,lazy:()=>wE,late:()=>WE,isValid:()=>i0,isDirty:()=>b9,isAsync:()=>eQ,isAborted:()=>y9,intersection:()=>BE,instanceof:()=>UE,getParsedType:()=>H0,getErrorMap:()=>tQ,function:()=>CE,enum:()=>_E,effect:()=>kE,discriminatedUnion:()=>ZE,defaultErrorMap:()=>T0,datetimeRegex:()=>LU,date:()=>VE,custom:()=>RU,coerce:()=>lE,boolean:()=>BU,bigint:()=>OE,array:()=>LE,any:()=>zE,addIssueToContext:()=>c,ZodVoid:()=>GY,ZodUnknown:()=>o0,ZodUnion:()=>GX,ZodUndefined:()=>XX,ZodType:()=>N$,ZodTuple:()=>z0,ZodTransformer:()=>eJ,ZodSymbol:()=>YY,ZodString:()=>aJ,ZodSet:()=>AQ,ZodSchema:()=>N$,ZodRecord:()=>WY,ZodReadonly:()=>HX,ZodPromise:()=>RQ,ZodPipeline:()=>OY,ZodParsedType:()=>m,ZodOptional:()=>rJ,ZodObject:()=>a$,ZodNumber:()=>a0,ZodNullable:()=>I0,ZodNull:()=>YX,ZodNever:()=>K0,ZodNativeEnum:()=>OX,ZodNaN:()=>MY,ZodMap:()=>UY,ZodLiteral:()=>MX,ZodLazy:()=>UX,ZodIssueCode:()=>h,ZodIntersection:()=>WX,ZodFunction:()=>JX,ZodFirstPartyTypeKind:()=>M$,ZodError:()=>TJ,ZodEnum:()=>r0,ZodEffects:()=>eJ,ZodDiscriminatedUnion:()=>h9,ZodDefault:()=>VX,ZodDate:()=>NQ,ZodCatch:()=>qX,ZodBranded:()=>u9,ZodBoolean:()=>QX,ZodBigInt:()=>s0,ZodArray:()=>sJ,ZodAny:()=>LQ,Schema:()=>N$,ParseStatus:()=>EJ,OK:()=>FJ,NEVER:()=>pE,INVALID:()=>W$,EMPTY_PATH:()=>bz,DIRTY:()=>FQ,BRAND:()=>GE});var B$;(function($){$.assertEqual=(Y)=>{};function J(Y){}$.assertIs=J;function X(Y){throw Error()}$.assertNever=X,$.arrayToEnum=(Y)=>{let G={};for(let W of Y)G[W]=W;return G},$.getValidEnumValues=(Y)=>{let G=$.objectKeys(Y).filter((U)=>typeof Y[Y[U]]!=="number"),W={};for(let U of G)W[U]=Y[U];return $.objectValues(W)},$.objectValues=(Y)=>{return $.objectKeys(Y).map(function(G){return Y[G]})},$.objectKeys=typeof Object.keys==="function"?(Y)=>Object.keys(Y):(Y)=>{let G=[];for(let W in Y)if(Object.prototype.hasOwnProperty.call(Y,W))G.push(W);return G},$.find=(Y,G)=>{for(let W of Y)if(G(W))return W;return},$.isInteger=typeof Number.isInteger==="function"?(Y)=>Number.isInteger(Y):(Y)=>typeof Y==="number"&&Number.isFinite(Y)&&Math.floor(Y)===Y;function Q(Y,G=" | "){return Y.map((W)=>typeof W==="string"?`'${W}'`:W).join(G)}$.joinValues=Q,$.jsonStringifyReplacer=(Y,G)=>{if(typeof G==="bigint")return G.toString();return G}})(B$||(B$={}));var zG;(function($){$.mergeShapes=(J,X)=>{return{...J,...X}}})(zG||(zG={}));var m=B$.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),H0=($)=>{switch(typeof $){case"undefined":return m.undefined;case"string":return m.string;case"number":return Number.isNaN($)?m.nan:m.number;case"boolean":return m.boolean;case"function":return m.function;case"bigint":return m.bigint;case"symbol":return m.symbol;case"object":if(Array.isArray($))return m.array;if($===null)return m.null;if($.then&&typeof $.then==="function"&&$.catch&&typeof $.catch==="function")return m.promise;if(typeof Map<"u"&&$ instanceof Map)return m.map;if(typeof Set<"u"&&$ instanceof Set)return m.set;if(typeof Date<"u"&&$ instanceof Date)return m.date;return m.object;default:return m.unknown}};var h=B$.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]),kz=($)=>{return JSON.stringify($,null,2).replace(/"([^"]+)":/g,"$1:")};class TJ extends Error{get errors(){return this.issues}constructor($){super();this.issues=[],this.addIssue=(X)=>{this.issues=[...this.issues,X]},this.addIssues=(X=[])=>{this.issues=[...this.issues,...X]};let J=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,J);else this.__proto__=J;this.name="ZodError",this.issues=$}format($){let J=$||function(Y){return Y.message},X={_errors:[]},Q=(Y)=>{for(let G of Y.issues)if(G.code==="invalid_union")G.unionErrors.map(Q);else if(G.code==="invalid_return_type")Q(G.returnTypeError);else if(G.code==="invalid_arguments")Q(G.argumentsError);else if(G.path.length===0)X._errors.push(J(G));else{let W=X,U=0;while(U<G.path.length){let M=G.path[U];if(U!==G.path.length-1)W[M]=W[M]||{_errors:[]};else W[M]=W[M]||{_errors:[]},W[M]._errors.push(J(G));W=W[M],U++}}};return Q(this),X}static assert($){if(!($ instanceof TJ))throw Error(`Not a ZodError: ${$}`)}toString(){return this.message}get message(){return JSON.stringify(this.issues,B$.jsonStringifyReplacer,2)}get isEmpty(){return this.issues.length===0}flatten($=(J)=>J.message){let J={},X=[];for(let Q of this.issues)if(Q.path.length>0){let Y=Q.path[0];J[Y]=J[Y]||[],J[Y].push($(Q))}else X.push($(Q));return{formErrors:X,fieldErrors:J}}get formErrors(){return this.flatten()}}TJ.create=($)=>{return new TJ($)};var fz=($,J)=>{let X;switch($.code){case h.invalid_type:if($.received===m.undefined)X="Required";else X=`Expected ${$.expected}, received ${$.received}`;break;case h.invalid_literal:X=`Invalid literal value, expected ${JSON.stringify($.expected,B$.jsonStringifyReplacer)}`;break;case h.unrecognized_keys:X=`Unrecognized key(s) in object: ${B$.joinValues($.keys,", ")}`;break;case h.invalid_union:X="Invalid input";break;case h.invalid_union_discriminator:X=`Invalid discriminator value. Expected ${B$.joinValues($.options)}`;break;case h.invalid_enum_value:X=`Invalid enum value. Expected ${B$.joinValues($.options)}, received '${$.received}'`;break;case h.invalid_arguments:X="Invalid function arguments";break;case h.invalid_return_type:X="Invalid function return type";break;case h.invalid_date:X="Invalid date";break;case h.invalid_string:if(typeof $.validation==="object")if("includes"in $.validation){if(X=`Invalid input: must include "${$.validation.includes}"`,typeof $.validation.position==="number")X=`${X} at one or more positions greater than or equal to ${$.validation.position}`}else if("startsWith"in $.validation)X=`Invalid input: must start with "${$.validation.startsWith}"`;else if("endsWith"in $.validation)X=`Invalid input: must end with "${$.validation.endsWith}"`;else B$.assertNever($.validation);else if($.validation!=="regex")X=`Invalid ${$.validation}`;else X="Invalid";break;case h.too_small:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at least":"more than"} ${$.minimum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at least":"over"} ${$.minimum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="bigint")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${new Date(Number($.minimum))}`;else X="Invalid input";break;case h.too_big:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at most":"less than"} ${$.maximum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at most":"under"} ${$.maximum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="bigint")X=`BigInt must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly":$.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number($.maximum))}`;else X="Invalid input";break;case h.custom:X="Invalid input";break;case h.invalid_intersection_types:X="Intersection results could not be merged";break;case h.not_multiple_of:X=`Number must be a multiple of ${$.multipleOf}`;break;case h.not_finite:X="Number must be finite";break;default:X=J.defaultError,B$.assertNever($)}return{message:X}},T0=fz;var KU=T0;function yz($){KU=$}function tQ(){return KU}var XY=($)=>{let{data:J,path:X,errorMaps:Q,issueData:Y}=$,G=[...X,...Y.path||[]],W={...Y,path:G};if(Y.message!==void 0)return{...Y,path:G,message:Y.message};let U="",M=Q.filter((O)=>!!O).slice().reverse();for(let O of M)U=O(W,{data:J,defaultError:U}).message;return{...Y,path:G,message:U}},bz=[];function c($,J){let X=tQ(),Q=XY({issueData:J,data:$.data,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,X,X===T0?void 0:T0].filter((Y)=>!!Y)});$.common.issues.push(Q)}class EJ{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray($,J){let X=[];for(let Q of J){if(Q.status==="aborted")return W$;if(Q.status==="dirty")$.dirty();X.push(Q.value)}return{status:$.value,value:X}}static async mergeObjectAsync($,J){let X=[];for(let Q of J){let Y=await Q.key,G=await Q.value;X.push({key:Y,value:G})}return EJ.mergeObjectSync($,X)}static mergeObjectSync($,J){let X={};for(let Q of J){let{key:Y,value:G}=Q;if(Y.status==="aborted")return W$;if(G.status==="aborted")return W$;if(Y.status==="dirty")$.dirty();if(G.status==="dirty")$.dirty();if(Y.value!=="__proto__"&&(typeof G.value<"u"||Q.alwaysSet))X[Y.value]=G.value}return{status:$.value,value:X}}}var W$=Object.freeze({status:"aborted"}),FQ=($)=>({status:"dirty",value:$}),FJ=($)=>({status:"valid",value:$}),y9=($)=>$.status==="aborted",b9=($)=>$.status==="dirty",i0=($)=>$.status==="valid",eQ=($)=>typeof Promise<"u"&&$ instanceof Promise;var t;(function($){$.errToObj=(J)=>typeof J==="string"?{message:J}:J||{},$.toString=(J)=>typeof J==="string"?J:J?.message})(t||(t={}));class tJ{constructor($,J,X,Q){this._cachedPath=[],this.parent=$,this.data=J,this._path=X,this._key=Q}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var zU=($,J)=>{if(i0(J))return{success:!0,data:J.value};else{if(!$.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let X=new TJ($.common.issues);return this._error=X,this._error}}}};function K$($){if(!$)return{};let{errorMap:J,invalid_type_error:X,required_error:Q,description:Y}=$;if(J&&(X||Q))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if(J)return{errorMap:J,description:Y};return{errorMap:(W,U)=>{let{message:M}=$;if(W.code==="invalid_enum_value")return{message:M??U.defaultError};if(typeof U.data>"u")return{message:M??Q??U.defaultError};if(W.code!=="invalid_type")return{message:U.defaultError};return{message:M??X??U.defaultError}},description:Y}}class N${get description(){return this._def.description}_getType($){return H0($.data)}_getOrReturnCtx($,J){return J||{common:$.parent.common,data:$.data,parsedType:H0($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}_processInputParams($){return{status:new EJ,ctx:{common:$.parent.common,data:$.data,parsedType:H0($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}}_parseSync($){let J=this._parse($);if(eQ(J))throw Error("Synchronous parse encountered promise.");return J}_parseAsync($){let J=this._parse($);return Promise.resolve(J)}parse($,J){let X=this.safeParse($,J);if(X.success)return X.data;throw X.error}safeParse($,J){let X={common:{issues:[],async:J?.async??!1,contextualErrorMap:J?.errorMap},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)},Q=this._parseSync({data:$,path:X.path,parent:X});return zU(X,Q)}"~validate"($){let J={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)};if(!this["~standard"].async)try{let X=this._parseSync({data:$,path:[],parent:J});return i0(X)?{value:X.value}:{issues:J.common.issues}}catch(X){if(X?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;J.common={issues:[],async:!0}}return this._parseAsync({data:$,path:[],parent:J}).then((X)=>i0(X)?{value:X.value}:{issues:J.common.issues})}async parseAsync($,J){let X=await this.safeParseAsync($,J);if(X.success)return X.data;throw X.error}async safeParseAsync($,J){let X={common:{issues:[],contextualErrorMap:J?.errorMap,async:!0},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:H0($)},Q=this._parse({data:$,path:X.path,parent:X}),Y=await(eQ(Q)?Q:Promise.resolve(Q));return zU(X,Y)}refine($,J){let X=(Q)=>{if(typeof J==="string"||typeof J>"u")return{message:J};else if(typeof J==="function")return J(Q);else return J};return this._refinement((Q,Y)=>{let G=$(Q),W=()=>Y.addIssue({code:h.custom,...X(Q)});if(typeof Promise<"u"&&G instanceof Promise)return G.then((U)=>{if(!U)return W(),!1;else return!0});if(!G)return W(),!1;else return!0})}refinement($,J){return this._refinement((X,Q)=>{if(!$(X))return Q.addIssue(typeof J==="function"?J(X,Q):J),!1;else return!0})}_refinement($){return new eJ({schema:this,typeName:M$.ZodEffects,effect:{type:"refinement",refinement:$}})}superRefine($){return this._refinement($)}constructor($){this.spa=this.safeParseAsync,this._def=$,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:(J)=>this["~validate"](J)}}optional(){return rJ.create(this,this._def)}nullable(){return I0.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return sJ.create(this)}promise(){return RQ.create(this,this._def)}or($){return GX.create([this,$],this._def)}and($){return WX.create(this,$,this._def)}transform($){return new eJ({...K$(this._def),schema:this,typeName:M$.ZodEffects,effect:{type:"transform",transform:$}})}default($){let J=typeof $==="function"?$:()=>$;return new VX({...K$(this._def),innerType:this,defaultValue:J,typeName:M$.ZodDefault})}brand(){return new u9({typeName:M$.ZodBranded,type:this,...K$(this._def)})}catch($){let J=typeof $==="function"?$:()=>$;return new qX({...K$(this._def),innerType:this,catchValue:J,typeName:M$.ZodCatch})}describe($){return new this.constructor({...this._def,description:$})}pipe($){return OY.create(this,$)}readonly(){return HX.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var hz=/^c[^\s-]{8,}$/i,uz=/^[0-9a-z]+$/,gz=/^[0-9A-HJKMNP-TV-Z]{26}$/i,mz=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,lz=/^[a-z0-9_-]{21}$/i,pz=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,dz=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,cz=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,nz="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",EG,iz=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,oz=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,az=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,sz=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,rz=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,tz=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,FU="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",ez=new RegExp(`^${FU}$`);function NU($){let J="[0-5]\\d";if($.precision)J=`${J}\\.\\d{${$.precision}}`;else if($.precision==null)J=`${J}(\\.\\d+)?`;let X=$.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${J})${X}`}function $E($){return new RegExp(`^${NU($)}$`)}function LU($){let J=`${FU}T${NU($)}`,X=[];if(X.push($.local?"Z?":"Z"),$.offset)X.push("([+-]\\d{2}:?\\d{2})");return J=`${J}(${X.join("|")})`,new RegExp(`^${J}$`)}function JE($,J){if((J==="v4"||!J)&&iz.test($))return!0;if((J==="v6"||!J)&&az.test($))return!0;return!1}function QE($,J){if(!pz.test($))return!1;try{let[X]=$.split(".");if(!X)return!1;let Q=X.replace(/-/g,"+").replace(/_/g,"/").padEnd(X.length+(4-X.length%4)%4,"="),Y=JSON.parse(atob(Q));if(typeof Y!=="object"||Y===null)return!1;if("typ"in Y&&Y?.typ!=="JWT")return!1;if(!Y.alg)return!1;if(J&&Y.alg!==J)return!1;return!0}catch{return!1}}function XE($,J){if((J==="v4"||!J)&&oz.test($))return!0;if((J==="v6"||!J)&&sz.test($))return!0;return!1}class aJ extends N${_parse($){if(this._def.coerce)$.data=String($.data);if(this._getType($)!==m.string){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.string,received:Y.parsedType}),W$}let X=new EJ,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.length<Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="max"){if($.data.length>Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="length"){let G=$.data.length>Y.value,W=$.data.length<Y.value;if(G||W){if(Q=this._getOrReturnCtx($,Q),G)c(Q,{code:h.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});else if(W)c(Q,{code:h.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});X.dirty()}}else if(Y.kind==="email"){if(!cz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"email",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="emoji"){if(!EG)EG=new RegExp(nz,"u");if(!EG.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"emoji",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="uuid"){if(!mz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"uuid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="nanoid"){if(!lz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"nanoid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid"){if(!hz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cuid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid2"){if(!uz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cuid2",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ulid"){if(!gz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"ulid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="url")try{new URL($.data)}catch{Q=this._getOrReturnCtx($,Q),c(Q,{validation:"url",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="regex"){if(Y.regex.lastIndex=0,!Y.regex.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"regex",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="trim")$.data=$.data.trim();else if(Y.kind==="includes"){if(!$.data.includes(Y.value,Y.position))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{includes:Y.value,position:Y.position},message:Y.message}),X.dirty()}else if(Y.kind==="toLowerCase")$.data=$.data.toLowerCase();else if(Y.kind==="toUpperCase")$.data=$.data.toUpperCase();else if(Y.kind==="startsWith"){if(!$.data.startsWith(Y.value))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{startsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="endsWith"){if(!$.data.endsWith(Y.value))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{endsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="datetime"){if(!LU(Y).test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"datetime",message:Y.message}),X.dirty()}else if(Y.kind==="date"){if(!ez.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"date",message:Y.message}),X.dirty()}else if(Y.kind==="time"){if(!$E(Y).test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"time",message:Y.message}),X.dirty()}else if(Y.kind==="duration"){if(!dz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"duration",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ip"){if(!JE($.data,Y.version))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"ip",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="jwt"){if(!QE($.data,Y.alg))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"jwt",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cidr"){if(!XE($.data,Y.version))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cidr",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64"){if(!rz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"base64",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64url"){if(!tz.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"base64url",code:h.invalid_string,message:Y.message}),X.dirty()}else B$.assertNever(Y);return{status:X.value,value:$.data}}_regex($,J,X){return this.refinement((Q)=>$.test(Q),{validation:J,code:h.invalid_string,...t.errToObj(X)})}_addCheck($){return new aJ({...this._def,checks:[...this._def.checks,$]})}email($){return this._addCheck({kind:"email",...t.errToObj($)})}url($){return this._addCheck({kind:"url",...t.errToObj($)})}emoji($){return this._addCheck({kind:"emoji",...t.errToObj($)})}uuid($){return this._addCheck({kind:"uuid",...t.errToObj($)})}nanoid($){return this._addCheck({kind:"nanoid",...t.errToObj($)})}cuid($){return this._addCheck({kind:"cuid",...t.errToObj($)})}cuid2($){return this._addCheck({kind:"cuid2",...t.errToObj($)})}ulid($){return this._addCheck({kind:"ulid",...t.errToObj($)})}base64($){return this._addCheck({kind:"base64",...t.errToObj($)})}base64url($){return this._addCheck({kind:"base64url",...t.errToObj($)})}jwt($){return this._addCheck({kind:"jwt",...t.errToObj($)})}ip($){return this._addCheck({kind:"ip",...t.errToObj($)})}cidr($){return this._addCheck({kind:"cidr",...t.errToObj($)})}datetime($){if(typeof $==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:$});return this._addCheck({kind:"datetime",precision:typeof $?.precision>"u"?null:$?.precision,offset:$?.offset??!1,local:$?.local??!1,...t.errToObj($?.message)})}date($){return this._addCheck({kind:"date",message:$})}time($){if(typeof $==="string")return this._addCheck({kind:"time",precision:null,message:$});return this._addCheck({kind:"time",precision:typeof $?.precision>"u"?null:$?.precision,...t.errToObj($?.message)})}duration($){return this._addCheck({kind:"duration",...t.errToObj($)})}regex($,J){return this._addCheck({kind:"regex",regex:$,...t.errToObj(J)})}includes($,J){return this._addCheck({kind:"includes",value:$,position:J?.position,...t.errToObj(J?.message)})}startsWith($,J){return this._addCheck({kind:"startsWith",value:$,...t.errToObj(J)})}endsWith($,J){return this._addCheck({kind:"endsWith",value:$,...t.errToObj(J)})}min($,J){return this._addCheck({kind:"min",value:$,...t.errToObj(J)})}max($,J){return this._addCheck({kind:"max",value:$,...t.errToObj(J)})}length($,J){return this._addCheck({kind:"length",value:$,...t.errToObj(J)})}nonempty($){return this.min(1,t.errToObj($))}trim(){return new aJ({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new aJ({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new aJ({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find(($)=>$.kind==="datetime")}get isDate(){return!!this._def.checks.find(($)=>$.kind==="date")}get isTime(){return!!this._def.checks.find(($)=>$.kind==="time")}get isDuration(){return!!this._def.checks.find(($)=>$.kind==="duration")}get isEmail(){return!!this._def.checks.find(($)=>$.kind==="email")}get isURL(){return!!this._def.checks.find(($)=>$.kind==="url")}get isEmoji(){return!!this._def.checks.find(($)=>$.kind==="emoji")}get isUUID(){return!!this._def.checks.find(($)=>$.kind==="uuid")}get isNANOID(){return!!this._def.checks.find(($)=>$.kind==="nanoid")}get isCUID(){return!!this._def.checks.find(($)=>$.kind==="cuid")}get isCUID2(){return!!this._def.checks.find(($)=>$.kind==="cuid2")}get isULID(){return!!this._def.checks.find(($)=>$.kind==="ulid")}get isIP(){return!!this._def.checks.find(($)=>$.kind==="ip")}get isCIDR(){return!!this._def.checks.find(($)=>$.kind==="cidr")}get isBase64(){return!!this._def.checks.find(($)=>$.kind==="base64")}get isBase64url(){return!!this._def.checks.find(($)=>$.kind==="base64url")}get minLength(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxLength(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}aJ.create=($)=>{return new aJ({checks:[],typeName:M$.ZodString,coerce:$?.coerce??!1,...K$($)})};function YE($,J){let X=($.toString().split(".")[1]||"").length,Q=(J.toString().split(".")[1]||"").length,Y=X>Q?X:Q,G=Number.parseInt($.toFixed(Y).replace(".","")),W=Number.parseInt(J.toFixed(Y).replace(".",""));return G%W/10**Y}class a0 extends N${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse($){if(this._def.coerce)$.data=Number($.data);if(this._getType($)!==m.number){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.number,received:Y.parsedType}),W$}let X=void 0,Q=new EJ;for(let Y of this._def.checks)if(Y.kind==="int"){if(!B$.isInteger($.data))X=this._getOrReturnCtx($,X),c(X,{code:h.invalid_type,expected:"integer",received:"float",message:Y.message}),Q.dirty()}else if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_small,minimum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_big,maximum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if(YE($.data,Y.value)!==0)X=this._getOrReturnCtx($,X),c(X,{code:h.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else if(Y.kind==="finite"){if(!Number.isFinite($.data))X=this._getOrReturnCtx($,X),c(X,{code:h.not_finite,message:Y.message}),Q.dirty()}else B$.assertNever(Y);return{status:Q.value,value:$.data}}gte($,J){return this.setLimit("min",$,!0,t.toString(J))}gt($,J){return this.setLimit("min",$,!1,t.toString(J))}lte($,J){return this.setLimit("max",$,!0,t.toString(J))}lt($,J){return this.setLimit("max",$,!1,t.toString(J))}setLimit($,J,X,Q){return new a0({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:t.toString(Q)}]})}_addCheck($){return new a0({...this._def,checks:[...this._def.checks,$]})}int($){return this._addCheck({kind:"int",message:t.toString($)})}positive($){return this._addCheck({kind:"min",value:0,inclusive:!1,message:t.toString($)})}negative($){return this._addCheck({kind:"max",value:0,inclusive:!1,message:t.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:0,inclusive:!0,message:t.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:0,inclusive:!0,message:t.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:t.toString(J)})}finite($){return this._addCheck({kind:"finite",message:t.toString($)})}safe($){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:t.toString($)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:t.toString($)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}get isInt(){return!!this._def.checks.find(($)=>$.kind==="int"||$.kind==="multipleOf"&&B$.isInteger($.value))}get isFinite(){let $=null,J=null;for(let X of this._def.checks)if(X.kind==="finite"||X.kind==="int"||X.kind==="multipleOf")return!0;else if(X.kind==="min"){if(J===null||X.value>J)J=X.value}else if(X.kind==="max"){if($===null||X.value<$)$=X.value}return Number.isFinite(J)&&Number.isFinite($)}}a0.create=($)=>{return new a0({checks:[],typeName:M$.ZodNumber,coerce:$?.coerce||!1,...K$($)})};class s0 extends N${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse($){if(this._def.coerce)try{$.data=BigInt($.data)}catch{return this._getInvalidInput($)}if(this._getType($)!==m.bigint)return this._getInvalidInput($);let X=void 0,Q=new EJ;for(let Y of this._def.checks)if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_small,type:"bigint",minimum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_big,type:"bigint",maximum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if($.data%Y.value!==BigInt(0))X=this._getOrReturnCtx($,X),c(X,{code:h.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else B$.assertNever(Y);return{status:Q.value,value:$.data}}_getInvalidInput($){let J=this._getOrReturnCtx($);return c(J,{code:h.invalid_type,expected:m.bigint,received:J.parsedType}),W$}gte($,J){return this.setLimit("min",$,!0,t.toString(J))}gt($,J){return this.setLimit("min",$,!1,t.toString(J))}lte($,J){return this.setLimit("max",$,!0,t.toString(J))}lt($,J){return this.setLimit("max",$,!1,t.toString(J))}setLimit($,J,X,Q){return new s0({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:t.toString(Q)}]})}_addCheck($){return new s0({...this._def,checks:[...this._def.checks,$]})}positive($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:t.toString($)})}negative($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:t.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:t.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:t.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:t.toString(J)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}s0.create=($)=>{return new s0({checks:[],typeName:M$.ZodBigInt,coerce:$?.coerce??!1,...K$($)})};class QX extends N${_parse($){if(this._def.coerce)$.data=Boolean($.data);if(this._getType($)!==m.boolean){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.boolean,received:X.parsedType}),W$}return FJ($.data)}}QX.create=($)=>{return new QX({typeName:M$.ZodBoolean,coerce:$?.coerce||!1,...K$($)})};class NQ extends N${_parse($){if(this._def.coerce)$.data=new Date($.data);if(this._getType($)!==m.date){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.date,received:Y.parsedType}),W$}if(Number.isNaN($.data.getTime())){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_date}),W$}let X=new EJ,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.getTime()<Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_small,message:Y.message,inclusive:!0,exact:!1,minimum:Y.value,type:"date"}),X.dirty()}else if(Y.kind==="max"){if($.data.getTime()>Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_big,message:Y.message,inclusive:!0,exact:!1,maximum:Y.value,type:"date"}),X.dirty()}else B$.assertNever(Y);return{status:X.value,value:new Date($.data.getTime())}}_addCheck($){return new NQ({...this._def,checks:[...this._def.checks,$]})}min($,J){return this._addCheck({kind:"min",value:$.getTime(),message:t.toString(J)})}max($,J){return this._addCheck({kind:"max",value:$.getTime(),message:t.toString(J)})}get minDate(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $!=null?new Date($):null}get maxDate(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $!=null?new Date($):null}}NQ.create=($)=>{return new NQ({checks:[],coerce:$?.coerce||!1,typeName:M$.ZodDate,...K$($)})};class YY extends N${_parse($){if(this._getType($)!==m.symbol){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.symbol,received:X.parsedType}),W$}return FJ($.data)}}YY.create=($)=>{return new YY({typeName:M$.ZodSymbol,...K$($)})};class XX extends N${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.undefined,received:X.parsedType}),W$}return FJ($.data)}}XX.create=($)=>{return new XX({typeName:M$.ZodUndefined,...K$($)})};class YX extends N${_parse($){if(this._getType($)!==m.null){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.null,received:X.parsedType}),W$}return FJ($.data)}}YX.create=($)=>{return new YX({typeName:M$.ZodNull,...K$($)})};class LQ extends N${constructor(){super(...arguments);this._any=!0}_parse($){return FJ($.data)}}LQ.create=($)=>{return new LQ({typeName:M$.ZodAny,...K$($)})};class o0 extends N${constructor(){super(...arguments);this._unknown=!0}_parse($){return FJ($.data)}}o0.create=($)=>{return new o0({typeName:M$.ZodUnknown,...K$($)})};class K0 extends N${_parse($){let J=this._getOrReturnCtx($);return c(J,{code:h.invalid_type,expected:m.never,received:J.parsedType}),W$}}K0.create=($)=>{return new K0({typeName:M$.ZodNever,...K$($)})};class GY extends N${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.void,received:X.parsedType}),W$}return FJ($.data)}}GY.create=($)=>{return new GY({typeName:M$.ZodVoid,...K$($)})};class sJ extends N${_parse($){let{ctx:J,status:X}=this._processInputParams($),Q=this._def;if(J.parsedType!==m.array)return c(J,{code:h.invalid_type,expected:m.array,received:J.parsedType}),W$;if(Q.exactLength!==null){let G=J.data.length>Q.exactLength.value,W=J.data.length<Q.exactLength.value;if(G||W)c(J,{code:G?h.too_big:h.too_small,minimum:W?Q.exactLength.value:void 0,maximum:G?Q.exactLength.value:void 0,type:"array",inclusive:!0,exact:!0,message:Q.exactLength.message}),X.dirty()}if(Q.minLength!==null){if(J.data.length<Q.minLength.value)c(J,{code:h.too_small,minimum:Q.minLength.value,type:"array",inclusive:!0,exact:!1,message:Q.minLength.message}),X.dirty()}if(Q.maxLength!==null){if(J.data.length>Q.maxLength.value)c(J,{code:h.too_big,maximum:Q.maxLength.value,type:"array",inclusive:!0,exact:!1,message:Q.maxLength.message}),X.dirty()}if(J.common.async)return Promise.all([...J.data].map((G,W)=>{return Q.type._parseAsync(new tJ(J,G,J.path,W))})).then((G)=>{return EJ.mergeArray(X,G)});let Y=[...J.data].map((G,W)=>{return Q.type._parseSync(new tJ(J,G,J.path,W))});return EJ.mergeArray(X,Y)}get element(){return this._def.type}min($,J){return new sJ({...this._def,minLength:{value:$,message:t.toString(J)}})}max($,J){return new sJ({...this._def,maxLength:{value:$,message:t.toString(J)}})}length($,J){return new sJ({...this._def,exactLength:{value:$,message:t.toString(J)}})}nonempty($){return this.min(1,$)}}sJ.create=($,J)=>{return new sJ({type:$,minLength:null,maxLength:null,exactLength:null,typeName:M$.ZodArray,...K$(J)})};function $X($){if($ instanceof a$){let J={};for(let X in $.shape){let Q=$.shape[X];J[X]=rJ.create($X(Q))}return new a$({...$._def,shape:()=>J})}else if($ instanceof sJ)return new sJ({...$._def,type:$X($.element)});else if($ instanceof rJ)return rJ.create($X($.unwrap()));else if($ instanceof I0)return I0.create($X($.unwrap()));else if($ instanceof z0)return z0.create($.items.map((J)=>$X(J)));else return $}class a$ extends N${constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let $=this._def.shape(),J=B$.objectKeys($);return this._cached={shape:$,keys:J},this._cached}_parse($){if(this._getType($)!==m.object){let M=this._getOrReturnCtx($);return c(M,{code:h.invalid_type,expected:m.object,received:M.parsedType}),W$}let{status:X,ctx:Q}=this._processInputParams($),{shape:Y,keys:G}=this._getCached(),W=[];if(!(this._def.catchall instanceof K0&&this._def.unknownKeys==="strip")){for(let M in Q.data)if(!G.includes(M))W.push(M)}let U=[];for(let M of G){let O=Y[M],V=Q.data[M];U.push({key:{status:"valid",value:M},value:O._parse(new tJ(Q,V,Q.path,M)),alwaysSet:M in Q.data})}if(this._def.catchall instanceof K0){let M=this._def.unknownKeys;if(M==="passthrough")for(let O of W)U.push({key:{status:"valid",value:O},value:{status:"valid",value:Q.data[O]}});else if(M==="strict"){if(W.length>0)c(Q,{code:h.unrecognized_keys,keys:W}),X.dirty()}else if(M==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let M=this._def.catchall;for(let O of W){let V=Q.data[O];U.push({key:{status:"valid",value:O},value:M._parse(new tJ(Q,V,Q.path,O)),alwaysSet:O in Q.data})}}if(Q.common.async)return Promise.resolve().then(async()=>{let M=[];for(let O of U){let V=await O.key,q=await O.value;M.push({key:V,value:q,alwaysSet:O.alwaysSet})}return M}).then((M)=>{return EJ.mergeObjectSync(X,M)});else return EJ.mergeObjectSync(X,U)}get shape(){return this._def.shape()}strict($){return t.errToObj,new a$({...this._def,unknownKeys:"strict",...$!==void 0?{errorMap:(J,X)=>{let Q=this._def.errorMap?.(J,X).message??X.defaultError;if(J.code==="unrecognized_keys")return{message:t.errToObj($).message??Q};return{message:Q}}}:{}})}strip(){return new a$({...this._def,unknownKeys:"strip"})}passthrough(){return new a$({...this._def,unknownKeys:"passthrough"})}extend($){return new a$({...this._def,shape:()=>({...this._def.shape(),...$})})}merge($){return new a$({unknownKeys:$._def.unknownKeys,catchall:$._def.catchall,shape:()=>({...this._def.shape(),...$._def.shape()}),typeName:M$.ZodObject})}setKey($,J){return this.augment({[$]:J})}catchall($){return new a$({...this._def,catchall:$})}pick($){let J={};for(let X of B$.objectKeys($))if($[X]&&this.shape[X])J[X]=this.shape[X];return new a$({...this._def,shape:()=>J})}omit($){let J={};for(let X of B$.objectKeys(this.shape))if(!$[X])J[X]=this.shape[X];return new a$({...this._def,shape:()=>J})}deepPartial(){return $X(this)}partial($){let J={};for(let X of B$.objectKeys(this.shape)){let Q=this.shape[X];if($&&!$[X])J[X]=Q;else J[X]=Q.optional()}return new a$({...this._def,shape:()=>J})}required($){let J={};for(let X of B$.objectKeys(this.shape))if($&&!$[X])J[X]=this.shape[X];else{let Y=this.shape[X];while(Y instanceof rJ)Y=Y._def.innerType;J[X]=Y}return new a$({...this._def,shape:()=>J})}keyof(){return AU(B$.objectKeys(this.shape))}}a$.create=($,J)=>{return new a$({shape:()=>$,unknownKeys:"strip",catchall:K0.create(),typeName:M$.ZodObject,...K$(J)})};a$.strictCreate=($,J)=>{return new a$({shape:()=>$,unknownKeys:"strict",catchall:K0.create(),typeName:M$.ZodObject,...K$(J)})};a$.lazycreate=($,J)=>{return new a$({shape:$,unknownKeys:"strip",catchall:K0.create(),typeName:M$.ZodObject,...K$(J)})};class GX extends N${_parse($){let{ctx:J}=this._processInputParams($),X=this._def.options;function Q(Y){for(let W of Y)if(W.result.status==="valid")return W.result;for(let W of Y)if(W.result.status==="dirty")return J.common.issues.push(...W.ctx.common.issues),W.result;let G=Y.map((W)=>new TJ(W.ctx.common.issues));return c(J,{code:h.invalid_union,unionErrors:G}),W$}if(J.common.async)return Promise.all(X.map(async(Y)=>{let G={...J,common:{...J.common,issues:[]},parent:null};return{result:await Y._parseAsync({data:J.data,path:J.path,parent:G}),ctx:G}})).then(Q);else{let Y=void 0,G=[];for(let U of X){let M={...J,common:{...J.common,issues:[]},parent:null},O=U._parseSync({data:J.data,path:J.path,parent:M});if(O.status==="valid")return O;else if(O.status==="dirty"&&!Y)Y={result:O,ctx:M};if(M.common.issues.length)G.push(M.common.issues)}if(Y)return J.common.issues.push(...Y.ctx.common.issues),Y.result;let W=G.map((U)=>new TJ(U));return c(J,{code:h.invalid_union,unionErrors:W}),W$}}get options(){return this._def.options}}GX.create=($,J)=>{return new GX({options:$,typeName:M$.ZodUnion,...K$(J)})};var S0=($)=>{if($ instanceof UX)return S0($.schema);else if($ instanceof eJ)return S0($.innerType());else if($ instanceof MX)return[$.value];else if($ instanceof r0)return $.options;else if($ instanceof OX)return B$.objectValues($.enum);else if($ instanceof VX)return S0($._def.innerType);else if($ instanceof XX)return[void 0];else if($ instanceof YX)return[null];else if($ instanceof rJ)return[void 0,...S0($.unwrap())];else if($ instanceof I0)return[null,...S0($.unwrap())];else if($ instanceof u9)return S0($.unwrap());else if($ instanceof HX)return S0($.unwrap());else if($ instanceof qX)return S0($._def.innerType);else return[]};class h9 extends N${_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.object)return c(J,{code:h.invalid_type,expected:m.object,received:J.parsedType}),W$;let X=this.discriminator,Q=J.data[X],Y=this.optionsMap.get(Q);if(!Y)return c(J,{code:h.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[X]}),W$;if(J.common.async)return Y._parseAsync({data:J.data,path:J.path,parent:J});else return Y._parseSync({data:J.data,path:J.path,parent:J})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create($,J,X){let Q=new Map;for(let Y of J){let G=S0(Y.shape[$]);if(!G.length)throw Error(`A discriminator value for key \`${$}\` could not be extracted from all schema options`);for(let W of G){if(Q.has(W))throw Error(`Discriminator property ${String($)} has duplicate value ${String(W)}`);Q.set(W,Y)}}return new h9({typeName:M$.ZodDiscriminatedUnion,discriminator:$,options:J,optionsMap:Q,...K$(X)})}}function FG($,J){let X=H0($),Q=H0(J);if($===J)return{valid:!0,data:$};else if(X===m.object&&Q===m.object){let Y=B$.objectKeys(J),G=B$.objectKeys($).filter((U)=>Y.indexOf(U)!==-1),W={...$,...J};for(let U of G){let M=FG($[U],J[U]);if(!M.valid)return{valid:!1};W[U]=M.data}return{valid:!0,data:W}}else if(X===m.array&&Q===m.array){if($.length!==J.length)return{valid:!1};let Y=[];for(let G=0;G<$.length;G++){let W=$[G],U=J[G],M=FG(W,U);if(!M.valid)return{valid:!1};Y.push(M.data)}return{valid:!0,data:Y}}else if(X===m.date&&Q===m.date&&+$===+J)return{valid:!0,data:$};else return{valid:!1}}class WX extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=(Y,G)=>{if(y9(Y)||y9(G))return W$;let W=FG(Y.value,G.value);if(!W.valid)return c(X,{code:h.invalid_intersection_types}),W$;if(b9(Y)||b9(G))J.dirty();return{status:J.value,value:W.data}};if(X.common.async)return Promise.all([this._def.left._parseAsync({data:X.data,path:X.path,parent:X}),this._def.right._parseAsync({data:X.data,path:X.path,parent:X})]).then(([Y,G])=>Q(Y,G));else return Q(this._def.left._parseSync({data:X.data,path:X.path,parent:X}),this._def.right._parseSync({data:X.data,path:X.path,parent:X}))}}WX.create=($,J,X)=>{return new WX({left:$,right:J,typeName:M$.ZodIntersection,...K$(X)})};class z0 extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.array)return c(X,{code:h.invalid_type,expected:m.array,received:X.parsedType}),W$;if(X.data.length<this._def.items.length)return c(X,{code:h.too_small,minimum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),W$;if(!this._def.rest&&X.data.length>this._def.items.length)c(X,{code:h.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),J.dirty();let Y=[...X.data].map((G,W)=>{let U=this._def.items[W]||this._def.rest;if(!U)return null;return U._parse(new tJ(X,G,X.path,W))}).filter((G)=>!!G);if(X.common.async)return Promise.all(Y).then((G)=>{return EJ.mergeArray(J,G)});else return EJ.mergeArray(J,Y)}get items(){return this._def.items}rest($){return new z0({...this._def,rest:$})}}z0.create=($,J)=>{if(!Array.isArray($))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new z0({items:$,typeName:M$.ZodTuple,rest:null,...K$(J)})};class WY extends N${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.object)return c(X,{code:h.invalid_type,expected:m.object,received:X.parsedType}),W$;let Q=[],Y=this._def.keyType,G=this._def.valueType;for(let W in X.data)Q.push({key:Y._parse(new tJ(X,W,X.path,W)),value:G._parse(new tJ(X,X.data[W],X.path,W)),alwaysSet:W in X.data});if(X.common.async)return EJ.mergeObjectAsync(J,Q);else return EJ.mergeObjectSync(J,Q)}get element(){return this._def.valueType}static create($,J,X){if(J instanceof N$)return new WY({keyType:$,valueType:J,typeName:M$.ZodRecord,...K$(X)});return new WY({keyType:aJ.create(),valueType:$,typeName:M$.ZodRecord,...K$(J)})}}class UY extends N${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.map)return c(X,{code:h.invalid_type,expected:m.map,received:X.parsedType}),W$;let Q=this._def.keyType,Y=this._def.valueType,G=[...X.data.entries()].map(([W,U],M)=>{return{key:Q._parse(new tJ(X,W,X.path,[M,"key"])),value:Y._parse(new tJ(X,U,X.path,[M,"value"]))}});if(X.common.async){let W=new Map;return Promise.resolve().then(async()=>{for(let U of G){let M=await U.key,O=await U.value;if(M.status==="aborted"||O.status==="aborted")return W$;if(M.status==="dirty"||O.status==="dirty")J.dirty();W.set(M.value,O.value)}return{status:J.value,value:W}})}else{let W=new Map;for(let U of G){let{key:M,value:O}=U;if(M.status==="aborted"||O.status==="aborted")return W$;if(M.status==="dirty"||O.status==="dirty")J.dirty();W.set(M.value,O.value)}return{status:J.value,value:W}}}}UY.create=($,J,X)=>{return new UY({valueType:J,keyType:$,typeName:M$.ZodMap,...K$(X)})};class AQ extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.set)return c(X,{code:h.invalid_type,expected:m.set,received:X.parsedType}),W$;let Q=this._def;if(Q.minSize!==null){if(X.data.size<Q.minSize.value)c(X,{code:h.too_small,minimum:Q.minSize.value,type:"set",inclusive:!0,exact:!1,message:Q.minSize.message}),J.dirty()}if(Q.maxSize!==null){if(X.data.size>Q.maxSize.value)c(X,{code:h.too_big,maximum:Q.maxSize.value,type:"set",inclusive:!0,exact:!1,message:Q.maxSize.message}),J.dirty()}let Y=this._def.valueType;function G(U){let M=new Set;for(let O of U){if(O.status==="aborted")return W$;if(O.status==="dirty")J.dirty();M.add(O.value)}return{status:J.value,value:M}}let W=[...X.data.values()].map((U,M)=>Y._parse(new tJ(X,U,X.path,M)));if(X.common.async)return Promise.all(W).then((U)=>G(U));else return G(W)}min($,J){return new AQ({...this._def,minSize:{value:$,message:t.toString(J)}})}max($,J){return new AQ({...this._def,maxSize:{value:$,message:t.toString(J)}})}size($,J){return this.min($,J).max($,J)}nonempty($){return this.min(1,$)}}AQ.create=($,J)=>{return new AQ({valueType:$,minSize:null,maxSize:null,typeName:M$.ZodSet,...K$(J)})};class JX extends N${constructor(){super(...arguments);this.validate=this.implement}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.function)return c(J,{code:h.invalid_type,expected:m.function,received:J.parsedType}),W$;function X(W,U){return XY({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,tQ(),T0].filter((M)=>!!M),issueData:{code:h.invalid_arguments,argumentsError:U}})}function Q(W,U){return XY({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,tQ(),T0].filter((M)=>!!M),issueData:{code:h.invalid_return_type,returnTypeError:U}})}let Y={errorMap:J.common.contextualErrorMap},G=J.data;if(this._def.returns instanceof RQ){let W=this;return FJ(async function(...U){let M=new TJ([]),O=await W._def.args.parseAsync(U,Y).catch((H)=>{throw M.addIssue(X(U,H)),M}),V=await Reflect.apply(G,this,O);return await W._def.returns._def.type.parseAsync(V,Y).catch((H)=>{throw M.addIssue(Q(V,H)),M})})}else{let W=this;return FJ(function(...U){let M=W._def.args.safeParse(U,Y);if(!M.success)throw new TJ([X(U,M.error)]);let O=Reflect.apply(G,this,M.data),V=W._def.returns.safeParse(O,Y);if(!V.success)throw new TJ([Q(O,V.error)]);return V.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(...$){return new JX({...this._def,args:z0.create($).rest(o0.create())})}returns($){return new JX({...this._def,returns:$})}implement($){return this.parse($)}strictImplement($){return this.parse($)}static create($,J,X){return new JX({args:$?$:z0.create([]).rest(o0.create()),returns:J||o0.create(),typeName:M$.ZodFunction,...K$(X)})}}class UX extends N${get schema(){return this._def.getter()}_parse($){let{ctx:J}=this._processInputParams($);return this._def.getter()._parse({data:J.data,path:J.path,parent:J})}}UX.create=($,J)=>{return new UX({getter:$,typeName:M$.ZodLazy,...K$(J)})};class MX extends N${_parse($){if($.data!==this._def.value){let J=this._getOrReturnCtx($);return c(J,{received:J.data,code:h.invalid_literal,expected:this._def.value}),W$}return{status:"valid",value:$.data}}get value(){return this._def.value}}MX.create=($,J)=>{return new MX({value:$,typeName:M$.ZodLiteral,...K$(J)})};function AU($,J){return new r0({values:$,typeName:M$.ZodEnum,...K$(J)})}class r0 extends N${_parse($){if(typeof $.data!=="string"){let J=this._getOrReturnCtx($),X=this._def.values;return c(J,{expected:B$.joinValues(X),received:J.parsedType,code:h.invalid_type}),W$}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has($.data)){let J=this._getOrReturnCtx($),X=this._def.values;return c(J,{received:J.data,code:h.invalid_enum_value,options:X}),W$}return FJ($.data)}get options(){return this._def.values}get enum(){let $={};for(let J of this._def.values)$[J]=J;return $}get Values(){let $={};for(let J of this._def.values)$[J]=J;return $}get Enum(){let $={};for(let J of this._def.values)$[J]=J;return $}extract($,J=this._def){return r0.create($,{...this._def,...J})}exclude($,J=this._def){return r0.create(this.options.filter((X)=>!$.includes(X)),{...this._def,...J})}}r0.create=AU;class OX extends N${_parse($){let J=B$.getValidEnumValues(this._def.values),X=this._getOrReturnCtx($);if(X.parsedType!==m.string&&X.parsedType!==m.number){let Q=B$.objectValues(J);return c(X,{expected:B$.joinValues(Q),received:X.parsedType,code:h.invalid_type}),W$}if(!this._cache)this._cache=new Set(B$.getValidEnumValues(this._def.values));if(!this._cache.has($.data)){let Q=B$.objectValues(J);return c(X,{received:X.data,code:h.invalid_enum_value,options:Q}),W$}return FJ($.data)}get enum(){return this._def.values}}OX.create=($,J)=>{return new OX({values:$,typeName:M$.ZodNativeEnum,...K$(J)})};class RQ extends N${unwrap(){return this._def.type}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.promise&&J.common.async===!1)return c(J,{code:h.invalid_type,expected:m.promise,received:J.parsedType}),W$;let X=J.parsedType===m.promise?J.data:Promise.resolve(J.data);return FJ(X.then((Q)=>{return this._def.type.parseAsync(Q,{path:J.path,errorMap:J.common.contextualErrorMap})}))}}RQ.create=($,J)=>{return new RQ({type:$,typeName:M$.ZodPromise,...K$(J)})};class eJ extends N${innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===M$.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=this._def.effect||null,Y={addIssue:(G)=>{if(c(X,G),G.fatal)J.abort();else J.dirty()},get path(){return X.path}};if(Y.addIssue=Y.addIssue.bind(Y),Q.type==="preprocess"){let G=Q.transform(X.data,Y);if(X.common.async)return Promise.resolve(G).then(async(W)=>{if(J.value==="aborted")return W$;let U=await this._def.schema._parseAsync({data:W,path:X.path,parent:X});if(U.status==="aborted")return W$;if(U.status==="dirty")return FQ(U.value);if(J.value==="dirty")return FQ(U.value);return U});else{if(J.value==="aborted")return W$;let W=this._def.schema._parseSync({data:G,path:X.path,parent:X});if(W.status==="aborted")return W$;if(W.status==="dirty")return FQ(W.value);if(J.value==="dirty")return FQ(W.value);return W}}if(Q.type==="refinement"){let G=(W)=>{let U=Q.refinement(W,Y);if(X.common.async)return Promise.resolve(U);if(U instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return W};if(X.common.async===!1){let W=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(W.status==="aborted")return W$;if(W.status==="dirty")J.dirty();return G(W.value),{status:J.value,value:W.value}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((W)=>{if(W.status==="aborted")return W$;if(W.status==="dirty")J.dirty();return G(W.value).then(()=>{return{status:J.value,value:W.value}})})}if(Q.type==="transform")if(X.common.async===!1){let G=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(!i0(G))return W$;let W=Q.transform(G.value,Y);if(W instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:J.value,value:W}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((G)=>{if(!i0(G))return W$;return Promise.resolve(Q.transform(G.value,Y)).then((W)=>({status:J.value,value:W}))});B$.assertNever(Q)}}eJ.create=($,J,X)=>{return new eJ({schema:$,typeName:M$.ZodEffects,effect:J,...K$(X)})};eJ.createWithPreprocess=($,J,X)=>{return new eJ({schema:J,effect:{type:"preprocess",transform:$},typeName:M$.ZodEffects,...K$(X)})};class rJ extends N${_parse($){if(this._getType($)===m.undefined)return FJ(void 0);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}rJ.create=($,J)=>{return new rJ({innerType:$,typeName:M$.ZodOptional,...K$(J)})};class I0 extends N${_parse($){if(this._getType($)===m.null)return FJ(null);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}I0.create=($,J)=>{return new I0({innerType:$,typeName:M$.ZodNullable,...K$(J)})};class VX extends N${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;if(J.parsedType===m.undefined)X=this._def.defaultValue();return this._def.innerType._parse({data:X,path:J.path,parent:J})}removeDefault(){return this._def.innerType}}VX.create=($,J)=>{return new VX({innerType:$,typeName:M$.ZodDefault,defaultValue:typeof J.default==="function"?J.default:()=>J.default,...K$(J)})};class qX extends N${_parse($){let{ctx:J}=this._processInputParams($),X={...J,common:{...J.common,issues:[]}},Q=this._def.innerType._parse({data:X.data,path:X.path,parent:{...X}});if(eQ(Q))return Q.then((Y)=>{return{status:"valid",value:Y.status==="valid"?Y.value:this._def.catchValue({get error(){return new TJ(X.common.issues)},input:X.data})}});else return{status:"valid",value:Q.status==="valid"?Q.value:this._def.catchValue({get error(){return new TJ(X.common.issues)},input:X.data})}}removeCatch(){return this._def.innerType}}qX.create=($,J)=>{return new qX({innerType:$,typeName:M$.ZodCatch,catchValue:typeof J.catch==="function"?J.catch:()=>J.catch,...K$(J)})};class MY extends N${_parse($){if(this._getType($)!==m.nan){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.nan,received:X.parsedType}),W$}return{status:"valid",value:$.data}}}MY.create=($)=>{return new MY({typeName:M$.ZodNaN,...K$($)})};var GE=Symbol("zod_brand");class u9 extends N${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;return this._def.type._parse({data:X,path:J.path,parent:J})}unwrap(){return this._def.type}}class OY extends N${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.common.async)return(async()=>{let Y=await this._def.in._parseAsync({data:X.data,path:X.path,parent:X});if(Y.status==="aborted")return W$;if(Y.status==="dirty")return J.dirty(),FQ(Y.value);else return this._def.out._parseAsync({data:Y.value,path:X.path,parent:X})})();else{let Q=this._def.in._parseSync({data:X.data,path:X.path,parent:X});if(Q.status==="aborted")return W$;if(Q.status==="dirty")return J.dirty(),{status:"dirty",value:Q.value};else return this._def.out._parseSync({data:Q.value,path:X.path,parent:X})}}static create($,J){return new OY({in:$,out:J,typeName:M$.ZodPipeline})}}class HX extends N${_parse($){let J=this._def.innerType._parse($),X=(Q)=>{if(i0(Q))Q.value=Object.freeze(Q.value);return Q};return eQ(J)?J.then((Q)=>X(Q)):X(J)}unwrap(){return this._def.innerType}}HX.create=($,J)=>{return new HX({innerType:$,typeName:M$.ZodReadonly,...K$(J)})};function EU($,J){let X=typeof $==="function"?$(J):typeof $==="string"?{message:$}:$;return typeof X==="string"?{message:X}:X}function RU($,J={},X){if($)return LQ.create().superRefine((Q,Y)=>{let G=$(Q);if(G instanceof Promise)return G.then((W)=>{if(!W){let U=EU(J,Q),M=U.fatal??X??!0;Y.addIssue({code:"custom",...U,fatal:M})}});if(!G){let W=EU(J,Q),U=W.fatal??X??!0;Y.addIssue({code:"custom",...W,fatal:U})}return});return LQ.create()}var WE={object:a$.lazycreate},M$;(function($){$.ZodString="ZodString",$.ZodNumber="ZodNumber",$.ZodNaN="ZodNaN",$.ZodBigInt="ZodBigInt",$.ZodBoolean="ZodBoolean",$.ZodDate="ZodDate",$.ZodSymbol="ZodSymbol",$.ZodUndefined="ZodUndefined",$.ZodNull="ZodNull",$.ZodAny="ZodAny",$.ZodUnknown="ZodUnknown",$.ZodNever="ZodNever",$.ZodVoid="ZodVoid",$.ZodArray="ZodArray",$.ZodObject="ZodObject",$.ZodUnion="ZodUnion",$.ZodDiscriminatedUnion="ZodDiscriminatedUnion",$.ZodIntersection="ZodIntersection",$.ZodTuple="ZodTuple",$.ZodRecord="ZodRecord",$.ZodMap="ZodMap",$.ZodSet="ZodSet",$.ZodFunction="ZodFunction",$.ZodLazy="ZodLazy",$.ZodLiteral="ZodLiteral",$.ZodEnum="ZodEnum",$.ZodEffects="ZodEffects",$.ZodNativeEnum="ZodNativeEnum",$.ZodOptional="ZodOptional",$.ZodNullable="ZodNullable",$.ZodDefault="ZodDefault",$.ZodCatch="ZodCatch",$.ZodPromise="ZodPromise",$.ZodBranded="ZodBranded",$.ZodPipeline="ZodPipeline",$.ZodReadonly="ZodReadonly"})(M$||(M$={}));var UE=($,J={message:`Input not instance of ${$.name}`})=>RU((X)=>X instanceof $,J),DU=aJ.create,ZU=a0.create,ME=MY.create,OE=s0.create,BU=QX.create,VE=NQ.create,qE=YY.create,HE=XX.create,KE=YX.create,zE=LQ.create,EE=o0.create,FE=K0.create,NE=GY.create,LE=sJ.create,AE=a$.create,RE=a$.strictCreate,DE=GX.create,ZE=h9.create,BE=WX.create,jE=z0.create,TE=WY.create,SE=UY.create,IE=AQ.create,CE=JX.create,wE=UX.create,PE=MX.create,_E=r0.create,xE=OX.create,vE=RQ.create,kE=eJ.create,fE=rJ.create,yE=I0.create,bE=eJ.createWithPreprocess,hE=OY.create,uE=()=>DU().optional(),gE=()=>ZU().optional(),mE=()=>BU().optional(),lE={string:($)=>aJ.create({...$,coerce:!0}),number:($)=>a0.create({...$,coerce:!0}),boolean:($)=>QX.create({...$,coerce:!0}),bigint:($)=>s0.create({...$,coerce:!0}),date:($)=>NQ.create({...$,coerce:!0})};var pE=W$;function LG($){if(dE($)===6)return!0;if($.includes("://")||$.includes("/")||$.includes(":"))return!1;if($==="localhost")return!0;if($.startsWith("*.")){let J=$.slice(2);if(!J.includes(".")||J.startsWith(".")||J.endsWith("."))return!1;let X=J.split(".");return X.length>=2&&X.every((Q)=>Q.length>0)}if($.includes("*"))return!1;return $.includes(".")&&!$.startsWith(".")&&!$.endsWith(".")}var AG='Invalid domain pattern. Must be a valid domain (e.g., "example.com"), a wildcard (e.g., "*.example.com"), or a bracketed IPv6 literal (e.g., "[::1]", "[2001:db8::1]:443"). Overly broad patterns like "*.com" or "*" are not allowed for security reasons.',m9=x.string().refine(LG,{message:AG});function SU($){let J=$.indexOf(":");return!(J!==-1&&$.indexOf(":",J+1)!==-1)||$.startsWith("[")}var nE=x.string().refine(($)=>SU($)&&LG(iX($).hostPattern),{message:AG+' An optional ":port" suffix (1-65535) restricts the entry to that port.'}),iE=x.string().refine(($)=>{if(!SU($))return!1;let{hostPattern:J}=iX($);return J==="*"||LG(J)},{message:AG+' In deniedDomains a bare "*" (deny-all) is also accepted, and an optional ":port" suffix (1-65535) restricts the entry to that port.'}),VY=x.string().min(1,"Path cannot be empty"),jU=x.string().min(1,"Path cannot be empty").refine(($)=>cE($),{message:"Binary path must be absolute"}),oE=x.object({socketPath:x.string().min(1).describe("Unix socket path to the MITM proxy"),domains:x.array(m9).min(1).describe('Domains to route through the MITM proxy (e.g., ["api.example.com", "*.internal.org"])')}),aE=x.object({http:x.string().url().optional().describe("Upstream proxy URL for plain HTTP traffic"),https:x.string().url().optional().describe("Upstream proxy URL for HTTPS/CONNECT traffic (falls back to http if unset)"),noProxy:x.string().optional().describe("Comma-separated NO_PROXY list (hostname suffixes and CIDR ranges). Matching destinations connect directly instead of via the parent proxy.")}),IU=x.enum(["deny","mask"]),g9=x.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/,"Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores"),CU=x.string().superRefine(($,J)=>{try{let{groupCount:X}=B7($);if(X<1)J.addIssue({code:x.ZodIssueCode.custom,message:"extract must contain at least one capturing group \u2014 group 1 is "+'the credential value to mask (e.g. "token:\\s*(\\S+)").'})}catch(X){J.addIssue({code:x.ZodIssueCode.custom,message:X instanceof Error?X.message:"Credential extract pattern is invalid"})}}),sE=x.object({path:VY.describe("Path to a credential file or directory. Supports the same path forms as filesystem.denyRead (absolute paths and ~ expansion)."),mode:IU.describe("Access mode for this path"),extract:CU.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the file is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe("What to do when extract matches nothing (or, with decode, no "+'candidate verifies): "warn" (default \u2014 stderr warning, file left '+'readable), "deny" (degrade to mode "deny" \u2014 file unreadable), or '+'"error" (throw at wrap time). Only meaningful with mode "mask" and extract or decode set.'),decode:x.enum(["jwt"]).optional().describe('Optional encoded-credential format. "jwt": decodes recognized JWTs so masking can target fields inside them (see maskClaims). Candidates are located with a built-in JWT regex (or the explicit extract pattern, if set) and verified to actually be JWTs before masking. Without maskClaims, the whole decoded value is treated as the credential and replaced with a structurally valid fake JWT, so client-side token parsing keeps working. If no candidate verifies, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches in any verified token, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskDuplicates:x.boolean().optional().describe("If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the "+"corresponding sentinel \u2014 for a secret repeated where the regex "+`does not reach (e.g. in a comment). Matches raw substrings: short or common credential values may corrupt unrelated content, so this is intended for long, high-entropy secrets. With decode, only values that passed verification are scanned; duplicates reuse the verified value's fake without re-verification. Defaults to false. Only meaningful with mode "mask" and extract or decode set; accepted but ignored otherwise.`),injectHosts:x.array(m9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),rE=x.object({name:g9.describe("Environment variable name"),mode:IU.describe("Access mode for this environment variable"),extract:CU.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the value is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe('What to do when extract matches nothing: "warn" (default \u2014 stderr '+'warning, variable passes through unmasked), "deny" (variable unset inside the sandbox), or "error" (throw at wrap time). Only meaningful with mode "mask" and extract set.'),decode:x.enum(["jwt"]).optional().describe(`Optional encoded-credential format. "jwt": the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".`),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHosts:x.array(m9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),tE=x.object({accessKeyIdVar:g9.describe("Name of the masked env var holding the AWS access key id."),secretAccessKeyVar:g9.describe("Name of the masked env var holding the AWS secret access key."),sessionTokenVar:g9.optional().describe("Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.")}).strict(),NG=x.enum(["deny","passthrough"]),eE=x.object({streaming:NG.optional().describe('Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. Default "deny".'),presigned:NG.optional().describe('Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. Default "deny".'),sigv4a:NG.optional().describe('Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. Default "deny".')}).strict(),wU=x.object({files:x.array(sE).optional().describe("Credential files or directories to protect"),envVars:x.array(rE).optional().describe("Environment variables to protect"),allowPlaintextInject:x.boolean().optional().describe("Allow sentinel\u2192real substitution on the plain-HTTP proxy path. "+"Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures."),awsPairs:x.array(tE).optional().describe("Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked."),sigv4:eE.optional().describe('Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: "deny" (default) or "passthrough".')}).strict(),TU=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/,$F=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/,JF=x.object({url:x.string().url().refine(($)=>new URL($).protocol==="https:",{message:"brokerForward.url must be https"}),tokenEnvVar:x.string().regex(TU),rules:x.array(x.object({envVar:x.string().regex(TU),hosts:x.array(x.string().regex($F)).min(1).max(16)}).strict()).min(1).max(32)}).strict(),PU=x.object({allowedDomains:x.array(nE).describe('List of allowed domains (e.g., ["github.com", "*.npmjs.org", "api.example.com:443"]). An optional ":port" suffix restricts the entry to that destination port.'),deniedDomains:x.array(iE).describe('List of denied domains. Unlike allowedDomains, a bare "*" is accepted here (deny-all). An optional ":port" suffix (e.g., "*:22") restricts the entry to that destination port.'),deniedDomainReasons:x.record(x.string(),x.string().min(1)).optional().describe('Optional model-facing reason keyed by the exact deniedDomains entry it explains (e.g., {"github.com:22": "SSH pushes to GitHub are blocked; use an https remote"}). Reported in the <sandbox_violations> line when that entry denies a connection; entries without one use a generic reason. Keys are matched by exact entry string, so a key with no matching deniedDomains entry never fires.'),strictAllowlist:x.boolean().optional().describe("If true, hosts not in allowedDomains are denied without consulting the ask callback. Set this when allowedDomains is policy enforcement, not a prompt-suppression hint."),allowUnixSockets:x.array(x.string()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),allowAllUnixSockets:x.boolean().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),allowLocalBinding:x.boolean().optional().describe("Whether to allow binding to local ports (default: false)"),allowMachLookup:x.array(x.string().refine(($)=>{return!($.endsWith("*")?$.slice(0,-1):$).includes("*")},{message:'Wildcards are only allowed as a single trailing "*" (e.g., "com.example.*" or "*" for all services).'})).optional().describe('macOS only: Additional XPC/Mach service names to allow looking up. Supports trailing-wildcard prefix matching (e.g., "2BUA8C4S2C.com.1password.*"). Needed for tools like 1Password CLI, Playwright, or the iOS Simulator that communicate via XPC.'),httpProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external HTTP proxy to use instead of starting a local one. When provided, the library will skip starting its own HTTP proxy and use this port. The external proxy must handle domain filtering."),socksProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external SOCKS proxy to use instead of starting a local one. When provided, the library will skip starting its own SOCKS proxy and use this port. The external proxy must handle domain filtering."),mitmProxy:oE.optional().describe("Optional MITM proxy configuration. Routes matching domains through an upstream proxy via Unix socket while SRT still handles allow/deny filtering."),filterRequest:x.custom(($)=>typeof $==="function",{message:"filterRequest must be a function"}).optional().describe("Per-request filter callback. Receives the parsed HTTP request (web-standard Request) and returns {action, reason?}. Denied requests get a 403 with the reason. If the callback throws, the request is denied. Applies to plain HTTP through the proxy and, when tlsTerminate is configured, to terminated HTTPS. SRT does not provide a policy language; library consumers own matching."),tlsTerminate:x.object({caCertPath:x.string().min(1).optional().describe("Path to a PEM-encoded CA certificate. The sandboxed child is configured to trust this CA, and the TLS-terminating proxy uses it to sign per-host certificates. If omitted, on Windows SRT generates-if-absent a persistent CA under %ProgramData%\\sandbox-runtime\\ca\\ and trusts it in the sandbox user's Root store; on other platforms SRT generates an ephemeral CA into a temp directory for the lifetime of the session."),caKeyPath:x.string().min(1).optional().describe("Path to the PEM-encoded private key for caCertPath."),excludeDomains:x.array(m9).optional().describe("Domain patterns (same syntax as allowedDomains) whose HTTPS connections are NOT terminated. Matching CONNECTs are opaque byte tunnels: still subject to the allow/deny domain lists, but the sandboxed client completes its own TLS handshake with the upstream, so filterRequest and credential injection do not apply to their HTTPS traffic (plain-HTTP requests to the same hosts keep the normal request pipeline). Use for hosts the proxy must not re-originate: mTLS upstreams (only the client holds the client certificate) and clients that pin the upstream certificate and would reject the MITM CA. Hosts still need to be reachable via allowedDomains; this list only changes how they are tunnelled."),extraCaCertPaths:x.array(x.string().min(1)).optional().describe("Paths to PEM CA certificate files appended to the trust bundle the sandboxed child is pointed at, after the MITM CA and the host's regular roots. Use for site-local roots (e.g. an internal mTLS CA) presented by excluded/passthrough hosts, so the child can verify them itself. Only the CERTIFICATE blocks of each file are copied; files that are missing, unreadable, or contain no PEM CERTIFICATE block are skipped (with a debug log), so paths that exist on only some hosts are safe to list.")}).refine(($)=>!$.caCertPath===!$.caKeyPath,{message:"caCertPath and caKeyPath must be provided together"}).optional().describe("[EXPERIMENTAL] Enable in-process TLS termination so HTTPS request/response bodies are visible to SRT. Provide a CA cert+key, or omit both to have SRT generate an ephemeral one."),parentProxy:aE.optional().describe("Upstream HTTP proxy for outbound connections. When set, SRT's proxy tunnels non-mitmProxy traffic through this parent instead of connecting directly. Falls back to HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars if unset."),brokerForward:JF.optional().describe("Credential placeholders a remote broker swaps (see broker-forward.ts).")}),_U=x.object({disabled:x.boolean().optional().describe("Disable all filesystem policy enforcement. When true, no read or write rules are emitted: denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, .claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process is trusted with full host filesystem access. Network and credential-env restrictions still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs."),denyRead:x.array(VY).describe("Paths denied for reading"),allowRead:x.array(VY).optional().describe("Paths to re-allow reading within denied regions (takes precedence over denyRead). Use with denyRead to deny a broad region then allow back specific subdirectories."),allowWrite:x.array(VY).describe("Paths allowed for writing"),denyWrite:x.array(VY).describe("Paths denied for writing (takes precedence over allowWrite)"),allowGitConfig:x.boolean().optional().describe("Allow writes to .git/config files (default: false). Enables git remote URL updates while keeping .git/hooks protected.")}),xU=x.record(x.string(),x.array(x.string())).describe('Map of command patterns to filesystem paths to ignore violations for. Use "*" to match all commands'),vU=x.object({command:x.string().describe("The ripgrep command to execute"),args:x.array(x.string()).optional().describe("Additional arguments to pass before ripgrep args"),argv0:x.string().optional().describe("Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])")}),kU=x.object({safeDirectories:x.array(x.string()).default([]).describe("Directories git should treat as safe (`safe.directory`) even though they're owned by a different user inside the sandbox. Use for the repo top-level when launching from a subdirectory. Does NOT grant write.")}),fU=x.object({path:x.string().min(1).describe("Path to the srt-win binary. Pass the exported VENDORED_SRT_WIN_EXE constant to use the packaged vendor/srt-win/<arch>/srt-win.exe (see its WARNING: in a dev checkout that file may sit inside your sandbox write grant). The binary is spawned with the `--srt-win` argv[1] sentinel so a multicall dispatcher can route to srt-win's CLI.")}),yU=x.object({sandboxUser:x.string().min(1).max(20,"Windows local usernames are limited to 20 characters").optional().describe("Name for the dedicated sandbox user account that `srt-win install` creates and the sandboxed child runs as. Default: `srt-sandbox`. Install refuses if an account by this name already exists and srt-win did not create it (it will not rotate the password of an account it does not own). Must match what `srt-win install --sandbox-user` was run with."),sublayerGuid:x.string().uuid().optional().describe("WFP sublayer GUID under which the filters were installed. Omit to use the srt-win compile-time default. Set this when filters were installed by enterprise tooling under a custom sublayer."),wfpSublayerGuid:x.string().uuid().optional().describe("Deprecated alias for sublayerGuid."),proxyPortRange:x.tuple([x.number().int().min(1),x.number().int().max(65535)]).refine(([$,J])=>$<=J&&J-$<=64,{message:"low must be \u2264 high and range width \u2264 64"}).optional().describe("Inclusive [low, high] port range the JS mux proxy listeners bind inside. MUST match the range passed to `srt-win install "+"--proxy-port-range` (default 60080\u201360089) \u2014 the WFP loopback "+"permit only covers ports in that range."),srtWin:fU.optional().describe("How to locate/invoke the srt-win helper binary. `srtWin.path` is "+"required to use the Windows sandbox \u2014 your own (multicall) binary, "+"or the exported VENDORED_SRT_WIN_EXE constant for the packaged exe.")}),QF=x.object({applyPath:x.string().optional().describe("Path to the apply-seccomp binary"),argv0:x.string().optional().describe("Invoke apply-seccomp as a multicall binary that dispatches on the ARGV0 environment variable. When set, applyPath is used verbatim (no existence check) and the invocation inside bwrap is prefixed with ARGV0=<this value>. The caller is responsible for ensuring applyPath resolves inside the bwrap namespace and that the target binary implements the apply-seccomp interface when ARGV0 matches.")}),XF=x.object({network:PU.describe("Network restrictions configuration"),filesystem:_U.describe("Filesystem restrictions configuration"),credentials:wU.optional().describe("Credential handling configuration. Only the explicitly declared files and environment variables are restricted."),ignoreViolations:xU.optional().describe("Optional configuration for ignoring specific violations"),enableWeakerNestedSandbox:x.boolean().optional().describe("Enable weaker nested sandbox mode (for Docker environments)"),runAsUid:x.number().int().nonnegative().optional().describe("ARA: uid to drop the sandboxed command to (bwrap --uid)"),runAsGid:x.number().int().nonnegative().optional().describe("ARA: gid to drop the sandboxed command to (bwrap --gid)"),runAsHostUid:x.number().int().positive().optional().describe("ARA: real host uid used to launch the sandboxed bwrap child"),runAsHostGid:x.number().int().positive().optional().describe("ARA: real host gid used to launch the sandboxed bwrap child"),runAsHostHome:x.string().min(1).optional().describe("ARA: HOME set inside a real-host-uid sandbox child"),runAsHostUser:x.string().min(1).optional().describe("ARA: USER and LOGNAME set inside a real-host-uid sandbox child"),enableWeakerNetworkIsolation:x.boolean().optional().describe("Enable weaker network isolation to allow access to com.apple.trustd.agent (macOS only). This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data exfiltration vector through the trustd service. Only enable if you need Go TLS verification."),allowAppleEvents:x.boolean().optional().describe("Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or network restrictions), and can script running apps subject to TCC automation consent. Default: false."),ripgrep:vU.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),mandatoryDenySearchDepth:x.number().int().min(1).max(10).optional().describe("Maximum directory depth to search for dangerous files on Linux (default: 3). Higher values provide more protection but slower performance."),allowPty:x.boolean().optional().describe("Allow pseudo-terminal (pty) operations (macOS only)"),seccomp:QF.optional().describe("Custom seccomp binary paths (Linux only)."),bwrapPath:jU.optional().describe('Linux only: absolute path to the bwrap (bubblewrap) binary. When set, this path is used directly instead of resolving "bwrap" via PATH.'),socatPath:jU.optional().describe('Linux only: absolute path to the socat binary. When set, this path is used directly instead of resolving "socat" via PATH.'),windows:yU.optional().describe("Windows-specific settings (WFP sublayer, proxy port range)."),git:kU.optional().describe("Git configuration to inject via GIT_CONFIG_* env vars (cross-platform). `safeDirectories` marks paths as `safe.directory` without adding them to `filesystem.allowWrite`.")}).superRefine(($,J)=>{let X=$.credentials;if(!X)return;let Q=$.network.allowedDomains.map(oX),Y=(M,O)=>{for(let[V,q]of M.entries())if(!_9(q,Q))J.addIssue({code:x.ZodIssueCode.custom,path:[...O,V],message:`injectHosts entry "${q}" is not reachable via `+`network.allowedDomains \u2014 add "${q}" (or a covering wildcard) to allowedDomains, or remove it from injectHosts.`})},G=!1,W=(M,O)=>{if(M.injectHosts)Y(M.injectHosts,[...O,"injectHosts"]);if(M.mode!=="mask")return;G=!0;let V=$.network.tlsTerminate?.excludeDomains;if(V?.length){if(M.injectHosts){for(let[q,H]of M.injectHosts.entries())if(_9(H,V))J.addIssue({code:x.ZodIssueCode.custom,path:[...O,"injectHosts",q],message:`injectHosts entry "${H}" is entirely covered by network.tlsTerminate.excludeDomains. Credential injection only runs on TLS-terminated connections, so this host would receive the placeholder instead of the credential. Remove it from one of the two lists.`})}else if(Q.length>0&&Q.every((q)=>_9(q,V)))J.addIssue({code:x.ZodIssueCode.custom,path:O,message:"This masked credential has no injectHosts, so it defaults "+"to network.allowedDomains \u2014 but "+"network.tlsTerminate.excludeDomains covers every allowed domain, so it could never be injected anywhere. Credential injection only runs on TLS-terminated connections."})}if(M.injectHosts!==void 0&&M.injectHosts.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:O,message:"injectHosts is explicitly empty \u2014 the credential would be "+"masked but never injected. Omit injectHosts to default to network.allowedDomains, or list the intended hosts."})};for(let[M,O]of(X.envVars??[]).entries()){if(W(O,["credentials","envVars",M]),O.maskClaims!==void 0&&O.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the whole value.'});if(O.maskClaims!==void 0&&O.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."})}for(let[M,O]of(X.files??[]).entries()){if(W(O,["credentials","files",M]),O.maskClaims!==void 0&&O.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the extracted value whole.'});if(O.maskClaims!==void 0&&O.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."});if(O.mode==="mask"&&O.path.endsWith("/"))J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"path"],message:`Credential mode "mask" applies to a single file, not a directory. Use mode "deny" for "${O.path}", or point at the credential file inside it.`})}let U=new Set;for(let[M,O]of(X.awsPairs??[]).entries()){let V=[["accessKeyIdVar",O.accessKeyIdVar],["secretAccessKeyVar",O.secretAccessKeyVar]];if(O.sessionTokenVar!==void 0)V.push(["sessionTokenVar",O.sessionTokenVar]);for(let[q,H]of V){let N=["credentials","awsPairs",M,q];if(U.has(H)){J.addIssue({code:x.ZodIssueCode.custom,path:N,message:`"${H}" appears in more than one awsPairs slot (within `+"or across pairs) \u2014 each variable can fill exactly one slot."});continue}U.add(H);let K=(X.envVars??[]).find((L)=>L.name===H);if(K===void 0||K.mode!=="mask")J.addIssue({code:x.ZodIssueCode.custom,path:N,message:`"${H}" does not reference a credentials.envVars entry `+'with mode "mask" \u2014 an AWS pair links already-masked '+"variables; add the entry (masking is the opt-in for SigV4 re-signing)."});else if(K.extract!==void 0||K.decode!==void 0)J.addIssue({code:x.ZodIssueCode.custom,path:N,message:`"${H}" uses extract/decode, but an AWS pair member must be masked whole-value: the SigV4 trigger is an exact match of the fake access key id, and the signer needs the entire real value.`})}}if(G&&$.network.tlsTerminate===void 0&&!X.allowPlaintextInject)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials"],message:"Credential masking requires network.tlsTerminate so substitution runs only over a verified TLS connection. Enable tlsTerminate, or set credentials.allowPlaintextInject to opt out (not recommended)."})});export{v5 as windowsTrustCaAsync,bK as windowsTrustCa,f5 as windowsStateDir,i7 as windowsInstallInstructions,r7 as verifyWindowsWfpEgress,fX as validateCaPair,gK as uninstallWindowsSandbox,QG as stampWindowsAcl,P9 as revokeWindowsAcl,w9 as restoreWindowsAcl,wJ as resolveSrtWin,mK as parseWindowsSandboxError,T9 as parseWindowsBinShell,FX as isUncPath,uK as installWindowsSandboxAsync,hK as installWindowsSandbox,XG as grantWindowsAcl,d9 as getWslVersion,x5 as getWindowsWfpStatusAsync,_5 as getWindowsWfpStatus,nX as getWindowsSandboxUserStatusAsync,t7 as getWindowsSandboxUserStatus,e7 as getWindowsSandboxCaCert,yK as getSrtWinPath,DQ as getDefaultWritePaths,tY as generateCa,C9 as expandWindowsFsPaths,$G as ensurePersistentWindowsCa,P5 as checkWindowsSandboxStatusAsync,w5 as checkWindowsSandboxStatus,YG as checkWindowsDependenciesAsync,mQ as certThumbprint,NX as buildGitConfigEnv,A$ as WindowsSandboxError,yU as WindowsConfigSchema,fK as VENDORED_SRT_WIN_EXE,fU as SrtWinConfigSchema,Z9 as SandboxViolationStore,XF as SandboxRuntimeConfigSchema,vz as SandboxManager,T5 as SRT_WIN_DISPATCH_ARG1,vU as RipgrepConfigSchema,PU as NetworkConfigSchema,xU as IgnoreViolationsConfigSchema,kU as GitConfigSchema,_U as FilesystemConfigSchema,j9 as DEFAULT_WINDOWS_PROXY_PORT_RANGE,wU as CredentialsConfigSchema};