@reason-machines/cli-linux-x64-musl 0.2.59
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
// @bun
|
|
2
|
+
var P5=Object.create;var{getPrototypeOf:_5,defineProperty:A9,getOwnPropertyNames:x5}=Object;var v5=Object.prototype.hasOwnProperty;function k5($){return this[$]}var f5,y5,fG=($,J,X)=>{var Q=$!=null&&typeof $==="object";if(Q){var Y=J?f5??=new WeakMap:y5??=new WeakMap,G=Y.get($);if(G)return G}X=$!=null?P5(_5($)):{};let W=J||!$||!$.__esModule?A9(X,"default",{value:$,enumerable:!0}):X;for(let O of x5($))if(!v5.call(W,O))A9(W,O,{get:k5.bind($,O),enumerable:!0});if(Q)Y.set($,W);return W};var H$=($,J)=>()=>(J||$((J={exports:{}}).exports,J),J.exports);var h5=($)=>$;function b5($,J){this[$]=h5.bind(null,J)}var u5=($,J)=>{for(var X in J)A9($,X,{get:J[X],enumerable:!0,configurable:!0,set:b5.bind(J,X)})};var L9=import.meta.require;var K$=H$((WE,uG)=>{uG.exports={options:{usePureJavaScript:!1}}});var lG=H$((OE,gG)=>{var Z9={};gG.exports=Z9;var mG={};Z9.encode=function($,J,X){if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');if(X!==void 0&&typeof X!=="number")throw TypeError('"maxline" must be a number.');var Q="";if(!($ instanceof Uint8Array))Q=n5($,J);else{var Y=0,G=J.length,W=J.charAt(0),O=[0];for(Y=0;Y<$.length;++Y){for(var M=0,U=$[Y];M<O.length;++M)U+=O[M]<<8,O[M]=U%G,U=U/G|0;while(U>0)O.push(U%G),U=U/G|0}for(Y=0;$[Y]===0&&Y<$.length-1;++Y)Q+=W;for(Y=O.length-1;Y>=0;--Y)Q+=J[O[Y]]}if(X){var H=new RegExp(".{1,"+X+"}","g");Q=Q.match(H).join(`\r
|
|
3
|
+
`)}return Q};Z9.decode=function($,J){if(typeof $!=="string")throw TypeError('"input" must be a string.');if(typeof J!=="string")throw TypeError('"alphabet" must be a string.');var X=mG[J];if(!X){X=mG[J]=[];for(var Q=0;Q<J.length;++Q)X[J.charCodeAt(Q)]=Q}$=$.replace(/\s/g,"");var Y=J.length,G=J.charAt(0),W=[0];for(var Q=0;Q<$.length;Q++){var O=X[$.charCodeAt(Q)];if(O===void 0)return;for(var M=0,U=O;M<W.length;++M)U+=W[M]*Y,W[M]=U&255,U>>=8;while(U>0)W.push(U&255),U>>=8}for(var H=0;$[H]===G&&H<$.length-1;++H)W.push(0);if(typeof Buffer<"u")return Buffer.from(W.reverse());return new Uint8Array(W.reverse())};function n5($,J){var X=0,Q=J.length,Y=J.charAt(0),G=[0];for(X=0;X<$.length();++X){for(var W=0,O=$.at(X);W<G.length;++W)O+=G[W]<<8,G[W]=O%Q,O=O/Q|0;while(O>0)G.push(O%Q),O=O/Q|0}var M="";for(X=0;$.at(X)===0&&X<$.length()-1;++X)M+=Y;for(X=G.length-1;X>=0;--X)M+=J[G[X]];return M}});var w$=H$((ME,nG)=>{var dG=K$(),pG=lG(),T=nG.exports=dG.util=dG.util||{};(function(){if(typeof process<"u"&&process.nextTick){if(T.nextTick=process.nextTick,typeof setImmediate==="function")T.setImmediate=setImmediate;else T.setImmediate=T.nextTick;return}if(typeof setImmediate==="function"){T.setImmediate=function(){return setImmediate.apply(void 0,arguments)},T.nextTick=function(O){return setImmediate(O)};return}if(T.setImmediate=function(O){setTimeout(O,0)},typeof window<"u"&&typeof window.postMessage==="function"){let O=function(M){if(M.source===window&&M.data===$){M.stopPropagation();var U=J.slice();J.length=0,U.forEach(function(H){H()})}};var W=O,$="forge.setImmediate",J=[];T.setImmediate=function(M){if(J.push(M),J.length===1)window.postMessage($,"*")},window.addEventListener("message",O,!0)}if(typeof MutationObserver<"u"){var X=Date.now(),Q=!0,Y=document.createElement("div"),J=[];new MutationObserver(function(){var M=J.slice();J.length=0,M.forEach(function(U){U()})}).observe(Y,{attributes:!0});var G=T.setImmediate;T.setImmediate=function(M){if(Date.now()-X>15)X=Date.now(),G(M);else if(J.push(M),J.length===1)Y.setAttribute("a",Q=!Q)}}T.nextTick=T.setImmediate})();T.isNodejs=typeof process<"u"&&process.versions&&process.versions.node;T.globalScope=function(){if(T.isNodejs)return global;return typeof self>"u"?window:self}();T.isArray=Array.isArray||function($){return Object.prototype.toString.call($)==="[object Array]"};T.isArrayBuffer=function($){return typeof ArrayBuffer<"u"&&$ instanceof ArrayBuffer};T.isArrayBufferView=function($){return $&&T.isArrayBuffer($.buffer)&&$.byteLength!==void 0};function MX($){if(!($===8||$===16||$===24||$===32))throw Error("Only 8, 16, 24, or 32 bits supported: "+$)}T.ByteBuffer=B9;function B9($){if(this.data="",this.read=0,typeof $==="string")this.data=$;else if(T.isArrayBuffer($)||T.isArrayBufferView($))if(typeof Buffer<"u"&&$ instanceof Buffer)this.data=$.toString("binary");else{var J=new Uint8Array($);try{this.data=String.fromCharCode.apply(null,J)}catch(Q){for(var X=0;X<J.length;++X)this.putByte(J[X])}}else if($ instanceof B9||typeof $==="object"&&typeof $.data==="string"&&typeof $.read==="number")this.data=$.data,this.read=$.read;this._constructedStringLength=0}T.ByteStringBuffer=B9;var i5=4096;T.ByteStringBuffer.prototype._optimizeConstructedString=function($){if(this._constructedStringLength+=$,this._constructedStringLength>i5)this.data.substr(0,1),this._constructedStringLength=0};T.ByteStringBuffer.prototype.length=function(){return this.data.length-this.read};T.ByteStringBuffer.prototype.isEmpty=function(){return this.length()<=0};T.ByteStringBuffer.prototype.putByte=function($){return this.putBytes(String.fromCharCode($))};T.ByteStringBuffer.prototype.fillWithByte=function($,J){$=String.fromCharCode($);var X=this.data;while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return this.data=X,this._optimizeConstructedString(J),this};T.ByteStringBuffer.prototype.putBytes=function($){return this.data+=$,this._optimizeConstructedString($.length),this};T.ByteStringBuffer.prototype.putString=function($){return this.putBytes(T.encodeUtf8($))};T.ByteStringBuffer.prototype.putInt16=function($){return this.putBytes(String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt24=function($){return this.putBytes(String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt32=function($){return this.putBytes(String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255))};T.ByteStringBuffer.prototype.putInt16Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255))};T.ByteStringBuffer.prototype.putInt24Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255))};T.ByteStringBuffer.prototype.putInt32Le=function($){return this.putBytes(String.fromCharCode($&255)+String.fromCharCode($>>8&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>24&255))};T.ByteStringBuffer.prototype.putInt=function($,J){MX(J);var X="";do J-=8,X+=String.fromCharCode($>>J&255);while(J>0);return this.putBytes(X)};T.ByteStringBuffer.prototype.putSignedInt=function($,J){if($<0)$+=2<<J-1;return this.putInt($,J)};T.ByteStringBuffer.prototype.putBuffer=function($){return this.putBytes($.getBytes())};T.ByteStringBuffer.prototype.getByte=function(){return this.data.charCodeAt(this.read++)};T.ByteStringBuffer.prototype.getInt16=function(){var $=this.data.charCodeAt(this.read)<<8^this.data.charCodeAt(this.read+1);return this.read+=2,$};T.ByteStringBuffer.prototype.getInt24=function(){var $=this.data.charCodeAt(this.read)<<16^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2);return this.read+=3,$};T.ByteStringBuffer.prototype.getInt32=function(){var $=this.data.charCodeAt(this.read)<<24^this.data.charCodeAt(this.read+1)<<16^this.data.charCodeAt(this.read+2)<<8^this.data.charCodeAt(this.read+3);return this.read+=4,$};T.ByteStringBuffer.prototype.getInt16Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8;return this.read+=2,$};T.ByteStringBuffer.prototype.getInt24Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16;return this.read+=3,$};T.ByteStringBuffer.prototype.getInt32Le=function(){var $=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16^this.data.charCodeAt(this.read+3)<<24;return this.read+=4,$};T.ByteStringBuffer.prototype.getInt=function($){MX($);var J=0;do J=(J<<8)+this.data.charCodeAt(this.read++),$-=8;while($>0);return J};T.ByteStringBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};T.ByteStringBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};T.ByteStringBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};T.ByteStringBuffer.prototype.at=function($){return this.data.charCodeAt(this.read+$)};T.ByteStringBuffer.prototype.setAt=function($,J){return this.data=this.data.substr(0,this.read+$)+String.fromCharCode(J)+this.data.substr(this.read+$+1),this};T.ByteStringBuffer.prototype.last=function(){return this.data.charCodeAt(this.data.length-1)};T.ByteStringBuffer.prototype.copy=function(){var $=T.createBuffer(this.data);return $.read=this.read,$};T.ByteStringBuffer.prototype.compact=function(){if(this.read>0)this.data=this.data.slice(this.read),this.read=0;return this};T.ByteStringBuffer.prototype.clear=function(){return this.data="",this.read=0,this};T.ByteStringBuffer.prototype.truncate=function($){var J=Math.max(0,this.length()-$);return this.data=this.data.substr(this.read,J),this.read=0,this};T.ByteStringBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.length;++J){var X=this.data.charCodeAt(J);if(X<16)$+="0";$+=X.toString(16)}return $};T.ByteStringBuffer.prototype.toString=function(){return T.decodeUtf8(this.bytes())};function o5($,J){J=J||{},this.read=J.readOffset||0,this.growSize=J.growSize||1024;var X=T.isArrayBuffer($),Q=T.isArrayBufferView($);if(X||Q){if(X)this.data=new DataView($);else this.data=new DataView($.buffer,$.byteOffset,$.byteLength);this.write="writeOffset"in J?J.writeOffset:this.data.byteLength;return}if(this.data=new DataView(new ArrayBuffer(0)),this.write=0,$!==null&&$!==void 0)this.putBytes($);if("writeOffset"in J)this.write=J.writeOffset}T.DataBuffer=o5;T.DataBuffer.prototype.length=function(){return this.write-this.read};T.DataBuffer.prototype.isEmpty=function(){return this.length()<=0};T.DataBuffer.prototype.accommodate=function($,J){if(this.length()>=$)return this;J=Math.max(J||this.growSize,$);var X=new Uint8Array(this.data.buffer,this.data.byteOffset,this.data.byteLength),Q=new Uint8Array(this.length()+J);return Q.set(X),this.data=new DataView(Q.buffer),this};T.DataBuffer.prototype.putByte=function($){return this.accommodate(1),this.data.setUint8(this.write++,$),this};T.DataBuffer.prototype.fillWithByte=function($,J){this.accommodate(J);for(var X=0;X<J;++X)this.data.setUint8($);return this};T.DataBuffer.prototype.putBytes=function($,J){if(T.isArrayBufferView($)){var X=new Uint8Array($.buffer,$.byteOffset,$.byteLength),Q=X.byteLength-X.byteOffset;this.accommodate(Q);var Y=new Uint8Array(this.data.buffer,this.write);return Y.set(X),this.write+=Q,this}if(T.isArrayBuffer($)){var X=new Uint8Array($);this.accommodate(X.byteLength);var Y=new Uint8Array(this.data.buffer);return Y.set(X,this.write),this.write+=X.byteLength,this}if($ instanceof T.DataBuffer||typeof $==="object"&&typeof $.read==="number"&&typeof $.write==="number"&&T.isArrayBufferView($.data)){var X=new Uint8Array($.data.byteLength,$.read,$.length());this.accommodate(X.byteLength);var Y=new Uint8Array($.data.byteLength,this.write);return Y.set(X),this.write+=X.byteLength,this}if($ instanceof T.ByteStringBuffer)$=$.data,J="binary";if(J=J||"binary",typeof $==="string"){var G;if(J==="hex")return this.accommodate(Math.ceil($.length/2)),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.hex.decode($,G,this.write),this;if(J==="base64")return this.accommodate(Math.ceil($.length/4)*3),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.base64.decode($,G,this.write),this;if(J==="utf8")$=T.encodeUtf8($),J="binary";if(J==="binary"||J==="raw")return this.accommodate($.length),G=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.raw.decode(G),this;if(J==="utf16")return this.accommodate($.length*2),G=new Uint16Array(this.data.buffer,this.write),this.write+=T.text.utf16.encode(G),this;throw Error("Invalid encoding: "+J)}throw Error("Invalid parameter: "+$)};T.DataBuffer.prototype.putBuffer=function($){return this.putBytes($),$.clear(),this};T.DataBuffer.prototype.putString=function($){return this.putBytes($,"utf16")};T.DataBuffer.prototype.putInt16=function($){return this.accommodate(2),this.data.setInt16(this.write,$),this.write+=2,this};T.DataBuffer.prototype.putInt24=function($){return this.accommodate(3),this.data.setInt16(this.write,$>>8&65535),this.data.setInt8(this.write,$>>16&255),this.write+=3,this};T.DataBuffer.prototype.putInt32=function($){return this.accommodate(4),this.data.setInt32(this.write,$),this.write+=4,this};T.DataBuffer.prototype.putInt16Le=function($){return this.accommodate(2),this.data.setInt16(this.write,$,!0),this.write+=2,this};T.DataBuffer.prototype.putInt24Le=function($){return this.accommodate(3),this.data.setInt8(this.write,$>>16&255),this.data.setInt16(this.write,$>>8&65535,!0),this.write+=3,this};T.DataBuffer.prototype.putInt32Le=function($){return this.accommodate(4),this.data.setInt32(this.write,$,!0),this.write+=4,this};T.DataBuffer.prototype.putInt=function($,J){MX(J),this.accommodate(J/8);do J-=8,this.data.setInt8(this.write++,$>>J&255);while(J>0);return this};T.DataBuffer.prototype.putSignedInt=function($,J){if(MX(J),this.accommodate(J/8),$<0)$+=2<<J-1;return this.putInt($,J)};T.DataBuffer.prototype.getByte=function(){return this.data.getInt8(this.read++)};T.DataBuffer.prototype.getInt16=function(){var $=this.data.getInt16(this.read);return this.read+=2,$};T.DataBuffer.prototype.getInt24=function(){var $=this.data.getInt16(this.read)<<8^this.data.getInt8(this.read+2);return this.read+=3,$};T.DataBuffer.prototype.getInt32=function(){var $=this.data.getInt32(this.read);return this.read+=4,$};T.DataBuffer.prototype.getInt16Le=function(){var $=this.data.getInt16(this.read,!0);return this.read+=2,$};T.DataBuffer.prototype.getInt24Le=function(){var $=this.data.getInt8(this.read)^this.data.getInt16(this.read+1,!0)<<8;return this.read+=3,$};T.DataBuffer.prototype.getInt32Le=function(){var $=this.data.getInt32(this.read,!0);return this.read+=4,$};T.DataBuffer.prototype.getInt=function($){MX($);var J=0;do J=(J<<8)+this.data.getInt8(this.read++),$-=8;while($>0);return J};T.DataBuffer.prototype.getSignedInt=function($){var J=this.getInt($),X=2<<$-2;if(J>=X)J-=X<<1;return J};T.DataBuffer.prototype.getBytes=function($){var J;if($)$=Math.min(this.length(),$),J=this.data.slice(this.read,this.read+$),this.read+=$;else if($===0)J="";else J=this.read===0?this.data:this.data.slice(this.read),this.clear();return J};T.DataBuffer.prototype.bytes=function($){return typeof $>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+$)};T.DataBuffer.prototype.at=function($){return this.data.getUint8(this.read+$)};T.DataBuffer.prototype.setAt=function($,J){return this.data.setUint8($,J),this};T.DataBuffer.prototype.last=function(){return this.data.getUint8(this.write-1)};T.DataBuffer.prototype.copy=function(){return new T.DataBuffer(this)};T.DataBuffer.prototype.compact=function(){if(this.read>0){var $=new Uint8Array(this.data.buffer,this.read),J=new Uint8Array($.byteLength);J.set($),this.data=new DataView(J),this.write-=this.read,this.read=0}return this};T.DataBuffer.prototype.clear=function(){return this.data=new DataView(new ArrayBuffer(0)),this.read=this.write=0,this};T.DataBuffer.prototype.truncate=function($){return this.write=Math.max(0,this.length()-$),this.read=Math.min(this.read,this.write),this};T.DataBuffer.prototype.toHex=function(){var $="";for(var J=this.read;J<this.data.byteLength;++J){var X=this.data.getUint8(J);if(X<16)$+="0";$+=X.toString(16)}return $};T.DataBuffer.prototype.toString=function($){var J=new Uint8Array(this.data,this.read,this.length());if($=$||"utf8",$==="binary"||$==="raw")return T.binary.raw.encode(J);if($==="hex")return T.binary.hex.encode(J);if($==="base64")return T.binary.base64.encode(J);if($==="utf8")return T.text.utf8.decode(J);if($==="utf16")return T.text.utf16.decode(J);throw Error("Invalid encoding: "+$)};T.createBuffer=function($,J){if(J=J||"raw",$!==void 0&&J==="utf8")$=T.encodeUtf8($);return new T.ByteBuffer($)};T.fillString=function($,J){var X="";while(J>0){if(J&1)X+=$;if(J>>>=1,J>0)$+=$}return X};T.xorBytes=function($,J,X){var Q="",Y="",G="",W=0,O=0;for(;X>0;--X,++W){if(Y=$.charCodeAt(W)^J.charCodeAt(W),O>=10)Q+=G,G="",O=0;G+=String.fromCharCode(Y),++O}return Q+=G,Q};T.hexToBytes=function($){var J="",X=0;if($.length&!0)X=1,J+=String.fromCharCode(parseInt($[0],16));for(;X<$.length;X+=2)J+=String.fromCharCode(parseInt($.substr(X,2),16));return J};T.bytesToHex=function($){return T.createBuffer($).toHex()};T.int32ToBytes=function($){return String.fromCharCode($>>24&255)+String.fromCharCode($>>16&255)+String.fromCharCode($>>8&255)+String.fromCharCode($&255)};var BJ="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",TJ=[62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,64,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],cG="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";T.encode64=function($,J){var X="",Q="",Y,G,W,O=0;while(O<$.length){if(Y=$.charCodeAt(O++),G=$.charCodeAt(O++),W=$.charCodeAt(O++),X+=BJ.charAt(Y>>2),X+=BJ.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=BJ.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":BJ.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
|
|
4
|
+
`,X=X.substr(J)}return Q+=X,Q};T.decode64=function($){$=$.replace(/[^A-Za-z0-9\+\/\=]/g,"");var J="",X,Q,Y,G,W=0;while(W<$.length)if(X=TJ[$.charCodeAt(W++)-43],Q=TJ[$.charCodeAt(W++)-43],Y=TJ[$.charCodeAt(W++)-43],G=TJ[$.charCodeAt(W++)-43],J+=String.fromCharCode(X<<2|Q>>4),Y!==64){if(J+=String.fromCharCode((Q&15)<<4|Y>>2),G!==64)J+=String.fromCharCode((Y&3)<<6|G)}return J};T.encodeUtf8=function($){return unescape(encodeURIComponent($))};T.decodeUtf8=function($){return decodeURIComponent(escape($))};T.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:pG.encode,decode:pG.decode}};T.binary.raw.encode=function($){return String.fromCharCode.apply(null,$)};T.binary.raw.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};T.binary.hex.encode=T.bytesToHex;T.binary.hex.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/2));X=X||0;var Y=0,G=X;if($.length&1)Y=1,Q[G++]=parseInt($[0],16);for(;Y<$.length;Y+=2)Q[G++]=parseInt($.substr(Y,2),16);return J?G-X:Q};T.binary.base64.encode=function($,J){var X="",Q="",Y,G,W,O=0;while(O<$.byteLength){if(Y=$[O++],G=$[O++],W=$[O++],X+=BJ.charAt(Y>>2),X+=BJ.charAt((Y&3)<<4|G>>4),isNaN(G))X+="==";else X+=BJ.charAt((G&15)<<2|W>>6),X+=isNaN(W)?"=":BJ.charAt(W&63);if(J&&X.length>J)Q+=X.substr(0,J)+`\r
|
|
5
|
+
`,X=X.substr(J)}return Q+=X,Q};T.binary.base64.decode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array(Math.ceil($.length/4)*3);$=$.replace(/[^A-Za-z0-9\+\/\=]/g,""),X=X||0;var Y,G,W,O,M=0,U=X;while(M<$.length)if(Y=TJ[$.charCodeAt(M++)-43],G=TJ[$.charCodeAt(M++)-43],W=TJ[$.charCodeAt(M++)-43],O=TJ[$.charCodeAt(M++)-43],Q[U++]=Y<<2|G>>4,W!==64){if(Q[U++]=(G&15)<<4|W>>2,O!==64)Q[U++]=(W&3)<<6|O}return J?U-X:Q.subarray(0,U)};T.binary.base58.encode=function($,J){return T.binary.baseN.encode($,cG,J)};T.binary.base58.decode=function($,J){return T.binary.baseN.decode($,cG,J)};T.text={utf8:{},utf16:{}};T.text.utf8.encode=function($,J,X){$=T.encodeUtf8($);var Q=J;if(!Q)Q=new Uint8Array($.length);X=X||0;var Y=X;for(var G=0;G<$.length;++G)Q[Y++]=$.charCodeAt(G);return J?Y-X:Q};T.text.utf8.decode=function($){return T.decodeUtf8(String.fromCharCode.apply(null,$))};T.text.utf16.encode=function($,J,X){var Q=J;if(!Q)Q=new Uint8Array($.length*2);var Y=new Uint16Array(Q.buffer);X=X||0;var G=X,W=X;for(var O=0;O<$.length;++O)Y[W++]=$.charCodeAt(O),G+=2;return J?G-X:Q};T.text.utf16.decode=function($){return String.fromCharCode.apply(null,new Uint16Array($.buffer))};T.deflate=function($,J,X){if(J=T.decode64($.deflate(T.encode64(J)).rval),X){var Q=2,Y=J.charCodeAt(1);if(Y&32)Q=6;J=J.substring(Q,J.length-4)}return J};T.inflate=function($,J,X){var Q=$.inflate(T.encode64(J)).rval;return Q===null?null:T.decode64(Q)};var T9=function($,J,X){if(!$)throw Error("WebStorage not available.");var Q;if(X===null)Q=$.removeItem(J);else X=T.encode64(JSON.stringify(X)),Q=$.setItem(J,X);if(typeof Q<"u"&&Q.rval!==!0){var Y=Error(Q.error.message);throw Y.id=Q.error.id,Y.name=Q.error.name,Y}},S9=function($,J){if(!$)throw Error("WebStorage not available.");var X=$.getItem(J);if($.init)if(X.rval===null){if(X.error){var Q=Error(X.error.message);throw Q.id=X.error.id,Q.name=X.error.name,Q}X=null}else X=X.rval;if(X!==null)X=JSON.parse(T.decode64(X));return X},a5=function($,J,X,Q){var Y=S9($,J);if(Y===null)Y={};Y[X]=Q,T9($,J,Y)},r5=function($,J,X){var Q=S9($,J);if(Q!==null)Q=X in Q?Q[X]:null;return Q},s5=function($,J,X){var Q=S9($,J);if(Q!==null&&X in Q){delete Q[X];var Y=!0;for(var G in Q){Y=!1;break}if(Y)Q=null;T9($,J,Q)}},t5=function($,J){T9($,J,null)},tX=function($,J,X){var Q=null;if(typeof X>"u")X=["web","flash"];var Y,G=!1,W=null;for(var O in X){Y=X[O];try{if(Y==="flash"||Y==="both"){if(J[0]===null)throw Error("Flash local storage not available.");Q=$.apply(this,J),G=Y==="flash"}if(Y==="web"||Y==="both")J[0]=localStorage,Q=$.apply(this,J),G=!0}catch(M){W=M}if(G)break}if(!G)throw W;return Q};T.setItem=function($,J,X,Q,Y){tX(a5,arguments,Y)};T.getItem=function($,J,X,Q){return tX(r5,arguments,Q)};T.removeItem=function($,J,X,Q){tX(s5,arguments,Q)};T.clearItems=function($,J,X){tX(t5,arguments,X)};T.isEmpty=function($){for(var J in $)if($.hasOwnProperty(J))return!1;return!0};T.format=function($){var J=/%./g,X,Q,Y=0,G=[],W=0;while(X=J.exec($)){if(Q=$.substring(W,J.lastIndex-2),Q.length>0)G.push(Q);W=J.lastIndex;var O=X[0][1];switch(O){case"s":case"o":if(Y<arguments.length)G.push(arguments[Y+++1]);else G.push("<?>");break;case"%":G.push("%");break;default:G.push("<%"+O+"?>")}}return G.push($.substring(W)),G.join("")};T.formatNumber=function($,J,X,Q){var Y=$,G=isNaN(J=Math.abs(J))?2:J,W=X===void 0?",":X,O=Q===void 0?".":Q,M=Y<0?"-":"",U=parseInt(Y=Math.abs(+Y||0).toFixed(G),10)+"",H=U.length>3?U.length%3:0;return M+(H?U.substr(0,H)+O:"")+U.substr(H).replace(/(\d{3})(?=\d)/g,"$1"+O)+(G?W+Math.abs(Y-U).toFixed(G).slice(2):"")};T.formatSize=function($){if($>=1073741824)$=T.formatNumber($/1073741824,2,".","")+" GiB";else if($>=1048576)$=T.formatNumber($/1048576,2,".","")+" MiB";else if($>=1024)$=T.formatNumber($/1024,0)+" KiB";else $=T.formatNumber($,0)+" bytes";return $};T.bytesFromIP=function($){if($.indexOf(".")!==-1)return T.bytesFromIPv4($);if($.indexOf(":")!==-1)return T.bytesFromIPv6($);return null};T.bytesFromIPv4=function($){if($=$.split("."),$.length!==4)return null;var J=T.createBuffer();for(var X=0;X<$.length;++X){var Q=parseInt($[X],10);if(isNaN(Q))return null;J.putByte(Q)}return J.getBytes()};T.bytesFromIPv6=function($){var J=0;$=$.split(":").filter(function(W){if(W.length===0)++J;return!0});var X=(8-$.length+J)*2,Q=T.createBuffer();for(var Y=0;Y<8;++Y){if(!$[Y]||$[Y].length===0){Q.fillWithByte(0,X),X=0;continue}var G=T.hexToBytes($[Y]);if(G.length<2)Q.putByte(0);Q.putBytes(G)}return Q.getBytes()};T.bytesToIP=function($){if($.length===4)return T.bytesToIPv4($);if($.length===16)return T.bytesToIPv6($);return null};T.bytesToIPv4=function($){if($.length!==4)return null;var J=[];for(var X=0;X<$.length;++X)J.push($.charCodeAt(X));return J.join(".")};T.bytesToIPv6=function($){if($.length!==16)return null;var J=[],X=[],Q=0;for(var Y=0;Y<$.length;Y+=2){var G=T.bytesToHex($[Y]+$[Y+1]);while(G[0]==="0"&&G!=="0")G=G.substr(1);if(G==="0"){var W=X[X.length-1],O=J.length;if(!W||O!==W.end+1)X.push({start:O,end:O});else if(W.end=O,W.end-W.start>X[Q].end-X[Q].start)Q=X.length-1}J.push(G)}if(X.length>0){var M=X[Q];if(M.end-M.start>0){if(J.splice(M.start,M.end-M.start+1,""),M.start===0)J.unshift("");if(M.end===7)J.push("")}}return J.join(":")};T.estimateCores=function($,J){if(typeof $==="function")J=$,$={};if($=$||{},"cores"in T&&!$.update)return J(null,T.cores);if(typeof navigator<"u"&&"hardwareConcurrency"in navigator&&navigator.hardwareConcurrency>0)return T.cores=navigator.hardwareConcurrency,J(null,T.cores);if(typeof Worker>"u")return T.cores=1,J(null,T.cores);if(typeof Blob>"u")return T.cores=2,J(null,T.cores);var X=URL.createObjectURL(new Blob(["(",function(){self.addEventListener("message",function(W){var O=Date.now(),M=O+4;while(Date.now()<M);self.postMessage({st:O,et:M})})}.toString(),")()"],{type:"application/javascript"}));Q([],5,16);function Q(W,O,M){if(O===0){var U=Math.floor(W.reduce(function(H,V){return H+V},0)/W.length);return T.cores=Math.max(1,U),URL.revokeObjectURL(X),J(null,T.cores)}Y(M,function(H,V){W.push(G(M,V)),Q(W,O-1,M)})}function Y(W,O){var M=[],U=[];for(var H=0;H<W;++H){var V=new Worker(X);V.addEventListener("message",function(q){if(U.push(q.data),U.length===W){for(var z=0;z<W;++z)M[z].terminate();O(null,U)}}),M.push(V)}for(var H=0;H<W;++H)M[H].postMessage(H)}function G(W,O){var M=[];for(var U=0;U<W;++U){var H=O[U],V=M[U]=[];for(var q=0;q<W;++q){if(U===q)continue;var z=O[q];if(H.st>z.st&&H.st<z.et||z.st>H.st&&z.st<H.et)V.push(q)}}return M.reduce(function(K,L){return Math.max(K,L.length)},0)}}});var eX=H$((UE,iG)=>{var e$=K$();w$();iG.exports=e$.cipher=e$.cipher||{};e$.cipher.algorithms=e$.cipher.algorithms||{};e$.cipher.createCipher=function($,J){var X=$;if(typeof X==="string"){if(X=e$.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new e$.cipher.BlockCipher({algorithm:X,key:J,decrypt:!1})};e$.cipher.createDecipher=function($,J){var X=$;if(typeof X==="string"){if(X=e$.cipher.getAlgorithm(X),X)X=X()}if(!X)throw Error("Unsupported algorithm: "+$);return new e$.cipher.BlockCipher({algorithm:X,key:J,decrypt:!0})};e$.cipher.registerAlgorithm=function($,J){$=$.toUpperCase(),e$.cipher.algorithms[$]=J};e$.cipher.getAlgorithm=function($){if($=$.toUpperCase(),$ in e$.cipher.algorithms)return e$.cipher.algorithms[$];return null};var j9=e$.cipher.BlockCipher=function($){this.algorithm=$.algorithm,this.mode=this.algorithm.mode,this.blockSize=this.mode.blockSize,this._finish=!1,this._input=null,this.output=null,this._op=$.decrypt?this.mode.decrypt:this.mode.encrypt,this._decrypt=$.decrypt,this.algorithm.initialize($)};j9.prototype.start=function($){$=$||{};var J={};for(var X in $)J[X]=$[X];J.decrypt=this._decrypt,this._finish=!1,this._input=e$.util.createBuffer(),this.output=$.output||e$.util.createBuffer(),this.mode.start(J)};j9.prototype.update=function($){if($)this._input.putBuffer($);while(!this._op.call(this.mode,this._input,this.output,this._finish)&&!this._finish);this._input.compact()};j9.prototype.finish=function($){if($&&(this.mode.name==="ECB"||this.mode.name==="CBC"))this.mode.pad=function(X){return $(this.blockSize,X,!1)},this.mode.unpad=function(X){return $(this.blockSize,X,!0)};var J={};if(J.decrypt=this._decrypt,J.overflow=this._input.length()%this.blockSize,!this._decrypt&&this.mode.pad){if(!this.mode.pad(this._input,J))return!1}if(this._finish=!0,this.update(),this._decrypt&&this.mode.unpad){if(!this.mode.unpad(this.output,J))return!1}if(this.mode.afterFinish){if(!this.mode.afterFinish(this.output,J))return!1}return!0}});var I9=H$((HE,oG)=>{var $0=K$();w$();$0.cipher=$0.cipher||{};var F$=oG.exports=$0.cipher.modes=$0.cipher.modes||{};F$.ecb=function($){$=$||{},this.name="ECB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};F$.ecb.prototype.start=function($){};F$.ecb.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};F$.ecb.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q])};F$.ecb.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};F$.ecb.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};F$.cbc=function($){$=$||{},this.name="CBC",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};F$.cbc.prototype.start=function($){if($.iv===null){if(!this._prev)throw Error("Invalid IV parameter.");this._iv=this._prev.slice(0)}else if(!("iv"in $))throw Error("Invalid IV parameter.");else this._iv=$Y($.iv,this.blockSize),this._prev=this._iv.slice(0)};F$.cbc.prototype.encrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=this._prev[Q]^$.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._outBlock[Q]);this._prev=this._outBlock};F$.cbc.prototype.decrypt=function($,J,X){if($.length()<this.blockSize&&!(X&&$.length()>0))return!0;for(var Q=0;Q<this._ints;++Q)this._inBlock[Q]=$.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var Q=0;Q<this._ints;++Q)J.putInt32(this._prev[Q]^this._outBlock[Q]);this._prev=this._inBlock.slice(0)};F$.cbc.prototype.pad=function($,J){var X=$.length()===this.blockSize?this.blockSize:this.blockSize-$.length();return $.fillWithByte(X,X),!0};F$.cbc.prototype.unpad=function($,J){if(J.overflow>0)return!1;var X=$.length(),Q=$.at(X-1);if(Q>this.blockSize<<2)return!1;return $.truncate(Q),!0};F$.cfb=function($){$=$||{},this.name="CFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialBlock=Array(this._ints),this._partialOutput=$0.util.createBuffer(),this._partialBytes=0};F$.cfb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=$Y($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};F$.cfb.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32()^this._outBlock[Y],J.putInt32(this._inBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32()^this._outBlock[Y],this._partialOutput.putInt32(this._partialBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};F$.cfb.prototype.decrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=$.getInt32(),J.putInt32(this._inBlock[Y]^this._outBlock[Y]);return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialBlock[Y]=$.getInt32(),this._partialOutput.putInt32(this._partialBlock[Y]^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._partialBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};F$.ofb=function($){$=$||{},this.name="OFB",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=$0.util.createBuffer(),this._partialBytes=0};F$.ofb.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=$Y($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};F$.ofb.prototype.encrypt=function($,J,X){var Q=$.length();if($.length()===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]),this._inBlock[Y]=this._outBlock[Y];return}var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;else for(var Y=0;Y<this._ints;++Y)this._inBlock[Y]=this._outBlock[Y];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0};F$.ofb.prototype.decrypt=F$.ofb.prototype.encrypt;F$.ctr=function($){$=$||{},this.name="CTR",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=$0.util.createBuffer(),this._partialBytes=0};F$.ctr.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");this._iv=$Y($.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};F$.ctr.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize)for(var Y=0;Y<this._ints;++Y)J.putInt32($.getInt32()^this._outBlock[Y]);else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G>0)$.read-=this.blockSize;if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}JY(this._inBlock)};F$.ctr.prototype.decrypt=F$.ctr.prototype.encrypt;F$.gcm=function($){$=$||{},this.name="GCM",this.cipher=$.cipher,this.blockSize=$.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints),this._partialOutput=$0.util.createBuffer(),this._partialBytes=0,this._R=3774873600};F$.gcm.prototype.start=function($){if(!("iv"in $))throw Error("Invalid IV parameter.");var J=$0.util.createBuffer($.iv);this._cipherLength=0;var X;if("additionalData"in $)X=$0.util.createBuffer($.additionalData);else X=$0.util.createBuffer();if("tagLength"in $)this._tagLength=$.tagLength;else this._tagLength=128;if(this._tag=null,$.decrypt){if(this._tag=$0.util.createBuffer($.tag).getBytes(),this._tag.length!==this._tagLength/8)throw Error("Authentication tag does not match tag length.")}this._hashBlock=Array(this._ints),this.tag=null,this._hashSubkey=Array(this._ints),this.cipher.encrypt([0,0,0,0],this._hashSubkey),this.componentBits=4,this._m=this.generateHashTable(this._hashSubkey,this.componentBits);var Q=J.length();if(Q===12)this._j0=[J.getInt32(),J.getInt32(),J.getInt32(),1];else{this._j0=[0,0,0,0];while(J.length()>0)this._j0=this.ghash(this._hashSubkey,this._j0,[J.getInt32(),J.getInt32(),J.getInt32(),J.getInt32()]);this._j0=this.ghash(this._hashSubkey,this._j0,[0,0].concat(C9(Q*8)))}this._inBlock=this._j0.slice(0),JY(this._inBlock),this._partialBytes=0,X=$0.util.createBuffer(X),this._aDataLength=C9(X.length()*8);var Y=X.length()%this.blockSize;if(Y)X.fillWithByte(0,this.blockSize-Y);this._s=[0,0,0,0];while(X.length()>0)this._s=this.ghash(this._hashSubkey,this._s,[X.getInt32(),X.getInt32(),X.getInt32(),X.getInt32()])};F$.gcm.prototype.encrypt=function($,J,X){var Q=$.length();if(Q===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&Q>=this.blockSize){for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^=$.getInt32());this._cipherLength+=this.blockSize}else{var G=(this.blockSize-Q)%this.blockSize;if(G>0)G=this.blockSize-G;this._partialOutput.clear();for(var Y=0;Y<this._ints;++Y)this._partialOutput.putInt32($.getInt32()^this._outBlock[Y]);if(G<=0||X){if(X){var W=Q%this.blockSize;this._cipherLength+=W,this._partialOutput.truncate(this.blockSize-W)}else this._cipherLength+=this.blockSize;for(var Y=0;Y<this._ints;++Y)this._outBlock[Y]=this._partialOutput.getInt32();this._partialOutput.read-=this.blockSize}if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(G>0&&!X)return $.read-=this.blockSize,J.putBytes(this._partialOutput.getBytes(G-this._partialBytes)),this._partialBytes=G,!0;J.putBytes(this._partialOutput.getBytes(Q-this._partialBytes)),this._partialBytes=0}this._s=this.ghash(this._hashSubkey,this._s,this._outBlock),JY(this._inBlock)};F$.gcm.prototype.decrypt=function($,J,X){var Q=$.length();if(Q<this.blockSize&&!(X&&Q>0))return!0;this.cipher.encrypt(this._inBlock,this._outBlock),JY(this._inBlock),this._hashBlock[0]=$.getInt32(),this._hashBlock[1]=$.getInt32(),this._hashBlock[2]=$.getInt32(),this._hashBlock[3]=$.getInt32(),this._s=this.ghash(this._hashSubkey,this._s,this._hashBlock);for(var Y=0;Y<this._ints;++Y)J.putInt32(this._outBlock[Y]^this._hashBlock[Y]);if(Q<this.blockSize)this._cipherLength+=Q%this.blockSize;else this._cipherLength+=this.blockSize};F$.gcm.prototype.afterFinish=function($,J){var X=!0;if(J.decrypt&&J.overflow)$.truncate(this.blockSize-J.overflow);this.tag=$0.util.createBuffer();var Q=this._aDataLength.concat(C9(this._cipherLength*8));this._s=this.ghash(this._hashSubkey,this._s,Q);var Y=[];this.cipher.encrypt(this._j0,Y);for(var G=0;G<this._ints;++G)this.tag.putInt32(this._s[G]^Y[G]);if(this.tag.truncate(this.tag.length()%(this._tagLength/8)),J.decrypt&&this.tag.bytes()!==this._tag)X=!1;return X};F$.gcm.prototype.multiply=function($,J){var X=[0,0,0,0],Q=J.slice(0);for(var Y=0;Y<128;++Y){var G=$[Y/32|0]&1<<31-Y%32;if(G)X[0]^=Q[0],X[1]^=Q[1],X[2]^=Q[2],X[3]^=Q[3];this.pow(Q,Q)}return X};F$.gcm.prototype.pow=function($,J){var X=$[3]&1;for(var Q=3;Q>0;--Q)J[Q]=$[Q]>>>1|($[Q-1]&1)<<31;if(J[0]=$[0]>>>1,X)J[0]^=this._R};F$.gcm.prototype.tableMultiply=function($){var J=[0,0,0,0];for(var X=0;X<32;++X){var Q=X/8|0,Y=$[Q]>>>(7-X%8)*4&15,G=this._m[X][Y];J[0]^=G[0],J[1]^=G[1],J[2]^=G[2],J[3]^=G[3]}return J};F$.gcm.prototype.ghash=function($,J,X){return J[0]^=X[0],J[1]^=X[1],J[2]^=X[2],J[3]^=X[3],this.tableMultiply(J)};F$.gcm.prototype.generateHashTable=function($,J){var X=8/J,Q=4*X,Y=16*X,G=Array(Y);for(var W=0;W<Y;++W){var O=[0,0,0,0],M=W/Q|0,U=(Q-1-W%Q)*J;O[M]=1<<J-1<<U,G[W]=this.generateSubHashTable(this.multiply(O,$),J)}return G};F$.gcm.prototype.generateSubHashTable=function($,J){var X=1<<J,Q=X>>>1,Y=Array(X);Y[Q]=$.slice(0);var G=Q>>>1;while(G>0)this.pow(Y[2*G],Y[G]=[]),G>>=1;G=2;while(G<Q){for(var W=1;W<G;++W){var O=Y[G],M=Y[W];Y[G+W]=[O[0]^M[0],O[1]^M[1],O[2]^M[2],O[3]^M[3]]}G*=2}Y[0]=[0,0,0,0];for(G=Q+1;G<X;++G){var U=Y[G^Q];Y[G]=[$[0]^U[0],$[1]^U[1],$[2]^U[2],$[3]^U[3]]}return Y};function $Y($,J){if(typeof $==="string")$=$0.util.createBuffer($);if($0.util.isArray($)&&$.length>4){var X=$;$=$0.util.createBuffer();for(var Q=0;Q<X.length;++Q)$.putByte(X[Q])}if($.length()<J)throw Error("Invalid IV length; got "+$.length()+" bytes and expected "+J+" bytes.");if(!$0.util.isArray($)){var Y=[],G=J/4;for(var Q=0;Q<G;++Q)Y.push($.getInt32());$=Y}return $}function JY($){$[$.length-1]=$[$.length-1]+1&4294967295}function C9($){return[$/4294967296|0,$&4294967295]}});var SJ=H$((VE,tG)=>{var f$=K$();eX();I9();w$();tG.exports=f$.aes=f$.aes||{};f$.aes.startEncrypting=function($,J,X,Q){var Y=QY({key:$,output:X,decrypt:!1,mode:Q});return Y.start(J),Y};f$.aes.createEncryptionCipher=function($,J){return QY({key:$,output:null,decrypt:!1,mode:J})};f$.aes.startDecrypting=function($,J,X,Q){var Y=QY({key:$,output:X,decrypt:!0,mode:Q});return Y.start(J),Y};f$.aes.createDecryptionCipher=function($,J){return QY({key:$,output:null,decrypt:!0,mode:J})};f$.aes.Algorithm=function($,J){if(!_9)rG();var X=this;X.name=$,X.mode=new J({blockSize:16,cipher:{encrypt:function(Q,Y){return P9(X._w,Q,Y,!1)},decrypt:function(Q,Y){return P9(X._w,Q,Y,!0)}}}),X._init=!1};f$.aes.Algorithm.prototype.initialize=function($){if(this._init)return;var J=$.key,X;if(typeof J==="string"&&(J.length===16||J.length===24||J.length===32))J=f$.util.createBuffer(J);else if(f$.util.isArray(J)&&(J.length===16||J.length===24||J.length===32)){X=J,J=f$.util.createBuffer();for(var Q=0;Q<X.length;++Q)J.putByte(X[Q])}if(!f$.util.isArray(J)){X=J,J=[];var Y=X.length();if(Y===16||Y===24||Y===32){Y=Y>>>2;for(var Q=0;Q<Y;++Q)J.push(X.getInt32())}}if(!f$.util.isArray(J)||!(J.length===4||J.length===6||J.length===8))throw Error("Invalid key parameter.");var G=this.mode.name,W=["CFB","OFB","CTR","GCM"].indexOf(G)!==-1;this._w=sG(J,$.decrypt&&!W),this._init=!0};f$.aes._expandKey=function($,J){if(!_9)rG();return sG($,J)};f$.aes._updateBlock=P9;LQ("AES-ECB",f$.cipher.modes.ecb);LQ("AES-CBC",f$.cipher.modes.cbc);LQ("AES-CFB",f$.cipher.modes.cfb);LQ("AES-OFB",f$.cipher.modes.ofb);LQ("AES-CTR",f$.cipher.modes.ctr);LQ("AES-GCM",f$.cipher.modes.gcm);function LQ($,J){var X=function(){return new f$.aes.Algorithm($,J)};f$.cipher.registerAlgorithm($,X)}var _9=!1,AQ=4,N0,w9,aG,rJ,u0;function rG(){_9=!0,aG=[0,1,2,4,8,16,32,64,128,27,54];var $=Array(256);for(var J=0;J<128;++J)$[J]=J<<1,$[J+128]=J+128<<1^283;N0=Array(256),w9=Array(256),rJ=[,,,,],u0=[,,,,];for(var J=0;J<4;++J)rJ[J]=Array(256),u0[J]=Array(256);var X=0,Q=0,Y,G,W,O,M,U,H;for(var J=0;J<256;++J){O=Q^Q<<1^Q<<2^Q<<3^Q<<4,O=O>>8^O&255^99,N0[X]=O,w9[O]=X,M=$[O],Y=$[X],G=$[Y],W=$[G],U=M<<24^O<<16^O<<8^(O^M),H=(Y^G^W)<<24^(X^W)<<16^(X^G^W)<<8^(X^Y^W);for(var V=0;V<4;++V)rJ[V][X]=U,u0[V][O]=H,U=U<<24|U>>>8,H=H<<24|H>>>8;if(X===0)X=Q=1;else X=Y^$[$[$[Y^W]]],Q^=$[$[Q]]}}function sG($,J){var X=$.slice(0),Q,Y=1,G=X.length,W=G+6+1,O=AQ*W;for(var M=G;M<O;++M){if(Q=X[M-1],M%G===0)Q=N0[Q>>>16&255]<<24^N0[Q>>>8&255]<<16^N0[Q&255]<<8^N0[Q>>>24]^aG[Y]<<24,Y++;else if(G>6&&M%G===4)Q=N0[Q>>>24]<<24^N0[Q>>>16&255]<<16^N0[Q>>>8&255]<<8^N0[Q&255];X[M]=X[M-G]^Q}if(J){var U,H=u0[0],V=u0[1],q=u0[2],z=u0[3],K=X.slice(0);O=X.length;for(var M=0,L=O-AQ;M<O;M+=AQ,L-=AQ)if(M===0||M===O-AQ)K[M]=X[L],K[M+1]=X[L+3],K[M+2]=X[L+2],K[M+3]=X[L+1];else for(var A=0;A<AQ;++A)U=X[L+A],K[M+(3&-A)]=H[N0[U>>>24]]^V[N0[U>>>16&255]]^q[N0[U>>>8&255]]^z[N0[U&255]];X=K}return X}function P9($,J,X,Q){var Y=$.length/4-1,G,W,O,M,U;if(Q)G=u0[0],W=u0[1],O=u0[2],M=u0[3],U=w9;else G=rJ[0],W=rJ[1],O=rJ[2],M=rJ[3],U=N0;var H,V,q,z,K,L,A;H=J[0]^$[0],V=J[Q?3:1]^$[1],q=J[2]^$[2],z=J[Q?1:3]^$[3];var D=3;for(var j=1;j<Y;++j)K=G[H>>>24]^W[V>>>16&255]^O[q>>>8&255]^M[z&255]^$[++D],L=G[V>>>24]^W[q>>>16&255]^O[z>>>8&255]^M[H&255]^$[++D],A=G[q>>>24]^W[z>>>16&255]^O[H>>>8&255]^M[V&255]^$[++D],z=G[z>>>24]^W[H>>>16&255]^O[V>>>8&255]^M[q&255]^$[++D],H=K,V=L,q=A;X[0]=U[H>>>24]<<24^U[V>>>16&255]<<16^U[q>>>8&255]<<8^U[z&255]^$[++D],X[Q?3:1]=U[V>>>24]<<24^U[q>>>16&255]<<16^U[z>>>8&255]<<8^U[H&255]^$[++D],X[2]=U[q>>>24]<<24^U[z>>>16&255]<<16^U[H>>>8&255]<<8^U[V&255]^$[++D],X[Q?1:3]=U[z>>>24]<<24^U[H>>>16&255]<<16^U[V>>>8&255]<<8^U[q&255]^$[++D]}function QY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="AES-"+J,Q;if($.decrypt)Q=f$.cipher.createDecipher(X,$.key);else Q=f$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var O=null;if(W instanceof f$.util.ByteBuffer)O=W,W={};W=W||{},W.output=O,W.iv=G,Y.call(Q,W)},Q}});var jJ=H$((qE,eG)=>{var UX=K$();UX.pki=UX.pki||{};var x9=eG.exports=UX.pki.oids=UX.oids=UX.oids||{};function f($,J){x9[$]=J,x9[J]=$}function P$($,J){x9[$]=J}f("1.2.840.113549.1.1.1","rsaEncryption");f("1.2.840.113549.1.1.4","md5WithRSAEncryption");f("1.2.840.113549.1.1.5","sha1WithRSAEncryption");f("1.2.840.113549.1.1.7","RSAES-OAEP");f("1.2.840.113549.1.1.8","mgf1");f("1.2.840.113549.1.1.9","pSpecified");f("1.2.840.113549.1.1.10","RSASSA-PSS");f("1.2.840.113549.1.1.11","sha256WithRSAEncryption");f("1.2.840.113549.1.1.12","sha384WithRSAEncryption");f("1.2.840.113549.1.1.13","sha512WithRSAEncryption");f("1.3.101.112","EdDSA25519");f("1.2.840.10040.4.3","dsa-with-sha1");f("1.3.14.3.2.7","desCBC");f("1.3.14.3.2.26","sha1");f("1.3.14.3.2.29","sha1WithRSASignature");f("2.16.840.1.101.3.4.2.1","sha256");f("2.16.840.1.101.3.4.2.2","sha384");f("2.16.840.1.101.3.4.2.3","sha512");f("2.16.840.1.101.3.4.2.4","sha224");f("2.16.840.1.101.3.4.2.5","sha512-224");f("2.16.840.1.101.3.4.2.6","sha512-256");f("1.2.840.113549.2.2","md2");f("1.2.840.113549.2.5","md5");f("1.2.840.113549.1.7.1","data");f("1.2.840.113549.1.7.2","signedData");f("1.2.840.113549.1.7.3","envelopedData");f("1.2.840.113549.1.7.4","signedAndEnvelopedData");f("1.2.840.113549.1.7.5","digestedData");f("1.2.840.113549.1.7.6","encryptedData");f("1.2.840.113549.1.9.1","emailAddress");f("1.2.840.113549.1.9.2","unstructuredName");f("1.2.840.113549.1.9.3","contentType");f("1.2.840.113549.1.9.4","messageDigest");f("1.2.840.113549.1.9.5","signingTime");f("1.2.840.113549.1.9.6","counterSignature");f("1.2.840.113549.1.9.7","challengePassword");f("1.2.840.113549.1.9.8","unstructuredAddress");f("1.2.840.113549.1.9.14","extensionRequest");f("1.2.840.113549.1.9.20","friendlyName");f("1.2.840.113549.1.9.21","localKeyId");f("1.2.840.113549.1.9.22.1","x509Certificate");f("1.2.840.113549.1.12.10.1.1","keyBag");f("1.2.840.113549.1.12.10.1.2","pkcs8ShroudedKeyBag");f("1.2.840.113549.1.12.10.1.3","certBag");f("1.2.840.113549.1.12.10.1.4","crlBag");f("1.2.840.113549.1.12.10.1.5","secretBag");f("1.2.840.113549.1.12.10.1.6","safeContentsBag");f("1.2.840.113549.1.5.13","pkcs5PBES2");f("1.2.840.113549.1.5.12","pkcs5PBKDF2");f("1.2.840.113549.1.12.1.1","pbeWithSHAAnd128BitRC4");f("1.2.840.113549.1.12.1.2","pbeWithSHAAnd40BitRC4");f("1.2.840.113549.1.12.1.3","pbeWithSHAAnd3-KeyTripleDES-CBC");f("1.2.840.113549.1.12.1.4","pbeWithSHAAnd2-KeyTripleDES-CBC");f("1.2.840.113549.1.12.1.5","pbeWithSHAAnd128BitRC2-CBC");f("1.2.840.113549.1.12.1.6","pbewithSHAAnd40BitRC2-CBC");f("1.2.840.113549.2.7","hmacWithSHA1");f("1.2.840.113549.2.8","hmacWithSHA224");f("1.2.840.113549.2.9","hmacWithSHA256");f("1.2.840.113549.2.10","hmacWithSHA384");f("1.2.840.113549.2.11","hmacWithSHA512");f("1.2.840.113549.3.7","des-EDE3-CBC");f("2.16.840.1.101.3.4.1.2","aes128-CBC");f("2.16.840.1.101.3.4.1.22","aes192-CBC");f("2.16.840.1.101.3.4.1.42","aes256-CBC");f("2.5.4.3","commonName");f("2.5.4.4","surname");f("2.5.4.5","serialNumber");f("2.5.4.6","countryName");f("2.5.4.7","localityName");f("2.5.4.8","stateOrProvinceName");f("2.5.4.9","streetAddress");f("2.5.4.10","organizationName");f("2.5.4.11","organizationalUnitName");f("2.5.4.12","title");f("2.5.4.13","description");f("2.5.4.15","businessCategory");f("2.5.4.17","postalCode");f("2.5.4.42","givenName");f("2.5.4.65","pseudonym");f("1.3.6.1.4.1.311.60.2.1.2","jurisdictionOfIncorporationStateOrProvinceName");f("1.3.6.1.4.1.311.60.2.1.3","jurisdictionOfIncorporationCountryName");f("2.16.840.1.113730.1.1","nsCertType");f("2.16.840.1.113730.1.13","nsComment");P$("2.5.29.1","authorityKeyIdentifier");P$("2.5.29.2","keyAttributes");P$("2.5.29.3","certificatePolicies");P$("2.5.29.4","keyUsageRestriction");P$("2.5.29.5","policyMapping");P$("2.5.29.6","subtreesConstraint");P$("2.5.29.7","subjectAltName");P$("2.5.29.8","issuerAltName");P$("2.5.29.9","subjectDirectoryAttributes");P$("2.5.29.10","basicConstraints");P$("2.5.29.11","nameConstraints");P$("2.5.29.12","policyConstraints");P$("2.5.29.13","basicConstraints");f("2.5.29.14","subjectKeyIdentifier");f("2.5.29.15","keyUsage");P$("2.5.29.16","privateKeyUsagePeriod");f("2.5.29.17","subjectAltName");f("2.5.29.18","issuerAltName");f("2.5.29.19","basicConstraints");P$("2.5.29.20","cRLNumber");P$("2.5.29.21","cRLReason");P$("2.5.29.22","expirationDate");P$("2.5.29.23","instructionCode");P$("2.5.29.24","invalidityDate");P$("2.5.29.25","cRLDistributionPoints");P$("2.5.29.26","issuingDistributionPoint");P$("2.5.29.27","deltaCRLIndicator");P$("2.5.29.28","issuingDistributionPoint");P$("2.5.29.29","certificateIssuer");P$("2.5.29.30","nameConstraints");f("2.5.29.31","cRLDistributionPoints");f("2.5.29.32","certificatePolicies");P$("2.5.29.33","policyMappings");P$("2.5.29.34","policyConstraints");f("2.5.29.35","authorityKeyIdentifier");P$("2.5.29.36","policyConstraints");f("2.5.29.37","extKeyUsage");P$("2.5.29.46","freshestCRL");P$("2.5.29.54","inhibitAnyPolicy");f("1.3.6.1.4.1.11129.2.4.2","timestampList");f("1.3.6.1.5.5.7.1.1","authorityInfoAccess");f("1.3.6.1.5.5.7.3.1","serverAuth");f("1.3.6.1.5.5.7.3.2","clientAuth");f("1.3.6.1.5.5.7.3.3","codeSigning");f("1.3.6.1.5.5.7.3.4","emailProtection");f("1.3.6.1.5.5.7.3.8","timeStamping")});var m0=H$((KE,J7)=>{var h$=K$();w$();jJ();var p=J7.exports=h$.asn1=h$.asn1||{};p.Class={UNIVERSAL:0,APPLICATION:64,CONTEXT_SPECIFIC:128,PRIVATE:192};p.Type={NONE:0,BOOLEAN:1,INTEGER:2,BITSTRING:3,OCTETSTRING:4,NULL:5,OID:6,ODESC:7,EXTERNAL:8,REAL:9,ENUMERATED:10,EMBEDDED:11,UTF8:12,ROID:13,SEQUENCE:16,SET:17,PRINTABLESTRING:19,IA5STRING:22,UTCTIME:23,GENERALIZEDTIME:24,BMPSTRING:30};p.maxDepth=256;p.create=function($,J,X,Q,Y){if(h$.util.isArray(Q)){var G=[];for(var W=0;W<Q.length;++W)if(Q[W]!==void 0)G.push(Q[W]);Q=G}var O={tagClass:$,type:J,constructed:X,composed:X||h$.util.isArray(Q),value:Q};if(Y&&"bitStringContents"in Y)O.bitStringContents=Y.bitStringContents,O.original=p.copy(O);return O};p.copy=function($,J){var X;if(h$.util.isArray($)){X=[];for(var Q=0;Q<$.length;++Q)X.push(p.copy($[Q],J));return X}if(typeof $==="string")return $;if(X={tagClass:$.tagClass,type:$.type,constructed:$.constructed,composed:$.composed,value:p.copy($.value,J)},J&&!J.excludeBitStringContents)X.bitStringContents=$.bitStringContents;return X};p.equals=function($,J,X){if(h$.util.isArray($)){if(!h$.util.isArray(J))return!1;if($.length!==J.length)return!1;for(var Q=0;Q<$.length;++Q)if(!p.equals($[Q],J[Q]))return!1;return!0}if(typeof $!==typeof J)return!1;if(typeof $==="string")return $===J;var Y=$.tagClass===J.tagClass&&$.type===J.type&&$.constructed===J.constructed&&$.composed===J.composed&&p.equals($.value,J.value);if(X&&X.includeBitStringContents)Y=Y&&$.bitStringContents===J.bitStringContents;return Y};p.getBerValueLength=function($){var J=$.getByte();if(J===128)return;var X,Q=J&128;if(!Q)X=J;else X=$.getInt((J&127)<<3);return X};function HX($,J,X){if(X>J){var Q=Error("Too few bytes to parse DER.");throw Q.available=$.length(),Q.remaining=J,Q.requested=X,Q}}var e5=function($,J){var X=$.getByte();if(J--,X===128)return;var Q,Y=X&128;if(!Y)Q=X;else{var G=X&127;HX($,J,G),Q=$.getInt(G<<3)}if(Q<0)throw Error("Negative length: "+Q);return Q};p.fromDer=function($,J){if(J===void 0)J={strict:!0,parseAllBytes:!0,decodeBitStrings:!0};if(typeof J==="boolean")J={strict:J,parseAllBytes:!0,decodeBitStrings:!0};if(!("strict"in J))J.strict=!0;if(!("parseAllBytes"in J))J.parseAllBytes=!0;if(!("decodeBitStrings"in J))J.decodeBitStrings=!0;if(!("maxDepth"in J))J.maxDepth=p.maxDepth;if(typeof $==="string")$=h$.util.createBuffer($);var X=$.length(),Q=XY($,$.length(),0,J);if(J.parseAllBytes&&$.length()!==0){var Y=Error("Unparsed DER bytes remain after ASN.1 parsing.");throw Y.byteCount=X,Y.remaining=$.length(),Y}return Q};function XY($,J,X,Q){if(X>=Q.maxDepth)throw Error("ASN.1 parsing error: Max depth exceeded.");var Y;HX($,J,2);var G=$.getByte();J--;var W=G&192,O=G&31;Y=$.length();var M=e5($,J);if(J-=Y-$.length(),M!==void 0&&M>J){if(Q.strict){var U=Error("Too few bytes to read ASN.1 value.");throw U.available=$.length(),U.remaining=J,U.requested=M,U}M=J}var H,V,q=(G&32)===32;if(q)if(H=[],M===void 0)for(;;){if(HX($,J,2),$.bytes(2)===String.fromCharCode(0,0)){$.getBytes(2),J-=2;break}Y=$.length(),H.push(XY($,J,X+1,Q)),J-=Y-$.length()}else while(M>0)Y=$.length(),H.push(XY($,M,X+1,Q)),J-=Y-$.length(),M-=Y-$.length();if(H===void 0&&W===p.Class.UNIVERSAL&&O===p.Type.BITSTRING)V=$.bytes(M);if(H===void 0&&Q.decodeBitStrings&&W===p.Class.UNIVERSAL&&O===p.Type.BITSTRING&&M>1){var z=$.read,K=J,L=0;if(O===p.Type.BITSTRING)HX($,J,1),L=$.getByte(),J--;if(L===0)try{Y=$.length();var A={strict:!0,decodeBitStrings:!0},D=XY($,J,X+1,A),j=Y-$.length();if(J-=j,O==p.Type.BITSTRING)j++;var S=D.tagClass;if(j===M&&(S===p.Class.UNIVERSAL||S===p.Class.CONTEXT_SPECIFIC))H=[D]}catch(C){}if(H===void 0)$.read=z,J=K}if(H===void 0){if(M===void 0){if(Q.strict)throw Error("Non-constructed ASN.1 object of indefinite length.");M=J}if(O===p.Type.BMPSTRING){H="";for(;M>0;M-=2)HX($,J,2),H+=String.fromCharCode($.getInt16()),J-=2}else H=$.getBytes(M),J-=M}var P=V===void 0?null:{bitStringContents:V};return p.create(W,O,q,H,P)}p.toDer=function($){var J=h$.util.createBuffer(),X=$.tagClass|$.type,Q=h$.util.createBuffer(),Y=!1;if("bitStringContents"in $){if(Y=!0,$.original)Y=p.equals($,$.original)}if(Y)Q.putBytes($.bitStringContents);else if($.composed){if($.constructed)X|=32;else Q.putByte(0);for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0)Q.putBuffer(p.toDer($.value[G]))}else if($.type===p.Type.BMPSTRING)for(var G=0;G<$.value.length;++G)Q.putInt16($.value.charCodeAt(G));else if($.type===p.Type.INTEGER&&$.value.length>1&&($.value.charCodeAt(0)===0&&($.value.charCodeAt(1)&128)===0||$.value.charCodeAt(0)===255&&($.value.charCodeAt(1)&128)===128))Q.putBytes($.value.substr(1));else Q.putBytes($.value);if(J.putByte(X),Q.length()<=127)J.putByte(Q.length()&127);else{var W=Q.length(),O="";do O+=String.fromCharCode(W&255),W=W>>>8;while(W>0);J.putByte(O.length|128);for(var G=O.length-1;G>=0;--G)J.putByte(O.charCodeAt(G))}return J.putBuffer(Q),J};p.oidToDer=function($){var J=$.split("."),X=h$.util.createBuffer();X.putByte(40*parseInt(J[0],10)+parseInt(J[1],10));var Q,Y,G,W;for(var O=2;O<J.length;++O){if(Q=!0,Y=[],G=parseInt(J[O],10),G>4294967295)throw Error("OID value too large; max is 32-bits.");do{if(W=G&127,G=G>>>7,!Q)W|=128;Y.push(W),Q=!1}while(G>0);for(var M=Y.length-1;M>=0;--M)X.putByte(Y[M])}return X};p.derToOid=function($){var J;if(typeof $==="string")$=h$.util.createBuffer($);var X=$.getByte();J=Math.floor(X/40)+"."+X%40;var Q=0;while($.length()>0){if(Q>70368744177663)throw Error("OID value too large; max is 53-bits.");if(X=$.getByte(),Q=Q*128,X&128)Q+=X&127;else J+="."+(Q+X),Q=0}return J};p.utcTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,2),10);X=X>=50?1900+X:2000+X;var Q=parseInt($.substr(2,2),10)-1,Y=parseInt($.substr(4,2),10),G=parseInt($.substr(6,2),10),W=parseInt($.substr(8,2),10),O=0;if($.length>11){var M=$.charAt(10),U=10;if(M!=="+"&&M!=="-")O=parseInt($.substr(10,2),10),U+=2}if(J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,O,0),U){if(M=$.charAt(U),M==="+"||M==="-"){var H=parseInt($.substr(U+1,2),10),V=parseInt($.substr(U+4,2),10),q=H*60+V;if(q*=60000,M==="+")J.setTime(+J-q);else J.setTime(+J+q)}}return J};p.generalizedTimeToDate=function($){var J=new Date,X=parseInt($.substr(0,4),10),Q=parseInt($.substr(4,2),10)-1,Y=parseInt($.substr(6,2),10),G=parseInt($.substr(8,2),10),W=parseInt($.substr(10,2),10),O=parseInt($.substr(12,2),10),M=0,U=0,H=!1;if($.charAt($.length-1)==="Z")H=!0;var V=$.length-5,q=$.charAt(V);if(q==="+"||q==="-"){var z=parseInt($.substr(V+1,2),10),K=parseInt($.substr(V+4,2),10);if(U=z*60+K,U*=60000,q==="+")U*=-1;H=!0}if($.charAt(14)===".")M=parseFloat($.substr(14),10)*1000;if(H)J.setUTCFullYear(X,Q,Y),J.setUTCHours(G,W,O,M),J.setTime(+J+U);else J.setFullYear(X,Q,Y),J.setHours(G,W,O,M);return J};p.dateToUtcTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push((""+$.getUTCFullYear()).substr(2)),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};p.dateToGeneralizedTime=function($){if(typeof $==="string")return $;var J="",X=[];X.push(""+$.getUTCFullYear()),X.push(""+($.getUTCMonth()+1)),X.push(""+$.getUTCDate()),X.push(""+$.getUTCHours()),X.push(""+$.getUTCMinutes()),X.push(""+$.getUTCSeconds());for(var Q=0;Q<X.length;++Q){if(X[Q].length<2)J+="0";J+=X[Q]}return J+="Z",J};p.integerToDer=function($){var J=h$.util.createBuffer();if($>=-128&&$<128)return J.putSignedInt($,8);if($>=-32768&&$<32768)return J.putSignedInt($,16);if($>=-8388608&&$<8388608)return J.putSignedInt($,24);if($>=-2147483648&&$<2147483648)return J.putSignedInt($,32);var X=Error("Integer too large; max is 32-bits.");throw X.integer=$,X};p.derToInteger=function($){if(typeof $==="string")$=h$.util.createBuffer($);var J=$.length()*8;if(J>32)throw Error("Integer too large; max is 32-bits.");return $.getSignedInt(J)};p.validate=function($,J,X,Q){var Y=!1;if(($.tagClass===J.tagClass||typeof J.tagClass>"u")&&($.type===J.type||typeof J.type>"u")){if($.constructed===J.constructed||typeof J.constructed>"u"){if(Y=!0,J.value&&h$.util.isArray(J.value)){var G=0;for(var W=0;Y&&W<J.value.length;++W){var O=J.value[W];Y=!!O.optional;var M=$.value[G];if(!M){if(!O.optional){if(Y=!1,Q)Q.push("["+J.name+'] Missing required element. Expected tag class "'+O.tagClass+'", type "'+O.type+'"')}continue}var U=typeof O.tagClass<"u"&&typeof O.type<"u";if(U&&(M.tagClass!==O.tagClass||M.type!==O.type))if(O.optional){Y=!0;continue}else{if(Y=!1,Q)Q.push("["+J.name+"] Tag mismatch. Expected ("+O.tagClass+","+O.type+"), got ("+M.tagClass+","+M.type+")");break}var H=p.validate(M,O,X,Q);if(H)++G,Y=!0;else if(O.optional)Y=!0;else{Y=!1;break}}}if(Y&&X){if(J.capture)X[J.capture]=$.value;if(J.captureAsn1)X[J.captureAsn1]=$;if(J.captureBitStringContents&&"bitStringContents"in $)X[J.captureBitStringContents]=$.bitStringContents;if(J.captureBitStringValue&&"bitStringContents"in $){var V;if($.bitStringContents.length<2)X[J.captureBitStringValue]="";else{var q=$.bitStringContents.charCodeAt(0);if(q!==0)throw Error("captureBitStringValue only supported for zero unused bits");X[J.captureBitStringValue]=$.bitStringContents.slice(1)}}}}else if(Q)Q.push("["+J.name+'] Expected constructed "'+J.constructed+'", got "'+$.constructed+'"')}else if(Q){if($.tagClass!==J.tagClass)Q.push("["+J.name+'] Expected tag class "'+J.tagClass+'", got "'+$.tagClass+'"');if($.type!==J.type)Q.push("["+J.name+'] Expected type "'+J.type+'", got "'+$.type+'"')}return Y};var $7=/[^\\u0000-\\u00ff]/;p.prettyPrint=function($,J,X){var Q="";if(J=J||0,X=X||2,J>0)Q+=`
|
|
6
|
+
`;var Y="";for(var G=0;G<J*X;++G)Y+=" ";switch(Q+=Y+"Tag: ",$.tagClass){case p.Class.UNIVERSAL:Q+="Universal:";break;case p.Class.APPLICATION:Q+="Application:";break;case p.Class.CONTEXT_SPECIFIC:Q+="Context-Specific:";break;case p.Class.PRIVATE:Q+="Private:";break}if($.tagClass===p.Class.UNIVERSAL)switch(Q+=$.type,$.type){case p.Type.NONE:Q+=" (None)";break;case p.Type.BOOLEAN:Q+=" (Boolean)";break;case p.Type.INTEGER:Q+=" (Integer)";break;case p.Type.BITSTRING:Q+=" (Bit string)";break;case p.Type.OCTETSTRING:Q+=" (Octet string)";break;case p.Type.NULL:Q+=" (Null)";break;case p.Type.OID:Q+=" (Object Identifier)";break;case p.Type.ODESC:Q+=" (Object Descriptor)";break;case p.Type.EXTERNAL:Q+=" (External or Instance of)";break;case p.Type.REAL:Q+=" (Real)";break;case p.Type.ENUMERATED:Q+=" (Enumerated)";break;case p.Type.EMBEDDED:Q+=" (Embedded PDV)";break;case p.Type.UTF8:Q+=" (UTF8)";break;case p.Type.ROID:Q+=" (Relative Object Identifier)";break;case p.Type.SEQUENCE:Q+=" (Sequence)";break;case p.Type.SET:Q+=" (Set)";break;case p.Type.PRINTABLESTRING:Q+=" (Printable String)";break;case p.Type.IA5String:Q+=" (IA5String (ASCII))";break;case p.Type.UTCTIME:Q+=" (UTC time)";break;case p.Type.GENERALIZEDTIME:Q+=" (Generalized time)";break;case p.Type.BMPSTRING:Q+=" (BMP String)";break}else Q+=$.type;if(Q+=`
|
|
7
|
+
`,Q+=Y+"Constructed: "+$.constructed+`
|
|
8
|
+
`,$.composed){var W=0,O="";for(var G=0;G<$.value.length;++G)if($.value[G]!==void 0){if(W+=1,O+=p.prettyPrint($.value[G],J+1,X),G+1<$.value.length)O+=","}Q+=Y+"Sub values: "+W+O}else{if(Q+=Y+"Value: ",$.type===p.Type.OID){var M=p.derToOid($.value);if(Q+=M,h$.pki&&h$.pki.oids){if(M in h$.pki.oids)Q+=" ("+h$.pki.oids[M]+") "}}if($.type===p.Type.INTEGER)try{Q+=p.derToInteger($.value)}catch(H){Q+="0x"+h$.util.bytesToHex($.value)}else if($.type===p.Type.BITSTRING){if($.value.length>1)Q+="0x"+h$.util.bytesToHex($.value.slice(1));else Q+="(none)";if($.value.length>0){var U=$.value.charCodeAt(0);if(U==1)Q+=" (1 unused bit shown)";else if(U>1)Q+=" ("+U+" unused bits shown)"}}else if($.type===p.Type.OCTETSTRING){if(!$7.test($.value))Q+="("+$.value+") ";Q+="0x"+h$.util.bytesToHex($.value)}else if($.type===p.Type.UTF8)try{Q+=h$.util.decodeUtf8($.value)}catch(H){if(H.message==="URI malformed")Q+="0x"+h$.util.bytesToHex($.value)+" (malformed UTF8)";else throw H}else if($.type===p.Type.PRINTABLESTRING||$.type===p.Type.IA5String)Q+=$.value;else if($7.test($.value))Q+="0x"+h$.util.bytesToHex($.value);else if($.value.length===0)Q+="[null]";else Q+=$.value}return Q}});var t0=H$((EE,Q7)=>{var YY=K$();Q7.exports=YY.md=YY.md||{};YY.md.algorithms=YY.md.algorithms||{}});var DQ=H$((zE,X7)=>{var KJ=K$();t0();w$();var $O=X7.exports=KJ.hmac=KJ.hmac||{};$O.create=function(){var $=null,J=null,X=null,Q=null,Y={};return Y.start=function(G,W){if(G!==null)if(typeof G==="string")if(G=G.toLowerCase(),G in KJ.md.algorithms)J=KJ.md.algorithms[G].create();else throw Error('Unknown hash algorithm "'+G+'"');else J=G;if(W===null)W=$;else{if(typeof W==="string")W=KJ.util.createBuffer(W);else if(KJ.util.isArray(W)){var O=W;W=KJ.util.createBuffer();for(var M=0;M<O.length;++M)W.putByte(O[M])}var U=W.length();if(U>J.blockLength)J.start(),J.update(W.bytes()),W=J.digest();X=KJ.util.createBuffer(),Q=KJ.util.createBuffer(),U=W.length();for(var M=0;M<U;++M){var O=W.at(M);X.putByte(54^O),Q.putByte(92^O)}if(U<J.blockLength){var O=J.blockLength-U;for(var M=0;M<O;++M)X.putByte(54),Q.putByte(92)}$=W,X=X.bytes(),Q=Q.bytes()}J.start(),J.update(X)},Y.update=function(G){J.update(G)},Y.getMac=function(){var G=J.digest().bytes();return J.start(),J.update(Q),J.update(G),J.digest()},Y.digest=Y.getMac,Y}});var WY=H$((FE,O7)=>{var e0=K$();t0();w$();var G7=O7.exports=e0.md5=e0.md5||{};e0.md.md5=e0.md.algorithms.md5=G7;G7.create=function(){if(!W7)JO();var $=null,J=e0.util.createBuffer(),X=Array(16),Q={algorithm:"md5",blockLength:64,digestLength:16,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=e0.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=e0.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var O=Q.fullMessageLength.length-1;O>=0;--O)Q.fullMessageLength[O]+=W[1],W[1]=W[0]+(Q.fullMessageLength[O]/4294967296>>>0),Q.fullMessageLength[O]=Q.fullMessageLength[O]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),Y7($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=e0.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(v9.substr(0,Q.blockLength-W));var O,M=0;for(var U=Q.fullMessageLength.length-1;U>=0;--U)O=Q.fullMessageLength[U]*8+M,M=O/4294967296>>>0,Y.putInt32Le(O>>>0);var H={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3};Y7(H,X,Y);var V=e0.util.createBuffer();return V.putInt32Le(H.h0),V.putInt32Le(H.h1),V.putInt32Le(H.h2),V.putInt32Le(H.h3),V},Q};var v9=null,GY=null,VX=null,RQ=null,W7=!1;function JO(){v9=String.fromCharCode(128),v9+=e0.util.fillString(String.fromCharCode(0),64),GY=[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,1,6,11,0,5,10,15,4,9,14,3,8,13,2,7,12,5,8,11,14,1,4,7,10,13,0,3,6,9,12,15,2,0,7,14,5,12,3,10,1,8,15,6,13,4,11,2,9],VX=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],RQ=Array(64);for(var $=0;$<64;++$)RQ[$]=Math.floor(Math.abs(Math.sin($+1))*4294967296);W7=!0}function Y7($,J,X){var Q,Y,G,W,O,M,U,H,V=X.length();while(V>=64){Y=$.h0,G=$.h1,W=$.h2,O=$.h3;for(H=0;H<16;++H)J[H]=X.getInt32Le(),M=O^G&(W^O),Q=Y+M+RQ[H]+J[H],U=VX[H],Y=O,O=W,W=G,G+=Q<<U|Q>>>32-U;for(;H<32;++H)M=W^O&(G^W),Q=Y+M+RQ[H]+J[GY[H]],U=VX[H],Y=O,O=W,W=G,G+=Q<<U|Q>>>32-U;for(;H<48;++H)M=G^W^O,Q=Y+M+RQ[H]+J[GY[H]],U=VX[H],Y=O,O=W,W=G,G+=Q<<U|Q>>>32-U;for(;H<64;++H)M=W^(G|~O),Q=Y+M+RQ[H]+J[GY[H]],U=VX[H],Y=O,O=W,W=G,G+=Q<<U|Q>>>32-U;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+O|0,V-=64}}});var sJ=H$((NE,U7)=>{var MY=K$();w$();var M7=U7.exports=MY.pem=MY.pem||{};M7.encode=function($,J){J=J||{};var X="-----BEGIN "+$.type+`-----\r
|
|
9
|
+
`,Q;if($.procType)Q={name:"Proc-Type",values:[String($.procType.version),$.procType.type]},X+=OY(Q);if($.contentDomain)Q={name:"Content-Domain",values:[$.contentDomain]},X+=OY(Q);if($.dekInfo){if(Q={name:"DEK-Info",values:[$.dekInfo.algorithm]},$.dekInfo.parameters)Q.values.push($.dekInfo.parameters);X+=OY(Q)}if($.headers)for(var Y=0;Y<$.headers.length;++Y)X+=OY($.headers[Y]);if($.procType)X+=`\r
|
|
10
|
+
`;return X+=MY.util.encode64($.body,J.maxline||64)+`\r
|
|
11
|
+
`,X+="-----END "+$.type+`-----\r
|
|
12
|
+
`,X};M7.decode=function($){var J=[],X=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g,Q=/([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/,Y=/\r?\n/,G;while(!0){if(G=X.exec($),!G)break;var W=G[1];if(W==="NEW CERTIFICATE REQUEST")W="CERTIFICATE REQUEST";var O={type:W,procType:null,contentDomain:null,dekInfo:null,headers:[],body:MY.util.decode64(G[3])};if(J.push(O),!G[2])continue;var M=G[2].split(Y),U=0;while(G&&U<M.length){var H=M[U].replace(/\s+$/,"");for(var V=U+1;V<M.length;++V){var q=M[V];if(!/\s/.test(q[0]))break;H+=q,U=V}if(G=H.match(Q),G){var z={name:G[1],values:[]},K=G[2].split(",");for(var L=0;L<K.length;++L)z.values.push(QO(K[L]));if(!O.procType){if(z.name!=="Proc-Type")throw Error('Invalid PEM formatted message. The first encapsulated header must be "Proc-Type".');else if(z.values.length!==2)throw Error('Invalid PEM formatted message. The "Proc-Type" header must have two subfields.');O.procType={version:K[0],type:K[1]}}else if(!O.contentDomain&&z.name==="Content-Domain")O.contentDomain=K[0]||"";else if(!O.dekInfo&&z.name==="DEK-Info"){if(z.values.length===0)throw Error('Invalid PEM formatted message. The "DEK-Info" header must have at least one subfield.');O.dekInfo={algorithm:K[0],parameters:K[1]||null}}else O.headers.push(z)}++U}if(O.procType==="ENCRYPTED"&&!O.dekInfo)throw Error('Invalid PEM formatted message. The "DEK-Info" header must be present if "Proc-Type" is "ENCRYPTED".')}if(J.length===0)throw Error("Invalid PEM formatted message.");return J};function OY($){var J=$.name+": ",X=[],Q=function(M,U){return" "+U};for(var Y=0;Y<$.values.length;++Y)X.push($.values[Y].replace(/^(\S+\r\n)/,Q));J+=X.join(",")+`\r
|
|
13
|
+
`;var G=0,W=-1;for(var Y=0;Y<J.length;++Y,++G)if(G>65&&W!==-1){var O=J[W];if(O===",")++W,J=J.substr(0,W)+`\r
|
|
14
|
+
`+J.substr(W);else J=J.substr(0,W)+`\r
|
|
15
|
+
`+O+J.substr(W+1);G=Y-W-1,W=-1,++Y}else if(J[Y]===" "||J[Y]==="\t"||J[Y]===",")W=Y;return J}function QO($){return $.replace(/^\s+/,"")}});var qX=H$((AE,V7)=>{var u$=K$();eX();I9();w$();V7.exports=u$.des=u$.des||{};u$.des.startEncrypting=function($,J,X,Q){var Y=UY({key:$,output:X,decrypt:!1,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};u$.des.createEncryptionCipher=function($,J){return UY({key:$,output:null,decrypt:!1,mode:J})};u$.des.startDecrypting=function($,J,X,Q){var Y=UY({key:$,output:X,decrypt:!0,mode:Q||(J===null?"ECB":"CBC")});return Y.start(J),Y};u$.des.createDecryptionCipher=function($,J){return UY({key:$,output:null,decrypt:!0,mode:J})};u$.des.Algorithm=function($,J){var X=this;X.name=$,X.mode=new J({blockSize:8,cipher:{encrypt:function(Q,Y){return H7(X._keys,Q,Y,!1)},decrypt:function(Q,Y){return H7(X._keys,Q,Y,!0)}}}),X._init=!1};u$.des.Algorithm.prototype.initialize=function($){if(this._init)return;var J=u$.util.createBuffer($.key);if(this.name.indexOf("3DES")===0){if(J.length()!==24)throw Error("Invalid Triple-DES key size: "+J.length()*8)}this._keys=VO(J),this._init=!0};$J("DES-ECB",u$.cipher.modes.ecb);$J("DES-CBC",u$.cipher.modes.cbc);$J("DES-CFB",u$.cipher.modes.cfb);$J("DES-OFB",u$.cipher.modes.ofb);$J("DES-CTR",u$.cipher.modes.ctr);$J("3DES-ECB",u$.cipher.modes.ecb);$J("3DES-CBC",u$.cipher.modes.cbc);$J("3DES-CFB",u$.cipher.modes.cfb);$J("3DES-OFB",u$.cipher.modes.ofb);$J("3DES-CTR",u$.cipher.modes.ctr);function $J($,J){var X=function(){return new u$.des.Algorithm($,J)};u$.cipher.registerAlgorithm($,X)}var XO=[16843776,0,65536,16843780,16842756,66564,4,65536,1024,16843776,16843780,1024,16778244,16842756,16777216,4,1028,16778240,16778240,66560,66560,16842752,16842752,16778244,65540,16777220,16777220,65540,0,1028,66564,16777216,65536,16843780,4,16842752,16843776,16777216,16777216,1024,16842756,65536,66560,16777220,1024,4,16778244,66564,16843780,65540,16842752,16778244,16777220,1028,66564,16843776,1028,16778240,16778240,0,65540,66560,0,16842756],YO=[-2146402272,-2147450880,32768,1081376,1048576,32,-2146435040,-2147450848,-2147483616,-2146402272,-2146402304,-2147483648,-2147450880,1048576,32,-2146435040,1081344,1048608,-2147450848,0,-2147483648,32768,1081376,-2146435072,1048608,-2147483616,0,1081344,32800,-2146402304,-2146435072,32800,0,1081376,-2146435040,1048576,-2147450848,-2146435072,-2146402304,32768,-2146435072,-2147450880,32,-2146402272,1081376,32,32768,-2147483648,32800,-2146402304,1048576,-2147483616,1048608,-2147450848,-2147483616,1048608,1081344,0,-2147450880,32800,-2147483648,-2146435040,-2146402272,1081344],GO=[520,134349312,0,134348808,134218240,0,131592,134218240,131080,134217736,134217736,131072,134349320,131080,134348800,520,134217728,8,134349312,512,131584,134348800,134348808,131592,134218248,131584,131072,134218248,8,134349320,512,134217728,134349312,134217728,131080,520,131072,134349312,134218240,0,512,131080,134349320,134218240,134217736,512,0,134348808,134218248,131072,134217728,134349320,8,131592,131584,134217736,134348800,134218248,520,134348800,131592,8,134348808,131584],WO=[8396801,8321,8321,128,8396928,8388737,8388609,8193,0,8396800,8396800,8396929,129,0,8388736,8388609,1,8192,8388608,8396801,128,8388608,8193,8320,8388737,1,8320,8388736,8192,8396928,8396929,129,8388736,8388609,8396800,8396929,129,0,0,8396800,8320,8388736,8388737,1,8396801,8321,8321,128,8396929,129,1,8192,8388609,8193,8396928,8388737,8193,8320,8388608,8396801,128,8388608,8192,8396928],OO=[256,34078976,34078720,1107296512,524288,256,1073741824,34078720,1074266368,524288,33554688,1074266368,1107296512,1107820544,524544,1073741824,33554432,1074266112,1074266112,0,1073742080,1107820800,1107820800,33554688,1107820544,1073742080,0,1107296256,34078976,33554432,1107296256,524544,524288,1107296512,256,33554432,1073741824,34078720,1107296512,1074266368,33554688,1073741824,1107820544,34078976,1074266368,256,33554432,1107820544,1107820800,524544,1107296256,1107820800,34078720,0,1074266112,1107296256,524544,33554688,1073742080,524288,0,1074266112,34078976,1073742080],MO=[536870928,541065216,16384,541081616,541065216,16,541081616,4194304,536887296,4210704,4194304,536870928,4194320,536887296,536870912,16400,0,4194320,536887312,16384,4210688,536887312,16,541065232,541065232,0,4210704,541081600,16400,4210688,541081600,536870912,536887296,16,541065232,4210688,541081616,4194304,16400,536870928,4194304,536887296,536870912,16400,536870928,541081616,4210688,541065216,4210704,541081600,0,541065232,16,16384,541065216,4210704,16384,4194320,536887312,0,541081600,536870912,4194320,536887312],UO=[2097152,69206018,67110914,0,2048,67110914,2099202,69208064,69208066,2097152,0,67108866,2,67108864,69206018,2050,67110912,2099202,2097154,67110912,67108866,69206016,69208064,2097154,69206016,2048,2050,69208066,2099200,2,67108864,2099200,67108864,2099200,2097152,67110914,67110914,69206018,69206018,2,2097154,67108864,67110912,2097152,69208064,2050,2099202,69208064,2050,67108866,69208066,69206016,2099200,0,2,69208066,0,2099202,69206016,2048,67108866,67110912,2048,2097154],HO=[268439616,4096,262144,268701760,268435456,268439616,64,268435456,262208,268697600,268701760,266240,268701696,266304,4096,64,268697600,268435520,268439552,4160,266240,262208,268697664,268701696,4160,0,0,268697664,268435520,268439552,266304,262144,266304,262144,268701696,4096,64,268697664,4096,266304,268439552,64,268435520,268697600,268697664,268435456,262144,268439616,0,268701760,262208,268435520,268697600,268439552,268439616,0,268701760,266240,266240,4160,4160,262208,268435456,268701696];function VO($){var J=[0,4,536870912,536870916,65536,65540,536936448,536936452,512,516,536871424,536871428,66048,66052,536936960,536936964],X=[0,1,1048576,1048577,67108864,67108865,68157440,68157441,256,257,1048832,1048833,67109120,67109121,68157696,68157697],Q=[0,8,2048,2056,16777216,16777224,16779264,16779272,0,8,2048,2056,16777216,16777224,16779264,16779272],Y=[0,2097152,134217728,136314880,8192,2105344,134225920,136323072,131072,2228224,134348800,136445952,139264,2236416,134356992,136454144],G=[0,262144,16,262160,0,262144,16,262160,4096,266240,4112,266256,4096,266240,4112,266256],W=[0,1024,32,1056,0,1024,32,1056,33554432,33555456,33554464,33555488,33554432,33555456,33554464,33555488],O=[0,268435456,524288,268959744,2,268435458,524290,268959746,0,268435456,524288,268959744,2,268435458,524290,268959746],M=[0,65536,2048,67584,536870912,536936448,536872960,536938496,131072,196608,133120,198656,537001984,537067520,537004032,537069568],U=[0,262144,0,262144,2,262146,2,262146,33554432,33816576,33554432,33816576,33554434,33816578,33554434,33816578],H=[0,268435456,8,268435464,0,268435456,8,268435464,1024,268436480,1032,268436488,1024,268436480,1032,268436488],V=[0,32,0,32,1048576,1048608,1048576,1048608,8192,8224,8192,8224,1056768,1056800,1056768,1056800],q=[0,16777216,512,16777728,2097152,18874368,2097664,18874880,67108864,83886080,67109376,83886592,69206016,85983232,69206528,85983744],z=[0,4096,134217728,134221824,524288,528384,134742016,134746112,16,4112,134217744,134221840,524304,528400,134742032,134746128],K=[0,4,256,260,0,4,256,260,1,5,257,261,1,5,257,261],L=$.length()>8?3:1,A=[],D=[0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0],j=0,S;for(var P=0;P<L;P++){var C=$.getInt32(),w=$.getInt32();S=(C>>>4^w)&252645135,w^=S,C^=S<<4,S=(w>>>-16^C)&65535,C^=S,w^=S<<-16,S=(C>>>2^w)&858993459,w^=S,C^=S<<2,S=(w>>>-16^C)&65535,C^=S,w^=S<<-16,S=(C>>>1^w)&1431655765,w^=S,C^=S<<1,S=(w>>>8^C)&16711935,C^=S,w^=S<<8,S=(C>>>1^w)&1431655765,w^=S,C^=S<<1,S=C<<8|w>>>20&240,C=w<<24|w<<8&16711680|w>>>8&65280|w>>>24&240,w=S;for(var b=0;b<D.length;++b){if(D[b])C=C<<2|C>>>26,w=w<<2|w>>>26;else C=C<<1|C>>>27,w=w<<1|w>>>27;C&=-15,w&=-15;var t=J[C>>>28]|X[C>>>24&15]|Q[C>>>20&15]|Y[C>>>16&15]|G[C>>>12&15]|W[C>>>8&15]|O[C>>>4&15],r=M[w>>>28]|U[w>>>24&15]|H[w>>>20&15]|V[w>>>16&15]|q[w>>>12&15]|z[w>>>8&15]|K[w>>>4&15];S=(r>>>16^t)&65535,A[j++]=t^S,A[j++]=r^S<<16}}return A}function H7($,J,X,Q){var Y=$.length===32?3:9,G;if(Y===3)G=Q?[30,-2,-2]:[0,32,2];else G=Q?[94,62,-2,32,64,2,30,-2,-2]:[0,32,2,62,30,-2,64,96,2];var W,O=J[0],M=J[1];W=(O>>>4^M)&252645135,M^=W,O^=W<<4,W=(O>>>16^M)&65535,M^=W,O^=W<<16,W=(M>>>2^O)&858993459,O^=W,M^=W<<2,W=(M>>>8^O)&16711935,O^=W,M^=W<<8,W=(O>>>1^M)&1431655765,M^=W,O^=W<<1,O=O<<1|O>>>31,M=M<<1|M>>>31;for(var U=0;U<Y;U+=3){var H=G[U+1],V=G[U+2];for(var q=G[U];q!=H;q+=V){var z=M^$[q],K=(M>>>4|M<<28)^$[q+1];W=O,O=M,M=W^(YO[z>>>24&63]|WO[z>>>16&63]|MO[z>>>8&63]|HO[z&63]|XO[K>>>24&63]|GO[K>>>16&63]|OO[K>>>8&63]|UO[K&63])}W=O,O=M,M=W}O=O>>>1|O<<31,M=M>>>1|M<<31,W=(O>>>1^M)&1431655765,M^=W,O^=W<<1,W=(M>>>8^O)&16711935,O^=W,M^=W<<8,W=(M>>>2^O)&858993459,O^=W,M^=W<<2,W=(O>>>16^M)&65535,M^=W,O^=W<<16,W=(O>>>4^M)&252645135,M^=W,O^=W<<4,X[0]=O,X[1]=M}function UY($){$=$||{};var J=($.mode||"CBC").toUpperCase(),X="DES-"+J,Q;if($.decrypt)Q=u$.cipher.createDecipher(X,$.key);else Q=u$.cipher.createCipher(X,$.key);var Y=Q.start;return Q.start=function(G,W){var O=null;if(W instanceof u$.util.ByteBuffer)O=W,W={};W=W||{},W.output=O,W.iv=G,Y.call(Q,W)},Q}});var HY=H$((LE,q7)=>{var A0=K$();DQ();t0();w$();var qO=A0.pkcs5=A0.pkcs5||{},EJ;if(A0.util.isNodejs&&!A0.options.usePureJavaScript)EJ=L9("crypto");q7.exports=A0.pbkdf2=qO.pbkdf2=function($,J,X,Q,Y,G){if(typeof Y==="function")G=Y,Y=null;if(A0.util.isNodejs&&!A0.options.usePureJavaScript&&EJ.pbkdf2&&(Y===null||typeof Y!=="object")&&(EJ.pbkdf2Sync.length>4||(!Y||Y==="sha1"))){if(typeof Y!=="string")Y="sha1";if($=Buffer.from($,"binary"),J=Buffer.from(J,"binary"),!G){if(EJ.pbkdf2Sync.length===4)return EJ.pbkdf2Sync($,J,X,Q).toString("binary");return EJ.pbkdf2Sync($,J,X,Q,Y).toString("binary")}if(EJ.pbkdf2Sync.length===4)return EJ.pbkdf2($,J,X,Q,function(S,P){if(S)return G(S);G(null,P.toString("binary"))});return EJ.pbkdf2($,J,X,Q,Y,function(S,P){if(S)return G(S);G(null,P.toString("binary"))})}if(typeof Y>"u"||Y===null)Y="sha1";if(typeof Y==="string"){if(!(Y in A0.md.algorithms))throw Error("Unknown hash algorithm: "+Y);Y=A0.md[Y].create()}var W=Y.digestLength;if(Q>4294967295*W){var O=Error("Derived key is too long.");if(G)return G(O);throw O}var M=Math.ceil(Q/W),U=Q-(M-1)*W,H=A0.hmac.create();H.start(Y,$);var V="",q,z,K;if(!G){for(var L=1;L<=M;++L){H.start(null,null),H.update(J),H.update(A0.util.int32ToBytes(L)),q=K=H.digest().getBytes();for(var A=2;A<=X;++A)H.start(null,null),H.update(K),z=H.digest().getBytes(),q=A0.util.xorBytes(q,z,W),K=z;V+=L<M?q:q.substr(0,U)}return V}var L=1,A;function D(){if(L>M)return G(null,V);H.start(null,null),H.update(J),H.update(A0.util.int32ToBytes(L)),q=K=H.digest().getBytes(),A=2,j()}function j(){if(A<=X)return H.start(null,null),H.update(K),z=H.digest().getBytes(),q=A0.util.xorBytes(q,z,W),K=z,++A,A0.util.setImmediate(j);V+=L<M?q:q.substr(0,U),++L,D()}D()}});var f9=H$((DE,N7)=>{var JJ=K$();t0();w$();var E7=N7.exports=JJ.sha256=JJ.sha256||{};JJ.md.sha256=JJ.md.algorithms.sha256=E7;E7.create=function(){if(!z7)KO();var $=null,J=JJ.util.createBuffer(),X=Array(64),Q={algorithm:"sha256",blockLength:64,digestLength:32,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=JJ.util.createBuffer(),$={h0:1779033703,h1:3144134277,h2:1013904242,h3:2773480762,h4:1359893119,h5:2600822924,h6:528734635,h7:1541459225},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=JJ.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var O=Q.fullMessageLength.length-1;O>=0;--O)Q.fullMessageLength[O]+=W[1],W[1]=W[0]+(Q.fullMessageLength[O]/4294967296>>>0),Q.fullMessageLength[O]=Q.fullMessageLength[O]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),K7($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=JJ.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(k9.substr(0,Q.blockLength-W));var O,M,U=Q.fullMessageLength[0]*8;for(var H=0;H<Q.fullMessageLength.length-1;++H)O=Q.fullMessageLength[H+1]*8,M=O/4294967296>>>0,U+=M,Y.putInt32(U>>>0),U=O>>>0;Y.putInt32(U);var V={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4,h5:$.h5,h6:$.h6,h7:$.h7};K7(V,X,Y);var q=JJ.util.createBuffer();return q.putInt32(V.h0),q.putInt32(V.h1),q.putInt32(V.h2),q.putInt32(V.h3),q.putInt32(V.h4),q.putInt32(V.h5),q.putInt32(V.h6),q.putInt32(V.h7),q},Q};var k9=null,z7=!1,F7=null;function KO(){k9=String.fromCharCode(128),k9+=JJ.util.fillString(String.fromCharCode(0),64),F7=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],z7=!0}function K7($,J,X){var Q,Y,G,W,O,M,U,H,V,q,z,K,L,A,D,j=X.length();while(j>=64){for(U=0;U<16;++U)J[U]=X.getInt32();for(;U<64;++U)Q=J[U-2],Q=(Q>>>17|Q<<15)^(Q>>>19|Q<<13)^Q>>>10,Y=J[U-15],Y=(Y>>>7|Y<<25)^(Y>>>18|Y<<14)^Y>>>3,J[U]=Q+J[U-7]+Y+J[U-16]|0;H=$.h0,V=$.h1,q=$.h2,z=$.h3,K=$.h4,L=$.h5,A=$.h6,D=$.h7;for(U=0;U<64;++U)W=(K>>>6|K<<26)^(K>>>11|K<<21)^(K>>>25|K<<7),O=A^K&(L^A),G=(H>>>2|H<<30)^(H>>>13|H<<19)^(H>>>22|H<<10),M=H&V|q&(H^V),Q=D+W+O+F7[U]+J[U],Y=G+M,D=A,A=L,L=K,K=z+Q>>>0,z=q,q=V,V=H,H=Q+Y>>>0;$.h0=$.h0+H|0,$.h1=$.h1+V|0,$.h2=$.h2+q|0,$.h3=$.h3+z|0,$.h4=$.h4+K|0,$.h5=$.h5+L|0,$.h6=$.h6+A|0,$.h7=$.h7+D|0,j-=64}}});var y9=H$((RE,A7)=>{var QJ=K$();w$();var VY=null;if(QJ.util.isNodejs&&!QJ.options.usePureJavaScript&&!process.versions["node-webkit"])VY=L9("crypto");var EO=A7.exports=QJ.prng=QJ.prng||{};EO.create=function($){var J={plugin:$,key:null,seed:null,time:null,reseeds:0,generated:0,keyBytes:""},X=$.md,Q=Array(32);for(var Y=0;Y<32;++Y)Q[Y]=X.create();J.pools=Q,J.pool=0,J.generate=function(U,H){if(!H)return J.generateSync(U);var V=J.plugin.cipher,q=J.plugin.increment,z=J.plugin.formatKey,K=J.plugin.formatSeed,L=QJ.util.createBuffer();J.key=null,A();function A(D){if(D)return H(D);if(L.length()>=U)return H(null,L.getBytes(U));if(J.generated>1048575)J.key=null;if(J.key===null)return QJ.util.nextTick(function(){G(A)});var j=V(J.key,J.seed);J.generated+=j.length,L.putBytes(j),J.key=z(V(J.key,q(J.seed))),J.seed=K(V(J.key,J.seed)),QJ.util.setImmediate(A)}},J.generateSync=function(U){var H=J.plugin.cipher,V=J.plugin.increment,q=J.plugin.formatKey,z=J.plugin.formatSeed;J.key=null;var K=QJ.util.createBuffer();while(K.length()<U){if(J.generated>1048575)J.key=null;if(J.key===null)W();var L=H(J.key,J.seed);J.generated+=L.length,K.putBytes(L),J.key=q(H(J.key,V(J.seed))),J.seed=z(H(J.key,J.seed))}return K.getBytes(U)};function G(U){if(J.pools[0].messageLength>=32)return O(),U();var H=32-J.pools[0].messageLength<<5;J.seedFile(H,function(V,q){if(V)return U(V);J.collect(q),O(),U()})}function W(){if(J.pools[0].messageLength>=32)return O();var U=32-J.pools[0].messageLength<<5;J.collect(J.seedFileSync(U)),O()}function O(){J.reseeds=J.reseeds===4294967295?0:J.reseeds+1;var U=J.plugin.md.create();U.update(J.keyBytes);var H=1;for(var V=0;V<32;++V){if(J.reseeds%H===0)U.update(J.pools[V].digest().getBytes()),J.pools[V].start();H=H<<1}J.keyBytes=U.digest().getBytes(),U.start(),U.update(J.keyBytes);var q=U.digest().getBytes();J.key=J.plugin.formatKey(J.keyBytes),J.seed=J.plugin.formatSeed(q),J.generated=0}function M(U){var H=null,V=QJ.util.globalScope,q=V.crypto||V.msCrypto;if(q&&q.getRandomValues)H=function(C){return q.getRandomValues(C)};var z=QJ.util.createBuffer();if(H)while(z.length()<U){var K=Math.max(1,Math.min(U-z.length(),65536)/4),L=new Uint32Array(Math.floor(K));try{H(L);for(var A=0;A<L.length;++A)z.putInt32(L[A])}catch(C){if(!(typeof QuotaExceededError<"u"&&C instanceof QuotaExceededError))throw C}}if(z.length()<U){var D,j,S,P=Math.floor(Math.random()*65536);while(z.length()<U){j=16807*(P&65535),D=16807*(P>>16),j+=(D&32767)<<16,j+=D>>15,j=(j&2147483647)+(j>>31),P=j&4294967295;for(var A=0;A<3;++A)S=P>>>(A<<3),S^=Math.floor(Math.random()*256),z.putByte(S&255)}}return z.getBytes(U)}if(VY)J.seedFile=function(U,H){VY.randomBytes(U,function(V,q){if(V)return H(V);H(null,q.toString())})},J.seedFileSync=function(U){return VY.randomBytes(U).toString()};else J.seedFile=function(U,H){try{H(null,M(U))}catch(V){H(V)}},J.seedFileSync=M;return J.collect=function(U){var H=U.length;for(var V=0;V<H;++V)J.pools[J.pool].update(U.substr(V,1)),J.pool=J.pool===31?0:J.pool+1},J.collectInt=function(U,H){var V="";for(var q=0;q<H;q+=8)V+=String.fromCharCode(U>>q&255);J.collect(V)},J.registerWorker=function(U){if(U===self)J.seedFile=function(V,q){function z(K){var L=K.data;if(L.forge&&L.forge.prng)self.removeEventListener("message",z),q(L.forge.prng.err,L.forge.prng.bytes)}self.addEventListener("message",z),self.postMessage({forge:{prng:{needed:V}}})};else{var H=function(V){var q=V.data;if(q.forge&&q.forge.prng)J.seedFile(q.forge.prng.needed,function(z,K){U.postMessage({forge:{prng:{err:z,bytes:K}}})})};U.addEventListener("message",H)}},J}});var P0=H$((ZE,h9)=>{var J0=K$();SJ();f9();y9();w$();(function(){if(J0.random&&J0.random.getBytes){h9.exports=J0.random;return}(function($){var J={},X=[,,,,],Q=J0.util.createBuffer();J.formatKey=function(V){var q=J0.util.createBuffer(V);return V=[,,,,],V[0]=q.getInt32(),V[1]=q.getInt32(),V[2]=q.getInt32(),V[3]=q.getInt32(),J0.aes._expandKey(V,!1)},J.formatSeed=function(V){var q=J0.util.createBuffer(V);return V=[,,,,],V[0]=q.getInt32(),V[1]=q.getInt32(),V[2]=q.getInt32(),V[3]=q.getInt32(),V},J.cipher=function(V,q){return J0.aes._updateBlock(V,q,X,!1),Q.putInt32(X[0]),Q.putInt32(X[1]),Q.putInt32(X[2]),Q.putInt32(X[3]),Q.getBytes()},J.increment=function(V){return++V[3],V},J.md=J0.md.sha256;function Y(){var V=J0.prng.create(J);return V.getBytes=function(q,z){return V.generate(q,z)},V.getBytesSync=function(q){return V.generate(q)},V}var G=Y(),W=null,O=J0.util.globalScope,M=O.crypto||O.msCrypto;if(M&&M.getRandomValues)W=function(V){return M.getRandomValues(V)};if(J0.options.usePureJavaScript||!J0.util.isNodejs&&!W){if(typeof window>"u"||window.document===void 0);if(G.collectInt(+new Date,32),typeof navigator<"u"){var U="";for(var H in navigator)try{if(typeof navigator[H]=="string")U+=navigator[H]}catch(V){}G.collect(U),U=null}if($)$().mousemove(function(V){G.collectInt(V.clientX,16),G.collectInt(V.clientY,16)}),$().keypress(function(V){G.collectInt(V.charCode,8)})}if(!J0.random)J0.random=G;else for(var H in G)J0.random[H]=G[H];J0.random.createInstance=Y,h9.exports=J0.random})(typeof jQuery<"u"?jQuery:null)})()});var u9=H$((BE,R7)=>{var R0=K$();w$();var b9=[217,120,249,196,25,221,181,237,40,233,253,121,74,160,216,157,198,126,55,131,43,118,83,142,98,76,100,136,68,139,251,162,23,154,89,245,135,179,79,19,97,69,109,141,9,129,125,50,189,143,64,235,134,183,123,11,240,149,33,34,92,107,78,130,84,214,101,147,206,96,178,28,115,86,192,20,167,140,241,220,18,117,202,31,59,190,228,209,66,61,212,48,163,60,182,38,111,191,14,218,70,105,7,87,39,242,29,155,188,148,67,3,248,17,199,246,144,239,62,231,6,195,213,47,200,102,30,215,8,232,234,222,128,82,238,247,132,170,114,172,53,77,106,42,150,26,210,113,90,21,73,116,75,159,208,94,4,24,164,236,194,224,65,110,15,81,203,204,36,145,175,80,161,244,112,57,153,124,58,133,35,184,180,122,252,2,54,91,37,85,151,49,45,93,250,152,227,138,146,174,5,223,41,16,103,108,186,201,211,0,230,207,225,158,168,44,99,22,1,63,88,226,137,169,13,56,52,27,171,51,255,176,187,72,12,95,185,177,205,46,197,243,219,71,229,165,156,119,10,166,32,104,254,127,193,173],L7=[1,2,3,5],zO=function($,J){return $<<J&65535|($&65535)>>16-J},FO=function($,J){return($&65535)>>J|$<<16-J&65535};R7.exports=R0.rc2=R0.rc2||{};R0.rc2.expandKey=function($,J){if(typeof $==="string")$=R0.util.createBuffer($);J=J||128;var X=$,Q=$.length(),Y=J,G=Math.ceil(Y/8),W=255>>(Y&7),O;for(O=Q;O<128;O++)X.putByte(b9[X.at(O-1)+X.at(O-Q)&255]);X.setAt(128-G,b9[X.at(128-G)&W]);for(O=127-G;O>=0;O--)X.setAt(O,b9[X.at(O+1)^X.at(O+G)]);return X};var D7=function($,J,X){var Q=!1,Y=null,G=null,W=null,O,M,U,H,V=[];$=R0.rc2.expandKey($,J);for(U=0;U<64;U++)V.push($.getInt16Le());if(X)O=function(K){for(U=0;U<4;U++)K[U]+=V[H]+(K[(U+3)%4]&K[(U+2)%4])+(~K[(U+3)%4]&K[(U+1)%4]),K[U]=zO(K[U],L7[U]),H++},M=function(K){for(U=0;U<4;U++)K[U]+=V[K[(U+3)%4]&63]};else O=function(K){for(U=3;U>=0;U--)K[U]=FO(K[U],L7[U]),K[U]-=V[H]+(K[(U+3)%4]&K[(U+2)%4])+(~K[(U+3)%4]&K[(U+1)%4]),H--},M=function(K){for(U=3;U>=0;U--)K[U]-=V[K[(U+3)%4]&63]};var q=function(K){var L=[];for(U=0;U<4;U++){var A=Y.getInt16Le();if(W!==null)if(X)A^=W.getInt16Le();else W.putInt16Le(A);L.push(A&65535)}H=X?0:63;for(var D=0;D<K.length;D++)for(var j=0;j<K[D][0];j++)K[D][1](L);for(U=0;U<4;U++){if(W!==null)if(X)W.putInt16Le(L[U]);else L[U]^=W.getInt16Le();G.putInt16Le(L[U])}},z=null;return z={start:function(K,L){if(K){if(typeof K==="string")K=R0.util.createBuffer(K)}Q=!1,Y=R0.util.createBuffer(),G=L||new R0.util.createBuffer,W=K,z.output=G},update:function(K){if(!Q)Y.putBuffer(K);while(Y.length()>=8)q([[5,O],[1,M],[6,O],[1,M],[5,O]])},finish:function(K){var L=!0;if(X)if(K)L=K(8,Y,!X);else{var A=Y.length()===8?8:8-Y.length();Y.fillWithByte(A,A)}if(L)Q=!0,z.update();if(!X){if(L=Y.length()===0,L)if(K)L=K(8,G,!X);else{var D=G.length(),j=G.at(D-1);if(j>D)L=!1;else G.truncate(j)}}return L}},z};R0.rc2.startEncrypting=function($,J,X){var Q=R0.rc2.createEncryptionCipher($,128);return Q.start(J,X),Q};R0.rc2.createEncryptionCipher=function($,J){return D7($,J,!0)};R0.rc2.startDecrypting=function($,J,X){var Q=R0.rc2.createDecryptionCipher($,128);return Q.start(J,X),Q};R0.rc2.createDecryptionCipher=function($,J){return D7($,J,!1)}});var EX=H$((TE,w7)=>{var m9=K$();w7.exports=m9.jsbn=m9.jsbn||{};var zJ,NO=244837814094590,Z7=(NO&16777215)==15715070;function v($,J,X){if(this.data=[],$!=null)if(typeof $=="number")this.fromNumber($,J,X);else if(J==null&&typeof $!="string")this.fromString($,256);else this.fromString($,J)}m9.jsbn.BigInteger=v;function j$(){return new v(null)}function AO($,J,X,Q,Y,G){while(--G>=0){var W=J*this.data[$++]+X.data[Q]+Y;Y=Math.floor(W/67108864),X.data[Q++]=W&67108863}return Y}function LO($,J,X,Q,Y,G){var W=J&32767,O=J>>15;while(--G>=0){var M=this.data[$]&32767,U=this.data[$++]>>15,H=O*M+U*W;M=W*M+((H&32767)<<15)+X.data[Q]+(Y&1073741823),Y=(M>>>30)+(H>>>15)+O*U+(Y>>>30),X.data[Q++]=M&1073741823}return Y}function B7($,J,X,Q,Y,G){var W=J&16383,O=J>>14;while(--G>=0){var M=this.data[$]&16383,U=this.data[$++]>>14,H=O*M+U*W;M=W*M+((H&16383)<<14)+X.data[Q]+Y,Y=(M>>28)+(H>>14)+O*U,X.data[Q++]=M&268435455}return Y}if(typeof navigator>"u")v.prototype.am=B7,zJ=28;else if(Z7&&navigator.appName=="Microsoft Internet Explorer")v.prototype.am=LO,zJ=30;else if(Z7&&navigator.appName!="Netscape")v.prototype.am=AO,zJ=26;else v.prototype.am=B7,zJ=28;v.prototype.DB=zJ;v.prototype.DM=(1<<zJ)-1;v.prototype.DV=1<<zJ;var g9=52;v.prototype.FV=Math.pow(2,g9);v.prototype.F1=g9-zJ;v.prototype.F2=2*zJ-g9;var DO="0123456789abcdefghijklmnopqrstuvwxyz",qY=[],ZQ,_0;ZQ=48;for(_0=0;_0<=9;++_0)qY[ZQ++]=_0;ZQ=97;for(_0=10;_0<36;++_0)qY[ZQ++]=_0;ZQ=65;for(_0=10;_0<36;++_0)qY[ZQ++]=_0;function T7($){return DO.charAt($)}function S7($,J){var X=qY[$.charCodeAt(J)];return X==null?-1:X}function RO($){for(var J=this.t-1;J>=0;--J)$.data[J]=this.data[J];$.t=this.t,$.s=this.s}function ZO($){if(this.t=1,this.s=$<0?-1:0,$>0)this.data[0]=$;else if($<-1)this.data[0]=$+this.DV;else this.t=0}function CJ($){var J=j$();return J.fromInt($),J}function BO($,J){var X;if(J==16)X=4;else if(J==8)X=3;else if(J==256)X=8;else if(J==2)X=1;else if(J==32)X=5;else if(J==4)X=2;else{this.fromRadix($,J);return}this.t=0,this.s=0;var Q=$.length,Y=!1,G=0;while(--Q>=0){var W=X==8?$[Q]&255:S7($,Q);if(W<0){if($.charAt(Q)=="-")Y=!0;continue}if(Y=!1,G==0)this.data[this.t++]=W;else if(G+X>this.DB)this.data[this.t-1]|=(W&(1<<this.DB-G)-1)<<G,this.data[this.t++]=W>>this.DB-G;else this.data[this.t-1]|=W<<G;if(G+=X,G>=this.DB)G-=this.DB}if(X==8&&($[0]&128)!=0){if(this.s=-1,G>0)this.data[this.t-1]|=(1<<this.DB-G)-1<<G}if(this.clamp(),Y)v.ZERO.subTo(this,this)}function TO(){var $=this.s&this.DM;while(this.t>0&&this.data[this.t-1]==$)--this.t}function SO($){if(this.s<0)return"-"+this.negate().toString($);var J;if($==16)J=4;else if($==8)J=3;else if($==2)J=1;else if($==32)J=5;else if($==4)J=2;else return this.toRadix($);var X=(1<<J)-1,Q,Y=!1,G="",W=this.t,O=this.DB-W*this.DB%J;if(W-- >0){if(O<this.DB&&(Q=this.data[W]>>O)>0)Y=!0,G=T7(Q);while(W>=0){if(O<J)Q=(this.data[W]&(1<<O)-1)<<J-O,Q|=this.data[--W]>>(O+=this.DB-J);else if(Q=this.data[W]>>(O-=J)&X,O<=0)O+=this.DB,--W;if(Q>0)Y=!0;if(Y)G+=T7(Q)}}return Y?G:"0"}function jO(){var $=j$();return v.ZERO.subTo(this,$),$}function CO(){return this.s<0?this.negate():this}function IO($){var J=this.s-$.s;if(J!=0)return J;var X=this.t;if(J=X-$.t,J!=0)return this.s<0?-J:J;while(--X>=0)if((J=this.data[X]-$.data[X])!=0)return J;return 0}function KY($){var J=1,X;if((X=$>>>16)!=0)$=X,J+=16;if((X=$>>8)!=0)$=X,J+=8;if((X=$>>4)!=0)$=X,J+=4;if((X=$>>2)!=0)$=X,J+=2;if((X=$>>1)!=0)$=X,J+=1;return J}function wO(){if(this.t<=0)return 0;return this.DB*(this.t-1)+KY(this.data[this.t-1]^this.s&this.DM)}function PO($,J){var X;for(X=this.t-1;X>=0;--X)J.data[X+$]=this.data[X];for(X=$-1;X>=0;--X)J.data[X]=0;J.t=this.t+$,J.s=this.s}function _O($,J){for(var X=$;X<this.t;++X)J.data[X-$]=this.data[X];J.t=Math.max(this.t-$,0),J.s=this.s}function xO($,J){var X=$%this.DB,Q=this.DB-X,Y=(1<<Q)-1,G=Math.floor($/this.DB),W=this.s<<X&this.DM,O;for(O=this.t-1;O>=0;--O)J.data[O+G+1]=this.data[O]>>Q|W,W=(this.data[O]&Y)<<X;for(O=G-1;O>=0;--O)J.data[O]=0;J.data[G]=W,J.t=this.t+G+1,J.s=this.s,J.clamp()}function vO($,J){J.s=this.s;var X=Math.floor($/this.DB);if(X>=this.t){J.t=0;return}var Q=$%this.DB,Y=this.DB-Q,G=(1<<Q)-1;J.data[0]=this.data[X]>>Q;for(var W=X+1;W<this.t;++W)J.data[W-X-1]|=(this.data[W]&G)<<Y,J.data[W-X]=this.data[W]>>Q;if(Q>0)J.data[this.t-X-1]|=(this.s&G)<<Y;J.t=this.t-X,J.clamp()}function kO($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]-$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q-=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q-=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q-=$.s}if(J.s=Q<0?-1:0,Q<-1)J.data[X++]=this.DV+Q;else if(Q>0)J.data[X++]=Q;J.t=X,J.clamp()}function fO($,J){var X=this.abs(),Q=$.abs(),Y=X.t;J.t=Y+Q.t;while(--Y>=0)J.data[Y]=0;for(Y=0;Y<Q.t;++Y)J.data[Y+X.t]=X.am(0,Q.data[Y],J,Y,0,X.t);if(J.s=0,J.clamp(),this.s!=$.s)v.ZERO.subTo(J,J)}function yO($){var J=this.abs(),X=$.t=2*J.t;while(--X>=0)$.data[X]=0;for(X=0;X<J.t-1;++X){var Q=J.am(X,J.data[X],$,2*X,0,1);if(($.data[X+J.t]+=J.am(X+1,2*J.data[X],$,2*X+1,Q,J.t-X-1))>=J.DV)$.data[X+J.t]-=J.DV,$.data[X+J.t+1]=1}if($.t>0)$.data[$.t-1]+=J.am(X,J.data[X],$,2*X,0,1);$.s=0,$.clamp()}function hO($,J,X){var Q=$.abs();if(Q.t<=0)return;var Y=this.abs();if(Y.t<Q.t){if(J!=null)J.fromInt(0);if(X!=null)this.copyTo(X);return}if(X==null)X=j$();var G=j$(),W=this.s,O=$.s,M=this.DB-KY(Q.data[Q.t-1]);if(M>0)Q.lShiftTo(M,G),Y.lShiftTo(M,X);else Q.copyTo(G),Y.copyTo(X);var U=G.t,H=G.data[U-1];if(H==0)return;var V=H*(1<<this.F1)+(U>1?G.data[U-2]>>this.F2:0),q=this.FV/V,z=(1<<this.F1)/V,K=1<<this.F2,L=X.t,A=L-U,D=J==null?j$():J;if(G.dlShiftTo(A,D),X.compareTo(D)>=0)X.data[X.t++]=1,X.subTo(D,X);v.ONE.dlShiftTo(U,D),D.subTo(G,G);while(G.t<U)G.data[G.t++]=0;while(--A>=0){var j=X.data[--L]==H?this.DM:Math.floor(X.data[L]*q+(X.data[L-1]+K)*z);if((X.data[L]+=G.am(0,j,X,A,0,U))<j){G.dlShiftTo(A,D),X.subTo(D,X);while(X.data[L]<--j)X.subTo(D,X)}}if(J!=null){if(X.drShiftTo(U,J),W!=O)v.ZERO.subTo(J,J)}if(X.t=U,X.clamp(),M>0)X.rShiftTo(M,X);if(W<0)v.ZERO.subTo(X,X)}function bO($){var J=j$();if(this.abs().divRemTo($,null,J),this.s<0&&J.compareTo(v.ZERO)>0)$.subTo(J,J);return J}function tJ($){this.m=$}function uO($){if($.s<0||$.compareTo(this.m)>=0)return $.mod(this.m);else return $}function mO($){return $}function gO($){$.divRemTo(this.m,null,$)}function lO($,J,X){$.multiplyTo(J,X),this.reduce(X)}function dO($,J){$.squareTo(J),this.reduce(J)}tJ.prototype.convert=uO;tJ.prototype.revert=mO;tJ.prototype.reduce=gO;tJ.prototype.mulTo=lO;tJ.prototype.sqrTo=dO;function pO(){if(this.t<1)return 0;var $=this.data[0];if(($&1)==0)return 0;var J=$&3;return J=J*(2-($&15)*J)&15,J=J*(2-($&255)*J)&255,J=J*(2-(($&65535)*J&65535))&65535,J=J*(2-$*J%this.DV)%this.DV,J>0?this.DV-J:-J}function eJ($){this.m=$,this.mp=$.invDigit(),this.mpl=this.mp&32767,this.mph=this.mp>>15,this.um=(1<<$.DB-15)-1,this.mt2=2*$.t}function cO($){var J=j$();if($.abs().dlShiftTo(this.m.t,J),J.divRemTo(this.m,null,J),$.s<0&&J.compareTo(v.ZERO)>0)this.m.subTo(J,J);return J}function nO($){var J=j$();return $.copyTo(J),this.reduce(J),J}function iO($){while($.t<=this.mt2)$.data[$.t++]=0;for(var J=0;J<this.m.t;++J){var X=$.data[J]&32767,Q=X*this.mpl+((X*this.mph+($.data[J]>>15)*this.mpl&this.um)<<15)&$.DM;X=J+this.m.t,$.data[X]+=this.m.am(0,Q,$,J,0,this.m.t);while($.data[X]>=$.DV)$.data[X]-=$.DV,$.data[++X]++}if($.clamp(),$.drShiftTo(this.m.t,$),$.compareTo(this.m)>=0)$.subTo(this.m,$)}function oO($,J){$.squareTo(J),this.reduce(J)}function aO($,J,X){$.multiplyTo(J,X),this.reduce(X)}eJ.prototype.convert=cO;eJ.prototype.revert=nO;eJ.prototype.reduce=iO;eJ.prototype.mulTo=aO;eJ.prototype.sqrTo=oO;function rO(){return(this.t>0?this.data[0]&1:this.s)==0}function sO($,J){if($>4294967295||$<1)return v.ONE;var X=j$(),Q=j$(),Y=J.convert(this),G=KY($)-1;Y.copyTo(X);while(--G>=0)if(J.sqrTo(X,Q),($&1<<G)>0)J.mulTo(Q,Y,X);else{var W=X;X=Q,Q=W}return J.revert(X)}function tO($,J){var X;if($<256||J.isEven())X=new tJ(J);else X=new eJ(J);return this.exp($,X)}v.prototype.copyTo=RO;v.prototype.fromInt=ZO;v.prototype.fromString=BO;v.prototype.clamp=TO;v.prototype.dlShiftTo=PO;v.prototype.drShiftTo=_O;v.prototype.lShiftTo=xO;v.prototype.rShiftTo=vO;v.prototype.subTo=kO;v.prototype.multiplyTo=fO;v.prototype.squareTo=yO;v.prototype.divRemTo=hO;v.prototype.invDigit=pO;v.prototype.isEven=rO;v.prototype.exp=sO;v.prototype.toString=SO;v.prototype.negate=jO;v.prototype.abs=CO;v.prototype.compareTo=IO;v.prototype.bitLength=wO;v.prototype.mod=bO;v.prototype.modPowInt=tO;v.ZERO=CJ(0);v.ONE=CJ(1);function eO(){var $=j$();return this.copyTo($),$}function $M(){if(this.s<0){if(this.t==1)return this.data[0]-this.DV;else if(this.t==0)return-1}else if(this.t==1)return this.data[0];else if(this.t==0)return 0;return(this.data[1]&(1<<32-this.DB)-1)<<this.DB|this.data[0]}function JM(){return this.t==0?this.s:this.data[0]<<24>>24}function QM(){return this.t==0?this.s:this.data[0]<<16>>16}function XM($){return Math.floor(Math.LN2*this.DB/Math.log($))}function YM(){if(this.s<0)return-1;else if(this.t<=0||this.t==1&&this.data[0]<=0)return 0;else return 1}function GM($){if($==null)$=10;if(this.signum()==0||$<2||$>36)return"0";var J=this.chunkSize($),X=Math.pow($,J),Q=CJ(X),Y=j$(),G=j$(),W="";this.divRemTo(Q,Y,G);while(Y.signum()>0)W=(X+G.intValue()).toString($).substr(1)+W,Y.divRemTo(Q,Y,G);return G.intValue().toString($)+W}function WM($,J){if(this.fromInt(0),J==null)J=10;var X=this.chunkSize(J),Q=Math.pow(J,X),Y=!1,G=0,W=0;for(var O=0;O<$.length;++O){var M=S7($,O);if(M<0){if($.charAt(O)=="-"&&this.signum()==0)Y=!0;continue}if(W=J*W+M,++G>=X)this.dMultiply(Q),this.dAddOffset(W,0),G=0,W=0}if(G>0)this.dMultiply(Math.pow(J,G)),this.dAddOffset(W,0);if(Y)v.ZERO.subTo(this,this)}function OM($,J,X){if(typeof J=="number")if($<2)this.fromInt(1);else{if(this.fromNumber($,X),!this.testBit($-1))this.bitwiseTo(v.ONE.shiftLeft($-1),l9,this);if(this.isEven())this.dAddOffset(1,0);while(!this.isProbablePrime(J))if(this.dAddOffset(2,0),this.bitLength()>$)this.subTo(v.ONE.shiftLeft($-1),this)}else{var Q=[],Y=$&7;if(Q.length=($>>3)+1,J.nextBytes(Q),Y>0)Q[0]&=(1<<Y)-1;else Q[0]=0;this.fromString(Q,256)}}function MM(){var $=this.t,J=[];J[0]=this.s;var X=this.DB-$*this.DB%8,Q,Y=0;if($-- >0){if(X<this.DB&&(Q=this.data[$]>>X)!=(this.s&this.DM)>>X)J[Y++]=Q|this.s<<this.DB-X;while($>=0){if(X<8)Q=(this.data[$]&(1<<X)-1)<<8-X,Q|=this.data[--$]>>(X+=this.DB-8);else if(Q=this.data[$]>>(X-=8)&255,X<=0)X+=this.DB,--$;if((Q&128)!=0)Q|=-256;if(Y==0&&(this.s&128)!=(Q&128))++Y;if(Y>0||Q!=this.s)J[Y++]=Q}}return J}function UM($){return this.compareTo($)==0}function HM($){return this.compareTo($)<0?this:$}function VM($){return this.compareTo($)>0?this:$}function qM($,J,X){var Q,Y,G=Math.min($.t,this.t);for(Q=0;Q<G;++Q)X.data[Q]=J(this.data[Q],$.data[Q]);if($.t<this.t){Y=$.s&this.DM;for(Q=G;Q<this.t;++Q)X.data[Q]=J(this.data[Q],Y);X.t=this.t}else{Y=this.s&this.DM;for(Q=G;Q<$.t;++Q)X.data[Q]=J(Y,$.data[Q]);X.t=$.t}X.s=J(this.s,$.s),X.clamp()}function KM($,J){return $&J}function EM($){var J=j$();return this.bitwiseTo($,KM,J),J}function l9($,J){return $|J}function zM($){var J=j$();return this.bitwiseTo($,l9,J),J}function j7($,J){return $^J}function FM($){var J=j$();return this.bitwiseTo($,j7,J),J}function C7($,J){return $&~J}function NM($){var J=j$();return this.bitwiseTo($,C7,J),J}function AM(){var $=j$();for(var J=0;J<this.t;++J)$.data[J]=this.DM&~this.data[J];return $.t=this.t,$.s=~this.s,$}function LM($){var J=j$();if($<0)this.rShiftTo(-$,J);else this.lShiftTo($,J);return J}function DM($){var J=j$();if($<0)this.lShiftTo(-$,J);else this.rShiftTo($,J);return J}function RM($){if($==0)return-1;var J=0;if(($&65535)==0)$>>=16,J+=16;if(($&255)==0)$>>=8,J+=8;if(($&15)==0)$>>=4,J+=4;if(($&3)==0)$>>=2,J+=2;if(($&1)==0)++J;return J}function ZM(){for(var $=0;$<this.t;++$)if(this.data[$]!=0)return $*this.DB+RM(this.data[$]);if(this.s<0)return this.t*this.DB;return-1}function BM($){var J=0;while($!=0)$&=$-1,++J;return J}function TM(){var $=0,J=this.s&this.DM;for(var X=0;X<this.t;++X)$+=BM(this.data[X]^J);return $}function SM($){var J=Math.floor($/this.DB);if(J>=this.t)return this.s!=0;return(this.data[J]&1<<$%this.DB)!=0}function jM($,J){var X=v.ONE.shiftLeft($);return this.bitwiseTo(X,J,X),X}function CM($){return this.changeBit($,l9)}function IM($){return this.changeBit($,C7)}function wM($){return this.changeBit($,j7)}function PM($,J){var X=0,Q=0,Y=Math.min($.t,this.t);while(X<Y)Q+=this.data[X]+$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;if($.t<this.t){Q+=$.s;while(X<this.t)Q+=this.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=this.s}else{Q+=this.s;while(X<$.t)Q+=$.data[X],J.data[X++]=Q&this.DM,Q>>=this.DB;Q+=$.s}if(J.s=Q<0?-1:0,Q>0)J.data[X++]=Q;else if(Q<-1)J.data[X++]=this.DV+Q;J.t=X,J.clamp()}function _M($){var J=j$();return this.addTo($,J),J}function xM($){var J=j$();return this.subTo($,J),J}function vM($){var J=j$();return this.multiplyTo($,J),J}function kM(){var $=j$();return this.squareTo($),$}function fM($){var J=j$();return this.divRemTo($,J,null),J}function yM($){var J=j$();return this.divRemTo($,null,J),J}function hM($){var J=j$(),X=j$();return this.divRemTo($,J,X),[J,X]}function bM($){this.data[this.t]=this.am(0,$-1,this,0,0,this.t),++this.t,this.clamp()}function uM($,J){if($==0)return;while(this.t<=J)this.data[this.t++]=0;this.data[J]+=$;while(this.data[J]>=this.DV){if(this.data[J]-=this.DV,++J>=this.t)this.data[this.t++]=0;++this.data[J]}}function KX(){}function I7($){return $}function mM($,J,X){$.multiplyTo(J,X)}function gM($,J){$.squareTo(J)}KX.prototype.convert=I7;KX.prototype.revert=I7;KX.prototype.mulTo=mM;KX.prototype.sqrTo=gM;function lM($){return this.exp($,new KX)}function dM($,J,X){var Q=Math.min(this.t+$.t,J);X.s=0,X.t=Q;while(Q>0)X.data[--Q]=0;var Y;for(Y=X.t-this.t;Q<Y;++Q)X.data[Q+this.t]=this.am(0,$.data[Q],X,Q,0,this.t);for(Y=Math.min($.t,J);Q<Y;++Q)this.am(0,$.data[Q],X,Q,0,J-Q);X.clamp()}function pM($,J,X){--J;var Q=X.t=this.t+$.t-J;X.s=0;while(--Q>=0)X.data[Q]=0;for(Q=Math.max(J-this.t,0);Q<$.t;++Q)X.data[this.t+Q-J]=this.am(J-Q,$.data[Q],X,0,0,this.t+Q-J);X.clamp(),X.drShiftTo(1,X)}function BQ($){this.r2=j$(),this.q3=j$(),v.ONE.dlShiftTo(2*$.t,this.r2),this.mu=this.r2.divide($),this.m=$}function cM($){if($.s<0||$.t>2*this.m.t)return $.mod(this.m);else if($.compareTo(this.m)<0)return $;else{var J=j$();return $.copyTo(J),this.reduce(J),J}}function nM($){return $}function iM($){if($.drShiftTo(this.m.t-1,this.r2),$.t>this.m.t+1)$.t=this.m.t+1,$.clamp();this.mu.multiplyUpperTo(this.r2,this.m.t+1,this.q3),this.m.multiplyLowerTo(this.q3,this.m.t+1,this.r2);while($.compareTo(this.r2)<0)$.dAddOffset(1,this.m.t+1);$.subTo(this.r2,$);while($.compareTo(this.m)>=0)$.subTo(this.m,$)}function oM($,J){$.squareTo(J),this.reduce(J)}function aM($,J,X){$.multiplyTo(J,X),this.reduce(X)}BQ.prototype.convert=cM;BQ.prototype.revert=nM;BQ.prototype.reduce=iM;BQ.prototype.mulTo=aM;BQ.prototype.sqrTo=oM;function rM($,J){var X=$.bitLength(),Q,Y=CJ(1),G;if(X<=0)return Y;else if(X<18)Q=1;else if(X<48)Q=3;else if(X<144)Q=4;else if(X<768)Q=5;else Q=6;if(X<8)G=new tJ(J);else if(J.isEven())G=new BQ(J);else G=new eJ(J);var W=[],O=3,M=Q-1,U=(1<<Q)-1;if(W[1]=G.convert(this),Q>1){var H=j$();G.sqrTo(W[1],H);while(O<=U)W[O]=j$(),G.mulTo(H,W[O-2],W[O]),O+=2}var V=$.t-1,q,z=!0,K=j$(),L;X=KY($.data[V])-1;while(V>=0){if(X>=M)q=$.data[V]>>X-M&U;else if(q=($.data[V]&(1<<X+1)-1)<<M-X,V>0)q|=$.data[V-1]>>this.DB+X-M;O=Q;while((q&1)==0)q>>=1,--O;if((X-=O)<0)X+=this.DB,--V;if(z)W[q].copyTo(Y),z=!1;else{while(O>1)G.sqrTo(Y,K),G.sqrTo(K,Y),O-=2;if(O>0)G.sqrTo(Y,K);else L=Y,Y=K,K=L;G.mulTo(K,W[q],Y)}while(V>=0&&($.data[V]&1<<X)==0)if(G.sqrTo(Y,K),L=Y,Y=K,K=L,--X<0)X=this.DB-1,--V}return G.revert(Y)}function sM($){var J=this.s<0?this.negate():this.clone(),X=$.s<0?$.negate():$.clone();if(J.compareTo(X)<0){var Q=J;J=X,X=Q}var Y=J.getLowestSetBit(),G=X.getLowestSetBit();if(G<0)return J;if(Y<G)G=Y;if(G>0)J.rShiftTo(G,J),X.rShiftTo(G,X);while(J.signum()>0){if((Y=J.getLowestSetBit())>0)J.rShiftTo(Y,J);if((Y=X.getLowestSetBit())>0)X.rShiftTo(Y,X);if(J.compareTo(X)>=0)J.subTo(X,J),J.rShiftTo(1,J);else X.subTo(J,X),X.rShiftTo(1,X)}if(G>0)X.lShiftTo(G,X);return X}function tM($){if($<=0)return 0;var J=this.DV%$,X=this.s<0?$-1:0;if(this.t>0)if(J==0)X=this.data[0]%$;else for(var Q=this.t-1;Q>=0;--Q)X=(J*X+this.data[Q])%$;return X}function eM($){if(this.signum()==0)return v.ZERO;var J=$.isEven();if(this.isEven()&&J||$.signum()==0)return v.ZERO;var X=$.clone(),Q=this.clone(),Y=CJ(1),G=CJ(0),W=CJ(0),O=CJ(1);while(X.signum()!=0){while(X.isEven()){if(X.rShiftTo(1,X),J){if(!Y.isEven()||!G.isEven())Y.addTo(this,Y),G.subTo($,G);Y.rShiftTo(1,Y)}else if(!G.isEven())G.subTo($,G);G.rShiftTo(1,G)}while(Q.isEven()){if(Q.rShiftTo(1,Q),J){if(!W.isEven()||!O.isEven())W.addTo(this,W),O.subTo($,O);W.rShiftTo(1,W)}else if(!O.isEven())O.subTo($,O);O.rShiftTo(1,O)}if(X.compareTo(Q)>=0){if(X.subTo(Q,X),J)Y.subTo(W,Y);G.subTo(O,G)}else{if(Q.subTo(X,Q),J)W.subTo(Y,W);O.subTo(G,O)}}if(Q.compareTo(v.ONE)!=0)return v.ZERO;if(O.compareTo($)>=0)return O.subtract($);if(O.signum()<0)O.addTo($,O);else return O;if(O.signum()<0)return O.add($);else return O}var g0=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997],$U=67108864/g0[g0.length-1];function JU($){var J,X=this.abs();if(X.t==1&&X.data[0]<=g0[g0.length-1]){for(J=0;J<g0.length;++J)if(X.data[0]==g0[J])return!0;return!1}if(X.isEven())return!1;J=1;while(J<g0.length){var Q=g0[J],Y=J+1;while(Y<g0.length&&Q<$U)Q*=g0[Y++];Q=X.modInt(Q);while(J<Y)if(Q%g0[J++]==0)return!1}return X.millerRabin($)}function QU($){var J=this.subtract(v.ONE),X=J.getLowestSetBit();if(X<=0)return!1;var Q=J.shiftRight(X),Y=XU(),G;for(var W=0;W<$;++W){do G=new v(this.bitLength(),Y);while(G.compareTo(v.ONE)<=0||G.compareTo(J)>=0);var O=G.modPow(Q,this);if(O.compareTo(v.ONE)!=0&&O.compareTo(J)!=0){var M=1;while(M++<X&&O.compareTo(J)!=0)if(O=O.modPowInt(2,this),O.compareTo(v.ONE)==0)return!1;if(O.compareTo(J)!=0)return!1}}return!0}function XU(){return{nextBytes:function($){for(var J=0;J<$.length;++J)$[J]=Math.floor(Math.random()*256)}}}v.prototype.chunkSize=XM;v.prototype.toRadix=GM;v.prototype.fromRadix=WM;v.prototype.fromNumber=OM;v.prototype.bitwiseTo=qM;v.prototype.changeBit=jM;v.prototype.addTo=PM;v.prototype.dMultiply=bM;v.prototype.dAddOffset=uM;v.prototype.multiplyLowerTo=dM;v.prototype.multiplyUpperTo=pM;v.prototype.modInt=tM;v.prototype.millerRabin=QU;v.prototype.clone=eO;v.prototype.intValue=$M;v.prototype.byteValue=JM;v.prototype.shortValue=QM;v.prototype.signum=YM;v.prototype.toByteArray=MM;v.prototype.equals=UM;v.prototype.min=HM;v.prototype.max=VM;v.prototype.and=EM;v.prototype.or=zM;v.prototype.xor=FM;v.prototype.andNot=NM;v.prototype.not=AM;v.prototype.shiftLeft=LM;v.prototype.shiftRight=DM;v.prototype.getLowestSetBit=ZM;v.prototype.bitCount=TM;v.prototype.testBit=SM;v.prototype.setBit=CM;v.prototype.clearBit=IM;v.prototype.flipBit=wM;v.prototype.add=_M;v.prototype.subtract=xM;v.prototype.multiply=vM;v.prototype.divide=fM;v.prototype.remainder=yM;v.prototype.divideAndRemainder=hM;v.prototype.modPow=rM;v.prototype.modInverse=eM;v.prototype.pow=lM;v.prototype.gcd=sM;v.prototype.isProbablePrime=JU;v.prototype.square=kM});var TQ=H$((SE,v7)=>{var XJ=K$();t0();w$();var _7=v7.exports=XJ.sha1=XJ.sha1||{};XJ.md.sha1=XJ.md.algorithms.sha1=_7;_7.create=function(){if(!x7)YU();var $=null,J=XJ.util.createBuffer(),X=Array(80),Q={algorithm:"sha1",blockLength:64,digestLength:20,messageLength:0,fullMessageLength:null,messageLengthSize:8};return Q.start=function(){Q.messageLength=0,Q.fullMessageLength=Q.messageLength64=[];var Y=Q.messageLengthSize/4;for(var G=0;G<Y;++G)Q.fullMessageLength.push(0);return J=XJ.util.createBuffer(),$={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878,h4:3285377520},Q},Q.start(),Q.update=function(Y,G){if(G==="utf8")Y=XJ.util.encodeUtf8(Y);var W=Y.length;Q.messageLength+=W,W=[W/4294967296>>>0,W>>>0];for(var O=Q.fullMessageLength.length-1;O>=0;--O)Q.fullMessageLength[O]+=W[1],W[1]=W[0]+(Q.fullMessageLength[O]/4294967296>>>0),Q.fullMessageLength[O]=Q.fullMessageLength[O]>>>0,W[0]=W[1]/4294967296>>>0;if(J.putBytes(Y),P7($,X,J),J.read>2048||J.length()===0)J.compact();return Q},Q.digest=function(){var Y=XJ.util.createBuffer();Y.putBytes(J.bytes());var G=Q.fullMessageLength[Q.fullMessageLength.length-1]+Q.messageLengthSize,W=G&Q.blockLength-1;Y.putBytes(d9.substr(0,Q.blockLength-W));var O,M,U=Q.fullMessageLength[0]*8;for(var H=0;H<Q.fullMessageLength.length-1;++H)O=Q.fullMessageLength[H+1]*8,M=O/4294967296>>>0,U+=M,Y.putInt32(U>>>0),U=O>>>0;Y.putInt32(U);var V={h0:$.h0,h1:$.h1,h2:$.h2,h3:$.h3,h4:$.h4};P7(V,X,Y);var q=XJ.util.createBuffer();return q.putInt32(V.h0),q.putInt32(V.h1),q.putInt32(V.h2),q.putInt32(V.h3),q.putInt32(V.h4),q},Q};var d9=null,x7=!1;function YU(){d9=String.fromCharCode(128),d9+=XJ.util.fillString(String.fromCharCode(0),64),x7=!0}function P7($,J,X){var Q,Y,G,W,O,M,U,H,V=X.length();while(V>=64){Y=$.h0,G=$.h1,W=$.h2,O=$.h3,M=$.h4;for(H=0;H<16;++H)Q=X.getInt32(),J[H]=Q,U=O^G&(W^O),Q=(Y<<5|Y>>>27)+U+M+1518500249+Q,M=O,O=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;H<20;++H)Q=J[H-3]^J[H-8]^J[H-14]^J[H-16],Q=Q<<1|Q>>>31,J[H]=Q,U=O^G&(W^O),Q=(Y<<5|Y>>>27)+U+M+1518500249+Q,M=O,O=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;H<32;++H)Q=J[H-3]^J[H-8]^J[H-14]^J[H-16],Q=Q<<1|Q>>>31,J[H]=Q,U=G^W^O,Q=(Y<<5|Y>>>27)+U+M+1859775393+Q,M=O,O=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;H<40;++H)Q=J[H-6]^J[H-16]^J[H-28]^J[H-32],Q=Q<<2|Q>>>30,J[H]=Q,U=G^W^O,Q=(Y<<5|Y>>>27)+U+M+1859775393+Q,M=O,O=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;H<60;++H)Q=J[H-6]^J[H-16]^J[H-28]^J[H-32],Q=Q<<2|Q>>>30,J[H]=Q,U=G&W|O&(G^W),Q=(Y<<5|Y>>>27)+U+M+2400959708+Q,M=O,O=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;for(;H<80;++H)Q=J[H-6]^J[H-16]^J[H-28]^J[H-32],Q=Q<<2|Q>>>30,J[H]=Q,U=G^W^O,Q=(Y<<5|Y>>>27)+U+M+3395469782+Q,M=O,O=W,W=(G<<30|G>>>2)>>>0,G=Y,Y=Q;$.h0=$.h0+Y|0,$.h1=$.h1+G|0,$.h2=$.h2+W|0,$.h3=$.h3+O|0,$.h4=$.h4+M|0,V-=64}}});var p9=H$((jE,f7)=>{var YJ=K$();w$();P0();TQ();var k7=f7.exports=YJ.pkcs1=YJ.pkcs1||{};k7.encode_rsa_oaep=function($,J,X){var Q,Y,G,W;if(typeof X==="string")Q=X,Y=arguments[3]||void 0,G=arguments[4]||void 0;else if(X){if(Q=X.label||void 0,Y=X.seed||void 0,G=X.md||void 0,X.mgf1&&X.mgf1.md)W=X.mgf1.md}if(!G)G=YJ.md.sha1.create();else G.start();if(!W)W=G;var O=Math.ceil($.n.bitLength()/8),M=O-2*G.digestLength-2;if(J.length>M){var U=Error("RSAES-OAEP input message length is too long.");throw U.length=J.length,U.maxLength=M,U}if(!Q)Q="";G.update(Q,"raw");var H=G.digest(),V="",q=M-J.length;for(var z=0;z<q;z++)V+="\x00";var K=H.getBytes()+V+"\x01"+J;if(!Y)Y=YJ.random.getBytes(G.digestLength);else if(Y.length!==G.digestLength){var U=Error("Invalid RSAES-OAEP seed. The seed length must match the digest length.");throw U.seedLength=Y.length,U.digestLength=G.digestLength,U}var L=EY(Y,O-G.digestLength-1,W),A=YJ.util.xorBytes(K,L,K.length),D=EY(A,G.digestLength,W),j=YJ.util.xorBytes(Y,D,Y.length);return"\x00"+j+A};k7.decode_rsa_oaep=function($,J,X){var Q,Y,G;if(typeof X==="string")Q=X,Y=arguments[3]||void 0;else if(X){if(Q=X.label||void 0,Y=X.md||void 0,X.mgf1&&X.mgf1.md)G=X.mgf1.md}var W=Math.ceil($.n.bitLength()/8);if(J.length!==W){var A=Error("RSAES-OAEP encoded message length is invalid.");throw A.length=J.length,A.expectedLength=W,A}if(Y===void 0)Y=YJ.md.sha1.create();else Y.start();if(!G)G=Y;if(W<2*Y.digestLength+2)throw Error("RSAES-OAEP key is too short for the hash function.");if(!Q)Q="";Y.update(Q,"raw");var O=Y.digest().getBytes(),M=J.charAt(0),U=J.substring(1,Y.digestLength+1),H=J.substring(1+Y.digestLength),V=EY(H,Y.digestLength,G),q=YJ.util.xorBytes(U,V,U.length),z=EY(q,W-Y.digestLength-1,G),K=YJ.util.xorBytes(H,z,H.length),L=K.substring(0,Y.digestLength),A=M!=="\x00";for(var D=0;D<Y.digestLength;++D)A|=O.charAt(D)!==L.charAt(D);var j=1,S=Y.digestLength;for(var P=Y.digestLength;P<K.length;P++){var C=K.charCodeAt(P),w=C&1^1,b=j?65534:0;A|=C&b,j=j&w,S+=j}if(A||K.charCodeAt(S)!==1)throw Error("Invalid RSAES-OAEP padding.");return K.substring(S+1)};function EY($,J,X){if(!X)X=YJ.md.sha1.create();var Q="",Y=Math.ceil(J/X.digestLength);for(var G=0;G<Y;++G){var W=String.fromCharCode(G>>24&255,G>>16&255,G>>8&255,G&255);X.start(),X.update($+W),Q+=X.digest().getBytes()}return Q.substring(0,J)}});var n9=H$((CE,c9)=>{var IJ=K$();w$();EX();P0();(function(){if(IJ.prime){c9.exports=IJ.prime;return}var $=c9.exports=IJ.prime=IJ.prime||{},J=IJ.jsbn.BigInteger,X=[6,4,2,4,2,4,6,2],Q=new J(null);Q.fromInt(30);var Y=function(V,q){return V|q};$.generateProbablePrime=function(V,q,z){if(typeof q==="function")z=q,q={};q=q||{};var K=q.algorithm||"PRIMEINC";if(typeof K==="string")K={name:K};K.options=K.options||{};var L=q.prng||IJ.random,A={nextBytes:function(D){var j=L.getBytesSync(D.length);for(var S=0;S<D.length;++S)D[S]=j.charCodeAt(S)}};if(K.name==="PRIMEINC")return G(V,A,K.options,z);throw Error("Invalid prime generation algorithm: "+K.name)};function G(V,q,z,K){if("workers"in z)return M(V,q,z,K);return W(V,q,z,K)}function W(V,q,z,K){var L=U(V,q),A=0,D=H(L.bitLength());if("millerRabinTests"in z)D=z.millerRabinTests;var j=10;if("maxBlockTime"in z)j=z.maxBlockTime;O(L,V,q,A,D,j,K)}function O(V,q,z,K,L,A,D){var j=+new Date;do{if(V.bitLength()>q)V=U(q,z);if(V.isProbablePrime(L))return D(null,V);V.dAddOffset(X[K++%8],0)}while(A<0||+new Date-j<A);IJ.util.setImmediate(function(){O(V,q,z,K,L,A,D)})}function M(V,q,z,K){if(typeof Worker>"u")return W(V,q,z,K);var L=U(V,q),A=z.workers,D=z.workLoad||100,j=D*30/8,S=z.workerScript||"forge/prime.worker.js";if(A===-1)return IJ.util.estimateCores(function(C,w){if(C)w=2;A=w-1,P()});P();function P(){A=Math.max(1,A);var C=[];for(var w=0;w<A;++w)C[w]=new Worker(S);var b=A;for(var w=0;w<A;++w)C[w].addEventListener("message",r);var t=!1;function r(G$){if(t)return;--b;var T$=G$.data;if(T$.found){for(var Z$=0;Z$<C.length;++Z$)C[Z$].terminate();return t=!0,K(null,new J(T$.prime,16))}if(L.bitLength()>V)L=U(V,q);var W$=L.toString(16);G$.target.postMessage({hex:W$,workLoad:D}),L.dAddOffset(j,0)}}}function U(V,q){var z=new J(V,q),K=V-1;if(!z.testBit(K))z.bitwiseTo(J.ONE.shiftLeft(K),Y,z);return z.dAddOffset(31-z.mod(Q).byteValue(),0),z}function H(V){if(V<=100)return 27;if(V<=150)return 18;if(V<=200)return 15;if(V<=250)return 12;if(V<=300)return 9;if(V<=350)return 8;if(V<=400)return 7;if(V<=500)return 6;if(V<=600)return 5;if(V<=800)return 4;if(V<=1250)return 3;return 2}})()});var zX=H$((IE,l7)=>{var e=K$();m0();EX();jJ();p9();n9();P0();w$();if(typeof B$>"u")B$=e.jsbn.BigInteger;var B$,i9=e.util.isNodejs?L9("crypto"):null,I=e.asn1,x0=e.util;e.pki=e.pki||{};l7.exports=e.pki.rsa=e.rsa=e.rsa||{};var U$=e.pki,GU=[6,4,2,4,2,4,6,2],WU={name:"PrivateKeyInfo",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:I.Class.UNIVERSAL,type:I.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:I.Class.UNIVERSAL,type:I.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]},OU={name:"RSAPrivateKey",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPrivateKey.version",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"RSAPrivateKey.modulus",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyModulus"},{name:"RSAPrivateKey.publicExponent",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyPublicExponent"},{name:"RSAPrivateKey.privateExponent",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyPrivateExponent"},{name:"RSAPrivateKey.prime1",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyPrime1"},{name:"RSAPrivateKey.prime2",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyPrime2"},{name:"RSAPrivateKey.exponent1",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyExponent1"},{name:"RSAPrivateKey.exponent2",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyExponent2"},{name:"RSAPrivateKey.coefficient",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"privateKeyCoefficient"}]},MU={name:"RSAPublicKey",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPublicKey.modulus",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"publicKeyModulus"},{name:"RSAPublicKey.exponent",tagClass:I.Class.UNIVERSAL,type:I.Type.INTEGER,constructed:!1,capture:"publicKeyExponent"}]},UU=e.pki.rsa.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:I.Class.UNIVERSAL,type:I.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{name:"SubjectPublicKeyInfo.subjectPublicKey",tagClass:I.Class.UNIVERSAL,type:I.Type.BITSTRING,constructed:!1,value:[{name:"SubjectPublicKeyInfo.subjectPublicKey.RSAPublicKey",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"rsaPublicKey"}]}]},HU={name:"DigestInfo",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm",tagClass:I.Class.UNIVERSAL,type:I.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm.algorithmIdentifier",tagClass:I.Class.UNIVERSAL,type:I.Type.OID,constructed:!1,capture:"algorithmIdentifier"},{name:"DigestInfo.DigestAlgorithm.parameters",tagClass:I.Class.UNIVERSAL,type:I.Type.NULL,capture:"parameters",optional:!0,constructed:!1}]},{name:"DigestInfo.digest",tagClass:I.Class.UNIVERSAL,type:I.Type.OCTETSTRING,constructed:!1,capture:"digest"}]},VU=function($){var J;if($.algorithm in U$.oids)J=U$.oids[$.algorithm];else{var X=Error("Unknown message digest algorithm.");throw X.algorithm=$.algorithm,X}var Q=I.oidToDer(J).getBytes(),Y=I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[]),G=I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[]);G.value.push(I.create(I.Class.UNIVERSAL,I.Type.OID,!1,Q)),G.value.push(I.create(I.Class.UNIVERSAL,I.Type.NULL,!1,""));var W=I.create(I.Class.UNIVERSAL,I.Type.OCTETSTRING,!1,$.digest().getBytes());return Y.value.push(G),Y.value.push(W),I.toDer(Y).getBytes()},m7=function($,J,X){if(X)return $.modPow(J.e,J.n);if(!J.p||!J.q)return $.modPow(J.d,J.n);if(!J.dP)J.dP=J.d.mod(J.p.subtract(B$.ONE));if(!J.dQ)J.dQ=J.d.mod(J.q.subtract(B$.ONE));if(!J.qInv)J.qInv=J.q.modInverse(J.p);var Q;do Q=new B$(e.util.bytesToHex(e.random.getBytes(J.n.bitLength()/8)),16);while(Q.compareTo(J.n)>=0||!Q.gcd(J.n).equals(B$.ONE));$=$.multiply(Q.modPow(J.e,J.n)).mod(J.n);var Y=$.mod(J.p).modPow(J.dP,J.p),G=$.mod(J.q).modPow(J.dQ,J.q);while(Y.compareTo(G)<0)Y=Y.add(J.p);var W=Y.subtract(G).multiply(J.qInv).mod(J.p).multiply(J.q).add(G);return W=W.multiply(Q.modInverse(J.n)).mod(J.n),W};U$.rsa.encrypt=function($,J,X){var Q=X,Y,G=Math.ceil(J.n.bitLength()/8);if(X!==!1&&X!==!0)Q=X===2,Y=g7($,J,X);else Y=e.util.createBuffer(),Y.putBytes($);var W=new B$(Y.toHex(),16),O=m7(W,J,Q),M=O.toString(16),U=e.util.createBuffer(),H=G-Math.ceil(M.length/2);while(H>0)U.putByte(0),--H;return U.putBytes(e.util.hexToBytes(M)),U.getBytes()};U$.rsa.decrypt=function($,J,X,Q){var Y=Math.ceil(J.n.bitLength()/8);if($.length!==Y){var G=Error("Encrypted message length is invalid.");throw G.length=$.length,G.expected=Y,G}var W=new B$(e.util.createBuffer($).toHex(),16);if(W.compareTo(J.n)>=0)throw Error("Encrypted message is invalid.");var O=m7(W,J,X),M=O.toString(16),U=e.util.createBuffer(),H=Y-Math.ceil(M.length/2);while(H>0)U.putByte(0),--H;if(U.putBytes(e.util.hexToBytes(M)),Q!==!1)return zY(U.getBytes(),J,X);return U.getBytes()};U$.rsa.createKeyPairGenerationState=function($,J,X){if(typeof $==="string")$=parseInt($,10);$=$||2048,X=X||{};var Q=X.prng||e.random,Y={nextBytes:function(O){var M=Q.getBytesSync(O.length);for(var U=0;U<O.length;++U)O[U]=M.charCodeAt(U)}},G=X.algorithm||"PRIMEINC",W;if(G==="PRIMEINC")W={algorithm:G,state:0,bits:$,rng:Y,eInt:J||65537,e:new B$(null),p:null,q:null,qBits:$>>1,pBits:$-($>>1),pqState:0,num:null,keys:null},W.e.fromInt(W.eInt);else throw Error("Invalid key generation algorithm: "+G);return W};U$.rsa.stepKeyPairGenerationState=function($,J){if(!("algorithm"in $))$.algorithm="PRIMEINC";var X=new B$(null);X.fromInt(30);var Q=0,Y=function(V,q){return V|q},G=+new Date,W,O=0;while($.keys===null&&(J<=0||O<J)){if($.state===0){var M=$.p===null?$.pBits:$.qBits,U=M-1;if($.pqState===0){if($.num=new B$(M,$.rng),!$.num.testBit(U))$.num.bitwiseTo(B$.ONE.shiftLeft(U),Y,$.num);$.num.dAddOffset(31-$.num.mod(X).byteValue(),0),Q=0,++$.pqState}else if($.pqState===1)if($.num.bitLength()>M)$.pqState=0;else if($.num.isProbablePrime(KU($.num.bitLength())))++$.pqState;else $.num.dAddOffset(GU[Q++%8],0);else if($.pqState===2)$.pqState=$.num.subtract(B$.ONE).gcd($.e).compareTo(B$.ONE)===0?3:0;else if($.pqState===3){if($.pqState=0,$.p===null)$.p=$.num;else $.q=$.num;if($.p!==null&&$.q!==null)++$.state;$.num=null}}else if($.state===1){if($.p.compareTo($.q)<0)$.num=$.p,$.p=$.q,$.q=$.num;++$.state}else if($.state===2)$.p1=$.p.subtract(B$.ONE),$.q1=$.q.subtract(B$.ONE),$.phi=$.p1.multiply($.q1),++$.state;else if($.state===3)if($.phi.gcd($.e).compareTo(B$.ONE)===0)++$.state;else $.p=null,$.q=null,$.state=0;else if($.state===4)if($.n=$.p.multiply($.q),$.n.bitLength()===$.bits)++$.state;else $.q=null,$.state=0;else if($.state===5){var H=$.e.modInverse($.phi);$.keys={privateKey:U$.rsa.setPrivateKey($.n,$.e,H,$.p,$.q,H.mod($.p1),H.mod($.q1),$.q.modInverse($.p)),publicKey:U$.rsa.setPublicKey($.n,$.e)}}W=+new Date,O+=W-G,G=W}return $.keys!==null};U$.rsa.generateKeyPair=function($,J,X,Q){if(arguments.length===1){if(typeof $==="object")X=$,$=void 0;else if(typeof $==="function")Q=$,$=void 0}else if(arguments.length===2)if(typeof $==="number"){if(typeof J==="function")Q=J,J=void 0;else if(typeof J!=="number")X=J,J=void 0}else X=$,Q=J,$=void 0,J=void 0;else if(arguments.length===3)if(typeof J==="number"){if(typeof X==="function")Q=X,X=void 0}else Q=X,X=J,J=void 0;if(X=X||{},$===void 0)$=X.bits||2048;if(J===void 0)J=X.e||65537;if(!e.options.usePureJavaScript&&!X.prng&&$>=256&&$<=16384&&(J===65537||J===3)){if(Q){if(y7("generateKeyPair"))return i9.generateKeyPair("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}},function(O,M,U){if(O)return Q(O);Q(null,{privateKey:U$.privateKeyFromPem(U),publicKey:U$.publicKeyFromPem(M)})});if(h7("generateKey")&&h7("exportKey"))return x0.globalScope.crypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:u7(J),hash:{name:"SHA-256"}},!0,["sign","verify"]).then(function(O){return x0.globalScope.crypto.subtle.exportKey("pkcs8",O.privateKey)}).then(void 0,function(O){Q(O)}).then(function(O){if(O){var M=U$.privateKeyFromAsn1(I.fromDer(e.util.createBuffer(O)));Q(null,{privateKey:M,publicKey:U$.setRsaPublicKey(M.n,M.e)})}});if(b7("generateKey")&&b7("exportKey")){var Y=x0.globalScope.msCrypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:$,publicExponent:u7(J),hash:{name:"SHA-256"}},!0,["sign","verify"]);Y.oncomplete=function(O){var M=O.target.result,U=x0.globalScope.msCrypto.subtle.exportKey("pkcs8",M.privateKey);U.oncomplete=function(H){var V=H.target.result,q=U$.privateKeyFromAsn1(I.fromDer(e.util.createBuffer(V)));Q(null,{privateKey:q,publicKey:U$.setRsaPublicKey(q.n,q.e)})},U.onerror=function(H){Q(H)}},Y.onerror=function(O){Q(O)};return}}else if(y7("generateKeyPairSync")){var G=i9.generateKeyPairSync("rsa",{modulusLength:$,publicExponent:J,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{privateKey:U$.privateKeyFromPem(G.privateKey),publicKey:U$.publicKeyFromPem(G.publicKey)}}}var W=U$.rsa.createKeyPairGenerationState($,J,X);if(!Q)return U$.rsa.stepKeyPairGenerationState(W,0),W.keys;qU(W,X,Q)};U$.setRsaPublicKey=U$.rsa.setPublicKey=function($,J){var X={n:$,e:J};return X.encrypt=function(Q,Y,G){if(typeof Y==="string")Y=Y.toUpperCase();else if(Y===void 0)Y="RSAES-PKCS1-V1_5";if(Y==="RSAES-PKCS1-V1_5")Y={encode:function(O,M,U){return g7(O,M,2).getBytes()}};else if(Y==="RSA-OAEP"||Y==="RSAES-OAEP")Y={encode:function(O,M){return e.pkcs1.encode_rsa_oaep(M,O,G)}};else if(["RAW","NONE","NULL",null].indexOf(Y)!==-1)Y={encode:function(O){return O}};else if(typeof Y==="string")throw Error('Unsupported encryption scheme: "'+Y+'".');var W=Y.encode(Q,X,!0);return U$.rsa.encrypt(W,X,!0)},X.verify=function(Q,Y,G,W){if(typeof G==="string")G=G.toUpperCase();else if(G===void 0)G="RSASSA-PKCS1-V1_5";if(W===void 0)W={_parseAllDigestBytes:!0,_skipPaddingChecks:!1};if(!("_parseAllDigestBytes"in W))W._parseAllDigestBytes=!0;if(!("_skipPaddingChecks"in W))W._skipPaddingChecks=!1;if(G==="RSASSA-PKCS1-V1_5")G={verify:function(M,U){U=zY(U,X,!0,void 0,W);var H=I.fromDer(U,{parseAllBytes:W._parseAllDigestBytes}),V={},q=[];if(!I.validate(H,HU,V,q)||H.value.length!==2){var z=Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.");throw z.errors=q,z}var K=I.derToOid(V.algorithmIdentifier);if(!(K===e.oids.md2||K===e.oids.md5||K===e.oids.sha1||K===e.oids.sha224||K===e.oids.sha256||K===e.oids.sha384||K===e.oids.sha512||K===e.oids["sha512-224"]||K===e.oids["sha512-256"])){var z=Error("Unknown RSASSA-PKCS1-v1_5 DigestAlgorithm identifier.");throw z.oid=K,z}if(K===e.oids.md2||K===e.oids.md5){if(!("parameters"in V))throw Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value. Missing algorithm identifier NULL parameters.")}return M===V.digest}};else if(G==="NONE"||G==="NULL"||G===null)G={verify:function(M,U){return U=zY(U,X,!0,void 0,W),M===U}};var O=U$.rsa.decrypt(Y,X,!0,!1);return G.verify(Q,O,X.n.bitLength())},X};U$.setRsaPrivateKey=U$.rsa.setPrivateKey=function($,J,X,Q,Y,G,W,O){var M={n:$,e:J,d:X,p:Q,q:Y,dP:G,dQ:W,qInv:O};return M.decrypt=function(U,H,V){if(typeof H==="string")H=H.toUpperCase();else if(H===void 0)H="RSAES-PKCS1-V1_5";var q=U$.rsa.decrypt(U,M,!1,!1);if(H==="RSAES-PKCS1-V1_5")H={decode:zY};else if(H==="RSA-OAEP"||H==="RSAES-OAEP")H={decode:function(z,K){return e.pkcs1.decode_rsa_oaep(K,z,V)}};else if(["RAW","NONE","NULL",null].indexOf(H)!==-1)H={decode:function(z){return z}};else throw Error('Unsupported encryption scheme: "'+H+'".');return H.decode(q,M,!1)},M.sign=function(U,H){var V=!1;if(typeof H==="string")H=H.toUpperCase();if(H===void 0||H==="RSASSA-PKCS1-V1_5")H={encode:VU},V=1;else if(H==="NONE"||H==="NULL"||H===null)H={encode:function(){return U}},V=1;var q=H.encode(U,M.n.bitLength());return U$.rsa.encrypt(q,M,V)},M};U$.wrapRsaPrivateKey=function($){return I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,I.integerToDer(0).getBytes()),I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.OID,!1,I.oidToDer(U$.oids.rsaEncryption).getBytes()),I.create(I.Class.UNIVERSAL,I.Type.NULL,!1,"")]),I.create(I.Class.UNIVERSAL,I.Type.OCTETSTRING,!1,I.toDer($).getBytes())])};U$.privateKeyFromAsn1=function($){var J={},X=[];if(I.validate($,WU,J,X))$=I.fromDer(e.util.createBuffer(J.privateKey));if(J={},X=[],!I.validate($,OU,J,X)){var Q=Error("Cannot read private key. ASN.1 object does not contain an RSAPrivateKey.");throw Q.errors=X,Q}var Y,G,W,O,M,U,H,V;return Y=e.util.createBuffer(J.privateKeyModulus).toHex(),G=e.util.createBuffer(J.privateKeyPublicExponent).toHex(),W=e.util.createBuffer(J.privateKeyPrivateExponent).toHex(),O=e.util.createBuffer(J.privateKeyPrime1).toHex(),M=e.util.createBuffer(J.privateKeyPrime2).toHex(),U=e.util.createBuffer(J.privateKeyExponent1).toHex(),H=e.util.createBuffer(J.privateKeyExponent2).toHex(),V=e.util.createBuffer(J.privateKeyCoefficient).toHex(),U$.setRsaPrivateKey(new B$(Y,16),new B$(G,16),new B$(W,16),new B$(O,16),new B$(M,16),new B$(U,16),new B$(H,16),new B$(V,16))};U$.privateKeyToAsn1=U$.privateKeyToRSAPrivateKey=function($){return I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,I.integerToDer(0).getBytes()),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.n)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.e)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.d)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.p)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.q)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.dP)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.dQ)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.qInv))])};U$.publicKeyFromAsn1=function($){var J={},X=[];if(I.validate($,UU,J,X)){var Q=I.derToOid(J.publicKeyOid);if(Q!==U$.oids.rsaEncryption){var Y=Error("Cannot read public key. Unknown OID.");throw Y.oid=Q,Y}$=J.rsaPublicKey}if(X=[],!I.validate($,MU,J,X)){var Y=Error("Cannot read public key. ASN.1 object does not contain an RSAPublicKey.");throw Y.errors=X,Y}var G=e.util.createBuffer(J.publicKeyModulus).toHex(),W=e.util.createBuffer(J.publicKeyExponent).toHex();return U$.setRsaPublicKey(new B$(G,16),new B$(W,16))};U$.publicKeyToAsn1=U$.publicKeyToSubjectPublicKeyInfo=function($){return I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.OID,!1,I.oidToDer(U$.oids.rsaEncryption).getBytes()),I.create(I.Class.UNIVERSAL,I.Type.NULL,!1,"")]),I.create(I.Class.UNIVERSAL,I.Type.BITSTRING,!1,[U$.publicKeyToRSAPublicKey($)])])};U$.publicKeyToRSAPublicKey=function($){return I.create(I.Class.UNIVERSAL,I.Type.SEQUENCE,!0,[I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.n)),I.create(I.Class.UNIVERSAL,I.Type.INTEGER,!1,GJ($.e))])};function g7($,J,X){var Q=e.util.createBuffer(),Y=Math.ceil(J.n.bitLength()/8);if($.length>Y-11){var G=Error("Message is too long for PKCS#1 v1.5 padding.");throw G.length=$.length,G.max=Y-11,G}Q.putByte(0),Q.putByte(X);var W=Y-3-$.length,O;if(X===0||X===1){O=X===0?0:255;for(var M=0;M<W;++M)Q.putByte(O)}else while(W>0){var U=0,H=e.random.getBytes(W);for(var M=0;M<W;++M)if(O=H.charCodeAt(M),O===0)++U;else Q.putByte(O);W=U}return Q.putByte(0),Q.putBytes($),Q}function zY($,J,X,Q,Y){var G=Math.ceil(J.n.bitLength()/8),W=e.util.createBuffer($),O=W.getByte(),M=W.getByte();if(O!==0||X&&M!==0&&M!==1||!X&&M!==2||X&&M===0&&typeof Q>"u")throw Error("Encryption block is invalid.");var U=0;if(M===0){U=G-3-Q;for(var H=0;H<U;++H)if(W.getByte()!==0)throw Error("Encryption block is invalid.")}else if(M===1){U=0;while(W.length()>1){if(W.getByte()!==255){--W.read;break}++U}if(U<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}else if(M===2){U=0;while(W.length()>1){if(W.getByte()===0){--W.read;break}++U}if(U<8&&!(Y?Y._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}var V=W.getByte();if(V!==0||U!==G-3-W.length())throw Error("Encryption block is invalid.");return W.getBytes()}function qU($,J,X){if(typeof J==="function")X=J,J={};J=J||{};var Q={algorithm:{name:J.algorithm||"PRIMEINC",options:{workers:J.workers||2,workLoad:J.workLoad||100,workerScript:J.workerScript}}};if("prng"in J)Q.prng=J.prng;Y();function Y(){G($.pBits,function(O,M){if(O)return X(O);if($.p=M,$.q!==null)return W(O,$.q);G($.qBits,W)})}function G(O,M){e.prime.generateProbablePrime(O,Q,M)}function W(O,M){if(O)return X(O);if($.q=M,$.p.compareTo($.q)<0){var U=$.p;$.p=$.q,$.q=U}if($.p.subtract(B$.ONE).gcd($.e).compareTo(B$.ONE)!==0){$.p=null,Y();return}if($.q.subtract(B$.ONE).gcd($.e).compareTo(B$.ONE)!==0){$.q=null,G($.qBits,W);return}if($.p1=$.p.subtract(B$.ONE),$.q1=$.q.subtract(B$.ONE),$.phi=$.p1.multiply($.q1),$.phi.gcd($.e).compareTo(B$.ONE)!==0){$.p=$.q=null,Y();return}if($.n=$.p.multiply($.q),$.n.bitLength()!==$.bits){$.q=null,G($.qBits,W);return}var H=$.e.modInverse($.phi);$.keys={privateKey:U$.rsa.setPrivateKey($.n,$.e,H,$.p,$.q,H.mod($.p1),H.mod($.q1),$.q.modInverse($.p)),publicKey:U$.rsa.setPublicKey($.n,$.e)},X(null,$.keys)}}function GJ($){var J=$.toString(16);if(J[0]>="8")J="00"+J;var X=e.util.hexToBytes(J);if(X.length>1&&(X.charCodeAt(0)===0&&(X.charCodeAt(1)&128)===0||X.charCodeAt(0)===255&&(X.charCodeAt(1)&128)===128))return X.substr(1);return X}function KU($){if($<=100)return 27;if($<=150)return 18;if($<=200)return 15;if($<=250)return 12;if($<=300)return 9;if($<=350)return 8;if($<=400)return 7;if($<=500)return 6;if($<=600)return 5;if($<=800)return 4;if($<=1250)return 3;return 2}function y7($){return e.util.isNodejs&&typeof i9[$]==="function"}function h7($){return typeof x0.globalScope<"u"&&typeof x0.globalScope.crypto==="object"&&typeof x0.globalScope.crypto.subtle==="object"&&typeof x0.globalScope.crypto.subtle[$]==="function"}function b7($){return typeof x0.globalScope<"u"&&typeof x0.globalScope.msCrypto==="object"&&typeof x0.globalScope.msCrypto.subtle==="object"&&typeof x0.globalScope.msCrypto.subtle[$]==="function"}function u7($){var J=e.util.hexToBytes($.toString(16)),X=new Uint8Array(J.length);for(var Q=0;Q<J.length;++Q)X[Q]=J.charCodeAt(Q);return X}});var a9=H$((wE,n7)=>{var i=K$();SJ();m0();qX();t0();jJ();HY();sJ();P0();u9();zX();w$();if(typeof o9>"u")o9=i.jsbn.BigInteger;var o9,_=i.asn1,q$=i.pki=i.pki||{};n7.exports=q$.pbe=i.pbe=i.pbe||{};var $Q=q$.oids,EU={name:"EncryptedPrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedPrivateKeyInfo.encryptionAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encryptionOid"},{name:"AlgorithmIdentifier.parameters",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,captureAsn1:"encryptionParams"}]},{name:"EncryptedPrivateKeyInfo.encryptedData",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encryptedData"}]},zU={name:"PBES2Algorithms",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"kdfOid"},{name:"PBES2Algorithms.params",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.params.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"kdfSalt"},{name:"PBES2Algorithms.params.iterationCount",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"kdfIterationCount"},{name:"PBES2Algorithms.params.keyLength",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,optional:!0,capture:"keyLength"},{name:"PBES2Algorithms.params.prf",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,optional:!0,value:[{name:"PBES2Algorithms.params.prf.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"prfOid"}]}]}]},{name:"PBES2Algorithms.encryptionScheme",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.encryptionScheme.oid",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"encOid"},{name:"PBES2Algorithms.encryptionScheme.iv",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"encIv"}]}]},FU={name:"pkcs-12PbeParams",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"pkcs-12PbeParams.salt",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"salt"},{name:"pkcs-12PbeParams.iterations",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"iterations"}]};q$.encryptPrivateKeyInfo=function($,J,X){X=X||{},X.saltSize=X.saltSize||8,X.count=X.count||2048,X.algorithm=X.algorithm||"aes128",X.prfAlgorithm=X.prfAlgorithm||"sha1";var Q=i.random.getBytesSync(X.saltSize),Y=X.count,G=_.integerToDer(Y),W,O,M;if(X.algorithm.indexOf("aes")===0||X.algorithm==="des"){var U,H,V;switch(X.algorithm){case"aes128":W=16,U=16,H=$Q["aes128-CBC"],V=i.aes.createEncryptionCipher;break;case"aes192":W=24,U=16,H=$Q["aes192-CBC"],V=i.aes.createEncryptionCipher;break;case"aes256":W=32,U=16,H=$Q["aes256-CBC"],V=i.aes.createEncryptionCipher;break;case"des":W=8,U=8,H=$Q.desCBC,V=i.des.createEncryptionCipher;break;default:var q=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw q.algorithm=X.algorithm,q}var z="hmacWith"+X.prfAlgorithm.toUpperCase(),K=c7(z),L=i.pkcs5.pbkdf2(J,Q,Y,W,K),A=i.random.getBytesSync(U),D=V(L);D.start(A),D.update(_.toDer($)),D.finish(),M=D.output.getBytes();var j=NU(Q,G,W,z);O=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer($Q.pkcs5PBES2).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer($Q.pkcs5PBKDF2).getBytes()),j]),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(H).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,A)])])])}else if(X.algorithm==="3des"){W=24;var S=new i.util.ByteBuffer(Q),L=q$.pbe.generatePkcs12Key(J,S,1,Y,W),A=q$.pbe.generatePkcs12Key(J,S,2,Y,W),D=i.des.createEncryptionCipher(L);D.start(A),D.update(_.toDer($)),D.finish(),M=D.output.getBytes(),O=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer($Q["pbeWithSHAAnd3-KeyTripleDES-CBC"]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,Q),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,G.getBytes())])])}else{var q=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw q.algorithm=X.algorithm,q}var P=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[O,_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,M)]);return P};q$.decryptPrivateKeyInfo=function($,J){var X=null,Q={},Y=[];if(!_.validate($,EU,Q,Y)){var G=Error("Cannot read encrypted private key. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=_.derToOid(Q.encryptionOid),O=q$.pbe.getCipher(W,Q.encryptionParams,J),M=i.util.createBuffer(Q.encryptedData);if(O.update(M),O.finish())X=_.fromDer(O.output);return X};q$.encryptedPrivateKeyToPem=function($,J){var X={type:"ENCRYPTED PRIVATE KEY",body:_.toDer($).getBytes()};return i.pem.encode(X,{maxline:J})};q$.encryptedPrivateKeyFromPem=function($){var J=i.pem.decode($)[0];if(J.type!=="ENCRYPTED PRIVATE KEY"){var X=Error('Could not convert encrypted private key from PEM; PEM header type is "ENCRYPTED PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert encrypted private key from PEM; PEM is encrypted.");return _.fromDer(J.body)};q$.encryptRsaPrivateKey=function($,J,X){if(X=X||{},!X.legacy){var Q=q$.wrapRsaPrivateKey(q$.privateKeyToAsn1($));return Q=q$.encryptPrivateKeyInfo(Q,J,X),q$.encryptedPrivateKeyToPem(Q)}var Y,G,W,O;switch(X.algorithm){case"aes128":Y="AES-128-CBC",W=16,G=i.random.getBytesSync(16),O=i.aes.createEncryptionCipher;break;case"aes192":Y="AES-192-CBC",W=24,G=i.random.getBytesSync(16),O=i.aes.createEncryptionCipher;break;case"aes256":Y="AES-256-CBC",W=32,G=i.random.getBytesSync(16),O=i.aes.createEncryptionCipher;break;case"3des":Y="DES-EDE3-CBC",W=24,G=i.random.getBytesSync(8),O=i.des.createEncryptionCipher;break;case"des":Y="DES-CBC",W=8,G=i.random.getBytesSync(8),O=i.des.createEncryptionCipher;break;default:var M=Error('Could not encrypt RSA private key; unsupported encryption algorithm "'+X.algorithm+'".');throw M.algorithm=X.algorithm,M}var U=i.pbe.opensslDeriveBytes(J,G.substr(0,8),W),H=O(U);H.start(G),H.update(_.toDer(q$.privateKeyToAsn1($))),H.finish();var V={type:"RSA PRIVATE KEY",procType:{version:"4",type:"ENCRYPTED"},dekInfo:{algorithm:Y,parameters:i.util.bytesToHex(G).toUpperCase()},body:H.output.getBytes()};return i.pem.encode(V)};q$.decryptRsaPrivateKey=function($,J){var X=null,Q=i.pem.decode($)[0];if(Q.type!=="ENCRYPTED PRIVATE KEY"&&Q.type!=="PRIVATE KEY"&&Q.type!=="RSA PRIVATE KEY"){var Y=Error('Could not convert private key from PEM; PEM header type is not "ENCRYPTED PRIVATE KEY", "PRIVATE KEY", or "RSA PRIVATE KEY".');throw Y.headerType=Y,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED"){var G,W;switch(Q.dekInfo.algorithm){case"DES-CBC":G=8,W=i.des.createDecryptionCipher;break;case"DES-EDE3-CBC":G=24,W=i.des.createDecryptionCipher;break;case"AES-128-CBC":G=16,W=i.aes.createDecryptionCipher;break;case"AES-192-CBC":G=24,W=i.aes.createDecryptionCipher;break;case"AES-256-CBC":G=32,W=i.aes.createDecryptionCipher;break;case"RC2-40-CBC":G=5,W=function(V){return i.rc2.createDecryptionCipher(V,40)};break;case"RC2-64-CBC":G=8,W=function(V){return i.rc2.createDecryptionCipher(V,64)};break;case"RC2-128-CBC":G=16,W=function(V){return i.rc2.createDecryptionCipher(V,128)};break;default:var Y=Error('Could not decrypt private key; unsupported encryption algorithm "'+Q.dekInfo.algorithm+'".');throw Y.algorithm=Q.dekInfo.algorithm,Y}var O=i.util.hexToBytes(Q.dekInfo.parameters),M=i.pbe.opensslDeriveBytes(J,O.substr(0,8),G),U=W(M);if(U.start(O),U.update(i.util.createBuffer(Q.body)),U.finish())X=U.output.getBytes();else return X}else X=Q.body;if(Q.type==="ENCRYPTED PRIVATE KEY")X=q$.decryptPrivateKeyInfo(_.fromDer(X),J);else X=_.fromDer(X);if(X!==null)X=q$.privateKeyFromAsn1(X);return X};q$.pbe.generatePkcs12Key=function($,J,X,Q,Y,G){var W,O;if(typeof G>"u"||G===null){if(!("sha1"in i.md))throw Error('"sha1" hash algorithm unavailable.');G=i.md.sha1.create()}var{digestLength:M,blockLength:U}=G,H=new i.util.ByteBuffer,V=new i.util.ByteBuffer;if($!==null&&$!==void 0){for(O=0;O<$.length;O++)V.putInt16($.charCodeAt(O));V.putInt16(0)}var q=V.length(),z=J.length(),K=new i.util.ByteBuffer;K.fillWithByte(X,U);var L=U*Math.ceil(z/U),A=new i.util.ByteBuffer;for(O=0;O<L;O++)A.putByte(J.at(O%z));var D=U*Math.ceil(q/U),j=new i.util.ByteBuffer;for(O=0;O<D;O++)j.putByte(V.at(O%q));var S=A;S.putBuffer(j);var P=Math.ceil(Y/M);for(var C=1;C<=P;C++){var w=new i.util.ByteBuffer;w.putBytes(K.bytes()),w.putBytes(S.bytes());for(var b=0;b<Q;b++)G.start(),G.update(w.getBytes()),w=G.digest();var t=new i.util.ByteBuffer;for(O=0;O<U;O++)t.putByte(w.at(O%M));var r=Math.ceil(z/U)+Math.ceil(q/U),G$=new i.util.ByteBuffer;for(W=0;W<r;W++){var T$=new i.util.ByteBuffer(S.getBytes(U)),Z$=511;for(O=t.length()-1;O>=0;O--)Z$=Z$>>8,Z$+=t.at(O)+T$.at(O),T$.setAt(O,Z$&255);G$.putBuffer(T$)}S=G$,H.putBuffer(w)}return H.truncate(H.length()-Y),H};q$.pbe.getCipher=function($,J,X){switch($){case q$.oids.pkcs5PBES2:return q$.pbe.getCipherForPBES2($,J,X);case q$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:case q$.oids["pbewithSHAAnd40BitRC2-CBC"]:return q$.pbe.getCipherForPKCS12PBE($,J,X);default:var Q=Error("Cannot read encrypted PBE data block. Unsupported OID.");throw Q.oid=$,Q.supportedOids=["pkcs5PBES2","pbeWithSHAAnd3-KeyTripleDES-CBC","pbewithSHAAnd40BitRC2-CBC"],Q}};q$.pbe.getCipherForPBES2=function($,J,X){var Q={},Y=[];if(!_.validate(J,zU,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}if($=_.derToOid(Q.kdfOid),$!==q$.oids.pkcs5PBKDF2){var G=Error("Cannot read encrypted private key. Unsupported key derivation function OID.");throw G.oid=$,G.supportedOids=["pkcs5PBKDF2"],G}if($=_.derToOid(Q.encOid),$!==q$.oids["aes128-CBC"]&&$!==q$.oids["aes192-CBC"]&&$!==q$.oids["aes256-CBC"]&&$!==q$.oids["des-EDE3-CBC"]&&$!==q$.oids.desCBC){var G=Error("Cannot read encrypted private key. Unsupported encryption scheme OID.");throw G.oid=$,G.supportedOids=["aes128-CBC","aes192-CBC","aes256-CBC","des-EDE3-CBC","desCBC"],G}var W=Q.kdfSalt,O=i.util.createBuffer(Q.kdfIterationCount);O=O.getInt(O.length()<<3);var M,U;switch(q$.oids[$]){case"aes128-CBC":M=16,U=i.aes.createDecryptionCipher;break;case"aes192-CBC":M=24,U=i.aes.createDecryptionCipher;break;case"aes256-CBC":M=32,U=i.aes.createDecryptionCipher;break;case"des-EDE3-CBC":M=24,U=i.des.createDecryptionCipher;break;case"desCBC":M=8,U=i.des.createDecryptionCipher;break}var H=p7(Q.prfOid),V=i.pkcs5.pbkdf2(X,W,O,M,H),q=Q.encIv,z=U(V);return z.start(q),z};q$.pbe.getCipherForPKCS12PBE=function($,J,X){var Q={},Y=[];if(!_.validate(J,FU,Q,Y)){var G=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw G.errors=Y,G}var W=i.util.createBuffer(Q.salt),O=i.util.createBuffer(Q.iterations);O=O.getInt(O.length()<<3);var M,U,H;switch($){case q$.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:M=24,U=8,H=i.des.startDecrypting;break;case q$.oids["pbewithSHAAnd40BitRC2-CBC"]:M=5,U=8,H=function(L,A){var D=i.rc2.createDecryptionCipher(L,40);return D.start(A,null),D};break;default:var G=Error("Cannot read PKCS #12 PBE data block. Unsupported OID.");throw G.oid=$,G}var V=p7(Q.prfOid),q=q$.pbe.generatePkcs12Key(X,W,1,O,M,V);V.start();var z=q$.pbe.generatePkcs12Key(X,W,2,O,U,V);return H(q,z)};q$.pbe.opensslDeriveBytes=function($,J,X,Q){if(typeof Q>"u"||Q===null){if(!("md5"in i.md))throw Error('"md5" hash algorithm unavailable.');Q=i.md.md5.create()}if(J===null)J="";var Y=[d7(Q,$+J)];for(var G=16,W=1;G<X;++W,G+=16)Y.push(d7(Q,Y[W-1]+$+J));return Y.join("").substr(0,X)};function d7($,J){return $.start().update(J).digest().getBytes()}function p7($){var J;if(!$)J="hmacWithSHA1";else if(J=q$.oids[_.derToOid($)],!J){var X=Error("Unsupported PRF OID.");throw X.oid=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}return c7(J)}function c7($){var J=i.md;switch($){case"hmacWithSHA224":J=i.md.sha512;case"hmacWithSHA1":case"hmacWithSHA256":case"hmacWithSHA384":case"hmacWithSHA512":$=$.substr(8).toLowerCase();break;default:var X=Error("Unsupported PRF algorithm.");throw X.algorithm=$,X.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],X}if(!J||!($ in J))throw Error("Unknown hash algorithm: "+$);return J[$].create()}function NU($,J,X,Q){var Y=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,$),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,J.getBytes())]);if(Q!=="hmacWithSHA1")Y.value.push(_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,i.util.hexToBytes(X.toString(16))),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(q$.oids[Q]).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]));return Y}});var r9=H$((PE,a7)=>{var SQ=K$();m0();w$();var n=SQ.asn1,jQ=a7.exports=SQ.pkcs7asn1=SQ.pkcs7asn1||{};SQ.pkcs7=SQ.pkcs7||{};SQ.pkcs7.asn1=jQ;var i7={name:"ContentInfo",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.ContentType",tagClass:n.Class.UNIVERSAL,type:n.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:n.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,captureAsn1:"content"}]};jQ.contentInfoValidator=i7;var o7={name:"EncryptedContentInfo",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentType",tagClass:n.Class.UNIVERSAL,type:n.Type.OID,constructed:!1,capture:"contentType"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentEncryptionAlgorithm.algorithm",tagClass:n.Class.UNIVERSAL,type:n.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm.parameter",tagClass:n.Class.UNIVERSAL,captureAsn1:"encParameter"}]},{name:"EncryptedContentInfo.encryptedContent",tagClass:n.Class.CONTEXT_SPECIFIC,type:0,capture:"encryptedContent",captureAsn1:"encryptedContentAsn1"}]};jQ.envelopedDataValidator={name:"EnvelopedData",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"EnvelopedData.Version",tagClass:n.Class.UNIVERSAL,type:n.Type.INTEGER,constructed:!1,capture:"version"},{name:"EnvelopedData.RecipientInfos",tagClass:n.Class.UNIVERSAL,type:n.Type.SET,constructed:!0,captureAsn1:"recipientInfos"}].concat(o7)};jQ.encryptedDataValidator={name:"EncryptedData",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedData.Version",tagClass:n.Class.UNIVERSAL,type:n.Type.INTEGER,constructed:!1,capture:"version"}].concat(o7)};var AU={name:"SignerInfo",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.version",tagClass:n.Class.UNIVERSAL,type:n.Type.INTEGER,constructed:!1},{name:"SignerInfo.issuerAndSerialNumber",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.issuerAndSerialNumber.issuer",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"SignerInfo.issuerAndSerialNumber.serialNumber",tagClass:n.Class.UNIVERSAL,type:n.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"SignerInfo.digestAlgorithm",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.digestAlgorithm.algorithm",tagClass:n.Class.UNIVERSAL,type:n.Type.OID,constructed:!1,capture:"digestAlgorithm"},{name:"SignerInfo.digestAlgorithm.parameter",tagClass:n.Class.UNIVERSAL,constructed:!1,captureAsn1:"digestParameter",optional:!0}]},{name:"SignerInfo.authenticatedAttributes",tagClass:n.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"authenticatedAttributes"},{name:"SignerInfo.digestEncryptionAlgorithm",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,capture:"signatureAlgorithm"},{name:"SignerInfo.encryptedDigest",tagClass:n.Class.UNIVERSAL,type:n.Type.OCTETSTRING,constructed:!1,capture:"signature"},{name:"SignerInfo.unauthenticatedAttributes",tagClass:n.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,capture:"unauthenticatedAttributes"}]};jQ.signedDataValidator={name:"SignedData",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"SignedData.Version",tagClass:n.Class.UNIVERSAL,type:n.Type.INTEGER,constructed:!1,capture:"version"},{name:"SignedData.DigestAlgorithms",tagClass:n.Class.UNIVERSAL,type:n.Type.SET,constructed:!0,captureAsn1:"digestAlgorithms"},i7,{name:"SignedData.Certificates",tagClass:n.Class.CONTEXT_SPECIFIC,type:0,optional:!0,captureAsn1:"certificates"},{name:"SignedData.CertificateRevocationLists",tagClass:n.Class.CONTEXT_SPECIFIC,type:1,optional:!0,captureAsn1:"crls"},{name:"SignedData.SignerInfos",tagClass:n.Class.UNIVERSAL,type:n.Type.SET,capture:"signerInfos",optional:!0,value:[AU]}]};jQ.recipientInfoValidator={name:"RecipientInfo",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.version",tagClass:n.Class.UNIVERSAL,type:n.Type.INTEGER,constructed:!1,capture:"version"},{name:"RecipientInfo.issuerAndSerial",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.issuerAndSerial.issuer",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"RecipientInfo.issuerAndSerial.serialNumber",tagClass:n.Class.UNIVERSAL,type:n.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"RecipientInfo.keyEncryptionAlgorithm",tagClass:n.Class.UNIVERSAL,type:n.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.keyEncryptionAlgorithm.algorithm",tagClass:n.Class.UNIVERSAL,type:n.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"RecipientInfo.keyEncryptionAlgorithm.parameter",tagClass:n.Class.UNIVERSAL,constructed:!1,captureAsn1:"encParameter",optional:!0}]},{name:"RecipientInfo.encryptedKey",tagClass:n.Class.UNIVERSAL,type:n.Type.OCTETSTRING,constructed:!1,capture:"encKey"}]}});var s9=H$((_E,r7)=>{var JQ=K$();w$();JQ.mgf=JQ.mgf||{};var LU=r7.exports=JQ.mgf.mgf1=JQ.mgf1=JQ.mgf1||{};LU.create=function($){var J={generate:function(X,Q){var Y=new JQ.util.ByteBuffer,G=Math.ceil(Q/$.digestLength);for(var W=0;W<G;W++){var O=new JQ.util.ByteBuffer;O.putInt32(W),$.start(),$.update(X+O.getBytes()),Y.putBuffer($.digest())}return Y.truncate(Y.length()-Q),Y.getBytes()}};return J}});var t7=H$((xE,s7)=>{var FY=K$();s9();s7.exports=FY.mgf=FY.mgf||{};FY.mgf.mgf1=FY.mgf1});var NY=H$((vE,e7)=>{var QQ=K$();P0();w$();var DU=e7.exports=QQ.pss=QQ.pss||{};DU.create=function($){if(arguments.length===3)$={md:arguments[0],mgf:arguments[1],saltLength:arguments[2]};var{md:J,mgf:X}=$,Q=J.digestLength,Y=$.salt||null;if(typeof Y==="string")Y=QQ.util.createBuffer(Y);var G;if("saltLength"in $)G=$.saltLength;else if(Y!==null)G=Y.length();else throw Error("Salt length not specified or specific salt not given.");if(Y!==null&&Y.length()!==G)throw Error("Given salt length does not match length of given salt.");var W=$.prng||QQ.random,O={};return O.encode=function(M,U){var H,V=U-1,q=Math.ceil(V/8),z=M.digest().getBytes();if(q<Q+G+2)throw Error("Message is too long to encrypt.");var K;if(Y===null)K=W.getBytesSync(G);else K=Y.bytes();var L=new QQ.util.ByteBuffer;L.fillWithByte(0,8),L.putBytes(z),L.putBytes(K),J.start(),J.update(L.getBytes());var A=J.digest().getBytes(),D=new QQ.util.ByteBuffer;D.fillWithByte(0,q-G-Q-2),D.putByte(1),D.putBytes(K);var j=D.getBytes(),S=q-Q-1,P=X.generate(A,S),C="";for(H=0;H<S;H++)C+=String.fromCharCode(j.charCodeAt(H)^P.charCodeAt(H));var w=65280>>8*q-V&255;return C=String.fromCharCode(C.charCodeAt(0)&~w)+C.substr(1),C+A+String.fromCharCode(188)},O.verify=function(M,U,H){var V,q=H-1,z=Math.ceil(q/8);if(U=U.substr(-z),z<Q+G+2)throw Error("Inconsistent parameters to PSS signature verification.");if(U.charCodeAt(z-1)!==188)throw Error("Encoded message does not end in 0xBC.");var K=z-Q-1,L=U.substr(0,K),A=U.substr(K,Q),D=65280>>8*z-q&255;if((L.charCodeAt(0)&D)!==0)throw Error("Bits beyond keysize not zero as expected.");var j=X.generate(A,K),S="";for(V=0;V<K;V++)S+=String.fromCharCode(L.charCodeAt(V)^j.charCodeAt(V));S=String.fromCharCode(S.charCodeAt(0)&~D)+S.substr(1);var P=z-Q-G-2;for(V=0;V<P;V++)if(S.charCodeAt(V)!==0)throw Error("Leftmost octets not zero as expected");if(S.charCodeAt(P)!==1)throw Error("Inconsistent PSS signature, 0x01 marker not found");var C=S.substr(-G),w=new QQ.util.ByteBuffer;w.fillWithByte(0,8),w.putBytes(M),w.putBytes(C),J.start(),J.update(w.getBytes());var b=J.digest().getBytes();return A===b},O}});var DY=H$((kE,Y1)=>{var $$=K$();SJ();m0();qX();t0();t7();jJ();sJ();NY();zX();w$();var E=$$.asn1,u=Y1.exports=$$.pki=$$.pki||{},C$=u.oids,g$={};g$.CN=C$.commonName;g$.commonName="CN";g$.C=C$.countryName;g$.countryName="C";g$.L=C$.localityName;g$.localityName="L";g$.ST=C$.stateOrProvinceName;g$.stateOrProvinceName="ST";g$.O=C$.organizationName;g$.organizationName="O";g$.OU=C$.organizationalUnitName;g$.organizationalUnitName="OU";g$.E=C$.emailAddress;g$.emailAddress="E";var J1=$$.pki.rsa.publicKeyValidator,RU={name:"Certificate",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,captureAsn1:"tbsCertificate",value:[{name:"Certificate.TBSCertificate.version",tagClass:E.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.version.integer",tagClass:E.Class.UNIVERSAL,type:E.Type.INTEGER,constructed:!1,capture:"certVersion"}]},{name:"Certificate.TBSCertificate.serialNumber",tagClass:E.Class.UNIVERSAL,type:E.Type.INTEGER,constructed:!1,capture:"certSerialNumber"},{name:"Certificate.TBSCertificate.signature",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.signature.algorithm",tagClass:E.Class.UNIVERSAL,type:E.Type.OID,constructed:!1,capture:"certinfoSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:E.Class.UNIVERSAL,optional:!0,captureAsn1:"certinfoSignatureParams"}]},{name:"Certificate.TBSCertificate.issuer",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,captureAsn1:"certIssuer"},{name:"Certificate.TBSCertificate.validity",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.validity.notBefore (utc)",tagClass:E.Class.UNIVERSAL,type:E.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity1UTCTime"},{name:"Certificate.TBSCertificate.validity.notBefore (generalized)",tagClass:E.Class.UNIVERSAL,type:E.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity2GeneralizedTime"},{name:"Certificate.TBSCertificate.validity.notAfter (utc)",tagClass:E.Class.UNIVERSAL,type:E.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity3UTCTime"},{name:"Certificate.TBSCertificate.validity.notAfter (generalized)",tagClass:E.Class.UNIVERSAL,type:E.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity4GeneralizedTime"}]},{name:"Certificate.TBSCertificate.subject",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,captureAsn1:"certSubject"},J1,{name:"Certificate.TBSCertificate.issuerUniqueID",tagClass:E.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.issuerUniqueID.id",tagClass:E.Class.UNIVERSAL,type:E.Type.BITSTRING,constructed:!1,captureBitStringValue:"certIssuerUniqueId"}]},{name:"Certificate.TBSCertificate.subjectUniqueID",tagClass:E.Class.CONTEXT_SPECIFIC,type:2,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.subjectUniqueID.id",tagClass:E.Class.UNIVERSAL,type:E.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSubjectUniqueId"}]},{name:"Certificate.TBSCertificate.extensions",tagClass:E.Class.CONTEXT_SPECIFIC,type:3,constructed:!0,captureAsn1:"certExtensions",optional:!0}]},{name:"Certificate.signatureAlgorithm",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.signatureAlgorithm.algorithm",tagClass:E.Class.UNIVERSAL,type:E.Type.OID,constructed:!1,capture:"certSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:E.Class.UNIVERSAL,optional:!0,captureAsn1:"certSignatureParams"}]},{name:"Certificate.signatureValue",tagClass:E.Class.UNIVERSAL,type:E.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSignature"}]},ZU={name:"rsapss",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.hashAlgorithm",tagClass:E.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier",tagClass:E.Class.UNIVERSAL,type:E.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier.algorithm",tagClass:E.Class.UNIVERSAL,type:E.Type.OID,constructed:!1,capture:"hashOid"}]}]},{name:"rsapss.maskGenAlgorithm",tagClass:E.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier",tagClass:E.Class.UNIVERSAL,type:E.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.algorithm",tagClass:E.Class.UNIVERSAL,type:E.Type.OID,constructed:!1,capture:"maskGenOid"},{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params.algorithm",tagClass:E.Class.UNIVERSAL,type:E.Type.OID,constructed:!1,capture:"maskGenHashOid"}]}]}]},{name:"rsapss.saltLength",tagClass:E.Class.CONTEXT_SPECIFIC,type:2,optional:!0,value:[{name:"rsapss.saltLength.saltLength",tagClass:E.Class.UNIVERSAL,type:E.Class.INTEGER,constructed:!1,capture:"saltLength"}]},{name:"rsapss.trailerField",tagClass:E.Class.CONTEXT_SPECIFIC,type:3,optional:!0,value:[{name:"rsapss.trailer.trailer",tagClass:E.Class.UNIVERSAL,type:E.Class.INTEGER,constructed:!1,capture:"trailer"}]}]},BU={name:"CertificationRequestInfo",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfo",value:[{name:"CertificationRequestInfo.integer",tagClass:E.Class.UNIVERSAL,type:E.Type.INTEGER,constructed:!1,capture:"certificationRequestInfoVersion"},{name:"CertificationRequestInfo.subject",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfoSubject"},J1,{name:"CertificationRequestInfo.attributes",tagClass:E.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"certificationRequestInfoAttributes",value:[{name:"CertificationRequestInfo.attributes",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequestInfo.attributes.type",tagClass:E.Class.UNIVERSAL,type:E.Type.OID,constructed:!1},{name:"CertificationRequestInfo.attributes.value",tagClass:E.Class.UNIVERSAL,type:E.Type.SET,constructed:!0}]}]}]},TU={name:"CertificationRequest",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,captureAsn1:"csr",value:[BU,{name:"CertificationRequest.signatureAlgorithm",tagClass:E.Class.UNIVERSAL,type:E.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequest.signatureAlgorithm.algorithm",tagClass:E.Class.UNIVERSAL,type:E.Type.OID,constructed:!1,capture:"csrSignatureOid"},{name:"CertificationRequest.signatureAlgorithm.parameters",tagClass:E.Class.UNIVERSAL,optional:!0,captureAsn1:"csrSignatureParams"}]},{name:"CertificationRequest.signature",tagClass:E.Class.UNIVERSAL,type:E.Type.BITSTRING,constructed:!1,captureBitStringValue:"csrSignature"}]};u.RDNAttributesAsArray=function($,J){var X=[],Q,Y,G;for(var W=0;W<$.value.length;++W){Q=$.value[W];for(var O=0;O<Q.value.length;++O){if(G={},Y=Q.value[O],G.type=E.derToOid(Y.value[0].value),G.value=Y.value[1].value,G.valueTagClass=Y.value[1].type,G.type in C$){if(G.name=C$[G.type],G.name in g$)G.shortName=g$[G.name]}if(J)J.update(G.type),J.update(G.value);X.push(G)}}return X};u.CRIAttributesAsArray=function($){var J=[];for(var X=0;X<$.length;++X){var Q=$[X],Y=E.derToOid(Q.value[0].value),G=Q.value[1].value;for(var W=0;W<G.length;++W){var O={};if(O.type=Y,O.value=G[W].value,O.valueTagClass=G[W].type,O.type in C$){if(O.name=C$[O.type],O.name in g$)O.shortName=g$[O.name]}if(O.type===C$.extensionRequest){O.extensions=[];for(var M=0;M<O.value.length;++M)O.extensions.push(u.certificateExtensionFromAsn1(O.value[M]))}J.push(O)}}return J};function wJ($,J){if(typeof J==="string")J={shortName:J};var X=null,Q;for(var Y=0;X===null&&Y<$.attributes.length;++Y)if(Q=$.attributes[Y],J.type&&J.type===Q.type)X=Q;else if(J.name&&J.name===Q.name)X=Q;else if(J.shortName&&J.shortName===Q.shortName)X=Q;return X}var AY=function($,J,X){var Q={};if($!==C$["RSASSA-PSS"])return Q;if(X)Q={hash:{algorithmOid:C$.sha1},mgf:{algorithmOid:C$.mgf1,hash:{algorithmOid:C$.sha1}},saltLength:20};var Y={},G=[];if(!E.validate(J,ZU,Y,G)){var W=Error("Cannot read RSASSA-PSS parameter block.");throw W.errors=G,W}if(Y.hashOid!==void 0)Q.hash=Q.hash||{},Q.hash.algorithmOid=E.derToOid(Y.hashOid);if(Y.maskGenOid!==void 0)Q.mgf=Q.mgf||{},Q.mgf.algorithmOid=E.derToOid(Y.maskGenOid),Q.mgf.hash=Q.mgf.hash||{},Q.mgf.hash.algorithmOid=E.derToOid(Y.maskGenHashOid);if(Y.saltLength!==void 0)Q.saltLength=Y.saltLength.charCodeAt(0);return Q},LY=function($){switch(C$[$.signatureOid]){case"sha1WithRSAEncryption":case"sha1WithRSASignature":return $$.md.sha1.create();case"md5WithRSAEncryption":return $$.md.md5.create();case"sha256WithRSAEncryption":return $$.md.sha256.create();case"sha384WithRSAEncryption":return $$.md.sha384.create();case"sha512WithRSAEncryption":return $$.md.sha512.create();case"RSASSA-PSS":return $$.md.sha256.create();default:var J=Error("Could not compute "+$.type+" digest. Unknown signature OID.");throw J.signatureOid=$.signatureOid,J}},Q1=function($){var J=$.certificate,X;switch(J.signatureOid){case C$.sha1WithRSAEncryption:case C$.sha1WithRSASignature:break;case C$["RSASSA-PSS"]:var Q,Y;if(Q=C$[J.signatureParameters.mgf.hash.algorithmOid],Q===void 0||$$.md[Q]===void 0){var G=Error("Unsupported MGF hash function.");throw G.oid=J.signatureParameters.mgf.hash.algorithmOid,G.name=Q,G}if(Y=C$[J.signatureParameters.mgf.algorithmOid],Y===void 0||$$.mgf[Y]===void 0){var G=Error("Unsupported MGF function.");throw G.oid=J.signatureParameters.mgf.algorithmOid,G.name=Y,G}if(Y=$$.mgf[Y].create($$.md[Q].create()),Q=C$[J.signatureParameters.hash.algorithmOid],Q===void 0||$$.md[Q]===void 0){var G=Error("Unsupported RSASSA-PSS hash function.");throw G.oid=J.signatureParameters.hash.algorithmOid,G.name=Q,G}X=$$.pss.create($$.md[Q].create(),Y,J.signatureParameters.saltLength);break}return J.publicKey.verify($.md.digest().getBytes(),$.signature,X)};u.certificateFromPem=function($,J,X){var Q=$$.pem.decode($)[0];if(Q.type!=="CERTIFICATE"&&Q.type!=="X509 CERTIFICATE"&&Q.type!=="TRUSTED CERTIFICATE"){var Y=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var G=E.fromDer(Q.body,X);return u.certificateFromAsn1(G,J)};u.certificateToPem=function($,J){var X={type:"CERTIFICATE",body:E.toDer(u.certificateToAsn1($)).getBytes()};return $$.pem.encode(X,{maxline:J})};u.publicKeyFromPem=function($){var J=$$.pem.decode($)[0];if(J.type!=="PUBLIC KEY"&&J.type!=="RSA PUBLIC KEY"){var X=Error('Could not convert public key from PEM; PEM header type is not "PUBLIC KEY" or "RSA PUBLIC KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert public key from PEM; PEM is encrypted.");var Q=E.fromDer(J.body);return u.publicKeyFromAsn1(Q)};u.publicKeyToPem=function($,J){var X={type:"PUBLIC KEY",body:E.toDer(u.publicKeyToAsn1($)).getBytes()};return $$.pem.encode(X,{maxline:J})};u.publicKeyToRSAPublicKeyPem=function($,J){var X={type:"RSA PUBLIC KEY",body:E.toDer(u.publicKeyToRSAPublicKey($)).getBytes()};return $$.pem.encode(X,{maxline:J})};u.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||$$.md.sha1.create(),Q=J.type||"RSAPublicKey",Y;switch(Q){case"RSAPublicKey":Y=E.toDer(u.publicKeyToRSAPublicKey($)).getBytes();break;case"SubjectPublicKeyInfo":Y=E.toDer(u.publicKeyToAsn1($)).getBytes();break;default:throw Error('Unknown fingerprint type "'+J.type+'".')}X.start(),X.update(Y);var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};u.certificationRequestFromPem=function($,J,X){var Q=$$.pem.decode($)[0];if(Q.type!=="CERTIFICATE REQUEST"){var Y=Error('Could not convert certification request from PEM; PEM header type is not "CERTIFICATE REQUEST".');throw Y.headerType=Q.type,Y}if(Q.procType&&Q.procType.type==="ENCRYPTED")throw Error("Could not convert certification request from PEM; PEM is encrypted.");var G=E.fromDer(Q.body,X);return u.certificationRequestFromAsn1(G,J)};u.certificationRequestToPem=function($,J){var X={type:"CERTIFICATE REQUEST",body:E.toDer(u.certificationRequestToAsn1($)).getBytes()};return $$.pem.encode(X,{maxline:J})};u.createCertificate=function(){var $={};return $.version=2,$.serialNumber="00",$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.validity={},$.validity.notBefore=new Date,$.validity.notAfter=new Date,$.issuer={},$.issuer.getField=function(J){return wJ($.issuer,J)},$.issuer.addField=function(J){v0([J]),$.issuer.attributes.push(J)},$.issuer.attributes=[],$.issuer.hash=null,$.subject={},$.subject.getField=function(J){return wJ($.subject,J)},$.subject.addField=function(J){v0([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.extensions=[],$.publicKey=null,$.md=null,$.setSubject=function(J,X){if(v0(J),$.subject.attributes=J,delete $.subject.uniqueId,X)$.subject.uniqueId=X;$.subject.hash=null},$.setIssuer=function(J,X){if(v0(J),$.issuer.attributes=J,delete $.issuer.uniqueId,X)$.issuer.uniqueId=X;$.issuer.hash=null},$.setExtensions=function(J){for(var X=0;X<J.length;++X)X1(J[X],{cert:$});$.extensions=J},$.getExtension=function(J){if(typeof J==="string")J={name:J};var X=null,Q;for(var Y=0;X===null&&Y<$.extensions.length;++Y)if(Q=$.extensions[Y],J.id&&Q.id===J.id)X=Q;else if(J.name&&Q.name===J.name)X=Q;return X},$.sign=function(J,X){$.md=X||$$.md.sha1.create();var Q=C$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certificate digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.tbsCertificate=u.getTBSCertificate($);var G=E.toDer($.tbsCertificate);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(J){var X=!1;if(!$.issued(J)){var Q=J.issuer,Y=$.subject,G=Error("The parent certificate did not issue the given child certificate; the child certificate's issuer does not match the parent's subject.");throw G.expectedIssuer=Y.attributes,G.actualIssuer=Q.attributes,G}var W=J.md;if(W===null){W=LY({signatureOid:J.signatureOid,type:"certificate"});var O=J.tbsCertificate||u.getTBSCertificate(J),M=E.toDer(O);W.update(M.getBytes())}if(W!==null)X=Q1({certificate:$,md:W,signature:J.signature});return X},$.isIssuer=function(J){var X=!1,Q=$.issuer,Y=J.subject;if(Q.hash&&Y.hash)X=Q.hash===Y.hash;else if(Q.attributes.length===Y.attributes.length){X=!0;var G,W;for(var O=0;X&&O<Q.attributes.length;++O)if(G=Q.attributes[O],W=Y.attributes[O],G.type!==W.type||G.value!==W.value)X=!1}return X},$.issued=function(J){return J.isIssuer($)},$.generateSubjectKeyIdentifier=function(){return u.getPublicKeyFingerprint($.publicKey,{type:"RSAPublicKey"})},$.verifySubjectKeyIdentifier=function(){var J=C$.subjectKeyIdentifier;for(var X=0;X<$.extensions.length;++X){var Q=$.extensions[X];if(Q.id===J){var Y=$.generateSubjectKeyIdentifier().getBytes();return $$.util.hexToBytes(Q.subjectKeyIdentifier)===Y}}return!1},$};u.certificateFromAsn1=function($,J){var X={},Q=[];if(!E.validate($,RU,X,Q)){var Y=Error("Cannot read X.509 certificate. ASN.1 object is not an X509v3 Certificate.");throw Y.errors=Q,Y}var G=E.derToOid(X.publicKeyOid);if(G!==u.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=u.createCertificate();W.version=X.certVersion?X.certVersion.charCodeAt(0):0;var O=$$.util.createBuffer(X.certSerialNumber);W.serialNumber=O.toHex(),W.signatureOid=$$.asn1.derToOid(X.certSignatureOid),W.signatureParameters=AY(W.signatureOid,X.certSignatureParams,!0),W.siginfo.algorithmOid=$$.asn1.derToOid(X.certinfoSignatureOid),W.siginfo.parameters=AY(W.siginfo.algorithmOid,X.certinfoSignatureParams,!1),W.signature=X.certSignature;var M=[];if(X.certValidity1UTCTime!==void 0)M.push(E.utcTimeToDate(X.certValidity1UTCTime));if(X.certValidity2GeneralizedTime!==void 0)M.push(E.generalizedTimeToDate(X.certValidity2GeneralizedTime));if(X.certValidity3UTCTime!==void 0)M.push(E.utcTimeToDate(X.certValidity3UTCTime));if(X.certValidity4GeneralizedTime!==void 0)M.push(E.generalizedTimeToDate(X.certValidity4GeneralizedTime));if(M.length>2)throw Error("Cannot read notBefore/notAfter validity times; more than two times were provided in the certificate.");if(M.length<2)throw Error("Cannot read notBefore/notAfter validity times; they were not provided as either UTCTime or GeneralizedTime.");if(W.validity.notBefore=M[0],W.validity.notAfter=M[1],W.tbsCertificate=X.tbsCertificate,J){W.md=LY({signatureOid:W.signatureOid,type:"certificate"});var U=E.toDer(W.tbsCertificate);W.md.update(U.getBytes())}var H=$$.md.sha1.create(),V=E.toDer(X.certIssuer);if(H.update(V.getBytes()),W.issuer.getField=function(K){return wJ(W.issuer,K)},W.issuer.addField=function(K){v0([K]),W.issuer.attributes.push(K)},W.issuer.attributes=u.RDNAttributesAsArray(X.certIssuer),X.certIssuerUniqueId)W.issuer.uniqueId=X.certIssuerUniqueId;W.issuer.hash=H.digest().toHex();var q=$$.md.sha1.create(),z=E.toDer(X.certSubject);if(q.update(z.getBytes()),W.subject.getField=function(K){return wJ(W.subject,K)},W.subject.addField=function(K){v0([K]),W.subject.attributes.push(K)},W.subject.attributes=u.RDNAttributesAsArray(X.certSubject),X.certSubjectUniqueId)W.subject.uniqueId=X.certSubjectUniqueId;if(W.subject.hash=q.digest().toHex(),X.certExtensions)W.extensions=u.certificateExtensionsFromAsn1(X.certExtensions);else W.extensions=[];return W.publicKey=u.publicKeyFromAsn1(X.subjectPublicKeyInfo),W};u.certificateExtensionsFromAsn1=function($){var J=[];for(var X=0;X<$.value.length;++X){var Q=$.value[X];for(var Y=0;Y<Q.value.length;++Y)J.push(u.certificateExtensionFromAsn1(Q.value[Y]))}return J};u.certificateExtensionFromAsn1=function($){var J={};if(J.id=E.derToOid($.value[0].value),J.critical=!1,$.value[1].type===E.Type.BOOLEAN)J.critical=$.value[1].value.charCodeAt(0)!==0,J.value=$.value[2].value;else J.value=$.value[1].value;if(J.id in C$){if(J.name=C$[J.id],J.name==="keyUsage"){var X=E.fromDer(J.value),Q=0,Y=0;if(X.value.length>1)Q=X.value.charCodeAt(1),Y=X.value.length>2?X.value.charCodeAt(2):0;J.digitalSignature=(Q&128)===128,J.nonRepudiation=(Q&64)===64,J.keyEncipherment=(Q&32)===32,J.dataEncipherment=(Q&16)===16,J.keyAgreement=(Q&8)===8,J.keyCertSign=(Q&4)===4,J.cRLSign=(Q&2)===2,J.encipherOnly=(Q&1)===1,J.decipherOnly=(Y&128)===128}else if(J.name==="basicConstraints"){var X=E.fromDer(J.value);if(X.value.length>0&&X.value[0].type===E.Type.BOOLEAN)J.cA=X.value[0].value.charCodeAt(0)!==0;else J.cA=!1;var G=null;if(X.value.length>0&&X.value[0].type===E.Type.INTEGER)G=X.value[0].value;else if(X.value.length>1)G=X.value[1].value;if(G!==null)J.pathLenConstraint=E.derToInteger(G)}else if(J.name==="extKeyUsage"){var X=E.fromDer(J.value);for(var W=0;W<X.value.length;++W){var O=E.derToOid(X.value[W].value);if(O in C$)J[C$[O]]=!0;else J[O]=!0}}else if(J.name==="nsCertType"){var X=E.fromDer(J.value),Q=0;if(X.value.length>1)Q=X.value.charCodeAt(1);J.client=(Q&128)===128,J.server=(Q&64)===64,J.email=(Q&32)===32,J.objsign=(Q&16)===16,J.reserved=(Q&8)===8,J.sslCA=(Q&4)===4,J.emailCA=(Q&2)===2,J.objCA=(Q&1)===1}else if(J.name==="subjectAltName"||J.name==="issuerAltName"){J.altNames=[];var M,X=E.fromDer(J.value);for(var U=0;U<X.value.length;++U){M=X.value[U];var H={type:M.type,value:M.value};switch(J.altNames.push(H),M.type){case 1:case 2:case 6:break;case 7:H.ip=$$.util.bytesToIP(M.value);break;case 8:H.oid=E.derToOid(M.value);break;default:}}}else if(J.name==="subjectKeyIdentifier"){var X=E.fromDer(J.value);J.subjectKeyIdentifier=$$.util.bytesToHex(X.value)}}return J};u.certificationRequestFromAsn1=function($,J){var X={},Q=[];if(!E.validate($,TU,X,Q)){var Y=Error("Cannot read PKCS#10 certificate request. ASN.1 object is not a PKCS#10 CertificationRequest.");throw Y.errors=Q,Y}var G=E.derToOid(X.publicKeyOid);if(G!==u.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var W=u.createCertificationRequest();if(W.version=X.csrVersion?X.csrVersion.charCodeAt(0):0,W.signatureOid=$$.asn1.derToOid(X.csrSignatureOid),W.signatureParameters=AY(W.signatureOid,X.csrSignatureParams,!0),W.siginfo.algorithmOid=$$.asn1.derToOid(X.csrSignatureOid),W.siginfo.parameters=AY(W.siginfo.algorithmOid,X.csrSignatureParams,!1),W.signature=X.csrSignature,W.certificationRequestInfo=X.certificationRequestInfo,J){W.md=LY({signatureOid:W.signatureOid,type:"certification request"});var O=E.toDer(W.certificationRequestInfo);W.md.update(O.getBytes())}var M=$$.md.sha1.create();return W.subject.getField=function(U){return wJ(W.subject,U)},W.subject.addField=function(U){v0([U]),W.subject.attributes.push(U)},W.subject.attributes=u.RDNAttributesAsArray(X.certificationRequestInfoSubject,M),W.subject.hash=M.digest().toHex(),W.publicKey=u.publicKeyFromAsn1(X.subjectPublicKeyInfo),W.getAttribute=function(U){return wJ(W,U)},W.addAttribute=function(U){v0([U]),W.attributes.push(U)},W.attributes=u.CRIAttributesAsArray(X.certificationRequestInfoAttributes||[]),W};u.createCertificationRequest=function(){var $={};return $.version=0,$.signatureOid=null,$.signature=null,$.siginfo={},$.siginfo.algorithmOid=null,$.subject={},$.subject.getField=function(J){return wJ($.subject,J)},$.subject.addField=function(J){v0([J]),$.subject.attributes.push(J)},$.subject.attributes=[],$.subject.hash=null,$.publicKey=null,$.attributes=[],$.getAttribute=function(J){return wJ($,J)},$.addAttribute=function(J){v0([J]),$.attributes.push(J)},$.md=null,$.setSubject=function(J){v0(J),$.subject.attributes=J,$.subject.hash=null},$.setAttributes=function(J){v0(J),$.attributes=J},$.sign=function(J,X){$.md=X||$$.md.sha1.create();var Q=C$[$.md.algorithm+"WithRSAEncryption"];if(!Q){var Y=Error("Could not compute certification request digest. Unknown message digest algorithm OID.");throw Y.algorithm=$.md.algorithm,Y}$.signatureOid=$.siginfo.algorithmOid=Q,$.certificationRequestInfo=u.getCertificationRequestInfo($);var G=E.toDer($.certificationRequestInfo);$.md.update(G.getBytes()),$.signature=J.sign($.md)},$.verify=function(){var J=!1,X=$.md;if(X===null){X=LY({signatureOid:$.signatureOid,type:"certification request"});var Q=$.certificationRequestInfo||u.getCertificationRequestInfo($),Y=E.toDer(Q);X.update(Y.getBytes())}if(X!==null)J=Q1({certificate:$,md:X,signature:$.signature});return J},$};function CQ($){var J=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]),X,Q,Y=$.attributes;for(var G=0;G<Y.length;++G){X=Y[G];var W=X.value,O=E.Type.PRINTABLESTRING;if("valueTagClass"in X){if(O=X.valueTagClass,O===E.Type.UTF8)W=$$.util.encodeUtf8(W)}Q=E.create(E.Class.UNIVERSAL,E.Type.SET,!0,[E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer(X.type).getBytes()),E.create(E.Class.UNIVERSAL,O,!1,W)])]),J.value.push(Q)}return J}function v0($){var J;for(var X=0;X<$.length;++X){if(J=$[X],typeof J.name>"u"){if(J.type&&J.type in u.oids)J.name=u.oids[J.type];else if(J.shortName&&J.shortName in g$)J.name=u.oids[g$[J.shortName]]}if(typeof J.type>"u")if(J.name&&J.name in u.oids)J.type=u.oids[J.name];else{var Q=Error("Attribute type not specified.");throw Q.attribute=J,Q}if(typeof J.shortName>"u"){if(J.name&&J.name in g$)J.shortName=g$[J.name]}if(J.type===C$.extensionRequest){if(J.valueConstructed=!0,J.valueTagClass=E.Type.SEQUENCE,!J.value&&J.extensions){J.value=[];for(var Y=0;Y<J.extensions.length;++Y)J.value.push(u.certificateExtensionToAsn1(X1(J.extensions[Y])))}}if(typeof J.value>"u"){var Q=Error("Attribute value not specified.");throw Q.attribute=J,Q}}}function X1($,J){if(J=J||{},typeof $.name>"u"){if($.id&&$.id in u.oids)$.name=u.oids[$.id]}if(typeof $.id>"u")if($.name&&$.name in u.oids)$.id=u.oids[$.name];else{var X=Error("Extension ID not specified.");throw X.extension=$,X}if(typeof $.value<"u")return $;if($.name==="keyUsage"){var Q=0,Y=0,G=0;if($.digitalSignature)Y|=128,Q=7;if($.nonRepudiation)Y|=64,Q=6;if($.keyEncipherment)Y|=32,Q=5;if($.dataEncipherment)Y|=16,Q=4;if($.keyAgreement)Y|=8,Q=3;if($.keyCertSign)Y|=4,Q=2;if($.cRLSign)Y|=2,Q=1;if($.encipherOnly)Y|=1,Q=0;if($.decipherOnly)G|=128,Q=7;var W=String.fromCharCode(Q);if(G!==0)W+=String.fromCharCode(Y)+String.fromCharCode(G);else if(Y!==0)W+=String.fromCharCode(Y);$.value=E.create(E.Class.UNIVERSAL,E.Type.BITSTRING,!1,W)}else if($.name==="basicConstraints"){if($.value=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]),$.cA)$.value.value.push(E.create(E.Class.UNIVERSAL,E.Type.BOOLEAN,!1,String.fromCharCode(255)));if("pathLenConstraint"in $)$.value.value.push(E.create(E.Class.UNIVERSAL,E.Type.INTEGER,!1,E.integerToDer($.pathLenConstraint).getBytes()))}else if($.name==="extKeyUsage"){$.value=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]);var O=$.value.value;for(var M in $){if($[M]!==!0)continue;if(M in C$)O.push(E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer(C$[M]).getBytes()));else if(M.indexOf(".")!==-1)O.push(E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer(M).getBytes()))}}else if($.name==="nsCertType"){var Q=0,Y=0;if($.client)Y|=128,Q=7;if($.server)Y|=64,Q=6;if($.email)Y|=32,Q=5;if($.objsign)Y|=16,Q=4;if($.reserved)Y|=8,Q=3;if($.sslCA)Y|=4,Q=2;if($.emailCA)Y|=2,Q=1;if($.objCA)Y|=1,Q=0;var W=String.fromCharCode(Q);if(Y!==0)W+=String.fromCharCode(Y);$.value=E.create(E.Class.UNIVERSAL,E.Type.BITSTRING,!1,W)}else if($.name==="subjectAltName"||$.name==="issuerAltName"){$.value=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]);var U;for(var H=0;H<$.altNames.length;++H){U=$.altNames[H];var W=U.value;if(U.type===7&&U.ip){if(W=$$.util.bytesFromIP(U.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(U.type===8)if(U.oid)W=E.oidToDer(E.oidToDer(U.oid));else W=E.oidToDer(W);$.value.value.push(E.create(E.Class.CONTEXT_SPECIFIC,U.type,!1,W))}}else if($.name==="nsComment"&&J.cert){if(!/^[\x00-\x7F]*$/.test($.comment)||$.comment.length<1||$.comment.length>128)throw Error('Invalid "nsComment" content.');$.value=E.create(E.Class.UNIVERSAL,E.Type.IA5STRING,!1,$.comment)}else if($.name==="subjectKeyIdentifier"&&J.cert){var V=J.cert.generateSubjectKeyIdentifier();$.subjectKeyIdentifier=V.toHex(),$.value=E.create(E.Class.UNIVERSAL,E.Type.OCTETSTRING,!1,V.getBytes())}else if($.name==="authorityKeyIdentifier"&&J.cert){$.value=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]);var O=$.value.value;if($.keyIdentifier){var q=$.keyIdentifier===!0?J.cert.generateSubjectKeyIdentifier().getBytes():$.keyIdentifier;O.push(E.create(E.Class.CONTEXT_SPECIFIC,0,!1,q))}if($.authorityCertIssuer){var z=[E.create(E.Class.CONTEXT_SPECIFIC,4,!0,[CQ($.authorityCertIssuer===!0?J.cert.issuer:$.authorityCertIssuer)])];O.push(E.create(E.Class.CONTEXT_SPECIFIC,1,!0,z))}if($.serialNumber){var K=$$.util.hexToBytes($.serialNumber===!0?J.cert.serialNumber:$.serialNumber);O.push(E.create(E.Class.CONTEXT_SPECIFIC,2,!1,K))}}else if($.name==="cRLDistributionPoints"){$.value=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]);var O=$.value.value,L=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]),A=E.create(E.Class.CONTEXT_SPECIFIC,0,!0,[]),U;for(var H=0;H<$.altNames.length;++H){U=$.altNames[H];var W=U.value;if(U.type===7&&U.ip){if(W=$$.util.bytesFromIP(U.ip),W===null){var X=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw X.extension=$,X}}else if(U.type===8)if(U.oid)W=E.oidToDer(E.oidToDer(U.oid));else W=E.oidToDer(W);A.value.push(E.create(E.Class.CONTEXT_SPECIFIC,U.type,!1,W))}L.value.push(E.create(E.Class.CONTEXT_SPECIFIC,0,!0,[A])),O.push(L)}if(typeof $.value>"u"){var X=Error("Extension value not specified.");throw X.extension=$,X}return $}function t9($,J){switch($){case C$["RSASSA-PSS"]:var X=[];if(J.hash.algorithmOid!==void 0)X.push(E.create(E.Class.CONTEXT_SPECIFIC,0,!0,[E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer(J.hash.algorithmOid).getBytes()),E.create(E.Class.UNIVERSAL,E.Type.NULL,!1,"")])]));if(J.mgf.algorithmOid!==void 0)X.push(E.create(E.Class.CONTEXT_SPECIFIC,1,!0,[E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer(J.mgf.algorithmOid).getBytes()),E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer(J.mgf.hash.algorithmOid).getBytes()),E.create(E.Class.UNIVERSAL,E.Type.NULL,!1,"")])])]));if(J.saltLength!==void 0)X.push(E.create(E.Class.CONTEXT_SPECIFIC,2,!0,[E.create(E.Class.UNIVERSAL,E.Type.INTEGER,!1,E.integerToDer(J.saltLength).getBytes())]));return E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,X);default:return E.create(E.Class.UNIVERSAL,E.Type.NULL,!1,"")}}function SU($){var J=E.create(E.Class.CONTEXT_SPECIFIC,0,!0,[]);if($.attributes.length===0)return J;var X=$.attributes;for(var Q=0;Q<X.length;++Q){var Y=X[Q],G=Y.value,W=E.Type.UTF8;if("valueTagClass"in Y)W=Y.valueTagClass;if(W===E.Type.UTF8)G=$$.util.encodeUtf8(G);var O=!1;if("valueConstructed"in Y)O=Y.valueConstructed;var M=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer(Y.type).getBytes()),E.create(E.Class.UNIVERSAL,E.Type.SET,!0,[E.create(E.Class.UNIVERSAL,W,O,G)])]);J.value.push(M)}return J}var jU=new Date("1950-01-01T00:00:00Z"),CU=new Date("2050-01-01T00:00:00Z");function $1($){if($>=jU&&$<CU)return E.create(E.Class.UNIVERSAL,E.Type.UTCTIME,!1,E.dateToUtcTime($));else return E.create(E.Class.UNIVERSAL,E.Type.GENERALIZEDTIME,!1,E.dateToGeneralizedTime($))}u.getTBSCertificate=function($){var J=$1($.validity.notBefore),X=$1($.validity.notAfter),Q=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.CONTEXT_SPECIFIC,0,!0,[E.create(E.Class.UNIVERSAL,E.Type.INTEGER,!1,E.integerToDer($.version).getBytes())]),E.create(E.Class.UNIVERSAL,E.Type.INTEGER,!1,$$.util.hexToBytes($.serialNumber)),E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer($.siginfo.algorithmOid).getBytes()),t9($.siginfo.algorithmOid,$.siginfo.parameters)]),CQ($.issuer),E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[J,X]),CQ($.subject),u.publicKeyToAsn1($.publicKey)]);if($.issuer.uniqueId)Q.value.push(E.create(E.Class.CONTEXT_SPECIFIC,1,!0,[E.create(E.Class.UNIVERSAL,E.Type.BITSTRING,!1,String.fromCharCode(0)+$.issuer.uniqueId)]));if($.subject.uniqueId)Q.value.push(E.create(E.Class.CONTEXT_SPECIFIC,2,!0,[E.create(E.Class.UNIVERSAL,E.Type.BITSTRING,!1,String.fromCharCode(0)+$.subject.uniqueId)]));if($.extensions.length>0)Q.value.push(u.certificateExtensionsToAsn1($.extensions));return Q};u.getCertificationRequestInfo=function($){var J=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.INTEGER,!1,E.integerToDer($.version).getBytes()),CQ($.subject),u.publicKeyToAsn1($.publicKey),SU($)]);return J};u.distinguishedNameToAsn1=function($){return CQ($)};u.certificateToAsn1=function($){var J=$.tbsCertificate||u.getTBSCertificate($);return E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[J,E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer($.signatureOid).getBytes()),t9($.signatureOid,$.signatureParameters)]),E.create(E.Class.UNIVERSAL,E.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};u.certificateExtensionsToAsn1=function($){var J=E.create(E.Class.CONTEXT_SPECIFIC,3,!0,[]),X=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]);J.value.push(X);for(var Q=0;Q<$.length;++Q)X.value.push(u.certificateExtensionToAsn1($[Q]));return J};u.certificateExtensionToAsn1=function($){var J=E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[]);if(J.value.push(E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer($.id).getBytes())),$.critical)J.value.push(E.create(E.Class.UNIVERSAL,E.Type.BOOLEAN,!1,String.fromCharCode(255)));var X=$.value;if(typeof $.value!=="string")X=E.toDer(X).getBytes();return J.value.push(E.create(E.Class.UNIVERSAL,E.Type.OCTETSTRING,!1,X)),J};u.certificationRequestToAsn1=function($){var J=$.certificationRequestInfo||u.getCertificationRequestInfo($);return E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[J,E.create(E.Class.UNIVERSAL,E.Type.SEQUENCE,!0,[E.create(E.Class.UNIVERSAL,E.Type.OID,!1,E.oidToDer($.signatureOid).getBytes()),t9($.signatureOid,$.signatureParameters)]),E.create(E.Class.UNIVERSAL,E.Type.BITSTRING,!1,String.fromCharCode(0)+$.signature)])};u.createCaStore=function($){var J={certs:{}};J.getIssuer=function(W){var O=X(W.issuer);return O},J.addCertificate=function(W){if(typeof W==="string")W=$$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))if(W.subject.hash in J.certs){var O=J.certs[W.subject.hash];if(!$$.util.isArray(O))O=[O];O.push(W),J.certs[W.subject.hash]=O}else J.certs[W.subject.hash]=W},J.hasCertificate=function(W){if(typeof W==="string")W=$$.pki.certificateFromPem(W);var O=X(W.subject);if(!O)return!1;if(!$$.util.isArray(O))O=[O];var M=E.toDer(u.certificateToAsn1(W)).getBytes();for(var U=0;U<O.length;++U){var H=E.toDer(u.certificateToAsn1(O[U])).getBytes();if(M===H)return!0}return!1},J.listAllCertificates=function(){var W=[];for(var O in J.certs)if(J.certs.hasOwnProperty(O)){var M=J.certs[O];if(!$$.util.isArray(M))W.push(M);else for(var U=0;U<M.length;++U)W.push(M[U])}return W},J.removeCertificate=function(W){var O;if(typeof W==="string")W=$$.pki.certificateFromPem(W);if(Q(W.subject),!J.hasCertificate(W))return null;var M=X(W.subject);if(!$$.util.isArray(M))return O=J.certs[W.subject.hash],delete J.certs[W.subject.hash],O;var U=E.toDer(u.certificateToAsn1(W)).getBytes();for(var H=0;H<M.length;++H){var V=E.toDer(u.certificateToAsn1(M[H])).getBytes();if(U===V)O=M[H],M.splice(H,1)}if(M.length===0)delete J.certs[W.subject.hash];return O};function X(W){return Q(W),J.certs[W.hash]||null}function Q(W){if(!W.hash){var O=$$.md.sha1.create();W.attributes=u.RDNAttributesAsArray(CQ(W),O),W.hash=O.digest().toHex()}}if($)for(var Y=0;Y<$.length;++Y){var G=$[Y];J.addCertificate(G)}return J};u.certificateError={bad_certificate:"forge.pki.BadCertificate",unsupported_certificate:"forge.pki.UnsupportedCertificate",certificate_revoked:"forge.pki.CertificateRevoked",certificate_expired:"forge.pki.CertificateExpired",certificate_unknown:"forge.pki.CertificateUnknown",unknown_ca:"forge.pki.UnknownCertificateAuthority"};u.verifyCertificateChain=function($,J,X){if(typeof X==="function")X={verify:X};X=X||{},J=J.slice(0);var Q=J.slice(0),Y=X.validityCheckDate;if(typeof Y>"u")Y=new Date;var G=!0,W=null,O=0;do{var M=J.shift(),U=null,H=!1;if(Y){if(Y<M.validity.notBefore||Y>M.validity.notAfter)W={message:"Certificate is not valid yet or has expired.",error:u.certificateError.certificate_expired,notBefore:M.validity.notBefore,notAfter:M.validity.notAfter,now:Y}}if(W===null){if(U=J[0]||$.getIssuer(M),U===null){if(M.isIssuer(M))H=!0,U=M}if(U){var V=U;if(!$$.util.isArray(V))V=[V];var q=!1;while(!q&&V.length>0){U=V.shift();try{q=U.verify(M)}catch(C){}}if(!q)W={message:"Certificate signature is invalid.",error:u.certificateError.bad_certificate}}if(W===null&&(!U||H)&&!$.hasCertificate(M))W={message:"Certificate is not trusted.",error:u.certificateError.unknown_ca}}if(W===null&&U&&!M.isIssuer(U))W={message:"Certificate issuer is invalid.",error:u.certificateError.bad_certificate};if(W===null){var z={keyUsage:!0,basicConstraints:!0};for(var K=0;W===null&&K<M.extensions.length;++K){var L=M.extensions[K];if(L.critical&&!(L.name in z))W={message:"Certificate has an unsupported critical extension.",error:u.certificateError.unsupported_certificate}}}if(W===null&&(!G||J.length===0&&(!U||H))){var A=M.getExtension("basicConstraints"),D=M.getExtension("keyUsage");if(D!==null){if(!D.keyCertSign||A===null)W={message:"Certificate keyUsage or basicConstraints conflict or indicate that the certificate is not a CA. If the certificate is the only one in the chain or isn't the first then the certificate must be a valid CA.",error:u.certificateError.bad_certificate}}if(W===null&&A===null)W={message:"Certificate is missing basicConstraints extension and cannot be used as a CA.",error:u.certificateError.bad_certificate};if(W===null&&A!==null&&!A.cA)W={message:"Certificate basicConstraints indicates the certificate is not a CA.",error:u.certificateError.bad_certificate};if(W===null&&D!==null&&"pathLenConstraint"in A){var j=O-1;if(j>A.pathLenConstraint)W={message:"Certificate basicConstraints pathLenConstraint violated.",error:u.certificateError.bad_certificate}}}var S=W===null?!0:W.error,P=X.verify?X.verify(S,O,Q):S;if(P===!0)W=null;else{if(S===!0)W={message:"The application rejected the certificate.",error:u.certificateError.bad_certificate};if(P||P===0){if(typeof P==="object"&&!$$.util.isArray(P)){if(P.message)W.message=P.message;if(P.error)W.error=P.error}else if(typeof P==="string")W.error=P}throw W}G=!1,++O}while(J.length>0);return!0}});var $8=H$((fE,W1)=>{var y$=K$();m0();DQ();jJ();r9();a9();P0();zX();TQ();w$();DY();var{asn1:R,pki:N$}=y$,NX=W1.exports=y$.pkcs12=y$.pkcs12||{},G1={name:"ContentInfo",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.contentType",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:R.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"content"}]},IU={name:"PFX",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.version",tagClass:R.Class.UNIVERSAL,type:R.Type.INTEGER,constructed:!1,capture:"version"},G1,{name:"PFX.macData",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"mac",value:[{name:"PFX.macData.mac",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm.algorithm",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"macAlgorithm"},{name:"PFX.macData.mac.digestAlgorithm.parameters",optional:!0,tagClass:R.Class.UNIVERSAL,captureAsn1:"macAlgorithmParameters"}]},{name:"PFX.macData.mac.digest",tagClass:R.Class.UNIVERSAL,type:R.Type.OCTETSTRING,constructed:!1,capture:"macDigest"}]},{name:"PFX.macData.macSalt",tagClass:R.Class.UNIVERSAL,type:R.Type.OCTETSTRING,constructed:!1,capture:"macSalt"},{name:"PFX.macData.iterations",tagClass:R.Class.UNIVERSAL,type:R.Type.INTEGER,constructed:!1,optional:!0,capture:"macIterations"}]}]},wU={name:"SafeBag",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"SafeBag.bagId",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"bagId"},{name:"SafeBag.bagValue",tagClass:R.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"bagValue"},{name:"SafeBag.bagAttributes",tagClass:R.Class.UNIVERSAL,type:R.Type.SET,constructed:!0,optional:!0,capture:"bagAttributes"}]},PU={name:"Attribute",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"Attribute.attrId",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"oid"},{name:"Attribute.attrValues",tagClass:R.Class.UNIVERSAL,type:R.Type.SET,constructed:!0,capture:"values"}]},_U={name:"CertBag",tagClass:R.Class.UNIVERSAL,type:R.Type.SEQUENCE,constructed:!0,value:[{name:"CertBag.certId",tagClass:R.Class.UNIVERSAL,type:R.Type.OID,constructed:!1,capture:"certId"},{name:"CertBag.certValue",tagClass:R.Class.CONTEXT_SPECIFIC,constructed:!0,value:[{name:"CertBag.certValue[0]",tagClass:R.Class.UNIVERSAL,type:R.Class.OCTETSTRING,constructed:!1,capture:"cert"}]}]};function FX($,J,X,Q){var Y=[];for(var G=0;G<$.length;G++)for(var W=0;W<$[G].safeBags.length;W++){var O=$[G].safeBags[W];if(Q!==void 0&&O.type!==Q)continue;if(J===null){Y.push(O);continue}if(O.attributes[J]!==void 0&&O.attributes[J].indexOf(X)>=0)Y.push(O)}return Y}NX.pkcs12FromAsn1=function($,J,X){if(typeof J==="string")X=J,J=!0;else if(J===void 0)J=!0;var Q={},Y=[];if(!R.validate($,IU,Q,Y)){var G=Error("Cannot read PKCS#12 PFX. ASN.1 object is not an PKCS#12 PFX.");throw G.errors=G,G}var W={version:Q.version.charCodeAt(0),safeContents:[],getBags:function(A){var D={},j;if("localKeyId"in A)j=A.localKeyId;else if("localKeyIdHex"in A)j=y$.util.hexToBytes(A.localKeyIdHex);if(j===void 0&&!("friendlyName"in A)&&"bagType"in A)D[A.bagType]=FX(W.safeContents,null,null,A.bagType);if(j!==void 0)D.localKeyId=FX(W.safeContents,"localKeyId",j,A.bagType);if("friendlyName"in A)D.friendlyName=FX(W.safeContents,"friendlyName",A.friendlyName,A.bagType);return D},getBagsByFriendlyName:function(A,D){return FX(W.safeContents,"friendlyName",A,D)},getBagsByLocalKeyId:function(A,D){return FX(W.safeContents,"localKeyId",A,D)}};if(Q.version.charCodeAt(0)!==3){var G=Error("PKCS#12 PFX of version other than 3 not supported.");throw G.version=Q.version.charCodeAt(0),G}if(R.derToOid(Q.contentType)!==N$.oids.data){var G=Error("Only PKCS#12 PFX in password integrity mode supported.");throw G.oid=R.derToOid(Q.contentType),G}var O=Q.content.value[0];if(O.tagClass!==R.Class.UNIVERSAL||O.type!==R.Type.OCTETSTRING)throw Error("PKCS#12 authSafe content data is not an OCTET STRING.");if(O=e9(O),Q.mac){var M=null,U=0,H=R.derToOid(Q.macAlgorithm);switch(H){case N$.oids.sha1:M=y$.md.sha1.create(),U=20;break;case N$.oids.sha256:M=y$.md.sha256.create(),U=32;break;case N$.oids.sha384:M=y$.md.sha384.create(),U=48;break;case N$.oids.sha512:M=y$.md.sha512.create(),U=64;break;case N$.oids.md5:M=y$.md.md5.create(),U=16;break}if(M===null)throw Error("PKCS#12 uses unsupported MAC algorithm: "+H);var V=new y$.util.ByteBuffer(Q.macSalt),q="macIterations"in Q?parseInt(y$.util.bytesToHex(Q.macIterations),16):1,z=NX.generateKey(X,V,3,q,U,M),K=y$.hmac.create();K.start(M,z),K.update(O.value);var L=K.getMac();if(L.getBytes()!==Q.macDigest)throw Error("PKCS#12 MAC could not be verified. Invalid password?")}else if(Array.isArray($.value)&&$.value.length>2)throw Error("Invalid PKCS#12. macData field present but MAC was not validated.");return xU(W,O.value,J,X),W};function e9($){if($.composed||$.constructed){var J=y$.util.createBuffer();for(var X=0;X<$.value.length;++X)J.putBytes($.value[X].value);$.composed=$.constructed=!1,$.value=J.getBytes()}return $}function xU($,J,X,Q){if(J=R.fromDer(J,X),J.tagClass!==R.Class.UNIVERSAL||J.type!==R.Type.SEQUENCE||J.constructed!==!0)throw Error("PKCS#12 AuthenticatedSafe expected to be a SEQUENCE OF ContentInfo");for(var Y=0;Y<J.value.length;Y++){var G=J.value[Y],W={},O=[];if(!R.validate(G,G1,W,O)){var M=Error("Cannot read ContentInfo.");throw M.errors=O,M}var U={encrypted:!1},H=null,V=W.content.value[0];switch(R.derToOid(W.contentType)){case N$.oids.data:if(V.tagClass!==R.Class.UNIVERSAL||V.type!==R.Type.OCTETSTRING)throw Error("PKCS#12 SafeContents Data is not an OCTET STRING.");H=e9(V).value;break;case N$.oids.encryptedData:H=vU(V,Q),U.encrypted=!0;break;default:var M=Error("Unsupported PKCS#12 contentType.");throw M.contentType=R.derToOid(W.contentType),M}U.safeBags=kU(H,X,Q),$.safeContents.push(U)}}function vU($,J){var X={},Q=[];if(!R.validate($,y$.pkcs7.asn1.encryptedDataValidator,X,Q)){var Y=Error("Cannot read EncryptedContentInfo.");throw Y.errors=Q,Y}var G=R.derToOid(X.contentType);if(G!==N$.oids.data){var Y=Error("PKCS#12 EncryptedContentInfo ContentType is not Data.");throw Y.oid=G,Y}G=R.derToOid(X.encAlgorithm);var W=N$.pbe.getCipher(G,X.encParameter,J),O=e9(X.encryptedContentAsn1),M=y$.util.createBuffer(O.value);if(W.update(M),!W.finish())throw Error("Failed to decrypt PKCS#12 SafeContents.");return W.output.getBytes()}function kU($,J,X){if(!J&&$.length===0)return[];if($=R.fromDer($,J),$.tagClass!==R.Class.UNIVERSAL||$.type!==R.Type.SEQUENCE||$.constructed!==!0)throw Error("PKCS#12 SafeContents expected to be a SEQUENCE OF SafeBag.");var Q=[];for(var Y=0;Y<$.value.length;Y++){var G=$.value[Y],W={},O=[];if(!R.validate(G,wU,W,O)){var M=Error("Cannot read SafeBag.");throw M.errors=O,M}var U={type:R.derToOid(W.bagId),attributes:fU(W.bagAttributes)};Q.push(U);var H,V,q=W.bagValue.value[0];switch(U.type){case N$.oids.pkcs8ShroudedKeyBag:if(q=N$.decryptPrivateKeyInfo(q,X),q===null)throw Error("Unable to decrypt PKCS#8 ShroudedKeyBag, wrong password?");case N$.oids.keyBag:try{U.key=N$.privateKeyFromAsn1(q)}catch(K){U.key=null,U.asn1=q}continue;case N$.oids.certBag:H=_U,V=function(){if(R.derToOid(W.certId)!==N$.oids.x509Certificate){var K=Error("Unsupported certificate type, only X.509 supported.");throw K.oid=R.derToOid(W.certId),K}var L=R.fromDer(W.cert,J);try{U.cert=N$.certificateFromAsn1(L,!0)}catch(A){U.cert=null,U.asn1=L}};break;default:var M=Error("Unsupported PKCS#12 SafeBag type.");throw M.oid=U.type,M}if(H!==void 0&&!R.validate(q,H,W,O)){var M=Error("Cannot read PKCS#12 "+H.name);throw M.errors=O,M}V()}return Q}function fU($){var J={};if($!==void 0)for(var X=0;X<$.length;++X){var Q={},Y=[];if(!R.validate($[X],PU,Q,Y)){var G=Error("Cannot read PKCS#12 BagAttribute.");throw G.errors=Y,G}var W=R.derToOid(Q.oid);if(N$.oids[W]===void 0)continue;J[N$.oids[W]]=[];for(var O=0;O<Q.values.length;++O)J[N$.oids[W]].push(Q.values[O].value)}return J}NX.toPkcs12Asn1=function($,J,X,Q){if(Q=Q||{},Q.saltSize=Q.saltSize||8,Q.count=Q.count||2048,Q.algorithm=Q.algorithm||Q.encAlgorithm||"aes128",!("useMac"in Q))Q.useMac=!0;if(!("localKeyId"in Q))Q.localKeyId=null;if(!("generateLocalKeyId"in Q))Q.generateLocalKeyId=!0;var Y=Q.localKeyId,G;if(Y!==null)Y=y$.util.hexToBytes(Y);else if(Q.generateLocalKeyId)if(J){var W=y$.util.isArray(J)?J[0]:J;if(typeof W==="string")W=N$.certificateFromPem(W);var O=y$.md.sha1.create();O.update(R.toDer(N$.certificateToAsn1(W)).getBytes()),Y=O.digest().getBytes()}else Y=y$.random.getBytes(20);var M=[];if(Y!==null)M.push(R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.localKeyId).getBytes()),R.create(R.Class.UNIVERSAL,R.Type.SET,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,Y)])]));if("friendlyName"in Q)M.push(R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.friendlyName).getBytes()),R.create(R.Class.UNIVERSAL,R.Type.SET,!0,[R.create(R.Class.UNIVERSAL,R.Type.BMPSTRING,!1,Q.friendlyName)])]));if(M.length>0)G=R.create(R.Class.UNIVERSAL,R.Type.SET,!0,M);var U=[],H=[];if(J!==null)if(y$.util.isArray(J))H=J;else H=[J];var V=[];for(var q=0;q<H.length;++q){if(J=H[q],typeof J==="string")J=N$.certificateFromPem(J);var z=q===0?G:void 0,K=N$.certificateToAsn1(J),L=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.certBag).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.x509Certificate).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,R.toDer(K).getBytes())])])]),z]);V.push(L)}if(V.length>0){var A=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,V),D=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.data).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,R.toDer(A).getBytes())])]);U.push(D)}var j=null;if($!==null){var S=N$.wrapRsaPrivateKey(N$.privateKeyToAsn1($));if(X===null)j=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.keyBag).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[S]),G]);else j=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.pkcs8ShroudedKeyBag).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[N$.encryptPrivateKeyInfo(S,X,Q)]),G]);var P=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[j]),C=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.data).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,R.toDer(P).getBytes())])]);U.push(C)}var w=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,U),b;if(Q.useMac){var O=y$.md.sha1.create(),t=new y$.util.ByteBuffer(y$.random.getBytes(Q.saltSize)),r=Q.count,$=NX.generateKey(X,t,3,r,20),G$=y$.hmac.create();G$.start(O,$),G$.update(R.toDer(w).getBytes());var T$=G$.getMac();b=R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.sha1).getBytes()),R.create(R.Class.UNIVERSAL,R.Type.NULL,!1,"")]),R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,T$.getBytes())]),R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,t.getBytes()),R.create(R.Class.UNIVERSAL,R.Type.INTEGER,!1,R.integerToDer(r).getBytes())])}return R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.INTEGER,!1,R.integerToDer(3).getBytes()),R.create(R.Class.UNIVERSAL,R.Type.SEQUENCE,!0,[R.create(R.Class.UNIVERSAL,R.Type.OID,!1,R.oidToDer(N$.oids.data).getBytes()),R.create(R.Class.CONTEXT_SPECIFIC,0,!0,[R.create(R.Class.UNIVERSAL,R.Type.OCTETSTRING,!1,R.toDer(w).getBytes())])]),b])};NX.generateKey=y$.pbe.generatePkcs12Key});var Q8=H$((yE,O1)=>{var PJ=K$();m0();jJ();a9();sJ();HY();$8();NY();zX();w$();DY();var J8=PJ.asn1,IQ=O1.exports=PJ.pki=PJ.pki||{};IQ.pemToDer=function($){var J=PJ.pem.decode($)[0];if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PEM to DER; PEM is encrypted.");return PJ.util.createBuffer(J.body)};IQ.privateKeyFromPem=function($){var J=PJ.pem.decode($)[0];if(J.type!=="PRIVATE KEY"&&J.type!=="RSA PRIVATE KEY"){var X=Error('Could not convert private key from PEM; PEM header type is not "PRIVATE KEY" or "RSA PRIVATE KEY".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert private key from PEM; PEM is encrypted.");var Q=J8.fromDer(J.body);return IQ.privateKeyFromAsn1(Q)};IQ.privateKeyToPem=function($,J){var X={type:"RSA PRIVATE KEY",body:J8.toDer(IQ.privateKeyToAsn1($)).getBytes()};return PJ.pem.encode(X,{maxline:J})};IQ.privateKeyInfoToPem=function($,J){var X={type:"PRIVATE KEY",body:J8.toDer($).getBytes()};return PJ.pem.encode(X,{maxline:J})}});var M8=H$((hE,z1)=>{var k=K$();m0();DQ();WY();sJ();Q8();P0();TQ();w$();var BY=function($,J,X,Q){var Y=k.util.createBuffer(),G=$.length>>1,W=G+($.length&1),O=$.substr(0,W),M=$.substr(G,W),U=k.util.createBuffer(),H=k.hmac.create();X=J+X;var V=Math.ceil(Q/16),q=Math.ceil(Q/20);H.start("MD5",O);var z=k.util.createBuffer();U.putBytes(X);for(var K=0;K<V;++K)H.start(null,null),H.update(U.getBytes()),U.putBuffer(H.digest()),H.start(null,null),H.update(U.bytes()+X),z.putBuffer(H.digest());H.start("SHA1",M);var L=k.util.createBuffer();U.clear(),U.putBytes(X);for(var K=0;K<q;++K)H.start(null,null),H.update(U.getBytes()),U.putBuffer(H.digest()),H.start(null,null),H.update(U.bytes()+X),L.putBuffer(H.digest());return Y.putBytes(k.util.xorBytes(z.getBytes(),L.getBytes(),Q)),Y},yU=function($,J,X){var Q=k.hmac.create();Q.start("SHA1",$);var Y=k.util.createBuffer();return Y.putInt32(J[0]),Y.putInt32(J[1]),Y.putByte(X.type),Y.putByte(X.version.major),Y.putByte(X.version.minor),Y.putInt16(X.length),Y.putBytes(X.fragment.bytes()),Q.update(Y.getBytes()),Q.digest().getBytes()},hU=function($,J,X){var Q=!1;try{var Y=$.deflate(J.fragment.getBytes());J.fragment=k.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},bU=function($,J,X){var Q=!1;try{var Y=$.inflate(J.fragment.getBytes());J.fragment=k.util.createBuffer(Y),J.length=Y.length,Q=!0}catch(G){}return Q},T0=function($,J){var X=0;switch(J){case 1:X=$.getByte();break;case 2:X=$.getInt16();break;case 3:X=$.getInt24();break;case 4:X=$.getInt32();break}return k.util.createBuffer($.getBytes(X))},k0=function($,J,X){$.putInt(X.length(),J<<3),$.putBuffer(X)},N={};N.Versions={TLS_1_0:{major:3,minor:1},TLS_1_1:{major:3,minor:2},TLS_1_2:{major:3,minor:3}};N.SupportedVersions=[N.Versions.TLS_1_1,N.Versions.TLS_1_0];N.Version=N.SupportedVersions[0];N.MaxFragment=15360;N.ConnectionEnd={server:0,client:1};N.PRFAlgorithm={tls_prf_sha256:0};N.BulkCipherAlgorithm={none:null,rc4:0,des3:1,aes:2};N.CipherType={stream:0,block:1,aead:2};N.MACAlgorithm={none:null,hmac_md5:0,hmac_sha1:1,hmac_sha256:2,hmac_sha384:3,hmac_sha512:4};N.CompressionMethod={none:0,deflate:1};N.ContentType={change_cipher_spec:20,alert:21,handshake:22,application_data:23,heartbeat:24};N.HandshakeType={hello_request:0,client_hello:1,server_hello:2,certificate:11,server_key_exchange:12,certificate_request:13,server_hello_done:14,certificate_verify:15,client_key_exchange:16,finished:20};N.Alert={};N.Alert.Level={warning:1,fatal:2};N.Alert.Description={close_notify:0,unexpected_message:10,bad_record_mac:20,decryption_failed:21,record_overflow:22,decompression_failure:30,handshake_failure:40,bad_certificate:42,unsupported_certificate:43,certificate_revoked:44,certificate_expired:45,certificate_unknown:46,illegal_parameter:47,unknown_ca:48,access_denied:49,decode_error:50,decrypt_error:51,export_restriction:60,protocol_version:70,insufficient_security:71,internal_error:80,user_canceled:90,no_renegotiation:100};N.HeartbeatMessageType={heartbeat_request:1,heartbeat_response:2};N.CipherSuites={};N.getCipherSuite=function($){var J=null;for(var X in N.CipherSuites){var Q=N.CipherSuites[X];if(Q.id[0]===$.charCodeAt(0)&&Q.id[1]===$.charCodeAt(1)){J=Q;break}}return J};N.handleUnexpected=function($,J){var X=!$.open&&$.entity===N.ConnectionEnd.client;if(!X)$.error($,{message:"Unexpected message. Received TLS record out of order.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unexpected_message}})};N.handleHelloRequest=function($,J,X){if(!$.handshaking&&$.handshakes>0)N.queue($,N.createAlert($,{level:N.Alert.Level.warning,description:N.Alert.Description.no_renegotiation})),N.flush($);$.process()};N.parseHelloMessage=function($,J,X){var Q=null,Y=$.entity===N.ConnectionEnd.client;if(X<38)$.error($,{message:Y?"Invalid ServerHello message. Message too short.":"Invalid ClientHello message. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});else{var G=J.fragment,W=G.length();if(Q={version:{major:G.getByte(),minor:G.getByte()},random:k.util.createBuffer(G.getBytes(32)),session_id:T0(G,1),extensions:[]},Y)Q.cipher_suite=G.getBytes(2),Q.compression_method=G.getByte();else Q.cipher_suites=T0(G,2),Q.compression_methods=T0(G,1);if(W=X-(W-G.length()),W>0){var O=T0(G,2);while(O.length()>0)Q.extensions.push({type:[O.getByte(),O.getByte()],data:T0(O,2)});if(!Y)for(var M=0;M<Q.extensions.length;++M){var U=Q.extensions[M];if(U.type[0]===0&&U.type[1]===0){var H=T0(U.data,2);while(H.length()>0){var V=H.getByte();if(V!==0)break;$.session.extensions.server_name.serverNameList.push(T0(H,2).getBytes())}}}}if($.session.version){if(Q.version.major!==$.session.version.major||Q.version.minor!==$.session.version.minor)return $.error($,{message:"TLS version change is disallowed during renegotiation.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}})}if(Y)$.session.cipherSuite=N.getCipherSuite(Q.cipher_suite);else{var q=k.util.createBuffer(Q.cipher_suites.bytes());while(q.length()>0)if($.session.cipherSuite=N.getCipherSuite(q.getBytes(2)),$.session.cipherSuite!==null)break}if($.session.cipherSuite===null)return $.error($,{message:"No cipher suites in common.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.handshake_failure},cipherSuite:k.util.bytesToHex(Q.cipher_suite)});if(Y)$.session.compressionMethod=Q.compression_method;else $.session.compressionMethod=N.CompressionMethod.none}return Q};N.createSecurityParameters=function($,J){var X=$.entity===N.ConnectionEnd.client,Q=J.random.bytes(),Y=X?$.session.sp.client_random:Q,G=X?Q:N.createRandom().getBytes();$.session.sp={entity:$.entity,prf_algorithm:N.PRFAlgorithm.tls_prf_sha256,bulk_cipher_algorithm:null,cipher_type:null,enc_key_length:null,block_length:null,fixed_iv_length:null,record_iv_length:null,mac_algorithm:null,mac_length:null,mac_key_length:null,compression_algorithm:$.session.compressionMethod,pre_master_secret:null,master_secret:null,client_random:Y,server_random:G}};N.handleServerHello=function($,J,X){var Q=N.parseHelloMessage($,J,X);if($.fail)return;if(Q.version.minor<=$.version.minor)$.version.minor=Q.version.minor;else return $.error($,{message:"Incompatible TLS version.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}});$.session.version=$.version;var Y=Q.session_id.bytes();if(Y.length>0&&Y===$.session.id)$.expect=H1,$.session.resuming=!0,$.session.sp.server_random=Q.random.bytes();else $.expect=mU,$.session.resuming=!1,N.createSecurityParameters($,Q);$.session.id=Y,$.process()};N.handleClientHello=function($,J,X){var Q=N.parseHelloMessage($,J,X);if($.fail)return;var Y=Q.session_id.bytes(),G=null;if($.sessionCache){if(G=$.sessionCache.getSession(Y),G===null)Y="";else if(G.version.major!==Q.version.major||G.version.minor>Q.version.minor)G=null,Y=""}if(Y.length===0)Y=k.random.getBytes(32);if($.session.id=Y,$.session.clientHelloVersion=Q.version,$.session.sp={},G)$.version=$.session.version=G.version,$.session.sp=G.sp;else{var W;for(var O=1;O<N.SupportedVersions.length;++O)if(W=N.SupportedVersions[O],W.minor<=Q.version.minor)break;$.version={major:W.major,minor:W.minor},$.session.version=$.version}if(G!==null)$.expect=W8,$.session.resuming=!0,$.session.sp.client_random=Q.random.bytes();else $.expect=$.verifyClient!==!1?iU:G8,$.session.resuming=!1,N.createSecurityParameters($,Q);if($.open=!0,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerHello($)})),$.session.resuming)N.queue($,N.createRecord($,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),$.state.pending=N.createConnectionState($),$.state.current.write=$.state.pending.write,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createFinished($)}));else if(N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificate($)})),!$.fail){if(N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerKeyExchange($)})),$.verifyClient!==!1)N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificateRequest($)}));N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createServerHelloDone($)}))}N.flush($),$.process()};N.handleCertificate=function($,J,X){if(X<3)return $.error($,{message:"Invalid Certificate message. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_list:T0(Q,3)},G,W,O=[];try{while(Y.certificate_list.length()>0)G=T0(Y.certificate_list,3),W=k.asn1.fromDer(G),G=k.pki.certificateFromAsn1(W,!0),O.push(G)}catch(U){return $.error($,{message:"Could not parse certificate list.",cause:U,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate}})}var M=$.entity===N.ConnectionEnd.client;if((M||$.verifyClient===!0)&&O.length===0)$.error($,{message:M?"No server certificate provided.":"No client certificate provided.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});else if(O.length===0)$.expect=M?M1:G8;else{if(M)$.session.serverCertificate=O[0];else $.session.clientCertificate=O[0];if(N.verifyCertificateChain($,O))$.expect=M?M1:G8}$.process()};N.handleServerKeyExchange=function($,J,X){if(X>0)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unsupported_certificate}});$.expect=gU,$.process()};N.handleClientKeyExchange=function($,J,X){if(X<48)return $.error($,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unsupported_certificate}});var Q=J.fragment,Y={enc_pre_master_secret:T0(Q,2).getBytes()},G=null;if($.getPrivateKey)try{G=$.getPrivateKey($,$.session.serverCertificate),G=k.pki.privateKeyFromPem(G)}catch(M){$.error($,{message:"Could not get private key.",cause:M,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}})}if(G===null)return $.error($,{message:"No private key set.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});try{var W=$.session.sp;W.pre_master_secret=G.decrypt(Y.enc_pre_master_secret);var O=$.session.clientHelloVersion;if(O.major!==W.pre_master_secret.charCodeAt(0)||O.minor!==W.pre_master_secret.charCodeAt(1))throw Error("TLS version rollback attack detected.")}catch(M){W.pre_master_secret=k.random.getBytes(48)}if($.expect=W8,$.session.clientCertificate!==null)$.expect=oU;$.process()};N.handleCertificateRequest=function($,J,X){if(X<3)return $.error($,{message:"Invalid CertificateRequest. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment,Y={certificate_types:T0(Q,1),certificate_authorities:T0(Q,2)};$.session.certificateRequest=Y,$.expect=lU,$.process()};N.handleCertificateVerify=function($,J,X){if(X<2)return $.error($,{message:"Invalid CertificateVerify. Message too short.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G={signature:T0(Q,2).getBytes()},W=k.util.createBuffer();W.putBuffer($.session.md5.digest()),W.putBuffer($.session.sha1.digest()),W=W.getBytes();try{var O=$.session.clientCertificate;if(!O.publicKey.verify(W,G.signature,"NONE"))throw Error("CertificateVerify signature does not match.");$.session.md5.update(Y),$.session.sha1.update(Y)}catch(M){return $.error($,{message:"Bad signature in CertificateVerify.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.handshake_failure}})}$.expect=W8,$.process()};N.handleServerHelloDone=function($,J,X){if(X>0)return $.error($,{message:"Invalid ServerHelloDone message. Invalid length.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.record_overflow}});if($.serverCertificate===null){var Q={message:"No server certificate provided. Not enough security.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.insufficient_security}},Y=0,G=$.verify($,Q.alert.description,Y,[]);if(G!==!0){if(G||G===0){if(typeof G==="object"&&!k.util.isArray(G)){if(G.message)Q.message=G.message;if(G.alert)Q.alert.description=G.alert}else if(typeof G==="number")Q.alert.description=G}return $.error($,Q)}}if($.session.certificateRequest!==null)J=N.createRecord($,{type:N.ContentType.handshake,data:N.createCertificate($)}),N.queue($,J);J=N.createRecord($,{type:N.ContentType.handshake,data:N.createClientKeyExchange($)}),N.queue($,J),$.expect=cU;var W=function(O,M){if(O.session.certificateRequest!==null&&O.session.clientCertificate!==null)N.queue(O,N.createRecord(O,{type:N.ContentType.handshake,data:N.createCertificateVerify(O,M)}));N.queue(O,N.createRecord(O,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),O.state.pending=N.createConnectionState(O),O.state.current.write=O.state.pending.write,N.queue(O,N.createRecord(O,{type:N.ContentType.handshake,data:N.createFinished(O)})),O.expect=H1,N.flush(O),O.process()};if($.session.certificateRequest===null||$.session.clientCertificate===null)return W($,null);N.getClientSignature($,W)};N.handleChangeCipherSpec=function($,J){if(J.fragment.getByte()!==1)return $.error($,{message:"Invalid ChangeCipherSpec message received.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.illegal_parameter}});var X=$.entity===N.ConnectionEnd.client;if($.session.resuming&&X||!$.session.resuming&&!X)$.state.pending=N.createConnectionState($);if($.state.current.read=$.state.pending.read,!$.session.resuming&&X||$.session.resuming&&!X)$.state.pending=null;$.expect=X?dU:aU,$.process()};N.handleFinished=function($,J,X){var Q=J.fragment;Q.read-=4;var Y=Q.bytes();Q.read+=4;var G=J.fragment.getBytes();Q=k.util.createBuffer(),Q.putBuffer($.session.md5.digest()),Q.putBuffer($.session.sha1.digest());var W=$.entity===N.ConnectionEnd.client,O=W?"server finished":"client finished",M=$.session.sp,U=12,H=BY;if(Q=H(M.master_secret,O,Q.getBytes(),U),Q.getBytes()!==G)return $.error($,{message:"Invalid verify_data in Finished message.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.decrypt_error}});if($.session.md5.update(Y),$.session.sha1.update(Y),$.session.resuming&&W||!$.session.resuming&&!W)N.queue($,N.createRecord($,{type:N.ContentType.change_cipher_spec,data:N.createChangeCipherSpec()})),$.state.current.write=$.state.pending.write,$.state.pending=null,N.queue($,N.createRecord($,{type:N.ContentType.handshake,data:N.createFinished($)}));$.expect=W?pU:rU,$.handshaking=!1,++$.handshakes,$.peerCertificate=W?$.session.serverCertificate:$.session.clientCertificate,N.flush($),$.isConnected=!0,$.connected($),$.process()};N.handleAlert=function($,J){var X=J.fragment,Q={level:X.getByte(),description:X.getByte()},Y;switch(Q.description){case N.Alert.Description.close_notify:Y="Connection closed.";break;case N.Alert.Description.unexpected_message:Y="Unexpected message.";break;case N.Alert.Description.bad_record_mac:Y="Bad record MAC.";break;case N.Alert.Description.decryption_failed:Y="Decryption failed.";break;case N.Alert.Description.record_overflow:Y="Record overflow.";break;case N.Alert.Description.decompression_failure:Y="Decompression failed.";break;case N.Alert.Description.handshake_failure:Y="Handshake failure.";break;case N.Alert.Description.bad_certificate:Y="Bad certificate.";break;case N.Alert.Description.unsupported_certificate:Y="Unsupported certificate.";break;case N.Alert.Description.certificate_revoked:Y="Certificate revoked.";break;case N.Alert.Description.certificate_expired:Y="Certificate expired.";break;case N.Alert.Description.certificate_unknown:Y="Certificate unknown.";break;case N.Alert.Description.illegal_parameter:Y="Illegal parameter.";break;case N.Alert.Description.unknown_ca:Y="Unknown certificate authority.";break;case N.Alert.Description.access_denied:Y="Access denied.";break;case N.Alert.Description.decode_error:Y="Decode error.";break;case N.Alert.Description.decrypt_error:Y="Decrypt error.";break;case N.Alert.Description.export_restriction:Y="Export restriction.";break;case N.Alert.Description.protocol_version:Y="Unsupported protocol version.";break;case N.Alert.Description.insufficient_security:Y="Insufficient security.";break;case N.Alert.Description.internal_error:Y="Internal error.";break;case N.Alert.Description.user_canceled:Y="User canceled.";break;case N.Alert.Description.no_renegotiation:Y="Renegotiation not supported.";break;default:Y="Unknown error.";break}if(Q.description===N.Alert.Description.close_notify)return $.close();$.error($,{message:Y,send:!1,origin:$.entity===N.ConnectionEnd.client?"server":"client",alert:Q}),$.process()};N.handleHandshake=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt24();if(Y>X.length())return $.fragmented=J,J.fragment=k.util.createBuffer(),X.read-=4,$.process();$.fragmented=null,X.read-=4;var G=X.bytes(Y+4);if(X.read+=4,Q in ZY[$.entity][$.expect]){if($.entity===N.ConnectionEnd.server&&!$.open&&!$.fail)$.handshaking=!0,$.session={version:null,extensions:{server_name:{serverNameList:[]}},cipherSuite:null,compressionMethod:null,serverCertificate:null,clientCertificate:null,md5:k.md.md5.create(),sha1:k.md.sha1.create()};if(Q!==N.HandshakeType.hello_request&&Q!==N.HandshakeType.certificate_verify&&Q!==N.HandshakeType.finished)$.session.md5.update(G),$.session.sha1.update(G);ZY[$.entity][$.expect][Q]($,J,Y)}else N.handleUnexpected($,J)};N.handleApplicationData=function($,J){$.data.putBuffer(J.fragment),$.dataReady($),$.process()};N.handleHeartbeat=function($,J){var X=J.fragment,Q=X.getByte(),Y=X.getInt16(),G=X.getBytes(Y);if(Q===N.HeartbeatMessageType.heartbeat_request){if($.handshaking||Y>G.length)return $.process();N.queue($,N.createRecord($,{type:N.ContentType.heartbeat,data:N.createHeartbeat(N.HeartbeatMessageType.heartbeat_response,G)})),N.flush($)}else if(Q===N.HeartbeatMessageType.heartbeat_response){if(G!==$.expectedHeartbeatPayload)return $.process();if($.heartbeatReceived)$.heartbeatReceived($,k.util.createBuffer(G))}$.process()};var uU=0,mU=1,M1=2,gU=3,lU=4,H1=5,dU=6,pU=7,cU=8,nU=0,iU=1,G8=2,oU=3,W8=4,aU=5,rU=6,F=N.handleUnexpected,V1=N.handleChangeCipherSpec,X0=N.handleAlert,L0=N.handleHandshake,q1=N.handleApplicationData,Y0=N.handleHeartbeat,O8=[];O8[N.ConnectionEnd.client]=[[F,X0,L0,F,Y0],[F,X0,L0,F,Y0],[F,X0,L0,F,Y0],[F,X0,L0,F,Y0],[F,X0,L0,F,Y0],[V1,X0,F,F,Y0],[F,X0,L0,F,Y0],[F,X0,L0,q1,Y0],[F,X0,L0,F,Y0]];O8[N.ConnectionEnd.server]=[[F,X0,L0,F,Y0],[F,X0,L0,F,Y0],[F,X0,L0,F,Y0],[F,X0,L0,F,Y0],[V1,X0,F,F,Y0],[F,X0,L0,F,Y0],[F,X0,L0,q1,Y0],[F,X0,L0,F,Y0]];var{handleHelloRequest:_J,handleServerHello:sU,handleCertificate:K1,handleServerKeyExchange:U1,handleCertificateRequest:X8,handleServerHelloDone:RY,handleFinished:E1}=N,ZY=[];ZY[N.ConnectionEnd.client]=[[F,F,sU,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F],[_J,F,F,F,F,F,F,F,F,F,F,K1,U1,X8,RY,F,F,F,F,F,F],[_J,F,F,F,F,F,F,F,F,F,F,F,U1,X8,RY,F,F,F,F,F,F],[_J,F,F,F,F,F,F,F,F,F,F,F,F,X8,RY,F,F,F,F,F,F],[_J,F,F,F,F,F,F,F,F,F,F,F,F,F,RY,F,F,F,F,F,F],[_J,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F],[_J,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,E1],[_J,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F],[_J,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F]];var{handleClientHello:tU,handleClientKeyExchange:eU,handleCertificateVerify:$H}=N;ZY[N.ConnectionEnd.server]=[[F,tU,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F],[F,F,F,F,F,F,F,F,F,F,F,K1,F,F,F,F,F,F,F,F,F],[F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,eU,F,F,F,F],[F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,$H,F,F,F,F,F],[F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F],[F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,E1],[F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F],[F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F,F]];N.generateKeys=function($,J){var X=BY,Q=J.client_random+J.server_random;if(!$.session.resuming)J.master_secret=X(J.pre_master_secret,"master secret",Q,48).bytes(),J.pre_master_secret=null;Q=J.server_random+J.client_random;var Y=2*J.mac_key_length+2*J.enc_key_length,G=$.version.major===N.Versions.TLS_1_0.major&&$.version.minor===N.Versions.TLS_1_0.minor;if(G)Y+=2*J.fixed_iv_length;var W=X(J.master_secret,"key expansion",Q,Y),O={client_write_MAC_key:W.getBytes(J.mac_key_length),server_write_MAC_key:W.getBytes(J.mac_key_length),client_write_key:W.getBytes(J.enc_key_length),server_write_key:W.getBytes(J.enc_key_length)};if(G)O.client_write_IV=W.getBytes(J.fixed_iv_length),O.server_write_IV=W.getBytes(J.fixed_iv_length);return O};N.createConnectionState=function($){var J=$.entity===N.ConnectionEnd.client,X=function(){var G={sequenceNumber:[0,0],macKey:null,macLength:0,macFunction:null,cipherState:null,cipherFunction:function(W){return!0},compressionState:null,compressFunction:function(W){return!0},updateSequenceNumber:function(){if(G.sequenceNumber[1]===4294967295)G.sequenceNumber[1]=0,++G.sequenceNumber[0];else++G.sequenceNumber[1]}};return G},Q={read:X(),write:X()};if(Q.read.update=function(G,W){if(!Q.read.cipherFunction(W,Q.read))G.error(G,{message:"Could not decrypt record or bad MAC.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_record_mac}});else if(!Q.read.compressFunction(G,W,Q.read))G.error(G,{message:"Could not decompress record.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.decompression_failure}});return!G.fail},Q.write.update=function(G,W){if(!Q.write.compressFunction(G,W,Q.write))G.error(G,{message:"Could not compress record.",send:!1,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});else if(!Q.write.cipherFunction(W,Q.write))G.error(G,{message:"Could not encrypt record.",send:!1,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});return!G.fail},$.session){var Y=$.session.sp;switch($.session.cipherSuite.initSecurityParameters(Y),Y.keys=N.generateKeys($,Y),Q.read.macKey=J?Y.keys.server_write_MAC_key:Y.keys.client_write_MAC_key,Q.write.macKey=J?Y.keys.client_write_MAC_key:Y.keys.server_write_MAC_key,$.session.cipherSuite.initConnectionState(Q,$,Y),Y.compression_algorithm){case N.CompressionMethod.none:break;case N.CompressionMethod.deflate:Q.read.compressFunction=bU,Q.write.compressFunction=hU;break;default:throw Error("Unsupported compression algorithm.")}}return Q};N.createRandom=function(){var $=new Date,J=+$+$.getTimezoneOffset()*60000,X=k.util.createBuffer();return X.putInt32(J),X.putBytes(k.random.getBytes(28)),X};N.createRecord=function($,J){if(!J.data)return null;var X={type:J.type,version:{major:$.version.major,minor:$.version.minor},length:J.data.length(),fragment:J.data};return X};N.createAlert=function($,J){var X=k.util.createBuffer();return X.putByte(J.level),X.putByte(J.description),N.createRecord($,{type:N.ContentType.alert,data:X})};N.createClientHello=function($){$.session.clientHelloVersion={major:$.version.major,minor:$.version.minor};var J=k.util.createBuffer();for(var X=0;X<$.cipherSuites.length;++X){var Q=$.cipherSuites[X];J.putByte(Q.id[0]),J.putByte(Q.id[1])}var Y=J.length(),G=k.util.createBuffer();G.putByte(N.CompressionMethod.none);var W=G.length(),O=k.util.createBuffer();if($.virtualHost){var M=k.util.createBuffer();M.putByte(0),M.putByte(0);var U=k.util.createBuffer();U.putByte(0),k0(U,2,k.util.createBuffer($.virtualHost));var H=k.util.createBuffer();k0(H,2,U),k0(M,2,H),O.putBuffer(M)}var V=O.length();if(V>0)V+=2;var q=$.session.id,z=q.length+1+2+4+28+2+Y+1+W+V,K=k.util.createBuffer();if(K.putByte(N.HandshakeType.client_hello),K.putInt24(z),K.putByte($.version.major),K.putByte($.version.minor),K.putBytes($.session.sp.client_random),k0(K,1,k.util.createBuffer(q)),k0(K,2,J),k0(K,1,G),V>0)k0(K,2,O);return K};N.createServerHello=function($){var J=$.session.id,X=J.length+1+2+4+28+2+1,Q=k.util.createBuffer();return Q.putByte(N.HandshakeType.server_hello),Q.putInt24(X),Q.putByte($.version.major),Q.putByte($.version.minor),Q.putBytes($.session.sp.server_random),k0(Q,1,k.util.createBuffer(J)),Q.putByte($.session.cipherSuite.id[0]),Q.putByte($.session.cipherSuite.id[1]),Q.putByte($.session.compressionMethod),Q};N.createCertificate=function($){var J=$.entity===N.ConnectionEnd.client,X=null;if($.getCertificate){var Q;if(J)Q=$.session.certificateRequest;else Q=$.session.extensions.server_name.serverNameList;X=$.getCertificate($,Q)}var Y=k.util.createBuffer();if(X!==null)try{if(!k.util.isArray(X))X=[X];var G=null;for(var W=0;W<X.length;++W){var O=k.pem.decode(X[W])[0];if(O.type!=="CERTIFICATE"&&O.type!=="X509 CERTIFICATE"&&O.type!=="TRUSTED CERTIFICATE"){var M=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw M.headerType=O.type,M}if(O.procType&&O.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var U=k.util.createBuffer(O.body);if(G===null)G=k.asn1.fromDer(U.bytes(),!1);var H=k.util.createBuffer();k0(H,3,U),Y.putBuffer(H)}if(X=k.pki.certificateFromAsn1(G),J)$.session.clientCertificate=X;else $.session.serverCertificate=X}catch(z){return $.error($,{message:"Could not send certificate list.",cause:z,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate}})}var V=3+Y.length(),q=k.util.createBuffer();return q.putByte(N.HandshakeType.certificate),q.putInt24(V),k0(q,3,Y),q};N.createClientKeyExchange=function($){var J=k.util.createBuffer();J.putByte($.session.clientHelloVersion.major),J.putByte($.session.clientHelloVersion.minor),J.putBytes(k.random.getBytes(46));var X=$.session.sp;X.pre_master_secret=J.getBytes();var Q=$.session.serverCertificate.publicKey;J=Q.encrypt(X.pre_master_secret);var Y=J.length+2,G=k.util.createBuffer();return G.putByte(N.HandshakeType.client_key_exchange),G.putInt24(Y),G.putInt16(J.length),G.putBytes(J),G};N.createServerKeyExchange=function($){var J=0,X=k.util.createBuffer();if(J>0)X.putByte(N.HandshakeType.server_key_exchange),X.putInt24(J);return X};N.getClientSignature=function($,J){var X=k.util.createBuffer();X.putBuffer($.session.md5.digest()),X.putBuffer($.session.sha1.digest()),X=X.getBytes(),$.getSignature=$.getSignature||function(Q,Y,G){var W=null;if(Q.getPrivateKey)try{W=Q.getPrivateKey(Q,Q.session.clientCertificate),W=k.pki.privateKeyFromPem(W)}catch(O){Q.error(Q,{message:"Could not get private key.",cause:O,send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}})}if(W===null)Q.error(Q,{message:"No private key set.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.internal_error}});else Y=W.sign(Y,null);G(Q,Y)},$.getSignature($,X,J)};N.createCertificateVerify=function($,J){var X=J.length+2,Q=k.util.createBuffer();return Q.putByte(N.HandshakeType.certificate_verify),Q.putInt24(X),Q.putInt16(J.length),Q.putBytes(J),Q};N.createCertificateRequest=function($){var J=k.util.createBuffer();J.putByte(1);var X=k.util.createBuffer();for(var Q in $.caStore.certs){var Y=$.caStore.certs[Q],G=k.pki.distinguishedNameToAsn1(Y.subject),W=k.asn1.toDer(G);X.putInt16(W.length()),X.putBuffer(W)}var O=1+J.length()+2+X.length(),M=k.util.createBuffer();return M.putByte(N.HandshakeType.certificate_request),M.putInt24(O),k0(M,1,J),k0(M,2,X),M};N.createServerHelloDone=function($){var J=k.util.createBuffer();return J.putByte(N.HandshakeType.server_hello_done),J.putInt24(0),J};N.createChangeCipherSpec=function(){var $=k.util.createBuffer();return $.putByte(1),$};N.createFinished=function($){var J=k.util.createBuffer();J.putBuffer($.session.md5.digest()),J.putBuffer($.session.sha1.digest());var X=$.entity===N.ConnectionEnd.client,Q=$.session.sp,Y=12,G=BY,W=X?"client finished":"server finished";J=G(Q.master_secret,W,J.getBytes(),Y);var O=k.util.createBuffer();return O.putByte(N.HandshakeType.finished),O.putInt24(J.length()),O.putBuffer(J),O};N.createHeartbeat=function($,J,X){if(typeof X>"u")X=J.length;var Q=k.util.createBuffer();Q.putByte($),Q.putInt16(X),Q.putBytes(J);var Y=Q.length(),G=Math.max(16,Y-X-3);return Q.putBytes(k.random.getBytes(G)),Q};N.queue=function($,J){if(!J)return;if(J.fragment.length()===0){if(J.type===N.ContentType.handshake||J.type===N.ContentType.alert||J.type===N.ContentType.change_cipher_spec)return}if(J.type===N.ContentType.handshake){var X=J.fragment.bytes();$.session.md5.update(X),$.session.sha1.update(X),X=null}var Q;if(J.fragment.length()<=N.MaxFragment)Q=[J];else{Q=[];var Y=J.fragment.bytes();while(Y.length>N.MaxFragment)Q.push(N.createRecord($,{type:J.type,data:k.util.createBuffer(Y.slice(0,N.MaxFragment))})),Y=Y.slice(N.MaxFragment);if(Y.length>0)Q.push(N.createRecord($,{type:J.type,data:k.util.createBuffer(Y)}))}for(var G=0;G<Q.length&&!$.fail;++G){var W=Q[G],O=$.state.current.write;if(O.update($,W))$.records.push(W)}};N.flush=function($){for(var J=0;J<$.records.length;++J){var X=$.records[J];$.tlsData.putByte(X.type),$.tlsData.putByte(X.version.major),$.tlsData.putByte(X.version.minor),$.tlsData.putInt16(X.fragment.length()),$.tlsData.putBuffer($.records[J].fragment)}return $.records=[],$.tlsDataReady($)};var Y8=function($){switch($){case!0:return!0;case k.pki.certificateError.bad_certificate:return N.Alert.Description.bad_certificate;case k.pki.certificateError.unsupported_certificate:return N.Alert.Description.unsupported_certificate;case k.pki.certificateError.certificate_revoked:return N.Alert.Description.certificate_revoked;case k.pki.certificateError.certificate_expired:return N.Alert.Description.certificate_expired;case k.pki.certificateError.certificate_unknown:return N.Alert.Description.certificate_unknown;case k.pki.certificateError.unknown_ca:return N.Alert.Description.unknown_ca;default:return N.Alert.Description.bad_certificate}},JH=function($){switch($){case!0:return!0;case N.Alert.Description.bad_certificate:return k.pki.certificateError.bad_certificate;case N.Alert.Description.unsupported_certificate:return k.pki.certificateError.unsupported_certificate;case N.Alert.Description.certificate_revoked:return k.pki.certificateError.certificate_revoked;case N.Alert.Description.certificate_expired:return k.pki.certificateError.certificate_expired;case N.Alert.Description.certificate_unknown:return k.pki.certificateError.certificate_unknown;case N.Alert.Description.unknown_ca:return k.pki.certificateError.unknown_ca;default:return k.pki.certificateError.bad_certificate}};N.verifyCertificateChain=function($,J){try{var X={};for(var Q in $.verifyOptions)X[Q]=$.verifyOptions[Q];X.verify=function(G,W,O){var M=Y8(G),U=$.verify($,G,W,O);if(U!==!0){if(typeof U==="object"&&!k.util.isArray(U)){var H=Error("The application rejected the certificate.");if(H.send=!0,H.alert={level:N.Alert.Level.fatal,description:N.Alert.Description.bad_certificate},U.message)H.message=U.message;if(U.alert)H.alert.description=U.alert;throw H}if(U!==G)U=JH(U)}return U},k.pki.verifyCertificateChain($.caStore,J,X)}catch(G){var Y=G;if(typeof Y!=="object"||k.util.isArray(Y))Y={send:!0,alert:{level:N.Alert.Level.fatal,description:Y8(G)}};if(!("send"in Y))Y.send=!0;if(!("alert"in Y))Y.alert={level:N.Alert.Level.fatal,description:Y8(Y.error)};$.error($,Y)}return!$.fail};N.createSessionCache=function($,J){var X=null;if($&&$.getSession&&$.setSession&&$.order)X=$;else{X={},X.cache=$||{},X.capacity=Math.max(J||100,1),X.order=[];for(var Q in $)if(X.order.length<=J)X.order.push(Q);else delete $[Q];X.getSession=function(Y){var G=null,W=null;if(Y)W=k.util.bytesToHex(Y);else if(X.order.length>0)W=X.order[0];if(W!==null&&W in X.cache){G=X.cache[W],delete X.cache[W];for(var O in X.order)if(X.order[O]===W){X.order.splice(O,1);break}}return G},X.setSession=function(Y,G){if(X.order.length===X.capacity){var W=X.order.shift();delete X.cache[W]}var W=k.util.bytesToHex(Y);X.order.push(W),X.cache[W]=G}}return X};N.createConnection=function($){var J=null;if($.caStore)if(k.util.isArray($.caStore))J=k.pki.createCaStore($.caStore);else J=$.caStore;else J=k.pki.createCaStore();var X=$.cipherSuites||null;if(X===null){X=[];for(var Q in N.CipherSuites)X.push(N.CipherSuites[Q])}var Y=$.server?N.ConnectionEnd.server:N.ConnectionEnd.client,G=$.sessionCache?N.createSessionCache($.sessionCache):null,W={version:{major:N.Version.major,minor:N.Version.minor},entity:Y,sessionId:$.sessionId,caStore:J,sessionCache:G,cipherSuites:X,connected:$.connected,virtualHost:$.virtualHost||null,verifyClient:$.verifyClient||!1,verify:$.verify||function(H,V,q,z){return V},verifyOptions:$.verifyOptions||{},getCertificate:$.getCertificate||null,getPrivateKey:$.getPrivateKey||null,getSignature:$.getSignature||null,input:k.util.createBuffer(),tlsData:k.util.createBuffer(),data:k.util.createBuffer(),tlsDataReady:$.tlsDataReady,dataReady:$.dataReady,heartbeatReceived:$.heartbeatReceived,closed:$.closed,error:function(H,V){if(V.origin=V.origin||(H.entity===N.ConnectionEnd.client?"client":"server"),V.send)N.queue(H,N.createAlert(H,V.alert)),N.flush(H);var q=V.fatal!==!1;if(q)H.fail=!0;if($.error(H,V),q)H.close(!1)},deflate:$.deflate||null,inflate:$.inflate||null};W.reset=function(H){W.version={major:N.Version.major,minor:N.Version.minor},W.record=null,W.session=null,W.peerCertificate=null,W.state={pending:null,current:null},W.expect=W.entity===N.ConnectionEnd.client?uU:nU,W.fragmented=null,W.records=[],W.open=!1,W.handshakes=0,W.handshaking=!1,W.isConnected=!1,W.fail=!(H||typeof H>"u"),W.input.clear(),W.tlsData.clear(),W.data.clear(),W.state.current=N.createConnectionState(W)},W.reset();var O=function(H,V){var q=V.type-N.ContentType.change_cipher_spec,z=O8[H.entity][H.expect];if(q in z)z[q](H,V);else N.handleUnexpected(H,V)},M=function(H){var V=0,q=H.input,z=q.length();if(z<5)V=5-z;else{H.record={type:q.getByte(),version:{major:q.getByte(),minor:q.getByte()},length:q.getInt16(),fragment:k.util.createBuffer(),ready:!1};var K=H.record.version.major===H.version.major;if(K&&H.session&&H.session.version)K=H.record.version.minor===H.version.minor;if(!K)H.error(H,{message:"Incompatible TLS version.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.protocol_version}})}return V},U=function(H){var V=0,q=H.input,z=q.length();if(z<H.record.length)V=H.record.length-z;else{H.record.fragment.putBytes(q.getBytes(H.record.length)),q.compact();var K=H.state.current.read;if(K.update(H,H.record)){if(H.fragmented!==null)if(H.fragmented.type===H.record.type)H.fragmented.fragment.putBuffer(H.record.fragment),H.record=H.fragmented;else H.error(H,{message:"Invalid fragmented record.",send:!0,alert:{level:N.Alert.Level.fatal,description:N.Alert.Description.unexpected_message}});H.record.ready=!0}}return V};return W.handshake=function(H){if(W.entity!==N.ConnectionEnd.client)W.error(W,{message:"Cannot initiate handshake as a server.",fatal:!1});else if(W.handshaking)W.error(W,{message:"Handshake already in progress.",fatal:!1});else{if(W.fail&&!W.open&&W.handshakes===0)W.fail=!1;W.handshaking=!0,H=H||"";var V=null;if(H.length>0){if(W.sessionCache)V=W.sessionCache.getSession(H);if(V===null)H=""}if(H.length===0&&W.sessionCache){if(V=W.sessionCache.getSession(),V!==null)H=V.id}if(W.session={id:H,version:null,cipherSuite:null,compressionMethod:null,serverCertificate:null,certificateRequest:null,clientCertificate:null,sp:{},md5:k.md.md5.create(),sha1:k.md.sha1.create()},V)W.version=V.version,W.session.sp=V.sp;W.session.sp.client_random=N.createRandom().getBytes(),W.open=!0,N.queue(W,N.createRecord(W,{type:N.ContentType.handshake,data:N.createClientHello(W)})),N.flush(W)}},W.process=function(H){var V=0;if(H)W.input.putBytes(H);if(!W.fail){if(W.record!==null&&W.record.ready&&W.record.fragment.isEmpty())W.record=null;if(W.record===null)V=M(W);if(!W.fail&&W.record!==null&&!W.record.ready)V=U(W);if(!W.fail&&W.record!==null&&W.record.ready)O(W,W.record)}return V},W.prepare=function(H){return N.queue(W,N.createRecord(W,{type:N.ContentType.application_data,data:k.util.createBuffer(H)})),N.flush(W)},W.prepareHeartbeatRequest=function(H,V){if(H instanceof k.util.ByteBuffer)H=H.bytes();if(typeof V>"u")V=H.length;return W.expectedHeartbeatPayload=H,N.queue(W,N.createRecord(W,{type:N.ContentType.heartbeat,data:N.createHeartbeat(N.HeartbeatMessageType.heartbeat_request,H,V)})),N.flush(W)},W.close=function(H){if(!W.fail&&W.sessionCache&&W.session){var V={id:W.session.id,version:W.session.version,sp:W.session.sp};V.sp.keys=null,W.sessionCache.setSession(V.id,V)}if(W.open){if(W.open=!1,W.input.clear(),W.isConnected||W.handshaking)W.isConnected=W.handshaking=!1,N.queue(W,N.createAlert(W,{level:N.Alert.Level.warning,description:N.Alert.Description.close_notify})),N.flush(W);W.closed(W)}W.reset(H)},W};z1.exports=k.tls=k.tls||{};for(AX in N)if(typeof N[AX]!=="function")k.tls[AX]=N[AX];var AX;k.tls.prf_tls1=BY;k.tls.hmac_sha1=yU;k.tls.createSessionCache=N.createSessionCache;k.tls.createConnection=N.createConnection});var A1=H$((bE,N1)=>{var xJ=K$();SJ();M8();var f0=N1.exports=xJ.tls;f0.CipherSuites.TLS_RSA_WITH_AES_128_CBC_SHA={id:[0,47],name:"TLS_RSA_WITH_AES_128_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=f0.BulkCipherAlgorithm.aes,$.cipher_type=f0.CipherType.block,$.enc_key_length=16,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=f0.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:F1};f0.CipherSuites.TLS_RSA_WITH_AES_256_CBC_SHA={id:[0,53],name:"TLS_RSA_WITH_AES_256_CBC_SHA",initSecurityParameters:function($){$.bulk_cipher_algorithm=f0.BulkCipherAlgorithm.aes,$.cipher_type=f0.CipherType.block,$.enc_key_length=32,$.block_length=16,$.fixed_iv_length=16,$.record_iv_length=16,$.mac_algorithm=f0.MACAlgorithm.hmac_sha1,$.mac_length=20,$.mac_key_length=20},initConnectionState:F1};function F1($,J,X){var Q=J.entity===xJ.tls.ConnectionEnd.client;$.read.cipherState={init:!1,cipher:xJ.cipher.createDecipher("AES-CBC",Q?X.keys.server_write_key:X.keys.client_write_key),iv:Q?X.keys.server_write_IV:X.keys.client_write_IV},$.write.cipherState={init:!1,cipher:xJ.cipher.createCipher("AES-CBC",Q?X.keys.client_write_key:X.keys.server_write_key),iv:Q?X.keys.client_write_IV:X.keys.server_write_IV},$.read.cipherFunction=GH,$.write.cipherFunction=QH,$.read.macLength=$.write.macLength=X.mac_length,$.read.macFunction=$.write.macFunction=f0.hmac_sha1}function QH($,J){var X=!1,Q=J.macFunction(J.macKey,J.sequenceNumber,$);$.fragment.putBytes(Q),J.updateSequenceNumber();var Y;if($.version.minor===f0.Versions.TLS_1_0.minor)Y=J.cipherState.init?null:J.cipherState.iv;else Y=xJ.random.getBytesSync(16);J.cipherState.init=!0;var G=J.cipherState.cipher;if(G.start({iv:Y}),$.version.minor>=f0.Versions.TLS_1_1.minor)G.output.putBytes(Y);if(G.update($.fragment),G.finish(XH))$.fragment=G.output,$.length=$.fragment.length(),X=!0;return X}function XH($,J,X){if(!X){var Q=$-J.length()%$;J.fillWithByte(Q-1,Q)}return!0}function YH($,J,X){var Q=!0;if(X){var Y=J.length(),G=J.last();for(var W=Y-1-G;W<Y-1;++W)Q=Q&&J.at(W)==G;if(Q)J.truncate(G+1)}return Q}function GH($,J){var X=!1,Q;if($.version.minor===f0.Versions.TLS_1_0.minor)Q=J.cipherState.init?null:J.cipherState.iv;else Q=$.fragment.getBytes(16);J.cipherState.init=!0;var Y=J.cipherState.cipher;Y.start({iv:Q}),Y.update($.fragment),X=Y.finish(YH);var G=J.macLength,W=xJ.random.getBytesSync(G),O=Y.output.length();if(O>=G)$.fragment=Y.output.getBytes(O-G),W=Y.output.getBytes(G);else $.fragment=Y.output.getBytes();$.fragment=xJ.util.createBuffer($.fragment),$.length=$.fragment.length();var M=J.macFunction(J.macKey,J.sequenceNumber,$);return J.updateSequenceNumber(),X=WH(J.macKey,W,M)&&X,X}function WH($,J,X){var Q=xJ.hmac.create();return Q.start("SHA1",$),Q.update(J),J=Q.digest().getBytes(),Q.start(null,null),Q.update(X),X=Q.digest().getBytes(),J===X}});var V8=H$((uE,Z1)=>{var b$=K$();t0();w$();var LX=Z1.exports=b$.sha512=b$.sha512||{};b$.md.sha512=b$.md.algorithms.sha512=LX;var D1=b$.sha384=b$.sha512.sha384=b$.sha512.sha384||{};D1.create=function(){return LX.create("SHA-384")};b$.md.sha384=b$.md.algorithms.sha384=D1;b$.sha512.sha256=b$.sha512.sha256||{create:function(){return LX.create("SHA-512/256")}};b$.md["sha512/256"]=b$.md.algorithms["sha512/256"]=b$.sha512.sha256;b$.sha512.sha224=b$.sha512.sha224||{create:function(){return LX.create("SHA-512/224")}};b$.md["sha512/224"]=b$.md.algorithms["sha512/224"]=b$.sha512.sha224;LX.create=function($){if(!R1)OH();if(typeof $>"u")$="SHA-512";if(!($ in XQ))throw Error("Invalid SHA-512 algorithm: "+$);var J=XQ[$],X=null,Q=b$.util.createBuffer(),Y=Array(80);for(var G=0;G<80;++G)Y[G]=[,,];var W=64;switch($){case"SHA-384":W=48;break;case"SHA-512/256":W=32;break;case"SHA-512/224":W=28;break}var O={algorithm:$.replace("-","").toLowerCase(),blockLength:128,digestLength:W,messageLength:0,fullMessageLength:null,messageLengthSize:16};return O.start=function(){O.messageLength=0,O.fullMessageLength=O.messageLength128=[];var M=O.messageLengthSize/4;for(var U=0;U<M;++U)O.fullMessageLength.push(0);Q=b$.util.createBuffer(),X=Array(J.length);for(var U=0;U<J.length;++U)X[U]=J[U].slice(0);return O},O.start(),O.update=function(M,U){if(U==="utf8")M=b$.util.encodeUtf8(M);var H=M.length;O.messageLength+=H,H=[H/4294967296>>>0,H>>>0];for(var V=O.fullMessageLength.length-1;V>=0;--V)O.fullMessageLength[V]+=H[1],H[1]=H[0]+(O.fullMessageLength[V]/4294967296>>>0),O.fullMessageLength[V]=O.fullMessageLength[V]>>>0,H[0]=H[1]/4294967296>>>0;if(Q.putBytes(M),L1(X,Y,Q),Q.read>2048||Q.length()===0)Q.compact();return O},O.digest=function(){var M=b$.util.createBuffer();M.putBytes(Q.bytes());var U=O.fullMessageLength[O.fullMessageLength.length-1]+O.messageLengthSize,H=U&O.blockLength-1;M.putBytes(U8.substr(0,O.blockLength-H));var V,q,z=O.fullMessageLength[0]*8;for(var K=0;K<O.fullMessageLength.length-1;++K)V=O.fullMessageLength[K+1]*8,q=V/4294967296>>>0,z+=q,M.putInt32(z>>>0),z=V>>>0;M.putInt32(z);var L=Array(X.length);for(var K=0;K<X.length;++K)L[K]=X[K].slice(0);L1(L,Y,M);var A=b$.util.createBuffer(),D;if($==="SHA-512")D=L.length;else if($==="SHA-384")D=L.length-2;else D=L.length-4;for(var K=0;K<D;++K)if(A.putInt32(L[K][0]),K!==D-1||$!=="SHA-512/224")A.putInt32(L[K][1]);return A},O};var U8=null,R1=!1,H8=null,XQ=null;function OH(){U8=String.fromCharCode(128),U8+=b$.util.fillString(String.fromCharCode(0),128),H8=[[1116352408,3609767458],[1899447441,602891725],[3049323471,3964484399],[3921009573,2173295548],[961987163,4081628472],[1508970993,3053834265],[2453635748,2937671579],[2870763221,3664609560],[3624381080,2734883394],[310598401,1164996542],[607225278,1323610764],[1426881987,3590304994],[1925078388,4068182383],[2162078206,991336113],[2614888103,633803317],[3248222580,3479774868],[3835390401,2666613458],[4022224774,944711139],[264347078,2341262773],[604807628,2007800933],[770255983,1495990901],[1249150122,1856431235],[1555081692,3175218132],[1996064986,2198950837],[2554220882,3999719339],[2821834349,766784016],[2952996808,2566594879],[3210313671,3203337956],[3336571891,1034457026],[3584528711,2466948901],[113926993,3758326383],[338241895,168717936],[666307205,1188179964],[773529912,1546045734],[1294757372,1522805485],[1396182291,2643833823],[1695183700,2343527390],[1986661051,1014477480],[2177026350,1206759142],[2456956037,344077627],[2730485921,1290863460],[2820302411,3158454273],[3259730800,3505952657],[3345764771,106217008],[3516065817,3606008344],[3600352804,1432725776],[4094571909,1467031594],[275423344,851169720],[430227734,3100823752],[506948616,1363258195],[659060556,3750685593],[883997877,3785050280],[958139571,3318307427],[1322822218,3812723403],[1537002063,2003034995],[1747873779,3602036899],[1955562222,1575990012],[2024104815,1125592928],[2227730452,2716904306],[2361852424,442776044],[2428436474,593698344],[2756734187,3733110249],[3204031479,2999351573],[3329325298,3815920427],[3391569614,3928383900],[3515267271,566280711],[3940187606,3454069534],[4118630271,4000239992],[116418474,1914138554],[174292421,2731055270],[289380356,3203993006],[460393269,320620315],[685471733,587496836],[852142971,1086792851],[1017036298,365543100],[1126000580,2618297676],[1288033470,3409855158],[1501505948,4234509866],[1607167915,987167468],[1816402316,1246189591]],XQ={},XQ["SHA-512"]=[[1779033703,4089235720],[3144134277,2227873595],[1013904242,4271175723],[2773480762,1595750129],[1359893119,2917565137],[2600822924,725511199],[528734635,4215389547],[1541459225,327033209]],XQ["SHA-384"]=[[3418070365,3238371032],[1654270250,914150663],[2438529370,812702999],[355462360,4144912697],[1731405415,4290775857],[2394180231,1750603025],[3675008525,1694076839],[1203062813,3204075428]],XQ["SHA-512/256"]=[[573645204,4230739756],[2673172387,3360449730],[596883563,1867755857],[2520282905,1497426621],[2519219938,2827943907],[3193839141,1401305490],[721525244,746961066],[246885852,2177182882]],XQ["SHA-512/224"]=[[2352822216,424955298],[1944164710,2312950998],[502970286,855612546],[1738396948,1479516111],[258812777,2077511080],[2011393907,79989058],[1067287976,1780299464],[286451373,2446758561]],R1=!0}function L1($,J,X){var Q,Y,G,W,O,M,U,H,V,q,z,K,L,A,D,j,S,P,C,w,b,t,r,G$,T$,Z$,W$,s,l,o,g,O$,a$,I$,S$,M$=X.length();while(M$>=128){for(l=0;l<16;++l)J[l][0]=X.getInt32()>>>0,J[l][1]=X.getInt32()>>>0;for(;l<80;++l)O$=J[l-2],o=O$[0],g=O$[1],Q=((o>>>19|g<<13)^(g>>>29|o<<3)^o>>>6)>>>0,Y=((o<<13|g>>>19)^(g<<3|o>>>29)^(o<<26|g>>>6))>>>0,I$=J[l-15],o=I$[0],g=I$[1],G=((o>>>1|g<<31)^(o>>>8|g<<24)^o>>>7)>>>0,W=((o<<31|g>>>1)^(o<<24|g>>>8)^(o<<25|g>>>7))>>>0,a$=J[l-7],S$=J[l-16],g=Y+a$[1]+W+S$[1],J[l][0]=Q+a$[0]+G+S$[0]+(g/4294967296>>>0)>>>0,J[l][1]=g>>>0;L=$[0][0],A=$[0][1],D=$[1][0],j=$[1][1],S=$[2][0],P=$[2][1],C=$[3][0],w=$[3][1],b=$[4][0],t=$[4][1],r=$[5][0],G$=$[5][1],T$=$[6][0],Z$=$[6][1],W$=$[7][0],s=$[7][1];for(l=0;l<80;++l)U=((b>>>14|t<<18)^(b>>>18|t<<14)^(t>>>9|b<<23))>>>0,H=((b<<18|t>>>14)^(b<<14|t>>>18)^(t<<23|b>>>9))>>>0,V=(T$^b&(r^T$))>>>0,q=(Z$^t&(G$^Z$))>>>0,O=((L>>>28|A<<4)^(A>>>2|L<<30)^(A>>>7|L<<25))>>>0,M=((L<<4|A>>>28)^(A<<30|L>>>2)^(A<<25|L>>>7))>>>0,z=(L&D|S&(L^D))>>>0,K=(A&j|P&(A^j))>>>0,g=s+H+q+H8[l][1]+J[l][1],Q=W$+U+V+H8[l][0]+J[l][0]+(g/4294967296>>>0)>>>0,Y=g>>>0,g=M+K,G=O+z+(g/4294967296>>>0)>>>0,W=g>>>0,W$=T$,s=Z$,T$=r,Z$=G$,r=b,G$=t,g=w+Y,b=C+Q+(g/4294967296>>>0)>>>0,t=g>>>0,C=S,w=P,S=D,P=j,D=L,j=A,g=Y+W,L=Q+G+(g/4294967296>>>0)>>>0,A=g>>>0;g=$[0][1]+A,$[0][0]=$[0][0]+L+(g/4294967296>>>0)>>>0,$[0][1]=g>>>0,g=$[1][1]+j,$[1][0]=$[1][0]+D+(g/4294967296>>>0)>>>0,$[1][1]=g>>>0,g=$[2][1]+P,$[2][0]=$[2][0]+S+(g/4294967296>>>0)>>>0,$[2][1]=g>>>0,g=$[3][1]+w,$[3][0]=$[3][0]+C+(g/4294967296>>>0)>>>0,$[3][1]=g>>>0,g=$[4][1]+t,$[4][0]=$[4][0]+b+(g/4294967296>>>0)>>>0,$[4][1]=g>>>0,g=$[5][1]+G$,$[5][0]=$[5][0]+r+(g/4294967296>>>0)>>>0,$[5][1]=g>>>0,g=$[6][1]+Z$,$[6][0]=$[6][0]+T$+(g/4294967296>>>0)>>>0,$[6][1]=g>>>0,g=$[7][1]+s,$[7][0]=$[7][0]+W$+(g/4294967296>>>0)>>>0,$[7][1]=g>>>0,M$-=128}}});var B1=H$((UH)=>{var MH=K$();m0();var Q0=MH.asn1;UH.privateKeyValidator={name:"PrivateKeyInfo",tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]};UH.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{tagClass:Q0.Class.UNIVERSAL,type:Q0.Type.BITSTRING,constructed:!1,composed:!0,captureBitStringValue:"ed25519PublicKey"}]}});var f1=H$((gE,k1)=>{var G0=K$();EX();P0();V8();w$();var I1=B1(),qH=I1.publicKeyValidator,KH=I1.privateKeyValidator;if(typeof K8>"u")K8=G0.jsbn.BigInteger;var K8,E8=G0.util.ByteBuffer,Z0=typeof Buffer>"u"?Uint8Array:Buffer;G0.pki=G0.pki||{};k1.exports=G0.pki.ed25519=G0.ed25519=G0.ed25519||{};var A$=G0.ed25519;A$.constants={};A$.constants.PUBLIC_KEY_BYTE_LENGTH=32;A$.constants.PRIVATE_KEY_BYTE_LENGTH=64;A$.constants.SEED_BYTE_LENGTH=32;A$.constants.SIGN_BYTE_LENGTH=64;A$.constants.HASH_BYTE_LENGTH=64;A$.generateKeyPair=function($){$=$||{};var J=$.seed;if(J===void 0)J=G0.random.getBytesSync(A$.constants.SEED_BYTE_LENGTH);else if(typeof J==="string"){if(J.length!==A$.constants.SEED_BYTE_LENGTH)throw TypeError('"seed" must be '+A$.constants.SEED_BYTE_LENGTH+" bytes in length.")}else if(!(J instanceof Uint8Array))throw TypeError('"seed" must be a node.js Buffer, Uint8Array, or a binary string.');J=FJ({message:J,encoding:"binary"});var X=new Z0(A$.constants.PUBLIC_KEY_BYTE_LENGTH),Q=new Z0(A$.constants.PRIVATE_KEY_BYTE_LENGTH);for(var Y=0;Y<32;++Y)Q[Y]=J[Y];return NH(X,Q),{publicKey:X,privateKey:Q}};A$.privateKeyFromAsn1=function($){var J={},X=[],Q=G0.asn1.validate($,KH,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=G0.asn1.derToOid(J.privateKeyOid),W=G0.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var O=J.privateKey,M=FJ({message:G0.asn1.fromDer(O).value,encoding:"binary"});return{privateKeyBytes:M}};A$.publicKeyFromAsn1=function($){var J={},X=[],Q=G0.asn1.validate($,qH,J,X);if(!Q){var Y=Error("Invalid Key.");throw Y.errors=X,Y}var G=G0.asn1.derToOid(J.publicKeyOid),W=G0.oids.EdDSA25519;if(G!==W)throw Error('Invalid OID "'+G+'"; OID must be "'+W+'".');var O=J.ed25519PublicKey;if(O.length!==A$.constants.PUBLIC_KEY_BYTE_LENGTH)throw Error("Key length is invalid.");return FJ({message:O,encoding:"binary"})};A$.publicKeyFromPrivateKey=function($){$=$||{};var J=FJ({message:$.privateKey,encoding:"binary"});if(J.length!==A$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+A$.constants.PRIVATE_KEY_BYTE_LENGTH);var X=new Z0(A$.constants.PUBLIC_KEY_BYTE_LENGTH);for(var Q=0;Q<X.length;++Q)X[Q]=J[32+Q];return X};A$.sign=function($){$=$||{};var J=FJ($),X=FJ({message:$.privateKey,encoding:"binary"});if(X.length===A$.constants.SEED_BYTE_LENGTH){var Q=A$.generateKeyPair({seed:X});X=Q.privateKey}else if(X.length!==A$.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+A$.constants.SEED_BYTE_LENGTH+" or "+A$.constants.PRIVATE_KEY_BYTE_LENGTH);var Y=new Z0(A$.constants.SIGN_BYTE_LENGTH+J.length);AH(Y,J,J.length,X);var G=new Z0(A$.constants.SIGN_BYTE_LENGTH);for(var W=0;W<G.length;++W)G[W]=Y[W];return G};A$.verify=function($){$=$||{};var J=FJ($);if($.signature===void 0)throw TypeError('"options.signature" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a binary string.');var X=FJ({message:$.signature,encoding:"binary"});if(X.length!==A$.constants.SIGN_BYTE_LENGTH)throw TypeError('"options.signature" must have a byte length of '+A$.constants.SIGN_BYTE_LENGTH);var Q=FJ({message:$.publicKey,encoding:"binary"});if(Q.length!==A$.constants.PUBLIC_KEY_BYTE_LENGTH)throw TypeError('"options.publicKey" must have a byte length of '+A$.constants.PUBLIC_KEY_BYTE_LENGTH);var Y=new Z0(A$.constants.SIGN_BYTE_LENGTH+J.length),G=new Z0(A$.constants.SIGN_BYTE_LENGTH+J.length),W;for(W=0;W<A$.constants.SIGN_BYTE_LENGTH;++W)Y[W]=X[W];for(W=0;W<J.length;++W)Y[W+A$.constants.SIGN_BYTE_LENGTH]=J[W];return LH(G,Y,Y.length,Q)>=0};function FJ($){var J=$.message;if(J instanceof Uint8Array||J instanceof Z0)return J;var X=$.encoding;if(J===void 0)if($.md)J=$.md.digest().getBytes(),X="binary";else throw TypeError('"options.message" or "options.md" not specified.');if(typeof J==="string"&&!X)throw TypeError('"options.encoding" must be "binary" or "utf8".');if(typeof J==="string"){if(typeof Buffer<"u")return Buffer.from(J,X);J=new E8(J,X)}else if(!(J instanceof E8))throw TypeError('"options.message" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a string with "options.encoding" specifying its encoding.');var Q=new Z0(J.length());for(var Y=0;Y<Q.length;++Y)Q[Y]=J.at(Y);return Q}var z8=Q$(),TY=Q$([1]),EH=Q$([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),zH=Q$([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),T1=Q$([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),S1=Q$([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),DX=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]),FH=Q$([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function RX($,J){var X=G0.md.sha512.create(),Q=new E8($);X.update(Q.getBytes(J),"binary");var Y=X.digest().getBytes();if(typeof Buffer<"u")return Buffer.from(Y,"binary");var G=new Z0(A$.constants.HASH_BYTE_LENGTH);for(var W=0;W<64;++W)G[W]=Y.charCodeAt(W);return G}function NH($,J){var X=[Q$(),Q$(),Q$(),Q$()],Q,Y=RX(J,32);Y[0]&=248,Y[31]&=127,Y[31]|=64,L8(X,Y),A8($,X);for(Q=0;Q<32;++Q)J[Q+32]=$[Q];return 0}function AH($,J,X,Q){var Y,G,W=new Float64Array(64),O=[Q$(),Q$(),Q$(),Q$()],M=RX(Q,32);M[0]&=248,M[31]&=127,M[31]|=64;var U=X+64;for(Y=0;Y<X;++Y)$[64+Y]=J[Y];for(Y=0;Y<32;++Y)$[32+Y]=M[32+Y];var H=RX($.subarray(32),X+32);F8(H),L8(O,H),A8($,O);for(Y=32;Y<64;++Y)$[Y]=Q[Y];var V=RX($,X+64);F8(V);for(Y=32;Y<64;++Y)W[Y]=0;for(Y=0;Y<32;++Y)W[Y]=H[Y];for(Y=0;Y<32;++Y)for(G=0;G<32;G++)W[Y+G]+=V[Y]*M[G];return w1($.subarray(32),W),U}function LH($,J,X,Q){var Y,G,W=new Z0(32),O=[Q$(),Q$(),Q$(),Q$()],M=[Q$(),Q$(),Q$(),Q$()];if(G=-1,X<64)return-1;if(RH(M,Q))return-1;if(!DH(J,32))return-1;for(Y=0;Y<X;++Y)$[Y]=J[Y];for(Y=0;Y<32;++Y)$[Y+32]=Q[Y];var U=RX($,X);if(F8(U),x1(O,M,U),L8(M,J.subarray(32)),N8(O,M),A8(W,O),X-=64,P1(J,0,W,0)){for(Y=0;Y<X;++Y)$[Y]=0;return-1}for(Y=0;Y<X;++Y)$[Y]=J[Y+64];return G=X,G}function DH($,J){var X;for(X=31;X>=0;--X){if($[J+X]<DX[X])return!0;if($[J+X]>DX[X])return!1}return!1}function w1($,J){var X,Q,Y,G;for(Q=63;Q>=32;--Q){X=0;for(Y=Q-32,G=Q-12;Y<G;++Y)J[Y]+=X-16*J[Q]*DX[Y-(Q-32)],X=J[Y]+128>>8,J[Y]-=X*256;J[Y]+=X,J[Q]=0}X=0;for(Y=0;Y<32;++Y)J[Y]+=X-(J[31]>>4)*DX[Y],X=J[Y]>>8,J[Y]&=255;for(Y=0;Y<32;++Y)J[Y]-=X*DX[Y];for(Q=0;Q<32;++Q)J[Q+1]+=J[Q]>>8,$[Q]=J[Q]&255}function F8($){var J=new Float64Array(64);for(var X=0;X<64;++X)J[X]=$[X],$[X]=0;w1($,J)}function N8($,J){var X=Q$(),Q=Q$(),Y=Q$(),G=Q$(),W=Q$(),O=Q$(),M=Q$(),U=Q$(),H=Q$();PQ(X,$[1],$[0]),PQ(H,J[1],J[0]),x$(X,X,H),wQ(Q,$[0],$[1]),wQ(H,J[0],J[1]),x$(Q,Q,H),x$(Y,$[3],J[3]),x$(Y,Y,zH),x$(G,$[2],J[2]),wQ(G,G,G),PQ(W,Q,X),PQ(O,G,Y),wQ(M,G,Y),wQ(U,Q,X),x$($[0],W,O),x$($[1],U,M),x$($[2],M,O),x$($[3],W,U)}function j1($,J,X){for(var Q=0;Q<4;++Q)v1($[Q],J[Q],X)}function A8($,J){var X=Q$(),Q=Q$(),Y=Q$();SH(Y,J[2]),x$(X,J[0],Y),x$(Q,J[1],Y),SY($,Q),$[31]^=_1(X)<<7}function SY($,J){var X,Q,Y,G=Q$(),W=Q$();for(X=0;X<16;++X)W[X]=J[X];q8(W),q8(W),q8(W);for(Q=0;Q<2;++Q){G[0]=W[0]-65517;for(X=1;X<15;++X)G[X]=W[X]-65535-(G[X-1]>>16&1),G[X-1]&=65535;G[15]=W[15]-32767-(G[14]>>16&1),Y=G[15]>>16&1,G[14]&=65535,v1(W,G,1-Y)}for(X=0;X<16;X++)$[2*X]=W[X]&255,$[2*X+1]=W[X]>>8}function RH($,J){var X=Q$(),Q=Q$(),Y=Q$(),G=Q$(),W=Q$(),O=Q$(),M=Q$();if(vJ($[2],TY),ZH($[1],J),YQ(Y,$[1]),x$(G,Y,EH),PQ(Y,Y,$[2]),wQ(G,$[2],G),YQ(W,G),YQ(O,W),x$(M,O,W),x$(X,M,Y),x$(X,X,G),BH(X,X),x$(X,X,Y),x$(X,X,G),x$(X,X,G),x$($[0],X,G),YQ(Q,$[0]),x$(Q,Q,G),C1(Q,Y))x$($[0],$[0],FH);if(YQ(Q,$[0]),x$(Q,Q,G),C1(Q,Y))return-1;if(_1($[0])===J[31]>>7)PQ($[0],z8,$[0]);return x$($[3],$[0],$[1]),0}function ZH($,J){var X;for(X=0;X<16;++X)$[X]=J[2*X]+(J[2*X+1]<<8);$[15]&=32767}function BH($,J){var X=Q$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=250;Q>=0;--Q)if(YQ(X,X),Q!==1)x$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function C1($,J){var X=new Z0(32),Q=new Z0(32);return SY(X,$),SY(Q,J),P1(X,0,Q,0)}function P1($,J,X,Q){return TH($,J,X,Q,32)}function TH($,J,X,Q,Y){var G,W=0;for(G=0;G<Y;++G)W|=$[J+G]^X[Q+G];return(1&W-1>>>8)-1}function _1($){var J=new Z0(32);return SY(J,$),J[0]&1}function x1($,J,X){var Q,Y;vJ($[0],z8),vJ($[1],TY),vJ($[2],TY),vJ($[3],z8);for(Y=255;Y>=0;--Y)Q=X[Y/8|0]>>(Y&7)&1,j1($,J,Q),N8(J,$),N8($,$),j1($,J,Q)}function L8($,J){var X=[Q$(),Q$(),Q$(),Q$()];vJ(X[0],T1),vJ(X[1],S1),vJ(X[2],TY),x$(X[3],T1,S1),x1($,X,J)}function vJ($,J){var X;for(X=0;X<16;X++)$[X]=J[X]|0}function SH($,J){var X=Q$(),Q;for(Q=0;Q<16;++Q)X[Q]=J[Q];for(Q=253;Q>=0;--Q)if(YQ(X,X),Q!==2&&Q!==4)x$(X,X,J);for(Q=0;Q<16;++Q)$[Q]=X[Q]}function q8($){var J,X,Q=1;for(J=0;J<16;++J)X=$[J]+Q+65535,Q=Math.floor(X/65536),$[J]=X-Q*65536;$[0]+=Q-1+37*(Q-1)}function v1($,J,X){var Q,Y=~(X-1);for(var G=0;G<16;++G)Q=Y&($[G]^J[G]),$[G]^=Q,J[G]^=Q}function Q$($){var J,X=new Float64Array(16);if($)for(J=0;J<$.length;++J)X[J]=$[J];return X}function wQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]+X[Q]}function PQ($,J,X){for(var Q=0;Q<16;++Q)$[Q]=J[Q]-X[Q]}function YQ($,J){x$($,J,J)}function x$($,J,X){var Q,Y,G=0,W=0,O=0,M=0,U=0,H=0,V=0,q=0,z=0,K=0,L=0,A=0,D=0,j=0,S=0,P=0,C=0,w=0,b=0,t=0,r=0,G$=0,T$=0,Z$=0,W$=0,s=0,l=0,o=0,g=0,O$=0,a$=0,I$=X[0],S$=X[1],M$=X[2],D$=X[3],k$=X[4],d$=X[5],r$=X[6],s$=X[7],O0=X[8],M0=X[9],U0=X[10],H0=X[11],V0=X[12],q0=X[13],K0=X[14],E0=X[15];Q=J[0],G+=Q*I$,W+=Q*S$,O+=Q*M$,M+=Q*D$,U+=Q*k$,H+=Q*d$,V+=Q*r$,q+=Q*s$,z+=Q*O0,K+=Q*M0,L+=Q*U0,A+=Q*H0,D+=Q*V0,j+=Q*q0,S+=Q*K0,P+=Q*E0,Q=J[1],W+=Q*I$,O+=Q*S$,M+=Q*M$,U+=Q*D$,H+=Q*k$,V+=Q*d$,q+=Q*r$,z+=Q*s$,K+=Q*O0,L+=Q*M0,A+=Q*U0,D+=Q*H0,j+=Q*V0,S+=Q*q0,P+=Q*K0,C+=Q*E0,Q=J[2],O+=Q*I$,M+=Q*S$,U+=Q*M$,H+=Q*D$,V+=Q*k$,q+=Q*d$,z+=Q*r$,K+=Q*s$,L+=Q*O0,A+=Q*M0,D+=Q*U0,j+=Q*H0,S+=Q*V0,P+=Q*q0,C+=Q*K0,w+=Q*E0,Q=J[3],M+=Q*I$,U+=Q*S$,H+=Q*M$,V+=Q*D$,q+=Q*k$,z+=Q*d$,K+=Q*r$,L+=Q*s$,A+=Q*O0,D+=Q*M0,j+=Q*U0,S+=Q*H0,P+=Q*V0,C+=Q*q0,w+=Q*K0,b+=Q*E0,Q=J[4],U+=Q*I$,H+=Q*S$,V+=Q*M$,q+=Q*D$,z+=Q*k$,K+=Q*d$,L+=Q*r$,A+=Q*s$,D+=Q*O0,j+=Q*M0,S+=Q*U0,P+=Q*H0,C+=Q*V0,w+=Q*q0,b+=Q*K0,t+=Q*E0,Q=J[5],H+=Q*I$,V+=Q*S$,q+=Q*M$,z+=Q*D$,K+=Q*k$,L+=Q*d$,A+=Q*r$,D+=Q*s$,j+=Q*O0,S+=Q*M0,P+=Q*U0,C+=Q*H0,w+=Q*V0,b+=Q*q0,t+=Q*K0,r+=Q*E0,Q=J[6],V+=Q*I$,q+=Q*S$,z+=Q*M$,K+=Q*D$,L+=Q*k$,A+=Q*d$,D+=Q*r$,j+=Q*s$,S+=Q*O0,P+=Q*M0,C+=Q*U0,w+=Q*H0,b+=Q*V0,t+=Q*q0,r+=Q*K0,G$+=Q*E0,Q=J[7],q+=Q*I$,z+=Q*S$,K+=Q*M$,L+=Q*D$,A+=Q*k$,D+=Q*d$,j+=Q*r$,S+=Q*s$,P+=Q*O0,C+=Q*M0,w+=Q*U0,b+=Q*H0,t+=Q*V0,r+=Q*q0,G$+=Q*K0,T$+=Q*E0,Q=J[8],z+=Q*I$,K+=Q*S$,L+=Q*M$,A+=Q*D$,D+=Q*k$,j+=Q*d$,S+=Q*r$,P+=Q*s$,C+=Q*O0,w+=Q*M0,b+=Q*U0,t+=Q*H0,r+=Q*V0,G$+=Q*q0,T$+=Q*K0,Z$+=Q*E0,Q=J[9],K+=Q*I$,L+=Q*S$,A+=Q*M$,D+=Q*D$,j+=Q*k$,S+=Q*d$,P+=Q*r$,C+=Q*s$,w+=Q*O0,b+=Q*M0,t+=Q*U0,r+=Q*H0,G$+=Q*V0,T$+=Q*q0,Z$+=Q*K0,W$+=Q*E0,Q=J[10],L+=Q*I$,A+=Q*S$,D+=Q*M$,j+=Q*D$,S+=Q*k$,P+=Q*d$,C+=Q*r$,w+=Q*s$,b+=Q*O0,t+=Q*M0,r+=Q*U0,G$+=Q*H0,T$+=Q*V0,Z$+=Q*q0,W$+=Q*K0,s+=Q*E0,Q=J[11],A+=Q*I$,D+=Q*S$,j+=Q*M$,S+=Q*D$,P+=Q*k$,C+=Q*d$,w+=Q*r$,b+=Q*s$,t+=Q*O0,r+=Q*M0,G$+=Q*U0,T$+=Q*H0,Z$+=Q*V0,W$+=Q*q0,s+=Q*K0,l+=Q*E0,Q=J[12],D+=Q*I$,j+=Q*S$,S+=Q*M$,P+=Q*D$,C+=Q*k$,w+=Q*d$,b+=Q*r$,t+=Q*s$,r+=Q*O0,G$+=Q*M0,T$+=Q*U0,Z$+=Q*H0,W$+=Q*V0,s+=Q*q0,l+=Q*K0,o+=Q*E0,Q=J[13],j+=Q*I$,S+=Q*S$,P+=Q*M$,C+=Q*D$,w+=Q*k$,b+=Q*d$,t+=Q*r$,r+=Q*s$,G$+=Q*O0,T$+=Q*M0,Z$+=Q*U0,W$+=Q*H0,s+=Q*V0,l+=Q*q0,o+=Q*K0,g+=Q*E0,Q=J[14],S+=Q*I$,P+=Q*S$,C+=Q*M$,w+=Q*D$,b+=Q*k$,t+=Q*d$,r+=Q*r$,G$+=Q*s$,T$+=Q*O0,Z$+=Q*M0,W$+=Q*U0,s+=Q*H0,l+=Q*V0,o+=Q*q0,g+=Q*K0,O$+=Q*E0,Q=J[15],P+=Q*I$,C+=Q*S$,w+=Q*M$,b+=Q*D$,t+=Q*k$,r+=Q*d$,G$+=Q*r$,T$+=Q*s$,Z$+=Q*O0,W$+=Q*M0,s+=Q*U0,l+=Q*H0,o+=Q*V0,g+=Q*q0,O$+=Q*K0,a$+=Q*E0,G+=38*C,W+=38*w,O+=38*b,M+=38*t,U+=38*r,H+=38*G$,V+=38*T$,q+=38*Z$,z+=38*W$,K+=38*s,L+=38*l,A+=38*o,D+=38*g,j+=38*O$,S+=38*a$,Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=z+Y+65535,Y=Math.floor(Q/65536),z=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=D+Y+65535,Y=Math.floor(Q/65536),D=Q-Y*65536,Q=j+Y+65535,Y=Math.floor(Q/65536),j=Q-Y*65536,Q=S+Y+65535,Y=Math.floor(Q/65536),S=Q-Y*65536,Q=P+Y+65535,Y=Math.floor(Q/65536),P=Q-Y*65536,G+=Y-1+37*(Y-1),Y=1,Q=G+Y+65535,Y=Math.floor(Q/65536),G=Q-Y*65536,Q=W+Y+65535,Y=Math.floor(Q/65536),W=Q-Y*65536,Q=O+Y+65535,Y=Math.floor(Q/65536),O=Q-Y*65536,Q=M+Y+65535,Y=Math.floor(Q/65536),M=Q-Y*65536,Q=U+Y+65535,Y=Math.floor(Q/65536),U=Q-Y*65536,Q=H+Y+65535,Y=Math.floor(Q/65536),H=Q-Y*65536,Q=V+Y+65535,Y=Math.floor(Q/65536),V=Q-Y*65536,Q=q+Y+65535,Y=Math.floor(Q/65536),q=Q-Y*65536,Q=z+Y+65535,Y=Math.floor(Q/65536),z=Q-Y*65536,Q=K+Y+65535,Y=Math.floor(Q/65536),K=Q-Y*65536,Q=L+Y+65535,Y=Math.floor(Q/65536),L=Q-Y*65536,Q=A+Y+65535,Y=Math.floor(Q/65536),A=Q-Y*65536,Q=D+Y+65535,Y=Math.floor(Q/65536),D=Q-Y*65536,Q=j+Y+65535,Y=Math.floor(Q/65536),j=Q-Y*65536,Q=S+Y+65535,Y=Math.floor(Q/65536),S=Q-Y*65536,Q=P+Y+65535,Y=Math.floor(Q/65536),P=Q-Y*65536,G+=Y-1+37*(Y-1),$[0]=G,$[1]=W,$[2]=O,$[3]=M,$[4]=U,$[5]=H,$[6]=V,$[7]=q,$[8]=z,$[9]=K,$[10]=L,$[11]=A,$[12]=D,$[13]=j,$[14]=S,$[15]=P}});var u1=H$((lE,b1)=>{var S0=K$();w$();P0();EX();b1.exports=S0.kem=S0.kem||{};var y1=S0.jsbn.BigInteger;S0.kem.rsa={};S0.kem.rsa.create=function($,J){J=J||{};var X=J.prng||S0.random,Q={};return Q.encrypt=function(Y,G){var W=Math.ceil(Y.n.bitLength()/8),O;do O=new y1(S0.util.bytesToHex(X.getBytesSync(W)),16).mod(Y.n);while(O.compareTo(y1.ONE)<=0);O=S0.util.hexToBytes(O.toString(16));var M=W-O.length;if(M>0)O=S0.util.fillString(String.fromCharCode(0),M)+O;var U=Y.encrypt(O,"NONE"),H=$.generate(O,G);return{encapsulation:U,key:H}},Q.decrypt=function(Y,G,W){var O=Y.decrypt(G,"NONE");return $.generate(O,W)},Q};S0.kem.kdf1=function($,J){h1(this,$,0,J||$.digestLength)};S0.kem.kdf2=function($,J){h1(this,$,1,J||$.digestLength)};function h1($,J,X,Q){$.generate=function(Y,G){var W=new S0.util.ByteBuffer,O=Math.ceil(G/Q)+X,M=new S0.util.ByteBuffer;for(var U=X;U<O;++U){M.putInt32(U),J.start(),J.update(Y+M.getBytes());var H=J.digest();W.putBytes(H.getBytes(Q))}return W.truncate(W.length()-G),W.getBytes()}}});var g1=H$((dE,m1)=>{var R$=K$();w$();m1.exports=R$.log=R$.log||{};R$.log.levels=["none","error","warning","info","debug","verbose","max"];var IY={},D8=[],ZX=null;R$.log.LEVEL_LOCKED=2;R$.log.NO_LEVEL_CHECK=4;R$.log.INTERPOLATE=8;for(y0=0;y0<R$.log.levels.length;++y0)jY=R$.log.levels[y0],IY[jY]={index:y0,name:jY.toUpperCase()};var jY,y0;R$.log.logMessage=function($){var J=IY[$.level].index;for(var X=0;X<D8.length;++X){var Q=D8[X];if(Q.flags&R$.log.NO_LEVEL_CHECK)Q.f($);else{var Y=IY[Q.level].index;if(J<=Y)Q.f(Q,$)}}};R$.log.prepareStandard=function($){if(!("standard"in $))$.standard=IY[$.level].name+" ["+$.category+"] "+$.message};R$.log.prepareFull=function($){if(!("full"in $)){var J=[$.message];J=J.concat([]),$.full=R$.util.format.apply(this,J)}};R$.log.prepareStandardFull=function($){if(!("standardFull"in $))R$.log.prepareStandard($),$.standardFull=$.standard};CY=["error","warning","info","debug","verbose"];for(y0=0;y0<CY.length;++y0)(function(J){R$.log[J]=function(X,Q){var Y=Array.prototype.slice.call(arguments).slice(2),G={timestamp:new Date,level:J,category:X,message:Q,arguments:Y};R$.log.logMessage(G)}})(CY[y0]);var CY,y0;R$.log.makeLogger=function($){var J={flags:0,f:$};return R$.log.setLevel(J,"none"),J};R$.log.setLevel=function($,J){var X=!1;if($&&!($.flags&R$.log.LEVEL_LOCKED))for(var Q=0;Q<R$.log.levels.length;++Q){var Y=R$.log.levels[Q];if(J==Y){$.level=J,X=!0;break}}return X};R$.log.lock=function($,J){if(typeof J>"u"||J)$.flags|=R$.log.LEVEL_LOCKED;else $.flags&=~R$.log.LEVEL_LOCKED};R$.log.addLogger=function($){D8.push($)};if(typeof console<"u"&&"log"in console){if(console.error&&console.warn&&console.info&&console.debug)R8={error:console.error,warning:console.warn,info:console.info,debug:console.debug,verbose:console.debug},xQ=function($,J){R$.log.prepareStandard(J);var X=R8[J.level],Q=[J.standard];Q=Q.concat(J.arguments.slice()),X.apply(console,Q)},GQ=R$.log.makeLogger(xQ);else xQ=function(J,X){R$.log.prepareStandardFull(X),console.log(X.standardFull)},GQ=R$.log.makeLogger(xQ);R$.log.setLevel(GQ,"debug"),R$.log.addLogger(GQ),ZX=GQ}else console={log:function(){}};var GQ,R8,xQ;if(ZX!==null&&typeof window<"u"&&window.location){if(_Q=new URL(window.location.href).searchParams,_Q.has("console.level"))R$.log.setLevel(ZX,_Q.get("console.level").slice(-1)[0]);if(_Q.has("console.lock")){if(Z8=_Q.get("console.lock").slice(-1)[0],Z8=="true")R$.log.lock(ZX)}}var _Q,Z8;R$.log.consoleLogger=ZX});var d1=H$((pE,l1)=>{l1.exports=t0();WY();TQ();f9();V8()});var n1=H$((cE,c1)=>{var d=K$();SJ();m0();qX();jJ();sJ();r9();P0();w$();DY();var B=d.asn1,D0=c1.exports=d.pkcs7=d.pkcs7||{};D0.messageFromPem=function($){var J=d.pem.decode($)[0];if(J.type!=="PKCS7"){var X=Error('Could not convert PKCS#7 message from PEM; PEM header type is not "PKCS#7".');throw X.headerType=J.type,X}if(J.procType&&J.procType.type==="ENCRYPTED")throw Error("Could not convert PKCS#7 message from PEM; PEM is encrypted.");var Q=B.fromDer(J.body);return D0.messageFromAsn1(Q)};D0.messageToPem=function($,J){var X={type:"PKCS7",body:B.toDer($.toAsn1()).getBytes()};return d.pem.encode(X,{maxline:J})};D0.messageFromAsn1=function($){var J={},X=[];if(!B.validate($,D0.asn1.contentInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 message. ASN.1 object is not an PKCS#7 ContentInfo.");throw Q.errors=X,Q}var Y=B.derToOid(J.contentType),G;switch(Y){case d.pki.oids.envelopedData:G=D0.createEnvelopedData();break;case d.pki.oids.encryptedData:G=D0.createEncryptedData();break;case d.pki.oids.signedData:G=D0.createSignedData();break;default:throw Error("Cannot read PKCS#7 message. ContentType with OID "+Y+" is not (yet) supported.")}return G.fromAsn1(J.content.value[0]),G};D0.createSignedData=function(){var $=null;return $={type:d.pki.oids.signedData,version:1,certificates:[],crls:[],signers:[],digestAlgorithmIdentifiers:[],contentInfo:null,signerInfos:[],fromAsn1:function(Q){if(T8($,Q,D0.asn1.signedDataValidator),$.certificates=[],$.crls=[],$.digestAlgorithmIdentifiers=[],$.contentInfo=null,$.signerInfos=[],$.rawCapture.certificates){var Y=$.rawCapture.certificates.value;for(var G=0;G<Y.length;++G)$.certificates.push(d.pki.certificateFromAsn1(Y[G]))}},toAsn1:function(){if(!$.contentInfo)$.sign();var Q=[];for(var Y=0;Y<$.certificates.length;++Y)Q.push(d.pki.certificateToAsn1($.certificates[Y]));var G=[],W=B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,$.digestAlgorithmIdentifiers),$.contentInfo])]);if(Q.length>0)W.value[0].value.push(B.create(B.Class.CONTEXT_SPECIFIC,0,!0,Q));if(G.length>0)W.value[0].value.push(B.create(B.Class.CONTEXT_SPECIFIC,1,!0,G));return W.value[0].value.push(B.create(B.Class.UNIVERSAL,B.Type.SET,!0,$.signerInfos)),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),W])},addSigner:function(Q){var{issuer:Y,serialNumber:G}=Q;if(Q.certificate){var W=Q.certificate;if(typeof W==="string")W=d.pki.certificateFromPem(W);Y=W.issuer.attributes,G=W.serialNumber}var O=Q.key;if(!O)throw Error("Could not add PKCS#7 signer; no private key specified.");if(typeof O==="string")O=d.pki.privateKeyFromPem(O);var M=Q.digestAlgorithm||d.pki.oids.sha1;switch(M){case d.pki.oids.sha1:case d.pki.oids.sha256:case d.pki.oids.sha384:case d.pki.oids.sha512:case d.pki.oids.md5:break;default:throw Error("Could not add PKCS#7 signer; unknown message digest algorithm: "+M)}var U=Q.authenticatedAttributes||[];if(U.length>0){var H=!1,V=!1;for(var q=0;q<U.length;++q){var z=U[q];if(!H&&z.type===d.pki.oids.contentType){if(H=!0,V)break;continue}if(!V&&z.type===d.pki.oids.messageDigest){if(V=!0,H)break;continue}}if(!H||!V)throw Error("Invalid signer.authenticatedAttributes. If signer.authenticatedAttributes is specified, then it must contain at least two attributes, PKCS #9 content-type and PKCS #9 message-digest.")}$.signers.push({key:O,version:1,issuer:Y,serialNumber:G,digestAlgorithm:M,signatureAlgorithm:d.pki.oids.rsaEncryption,signature:null,authenticatedAttributes:U,unauthenticatedAttributes:[]})},sign:function(Q){if(Q=Q||{},typeof $.content!=="object"||$.contentInfo===null){if($.contentInfo=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(d.pki.oids.data).getBytes())]),"content"in $){var Y;if($.content instanceof d.util.ByteBuffer)Y=$.content.bytes();else if(typeof $.content==="string")Y=d.util.encodeUtf8($.content);if(Q.detached)$.detachedContent=B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,Y);else $.contentInfo.value.push(B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,Y)]))}}if($.signers.length===0)return;var G=J();X(G)},verify:function(){throw Error("PKCS#7 signature verification not yet implemented.")},addCertificate:function(Q){if(typeof Q==="string")Q=d.pki.certificateFromPem(Q);$.certificates.push(Q)},addCertificateRevokationList:function(Q){throw Error("PKCS#7 CRL support not yet implemented.")}},$;function J(){var Q={};for(var Y=0;Y<$.signers.length;++Y){var G=$.signers[Y],W=G.digestAlgorithm;if(!(W in Q))Q[W]=d.md[d.pki.oids[W]].create();if(G.authenticatedAttributes.length===0)G.md=Q[W];else G.md=d.md[d.pki.oids[W]].create()}$.digestAlgorithmIdentifiers=[];for(var W in Q)$.digestAlgorithmIdentifiers.push(B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(W).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]));return Q}function X(Q){var Y;if($.detachedContent)Y=$.detachedContent;else Y=$.contentInfo.value[1],Y=Y.value[0];if(!Y)throw Error("Could not sign PKCS#7 message; there is no content to sign.");var G=B.derToOid($.contentInfo.value[0].value),W=B.toDer(Y);W.getByte(),B.getBerValueLength(W),W=W.getBytes();for(var O in Q)Q[O].start().update(W);var M=new Date;for(var U=0;U<$.signers.length;++U){var H=$.signers[U];if(H.authenticatedAttributes.length===0){if(G!==d.pki.oids.data)throw Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.")}else{H.authenticatedAttributesAsn1=B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[]);var V=B.create(B.Class.UNIVERSAL,B.Type.SET,!0,[]);for(var q=0;q<H.authenticatedAttributes.length;++q){var z=H.authenticatedAttributes[q];if(z.type===d.pki.oids.messageDigest)z.value=Q[H.digestAlgorithm].digest();else if(z.type===d.pki.oids.signingTime){if(!z.value)z.value=M}V.value.push(B8(z)),H.authenticatedAttributesAsn1.value.push(B8(z))}W=B.toDer(V).getBytes(),H.md.start().update(W)}H.signature=H.key.sign(H.md,"RSASSA-PKCS1-V1_5")}$.signerInfos=_H($.signers)}};D0.createEncryptedData=function(){var $=null;return $={type:d.pki.oids.encryptedData,version:0,encryptedContent:{algorithm:d.pki.oids["aes256-CBC"]},fromAsn1:function(J){T8($,J,D0.asn1.encryptedDataValidator)},decrypt:function(J){if(J!==void 0)$.encryptedContent.key=J;p1($)}},$};D0.createEnvelopedData=function(){var $=null;return $={type:d.pki.oids.envelopedData,version:0,recipients:[],encryptedContent:{algorithm:d.pki.oids["aes256-CBC"]},fromAsn1:function(J){var X=T8($,J,D0.asn1.envelopedDataValidator);$.recipients=IH(X.recipientInfos.value)},toAsn1:function(){return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,wH($.recipients)),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,xH($.encryptedContent))])])])},findRecipient:function(J){var X=J.issuer.attributes;for(var Q=0;Q<$.recipients.length;++Q){var Y=$.recipients[Q],G=Y.issuer;if(Y.serialNumber!==J.serialNumber)continue;if(G.length!==X.length)continue;var W=!0;for(var O=0;O<X.length;++O)if(G[O].type!==X[O].type||G[O].value!==X[O].value){W=!1;break}if(W)return Y}return null},decrypt:function(J,X){if($.encryptedContent.key===void 0&&J!==void 0&&X!==void 0)switch(J.encryptedContent.algorithm){case d.pki.oids.rsaEncryption:case d.pki.oids.desCBC:var Q=X.decrypt(J.encryptedContent.content);$.encryptedContent.key=d.util.createBuffer(Q);break;default:throw Error("Unsupported asymmetric cipher, OID "+J.encryptedContent.algorithm)}p1($)},addRecipient:function(J){$.recipients.push({version:0,issuer:J.issuer.attributes,serialNumber:J.serialNumber,encryptedContent:{algorithm:d.pki.oids.rsaEncryption,key:J.publicKey}})},encrypt:function(J,X){if($.encryptedContent.content===void 0){X=X||$.encryptedContent.algorithm,J=J||$.encryptedContent.key;var Q,Y,G;switch(X){case d.pki.oids["aes128-CBC"]:Q=16,Y=16,G=d.aes.createEncryptionCipher;break;case d.pki.oids["aes192-CBC"]:Q=24,Y=16,G=d.aes.createEncryptionCipher;break;case d.pki.oids["aes256-CBC"]:Q=32,Y=16,G=d.aes.createEncryptionCipher;break;case d.pki.oids["des-EDE3-CBC"]:Q=24,Y=8,G=d.des.createEncryptionCipher;break;default:throw Error("Unsupported symmetric cipher, OID "+X)}if(J===void 0)J=d.util.createBuffer(d.random.getBytes(Q));else if(J.length()!=Q)throw Error("Symmetric key has wrong length; got "+J.length()+" bytes, expected "+Q+".");$.encryptedContent.algorithm=X,$.encryptedContent.key=J,$.encryptedContent.parameter=d.util.createBuffer(d.random.getBytes(Y));var W=G(J);if(W.start($.encryptedContent.parameter.copy()),W.update($.content),!W.finish())throw Error("Symmetric encryption failed.");$.encryptedContent.content=W.output}for(var O=0;O<$.recipients.length;++O){var M=$.recipients[O];if(M.encryptedContent.content!==void 0)continue;switch(M.encryptedContent.algorithm){case d.pki.oids.rsaEncryption:M.encryptedContent.content=M.encryptedContent.key.encrypt($.encryptedContent.key.data);break;default:throw Error("Unsupported asymmetric cipher, OID "+M.encryptedContent.algorithm)}}}},$};function jH($){var J={},X=[];if(!B.validate($,D0.asn1.recipientInfoValidator,J,X)){var Q=Error("Cannot read PKCS#7 RecipientInfo. ASN.1 object is not an PKCS#7 RecipientInfo.");throw Q.errors=X,Q}return{version:J.version.charCodeAt(0),issuer:d.pki.RDNAttributesAsArray(J.issuer),serialNumber:d.util.createBuffer(J.serial).toHex(),encryptedContent:{algorithm:B.derToOid(J.encAlgorithm),parameter:J.encParameter?J.encParameter.value:void 0,content:J.encKey}}}function CH($){return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[d.pki.distinguishedNameToAsn1({attributes:$.issuer}),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,d.util.hexToBytes($.serialNumber))]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.encryptedContent.algorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]),B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.encryptedContent.content)])}function IH($){var J=[];for(var X=0;X<$.length;++X)J.push(jH($[X]));return J}function wH($){var J=[];for(var X=0;X<$.length;++X)J.push(CH($[X]));return J}function PH($){var J=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,B.integerToDer($.version).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[d.pki.distinguishedNameToAsn1({attributes:$.issuer}),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,d.util.hexToBytes($.serialNumber))]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.digestAlgorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")])]);if($.authenticatedAttributesAsn1)J.value.push($.authenticatedAttributesAsn1);if(J.value.push(B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.signatureAlgorithm).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")])),J.value.push(B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.signature)),$.unauthenticatedAttributes.length>0){var X=B.create(B.Class.CONTEXT_SPECIFIC,1,!0,[]);for(var Q=0;Q<$.unauthenticatedAttributes.length;++Q){var Y=$.unauthenticatedAttributes[Q];X.values.push(B8(Y))}J.value.push(X)}return J}function _H($){var J=[];for(var X=0;X<$.length;++X)J.push(PH($[X]));return J}function B8($){var J;if($.type===d.pki.oids.contentType)J=B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.value).getBytes());else if($.type===d.pki.oids.messageDigest)J=B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.value.bytes());else if($.type===d.pki.oids.signingTime){var X=new Date("1950-01-01T00:00:00Z"),Q=new Date("2050-01-01T00:00:00Z"),Y=$.value;if(typeof Y==="string"){var G=Date.parse(Y);if(!isNaN(G))Y=new Date(G);else if(Y.length===13)Y=B.utcTimeToDate(Y);else Y=B.generalizedTimeToDate(Y)}if(Y>=X&&Y<Q)J=B.create(B.Class.UNIVERSAL,B.Type.UTCTIME,!1,B.dateToUtcTime(Y));else J=B.create(B.Class.UNIVERSAL,B.Type.GENERALIZEDTIME,!1,B.dateToGeneralizedTime(Y))}return B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.type).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SET,!0,[J])])}function xH($){return[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(d.pki.oids.data).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer($.algorithm).getBytes()),!$.parameter?void 0:B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.parameter.getBytes())]),B.create(B.Class.CONTEXT_SPECIFIC,0,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,$.content.getBytes())])]}function T8($,J,X){var Q={},Y=[];if(!B.validate(J,X,Q,Y)){var G=Error("Cannot read PKCS#7 message. ASN.1 object is not a supported PKCS#7 message.");throw G.errors=G,G}var W=B.derToOid(Q.contentType);if(W!==d.pki.oids.data)throw Error("Unsupported PKCS#7 message. Only wrapped ContentType Data supported.");if(Q.encryptedContent){var O="";if(d.util.isArray(Q.encryptedContent))for(var M=0;M<Q.encryptedContent.length;++M){if(Q.encryptedContent[M].type!==B.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting encrypted content constructed of only OCTET STRING objects.");O+=Q.encryptedContent[M].value}else O=Q.encryptedContent;$.encryptedContent={algorithm:B.derToOid(Q.encAlgorithm),parameter:d.util.createBuffer(Q.encParameter.value),content:d.util.createBuffer(O)}}if(Q.content){var O="";if(d.util.isArray(Q.content))for(var M=0;M<Q.content.length;++M){if(Q.content[M].type!==B.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting content constructed of only OCTET STRING objects.");O+=Q.content[M].value}else O=Q.content;$.content=d.util.createBuffer(O)}return $.version=Q.version.charCodeAt(0),$.rawCapture=Q,Q}function p1($){if($.encryptedContent.key===void 0)throw Error("Symmetric key not available.");if($.content===void 0){var J;switch($.encryptedContent.algorithm){case d.pki.oids["aes128-CBC"]:case d.pki.oids["aes192-CBC"]:case d.pki.oids["aes256-CBC"]:J=d.aes.createDecryptionCipher($.encryptedContent.key);break;case d.pki.oids.desCBC:case d.pki.oids["des-EDE3-CBC"]:J=d.des.createDecryptionCipher($.encryptedContent.key);break;default:throw Error("Unsupported symmetric cipher, OID "+$.encryptedContent.algorithm)}if(J.start($.encryptedContent.parameter),J.update($.encryptedContent.content),!J.finish())throw Error("Symmetric decryption failed.");$.content=J.output}}});var o1=H$((nE,i1)=>{var o$=K$();SJ();DQ();WY();TQ();w$();var PY=i1.exports=o$.ssh=o$.ssh||{};PY.privateKeyToPutty=function($,J,X){X=X||"",J=J||"";var Q="ssh-rsa",Y=J===""?"none":"aes256-cbc",G="PuTTY-User-Key-File-2: "+Q+`\r
|
|
16
|
+
`;G+="Encryption: "+Y+`\r
|
|
17
|
+
`,G+="Comment: "+X+`\r
|
|
18
|
+
`;var W=o$.util.createBuffer();vQ(W,Q),WJ(W,$.e),WJ(W,$.n);var O=o$.util.encode64(W.bytes(),64),M=Math.floor(O.length/66)+1;G+="Public-Lines: "+M+`\r
|
|
19
|
+
`,G+=O;var U=o$.util.createBuffer();WJ(U,$.d),WJ(U,$.p),WJ(U,$.q),WJ(U,$.qInv);var H;if(!J)H=o$.util.encode64(U.bytes(),64);else{var V=U.length()+16-1;V-=V%16;var q=wY(U.bytes());q.truncate(q.length()-V+U.length()),U.putBuffer(q);var z=o$.util.createBuffer();z.putBuffer(wY("\x00\x00\x00\x00",J)),z.putBuffer(wY("\x00\x00\x00\x01",J));var K=o$.aes.createEncryptionCipher(z.truncate(8),"CBC");K.start(o$.util.createBuffer().fillWithByte(0,16)),K.update(U.copy()),K.finish();var L=K.output;L.truncate(16),H=o$.util.encode64(L.bytes(),64)}M=Math.floor(H.length/66)+1,G+=`\r
|
|
20
|
+
Private-Lines: `+M+`\r
|
|
21
|
+
`,G+=H;var A=wY("putty-private-key-file-mac-key",J),D=o$.util.createBuffer();vQ(D,Q),vQ(D,Y),vQ(D,X),D.putInt32(W.length()),D.putBuffer(W),D.putInt32(U.length()),D.putBuffer(U);var j=o$.hmac.create();return j.start("sha1",A),j.update(D.bytes()),G+=`\r
|
|
22
|
+
Private-MAC: `+j.digest().toHex()+`\r
|
|
23
|
+
`,G};PY.publicKeyToOpenSSH=function($,J){var X="ssh-rsa";J=J||"";var Q=o$.util.createBuffer();return vQ(Q,X),WJ(Q,$.e),WJ(Q,$.n),X+" "+o$.util.encode64(Q.bytes())+" "+J};PY.privateKeyToOpenSSH=function($,J){if(!J)return o$.pki.privateKeyToPem($);return o$.pki.encryptRsaPrivateKey($,J,{legacy:!0,algorithm:"aes128"})};PY.getPublicKeyFingerprint=function($,J){J=J||{};var X=J.md||o$.md.md5.create(),Q="ssh-rsa",Y=o$.util.createBuffer();vQ(Y,Q),WJ(Y,$.e),WJ(Y,$.n),X.start(),X.update(Y.getBytes());var G=X.digest();if(J.encoding==="hex"){var W=G.toHex();if(J.delimiter)return W.match(/.{2}/g).join(J.delimiter);return W}else if(J.encoding==="binary")return G.getBytes();else if(J.encoding)throw Error('Unknown encoding "'+J.encoding+'".');return G};function WJ($,J){var X=J.toString(16);if(X[0]>="8")X="00"+X;var Q=o$.util.hexToBytes(X);$.putInt32(Q.length),$.putBytes(Q)}function vQ($,J){$.putInt32(J.length),$.putString(J)}function wY(){var $=o$.md.sha1.create(),J=arguments.length;for(var X=0;X<J;++X)$.update(arguments[X]);return $.digest()}});var S8=H$((iE,a1)=>{a1.exports=K$();SJ();A1();m0();eX();qX();f1();DQ();u1();g1();d1();s9();HY();sJ();p9();$8();n1();Q8();n9();y9();NY();P0();u9();o1();M8();w$()});import{Agent as jV,createServer as CV}from"http";import{request as d8}from"http";import{request as CW}from"https";import{connect as IV,isIP as wV}from"net";import{URL as IW}from"url";function Z($,J){if(!process.env.SRT_DEBUG)return;let X=J?.level||"info",Q="[SandboxDebug]";switch(X){case"error":console.error(`${Q} ${$}`);break;case"warn":console.warn(`${Q} ${$}`);break;default:console.error(`${Q} ${$}`)}}import{homedir as iX}from"os";import*as t$ from"path";import*as iJ from"fs";import*as yG from"fs";function D9(){if(process.platform!=="linux")return;try{let $=yG.readFileSync("/proc/version",{encoding:"utf8"}),J=$.match(/WSL(\d+)/i);if(J&&J[1])return J[1];if($.toLowerCase().includes("microsoft"))return"1";return}catch{return}}function _$(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"unknown"}}var XX=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json"],m5=[".git",".vscode",".idea"];function aX(){return[...m5.filter(($)=>$!==".git"),".claude/commands",".claude/agents"]}function R9($){return $.toLowerCase()}function F0($){return $.includes("*")||$.includes("?")||$.includes("[")||$.includes("]")}function YX($){return $.includes("*")||$.includes("?")}function hG($){return _$()==="windows"?YX($):F0($)}function bG($){if(/^\\\\\?\\unc\\/i.test($))return"\\\\"+$.slice(8);if($.startsWith("\\\\?\\"))return $.slice(4);return $}function GX($){let J=t$.win32.toNamespacedPath($);return/^[\\/]{2}[?.][\\/]unc[\\/]/i.test(J)}function qJ($){return $.replace(/\/\*\*$/,"")||"/"}function oX($,J){let X=t$.normalize($),Q=t$.normalize(J);if(Q===X)return!1;if(X.startsWith("/tmp/")&&Q==="/private"+X)return!1;if(X.startsWith("/var/")&&Q==="/private"+X)return!1;if(X.startsWith("/private/tmp/")&&Q===X)return!1;if(X.startsWith("/private/var/")&&Q===X)return!1;if(Q==="/")return!0;if(Q.split("/").filter(Boolean).length<=1)return!0;if(X.startsWith(Q+"/"))return!0;let G=X;if(X.startsWith("/tmp/"))G="/private"+X;else if(X.startsWith("/var/"))G="/private"+X;if(G!==X&&G.startsWith(Q+"/"))return!0;let W=Q.startsWith(X+"/"),O=G!==X&&Q.startsWith(G+"/");if(Q!==X&&!(G!==X&&Q===G)&&!W&&!O)return!0;return!1}function g5($){if($==="~")return iX();if($.startsWith("~/")||process.platform==="win32"&&$.startsWith("~\\"))return iX()+$.slice(1);return $}function l5($){let J=iX(),X=/^[A-Za-z]:/.test(J)?J.slice(0,2):"",Q=X?J.slice(2):J;return $.replace(/%USERPROFILE%/gi,J).replace(/%HOMEDRIVE%/gi,X).replace(/%HOMEPATH%/gi,Q)}function i$($){let J=process.cwd();if(_$()==="windows"){if($=bG(l5($)),/^[a-z]:/.test($))$=$[0].toUpperCase()+$.slice(1);if(GX($)&&!YX($))return t$.win32.normalize($)}if(_$()!=="windows"&&$.endsWith("/")&&$!=="/"&&!hG($))$=$.replace(/\/+$/,"")||"/";let X=g5($);if(X!==$);else if($.startsWith("./")||$.startsWith("../"))X=t$.resolve(J,$);else if(!t$.isAbsolute($))X=t$.resolve(J,$);if(hG(X)){let Q=_$()==="windows"?/[*?]/:/[*?[\]]/,Y=X.split(Q)[0];if(Y&&Y!=="/"){let G=Y.endsWith("/")?Y.slice(0,-1):t$.dirname(Y);try{let W=iJ.realpathSync(G);if(!oX(G,W)){let O=X.slice(G.length);return W+O}}catch{}}return X}try{let Q=iJ.realpathSync(X);if(oX(X,Q));else X=Q}catch{}return X}function FQ(){let $=iX();return["/dev/stdout","/dev/stderr","/dev/null","/dev/tty","/dev/dtracehelper","/dev/autofs_nowait","/tmp/claude","/private/tmp/claude",t$.join($,".npm/_logs"),t$.join($,".claude/debug")]}var d5=["NODE_EXTRA_CA_CERTS","SSL_CERT_FILE","CURL_CA_BUNDLE","REQUESTS_CA_BUNDLE","PIP_CERT","GIT_SSL_CAINFO","AWS_CA_BUNDLE","CARGO_HTTP_CAINFO","DENO_CERT","CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","NIX_SSL_CERT_FILE"];function NQ($,J,X,Q,Y,G){let W=c5(G),O=W===VJ?W:encodeURIComponent(W),M=Q?`${O}:${Q}@`:"",U=["SANDBOX_RUNTIME=1"];if(!Y){let q=process.env.CLAUDE_CODE_TMPDIR||process.env.CLAUDE_TMPDIR||"/tmp/claude";U.push(`TMPDIR=${q}`)}if(X)for(let q of d5)U.push(`${q}=${X}`);if(!$&&!J)return U;let H=["localhost","127.0.0.1","::1","169.254.0.0/16","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"].join(",");if(U.push(`NO_PROXY=${H}`),U.push(`no_proxy=${H}`),$){if(U.push(`HTTP_PROXY=http://${M}localhost:${$}`),U.push(`HTTPS_PROXY=http://${M}localhost:${$}`),U.push(`http_proxy=http://${M}localhost:${$}`),U.push(`https_proxy=http://${M}localhost:${$}`),Q)U.push("GIT_CONFIG_PARAMETERS='http.proxyAuthMethod=basic'")}let V=$?`http://${M}localhost:${$}`:`socks5h://${M}localhost:${J}`;if(U.push(`ALL_PROXY=${V}`),U.push(`all_proxy=${V}`),U.push(`GRPC_PROXY=${V}`),U.push(`grpc_proxy=${V}`),J){let z=_$();if(z==="macos")U.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:${J} %h %p'`);else if(z==="linux"&&$){let K=Q?`,proxyauth=${W}:${Q}`:"";U.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='socat - PROXY:localhost:%h:%p,proxyport=${$}${K}'`)}if(U.push(`FTP_PROXY=socks5h://${M}localhost:${J}`),U.push(`ftp_proxy=socks5h://${M}localhost:${J}`),U.push(`RSYNC_PROXY=localhost:${J}`),U.push(`DOCKER_HTTP_PROXY=http://${M}localhost:${$||J}`),U.push(`DOCKER_HTTPS_PROXY=http://${M}localhost:${$||J}`),$){if(U.push("CLOUDSDK_PROXY_TYPE=http"),U.push("CLOUDSDK_PROXY_ADDRESS=localhost"),U.push(`CLOUDSDK_PROXY_PORT=${$}`),Q)U.push(`CLOUDSDK_PROXY_USERNAME=${W}`),U.push(`CLOUDSDK_PROXY_PASSWORD=${Q}`)}}return U}var p5=8;function WX($){if($.baseEnv?.GIT_CONFIG_COUNT==="0")return{};let J=Number.parseInt($.baseEnv?.GIT_CONFIG_COUNT??"",10),X=Number.isFinite(J)&&J>=0?J:0,Q=X,Y={},G=(O,M)=>{Y[`GIT_CONFIG_KEY_${Q}`]=O,Y[`GIT_CONFIG_VALUE_${Q}`]=M,Q++},W=[...new Set($.safeDirs.filter((O)=>!!O).map((O)=>{let U=O.replace(/\\/g,"/").replace(/\/+$/,"");if(U===""||/^[A-Za-z]:$/.test(U))return`${U}/`;return U}))];if(W.length>p5)G("safe.directory","*");else for(let O of W)G("safe.directory",O),G("safe.directory",O.endsWith("/")?`${O}*`:`${O}/*`);if($.schannelCa)G("http.schannelUseSSLCAInfo","true"),G("http.schannelCheckRevoke","false");if(Q===X)return{};return Y.GIT_CONFIG_COUNT=String(Q),Y}function rX($){let J={GIT_CONFIG_COUNT:process.env.GIT_CONFIG_COUNT};for(let X of $.unsetEnvVars??[])delete J[X];return Object.assign(J,$.setEnvVars??{}),WX({safeDirs:$.safeDirs,baseEnv:J})}function w0($){let J=$.slice(0,100);return Buffer.from(J).toString("base64")}function oJ($){return Buffer.from($,"base64").toString("utf8")}var VJ="srt";function c5($){if(!$)return VJ;let J=`${VJ}.${$}`;return Buffer.byteLength(J)<=255?J:VJ}function sX($){if(!$||!$.startsWith(`${VJ}.`))return;return $.slice(VJ.length+1)||void 0}function OX($){return"^"+$.replace(/[.^$+{}()|\\]/g,"\\$&").replace(/\[([^\]]*?)$/g,"\\[$1").replace(/\*\*\//g,"__GLOBSTAR_SLASH__").replace(/\*\*/g,"__GLOBSTAR__").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/__GLOBSTAR_SLASH__/g,"(.*/)?").replace(/__GLOBSTAR__/g,".*")+"$"}function aJ($,J={}){let X=(M)=>process.platform==="win32"?M.replace(/\\/g,"/"):M,Q=X(i$($)),Y=Q.split(/[*?[\]]/)[0];if(!Y||Y==="/")return Z(`[Sandbox] Glob pattern too broad, skipping: ${$}`),[];let G=Y.endsWith("/")?Y.slice(0,-1):t$.dirname(Y);if(!iJ.existsSync(G))return Z(`[Sandbox] Base directory for glob does not exist: ${G}`),[];let W=new RegExp(OX(Q),J.caseInsensitive?"i":""),O=[];try{let M=iJ.readdirSync(G,{recursive:!0,withFileTypes:!0});for(let U of M){let H=U.parentPath??U.path??G,V=t$.join(H,U.name);if(W.test(X(V)))O.push(V)}}catch(M){Z(`[Sandbox] Error expanding glob pattern ${$}: ${M}`)}return O}var e1=fG(S8(),1);import{sign as vH,X509Certificate as kH}from"crypto";import{mkdtempSync as $W,readFileSync as j8,writeFileSync as C8}from"fs";import{rm as fH}from"fs/promises";import{tmpdir as JW}from"os";import{join as BX,dirname as r1}from"path";import{rootCertificates as yH}from"tls";var{asn1:l$,pki:l0,md:hH,random:bH,util:QW}=e1.default,uH=l0.getTBSCertificate,mH=/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g,_Y="/srt.crl";function I8($){let J=$.getExtension("subjectKeyIdentifier");return J?.subjectKeyIdentifier?QW.hexToBytes(J.subjectKeyIdentifier):$.generateSubjectKeyIdentifier().getBytes()}function w8($,J){let X=l0.oids.sha256WithRSAEncryption;$.siginfo.algorithmOid=X,$.signatureOid=X,$.tbsCertificate=uH($);let Q=l$.toDer($.tbsCertificate).getBytes();$.signature=XW(Q,J),$.md=hH.sha256.create(),$.md.update(Q)}function XW($,J){return vH("sha256",Buffer.from($,"binary"),J).toString("binary")}function P8($){if($.caCertPem&&$.caKeyPem){let J=SX($.caCertPem,$.caKeyPem);if(!J.ok)throw Error(`tlsTerminate: CA PEM pair: ${J.reason}`);return _8($.caCertPem,$.caKeyPem,J.cert,J.key,{certPath:$.caCertPath??"",keyPath:$.caKeyPath??"",extraCaCertPaths:$.extraCaCertPaths})}if($.caCertPath&&$.caKeyPath)return dH($.caCertPath,$.caKeyPath,$.extraCaCertPaths);if($.caCertPath||$.caKeyPath)throw Error("tlsTerminate: caCertPath and caKeyPath must be provided together");return pH($.extraCaCertPaths)}async function YW($){let J=new Set([r1($.trustBundlePath)]);if($.ephemeral)J.add(r1($.certPath));for(let X of J)try{await fH(X,{recursive:!0,force:!0})}catch(Q){Z(`[mitm-ca] cleanup failed: ${Q.message}`,{level:"warn"})}}function gH($,J,X){let Q=[J.trim(),...yH],Y=process.env.NODE_EXTRA_CA_CERTS;if(Y)try{Q.push(j8(Y,"utf8").trim())}catch{}for(let W of X??[]){let O;try{O=j8(W,"utf8")}catch(U){let H=U.code??String(U);Z(`[mitm-ca] extraCaCertPaths: cannot read ${W} (${H}); skipping`,{level:"warn"});continue}let M=O.match(mH);if(!M){Z(`[mitm-ca] extraCaCertPaths: ${W} has no PEM CERTIFICATE block; skipping`,{level:"warn"});continue}Q.push(...M)}let G=BX($,"trust-bundle.crt");return C8(G,Q.join(`
|
|
24
|
+
`)+`
|
|
25
|
+
`,{mode:420}),G}function lH($,J){let X=l0.oids.sha256WithRSAEncryption,Q=()=>kQ([l$.create(h0.UNIVERSAL,OJ.OID,!1,l$.oidToDer(X).getBytes()),l$.create(h0.UNIVERSAL,OJ.NULL,!1,"")]),Y=(q,z)=>kQ([l$.create(h0.UNIVERSAL,OJ.OID,!1,l$.oidToDer(q).getBytes()),l$.create(h0.UNIVERSAL,OJ.OCTETSTRING,!1,l$.toDer(z).getBytes())]),G=l$.create(h0.CONTEXT_SPECIFIC,0,!0,[kQ([Y(l0.oids.authorityKeyIdentifier,kQ([l$.create(h0.CONTEXT_SPECIFIC,0,!1,I8($))])),Y("2.5.29.20",l$.create(h0.UNIVERSAL,OJ.INTEGER,!1,"\x01"))])]),W=new Date,O=$.validity.notAfter,M=O>W?O:TX(1),U=kQ([l$.create(h0.UNIVERSAL,OJ.INTEGER,!1,"\x01"),Q(),l0.distinguishedNameToAsn1($.subject),s1(W),s1(M),G]),H=XW(l$.toDer(U).getBytes(),J),V=kQ([U,Q(),l$.create(h0.UNIVERSAL,OJ.BITSTRING,!1,"\x00"+H)]);return Buffer.from(l$.toDer(V).getBytes(),"binary")}var{Class:h0,Type:OJ}=l$;function kQ($){return l$.create(h0.UNIVERSAL,OJ.SEQUENCE,!0,$)}function s1($){return $.getUTCFullYear()<2050?l$.create(h0.UNIVERSAL,OJ.UTCTIME,!1,l$.dateToUtcTime($)):l$.create(h0.UNIVERSAL,OJ.GENERALIZEDTIME,!1,l$.dateToGeneralizedTime($))}function dH($,J,X){let Q=t1($,"CERTIFICATE","tlsTerminate.caCertPath"),Y=t1(J,"PRIVATE KEY","tlsTerminate.caKeyPath"),G=SX(Q,Y);if(!G.ok)throw Error(`tlsTerminate: CA at ${$}: ${G.reason}`);return Z(`[mitm-ca] loaded CA from ${$}`),_8(Q,Y,G.cert,G.key,{certPath:$,keyPath:J,extraCaCertPaths:X})}function _8($,J,X,Q,Y){let G=$W(BX(JW(),"srt-ca-"));return{certPath:Y.certPath,keyPath:Y.keyPath,trustBundlePath:gH(G,$,Y.extraCaCertPaths),certPem:$,keyPem:J,cert:X,key:Q,leafCerts:new Map,secureContexts:new Map,crlDer:lH(X,J),ephemeral:Y.ephemeral??!1}}function xY($={}){let J=l0.rsa.generateKeyPair(2048),X=l0.createCertificate();X.publicKey=J.publicKey,X.serialNumber=x8(),X.validity.notBefore=TX(-1),X.validity.notAfter=TX($.validityDays??825);let Q=[{name:"commonName",value:$.cn??"sandbox-runtime ephemeral CA"},{name:"organizationName",value:"sandbox-runtime"}];X.setSubject(Q),X.setIssuer(Q),X.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",critical:!0,keyCertSign:!0,cRLSign:!0,digitalSignature:!0},{name:"subjectKeyIdentifier"}]);let Y=l0.privateKeyToPem(J.privateKey);return w8(X,Y),{certPem:l0.certificateToPem(X),keyPem:Y,cert:X,key:J.privateKey}}function fQ($){return new kH($).fingerprint.replace(/:/g,"").toUpperCase()}function SX($,J){let X,Q;try{X=l0.certificateFromPem($),Q=l0.privateKeyFromPem(J)}catch(W){return{ok:!1,reason:`parse: ${W.message}`}}if(!("n"in Q)||!("d"in Q))return{ok:!1,reason:"key is not RSA"};if(X.validity.notBefore.getTime()>Date.now())return{ok:!1,reason:`notBefore ${X.validity.notBefore.toISOString()} is in the future (clock skew?)`};let Y=X.publicKey;if(!("n"in Y)||Y.n.compareTo(Q.n))return{ok:!1,reason:"key does not match certificate public key"};let G;try{G=fQ($)}catch(W){return{ok:!1,reason:`thumbprint: ${W.message}`}}return{ok:!0,thumbprint:G,notAfter:X.validity.notAfter,cert:X,key:Q}}function pH($){let{certPem:J,keyPem:X,cert:Q,key:Y}=xY(),G=$W(BX(JW(),"srt-ca-")),W=BX(G,"ca.crt"),O=BX(G,"ca.key");return C8(W,J,{mode:420}),C8(O,X,{mode:384}),Z(`[mitm-ca] generated ephemeral CA at ${W}`),_8(J,X,Q,Y,{certPath:W,keyPath:O,extraCaCertPaths:$,ephemeral:!0})}function t1($,J,X){let Q;try{Q=j8($,"utf8")}catch(Y){let G=Y.code??String(Y);throw Error(`${X}: cannot read ${$} (${G})`)}if(!new RegExp(`-----BEGIN [A-Z ]*${J}-----`).test(Q))throw Error(`${X}: ${$} is not a PEM ${J}`);return Q}function x8(){let $=bH.getBytesSync(16),J=QW.bytesToHex($);return(parseInt(J[0],16)&7).toString(16)+J.slice(1)}function TX($){let J=new Date;return J.setDate(J.getDate()+$),J}import{PassThrough as cH,Readable as GW}from"stream";var v8=new Set(["GET","HEAD","OPTIONS"]),MW="denied by sandbox policy";function WW($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}async function vY($,J,X,Q,Y,G){let W=J.method??"GET",O,M=J,U=Boolean(J.headers["content-length"]||J.headers["transfer-encoding"]),H=v8.has(W);if(!H||U){let z=new cH;z.on("error",()=>{}),J.pipe(z);let K=GW.toWeb(z),[L,A]=K.tee();O=L,M=GW.fromWeb(A);let D=M;D.on("error",()=>{}),J.on("error",(j)=>{z.end(),D.destroy(j)})}let V;try{let z=O&&!H?{body:O,duplex:"half"}:{};V=new Request(Q,{method:W,headers:nH(J),signal:Y,...z})}catch(z){let K=`malformed request: ${z.message}`;if(G?.(W,Q,K),OW(X,{action:"deny",reason:K}),O?.cancel().catch(()=>{}),M.destroy(),M!==J)WW(J,X);return null}let q;try{q=await $(V)}catch(z){q={action:"deny",reason:`sandbox policy check failed: ${z.message}`}}if(O&&!V.bodyUsed)O.cancel().catch(()=>{});if(q.action==="allow")return Z(`[request-filter] allow ${W} ${Q}`),M;if(G?.(W,Q,q.reason??MW),OW(X,q),M.destroy(),M!==J)WW(J,X);return null}function OW($,J){jX($,J.reason??MW)}function jX($,J){if(Z(`[request-filter] deny: ${J}`),$.headersSent){$.destroy();return}$.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-sandbox-runtime"}),$.end(J+`
|
|
26
|
+
`)}function nH($){let J=new Headers;for(let[X,Q]of Object.entries($.headers)){if(Q===void 0)continue;if(Array.isArray(Q))for(let Y of Q)J.append(X,Y);else J.append(X,Q)}return J}import{createServer as KV,request as EV}from"https";import{connect as zV,isIP as RW}from"net";import{unlink as FV}from"fs";import{tmpdir as NV}from"os";import{join as AV}from"path";import{Transform as iH}from"stream";function oH($){return $.every((J)=>J.sentinel.length===J.realValue.length)}function kY($,J,X,Q){if($===void 0)return;let Y=J.headers["content-length"]!==void 0||J.headers["transfer-encoding"]!==void 0;if(v8.has(J.method??"GET")&&!Y)return;let G=$(Q);if(!G?.length)return;if(J.headers["content-encoding"]!==void 0){Z(`[body-substitution] ${Q}: request body has Content-Encoding "${String(J.headers["content-encoding"])}"; masked-credential `+"substitution skipped \u2014 a sentinel in this body reaches the "+"upstream as the fake value",{level:"warn"});return}if(!oH(G))delete X["content-length"];return aH(G)}function aH($){let J=Math.max(...$.map((Q)=>Q.sentinel.length)),X;return new iH({transform(Q,Y,G){let W=Buffer.isBuffer(Q)?Q:Buffer.from(Q,Y),O=X?.length?Buffer.concat([X,W]):W,{out:M,tail:U}=rH(O,$,J);X=U,G(null,M)},flush(Q){Q(null,X?.length?X:void 0)}})}function rH($,J,X){let Q=[],Y=0;for(;;){let W=-1,O;for(let M of J){let U=$.indexOf(M.sentinel,Y);if(U!==-1&&(W===-1||U<W))W=U,O=M}if(O===void 0)break;Q.push($.subarray(Y,W),O.realValue),Y=W+O.sentinel.length}let G=Math.max(Y,$.length-(X-1));return Q.push($.subarray(Y,G)),{out:Buffer.concat(Q),tail:Buffer.from($.subarray(G))}}var UW=fG(S8(),1);import{isIP as sH}from"net";import{createSecureContext as tH}from"tls";var{pki:fY}=UW.default;function k8($,J){let X=$.leafCerts.get(J);if(X)return X;let Q=fY.rsa.generateKeyPair(2048),Y=fY.createCertificate();Y.publicKey=Q.publicKey,Y.serialNumber=x8();let G=TX(-1);Y.validity.notBefore=G,Y.validity.notAfter=$V($.cert,G),Y.setSubject([{name:"commonName",value:J}]),Y.setIssuer($.cert.subject.attributes),Y.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",critical:!0,digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[eH(J)]},{name:"subjectKeyIdentifier"},{name:"authorityKeyIdentifier",keyIdentifier:I8($.cert)},...$.crlUrl?[{name:"cRLDistributionPoints",altNames:[{type:6,value:$.crlUrl}]}]:[]]),w8(Y,$.keyPem);let W={certPem:fY.certificateToPem(Y)+$.certPem,keyPem:fY.privateKeyToPem(Q.privateKey)};return $.leafCerts.set(J,W),Z(`[mitm-leaf] minted RSA leaf for ${J}`),W}function HW($,J){let X=$.secureContexts.get(J);if(X)return X;let{certPem:Q,keyPem:Y}=k8($,J),G=tH({cert:Q,key:Y});return $.secureContexts.set(J,G),G}function eH($){return sH($)!==0?{type:7,ip:$}:{type:2,value:$}}function $V($,J){let X=$.validity.notAfter,Q=new Date(J);return Q.setDate(Q.getDate()+99),X<Q?new Date(X):Q}import{BlockList as VW,connect as qW,isIP as WQ}from"net";import{connect as JV}from"tls";import{URL as f8}from"url";var KW=30000,QV=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);function y8($){let J=$?.http??process.env.HTTP_PROXY??process.env.http_proxy??void 0,X=$?.https??process.env.HTTPS_PROXY??process.env.https_proxy??J,Q=$?.noProxy??process.env.NO_PROXY??process.env.no_proxy??"";if(!J&&!X)return;let Y=(O)=>{if(!O)return;let U=/^[a-z][a-z0-9+.-]*:\/\//i.test(O)?O:`http://${O}`;try{let H=new f8(U);if(H.protocol!=="http:"&&H.protocol!=="https:"||!H.hostname)throw Error("unsupported scheme or empty host");return H}catch{Z(`Invalid parent proxy URL, ignoring: ${GV(O)}`,{level:"error"});return}},G=Y(J),W=Y(X);if(!G&&!W)return;return{httpUrl:G,httpsUrl:W,noProxy:XV(Q)}}function XV($){let J={all:!1,suffixes:[],cidr:new VW};for(let X of $.split(",")){if(X=X.trim(),!X)continue;if(X==="*"){J.all=!0;continue}let Q=X.indexOf("/");if(Q!==-1){let O=X.slice(0,Q),M=X.slice(Q+1),U=WQ(O);if(U&&M!==""&&/^\d+$/.test(M)){let H=Number(M),V=U===6?128:32;if(H>=0&&H<=V){try{J.cidr.addSubnet(O,H,U===6?"ipv6":"ipv4")}catch{}continue}}continue}let Y=X.toLowerCase(),G=/^\[([^\]]+)\](?::\d+)?$/.exec(Y);if(G)Y=G[1];if(Y.startsWith("*."))Y=Y.slice(1);let W=WQ(Y);if(!W){let O=Y.lastIndexOf(":");if(O!==-1&&/^\d+$/.test(Y.slice(O+1)))Y=Y.slice(0,O)}else try{J.cidr.addAddress(Y,W===6?"ipv6":"ipv4");continue}catch{}J.suffixes.push(Y)}return J}function CX($,J){let X=d0(J.toLowerCase().replace(/\.$/,""));if(X==="localhost")return!0;let Q=WQ(X);if(Q){if(YV.check(X,Q===6?"ipv6":"ipv4"))return!0}if($.noProxy.all)return!0;if(Q){if($.noProxy.cidr.check(X,Q===6?"ipv6":"ipv4"))return!0}for(let Y of $.noProxy.suffixes)if(Y.startsWith(".")){if(X===Y.slice(1)||X.endsWith(Y))return!0}else if(X===Y||X.endsWith("."+Y))return!0;return!1}var YV=(()=>{let $=new VW;return $.addSubnet("127.0.0.0",8,"ipv4"),$.addAddress("::1","ipv6"),$.addSubnet("::ffff:127.0.0.0",104,"ipv6"),$})();function IX($,J){if(J.isHttps)return $.httpsUrl??$.httpUrl;return $.httpUrl}function h8($){let{destHost:J,destPort:X}=$,Q=d0(J);if(!yQ(Q))return Promise.reject(Error(`Invalid destination host for CONNECT: ${JSON.stringify(J)}`));if(!Number.isInteger(X)||X<1||X>65535)return Promise.reject(Error(`Invalid destination port: ${X}`));let Y=WQ(Q)===6?`[${Q}]:${X}`:`${Q}:${X}`;return new Promise((G,W)=>{let O=$.dial(),M=!1,U=(V)=>{if(M)return;M=!0,O.destroy(),W(V)},H=()=>U(Error("Proxy closed during CONNECT handshake"));O.setTimeout($.timeoutMs??KW,()=>U(Error("CONNECT handshake timed out"))),O.once("error",U),O.once("close",H),O.once($.readyEvent,()=>{O.write(`CONNECT ${Y} HTTP/1.1\r
|
|
27
|
+
Host: ${Y}\r
|
|
28
|
+
`+($.authHeader?`Proxy-Authorization: ${$.authHeader}\r
|
|
29
|
+
`:"")+`\r
|
|
30
|
+
`);let V="",q=(z)=>{V+=z.toString("latin1");let K=V.indexOf(`\r
|
|
31
|
+
\r
|
|
32
|
+
`);if(K===-1){if(V.length>16384)U(Error("CONNECT response header too large"));return}O.pause(),O.removeListener("data",q);let L=V.slice(0,V.indexOf(`\r
|
|
33
|
+
`));if(!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(L))return U(Error(`Proxy refused CONNECT: ${L.trim()}`));let A=V.slice(K+4);if(A.length)O.unshift(Buffer.from(A,"latin1"));M=!0,O.setTimeout(0),O.removeListener("error",U),O.removeListener("close",H),G(O)};O.on("data",q)})})}function yY($,J,X){let Q=d0($.hostname),Y=Number($.port)||($.protocol==="https:"?443:80),G=$.protocol==="https:";return h8({destHost:J,destPort:X,authHeader:b8($),readyEvent:G?"secureConnect":"connect",dial:()=>G?JV({host:Q,port:Y,...WQ(Q)?{}:{servername:Q}}):qW(Y,Q)})}function b8($){if(!$.username&&!$.password)return;try{let J=`${decodeURIComponent($.username)}:${decodeURIComponent($.password)}`;return`Basic ${Buffer.from(J).toString("base64")}`}catch{let J=`${$.username}:${$.password}`;return`Basic ${Buffer.from(J).toString("base64")}`}}function kJ($){let J=new Set,X=$.connection;if(X)for(let Y of String(X).split(","))J.add(Y.trim().toLowerCase());let Q={};for(let[Y,G]of Object.entries($)){let W=Y.toLowerCase();if(!QV.has(W)&&!J.has(W))Q[Y]=G}return Q}function d0($){return $.startsWith("[")&&$.endsWith("]")?$.slice(1,-1):$}function u8($){if(!$)return"-";if(!$.username&&!$.password)return $.href;let J=new f8($.href);return J.username="***",J.password="***",J.href}function GV($){return $.replace(/\/\/[^@/]*@/,"//***:***@")}function yQ($){if(!$||$.length>255)return!1;let J=d0($);if(J.includes("%"))return!1;if(WQ(J))return!0;return/^[A-Za-z0-9._-]+$/.test(J)}function j0($){try{let J=d0($),X=WQ(J)===6?`[${J}]`:J,Q=new f8(`http://${X}/`).hostname;return d0(Q).replace(/\.$/,"")}catch{return}}function hY($,J,X=KW){return new Promise((Q,Y)=>{let G=qW(J,$),W=!1,O=(M)=>{if(W)return;if(W=!0,G.setTimeout(0),M)G.destroy(),Y(M);else Q(G)};G.setTimeout(X,()=>O(Error("connect timed out"))),G.once("connect",()=>O()),G.once("error",O),G.once("close",()=>O(Error("socket closed before connect")))})}import{createHash as WV,createHmac as NW}from"crypto";var wX="AWS4-HMAC-SHA256",OV="AWS4-ECDSA-P256-SHA256",uY="UNSIGNED-PAYLOAD";function AW($,J){let X=hQ($.authorization);if(X!==void 0&&X.startsWith(OV)){let O=EW(X);if(O!==void 0)return{kind:"sigv4a",accessKeyId:O}}else if(X!==void 0&&X.startsWith(wX)){let O=EW(X);if(O!==void 0)return{kind:hQ($["x-amz-content-sha256"])?.startsWith("STREAMING-")?"streaming":"header-sigv4",accessKeyId:O}}let Q=J.indexOf("?");if(Q===-1)return null;let Y=new URLSearchParams(J.slice(Q+1));if(Y.get("X-Amz-Algorithm")!==wX)return null;if(!Y.has("X-Amz-Signature"))return null;let G=Y.get("X-Amz-Credential");if(!G)return null;let W=G.split("/")[0];return W?{kind:"presigned",accessKeyId:W}:null}function EW($){return/Credential=([^/,\s]+)\//.exec($)?.[1]}function LW($){if(!$.startsWith(wX))return null;let J=/Credential=([^,\s]+)/.exec($)?.[1],X=/SignedHeaders=([^,\s]+)/.exec($)?.[1],Q=/Signature=([0-9a-fA-F]+)/.exec($)?.[1];if(!J||!X||!Q)return null;let Y=J.split("/");if(Y.length!==5||Y[4]!=="aws4_request")return null;let[G,W,O,M]=Y;if(!G||!W||!O||!M)return null;return{accessKeyId:G,date:W,region:O,service:M,signedHeaders:X.split(";").map((U)=>U.toLowerCase()),signature:Q}}function m8($){return encodeURIComponent($).replace(/[!'()*]/g,(J)=>"%"+J.charCodeAt(0).toString(16).toUpperCase())}function MV($,J){if($==="")return"/";if(J==="s3")return $;let X=[];for(let G of $.split("/")){if(G===""||G===".")continue;if(G==="..")X.pop();else X.push(G)}let Q=X.length>0&&$.endsWith("/")?"/":"",Y=`/${X.join("/")}${Q}`;return m8(Y).replace(/%2F/gi,"/")}function UV($){if($==="")return"";let J=[];for(let X of $.split("&")){if(X==="")continue;let Q=X.indexOf("="),Y=Q===-1?X:X.slice(0,Q),G=Q===-1?"":X.slice(Q+1);J.push([m8(zW(Y)),m8(zW(G))])}return J.sort(([X,Q],[Y,G])=>X<Y?-1:X>Y?1:Q<G?-1:Q>G?1:0),J.map(([X,Q])=>`${X}=${Q}`).join("&")}function zW($){try{return decodeURIComponent($)}catch{return $}}function FW($){return $.trim().replace(/[ \t]+/g," ")}function HV($){let J=$.requestTarget.indexOf("?"),X=J===-1?$.requestTarget:$.requestTarget.slice(0,J),Q=J===-1?"":$.requestTarget.slice(J+1),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=[];for(let W of Y){let O=W==="host"?$.hostHeader:$.headers[W];if(O===void 0)throw Error(`signed header "${W}" is missing from the request`);let M=Array.isArray(O)?O.map(FW).join(","):FW(String(O));G.push(`${W}:${M}`)}return[$.method.toUpperCase(),MV(X,$.scope.service),UV(Q),G.join(`
|
|
34
|
+
`)+`
|
|
35
|
+
`,Y.join(";"),$.payloadHash].join(`
|
|
36
|
+
`)}function VV($,J,X){return[wX,J,`${X.date}/${X.region}/${X.service}/aws4_request`,g8($)].join(`
|
|
37
|
+
`)}function qV($,J){let X=bY(`AWS4${$}`,J.date),Q=bY(X,J.region),Y=bY(Q,J.service);return bY(Y,"aws4_request")}function DW($){let J=HV($),X=VV(J,$.amzDate,$.scope),Q=NW("sha256",qV($.secretAccessKey,$.scope)).update(X,"utf8").digest("hex"),Y=[...$.signedHeaders].map((W)=>W.toLowerCase()).sort(),G=`${$.scope.date}/${$.scope.region}/${$.scope.service}/aws4_request`;return{authorization:`${wX} Credential=${$.accessKeyId}/${G}, SignedHeaders=${Y.join(";")}, Signature=${Q}`,signature:Q,canonicalRequest:J,stringToSign:X}}function g8($){return WV("sha256").update($).digest("hex")}function bY($,J){return NW("sha256",$).update(J,"utf8").digest()}function hQ($){return Array.isArray($)?$[0]:$}var TW=67108864;class l8 extends Error{}function ZW($){return $.length>=3&&$[0]===22&&$[1]===3&&$[2]<=3}function SW($,J){if(J.length>=3)return Promise.resolve({isTLS:ZW(J),head:J});return new Promise((X)=>{let Q=J,Y=()=>{$.removeListener("data",G),$.removeListener("close",Y),X({isTLS:ZW(Q),head:Q})},G=(W)=>{if($.pause(),Q=Q.length?Buffer.concat([Q,W]):W,Q.length>=3)return Y();$.resume()};$.on("data",G),$.once("close",Y)})}function LV($,J){let X=()=>{let Q;while((Q=$.read())!==null)if(!J.write(Q)){J.once("drain",X);return}$.once("readable",X)};X(),$.once("end",()=>J.end())}function jW($,J,X,Q,Y,G,W,O,M=TW){let U=k8($,W.hostname),H=KV({ALPNProtocols:["http/1.1"],cert:U.certPem,key:U.keyPem,SNICallback:(z,K)=>{try{K(null,HW($,z||W.hostname))}catch(L){K(L)}}});H.on("request",(z,K)=>{z.on("error",(L)=>{Z(`[tls-terminate] client request error: ${L.message}`,{level:"error"})}),K.on("error",(L)=>{Z(`[tls-terminate] client response error: ${L.message}`,{level:"error"})}),DV(J,X,Q,z,K,W,O,M)}),H.on("clientError",(z,K)=>{Z(`[tls-terminate] client connection error for ${W.hostname}: ${z.message}`,{level:"error"}),K.destroy()}),H.on("tlsClientError",(z,K)=>{Z(`[tls-terminate] client TLS error for ${W.hostname}: ${z.message}`,{level:"error"}),K.destroy()}),H.on("upgrade",(z,K)=>{Z("[tls-terminate] upgrade request refused",{level:"warn"}),K.destroy()});let V=SV(),q=()=>{H.close(),FV(V,()=>{})};H.on("error",(z)=>{Z(`[tls-terminate] inner server listen failed: ${z.message}`,{level:"error"}),Y.destroy(),q()}),H.listen(V,()=>{let z=zV({path:V});z.on("error",(K)=>{Z(`[tls-terminate] inner loopback failed: ${K.message}`,{level:"error"}),Y.destroy(),q()}),z.once("connect",()=>{if(G.length)z.write(G);LV(Y,z),z.pipe(Y)}),Y.on("error",()=>z.destroy()),Y.once("close",()=>{z.destroy(),q()}),z.once("close",()=>Y.destroy())}),H.unref()}function BW($,J){if(J.writableFinished||J.destroyed){$.destroy();return}J.once("finish",()=>$.destroy()),J.once("close",()=>$.destroy())}function DV(...$){RV(...$).catch((J)=>{Z(`[tls-terminate] forwardUpstream failed: ${J.message}`,{level:"error"})})}async function RV($,J,X,Q,Y,G,W,O=TW){let M=BV(Q.url),U=Q;if($){let A=new AbortController;Y.once("close",()=>A.abort());let D=G.port===443?G.hostname:`${G.hostname}:${G.port}`,j=await vY($,Q,Y,`https://${D}${M}`,A.signal,G.onFilterRequestDeny);if(j===null)return;if(U=j,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||U.destroyed){U.destroy();return}}let H=kJ(Q.headers);delete H.host;let V=W?.(Q.method??"GET",M,H,G.hostname);J?.(H,G.hostname);let q=kY(X,Q,H,G.hostname),z;if(V?.action==="deny"){if(jX(Y,V.reason),U.destroy(),U!==Q)BW(Q,Y);return}if(V?.action==="resign"){let A=V.payloadHash;if(A===void 0){let S=q?U.pipe(q):U;if(q)U.on("error",(P)=>q.destroy(P));try{z=await ZV(S,O)}catch(P){if(P instanceof l8){jX(Y,`AWS SigV4 request uses a masked credential and signs a literal body hash, so the proxy must buffer the body to re-sign it, but the body exceeds the ${O}-byte buffering limit; denied. Sign the payload as UNSIGNED-PAYLOAD to stream it without buffering, or use an unmasked credential to have the request forwarded untouched.`),S.resume();return}Z(`[tls-terminate] failed to buffer body for SigV4 re-sign: ${P.message}`,{level:"error"}),Y.destroy();return}A=g8(z),H["content-length"]=String(z.length)}let D=RW(G.hostname)===6?`[${G.hostname}]`:G.hostname,j=G.port===443?D:`${D}:${G.port}`;try{V.apply(H,j,A)}catch(S){if(jX(Y,`AWS SigV4 re-signing failed: ${S.message}`),U.destroy(),U!==Q)BW(Q,Y);return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&z===void 0&&H["content-length"]===void 0&&H["transfer-encoding"]===void 0)H["transfer-encoding"]="chunked";let L=EV({host:G.hostname,port:G.port,path:M,method:Q.method,headers:H,...RW(G.hostname)?{}:{servername:G.hostname},...G.upstreamCA?{ca:G.upstreamCA}:{},agent:!1},(A)=>{A.on("error",(D)=>{Z(`[tls-terminate] upstream response error: ${D.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(A.statusCode??502,kJ(A.headers)),A.pipe(Y)});if(L.on("error",(A)=>{if(Z(`[tls-terminate] upstream ${G.hostname}:${G.port} failed: ${A.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>L.destroy()),z!==void 0)L.end(z);else if(q)q.on("error",(A)=>L.destroy(A)),U.on("error",(A)=>q.destroy(A)),Y.on("close",()=>q.destroy()),U.pipe(q).pipe(L);else U.on("error",(A)=>L.destroy(A)),U.pipe(L)}function ZV($,J){return new Promise((X,Q)=>{let Y=[],G=0,W=(O)=>{if(G+=O.length,G>J){Y.length=0,$.removeListener("data",W),Q(new l8(`request body exceeds ${J} bytes`));return}Y.push(O)};$.on("data",W),$.once("end",()=>X(Buffer.concat(Y))),$.once("error",Q)})}function BV($){let J=$??"/";if(J.startsWith("/"))return J;try{let X=new URL(J);return`${X.pathname}${X.search}`||"/"}catch{return J}}var TV=0;function SV(){return AV(NV(),`srt-tt-${process.pid}-${(TV++).toString(36)}.sock`)}function wW($){let J=CV();J.on("clientError",(Q,Y)=>{if(Z(`Client connection error: ${Q.message}`,{level:"error"}),Y.on("error",()=>{}),Q.code!=="ECONNRESET"&&Y.writable){let G=Q.code==="HPE_HEADER_OVERFLOW"?"431 Request Header Fields Too Large":"400 Bad Request";Y.end(`HTTP/1.1 ${G}\r
|
|
38
|
+
\r
|
|
39
|
+
`,()=>Y.destroy()),setTimeout(()=>Y.destroy(),1000).unref?.();return}Y.destroy()});let X=(Q)=>{if(!$.proxyAuthToken)return{ok:!0};let Y=/^basic\s+([a-z0-9+/=]+)\s*$/i.exec(Q??"");if(!Y)return{ok:!1};let G=Buffer.from(Y[1],"base64").toString("utf8"),W=G.indexOf(":");if(W<=0||G.slice(W+1)!==$.proxyAuthToken)return{ok:!1};return{ok:!0,encodedCommand:sX(G.slice(0,W))}};return J.on("connect",async(Q,Y,G)=>{Y.on("error",(D)=>{Z(`Client socket error: ${D.message}`,{level:"error"}),Y.destroy()});let W=!1;Y.once("close",()=>{W=!0});let O=()=>{W=!0,Y.destroy()},M=65536,U=0,H=!1,V=[],q=(D)=>{if(!H)return;if(U+=D.length,U>M){Z("CONNECT client exceeded pre-establishment capture cap; destroying",{level:"error"}),O();return}V.push(D)};if(!$.mitmCA)H=!0,Y.on("data",q);if(Y.readableEnded)O();else Y.once("end",O);let z=()=>{if(H=!1,V.length)G=Buffer.concat([G,...V]),V.length=0},K=()=>{Y.removeListener("end",O),z()},L=(D)=>{if(W||Y.destroyed||Y.readableEnded||!Y.writable){Z("CONNECT client gone before status write; dropping verdict and destroying socket"),Y.destroy();return}K(),Y.end(D)};if(W||Y.destroyed)return;let A=!1;try{let D=X(Q.headers["proxy-authorization"]);if(!D.ok){L(`HTTP/1.1 407 Proxy Authentication Required\r
|
|
40
|
+
Proxy-Authenticate: Basic realm="srt"\r
|
|
41
|
+
\r
|
|
42
|
+
`);return}let j=PV(Q.url);if(!j){Z(`Invalid CONNECT request: ${Q.url}`,{level:"error"}),L(`HTTP/1.1 400 Bad Request\r
|
|
43
|
+
\r
|
|
44
|
+
`);return}let{hostname:S,port:P}=j;if(!await $.filter(P,S,Y,D.encodedCommand)){Z(`Connection blocked to ${S}:${P}`,{level:"error"}),L(`HTTP/1.1 403 Forbidden\r
|
|
45
|
+
Content-Type: text/plain\r
|
|
46
|
+
X-Proxy-Error: blocked-by-allowlist\r
|
|
47
|
+
\r
|
|
48
|
+
Connection blocked by network allowlist`);return}if(W||Y.destroyed){Y.destroy();return}let w=j0(S)??S;if($.mitmCA&&($.shouldTerminateTLS?.(w,P)??!0)){Y.write(`HTTP/1.1 200 Connection Established\r
|
|
49
|
+
\r
|
|
50
|
+
`),A=!0;let G$=await SW(Y,G);if(W||Y.destroyed){Y.destroy();return}if(G$.isTLS){K(),jW($.mitmCA,$.filterRequest,$.mutateHeaders,$.getBodySubstitutions,Y,G$.head,{hostname:w,port:P,upstreamCA:$.tlsTerminateUpstreamCA,onFilterRequestDeny:$.onFilterRequestDenied?(T$,Z$,W$)=>$.onFilterRequestDenied({method:T$,url:Z$,reason:W$,encodedCommand:D.encodedCommand}):void 0},$.planSigv4,$.maxSigv4ResignBodyBytes);return}Z(`[tls-terminate] non-TLS bytes on CONNECT ${w}:${P}; opaque-tunnelling`),G=G$.head}else if($.mitmCA)Z(`[tls-terminate] policy exempts ${w}:${P}; opaque-tunnelling`);let b=$.getMitmSocketPath?.(w),t=!b&&$.parentProxy&&!CX($.parentProxy,w)?IX($.parentProxy,{isHttps:!0}):void 0,r;try{if(b)Z(`Routing CONNECT ${w}:${P} through MITM proxy at ${b}`),r=await h8({dial:()=>IV({path:b}),readyEvent:"connect",destHost:w,destPort:P});else if(t)r=await yY(t,w,P);else r=await hY(w,P)}catch(G$){if(Z(`CONNECT tunnel failed: ${G$.message}`,{level:"error"}),A)Y.destroy();else L(`HTTP/1.1 502 Bad Gateway\r
|
|
51
|
+
\r
|
|
52
|
+
`);return}if(W||Y.destroyed){r.on("error",()=>{}),r.destroy(),Y.destroy();return}if(!A)Y.write(`HTTP/1.1 200 Connection Established\r
|
|
53
|
+
\r
|
|
54
|
+
`);if(K(),Y.allowHalfOpen=!0,G.length)r.write(G);r.pipe(Y),Y.pipe(r),r.on("error",(G$)=>{Z(`CONNECT tunnel failed: ${G$.message}`,{level:"error"}),Y.destroy()}),Y.on("close",()=>r.destroy()),r.on("close",()=>Y.destroy())}catch(D){if(Z(`Error handling CONNECT: ${D}`,{level:"error"}),A)Y.destroy();else L(`HTTP/1.1 500 Internal Server Error\r
|
|
55
|
+
\r
|
|
56
|
+
`)}}),J.on("request",async(Q,Y)=>{Q.on("error",(G)=>{Z(`Client request error: ${G.message}`,{level:"error"})}),Y.on("error",(G)=>{Z(`Client response error: ${G.message}`,{level:"error"}),Y.socket?.destroy()});try{if($.mitmCA&&Q.method==="GET"&&new IW(Q.url??"","http://x").pathname===_Y){Y.writeHead(200,{"Content-Type":"application/pkix-crl","Content-Length":$.mitmCA.crlDer.length}),Y.end($.mitmCA.crlDer);return}let G=X(Q.headers["proxy-authorization"]);if(!G.ok){Y.writeHead(407,{"Proxy-Authenticate":'Basic realm="srt"'}),Y.end();return}let W=new IW(Q.url),O=d0(W.hostname),M=W.port?parseInt(W.port,10):W.protocol==="https:"?443:80;if(!await $.filter(M,O,Q.socket,G.encodedCommand)){if(Z(`HTTP request blocked to ${O}:${M}`,{level:"error"}),Q.socket.destroyed||Y.destroyed){Y.destroy();return}Y.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-allowlist"}),Y.end("Connection blocked by network allowlist");return}if(Q.socket.destroyed)return;let H=j0(O)??O,V=(wV(H)===6?`[${H}]`:H)+(W.port?`:${W.port}`:""),q={...kJ(Q.headers),host:V};$.mutateHeadersPlaintext?.(q,H);let z=kY($.getBodySubstitutionsPlaintext,Q,q,H),K=$.getMitmSocketPath?.(H),L=!K&&$.parentProxy&&!CX($.parentProxy,H)?IX($.parentProxy,{isHttps:W.protocol==="https:"}):void 0,A=`${W.protocol}//${V}${W.pathname}${W.search}`,D=Q;if($.filterRequest){let P=new AbortController;Y.once("close",()=>P.abort());let C=await vY($.filterRequest,Q,Y,A,P.signal,$.onFilterRequestDenied?(w,b,t)=>$.onFilterRequestDenied({method:w,url:b,reason:t,encodedCommand:G.encodedCommand}):void 0);if(C===null)return;if(D=C,Q.destroyed&&!Q.readableEnded||Y.destroyed||Q.socket.destroyed||D.destroyed){D.destroy();return}}if(Boolean(Q.headers["content-length"]||Q.headers["transfer-encoding"])&&q["content-length"]===void 0&&q["transfer-encoding"]===void 0)q["transfer-encoding"]="chunked";let S;if(K){Z(`Routing HTTP ${Q.method} ${H}:${M} through MITM proxy at ${K}`);let P=new jV({socketPath:K});S=d8({agent:P,path:A,method:Q.method,headers:q},(C)=>{C.on("error",(w)=>{Z(`Upstream response error: ${w.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(C.statusCode,kJ(C.headers)),C.pipe(Y)})}else if(L){let P=d0(L.hostname),C=Number(L.port)||(L.protocol==="https:"?443:80),w=b8(L);S=(L.protocol==="https:"?CW:d8)({hostname:P,port:C,path:A,method:Q.method,headers:w?{...q,"proxy-authorization":w}:q},(t)=>{t.on("error",(r)=>{Z(`Upstream response error: ${r.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(t.statusCode,kJ(t.headers)),t.pipe(Y)})}else S=(W.protocol==="https:"?CW:d8)({hostname:H,port:M,path:W.pathname+W.search,method:Q.method,headers:q},(C)=>{C.on("error",(w)=>{Z(`Upstream response error: ${w.message}`,{level:"error"}),Y.destroy()}),Y.writeHead(C.statusCode,kJ(C.headers)),C.pipe(Y)});if(S.on("error",(P)=>{if(Z(`Proxy request failed: ${P.message}`,{level:"error"}),!Y.headersSent)Y.writeHead(502,{"Content-Type":"text/plain"}),Y.end("Bad Gateway");else Y.destroy()}),Y.on("close",()=>S.destroy()),z)z.on("error",(P)=>S.destroy(P)),D.on("error",(P)=>z.destroy(P)),Y.on("close",()=>z.destroy()),D.pipe(z).pipe(S);else D.on("error",(P)=>S.destroy(P)),D.pipe(S)}catch(G){if(Z(`Error handling HTTP request: ${G}`,{level:"error"}),!Y.headersSent)Y.writeHead(500,{"Content-Type":"text/plain"}),Y.end("Internal Server Error");else Y.destroy()}}),J}function PV($){let J=/^\[([^\]]+)\]:(\d+)$/.exec($)??/^([^:]+):(\d+)$/.exec($);if(!J)return;let X=Number(J[2]);if(!Number.isInteger(X)||X<1||X>65535)return;return{hostname:J[1],port:X}}import _V from"net";import vV from"net";var _W=(($)=>{return $[$.connect=1]="connect",$[$.bind=2]="bind",$[$.udp=3]="udp",$})(_W||{}),p8=(($)=>{return $[$.REQUEST_GRANTED=0]="REQUEST_GRANTED",$[$.GENERAL_FAILURE=1]="GENERAL_FAILURE",$[$.CONNECTION_NOT_ALLOWED=2]="CONNECTION_NOT_ALLOWED",$[$.NETWORK_UNREACHABLE=3]="NETWORK_UNREACHABLE",$[$.HOST_UNREACHABLE=4]="HOST_UNREACHABLE",$[$.CONNECTION_REFUSED=5]="CONNECTION_REFUSED",$[$.TTL_EXPIRED=6]="TTL_EXPIRED",$[$.COMMAND_NOT_SUPPORTED=7]="COMMAND_NOT_SUPPORTED",$[$.ADDRESS_TYPE_NOT_SUPPORTED=8]="ADDRESS_TYPE_NOT_SUPPORTED",$})(p8||{}),xV=class{constructor($,J){this.errorHandler=()=>{},this.metadata={},this.socket=J,this.server=$,J.on("error",this.errorHandler),J.pause(),this.handleGreeting()}readBytes($){return new Promise((J)=>{let X=Buffer.allocUnsafe($),Q=0,Y=(G)=>{let W=Math.min(G.length,$-Q);if(G.copy(X,Q,0,W),Q+=W,Q<$)return;this.socket.removeListener("data",Y),this.socket.push(G.subarray(W)),J(X),this.socket.pause()};this.socket.on("data",Y),this.socket.resume()})}async handleGreeting(){if((await this.readBytes(1)).readUInt8()!==5)return this.socket.destroy();let J=(await this.readBytes(1)).readUInt8();if(J>128||J===0)return this.socket.destroy();let X=await this.readBytes(J),Q=this.server.authHandler?2:0;if(!X.includes(Q))return this.socket.write(Buffer.from([5,255])),this.socket.destroy();if(this.socket.write(Buffer.from([5,Q])),this.server.authHandler)this.handleUserPassword();else this.handleConnectionRequest()}async handleUserPassword(){await this.readBytes(1);let $=(await this.readBytes(1)).readUint8(),J=(await this.readBytes($)).toString(),X=(await this.readBytes(1)).readUint8(),Q=(await this.readBytes(X)).toString();this.username=J,this.password=Q;let Y=!1,G=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,0])),this.handleConnectionRequest()},W=()=>{if(Y)return;Y=!0,this.socket.write(Buffer.from([1,1])),this.socket.destroy()},O=await this.server.authHandler(this,G,W);if(O===!0)G();else if(O===!1)W()}async handleConnectionRequest(){await this.readBytes(1);let $=(await this.readBytes(1))[0],J=_W[$];if(!J)return this.socket.destroy();this.command=J,await this.readBytes(1);let X=(await this.readBytes(1)).readUInt8(),Q="";switch(X){case 1:Q=(await this.readBytes(4)).join(".");break;case 3:let U=(await this.readBytes(1)).readUInt8();Q=(await this.readBytes(U)).toString();break;case 4:let H=await this.readBytes(16);for(let V=0;V<16;V++){if(V%2===0&&V>0)Q+=":";Q+=`${H[V]<16?"0":""}${H[V].toString(16)}`}break;default:this.socket.destroy();return}let Y=(await this.readBytes(2)).readUInt16BE();if(!this.server.supportedCommands.has(J))return this.socket.write(Buffer.from([5,7])),this.socket.destroy();this.destAddress=Q,this.destPort=Y;let G=!1,W=()=>{if(G)return;G=!0,this.connect()};if(!this.server.rulesetValidator)return W();let O=()=>{if(G)return;G=!0,this.socket.write(Buffer.from([5,2,0,1,0,0,0,0,0,0])),this.socket.destroy()},M=await this.server.rulesetValidator(this,W,O);if(M===!0)W();else if(M===!1)O()}connect(){this.socket.removeListener("error",this.errorHandler),this.server.connectionHandler(this,($)=>{if(p8[$]===void 0)throw Error(`"${$}" is not a valid status.`);if(this.socket.write(Buffer.from([5,p8[$],0,1,0,0,0,0,0,0])),$!=="REQUEST_GRANTED")this.socket.destroy()}),this.socket.resume()}};function PW($,J){if($.command!=="connect")return J("COMMAND_NOT_SUPPORTED");$.socket.on("error",()=>{});let X=vV.createConnection({host:$.destAddress,port:$.destPort});X.setNoDelay();let Q=!1;return X.on("error",(Y)=>{if(!Q)switch(Y.code){case"EINVAL":case"ENOENT":case"ENOTFOUND":case"ETIMEDOUT":case"EADDRNOTAVAIL":case"EHOSTUNREACH":J("HOST_UNREACHABLE");break;case"ENETUNREACH":J("NETWORK_UNREACHABLE");break;case"ECONNREFUSED":J("CONNECTION_REFUSED");break;default:J("GENERAL_FAILURE")}}),X.on("ready",()=>{Q=!0,J("REQUEST_GRANTED"),$.socket.pipe(X).pipe($.socket)}),$.socket.on("close",()=>X.destroy()),X}var kV=class{constructor(){this.supportedCommands=new Set(["connect"]),this.connectionHandler=PW,this.server=_V.createServer(($)=>{$.setNoDelay(),this._handleConnection($)})}listen(...$){return this.server.listen(...$),this}close($){return this.server.close($),this}setAuthHandler($){return this.authHandler=$,this}disableAuthHandler(){return this.authHandler=void 0,this}setRulesetValidator($){return this.rulesetValidator=$,this}disableRulesetValidator(){return this.rulesetValidator=void 0,this}setConnectionHandler($){return this.connectionHandler=$,this}useDefaultConnectionHandler(){return this.connectionHandler=PW,this}_handleConnection($){return new xV(this,$),this}};function xW($){let J=new kV;if($?.auth)J.setAuthHandler((X)=>{return X.username===$.auth.username&&X.password===$.auth.password});if($?.port)J.listen($.port,$.hostname);return J}function vW($){let J=xW();if($.proxyAuthToken)J.setAuthHandler((Q,Y,G)=>{if((Q.username===VJ||Q.username.startsWith(`${VJ}.`))&&Q.password===$.proxyAuthToken)Y();else Z("SOCKS auth rejected",{level:"error"}),G()});J.setRulesetValidator(async(Q)=>{try{let{destAddress:Y,destPort:G}=Q;if(!yQ(Y))return Z(`Rejecting malformed SOCKS host: ${JSON.stringify(Y)}`,{level:"error"}),!1;if(Z(`Connection request to ${Y}:${G}`),!await $.filter(G,Y,sX(Q.username)))return Z(`Connection blocked to ${Y}:${G}`,{level:"error"}),!1;return Z(`Connection allowed to ${Y}:${G}`),!0}catch(Y){return Z(`Error validating connection: ${Y}`,{level:"error"}),!1}}),J.setConnectionHandler((Q,Y)=>{let G=j0(Q.destAddress)??Q.destAddress,W=Q.destPort,O=!1,M;Q.socket.once("close",()=>{O=!0,M?.destroy()}),Q.socket.on("error",()=>M?.destroy());let U=$.parentProxy&&!CX($.parentProxy,G)?IX($.parentProxy,{isHttps:!0}):void 0;(U?yY(U,G,W):hY(G,W)).then((V)=>{if(M=V,V.on("error",()=>Q.socket.destroy()),O){V.destroy();return}Y("REQUEST_GRANTED"),V.pipe(Q.socket),Q.socket.pipe(V),V.on("close",()=>Q.socket.destroy())}).catch((V)=>{if(Z(`SOCKS connect to ${G}:${W} failed: ${V.message}`,{level:"error"}),!O)try{Y("HOST_UNREACHABLE")}catch{}})});let X=new Set;return{handleConnection(Q){if(Q.setNoDelay(),X.add(Q),Q.once("close",()=>X.delete(Q)),!$.proxyAuthToken){J._handleConnection(Q);return}hV(Q,(Y)=>{if(Y){J._handleConnection(Q);return}bV(Q,$).catch(()=>Q.destroy())})},async close(){for(let Q of X)Q.destroy();X.clear()}}}var fV=0,yV=2;function hV($,J){let X=Buffer.alloc(0),Q=(Y)=>{if(X=Buffer.concat([X,Y]),X.length<2)return;if(X[0]!==5){$.off("data",Q),$.destroy();return}let G=X[1];if(X.length<2+G)return;$.off("data",Q),$.pause();let O=X.subarray(2,2+G).includes(yV),M=O?X:X.subarray(2+G);if(M.length>0)$.unshift(M);J(O)};$.on("data",Q),$.once("error",()=>$.off("data",Q))}async function bV($,J){$.write(Buffer.from([5,fV]));let X=await uV($);if(X===void 0){$.destroy();return}let{host:Q,port:Y}=X;if(!yQ(Q)){$.end(c8(2));return}let G=J.probeUnauthenticated?await J.probeUnauthenticated(Y,Q):{};if(Z(`SOCKS unauthenticated client refused for ${Q}:${Y}`+(G.deniedReason!==void 0?" (denied by policy)":"")),Y!==22){$.end(c8(2));return}let W=G.deniedReason??"This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.";$.write(c8(0)),$.write(Buffer.from(`SSH-2.0-policy_refusal\r
|
|
57
|
+
`)),$.end(mV(W))}function c8($){return Buffer.from([5,$,0,1,0,0,0,0,0,0])}function uV($){return new Promise((J)=>{let X=Buffer.alloc(0),Q=(W)=>{$.off("data",G),clearTimeout(Y),J(W)},Y=setTimeout(()=>Q(void 0),5000),G=(W)=>{if(X=Buffer.concat([X,W]),X.length<4)return;if(X[0]!==5||X[1]!==1){Q(void 0);return}let O=X[3];if(O===1){if(X.length<10)return;let M=Array.from(X.subarray(4,8)).join(".");Q({host:M,port:X.readUInt16BE(8)})}else if(O===3){if(X.length<5)return;let M=X[4];if(X.length<5+M+2)return;Q({host:X.subarray(5,5+M).toString("utf8"),port:X.readUInt16BE(5+M)})}else if(O===4){if(X.length<22)return;let M=[];for(let U=0;U<16;U+=2)M.push(X.readUInt16BE(4+U).toString(16));Q({host:M.join(":"),port:X.readUInt16BE(20)})}else Q(void 0)};$.on("data",G),$.resume(),$.once("error",()=>Q(void 0)),$.once("close",()=>Q(void 0))})}function mV($){let J=$.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").slice(0,1000),X=Buffer.from(J,"utf8"),Q=Buffer.alloc(0),Y=Buffer.concat([Buffer.from([1]),mY(1),mY(X.length),X,mY(Q.length),Q]),G=8-(5+Y.length)%8;if(G<4)G+=8;return Buffer.concat([mY(1+Y.length+G),Buffer.from([G]),Y,Buffer.alloc(G)])}function mY($){let J=Buffer.alloc(4);return J.writeUInt32BE($,0),J}import{createServer as gV,connect as kW}from"net";import{join as lV}from"path";import{tmpdir as dV}from"os";import{unlink as fW}from"fs/promises";function gY($,J,X,Q){return new Promise((Y,G)=>{let[W,O]=X??[0,0],M=W,U=()=>{while(Q.has(M)&&M<=O)M++;if(M>O){G(Error(`No free port in range ${W}-${O} (excluding ${[...Q].join(",")})`));return}let H=()=>{$.removeListener("error",V),Y()},V=(q)=>{if($.removeListener("listening",H),X&&q?.code==="EADDRINUSE"&&M<O){M++,U();return}G(q??Error("listen error"))};$.once("error",V),$.once("listening",H),J(X?M:0)};U()})}var pV=new Set([4,5]),cV=1e4,nV=0;function iV(){return lV(dV(),`srt-mux-${process.pid}-${(nV++).toString(36)}.sock`)}function yW($){let J=$.firstByteTimeoutMs??cV,X=_$()==="windows",Q,Y,G=new Set;function W(M){if(Q===void 0&&Y===void 0){Z("mux: HTTP dispatch before backend bound; dropping",{level:"error"}),M.destroy();return}let U=Q?kW(Q):kW(Y,"127.0.0.1");U.on("error",(H)=>{let V=H.code??"ERR";if(Z(`mux: HTTP backend dial failed: ${H.message}`,{level:"error"}),!M.destroyed)M.end(`HTTP/1.1 502 Bad Gateway\r
|
|
58
|
+
Connection: close\r
|
|
59
|
+
\r
|
|
60
|
+
mux backend dial failed (${V})
|
|
61
|
+
`)}),M.on("error",()=>U.destroy()),M.once("close",()=>U.destroy()),U.once("close",()=>M.destroy()),M.pipe(U),U.pipe(M)}let O=gV((M)=>{G.add(M),M.once("close",()=>G.delete(M)),M.on("error",(H)=>Z(`mux: client socket error: ${H.message}`));let U=setTimeout(()=>{Z("mux: first-byte timeout; destroying connection"),M.destroy()},J);if(typeof U.unref==="function")U.unref();M.once("readable",()=>{clearTimeout(U);let H=M.read(1);if(!H||H.length===0){M.destroy();return}if(M.unshift(H),pV.has(H[0]))$.handleSocksConnection(M);else W(M)})});return{server:O,getPort(){let M=O.address();return M&&typeof M==="object"?M.port:void 0},async listenHttpBackend(){if(!X){let U=iV();await fW(U).catch(()=>{}),await new Promise((H,V)=>{$.httpServer.once("error",V),$.httpServer.listen(U,()=>{$.httpServer.removeListener("error",V),H()})}),Q=U,Z(`mux: HTTP backend listening on ${U}`);return}await gY($.httpServer,(U)=>$.httpServer.listen(U,"127.0.0.1"),$.httpBackendPortRange,new Set);let M=$.httpServer.address();return Y=M&&typeof M==="object"?M.port:void 0,Z(`mux: HTTP backend listening on 127.0.0.1:${Y}`),Y},async close(){for(let M of G)M.destroy();if(G.clear(),await new Promise((M)=>O.close(()=>M())),await new Promise((M)=>$.httpServer.close(()=>M())),Q)await fW(Q).catch(()=>{}),Q=void 0;Y=void 0},unref(){O.unref(),$.httpServer.unref()}}}import{randomBytes as oV,randomUUID as aV}from"crypto";var PX="fake_value_",hW="abcdefghijklmnopqrstuvwxyz0123456789_-";function rV($){let J=PX+aV(),X=Buffer.byteLength($)-J.length;if(X<=0)return J;let Q=J;for(let Y of oV(X))Q+=hW[Y%hW.length];return Q}class n8{constructor(){this.byName=new Map,this.bySentinel=new Map,this.allSentinelsPrefixed=!0}register($,J,X){return this.registerWithSentinel($,rV(J),J,X)}registerWithSentinel($,J,X,Q){let Y=this.byName.get($);if(Y!==void 0)return Y.realValue=X,Y.injectHosts=Q,Y.sentinel;if(!J.startsWith(PX))this.allSentinelsPrefixed=!1;let G={name:$,sentinel:J,realValue:X,injectHosts:Q};return this.byName.set($,G),this.bySentinel.set(J,G),J}lookupReal($){return this.bySentinel.get($)?.realValue}namesInjectableAt($,J){let X=[];for(let Q of this.byName.values())if(Q.injectHosts.some((Y)=>J($,Y)))X.push(Q.name);return X}sentinelsForHost($,J){let X=[];for(let Q of this.bySentinel.values()){if(!Q.injectHosts.some((Y)=>J($,Y)))continue;X.push({sentinel:Buffer.from(Q.sentinel),realValue:Buffer.from(Q.realValue)})}return X}*entries(){for(let $ of this.bySentinel.values())yield[$.sentinel,$.realValue]}get size(){return this.bySentinel.size}clear(){this.byName.clear(),this.bySentinel.clear(),this.allSentinelsPrefixed=!0}substituteInHeaders($,J,X){if(this.bySentinel.size===0)return;for(let[Q,Y]of Object.entries($)){if(Y===void 0)continue;if(Array.isArray(Y))for(let G=0;G<Y.length;G++)Y[G]=this.substituteInString(Y[G],J,X);else $[Q]=this.substituteInString(Y,J,X)}}substituteInString($,J,X){if(this.allSentinelsPrefixed&&!$.includes(PX))return $;let Q=$;for(let Y of this.bySentinel.values()){if(!Q.includes(Y.sentinel))continue;if(!Y.injectHosts.some((G)=>X(J,G)))continue;Q=Q.split(Y.sentinel).join(Y.realValue)}return Q}}import{randomUUID as tV}from"crypto";import*as p0 from"fs";import{tmpdir as eV}from"os";import{join as mW}from"path";function lY($,J,X,Q={}){let Y=new RegExp(J,"gd"),G=new Map,W=new Map,O=[];for(let H of $.matchAll(Y)){let V=H[1];if(V===void 0)throw Error(`extract pattern /${J}/ matched at offset ${H.index} but `+"capture group 1 is undefined \u2014 group 1 must capture the "+"credential value on every match.");if(V.length===0)continue;let q=G.get(V);if(q===void 0)G.set(V,q=G.size);let[z,K]=H.indices[1],L=X(V,q);if(!W.has(V))W.set(V,L);O.push({start:z,end:K,sentinel:L})}if(G.size===0)return null;if(Q.maskDuplicates){let H=[...G.keys()].sort((V,q)=>q.length-V.length);for(let V of H){let q=W.get(V);if(q===V)continue;for(let z=$.indexOf(V);z!==-1;z=$.indexOf(V,z+1)){let K=z+V.length;if(O.some((L)=>z<L.end&&L.start<K))continue;O.push({start:z,end:K,sentinel:q})}}O.sort((V,q)=>V.start-q.start)}let M="",U=0;for(let H of O)M+=$.slice(U,H.start)+H.sentinel,U=H.end;return{fakeContent:M+$.slice(U),captures:[...G.keys()]}}var bW="(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";function i8($){try{return JSON.parse(Buffer.from($,"base64url").toString("utf8"))}catch{return}}function dY($){let J=$.split(".");if(J.length!==3)return!1;let X=i8(J[0]);if(typeof X!=="object"||X===null||!("alg"in X))return!1;return i8(J[1])!==void 0}var sV=9999999999,uW="c3J0LWZha2U";function o8($){return Buffer.from($,"utf8").toString("base64url")}function pY($){let J=o8(JSON.stringify({alg:"HS256",typ:"JWT"})),X=o8(JSON.stringify({sub:PX+$,exp:sV}));return`${J}.${X}.${uW}`}function cY($,J,X){let[Q,Y]=$.split("."),G=i8(Y??"");if(typeof G!=="object"||G===null||Array.isArray(G))return null;let W=G,O=[];for(let U of J){let H=W[U];if(typeof H==="string")O.push([U,H])}if(O.length===0)return null;let M=new Map;for(let[U,H]of O){let V=X(U,H);W[U]=V,M.set(U,V)}return{fakeToken:`${Q}.${o8(JSON.stringify(W))}.${uW}`,claimSentinels:M}}var $q="file:";class a8{constructor(){this.byKey=new Map}write($,J){if(this.dir===void 0)this.dir=p0.mkdtempSync(mW(eV(),"srt-credmask-"));let X=this.byKey.get($);if(X===void 0)X=mW(this.dir,`${this.byKey.size}.fake`),this.byKey.set($,X);return p0.rmSync(X,{force:!0}),p0.writeFileSync(X,J,{mode:384}),X}dispose(){if(this.dir!==void 0)try{p0.rmSync(this.dir,{recursive:!0,force:!0})}catch($){Z(`MaskedFileStore cleanup failed: ${$}`,{level:"error"})}this.dir=void 0,this.byKey.clear()}get dirPath(){return this.dir}}function gW($,J,X,Q){let Y=[],G=[];for(let W of $){if(W.mode!=="mask")continue;let O=i$(W.path),M;try{if(p0.statSync(O).isDirectory()){Z(`[credential-mask] Skipping masked file entry that resolves to a directory: ${W.path} \u2014 use mode "deny" for directories.`,{level:"warn"});continue}let K=p0.readFileSync(O);if(M=K.toString("utf8"),Buffer.byteLength(M,"utf8")!==K.length){Z(`[credential-mask] Skipping masked file with non-UTF-8 content (binary credential files are not supported in mask mode): ${W.path}`,{level:"warn"});continue}}catch(z){Z(`[credential-mask] Skipping masked file (unreadable on host): ${W.path} \u2014 ${z.message}`);continue}let U=W.injectHosts??J,H=$q+O,V;if(W.extract===void 0&&W.decode===void 0)V=X.register(H,M,U);else{let z=W.extract??bW,K=0,L=lY(M,z,(A,D)=>{if(W.decode==="jwt"&&!dY(A))return A;let j=`${H}#${D}`;if(W.decode==="jwt"&&W.maskClaims?.length){let S=cY(A,W.maskClaims,(C,w)=>X.register(`${H}#jwt${D}.${C}`,w,U));if(S===null)return Z(`[credential-mask] ${W.path}: verified JWT candidate has none of maskClaims ${JSON.stringify(W.maskClaims)} as `+"string claims \u2014 left unmasked."),A;let P=W.maskClaims.filter((C)=>!S.claimSentinels.has(C));if(P.length>0)Z(`[credential-mask] ${W.path}: maskClaims ${JSON.stringify(P)} absent or non-string in a `+"verified JWT \u2014 skipped.");return K++,X.registerWithSentinel(j,S.fakeToken,A,U)}return K++,W.decode==="jwt"?X.registerWithSentinel(j,pY(tV()),A,U):X.register(j,A,U)},{maskDuplicates:W.maskDuplicates??!1});if(L===null||K===0){let A=W.decode==="jwt"?W.maskClaims?.length?`decode "jwt" with pattern "${z}" that matched no verified JWT with maskable claims (maskClaims: ${JSON.stringify(W.maskClaims)})`:`decode "jwt" with pattern "${z}" that matched no verified JWT`:`extract pattern "${z}" that matched nothing`,D=W.onExtractNoMatch??"warn";if(D==="error")throw Error(`credentials.files entry "${W.path}": ${A} (onExtractNoMatch: "error"). Fix the config, change to "warn"/"deny", or remove the entry.`);if(D==="deny"){Z(`[credential-mask] ${W.path} has ${A} \u2014 degrading to `+'mode "deny".',{level:"warn"}),G.push(O);continue}let j=`[sandbox-runtime] WARNING: credentials.files entry "${W.path}" has ${A} in the file. The file is left UNPROTECTED (readable as-is inside the sandbox). Fix the config, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(j),Z(j,{level:"warn"});continue}V=L.fakeContent}let q=Q.write(H,V);Y.push({realPath:O,fakePath:q})}return{binds:Y,degradeToDenyPaths:G}}import{randomUUID as Jq}from"crypto";var nY="env:";function lW($,J,X,Q=process.env){let Y={},G=[];for(let W of $){if(W.mode!=="mask")continue;let O=Q[W.name];if(O===void 0)continue;let M=W.injectHosts??J;if(W.decode==="jwt"){if(!dY(O)){let H=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has decode "jwt" but its value did not verify as a JWT. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(H),Z(H,{level:"warn"});continue}if(W.maskClaims?.length){let H=cY(O,W.maskClaims,(q,z)=>X.register(`${nY}${W.name}#${q}`,z,M));if(H===null){let q=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has maskClaims ${JSON.stringify(W.maskClaims)} but none is present as a string claim in its JWT value. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(q),Z(q,{level:"warn"});continue}let V=W.maskClaims.filter((q)=>!H.claimSentinels.has(q));if(V.length>0)Z(`[credential-mask] env var "${W.name}": maskClaims ${JSON.stringify(V)} absent or non-string in the `+"JWT \u2014 skipped.");Y[W.name]=X.registerWithSentinel(`${nY}${W.name}`,H.fakeToken,O,M);continue}Y[W.name]=X.registerWithSentinel(`${nY}${W.name}`,pY(Jq()),O,M);continue}if(W.extract===void 0){Y[W.name]=X.register(W.name,O,M);continue}let U=lY(O,W.extract,(H,V)=>X.register(`${nY}${W.name}#${V}`,H,M));if(U===null){let H=W.onExtractNoMatch??"warn";if(H==="error")throw Error(`credentials.envVars entry "${W.name}": extract pattern "${W.extract}" matched nothing (onExtractNoMatch: "error"). Fix the regex, change to "warn"/"deny", or remove the entry.`);if(H==="deny"){Z(`[credential-mask] extract pattern /${W.extract}/ matched nothing in the value of ${W.name} \u2014 unsetting the variable.`,{level:"warn"}),G.push(W.name);continue}let V=`[sandbox-runtime] WARNING: credentials.envVars entry "${W.name}" has extract pattern "${W.extract}" that matched nothing in the variable's value. The variable is left UNPROTECTED (visible as-is inside the sandbox). Fix the regex, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(V),Z(V,{level:"warn"});continue}Y[W.name]=U.fakeContent}return{setEnvVars:Y,degradeToUnsetNames:G}}var dW="AWS_ACCESS_KEY_ID",pW="AWS_SECRET_ACCESS_KEY",cW="AWS_SESSION_TOKEN";class r8{constructor(){this.bySentinel=new Map}register($){this.bySentinel.set($.accessKeyIdSentinel,$)}lookup($){return this.bySentinel.get($)}get size(){return this.bySentinel.size}clear(){this.bySentinel.clear()}}function nW($,J,X,Q,Y,G=process.env){let W=[...J??[]],O=new Set(W.flatMap((V)=>[V.accessKeyIdVar,V.secretAccessKeyVar,...V.sessionTokenVar?[V.sessionTokenVar]:[]]));if(![dW,pW,cW].some((V)=>O.has(V)))W.push({accessKeyIdVar:dW,secretAccessKeyVar:pW,sessionTokenVar:cW});let U=(V)=>$.find((q)=>q.name===V&&q.mode==="mask"&&q.extract===void 0&&q.decode===void 0),H=(V)=>U(V)!==void 0?Q[V]:void 0;for(let V of W){let q=H(V.accessKeyIdVar),z=H(V.secretAccessKeyVar)!==void 0,K=G[V.accessKeyIdVar],L=G[V.secretAccessKeyVar];if(q===void 0||!z||K===void 0||L===void 0){if(z&&q===void 0){let S=`[sandbox-runtime] WARNING: "${V.secretAccessKeyVar}" is masked but "${V.accessKeyIdVar}" is not, so no AWS credential pair was registered. SigV4 requests will be signed with the masked placeholder secret and the proxy cannot `+"detect or re-sign them \u2014 they will fail upstream. Mask both "+"variables (whole-value) to enable re-signing.";console.warn(S),Z(S,{level:"warn"})}continue}let A=U(V.accessKeyIdVar),j=(V.sessionTokenVar!==void 0?H(V.sessionTokenVar):void 0)!==void 0&&V.sessionTokenVar!==void 0?G[V.sessionTokenVar]:void 0;Y.register({accessKeyIdSentinel:q,realAccessKeyId:K,realSecretAccessKey:L,...j!==void 0?{realSessionToken:j}:{},injectHosts:A.injectHosts??X}),Z(`[credential-aws] registered SigV4 pair for ${V.accessKeyIdVar}/${V.secretAccessKeyVar}`+(j!==void 0?" (+session token)":""))}}function Qq($){return{streaming:$?.streaming??"deny",presigned:$?.presigned??"deny",sigv4a:$?.sigv4a??"deny"}}function iW($,J,X){let Q=Qq(J);return(Y,G,W,O)=>{if($.size===0)return;let M=AW(W,G);if(M===null)return;let U=$.lookup(M.accessKeyId);if(U===void 0)return;if(!U.injectHosts.some((K)=>X(O,K)))return;if(M.kind!=="header-sigv4"){if(Q[M.kind]==="passthrough"){Z(`[credential-aws] ${M.kind} request with masked credential passed through un-resigned per credentials.sigv4.${M.kind} (its signature covers the placeholder secret and will fail upstream)`);return}return{action:"deny",reason:`AWS SigV4 ${M.kind} request uses a masked credential but cannot be re-signed by the sandbox proxy; denied by policy. Set credentials.sigv4.${M.kind} to "passthrough" to forward it unmodified (it will fail upstream: the signature covers the masked placeholder).`}}let H=LW(hQ(W.authorization));if(H===null)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but its Authorization header is malformed; the proxy cannot re-sign it."};let V=hQ(W["x-amz-date"]);if(V===void 0)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it."};let q=[...H.signedHeaders];for(let K of q){if(K==="host")continue;if(K==="x-amz-security-token"&&U.realSessionToken!==void 0)continue;if(W[K]===void 0)return{action:"deny",reason:`AWS SigV4 request uses a masked credential but signed header "${K}" is missing; the proxy cannot re-sign it.`}}if(U.realSessionToken!==void 0&&!q.includes("x-amz-security-token"))q.push("x-amz-security-token");let z=hQ(W["x-amz-content-sha256"]);return{action:"resign",payloadHash:z===uY?uY:void 0,apply(K,L,A){if(U.realSessionToken!==void 0)K["x-amz-security-token"]=U.realSessionToken;if(K["x-amz-content-sha256"]!==void 0&&z!==uY)K["x-amz-content-sha256"]=A;let{authorization:D}=DW({method:Y,requestTarget:G,headers:K,hostHeader:L,signedHeaders:q,payloadHash:A,amzDate:V,scope:{date:H.date,region:H.region,service:H.service},accessKeyId:U.realAccessKeyId,secretAccessKey:U.realSecretAccessKey});K.authorization=D}}}}import{spawnSync as Xq}from"child_process";function NJ($){if(typeof globalThis.Bun<"u")return globalThis.Bun.which($);let J=Xq("which",[$],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000});if(J.status===0&&J.stdout)return J.stdout.trim();return null}import*as ZG from"fs";import{randomBytes as aq}from"crypto";function C0($){return $.map((J)=>{if(J==="")return"''";if(/^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/.test(J))return J;return"'"+J.replace(/'/g,`'"'"'`)+"'"}).join(" ")}import{randomBytes as qq}from"crypto";import*as Y$ from"fs";import{spawn as sW}from"child_process";import{tmpdir as QG}from"os";import v$,{join as tW}from"path";import{spawn as Yq}from"child_process";import{text as oW}from"stream/consumers";async function aW($,J,X,Q={command:"rg"}){let{command:Y,args:G=[],argv0:W}=Q,O=Yq(Y,[...G,...$,J],{argv0:W,signal:X,timeout:1e4,windowsHide:!0}),[M,U,H]=await Promise.all([oW(O.stdout),oW(O.stderr),new Promise((V,q)=>{O.on("close",V),O.on("error",q)})]);if(H===0)return M.trim().split(`
|
|
62
|
+
`).filter(Boolean);if(H===1)return[];throw Error(`ripgrep failed with exit code ${H}: ${U}`)}import{join as c0,dirname as Gq}from"path";import{fileURLToPath as Wq}from"url";import*as iY from"fs";import{execSync as Oq}from"child_process";import{homedir as Mq}from"os";var s8=new Map,t8=null;function Uq(){if(t8)return t8;let $=[];try{let X=Oq("npm root -g",{encoding:"utf8",timeout:5000,stdio:["pipe","pipe","ignore"]}).trim();if(X)$.push(c0(X,"@anthropic-ai","sandbox-runtime"))}catch{}let J=Mq();return $.push(c0("/usr","lib","node_modules","@anthropic-ai","sandbox-runtime"),c0("/usr","local","lib","node_modules","@anthropic-ai","sandbox-runtime"),c0("/opt","homebrew","lib","node_modules","@anthropic-ai","sandbox-runtime"),c0(J,".npm","lib","node_modules","@anthropic-ai","sandbox-runtime"),c0(J,".npm-global","lib","node_modules","@anthropic-ai","sandbox-runtime")),t8=$,$}function rW(){let $=process.arch;switch($){case"x64":case"x86_64":return"x64";case"arm64":case"aarch64":return"arm64";case"ia32":case"x86":return Z("[SeccompFilter] 32-bit x86 (ia32) is not currently supported due to missing socketcall() syscall blocking. The current seccomp filter only blocks socket(AF_UNIX, ...), but on 32-bit x86, socketcall() can be used to bypass this.",{level:"error"}),null;default:return Z(`[SeccompFilter] Unsupported architecture: ${$}. Only x64 and arm64 are supported.`),null}}function Hq($){let J=rW();if(!J)return[];let X=Gq(Wq(import.meta.url)),Q=c0("vendor","seccomp",J,$);return[c0(X,Q),c0(X,"..","..",Q),c0(X,"..",Q)]}function e8($){let J=$??"";if(s8.has(J))return s8.get(J);let X=Vq($);return s8.set(J,X),X}function Vq($){if($){if(iY.existsSync($))return Z(`[SeccompFilter] Using apply-seccomp binary from explicit path: ${$}`),$;Z(`[SeccompFilter] Explicit path provided but file not found: ${$}`)}let J=rW();if(!J)return Z(`[SeccompFilter] Cannot find apply-seccomp binary: unsupported architecture ${process.arch}`),null;Z(`[SeccompFilter] Looking for apply-seccomp binary for architecture: ${J}`);for(let X of Hq("apply-seccomp"))if(iY.existsSync(X))return Z(`[SeccompFilter] Found apply-seccomp binary: ${X} (${J})`),X;for(let X of Uq()){let Q=c0(X,"vendor","seccomp",J,"apply-seccomp");if(iY.existsSync(Q))return Z(`[SeccompFilter] Found apply-seccomp binary in global install: ${Q} (${J})`),Q}return Z(`[SeccompFilter] apply-seccomp binary not found in any expected location (${J})`),null}var XG=3;function $G($,J){let X=$.split(v$.sep),Q="";for(let Y of X){if(!Y)continue;let G=Q+v$.sep+Y;try{if(Y$.lstatSync(G).isSymbolicLink()){if(J.some((M)=>G.startsWith(M+"/")||G===M))return G}}catch{break}Q=G}return null}var Kq=40;function eW($){let J=$;for(let X=0;X<Kq;X++){try{return Y$.realpathSync(J)}catch{}let Q=J,Y=[],G=null;while(G===null){let M=v$.dirname(Q);if(M===Q)return null;Y.unshift(v$.basename(Q)),Q=M;try{G=Y$.realpathSync(Q)}catch{}}let W=v$.join(G,Y[0]),O=null;try{O=Y$.readlinkSync(W)}catch{}if(O===null)return v$.join(G,...Y);J=v$.join(v$.resolve(v$.dirname(W),O),...Y.slice(1))}return null}function Eq($){let J=$.split(v$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+v$.sep+Q;try{let G=Y$.statSync(Y);if(G.isFile()||G.isSymbolicLink())return!0}catch{break}X=Y}return!1}function zq($){let J=$.split(v$.sep),X="";for(let Q of J){if(!Q)continue;let Y=X+v$.sep+Q;if(!Y$.existsSync(Y))return Y;X=Y}return $}async function Fq($={command:"rg"},J=XG,X=!1,Q){let Y=process.cwd(),G=new AbortController,W=Q??G.signal,O=aX(),M=[...XX.map((z)=>v$.resolve(Y,z)),...O.map((z)=>v$.resolve(Y,z))],U=v$.resolve(Y,".git"),H=!1;try{H=Y$.statSync(U).isDirectory()}catch{}if(H){if(M.push(v$.resolve(Y,".git/hooks")),!X)M.push(v$.resolve(Y,".git/config"))}let V=[];for(let z of XX)V.push("--iglob",z);for(let z of O)V.push("--iglob",`**/${z}/**`);if(V.push("--iglob","**/.git/hooks/**"),!X)V.push("--iglob","**/.git/config");let q=[];try{q=await aW(["--files","--hidden","--max-depth",String(J),...V,"-g","!**/node_modules/**"],Y,W,$)}catch(z){Z(`[Sandbox] ripgrep scan failed: ${z}`)}for(let z of q){let K=v$.resolve(Y,z),L=!1;for(let A of[...O,".git"]){let D=R9(A),j=K.split(v$.sep),S=j.findIndex((P)=>R9(P)===D);if(S!==-1){if(A===".git"){let P=j.slice(0,S+1).join(v$.sep);if(z.includes(".git/hooks"))M.push(v$.join(P,"hooks"));else if(z.includes(".git/config"))M.push(v$.join(P,"config"))}else M.push(j.slice(0,S+1).join(v$.sep));L=!0;break}}if(!L)M.push(K)}return[...new Set(M)]}var oY=new Set,fJ=0,$4=!1;function J4(){if($4)return;process.on("exit",()=>{aY({force:!0})}),$4=!0}function aY($){if(!$?.force){if(fJ>0)fJ--;if(fJ>0){Z(`[Sandbox Linux] Deferring mount point cleanup \u2014 ${fJ} sandbox(es) still active`);return}}else fJ=0;for(let J of oY)try{let X=Y$.statSync(J);if(X.isFile()&&X.size===0)Y$.unlinkSync(J),Z(`[Sandbox Linux] Cleaned up bwrap mount point (file): ${J}`);else if(X.isDirectory()){if(Y$.readdirSync(J).length===0)Y$.rmdirSync(J),Z(`[Sandbox Linux] Cleaned up bwrap mount point (dir): ${J}`)}}catch{}oY.clear()}function Q4($){try{return Y$.accessSync($,Y$.constants.X_OK),!0}catch{return!1}}function Y4($){let{seccompConfig:J,bwrapPath:X,socatPath:Q}=$??{},Y=[],G=[];if(X){if(!Q4(X))Y.push(`bubblewrap (bwrap) not executable at ${X}`)}else if(NJ("bwrap")===null)Y.push("bubblewrap (bwrap) not installed");if(Q){if(!Q4(Q))Y.push(`socat not executable at ${Q}`)}else if(NJ("socat")===null)Y.push("socat not installed");if(!J?.argv0&&e8(J?.applyPath)===null)G.push("seccomp not available - unix socket access not restricted");return{warnings:G,errors:Y}}async function G4($,J,X){let Q=X??"socat",Y=qq(8).toString("hex"),G=tW(QG(),`claude-http-${Y}.sock`),W=tW(QG(),`claude-socks-${Y}.sock`),O=[`UNIX-LISTEN:${G},fork,reuseaddr`,`TCP:localhost:${$},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];Z(`Starting HTTP bridge: ${Q} ${O.join(" ")}`);let M=sW(Q,O,{stdio:"ignore"});if(M.on("error",(q)=>{Z(`HTTP bridge process error: ${q}`,{level:"error"})}),M.on("exit",(q,z)=>{Z(`HTTP bridge process exited with code ${q}, signal ${z}`,{level:q===0?"info":"error"})}),!M.pid)throw Error("Failed to start HTTP bridge process");let U,H;if(J===$)U=M,H=G;else{H=W;let q=[`UNIX-LISTEN:${W},fork,reuseaddr`,`TCP:localhost:${J},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];if(Z(`Starting SOCKS bridge: ${Q} ${q.join(" ")}`),U=sW(Q,q,{stdio:"ignore"}),U.on("error",(z)=>{Z(`SOCKS bridge process error: ${z}`,{level:"error"})}),U.on("exit",(z,K)=>{Z(`SOCKS bridge process exited with code ${z}, signal ${K}`,{level:z===0?"info":"error"})}),!U.pid){if(M.pid)try{process.kill(M.pid,"SIGTERM")}catch{}throw Error("Failed to start SOCKS bridge process")}}let V=5;for(let q=0;q<V;q++){if(!M.pid||M.killed||!U.pid||U.killed)throw Error("Linux bridge process died unexpectedly");try{if(Y$.existsSync(G)&&Y$.existsSync(H)){Z(`Linux bridges ready after ${q+1} attempts`);break}}catch(z){Z(`Error checking sockets (attempt ${q+1}): ${z}`,{level:"error"})}if(q===V-1){if(M.pid)try{process.kill(M.pid,"SIGTERM")}catch{}if(U.pid)try{process.kill(U.pid,"SIGTERM")}catch{}throw Error(`Failed to create bridge sockets after ${V} attempts`)}await new Promise((z)=>setTimeout(z,q*100))}return{httpSocketPath:G,socksSocketPath:H,httpBridgeProcess:M,socksBridgeProcess:U,httpProxyPort:$,socksProxyPort:J}}function Nq($,J){if(J){if(!$)throw Error("seccompConfig.argv0 requires seccompConfig.applyPath");return`ARGV0=${C0([J])} ${C0([$])} `}let X=e8($);return X?`${C0([X])} `:void 0}function Aq($,J,X,Q,Y,G){let W=Y||"bash",O=C0([G??"socat"]),M=[`${O} TCP-LISTEN:3128,fork,reuseaddr UNIX-CONNECT:${$} >/dev/null 2>&1 &`,`${O} TCP-LISTEN:1080,fork,reuseaddr UNIX-CONNECT:${J} >/dev/null 2>&1 &`,'trap "kill %1 %2 2>/dev/null; exit" EXIT'];if(Q){let U=Q+C0([W,"-c",X]),H=[...M,U].join(`
|
|
63
|
+
`);return`${W} -c ${C0([H])}`}else{let U=[...M,`eval ${C0([X])}`].join(`
|
|
64
|
+
`);return`${W} -c ${C0([U])}`}}function JG($){try{if(Y$.lstatSync($).isSymbolicLink())return Y$.realpathSync($)}catch{}return $}function X4($,J,X,Q){let Y=J==="/"?"/":J+"/";$.push("--tmpfs",J);for(let G of X)if(G.startsWith(Y)||G===J)$.push("--bind",G,G),Z(`[Sandbox Linux] Re-bound write path wiped by denyRead tmpfs: ${G}`);for(let G of Q)if(G.startsWith(Y)||G===J){if(!Y$.existsSync(G)){Z(`[Sandbox Linux] Skipping non-existent read allow path: ${G}`);continue}if(X.some((W)=>(W.startsWith(Y)||W===J)&&(G===W||G.startsWith(W+"/"))))continue;$.push("--ro-bind",G,G),Z(`[Sandbox Linux] Re-allowed read access within denied region: ${G}`)}}async function Lq($,J,X,Q,Y={command:"rg"},G=XG,W=!1,O){let M=[],U=[],H=[],V=new Map,q=new Map;if(J){M.push("--ro-bind","/","/");for(let W$ of J.allowOnly||[]){let s=i$(W$).replace(/\/+$/,"")||"/";if(Z(`[Sandbox Linux] Processing write path: ${W$} -> ${s}`),s.startsWith("/dev/")){Z(`[Sandbox Linux] Skipping /dev path: ${s}`);continue}if(!Y$.existsSync(s)){Z(`[Sandbox Linux] Skipping non-existent write path: ${s}`);continue}try{let l=Y$.realpathSync(s),o=s.replace(/\/+$/,"");if(l!==o&&oX(s,l)){Z(`[Sandbox Linux] Skipping symlink write path pointing outside expected location: ${W$} -> ${l}`);continue}}catch{Z(`[Sandbox Linux] Skipping write path that could not be resolved: ${s}`);continue}M.push("--bind",s,s),U.push(s)}let C,w=()=>{if(C!==void 0)return C;let W$=[];for(let l of U){W$.push(l);try{let o=Y$.realpathSync(l);if(o!==l)W$.push(o)}catch{}}let s=[];if($){let l=[],o=new Set(["proc","dev","sys"]);for(let g of $.denyOnly||[])if(i$(g)==="/")try{for(let O$ of Y$.readdirSync("/"))if(!o.has(O$))l.push("/"+O$)}catch{}else l.push(g);if(Y$.existsSync("/etc/ssh/ssh_config.d"))l.push("/etc/ssh/ssh_config.d");for(let g of l){let O$=i$(g),a$=!1;try{a$=Y$.statSync(O$).isDirectory()}catch{continue}if(!a$)continue;s.push(O$);try{let I$=Y$.realpathSync(O$);if(I$!==O$)s.push(I$)}catch{}}}return C={allowedWritePathsBothForms:W$,prospectiveReadDenyTmpfsDirsBothForms:s},C},b=(W$)=>U.some((s)=>W$.startsWith(s+"/")||W$===s),t=[...J.denyWithinAllow||[],...await Fq(Y,G,W,O)],r=new Set;for(let W$ of t){let s=i$(W$);if(s.startsWith("/dev/"))continue;let l=eW(s);if(l===null||l.startsWith("/dev/"))continue;if($G(l,U))continue;let o=!1;try{o=Y$.statSync(l).isDirectory()}catch{continue}if(!o)continue;if(b(l)){let g=V.get(l);if(g===void 0)g=new Set,V.set(l,g);g.add(s)}}let G$=new Map,T$=(W$)=>{let s=G$.get(W$);if(s!==void 0)return s;let{allowedWritePathsBothForms:l,prospectiveReadDenyTmpfsDirsBothForms:o}=w(),g=l.some((O$)=>O$.startsWith(W$+"/"))||o.some((O$)=>O$===W$||O$.startsWith(W$+"/"))||o.some((O$)=>[W$,...V.get(W$)??[]].some((a$)=>a$===O$||a$.startsWith(O$+"/")));return G$.set(W$,g),g},Z$=[...V.keys()];for(let W$ of t){let s=i$(W$);if(s.startsWith("/dev/"))continue;let l=eW(s);if(l===null){let O$=$G(s,U);if(O$&&!r.has(O$))r.add(O$),H.push("--ro-bind","/dev/null",O$),q.set(O$,s);Z(`[Sandbox Linux] Deny path could not be resolved through symlinks, failing closed: ${s}`);continue}if(l!==s)Z(`[Sandbox Linux] Resolved symlinked deny path: ${s} -> ${l}`);if(l.startsWith("/dev/"))continue;if(r.has(l))continue;r.add(l);let o=$G(l,U);if(o){if(!r.has(o))r.add(o),H.push("--ro-bind","/dev/null",o),q.set(o,s);Z(`[Sandbox Linux] Mounted /dev/null at symlink ${o} to prevent symlink replacement attack`);continue}if(!Y$.existsSync(l)){if(Eq(l)){Z(`[Sandbox Linux] Skipping deny path with file ancestor (cannot create paths under a file): ${l}`);continue}let O$=v$.dirname(l);while(O$!=="/"&&!Y$.existsSync(O$))O$=v$.dirname(O$);let a$=b(O$)||b(l),I$=Z$.filter((M$)=>O$===M$||O$.startsWith(M$+"/")),S$=I$.length>0&&!I$.some(T$);if(a$&&!S$){let M$=zq(l);if(M$!==l){let D$=Y$.mkdtempSync(v$.join(QG(),"claude-empty-"));H.push("--ro-bind",D$,M$),q.set(M$,s),oY.add(M$),J4(),Z(`[Sandbox Linux] Mounted empty dir at ${M$} to block creation of ${l}`)}else H.push("--ro-bind","/dev/null",M$),q.set(M$,s),oY.add(M$),J4(),Z(`[Sandbox Linux] Mounted /dev/null at ${M$} to block creation of ${l}`)}else if(S$)Z(`[Sandbox Linux] Skipping non-existent deny path inside a read-only denied directory (already uncreatable): ${l}`);else Z(`[Sandbox Linux] Skipping non-existent deny path not within allowed paths: ${l}`);continue}if(b(l))H.push("--ro-bind",l,l),q.set(l,s);else Z(`[Sandbox Linux] Skipping deny path not within allowed paths: ${l}`)}}else M.push("--bind","/","/");let z=[],K=($?.allowWithinDeny||[]).map((C)=>i$(C)),L=new Map,A=[],D=new Set(["proc","dev","sys"]);for(let C of $?.denyOnly||[])if(i$(C)==="/"){for(let w of Y$.readdirSync("/"))if(!D.has(w))z.push("/"+w)}else z.push(C);if($&&Y$.existsSync("/etc/ssh/ssh_config.d"))z.push("/etc/ssh/ssh_config.d");let j=z.map((C)=>i$(C)).sort((C,w)=>C.split("/").length-w.split("/").length);for(let C of j){if(!Y$.existsSync(C)){Z(`[Sandbox Linux] Skipping non-existent read deny path: ${C}`);continue}if(Y$.statSync(C).isDirectory())A.push(C),X4(M,C,U,K);else{if(K.includes(C)){Z(`[Sandbox Linux] Skipping read deny for re-allowed path: ${C}`);continue}let b=JG(C);M.push("--ro-bind","/dev/null",b),L.set(b,"/dev/null"),L.set(C,"/dev/null")}}for(let{realPath:C,fakePath:w}of X??[]){let b=JG(C);M.push("--ro-bind",w,b),L.set(b,w),L.set(C,w)}let S=(C)=>A.some((w)=>{if(!(C===w||C.startsWith(w+"/")))return!1;return!U.some((r)=>(r===w||r.startsWith(w+"/"))&&(C===r||C.startsWith(r+"/")))}),P=[];for(let C=0;C<H.length;C+=3){let w=H[C+2],b=q.get(w)??w;if(L.has(w))continue;if(S(w)||S(b)){Z(`[Sandbox Linux] Skipping denyWrite bind already hidden by denyRead tmpfs: ${w}`);continue}if(M.push(H[C],H[C+1],w),P.push(w),b!==w)P.push(b)}for(let C of A)if(P.some((w)=>C.startsWith(w+"/")))Z(`[Sandbox Linux] Re-applying denyRead tmpfs re-exposed by denyWrite bind: ${C}`),X4(M,C,U,K);for(let[C,w]of L)if(P.some((b)=>C.startsWith(b+"/"))){if(JG(C)!==C)continue;Z(`[Sandbox Linux] Re-applying file mask re-exposed by denyWrite bind: ${C}`),M.push("--ro-bind",w,C)}if(Q!==void 0)M.push("--ro-bind",Q,Q);return M}async function W4($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpSocketPath:Y,socksSocketPath:G,httpProxyPort:W,socksProxyPort:O,proxyAuthToken:M,caCertPath:U,readConfig:H,writeConfig:V,unsetEnvVars:q,setEnvVars:z,maskedFileBinds:K,maskedFileStoreDir:L,enableWeakerNestedSandbox:A,allowAllUnixSockets:D,binShell:j,ripgrepConfig:S={command:"rg"},mandatoryDenySearchDepth:P=XG,allowGitConfig:C=!1,gitSafeDirectories:w,seccompConfig:b,bwrapPath:t,socatPath:r,observeSocketPath:G$,abortSignal:T$}=$,Z$=H&&H.denyOnly.length>0||K!==void 0&&K.length>0,W$=V!==void 0,s=q!==void 0&&q.length>0||z!==void 0&&Object.keys(z).length>0,l=(w?.length??0)>0;if(!Q&&!Z$&&!W$&&!s&&!l)return J;fJ++;let o=["--new-session","--die-with-parent"],g;try{if(!D)if(g=Nq(b?.applyPath,b?.argv0),!g)Z("[Sandbox Linux] apply-seccomp binary not available - unix socket blocking disabled. Install @anthropic-ai/sandbox-runtime globally for full protection.",{level:"warn"});else Z("[Sandbox Linux] Applying seccomp filter for Unix socket blocking");else Z("[Sandbox Linux] Skipping seccomp filter - allowAllUnixSockets is enabled");if(G$&&g)if(Y$.existsSync(G$))o.push("--bind",G$,G$),o.push("--setenv","SRT_OBSERVE_SOCK",G$),o.push("--setenv","SRT_ENCODED_CMD",w0(X??J));else Z("[Sandbox Linux] observe socket missing \u2014 supervisor not running; "+"continuing without violation monitoring");if(s){for(let D$ of q??[])o.push("--unsetenv",D$);for(let[D$,k$]of Object.entries(z??{}))o.push("--setenv",D$,k$)}if(w&&w.length>0){let D$=rX({safeDirs:w,unsetEnvVars:q,setEnvVars:z});for(let[k$,d$]of Object.entries(D$))o.push("--setenv",k$,d$)}if(Q){if(o.push("--unshare-net"),Y&&G){if(!Y$.existsSync(Y))throw Error(`Linux HTTP bridge socket does not exist: ${Y}. The bridge process may have died. Try reinitializing the sandbox.`);if(!Y$.existsSync(G))throw Error(`Linux SOCKS bridge socket does not exist: ${G}. The bridge process may have died. Try reinitializing the sandbox.`);if(o.push("--bind",Y,Y),G!==Y)o.push("--bind",G,G);let D$=NQ(3128,1080,U,M,V===void 0,w0(X??J));if(o.push(...D$.flatMap((k$)=>{let d$=k$.indexOf("="),r$=k$.slice(0,d$),s$=k$.slice(d$+1);return["--setenv",r$,s$]})),W!==void 0)o.push("--setenv","CLAUDE_CODE_HOST_HTTP_PROXY_PORT",String(W));if(O!==void 0)o.push("--setenv","CLAUDE_CODE_HOST_SOCKS_PROXY_PORT",String(O))}}let O$=await Lq(H,V,K,L,S,P,C,T$);if(o.push(...O$),o.push("--dev","/dev"),o.push("--unshare-pid"),!A)o.push("--unshare-user","--cap-drop","ALL","--proc","/proc");else o.push("--unshare-user","--bind","/proc","/proc");let a$=j||"bash",I$=NJ(a$);if(!I$)throw Error(`Shell '${a$}' not found in PATH`);if(o.push("--",I$,"-c"),Q&&Y&&G){let D$=Aq(Y,G,J,g,I$,r);o.push(D$)}else if(g){let D$=g+C0([I$,"-c",J]);o.push(D$)}else o.push(J);let S$=C0([t??"bwrap",...o]),M$=[];if(Q)M$.push("network");if(Z$||W$)M$.push("filesystem");if(s)M$.push("env");if(g)M$.push("seccomp(unix-block)");return Z(`[Sandbox Linux] Wrapped command with bwrap (${M$.join(", ")} restrictions)`),S$}catch(O$){if(fJ>0)fJ--;throw O$}}import{spawn as Dq}from"child_process";import*as AJ from"path";class rY{constructor(){this.violations=[],this.totalCount=0,this.maxSize=100,this.listeners=new Set}addViolation($){if(this.violations.push({...$,line:YG($.line).replace(/[<>]/g,"")}),this.totalCount++,this.violations.length>this.maxSize)this.violations=this.violations.slice(-this.maxSize);this.notifyListeners()}getViolations($){if($===void 0)return[...this.violations];return this.violations.slice(-$)}getCount(){return this.violations.length}getTotalCount(){return this.totalCount}getViolationsForCommand($){let J=w0($);return this.violations.filter((X)=>X.encodedCommand===J)}clear(){this.violations=[],this.notifyListeners()}subscribe($){return this.listeners.add($),$(this.getViolations()),()=>{this.listeners.delete($)}}notifyListeners(){let $=this.getViolations();this.listeners.forEach((J)=>J($))}}function bQ($,J,X){if(!X)return!1;if((X["*"]??[]).some((Y)=>$.includes(Y)))return!0;if(J===void 0)return!1;for(let[Y,G]of Object.entries(X))if(Y!=="*"&&J.includes(Y)&&G.some((W)=>$.includes(W)))return!0;return!1}function YG($){return $.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").trim()}function Rq($=!1){let J=process.cwd(),X=[];for(let Q of XX)X.push(AJ.resolve(J,Q)),X.push(`**/${Q}`);for(let Q of aX())X.push(AJ.resolve(J,Q)),X.push(`**/${Q}/**`);if(X.push(AJ.resolve(J,".git/hooks")),X.push("**/.git/hooks/**"),!$)X.push(AJ.resolve(J,".git/config")),X.push("**/.git/config");return[...new Set(X)]}var O4=`_${Math.random().toString(36).slice(2,11)}_SBX`;function Zq($){return`CMD64_${w0($)}_END_${O4}`}function uQ($){return F0($)?`(regex ${n0(OX($))})`:`(subpath ${n0($)})`}function MG($){return OX($).slice(0,-1)+"(/.*)?$"}function OQ($){return F0($)?`(regex ${n0(MG($))})`:`(subpath ${n0($)})`}function M4($){return $.replace(/\[[^\]]*\]|[*?]+/g,"x")}function WG($,J){let X=[...new Set(J)];if(X.length===0)return $;let Q=X.map((Y)=>`(require-not ${Y})`).join(" ");return`(require-all ${$} ${Q})`}function GG($){let J=i$($);return{path:J,glob:F0(J)}}function U4($,J){return $.test(J.glob?M4(J.path):J.path)}function sY($,J){let X=$.glob?M4($.path):$.path;return X.startsWith(J==="/"?"/":J+"/")&&X!==J}function Bq($,J){return{denies:($.denyOnly||[]).map(GG),allows:($.allowWithinDeny||[]).map(GG),writeRoots:(J||[]).map(GG)}}function Tq($){let J=[],X=!1,Q=$.allows.filter((Y)=>!Y.glob).map((Y)=>Y.path);for(let Y of $.denies){if(!Y.glob){if(Q.some((O)=>Y.path.startsWith(O+"/")))J.push(OQ(Y.path));continue}let G=new RegExp(MG(Y.path));if(G.test("/"))X=!0;let W=$.allows.filter((O)=>U4(G,O)).map((O)=>uQ(O.path));J.push(WG(OQ(Y.path),W))}return{filters:J,coversRoot:X}}function H4($){let J=$.split(/[*?[\]]/)[0];if(!J||J==="/")return"/";return J.endsWith("/")?J.slice(0,-1):AJ.dirname(J)}function Sq($,J){let{denies:X,allows:Q,writeRoots:Y}=$;if(Y.length===0)return[];let G=Y.filter((V)=>V.glob).map((V)=>new RegExp(OX(V.path))),W=Y.filter((V)=>!V.glob).map((V)=>V.path),O=(V)=>W.some((q)=>sY({path:V,glob:!1},q))||G.some((q)=>q.test(V)),M=(V)=>[...Q,...Y].filter((q)=>sY(q,V)).map((q)=>uQ(q.path)),U=new Set,H=(V)=>{for(let q of V)if(O(q))U.add(`(literal ${n0(q)})`)};for(let V of X)if(V.glob){let q=H4(V.path);if(!(G.length>0||W.some((A)=>q===A||sY({path:q,glob:!1},A)||sY({path:A,glob:!1},q))))continue;let K=new RegExp(MG(V.path)),L=[...Q,...Y].filter((A)=>U4(K,A)).map((A)=>uQ(A.path));if(U.add(WG(OQ(V.path),L)),q!=="/")H([q,...OG(q)])}else{if(!O(V.path))continue;U.add(WG(OQ(V.path),M(V.path))),H(OG(V.path))}return yJ("deny",["file-write-unlink"],U,J)}function yJ($,J,X,Q){if(X.size===0)return[];return[`(${$} ${J.join(" ")}`,...[...X].map((Y)=>` ${Y}`),` (with message "${Q}"))`]}function OG($){let J=[],X=AJ.dirname($);while(X!=="/"&&X!=="."){J.push(X);let Q=AJ.dirname(X);if(Q===X)break;X=Q}return J}function V4($,J){let X=new Set;for(let Q of $){let Y=i$(Q);X.add(OQ(Y));let G;if(F0(Y)){if(G=H4(Y),G==="/")continue;X.add(`(literal ${n0(G)})`)}else G=Y;for(let W of OG(G))X.add(`(literal ${n0(W)})`)}return yJ("deny",["file-write-unlink","file-write-create"],X,J)}function jq($,J){if(!$)return["(allow file-read*)"];let X=[];X.push("(allow file-read*)");let Q=$.denies.some((M)=>M.path==="/"),Y=new Set($.denies.map((M)=>OQ(M.path)));X.push(...yJ("deny",["file-read*"],Y,J));let G=new Set($.allows.map((M)=>uQ(M.path)));X.push(...yJ("allow",["file-read*"],G,J));let W=Tq($);if(X.push(...yJ("deny",["file-read*"],new Set(W.filters),J)),Q||W.coversRoot)X.push('(allow file-read* (literal "/"))');if($.denies.length>0)X.push("(allow file-read-metadata"," (vnode-type DIRECTORY))");X.push(...V4($.denies.map((M)=>M.path),J));let O=new Set($.writeRoots.map((M)=>uQ(M.path)));return X.push(...yJ("allow",["file-write-unlink","file-write-create"],O,J)),X}function Cq($,J,X=!1){if(!$)return["(allow file-write*)"];let Q=[],Y=new Set;for(let O of $.allowOnly||[])Y.add(uQ(i$(O)));Q.push(...yJ("allow",["file-write*"],Y,J));let G=[...$.denyWithinAllow||[],...Rq(X)],W=new Set;for(let O of G)W.add(OQ(i$(O)));return Q.push(...yJ("deny",["file-write*"],W,J)),Q.push(...V4(G,J)),Q}function Iq({readConfig:$,writeConfig:J,httpProxyPort:X,socksProxyPort:Q,needsNetworkRestriction:Y,allowUnixSockets:G,allowAllUnixSockets:W,allowLocalBinding:O,allowMachLookup:M,allowPty:U,allowGitConfig:H=!1,enableWeakerNetworkIsolation:V=!1,allowAppleEvents:q=!1,logTag:z}){let K=["(version 1)",`(deny default (with message "${z}"))`,"",`; LogTag: ${z}`,"","; Essential permissions - based on Chrome sandbox policy","; Process permissions","(allow process-exec)","(allow process-fork)","(allow process-info* (target same-sandbox))","(allow signal (target same-sandbox))","(allow mach-priv-task-port (target same-sandbox))","","; User preferences","(allow user-preference-read)","","; Mach IPC - specific services only (no wildcard)","(allow mach-lookup",' (global-name "com.apple.audio.systemsoundserver")',' (global-name "com.apple.distributed_notifications@Uv3")',' (global-name "com.apple.FontObjectsServer")',' (global-name "com.apple.fonts")',' (global-name "com.apple.logd")',' (global-name "com.apple.lsd.mapdb")',' (global-name "com.apple.PowerManagement.control")',' (global-name "com.apple.system.logger")',' (global-name "com.apple.system.notification_center")',' (global-name "com.apple.system.opendirectoryd.libinfo")',' (global-name "com.apple.system.opendirectoryd.membership")',' (global-name "com.apple.bsd.dirhelper")',' (global-name "com.apple.securityd.xpc")',' (global-name "com.apple.coreservices.launchservicesd")',")","",...V?["; trustd.agent - needed for Go TLS certificate verification (weaker network isolation)",'(allow mach-lookup (global-name "com.apple.trustd.agent"))']:[],...q?["; Apple Events - opt-in; needed for open/osascript to talk to other apps (appleeventsd)","(allow appleevent-send)",'(allow mach-lookup (global-name "com.apple.coreservices.appleevents"))',"; Launch Services open requests need the lsopen operation plus, on","; macOS 14/15, coreservicesd and the quarantine resolver - without","; these open fails with -10822 kLSServerCommunicationErr or -54","(allow lsopen)",'(allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))','(allow mach-lookup (global-name "com.apple.coreservices.quarantine-resolver"))']:[],...M&&M.length>0?["; User-specified XPC/Mach services",...M.map((A)=>A.endsWith("*")?`(allow mach-lookup (global-name-prefix ${n0(A.slice(0,-1))}))`:`(allow mach-lookup (global-name ${n0(A)}))`)]:[],"","; POSIX IPC - shared memory","(allow ipc-posix-shm)","","; POSIX IPC - semaphores for Python multiprocessing","(allow ipc-posix-sem)","","; IOKit - specific operations only","(allow iokit-open",' (iokit-registry-entry-class "IOSurfaceRootUserClient")',' (iokit-registry-entry-class "RootDomainUserClient")',' (iokit-user-client-class "IOSurfaceSendRight")',")","","; IOKit properties","(allow iokit-get-properties)","","; Specific safe system-sockets, doesn't allow network access","(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))","","; sysctl - specific sysctls only","(allow sysctl-read",' (sysctl-name "hw.activecpu")',' (sysctl-name "hw.busfrequency_compat")',' (sysctl-name "hw.byteorder")',' (sysctl-name "hw.cacheconfig")',' (sysctl-name "hw.cachelinesize_compat")',' (sysctl-name "hw.cpufamily")',' (sysctl-name "hw.cpufrequency")',' (sysctl-name "hw.cpufrequency_compat")',' (sysctl-name "hw.cputype")',' (sysctl-name "hw.l1dcachesize_compat")',' (sysctl-name "hw.l1icachesize_compat")',' (sysctl-name "hw.l2cachesize_compat")',' (sysctl-name "hw.l3cachesize_compat")',' (sysctl-name "hw.logicalcpu")',' (sysctl-name "hw.logicalcpu_max")',' (sysctl-name "hw.machine")',' (sysctl-name "hw.memsize")',' (sysctl-name "hw.ncpu")',' (sysctl-name "hw.nperflevels")',' (sysctl-name "hw.packages")',' (sysctl-name "hw.pagesize_compat")',' (sysctl-name "hw.pagesize")',' (sysctl-name "hw.physicalcpu")',' (sysctl-name "hw.physicalcpu_max")',' (sysctl-name "hw.tbfrequency_compat")',' (sysctl-name "hw.vectorunit")',' (sysctl-name "kern.argmax")',' (sysctl-name "kern.bootargs")',' (sysctl-name "kern.hostname")',' (sysctl-name "kern.maxfiles")',' (sysctl-name "kern.maxfilesperproc")',' (sysctl-name "kern.maxproc")',' (sysctl-name "kern.ngroups")',' (sysctl-name "kern.osproductversion")',' (sysctl-name "kern.osrelease")',' (sysctl-name "kern.ostype")',' (sysctl-name "kern.osvariant_status")',' (sysctl-name "kern.osversion")',' (sysctl-name "kern.secure_kernel")',' (sysctl-name "kern.tcsm_available")',' (sysctl-name "kern.tcsm_enable")',' (sysctl-name "kern.usrstack64")',' (sysctl-name "kern.version")',' (sysctl-name "kern.willshutdown")',' (sysctl-name "machdep.cpu.brand_string")',' (sysctl-name "machdep.ptrauth_enabled")',' (sysctl-name "security.mac.lockdown_mode_state")',' (sysctl-name "sysctl.proc_cputype")',' (sysctl-name "vm.loadavg")',' (sysctl-name-prefix "hw.optional.arm")',' (sysctl-name-prefix "hw.optional.arm.")',' (sysctl-name-prefix "hw.optional.armv8_")',' (sysctl-name-prefix "hw.perflevel")',' (sysctl-name-prefix "kern.proc.all")',' (sysctl-name-prefix "kern.proc.pgrp.")',' (sysctl-name-prefix "kern.proc.pid.")',' (sysctl-name-prefix "machdep.cpu.")',' (sysctl-name-prefix "net.routetable.")',")","","; V8 thread calculations","(allow sysctl-write",' (sysctl-name "kern.tcsm_enable")',")","","; Distributed notifications","(allow distributed-notification-post)","","; Specific mach-lookup permissions for security operations",'(allow mach-lookup (global-name "com.apple.SecurityServer"))',"","; File I/O on device files",'(allow file-ioctl (literal "/dev/null"))','(allow file-ioctl (literal "/dev/zero"))','(allow file-ioctl (literal "/dev/random"))','(allow file-ioctl (literal "/dev/urandom"))','(allow file-ioctl (literal "/dev/dtracehelper"))','(allow file-ioctl (literal "/dev/tty"))',"","(allow file-ioctl file-read-data file-write-data"," (require-all",' (literal "/dev/null")'," (vnode-type CHARACTER-DEVICE)"," )",")",""];if(K.push("; Network"),!Y)K.push("(allow network*)");else{if(O)K.push('(allow network-bind (local ip "*:*"))'),K.push('(allow network-inbound (local ip "*:*"))'),K.push('(allow network-outbound (remote ip "localhost:*"))');if(W)K.push("(allow system-socket (socket-domain AF_UNIX))"),K.push('(allow network-bind (local unix-socket (path-regex #"^/")))'),K.push('(allow network-outbound (remote unix-socket (path-regex #"^/")))');else if(G&&G.length>0){K.push("(allow system-socket (socket-domain AF_UNIX))");for(let A of G){let D=i$(A);K.push(`(allow network-bind (local unix-socket (subpath ${n0(D)})))`),K.push(`(allow network-outbound (remote unix-socket (subpath ${n0(D)})))`)}}if(X!==void 0)K.push(`(allow network-bind (local ip "localhost:${X}"))`),K.push(`(allow network-inbound (local ip "localhost:${X}"))`),K.push(`(allow network-outbound (remote ip "localhost:${X}"))`);if(Q!==void 0&&Q!==X)K.push(`(allow network-bind (local ip "localhost:${Q}"))`),K.push(`(allow network-inbound (local ip "localhost:${Q}"))`),K.push(`(allow network-outbound (remote ip "localhost:${Q}"))`)}K.push("");let L=$?Bq($,J?.allowOnly):void 0;if(K.push("; File read"),K.push(...jq(L,z)),K.push(""),K.push("; File write"),K.push(...Cq(J,z,H)),L){let A=Sq(L,z);if(A.length>0)K.push(""),K.push("; File read: keep read-denied paths inside write roots in place"),K.push(...A)}if(U)K.push(""),K.push("; Pseudo-terminal (pty) support"),K.push("(allow pseudo-tty)"),K.push("(allow file-ioctl"),K.push(' (literal "/dev/ptmx")'),K.push(' (regex #"^/dev/ttys")'),K.push(")"),K.push("(allow file-read* file-write*"),K.push(' (literal "/dev/ptmx")'),K.push(' (regex #"^/dev/ttys")'),K.push(")");return K.join(`
|
|
65
|
+
`)}function n0($){return JSON.stringify($)}function q4($){let{command:J,commandId:X,needsNetworkRestriction:Q,httpProxyPort:Y,socksProxyPort:G,proxyAuthToken:W,caCertPath:O,allowUnixSockets:M,allowAllUnixSockets:U,allowLocalBinding:H,allowMachLookup:V,readConfig:q,writeConfig:z,unsetEnvVars:K,setEnvVars:L,maskedFileBinds:A,allowPty:D,allowGitConfig:j=!1,gitSafeDirectories:S,enableWeakerNetworkIsolation:P=!1,allowAppleEvents:C=!1,binShell:w}=$,b=q;if(A&&A.length>0)Z("[Sandbox macOS] file mask degrades to deny on macOS until the interposer lands"),b={denyOnly:[...q?.denyOnly??[],...A.map((S$)=>S$.realPath)],allowWithinDeny:q?.allowWithinDeny};let t=b&&b.denyOnly.length>0,r=z!==void 0,G$=K!==void 0&&K.length>0||L!==void 0&&Object.keys(L).length>0,T$=(S?.length??0)>0;if(!Q&&!t&&!r&&!G$&&!T$)return J;let Z$=X??J,W$=Zq(Z$),s=Iq({readConfig:b,writeConfig:z,httpProxyPort:Y,socksProxyPort:G,needsNetworkRestriction:Q,allowUnixSockets:M,allowAllUnixSockets:U,allowLocalBinding:H,allowMachLookup:V,allowPty:D,allowGitConfig:j,enableWeakerNetworkIsolation:P,allowAppleEvents:C,logTag:W$}),l=NQ(Y,G,O,W,z===void 0,w0(Z$));if(H&&Q){let D$=(K??[]).includes("JAVA_TOOL_OPTIONS")?"":process.env.JAVA_TOOL_OPTIONS??"",k$=D$.includes("-Djava.net.preferIPv4Stack=true")?D$:[D$,"-Djava.net.preferIPv4Stack=true"].filter(Boolean).join(" ");l.push(`JAVA_TOOL_OPTIONS=${k$}`)}if(S&&S.length>0){let S$=rX({safeDirs:S,unsetEnvVars:K,setEnvVars:L});for(let[M$,D$]of Object.entries(S$))l.push(`${M$}=${D$}`)}let o=w||"bash",g=NJ(o);if(!g)throw Error(`Shell '${o}' not found in PATH`);let O$=(K??[]).flatMap((S$)=>["-u",S$]),a$=Object.entries(L??{}).map(([S$,M$])=>`${S$}=${M$}`),I$=C0(["env",...O$,...a$,...l,"/usr/bin/sandbox-exec","-p",s,g,"-c",J]);return Z(`[Sandbox macOS] Applied restrictions - network: ${!!(Y||G)}, read: ${b?"allowAllExcept"in b?"allowAllExcept":"denyAllExcept":"none"}, write: ${z?"allowAllExcept"in z?"allowAllExcept":"denyAllExcept":"none"}`),I$}function K4($,J,X=(Q)=>Q){let Q=/CMD64_(.+?)_END/,Y=/Sandbox:\s+(.+)$/,G=Dq("log",["stream","--predicate",`(eventMessage ENDSWITH "${O4}")`,"--style","compact"]);return G.stdout?.on("data",(W)=>{let O=W.toString().split(`
|
|
66
|
+
`),M=O.find((K)=>K.includes("Sandbox:")&&K.includes("deny")),U=O.find((K)=>K.startsWith("CMD64_"));if(!M)return;let H=M.match(Y);if(!H?.[1])return;let V=H[1],q,z;if(U){if(z=U.match(Q)?.[1],z)try{q=X(oJ(z))}catch{}}if(V.includes("mDNSResponder")||V.includes("mach-lookup com.apple.diagnosticd")||V.includes("mach-lookup com.apple.analyticsd"))return;if(bQ(V,q,J))return;$({line:V,command:q,encodedCommand:z,timestamp:new Date})}),G.stderr?.on("data",(W)=>{Z(`[Sandbox Monitor] Log stream stderr: ${W.toString()}`)}),G.on("error",(W)=>{Z(`[Sandbox Monitor] Failed to start log stream: ${W.message}`)}),G.on("exit",(W)=>{Z(`[Sandbox Monitor] Log stream exited with code: ${W}`)}),()=>{Z("[Sandbox Monitor] Stopping log monitor"),G.kill("SIGTERM")}}import{randomBytes as wq}from"crypto";import{mkdtempSync as Pq,rmSync as _q}from"fs";import{createServer as xq}from"net";import{tmpdir as vq}from"os";import{join as E4,posix as kq}from"path";import{createInterface as fq}from"readline";function z4($,J){let{allowWritePaths:X,denyWritePaths:Q,ignoreViolations:Y,resolveCommandText:G=(D)=>D}=J,W=Pq(E4(vq(),"srt-obs-")),O=E4(W,`s${wq(4).toString("hex")}.sock`),M=(D,j)=>D===j||D.startsWith(j.endsWith("/")?j:j+"/"),U=(D)=>{let j=kq.normalize(D);if(Q.some((S)=>M(j,S)))return!0;return!X.some((S)=>M(j,S))},H=(D,j)=>{if(D.observe_init_error){Z(`[Sandbox Linux Monitor] observe filter not installed: ${D.observe_init_error}`);return}if(typeof D.path!=="string")return;if(!D.path.startsWith("/"))return;if(!U(D.path))return;let S;if(j)try{S=G(oJ(j))}catch{}if(bQ(D.path,S,Y))return;let P={line:`deny ${D.syscall??"syscall"} ${D.path}`,command:S,encodedCommand:j,timestamp:new Date};$(P)},V,q=new Promise((D)=>{V=D}),z=O,K=xq((D)=>{let j,S=fq({input:D});S.on("line",(P)=>{if(!P)return;let C;try{C=JSON.parse(P)}catch{return}if(C.encodedCommand&&j===void 0)j=C.encodedCommand;H(C,j??C.encodedCommand)}),D.on("error",()=>S.close()),D.on("close",()=>S.close())});K.on("error",(D)=>{Z(`[Sandbox Linux Monitor] listen failed: ${D.message} - violation monitoring disabled`,{level:"warn"}),z=void 0,V()}),K.listen(O,()=>V());let L=new Set;return K.on("connection",(D)=>{L.add(D),D.on("close",()=>L.delete(D))}),{get observeSocketPath(){return z},ready:q,stop:()=>{Z("[Sandbox Linux Monitor] stopping");for(let D of L)D.destroy();K.close();try{_q(W,{recursive:!0,force:!0})}catch{}}}}import*as c$ from"fs";import*as A4 from"net";import*as p$ from"path";import{spawn as yq,spawnSync as hq}from"child_process";import{once as bq}from"events";import{fileURLToPath as uq}from"url";class z$ extends Error{constructor($,J,X){super(J);this.name="WindowsSandboxError",this.code=$,this.subcommand=X}}var tY=[60080,60089],F4=["-NoProfile","-Command"];function eY($){let J=process.env.SystemRoot??"C:\\Windows",X={exe:p$.win32.join(J,"System32","cmd.exe"),args:["/d","/s","/c"]};if($===void 0||$===null)return X;if(typeof $==="object"){if(!p$.win32.isAbsolute($.exe))throw new z$("bin_shell_invalid",`binShell.exe must be an absolute path (got ${JSON.stringify($.exe)})`);if(!Array.isArray($.args))throw new z$("bin_shell_invalid",`binShell.args must be an array (got ${JSON.stringify($.args)})`);return $}let Q=p$.win32.basename($),Y=Q.toLowerCase(),G=p$.win32.isAbsolute($);if(!G&&$!==Q)throw new z$("bin_shell_invalid",`binShell string must be a bare token or an absolute path (got ${JSON.stringify($)})`);switch(Y){case"bash":case"bash.exe":case"sh":case"sh.exe":if(!G)throw new z$("bin_shell_invalid",`binShell bash path must be absolute (got ${JSON.stringify($)}); pass the resolved Git Bash install path`);return{exe:$,args:["-c"]};case"pwsh":case"pwsh.exe":return{exe:G?$:"pwsh.exe",args:F4};case"powershell":case"powershell.exe":return{exe:G?$:p$.win32.join(J,"System32","WindowsPowerShell","v1.0","powershell.exe"),args:F4};case"cmd":case"cmd.exe":return G?{exe:$,args:X.args}:X;default:throw new z$("bin_shell_invalid",`unrecognised binShell ${JSON.stringify($)}: expected 'cmd' | 'powershell' | 'pwsh' or an absolute path to bash.exe/sh.exe/pwsh.exe/powershell.exe`)}}function L4(){let $=p$.dirname(uq(import.meta.url));return p$.resolve($,"..","..")}var D4={x64:"x64",arm64:"arm64"},mq=p$.join(L4(),"vendor","srt-win",D4[process.arch]??process.arch,"srt-win.exe");function gq(){let $=L4(),J=D4[process.arch],X=[];if(J)X.push(p$.join($,"vendor","srt-win",J,"srt-win.exe"));X.push(p$.join($,"vendor","srt-win-src","target","release","srt-win.exe"));for(let Q of X)if(c$.existsSync(Q))return Q;throw new z$("srt_win_not_found",`srt-win.exe not found. Set windows.srtWin.path or build with \`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. Looked in: ${X.join(", ")}`)}var R4="--srt-win";function I0($){if($?.path===void 0)throw new z$("srt_win_not_found","no srt-win path configured; set windows.srtWin.path (e.g. to the exported VENDORED_SRT_WIN_EXE constant for the packaged binary)");if(!c$.existsSync($.path))throw new z$("srt_win_not_found",`windows.srtWin.path is set to '${$.path}' but the file does not exist`);return{exe:$.path,prependArgs:[R4]}}function hJ($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??I0(),Y=hq(X,[...Q,...$],{encoding:"utf8",windowsHide:!0,timeout:J.timeoutMs??15000,...J.stdin!==void 0?{input:J.stdin}:{}});if(Y.error){if(Y.error.code==="ETIMEDOUT")throw new z$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${J.timeoutMs??15000}ms`+(Y.signal?` (killed by ${Y.signal})`:""),$[0]);throw new z$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${Y.error.message}`,$[0])}return{status:Y.status,signal:Y.signal,stdout:(Y.stdout??"").trim(),stderr:(Y.stderr??"").trim()}}function HG($,J={}){let{exe:X,prependArgs:Q}=J.srtWin??I0(),Y=J.timeoutMs??15000;return new Promise((G,W)=>{let O=yq(X,[...Q,...$],{windowsHide:!0}),M=!1,U=Y>0?setTimeout(()=>{M=!0,O.kill()},Y):void 0,H="",V="";O.stdout?.setEncoding("utf8").on("data",(q)=>H+=q),O.stderr?.setEncoding("utf8").on("data",(q)=>V+=q),O.stdin?.on("error",()=>{}).end(J.stdin),O.once("error",(q)=>{clearTimeout(U),W(new z$("spawn_failed",`srt-win ${$[0]}: spawn failed: ${q.message}`,$[0]))}),O.once("close",(q,z)=>{if(clearTimeout(U),M){W(new z$("srt_win_timeout",`srt-win ${$.join(" ")} timed out after ${Y}ms`+(z?` (killed by ${z})`:""),$[0]));return}G({status:q,signal:z,stdout:H.trim(),stderr:V.trim()})})})}function Z4($,J){if(J.status!==0)throw new z$("srt_win_nonzero",`srt-win ${$.join(" ")} exited ${J.status}: ${J.stderr||J.stdout}`,$[0]);try{return JSON.parse(J.stdout)}catch(X){throw new z$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(J.stdout)}: ${X.message}`,$[0])}}function VG($,J){return Z4($,hJ($,J))}async function qG($,J){return Z4($,await HG($,J))}function B4($,J){let X=hJ($,J),Q;try{Q=JSON.parse(X.stdout)}catch(Y){throw new z$("srt_win_bad_json",`srt-win ${$.join(" ")}: unparseable JSON output ${JSON.stringify(X.stdout)}: ${Y.message}`,$[0])}return{ok:X.status===0,json:Q,stderr:X.stderr}}function T4($){let J=["wfp","status"];if($)J.push("--sublayer-guid",$);return J}function $9($){return{state:$.state,filters:$.filters,...$.port_range&&{portRange:$.port_range},...$.user_sid&&{userSid:$.user_sid},...$.hint&&{hint:$.hint}}}function J9($){return{provisioned:$.user.exists,...$.user.sid&&{sid:$.user.sid},groupExists:$.user.group_exists,...$.user.group_sid&&{groupSid:$.user.group_sid},inBuiltinUsers:$.user.in_builtin_users,inSandboxGroup:$.user.in_sandbox_group,hiddenFromLogon:$.user.hidden_from_logon,credPresent:$.cred_present,...typeof $.marker_version==="number"&&{markerVersion:$.marker_version},realUserSid:$.real_user_sid,...$.ca_cert_thumb&&{caCertThumb:$.ca_cert_thumb},...$.ca_cert_pem&&{caCertPem:$.ca_cert_pem}}}function S4($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=VG(J,{srtWin:$.srtWin});return{user:J9(X.user),wfp:$9(X.wfp)}}async function j4($={}){let J=["status"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);let X=await qG(J,{srtWin:$.srtWin});return{user:J9(X.user),wfp:$9(X.wfp)}}function C4($={}){return $9(VG(T4($.sublayerGuid),{srtWin:$.srtWin}))}async function I4($={}){return $9(await qG(T4($.sublayerGuid),{srtWin:$.srtWin}))}async function KG($={}){let J=$.target,X;if(!J){let[Q,Y]=$.proxyPortRange??tY;for(let G=0;G<5;G++){let W=A4.createServer();W.listen(0,"127.0.0.1"),await bq(W,"listening");let O=W.address().port;if(O<Q||O>Y){X=W,J=`127.0.0.1:${O}`;break}W.close()}if(!J)throw new z$("wfp_verify_bind_failed",`verifyWindowsWfpEgress: could not bind a loopback listener outside the WFP permit range [${Q},${Y}] in 5 attempts`)}try{let Q=hJ(["wfp","verify","--target",J],{timeoutMs:30000,srtWin:$.srtWin});Z(`[Sandbox Windows] wfp verify exit=${Q.status}: ${Q.stderr||Q.stdout}`);let Y;try{Y=JSON.parse(Q.stdout)}catch{throw new z$("wfp_verify_unparseable","WFP egress fence could not be verified \u2014 `srt-win wfp "+`verify\` exited ${Q.status}`+(Q.signal?` (signal ${Q.signal})`:"")+` with unparseable output ${JSON.stringify(Q.stdout)} (stderr: ${JSON.stringify(Q.stderr)})`)}if(Q.status===3)throw new z$("wfp_fence_inactive","WFP egress fence is not active \u2014 direct outbound from the "+`sandbox user to ${Y.target} succeeded. Re-run \`srt-win install\` (one UAC prompt). (${Q.stderr})`);if(Q.status!==0)throw new z$("wfp_verify_inconclusive","WFP egress fence could not be verified \u2014 probe to "+`${Y.target} was '${Y.egress_probe}' (exit ${Q.status}). The fence may be absent. Re-run \`srt-win install\`. (${Q.stderr})`);return{target:Y.target,stderr:Q.stderr}}finally{X?.close()}}function EG($={}){return J9(VG(["user","status"],{srtWin:$.srtWin}))}async function _X($={}){return J9(await qG(["user","status"],{srtWin:$.srtWin}))}function zG($,J={}){let X=$??EG(J);if(!X.caCertThumb||!X.caCertPem)return null;return{pem:X.caCertPem,thumb:X.caCertThumb}}function lq($,J={}){let X=hJ(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});P4($,X)}async function w4($,J={}){let X=await HG(["user","trust-ca",$],{timeoutMs:60000,srtWin:J.srtWin});P4($,X)}function P4($,J){if(Z(`[Sandbox Windows] user trust-ca exit=${J.status}: ${J.stderr||J.stdout}`),J.status!==0)throw new z$("trust_ca_failed",`srt-win user trust-ca '${$}' failed (exit ${J.status}): ${J.stderr||J.stdout}`)}function _4(){let $=process.env.ProgramData;if(!$)throw Error("ProgramData is not set");return p$.win32.join($,"sandbox-runtime")}async function FG($={}){let J=$.status??await _X({srtWin:$.srtWin});if(!J.provisioned||!J.credPresent)throw Error(`ensurePersistentWindowsCa: sandbox user is not provisioned (user=${J.provisioned}, cred=${J.credPresent}). Run \`npx sandbox-runtime windows-install\` first.`);let X=$.dir?void 0:_4();if(X&&!c$.existsSync(X))throw Error(`ensurePersistentWindowsCa: state directory ${X} does not exist. Run \`npx sandbox-runtime windows-install\` first.`);let Q=$.dir??p$.win32.join(X,"ca"),Y=p$.join(Q,"ca.json"),G=p$.join(Q,"cert.pem"),W=p$.join(Q,"key.pem"),O=($.regenerateWithinDays??30)*24*60*60*1000,M=(A,D)=>{let j=`${A}.tmp.${process.pid}`;c$.writeFileSync(j,D),c$.renameSync(j,A)},U=async(A,D,j,S)=>{M(G,A),M(W,D);let P=S||J.caCertThumb!==j;if(P){let C=p$.join(Q,`.trust.${process.pid}.${Date.now()}.pem`);c$.writeFileSync(C,A);try{await w4(C,{srtWin:$.srtWin})}finally{c$.rmSync(C,{force:!0})}}return Z(`[Sandbox Windows] persistent CA ${S?"generated":"reused"} (thumb=${j}${P&&!S?", trust reconciled":""})`),{certPem:A,keyPem:D,certPath:G,keyPath:W,thumbprint:j,generated:S,trusted:P}},H=()=>{let A;try{A=JSON.parse(c$.readFileSync(Y,"utf8"))}catch(j){Z(`[Sandbox Windows] persistent CA ca.json unreadable (${j.message})`,{level:"warn"});return}if(typeof A.certPem!=="string"||typeof A.keyPem!=="string")return;let D=SX(A.certPem,A.keyPem);if(!D.ok){Z(`[Sandbox Windows] persistent CA invalid (${D.reason})`,{level:"warn"});return}return{certPem:A.certPem,keyPem:A.keyPem,thumbprint:D.thumbprint,notAfter:D.notAfter}};if(!$.force){let A=H();if(A&&A.notAfter.getTime()-Date.now()>O)return await U(A.certPem,A.keyPem,A.thumbprint,!1);if(A)Z(`[Sandbox Windows] persistent CA expiring ${A.notAfter.toISOString()}; regenerating`,{level:"warn"})}c$.mkdirSync(Q,{recursive:!0});try{let A=Date.now()-300000;for(let D of c$.readdirSync(Q)){if(!D.includes(".tmp.")&&!D.startsWith(".trust."))continue;let j=p$.join(Q,D);if(c$.statSync(j).mtimeMs<A)c$.rmSync(j,{force:!0})}}catch{}let V=xY({cn:"sandbox-runtime persistent CA"});M(Y,JSON.stringify({certPem:V.certPem,keyPem:V.keyPem}));let q=H(),{certPem:z,keyPem:K,thumbprint:L}=q??{certPem:V.certPem,keyPem:V.keyPem,thumbprint:fQ(V.certPem)};return await U(z,K,L,!0)}function NG($){return $.timeoutMs??120000}function x4($){let J=["install"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.proxyPortRange)J.push("--proxy-port-range",`${$.proxyPortRange[0]}-${$.proxyPortRange[1]}`);if($.sandboxUser)J.push("--sandbox-user",$.sandboxUser);if($.force)J.push("--force");return J}function v4($){if($ instanceof z$&&$.code==="srt_win_timeout")throw new z$("install_timeout","srt-win install timed out \u2014 the UAC prompt may still be open. "+`Re-run when ready to grant elevation. (${$.message})`);throw $}function k4($){if(Z(`[Sandbox Windows] install exit=${$.status}: ${$.stderr||$.stdout}`),$.status===0||$.status===10)return;let J=$.stderr||$.stdout;switch($.status){case 12:throw new z$("install_wfp_failed",`srt-win install: WFP filter install failed: ${J}`);case 14:throw new z$("install_user_failed",`srt-win install: sandbox user provisioning failed: ${J}`);case 13:throw new z$("install_config_conflict",`srt-win install: filters already exist under this sublayer with a different port range or sandbox-user name. Pass {force: true} to replace, or pick a different sublayerGuid. Output: ${J}`);case 17:throw new z$("install_ambient_failed",`srt-win install: ambient write-deny stamping failed (stock world-writable system dirs could not be deny-stamped for the sandbox user): ${J}`);default:throw new z$("install_failed",`srt-win install failed (exit ${$.status}): ${J}`)}}function dq($={}){let J=$.srtWin??I0(),X;try{X=hJ(x4($),{timeoutMs:NG($),srtWin:J})}catch(Y){v4(Y)}k4(X);let Q=S4({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}async function pq($={}){let J=$.srtWin??I0(),X;try{X=await HG(x4($),{timeoutMs:NG($),srtWin:J})}catch(Y){v4(Y)}k4(X);let Q=await j4({sublayerGuid:$.sublayerGuid,srtWin:J});return X.status===10?{...Q,cancelled:!0}:Q}function cq($={}){let J=["uninstall"];if($.sublayerGuid)J.push("--sublayer-guid",$.sublayerGuid);if($.keepUser)J.push("--keep-user");let X=hJ(J,{timeoutMs:NG($),srtWin:$.srtWin});if(Z(`[Sandbox Windows] uninstall exit=${X.status}: ${X.stderr||X.stdout}`),X.status===10)return{cancelled:!0};if(X.status!==0)throw new z$("uninstall_failed",`srt-win uninstall failed (exit ${X.status}): ${X.stderr||X.stdout}`);return{}}function Q9($,J){let X=new Set;for(let Q of $){let Y=i$(Q),G=YX(Y);if(GX(Y)&&!G){X.add(Y);continue}let W=G?aJ(Y,{caseInsensitive:!0}):[Y];for(let O of W){if(!c$.statSync(O,{throwIfNoEntry:!1})){if(J?.mode==="deny"&&!G)X.add(/[\\/]$/.test(Q)&&!/[\\/]$/.test(O)?O+"\\":O);continue}X.add(O)}}return[...X]}function nq($){for(let J of $.split(/\r?\n/)){let X=J.trim();if(!X.startsWith("{")||!X.includes('"code"'))continue;try{let Q=JSON.parse(X);if(Q.code==="mapped_drive_cwd")return Object.assign(new z$("mapped_drive_cwd",Q.message??"mapped/network-drive working directory","exec"),{drive:Q.drive})}catch{}}return}function AG($){let J=$.holderPid??process.pid,X=JSON.stringify({denyRead:$.denyRead,denyWrite:$.denyWrite}),Q=hJ(["acl","stamp","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl stamp exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new z$("acl_stamp_failed",`srt-win acl stamp exited ${Q.status} `+(Q.status===2?"(partial \u2014 some inputs skipped)":"(failed)")+`: ${Q.stderr||Q.stdout}`)}function X9($){let J=$.holderPid??process.pid;try{let X=B4(["acl","restore","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl restore exited non-zero (per-path outcomes preserved): ${X.stderr}`,{level:"error"});return Array.isArray(X.json)?X.json:[...X.json.paths??[],...X.json.parents??[]]}catch(X){Z(`[Sandbox Windows] acl restore: ${X.message}`,{level:"error"});return}}function LG($){let J=$.holderPid??process.pid,X=JSON.stringify({read:$.read,write:$.write}),Q=hJ(["acl","grant","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid],{timeoutMs:60000,stdin:X,srtWin:$.srtWin});if(Z(`[Sandbox Windows] acl grant exit=${Q.status}: ${Q.stderr||Q.stdout}`),Q.status!==0)throw new z$("acl_grant_failed",`srt-win acl grant exited ${Q.status}: ${Q.stderr||Q.stdout}`)}function Y9($){let J=$.holderPid??process.pid;try{let X=B4(["acl","revoke","--holder-pid",`${J}`,"--sandbox-user-sid",$.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:$.srtWin});if(!X.ok)Z(`[Sandbox Windows] acl revoke exited non-zero: ${X.stderr}`,{level:"error"});return X.json}catch(X){Z(`[Sandbox Windows] acl revoke: ${X.message}`,{level:"error"});return}}function f4($){let{exe:J,prependArgs:X}=$.srtWin??I0(),Q=iq(NQ($.httpProxyPort,$.socksProxyPort,$.caCertPath?.replace(/\\/g,"/"),$.proxyAuthToken,void 0,w0($.commandId??$.command)));delete Q.TMPDIR,delete Q.NO_PROXY,delete Q.no_proxy;let Y=WX({safeDirs:[$.cwd??process.cwd(),...$.allowWrite??[],...$.gitSafeDirectories??[]],schannelCa:$.caCertPath!==void 0,baseEnv:$.setEnvVars}),G=[J,...X,"exec"];if($.quiet!==!1)G.push("--quiet");for(let H of $.denyRead??[])G.push("--deny-read",H);for(let H of $.denyWrite??[])G.push("--deny-write",H);let W={PATH:process.env.PATH,PATHEXT:process.env.PATHEXT,...$.setEnvVars??{},...Q,...Y};for(let[H,V]of Object.entries(W))if(V!==void 0)G.push("--env",`${H}=${V}`);G.push("--");let O=$.binShell??eY(void 0);G.push(O.exe,...O.args,$.command);let M=G.reduce((H,V)=>H+V.length+3,0);if(M>30000)throw new z$("argv_too_long",`Windows sandbox argv is ~${M} chars (CreateProcessW limit is 32 767).`);let U={...process.env,...Q};return{argv:G,env:U}}function iq($){let J={};for(let X of $){let Q=X.indexOf("=");if(Q===-1)continue;J[X.slice(0,Q)]=X.slice(Q+1)}return J}function UG($){let J=$?` --sublayer-guid ${$}`:"";return`Windows sandbox needs a one-time install (one UAC prompt):
|
|
67
|
+
npx sandbox-runtime windows-install
|
|
68
|
+
`+" \u2014 or call installWindowsSandbox(), or run "+`\`srt-win.exe install${J}\` directly.
|
|
69
|
+
No logout is needed: the WFP filter keys on the dedicated \`srt-sandbox\` user's SID, so your network is unaffected.`}function N4($){try{return{status:"fulfilled",value:$()}}catch(J){return{status:"rejected",reason:J}}}function y4($,J,X){let Q=[],Y=[];if(J.status==="rejected")return Q.push(`srt-win user status failed: ${J.reason.message}`),{errors:Q,warnings:Y};let G=J.value;if(!G.provisioned||!G.credPresent)Q.push(`Sandbox user is not provisioned (user=${G.provisioned}, cred=${G.credPresent}). `+UG($));let W=X();if(W.status==="rejected")return Q.push(`srt-win wfp status failed: ${W.reason.message}`),{errors:Q,warnings:Y};let O=W.value;if(O.state==="cannot-read")Z(`[Sandbox Windows] wfp status cannot-read (non-elevated): ${O.hint}`);else if(O.state!=="installed"){if(G.provisioned&&G.credPresent)Q.push(`WFP filters not installed under sublayer ${$??"(default)"}. `+UG($))}else if(O.portRange)Z(`[Sandbox Windows] WFP installed: ${O.filters} filters, proxy port range ${O.portRange[0]}-${O.portRange[1]}`);return{errors:Q,warnings:Y}}function h4($={}){let J;try{J=$.srtWin??I0()}catch(X){return{errors:[X.message],warnings:[]}}return Z(`[Sandbox Windows] using srt-win at ${J.exe}`),y4($.sublayerGuid,N4(()=>EG({srtWin:J})),()=>N4(()=>C4({sublayerGuid:$.sublayerGuid,srtWin:J})))}async function DG($={}){let J;try{J=$.srtWin??I0()}catch(Y){return{errors:[Y.message],warnings:[]}}Z(`[Sandbox Windows] using srt-win at ${J.exe}`);let[X,Q]=await Promise.allSettled([_X({srtWin:J}),I4({sublayerGuid:$.sublayerGuid,srtWin:J})]);return y4($.sublayerGuid,X,()=>Q)}import{isIP as oq}from"net";function xX($){if($.startsWith("[")){let Q=$.indexOf("]");if(Q===-1)return{hostPattern:$,port:void 0};let Y=$.slice(1,Q),G=j0(Y)??Y,W=$.slice(Q+1);if(W==="")return{hostPattern:G,port:void 0};let O=b4(W.startsWith(":")?W.slice(1):"");return O===void 0?{hostPattern:$,port:void 0}:{hostPattern:G,port:O}}let J=$.lastIndexOf(":");if(J===-1)return{hostPattern:$,port:void 0};if($.indexOf(":")!==J)return{hostPattern:j0($)??$,port:void 0};let X=b4($.slice(J+1));if(X===void 0)return{hostPattern:$,port:void 0};return{hostPattern:$.slice(0,J),port:X}}function b4($){if(!/^[1-9][0-9]{0,4}$/.test($))return;let J=Number($);return J>65535?void 0:J}function vX($){return xX($).hostPattern}function LJ($,J){let X=$.toLowerCase();if(J==="*")return!0;if(J.startsWith("*.")){if(oq(d0(X)))return!1;let Q=J.substring(2).toLowerCase();return X.endsWith("."+Q)}return X===J.toLowerCase()}function G9($,J,X){let{hostPattern:Q,port:Y}=xX(X);if(Y!==void 0&&Y!==J)return!1;return LJ($,Q)}function W9($,J){let X=J.map(vX);if(!$.startsWith("*."))return X.some((Y)=>LJ($,Y));let Q=$.slice(2).toLowerCase();return X.some((Y)=>{if(!Y.startsWith("*."))return!1;let G=Y.slice(2).toLowerCase();return Q===G||Q.endsWith("."+G)})}import{EOL as RG}from"os";import{dirname as rq}from"path";var y,fX,yX,hX,b0,bJ,u4=!1,O9,mQ,mJ,n$,gJ,gQ,uJ,M9,m4=!1,bX,UQ=new rY,HQ=new n8,H9=new r8,U9=new a8;function sq(){if(u4)return;let $=()=>IG().catch((J)=>{Z(`Cleanup failed in registerCleanup ${J}`,{level:"error"})});process.once("exit",$),process.once("SIGINT",$),process.once("SIGTERM",$),u4=!0}var tq=1024,MQ=new Map;function n4($,J){let X=J?.commandId,Q=J?.commandText??$;if(X===void 0||X===Q)return;let Y=oJ(w0(X));MQ.delete(Y),MQ.set(Y,Q);while(MQ.size>tq){let G=MQ.keys().next().value;if(G===void 0)break;MQ.delete(G)}}function g4($){return MQ.get($)??$}function BG($,J){let X=J?(()=>{let Q=oJ(J);return MQ.get(Q)??YG(Q)})():void 0;if(bQ($,X,y?.ignoreViolations))return;UQ.addViolation({line:$,encodedCommand:J,command:X,timestamp:new Date})}function eq($){try{let J=new URL($);return`${J.origin}${J.pathname}${J.search?"?\u2026":""}`}catch{let J=$.indexOf("?");return J===-1?$:`${$.slice(0,J)}?\u2026`}}async function l4($,J,X,Q){let Y=(W)=>{return BG(`deny network-outbound ${J}:${$} (${W})`,Q),!1};if(!y)return Z("No config available, denying network request"),Y("sandbox policy unavailable");if(!yQ(J))return Z(`Denying malformed host: ${JSON.stringify(J)}:${$}`,{level:"error"}),Y("malformed host");let G=j0(J)??J;for(let W of y.network.deniedDomains)if(G9(G,$,W))return Z(`Denied by config rule: ${J}:${$}`),Y(y.network.deniedDomainReasons?.[W]??"host is on the deny list");for(let W of y.network.allowedDomains)if(G9(G,$,W))return Z(`Allowed by config rule: ${J}:${$}`),!0;if(!X||y.network.strictAllowlist)return Z(`No matching config rule, denying: ${J}:${$}`),Y("host is not on the allow list");Z(`No matching config rule, asking user: ${J}:${$}`);try{if(await X({host:J,port:$}))return Z(`User allowed: ${J}:${$}`),!0;return Z(`User denied: ${J}:${$}`),Y("user denied")}catch(W){return Z(`Error in permission callback: ${W}`,{level:"error"}),Y("permission prompt failed")}}function $K(){if(!y?.credentials)return;return($,J)=>{HQ.substituteInHeaders($,J,LJ)}}function JK(){if(!y?.credentials)return;return($)=>HQ.sentinelsForHost($,LJ)}function QK(){if(!y?.credentials)return;return($,J,X,Q)=>iW(H9,y?.credentials?.sigv4,LJ)($,J,X,Q)}function XK($){if(!y?.network.mitmProxy)return;let{socketPath:J,domains:X}=y.network.mitmProxy,Q=j0($)??$;for(let Y of X)if(LJ(Q,Y))return Z(`Host ${$} matches MITM pattern ${Y}`),J;return}function YK($){let J=y?.network.tlsTerminate?.excludeDomains;if(!J?.length)return!0;let X=j0($)??$;for(let Q of J){if(!LJ(X,Q))continue;Z(`Host ${$} matches tlsTerminate.excludeDomains pattern ${Q}; skipping TLS termination`);let Y=HQ.namesInjectableAt(X,LJ);if(Y.length>0)Z(`tlsTerminate.excludeDomains: masked credential(s) ${Y.join(", ")} are configured for injection at ${$}, but its connections are not terminated, so the upstream will receive the placeholder`,{level:"error"});return!1}return!0}async function GK($,J){let X=$K(),Q=JK();fX=wW({filter:(O,M,U,H)=>l4(O,M,$,H),getMitmSocketPath:XK,mitmCA:n$,shouldTerminateTLS:YK,filterRequest:y?.network.filterRequest,onFilterRequestDenied:({method:O,url:M,reason:U,encodedCommand:H})=>{BG(`deny http-request ${O} ${eq(M)} (${U})`,H)},mutateHeaders:X,mutateHeadersPlaintext:y?.credentials?.allowPlaintextInject?X:void 0,getBodySubstitutions:Q,getBodySubstitutionsPlaintext:y?.credentials?.allowPlaintextInject?Q:void 0,planSigv4:QK(),parentProxy:mJ,proxyAuthToken:gJ}),yX=vW({filter:(O,M,U)=>l4(O,M,$,U),parentProxy:mJ,proxyAuthToken:gJ,probeUnauthenticated:async(O,M)=>{if(!y)return{};let U=j0(M)??M;for(let H of y.network.deniedDomains)if(G9(U,O,H)){let V=y.network.deniedDomainReasons?.[H]??"host is on the deny list";return BG(`deny network-outbound ${M}:${O} (${V})`,void 0),{deniedReason:V}}return{}}}),hX=yW({httpServer:fX,handleSocksConnection:(O)=>yX.handleConnection(O),httpBackendPortRange:J});let Y=hX,G=await Y.listenHttpBackend();await gY(Y.server,(O)=>Y.server.listen(O,"127.0.0.1"),J,G!==void 0?new Set([G]):new Set);let W=Y.getPort();if(W===void 0)throw Error("Failed to get mux proxy server port");return Y.unref(),Z(`Mux proxy (HTTP+SOCKS) listening on localhost:${W}`),W}async function WK($,J,X=!1){if(bJ){await bJ;return}if(y=$,mJ=y8($.network.parentProxy),mJ)Z(`Parent proxy configured: http=${u8(mJ.httpUrl)} https=${u8(mJ.httpsUrl)}`);if($.network.tlsTerminate&&$.network.mitmProxy)throw Error("network.tlsTerminate and network.mitmProxy are mutually exclusive");let Q=$.network.tlsTerminate,Y=_$()==="windows"&&Q!==void 0&&!Q.caCertPath&&!Q.caKeyPath;n$=Q&&!Y?P8(Q):void 0;let G=await a4();if(G.errors.length>0)throw Error(`Sandbox dependencies not available: ${G.errors.join(", ")}`);if(X&&_$()==="macos")O9=K4(UQ.addViolation.bind(UQ),y.ignoreViolations,g4),Z("Started macOS sandbox log monitor");if(X&&_$()==="linux")mQ=z4(UQ.addViolation.bind(UQ),{allowWritePaths:[...FQ(),...y.filesystem.allowWrite],denyWritePaths:y.filesystem.denyWrite,ignoreViolations:y.ignoreViolations,resolveCommandText:g4}),mQ.ready,Z("Started Linux seccomp violation monitor");if(sq(),_$()==="windows"){bX=I0($.windows?.srtWin);let W=bX,O=await _X({srtWin:W});if(!O.provisioned||!O.credPresent)throw y=void 0,new z$("not_provisioned",`Windows sandbox user is not provisioned (user=${O.provisioned}, cred=${O.credPresent}). Run \`npx sandbox-runtime windows-install\` (one UAC prompt) to provision it.`);if(!m4){try{await KG({proxyPortRange:$.windows?.proxyPortRange,srtWin:W})}catch(M){throw y=void 0,M}m4=!0}if(Y&&Q)try{let M=await FG({status:O,srtWin:W});n$=P8({caCertPem:M.certPem,caKeyPem:M.keyPem,caCertPath:M.certPath,caKeyPath:M.keyPath,extraCaCertPaths:Q.extraCaCertPaths})}catch(M){throw y=void 0,M}if(Q&&n$&&!Y){let M=zG(O),U=fQ(n$.certPem);if(!M)throw y=void 0,new z$("trust_ca_not_installed",`tlsTerminate on Windows requires the sandbox to be installed with this CA (thumb=${U}): run \`srt-win user trust-ca ${n$.certPath}\`. Per-exec installs into the sandbox user's Root store are not supported.`);if(M.thumb!==U)throw y=void 0,new z$("trust_ca_thumbprint_mismatch",`tlsTerminate on Windows: the sandbox's installed CA (thumb=${M.thumb}) doesn't match this session's CA (thumb=${U}). Run \`srt-win user trust-ca ${n$.certPath}\` to update it.`)}try{let M=VK($);if(n$)M.grantRead.push(rq(n$.trustBundlePath));if(!O.sid)throw Error("sandbox user SID missing from `srt-win user status` (provisioned but in an inconsistent state)");let U=O.sid;if(uJ=U,M.grantRead.length>0||M.grantWrite.length>0)LG({sandboxUserSid:U,read:M.grantRead,write:M.grantWrite,srtWin:W});if(M.denyRead.length>0||M.denyWrite.length>0)AG({sandboxUserSid:U,denyRead:M.denyRead,denyWrite:M.denyWrite,srtWin:W});if(M.grantRead.length>0||M.grantWrite.length>0||M.denyRead.length>0||M.denyWrite.length>0)gQ=M,Z(`[Sandbox Windows] fs applied: ${M.grantWrite.length} grantWrite, ${M.grantRead.length} grantRead, ${M.denyRead.length} denyRead, ${M.denyWrite.length} denyWrite`);M9=s4($)}catch(M){if(uJ)Y9({sandboxUserSid:uJ,srtWin:W}),X9({sandboxUserSid:uJ,srtWin:W});throw uJ=void 0,y=void 0,M}}bJ=(async()=>{try{let W=_$()==="windows"?y.windows?.proxyPortRange??tY:void 0;gJ=y.network.httpProxyPort!==void 0?void 0:aq(16).toString("hex");let M=y.network.httpProxyPort===void 0||y.network.socksProxyPort===void 0?await GK(J,W):void 0,U=y.network.httpProxyPort??M,H=y.network.socksProxyPort??M;if(n$&&M!==void 0&&_$()==="windows")n$.crlUrl=`http://127.0.0.1:${M}${_Y}`;if(y.network.httpProxyPort!==void 0)Z(`Using external HTTP proxy on port ${U}`);if(y.network.socksProxyPort!==void 0)Z(`Using external SOCKS proxy on port ${H}`);let V;if(_$()==="linux")V=await G4(U,H,y.socatPath);let q={httpProxyPort:U,socksProxyPort:H,linuxBridge:V};return b0=q,Z("Network infrastructure initialized"),q}catch(W){throw bJ=void 0,b0=void 0,IG().catch((O)=>{Z(`Cleanup failed in initializationPromise ${O}`,{level:"error"})}),W}})(),await bJ}function i4(){let $=_$();if($==="linux")return D9()!=="1";return $==="macos"||$==="windows"}function OK(){return y!==void 0}function o4($){if(!i4())return{done:{errors:["Unsupported platform"],warnings:[]}};let J=[],X=[],Q=_$();if(Q==="linux"){let Y=$??y?.ripgrep??{command:"rg"};if(NJ(Y.command)===null)J.push(`ripgrep (${Y.command}) not found`);let G=Y4({seccompConfig:y?.seccomp,bwrapPath:y?.bwrapPath,socatPath:y?.socatPath});J.push(...G.errors),X.push(...G.warnings)}else if(Q==="windows"){let Y;try{Y=I0(y?.windows?.srtWin)}catch(G){return J.push(G.message),{done:{errors:J,warnings:X}}}return{windows:{sublayerGuid:y?.windows?.sublayerGuid??y?.windows?.wfpSublayerGuid,srtWin:Y}}}return{done:{errors:J,warnings:X}}}function MK($){let J=o4($);if("done"in J)return J.done;return h4(J.windows)}async function a4($){let J=o4($);if("done"in J)return J.done;return DG(J.windows)}function TG($,J){if(!$)return{denyReadPaths:[],unsetEnvVars:[],setEnvVars:{},maskedFileBinds:[],maskedFileStoreDir:void 0};let X=V9($),Q=[...new Set((J??[]).map(vX))],Y=[];for(let H of $.envVars??[])if(H.mode==="deny")Y.push(H.name);let{setEnvVars:G,degradeToUnsetNames:W}=lW($.envVars??[],Q,HQ);Y.push(...W),nW($.envVars??[],$.awsPairs,Q,G,H9);let O=$.files??[],{binds:M,degradeToDenyPaths:U}=gW(O,Q,HQ,U9);return{denyReadPaths:[...new Set([...X,...U])],unsetEnvVars:[...new Set(Y)],setEnvVars:G,maskedFileBinds:M,maskedFileStoreDir:U9.dirPath}}function V9($){let J=$?.files??[];return[...new Set(J.filter((X)=>X.mode==="deny").map((X)=>X.path))]}function r4($,J){return[...new Set([...$,...J.denyReadPaths])]}function UK(){if(!y||y.filesystem.disabled)return{denyOnly:[],allowWithinDeny:[]};let $=r4(y.filesystem.denyRead,TG(y.credentials,y.network.allowedDomains)),J=[];for(let Q of $){let Y=qJ(Q);if(_$()==="linux"&&F0(Y)){let G=aJ(Q);Z(`[Sandbox] Expanded glob pattern "${Q}" to ${G.length} paths on Linux`),J.push(...G)}else J.push(Y)}let X=[];for(let Q of y.filesystem.allowRead??[]){let Y=qJ(Q);if(_$()==="linux"&&F0(Y)){let G=aJ(Q);Z(`[Sandbox] Expanded allowRead glob pattern "${Q}" to ${G.length} paths on Linux`),X.push(...G)}else X.push(Y)}return{denyOnly:J,allowWithinDeny:X}}function HK(){if(!y)return{allowOnly:FQ(),denyWithinAllow:[]};if(y.filesystem.disabled)return{allowOnly:["/"],denyWithinAllow:[]};let $=y.filesystem.allowWrite.map((Q)=>qJ(Q)).filter((Q)=>{if(_$()==="linux"&&F0(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0}),J=y.filesystem.denyWrite.map((Q)=>qJ(Q)).filter((Q)=>{if(_$()==="linux"&&F0(Q))return Z(`Skipping glob pattern on Linux/WSL: ${Q}`),!1;return!0});return{allowOnly:[...FQ(),...$],denyWithinAllow:J}}function VK($){let J=$.filesystem;if(J?.disabled)return{grantRead:[],grantWrite:[],denyRead:[],denyWrite:[]};let X=Q9,Q=X([...new Set([...J?.denyRead??[],...V9($.credentials)])],{mode:"deny"}),Y=X(J?.denyWrite??[],{mode:"deny"});return{grantRead:X(J?.allowRead??[],{mode:"grant"}),grantWrite:X(J?.allowWrite??[],{mode:"grant"}),denyRead:Q,denyWrite:Y}}function s4($){return{disabled:$.filesystem.disabled??!1,denyRead:[...$.filesystem.denyRead],denyWrite:[...$.filesystem.denyWrite],allowRead:[...$.filesystem.allowRead??[]],allowWrite:[...$.filesystem.allowWrite],credFiles:V9($.credentials)}}function kX($,J){if($.length!==J.length)return!1;let X=new Set($);return J.every((Q)=>X.has(Q))}function qK($,J){return $.disabled===J.disabled&&kX($.denyRead,J.denyRead)&&kX($.denyWrite,J.denyWrite)&&kX($.allowRead,J.allowRead)&&kX($.allowWrite,J.allowWrite)&&kX($.credFiles,J.credFiles)}function KK($){return M9!==void 0&&qK(M9,s4($))}function EK(){if(!y)return{};let $=y.network.allowedDomains,J=y.network.deniedDomains;return{allowedHosts:$,...J.length>0&&{deniedHosts:J}}}function t4(){return y?.network?.allowUnixSockets}function d4(){return y?.network?.allowAllUnixSockets}function e4(){return y?.network?.allowLocalBinding}function $5(){return y?.network?.allowMachLookup}function J5(){return y?.ignoreViolations}function Q5(){return y?.enableWeakerNestedSandbox}function zK(){return y?.enableWeakerNetworkIsolation}function FK(){return y?.allowAppleEvents}function NK(){return y?.ripgrep??{command:"rg"}}function AK(){return y?.mandatoryDenySearchDepth??3}function p4(){return y?.filesystem?.allowGitConfig??!1}function X5($){return[...y?.git?.safeDirectories??[],...$?.git?.safeDirectories??[]]}function LK(){return y?.seccomp}function DK(){return gJ}function SG(){return b0?.httpProxyPort}function jG(){return b0?.socksProxyPort}function Y5(){return b0?.linuxBridge?.httpSocketPath}function G5(){return b0?.linuxBridge?.socksSocketPath}async function CG(){if(!y)return!1;if(bJ)try{return await bJ,!0}catch{return!1}return b0!==void 0}async function W5($,J,X,Q,Y){let G=_$(),W=Y?.commandId;n4($,Y);let O=X?.filesystem!==void 0?X.filesystem.disabled??!1:y?.filesystem.disabled??!1,M=TG(X?.credentials??y?.credentials,X?.network?.allowedDomains??y?.network?.allowedDomains),U,H;if(!O){let A=(w)=>w.map((b)=>qJ(b)).filter((b)=>{if(_$()==="linux"&&F0(b))return Z(`[Sandbox] Skipping glob write pattern on Linux: ${b}`),!1;return!0}),D=A(X?.filesystem?.allowWrite??y?.filesystem.allowWrite??[]);U={allowOnly:[...FQ(),...D],denyWithinAllow:A(X?.filesystem?.denyWrite??y?.filesystem.denyWrite??[])};let j=r4(X?.filesystem?.denyRead??y?.filesystem.denyRead??[],M),S=[];for(let w of j){let b=qJ(w);if(_$()==="linux"&&F0(b))S.push(...aJ(w));else S.push(b)}let P=X?.filesystem?.allowRead??y?.filesystem.allowRead??[],C=[];for(let w of P){let b=qJ(w);if(_$()==="linux"&&F0(b))C.push(...aJ(w));else C.push(b)}if(n$)C.push(n$.certPath,n$.trustBundlePath);H={denyOnly:S,allowWithinDeny:C}}let V=X?.network?.allowedDomains!==void 0||y?.network?.allowedDomains!==void 0,q=V,z=V;if(z)await CG();let K=X?.allowPty??y?.allowPty,L=X5(X);switch(G){case"macos":return q4({command:$,commandId:W,needsNetworkRestriction:q,httpProxyPort:z?SG():void 0,socksProxyPort:z?jG():void 0,proxyAuthToken:z?gJ:void 0,caCertPath:n$?.trustBundlePath,readConfig:H,writeConfig:U,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,allowUnixSockets:t4(),allowAllUnixSockets:d4(),allowLocalBinding:e4(),allowMachLookup:$5(),ignoreViolations:J5(),allowPty:K,allowGitConfig:p4(),gitSafeDirectories:L,enableWeakerNetworkIsolation:zK(),allowAppleEvents:FK(),binShell:J});case"linux":return W4({command:$,commandId:W,needsNetworkRestriction:q,httpSocketPath:z?Y5():void 0,socksSocketPath:z?G5():void 0,httpProxyPort:z?b0?.httpProxyPort:void 0,socksProxyPort:z?b0?.socksProxyPort:void 0,proxyAuthToken:z?gJ:void 0,caCertPath:n$?.trustBundlePath,readConfig:H,writeConfig:U,unsetEnvVars:M.unsetEnvVars,setEnvVars:M.setEnvVars,maskedFileBinds:M.maskedFileBinds,maskedFileStoreDir:M.maskedFileStoreDir,enableWeakerNestedSandbox:Q5(),allowAllUnixSockets:d4(),binShell:J,ripgrepConfig:NK(),mandatoryDenySearchDepth:AK(),allowGitConfig:p4(),gitSafeDirectories:L,seccompConfig:LK(),bwrapPath:y?.bwrapPath,socatPath:y?.socatPath,observeSocketPath:mQ?.observeSocketPath,abortSignal:Q});case"windows":throw Error("wrapWithSandbox() returns a shell string and is not supported on Windows. Use SandboxManager.wrapWithSandboxArgv() and spawn the result with {shell: false}.");default:throw Error(`Sandbox configuration is not supported on platform: ${G}`)}}async function RK($,J,X,Q,Y,G){if(_$()==="windows"){let U=X?.network?.allowedDomains!==void 0||y?.network?.allowedDomains!==void 0;if(U)await CG();let H=TG(X?.credentials??y?.credentials,X?.network?.allowedDomains??y?.network?.allowedDomains),V=X?.filesystem,q=[],z=[];if(!V?.disabled){if(V?.allowRead?.length||V?.allowWrite?.length)throw Error("Per-exec filesystem.allowRead/allowWrite is not supported "+"on Windows \u2014 `srt-win exec` only exposes per-exec "+"denies. Set them at the session level (initialize()).");let K=[...V?.denyRead??[],...V9(X?.credentials)],L=V?.denyWrite??[];if(K.length>0||L.length>0){let A=new Set(gQ?.denyRead??[]),D=new Set(gQ?.denyWrite??[]),j=Q9;q=j(K,{mode:"deny"}).filter((S)=>!A.has(S)),z=j(L,{mode:"deny"}).filter((S)=>!A.has(S)&&!D.has(S))}}return n4($,G),f4({command:$,commandId:G?.commandId,httpProxyPort:U?SG():void 0,socksProxyPort:U?jG():void 0,proxyAuthToken:U?gJ:void 0,setEnvVars:H.setEnvVars,denyRead:q,denyWrite:z,cwd:Y,allowWrite:gQ?.grantWrite,gitSafeDirectories:X5(X),caCertPath:n$?.trustBundlePath,binShell:eY(J),srtWin:X?.windows?.srtWin?I0(X.windows.srtWin):bX??I0(y?.windows?.srtWin)})}if(typeof J==="object")throw Error("binShell object form is Windows-only; pass a shell path string on macOS/Linux");let O=await W5($,J,X,Q,G);return{argv:[J??"/bin/bash","-c",O],env:process.env}}function ZK(){return y}function BK($){if(_$()==="windows"&&y&&!KK($))Z("[Sandbox Windows] updateConfig: the resolved file-access set "+"(filesystem.* \u222A credentials.files) changed but the ACL "+"stamp/grant is session-wide \u2014 call reset() then initialize() "+"to apply. The previously-applied set stays in effect.",{level:"warn"});let{filterRequest:J,...X}=$.network;y=structuredClone({...$,network:X}),y.network.filterRequest=J,mJ=y8($.network.parentProxy),Z("Sandbox configuration updated")}function TK(){aY()}var SK=1500;function c4($,J){if(!$.pid||$.exitCode!==null||$.signalCode!==null)return Promise.resolve();try{process.kill($.pid,"SIGTERM"),Z(`Sent SIGTERM to ${J} bridge process`)}catch(X){if(X.code!=="ESRCH")Z(`Error killing ${J} bridge: ${X}`,{level:"error"});return Promise.resolve()}return new Promise((X)=>{let Q=!1,Y=()=>{if(Q)return;Q=!0,clearTimeout(G),X()};$.once("exit",()=>{Z(`${J} bridge process exited`),Y()});let G=setTimeout(()=>{if($.exitCode===null&&$.signalCode===null){Z(`${J} bridge did not exit, forcing SIGKILL`,{level:"warn"});try{if($.pid)process.kill($.pid,"SIGKILL")}catch{}}Y()},SK);G.unref?.()})}function jK($){return new Promise((J)=>{if(typeof $.closeAllConnections==="function")$.closeAllConnections();$.close((X)=>{if(X&&X.message!=="Server is not running.")Z(`Error closing HTTP proxy server: ${X.message}`,{level:"error"});J()})})}async function IG(){if(gQ&&uJ){let J=uJ,X=bX,Q=new Set(["revoked","stillHeld","restored","alreadyOriginal"]),Y=(G,W)=>{if(!Q.has(W.status))Z(`[Sandbox Windows] ${G}: '${W.path}' ${W.status} \u2014 `+"ACE may be left in place; resolve and run `srt-win acl recover` to clear",{level:"warn"})};for(let G of Y9({sandboxUserSid:J,srtWin:X})??[])Y("grant revoke",G);for(let G of X9({sandboxUserSid:J,srtWin:X})??[])Y("deny restore",G)}if(gQ=void 0,uJ=void 0,M9=void 0,bX=void 0,aY({force:!0}),O9)O9(),O9=void 0;if(mQ)mQ.stop(),mQ=void 0;if(b0?.linuxBridge){let{httpSocketPath:J,socksSocketPath:X,httpBridgeProcess:Q,socksBridgeProcess:Y}=b0.linuxBridge;if(await Promise.all([c4(Q,"HTTP"),c4(Y,"SOCKS")]),J)try{ZG.rmSync(J,{force:!0}),Z("Cleaned up HTTP socket")}catch(G){Z(`HTTP socket cleanup error: ${G}`,{level:"error"})}if(X)try{ZG.rmSync(X,{force:!0}),Z("Cleaned up SOCKS socket")}catch(G){Z(`SOCKS socket cleanup error: ${G}`,{level:"error"})}}let $=[];if(n$)$.push(YW(n$));if(hX)$.push(hX.close().catch((J)=>{Z(`Error closing mux proxy server: ${J.message}`,{level:"error"})}));if(fX)$.push(jK(fX));if(yX){let J=yX.close().catch((X)=>{Z(`Error closing SOCKS proxy server: ${X.message}`,{level:"error"})});$.push(J)}await Promise.all($),hX=void 0,fX=void 0,gJ=void 0,yX=void 0,b0=void 0,bJ=void 0,mJ=void 0,n$=void 0,HQ.clear(),H9.clear(),U9.dispose()}function CK(){return UQ}function IK($,J){if(!y)return J;let X=UQ.getViolationsForCommand($);if(X.length===0)return J;let Q=J;Q+=RG+"<sandbox_violations>"+RG;for(let Y of X)Q+=Y.line+RG;return Q+="</sandbox_violations>",Q}function wK(){if(_$()!=="linux"||!y||y.filesystem.disabled)return[];let $=[],J=[...y.filesystem.allowWrite,...y.filesystem.denyWrite];for(let X of J){let Q=qJ(X);if(F0(Q))$.push(X)}return $}var PK={initialize:WK,isSupportedPlatform:i4,isSandboxingEnabled:OK,checkDependencies:MK,checkDependenciesAsync:a4,getFsReadConfig:UK,getFsWriteConfig:HK,getNetworkRestrictionConfig:EK,getAllowUnixSockets:t4,getAllowLocalBinding:e4,getAllowMachLookup:$5,getIgnoreViolations:J5,getEnableWeakerNestedSandbox:Q5,getProxyPort:SG,getProxyAuthToken:DK,getSocksProxyPort:jG,getLinuxHttpSocketPath:Y5,getLinuxSocksSocketPath:G5,waitForNetworkInitialization:CG,wrapWithSandbox:W5,wrapWithSandboxArgv:RK,cleanupAfterCommand:TK,reset:IG,getMitmCA:()=>n$,getSentinelRegistry:()=>HQ,getAwsPairRegistry:()=>H9,getMaskedFileStore:()=>U9,getSandboxViolationStore:CK,annotateStderrWithSandboxFailures:IK,getLinuxGlobPatternWarnings:wK,getConfig:ZK,updateConfig:BK};import{isIP as g6}from"net";import{isAbsolute as l6}from"path";var x={};u5(x,{void:()=>E6,util:()=>L$,unknown:()=>q6,union:()=>A6,undefined:()=>U6,tuple:()=>R6,transformer:()=>_6,symbol:()=>M6,string:()=>z5,strictObject:()=>N6,setErrorMap:()=>vK,set:()=>T6,record:()=>Z6,quotelessJson:()=>_K,promise:()=>P6,preprocess:()=>k6,pipeline:()=>f6,ostring:()=>y6,optional:()=>x6,onumber:()=>h6,oboolean:()=>b6,objectUtil:()=>wG,object:()=>F6,number:()=>F5,nullable:()=>v6,null:()=>H6,never:()=>K6,nativeEnum:()=>w6,nan:()=>G6,map:()=>B6,makeIssue:()=>uX,literal:()=>C6,lazy:()=>j6,late:()=>X6,isValid:()=>lJ,isDirty:()=>K9,isAsync:()=>dQ,isAborted:()=>q9,intersection:()=>D6,instanceof:()=>Y6,getParsedType:()=>MJ,getErrorMap:()=>lQ,function:()=>S6,enum:()=>I6,effect:()=>_6,discriminatedUnion:()=>L6,defaultErrorMap:()=>DJ,datetimeRegex:()=>q5,date:()=>O6,custom:()=>E5,coerce:()=>u6,boolean:()=>N5,bigint:()=>W6,array:()=>z6,any:()=>V6,addIssueToContext:()=>c,ZodVoid:()=>gX,ZodUnknown:()=>dJ,ZodUnion:()=>aQ,ZodUndefined:()=>iQ,ZodType:()=>E$,ZodTuple:()=>HJ,ZodTransformer:()=>s0,ZodSymbol:()=>mX,ZodString:()=>i0,ZodSet:()=>EQ,ZodSchema:()=>E$,ZodRecord:()=>lX,ZodReadonly:()=>QX,ZodPromise:()=>zQ,ZodPipeline:()=>cX,ZodParsedType:()=>m,ZodOptional:()=>a0,ZodObject:()=>m$,ZodNumber:()=>pJ,ZodNullable:()=>ZJ,ZodNull:()=>oQ,ZodNever:()=>UJ,ZodNativeEnum:()=>eQ,ZodNaN:()=>pX,ZodMap:()=>dX,ZodLiteral:()=>tQ,ZodLazy:()=>sQ,ZodIssueCode:()=>h,ZodIntersection:()=>rQ,ZodFunction:()=>cQ,ZodFirstPartyTypeKind:()=>X$,ZodError:()=>B0,ZodEnum:()=>nJ,ZodEffects:()=>s0,ZodDiscriminatedUnion:()=>E9,ZodDefault:()=>$X,ZodDate:()=>qQ,ZodCatch:()=>JX,ZodBranded:()=>z9,ZodBoolean:()=>nQ,ZodBigInt:()=>cJ,ZodArray:()=>o0,ZodAny:()=>KQ,Schema:()=>E$,ParseStatus:()=>W0,OK:()=>z0,NEVER:()=>m6,INVALID:()=>J$,EMPTY_PATH:()=>kK,DIRTY:()=>VQ,BRAND:()=>Q6});var L$;(function($){$.assertEqual=(Y)=>{};function J(Y){}$.assertIs=J;function X(Y){throw Error()}$.assertNever=X,$.arrayToEnum=(Y)=>{let G={};for(let W of Y)G[W]=W;return G},$.getValidEnumValues=(Y)=>{let G=$.objectKeys(Y).filter((O)=>typeof Y[Y[O]]!=="number"),W={};for(let O of G)W[O]=Y[O];return $.objectValues(W)},$.objectValues=(Y)=>{return $.objectKeys(Y).map(function(G){return Y[G]})},$.objectKeys=typeof Object.keys==="function"?(Y)=>Object.keys(Y):(Y)=>{let G=[];for(let W in Y)if(Object.prototype.hasOwnProperty.call(Y,W))G.push(W);return G},$.find=(Y,G)=>{for(let W of Y)if(G(W))return W;return},$.isInteger=typeof Number.isInteger==="function"?(Y)=>Number.isInteger(Y):(Y)=>typeof Y==="number"&&Number.isFinite(Y)&&Math.floor(Y)===Y;function Q(Y,G=" | "){return Y.map((W)=>typeof W==="string"?`'${W}'`:W).join(G)}$.joinValues=Q,$.jsonStringifyReplacer=(Y,G)=>{if(typeof G==="bigint")return G.toString();return G}})(L$||(L$={}));var wG;(function($){$.mergeShapes=(J,X)=>{return{...J,...X}}})(wG||(wG={}));var m=L$.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),MJ=($)=>{switch(typeof $){case"undefined":return m.undefined;case"string":return m.string;case"number":return Number.isNaN($)?m.nan:m.number;case"boolean":return m.boolean;case"function":return m.function;case"bigint":return m.bigint;case"symbol":return m.symbol;case"object":if(Array.isArray($))return m.array;if($===null)return m.null;if($.then&&typeof $.then==="function"&&$.catch&&typeof $.catch==="function")return m.promise;if(typeof Map<"u"&&$ instanceof Map)return m.map;if(typeof Set<"u"&&$ instanceof Set)return m.set;if(typeof Date<"u"&&$ instanceof Date)return m.date;return m.object;default:return m.unknown}};var h=L$.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]),_K=($)=>{return JSON.stringify($,null,2).replace(/"([^"]+)":/g,"$1:")};class B0 extends Error{get errors(){return this.issues}constructor($){super();this.issues=[],this.addIssue=(X)=>{this.issues=[...this.issues,X]},this.addIssues=(X=[])=>{this.issues=[...this.issues,...X]};let J=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,J);else this.__proto__=J;this.name="ZodError",this.issues=$}format($){let J=$||function(Y){return Y.message},X={_errors:[]},Q=(Y)=>{for(let G of Y.issues)if(G.code==="invalid_union")G.unionErrors.map(Q);else if(G.code==="invalid_return_type")Q(G.returnTypeError);else if(G.code==="invalid_arguments")Q(G.argumentsError);else if(G.path.length===0)X._errors.push(J(G));else{let W=X,O=0;while(O<G.path.length){let M=G.path[O];if(O!==G.path.length-1)W[M]=W[M]||{_errors:[]};else W[M]=W[M]||{_errors:[]},W[M]._errors.push(J(G));W=W[M],O++}}};return Q(this),X}static assert($){if(!($ instanceof B0))throw Error(`Not a ZodError: ${$}`)}toString(){return this.message}get message(){return JSON.stringify(this.issues,L$.jsonStringifyReplacer,2)}get isEmpty(){return this.issues.length===0}flatten($=(J)=>J.message){let J={},X=[];for(let Q of this.issues)if(Q.path.length>0){let Y=Q.path[0];J[Y]=J[Y]||[],J[Y].push($(Q))}else X.push($(Q));return{formErrors:X,fieldErrors:J}}get formErrors(){return this.flatten()}}B0.create=($)=>{return new B0($)};var xK=($,J)=>{let X;switch($.code){case h.invalid_type:if($.received===m.undefined)X="Required";else X=`Expected ${$.expected}, received ${$.received}`;break;case h.invalid_literal:X=`Invalid literal value, expected ${JSON.stringify($.expected,L$.jsonStringifyReplacer)}`;break;case h.unrecognized_keys:X=`Unrecognized key(s) in object: ${L$.joinValues($.keys,", ")}`;break;case h.invalid_union:X="Invalid input";break;case h.invalid_union_discriminator:X=`Invalid discriminator value. Expected ${L$.joinValues($.options)}`;break;case h.invalid_enum_value:X=`Invalid enum value. Expected ${L$.joinValues($.options)}, received '${$.received}'`;break;case h.invalid_arguments:X="Invalid function arguments";break;case h.invalid_return_type:X="Invalid function return type";break;case h.invalid_date:X="Invalid date";break;case h.invalid_string:if(typeof $.validation==="object")if("includes"in $.validation){if(X=`Invalid input: must include "${$.validation.includes}"`,typeof $.validation.position==="number")X=`${X} at one or more positions greater than or equal to ${$.validation.position}`}else if("startsWith"in $.validation)X=`Invalid input: must start with "${$.validation.startsWith}"`;else if("endsWith"in $.validation)X=`Invalid input: must end with "${$.validation.endsWith}"`;else L$.assertNever($.validation);else if($.validation!=="regex")X=`Invalid ${$.validation}`;else X="Invalid";break;case h.too_small:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at least":"more than"} ${$.minimum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at least":"over"} ${$.minimum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="bigint")X=`Number must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${$.minimum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly equal to ":$.inclusive?"greater than or equal to ":"greater than "}${new Date(Number($.minimum))}`;else X="Invalid input";break;case h.too_big:if($.type==="array")X=`Array must contain ${$.exact?"exactly":$.inclusive?"at most":"less than"} ${$.maximum} element(s)`;else if($.type==="string")X=`String must contain ${$.exact?"exactly":$.inclusive?"at most":"under"} ${$.maximum} character(s)`;else if($.type==="number")X=`Number must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="bigint")X=`BigInt must be ${$.exact?"exactly":$.inclusive?"less than or equal to":"less than"} ${$.maximum}`;else if($.type==="date")X=`Date must be ${$.exact?"exactly":$.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number($.maximum))}`;else X="Invalid input";break;case h.custom:X="Invalid input";break;case h.invalid_intersection_types:X="Intersection results could not be merged";break;case h.not_multiple_of:X=`Number must be a multiple of ${$.multipleOf}`;break;case h.not_finite:X="Number must be finite";break;default:X=J.defaultError,L$.assertNever($)}return{message:X}},DJ=xK;var O5=DJ;function vK($){O5=$}function lQ(){return O5}var uX=($)=>{let{data:J,path:X,errorMaps:Q,issueData:Y}=$,G=[...X,...Y.path||[]],W={...Y,path:G};if(Y.message!==void 0)return{...Y,path:G,message:Y.message};let O="",M=Q.filter((U)=>!!U).slice().reverse();for(let U of M)O=U(W,{data:J,defaultError:O}).message;return{...Y,path:G,message:O}},kK=[];function c($,J){let X=lQ(),Q=uX({issueData:J,data:$.data,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,X,X===DJ?void 0:DJ].filter((Y)=>!!Y)});$.common.issues.push(Q)}class W0{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray($,J){let X=[];for(let Q of J){if(Q.status==="aborted")return J$;if(Q.status==="dirty")$.dirty();X.push(Q.value)}return{status:$.value,value:X}}static async mergeObjectAsync($,J){let X=[];for(let Q of J){let Y=await Q.key,G=await Q.value;X.push({key:Y,value:G})}return W0.mergeObjectSync($,X)}static mergeObjectSync($,J){let X={};for(let Q of J){let{key:Y,value:G}=Q;if(Y.status==="aborted")return J$;if(G.status==="aborted")return J$;if(Y.status==="dirty")$.dirty();if(G.status==="dirty")$.dirty();if(Y.value!=="__proto__"&&(typeof G.value<"u"||Q.alwaysSet))X[Y.value]=G.value}return{status:$.value,value:X}}}var J$=Object.freeze({status:"aborted"}),VQ=($)=>({status:"dirty",value:$}),z0=($)=>({status:"valid",value:$}),q9=($)=>$.status==="aborted",K9=($)=>$.status==="dirty",lJ=($)=>$.status==="valid",dQ=($)=>typeof Promise<"u"&&$ instanceof Promise;var a;(function($){$.errToObj=(J)=>typeof J==="string"?{message:J}:J||{},$.toString=(J)=>typeof J==="string"?J:J?.message})(a||(a={}));class r0{constructor($,J,X,Q){this._cachedPath=[],this.parent=$,this.data=J,this._path=X,this._key=Q}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var M5=($,J)=>{if(lJ(J))return{success:!0,data:J.value};else{if(!$.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let X=new B0($.common.issues);return this._error=X,this._error}}}};function V$($){if(!$)return{};let{errorMap:J,invalid_type_error:X,required_error:Q,description:Y}=$;if(J&&(X||Q))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if(J)return{errorMap:J,description:Y};return{errorMap:(W,O)=>{let{message:M}=$;if(W.code==="invalid_enum_value")return{message:M??O.defaultError};if(typeof O.data>"u")return{message:M??Q??O.defaultError};if(W.code!=="invalid_type")return{message:O.defaultError};return{message:M??X??O.defaultError}},description:Y}}class E${get description(){return this._def.description}_getType($){return MJ($.data)}_getOrReturnCtx($,J){return J||{common:$.parent.common,data:$.data,parsedType:MJ($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}_processInputParams($){return{status:new W0,ctx:{common:$.parent.common,data:$.data,parsedType:MJ($.data),schemaErrorMap:this._def.errorMap,path:$.path,parent:$.parent}}}_parseSync($){let J=this._parse($);if(dQ(J))throw Error("Synchronous parse encountered promise.");return J}_parseAsync($){let J=this._parse($);return Promise.resolve(J)}parse($,J){let X=this.safeParse($,J);if(X.success)return X.data;throw X.error}safeParse($,J){let X={common:{issues:[],async:J?.async??!1,contextualErrorMap:J?.errorMap},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:MJ($)},Q=this._parseSync({data:$,path:X.path,parent:X});return M5(X,Q)}"~validate"($){let J={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:MJ($)};if(!this["~standard"].async)try{let X=this._parseSync({data:$,path:[],parent:J});return lJ(X)?{value:X.value}:{issues:J.common.issues}}catch(X){if(X?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;J.common={issues:[],async:!0}}return this._parseAsync({data:$,path:[],parent:J}).then((X)=>lJ(X)?{value:X.value}:{issues:J.common.issues})}async parseAsync($,J){let X=await this.safeParseAsync($,J);if(X.success)return X.data;throw X.error}async safeParseAsync($,J){let X={common:{issues:[],contextualErrorMap:J?.errorMap,async:!0},path:J?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:$,parsedType:MJ($)},Q=this._parse({data:$,path:X.path,parent:X}),Y=await(dQ(Q)?Q:Promise.resolve(Q));return M5(X,Y)}refine($,J){let X=(Q)=>{if(typeof J==="string"||typeof J>"u")return{message:J};else if(typeof J==="function")return J(Q);else return J};return this._refinement((Q,Y)=>{let G=$(Q),W=()=>Y.addIssue({code:h.custom,...X(Q)});if(typeof Promise<"u"&&G instanceof Promise)return G.then((O)=>{if(!O)return W(),!1;else return!0});if(!G)return W(),!1;else return!0})}refinement($,J){return this._refinement((X,Q)=>{if(!$(X))return Q.addIssue(typeof J==="function"?J(X,Q):J),!1;else return!0})}_refinement($){return new s0({schema:this,typeName:X$.ZodEffects,effect:{type:"refinement",refinement:$}})}superRefine($){return this._refinement($)}constructor($){this.spa=this.safeParseAsync,this._def=$,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:(J)=>this["~validate"](J)}}optional(){return a0.create(this,this._def)}nullable(){return ZJ.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return o0.create(this)}promise(){return zQ.create(this,this._def)}or($){return aQ.create([this,$],this._def)}and($){return rQ.create(this,$,this._def)}transform($){return new s0({...V$(this._def),schema:this,typeName:X$.ZodEffects,effect:{type:"transform",transform:$}})}default($){let J=typeof $==="function"?$:()=>$;return new $X({...V$(this._def),innerType:this,defaultValue:J,typeName:X$.ZodDefault})}brand(){return new z9({typeName:X$.ZodBranded,type:this,...V$(this._def)})}catch($){let J=typeof $==="function"?$:()=>$;return new JX({...V$(this._def),innerType:this,catchValue:J,typeName:X$.ZodCatch})}describe($){return new this.constructor({...this._def,description:$})}pipe($){return cX.create(this,$)}readonly(){return QX.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var fK=/^c[^\s-]{8,}$/i,yK=/^[0-9a-z]+$/,hK=/^[0-9A-HJKMNP-TV-Z]{26}$/i,bK=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,uK=/^[a-z0-9_-]{21}$/i,mK=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,gK=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,lK=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,dK="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",PG,pK=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,cK=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,nK=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,iK=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,oK=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,aK=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,H5="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",rK=new RegExp(`^${H5}$`);function V5($){let J="[0-5]\\d";if($.precision)J=`${J}\\.\\d{${$.precision}}`;else if($.precision==null)J=`${J}(\\.\\d+)?`;let X=$.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${J})${X}`}function sK($){return new RegExp(`^${V5($)}$`)}function q5($){let J=`${H5}T${V5($)}`,X=[];if(X.push($.local?"Z?":"Z"),$.offset)X.push("([+-]\\d{2}:?\\d{2})");return J=`${J}(${X.join("|")})`,new RegExp(`^${J}$`)}function tK($,J){if((J==="v4"||!J)&&pK.test($))return!0;if((J==="v6"||!J)&&nK.test($))return!0;return!1}function eK($,J){if(!mK.test($))return!1;try{let[X]=$.split(".");if(!X)return!1;let Q=X.replace(/-/g,"+").replace(/_/g,"/").padEnd(X.length+(4-X.length%4)%4,"="),Y=JSON.parse(atob(Q));if(typeof Y!=="object"||Y===null)return!1;if("typ"in Y&&Y?.typ!=="JWT")return!1;if(!Y.alg)return!1;if(J&&Y.alg!==J)return!1;return!0}catch{return!1}}function $6($,J){if((J==="v4"||!J)&&cK.test($))return!0;if((J==="v6"||!J)&&iK.test($))return!0;return!1}class i0 extends E${_parse($){if(this._def.coerce)$.data=String($.data);if(this._getType($)!==m.string){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.string,received:Y.parsedType}),J$}let X=new W0,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.length<Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="max"){if($.data.length>Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!1,message:Y.message}),X.dirty()}else if(Y.kind==="length"){let G=$.data.length>Y.value,W=$.data.length<Y.value;if(G||W){if(Q=this._getOrReturnCtx($,Q),G)c(Q,{code:h.too_big,maximum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});else if(W)c(Q,{code:h.too_small,minimum:Y.value,type:"string",inclusive:!0,exact:!0,message:Y.message});X.dirty()}}else if(Y.kind==="email"){if(!lK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"email",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="emoji"){if(!PG)PG=new RegExp(dK,"u");if(!PG.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"emoji",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="uuid"){if(!bK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"uuid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="nanoid"){if(!uK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"nanoid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid"){if(!fK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cuid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cuid2"){if(!yK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cuid2",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ulid"){if(!hK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"ulid",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="url")try{new URL($.data)}catch{Q=this._getOrReturnCtx($,Q),c(Q,{validation:"url",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="regex"){if(Y.regex.lastIndex=0,!Y.regex.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"regex",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="trim")$.data=$.data.trim();else if(Y.kind==="includes"){if(!$.data.includes(Y.value,Y.position))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{includes:Y.value,position:Y.position},message:Y.message}),X.dirty()}else if(Y.kind==="toLowerCase")$.data=$.data.toLowerCase();else if(Y.kind==="toUpperCase")$.data=$.data.toUpperCase();else if(Y.kind==="startsWith"){if(!$.data.startsWith(Y.value))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{startsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="endsWith"){if(!$.data.endsWith(Y.value))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:{endsWith:Y.value},message:Y.message}),X.dirty()}else if(Y.kind==="datetime"){if(!q5(Y).test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"datetime",message:Y.message}),X.dirty()}else if(Y.kind==="date"){if(!rK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"date",message:Y.message}),X.dirty()}else if(Y.kind==="time"){if(!sK(Y).test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{code:h.invalid_string,validation:"time",message:Y.message}),X.dirty()}else if(Y.kind==="duration"){if(!gK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"duration",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="ip"){if(!tK($.data,Y.version))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"ip",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="jwt"){if(!eK($.data,Y.alg))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"jwt",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="cidr"){if(!$6($.data,Y.version))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"cidr",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64"){if(!oK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"base64",code:h.invalid_string,message:Y.message}),X.dirty()}else if(Y.kind==="base64url"){if(!aK.test($.data))Q=this._getOrReturnCtx($,Q),c(Q,{validation:"base64url",code:h.invalid_string,message:Y.message}),X.dirty()}else L$.assertNever(Y);return{status:X.value,value:$.data}}_regex($,J,X){return this.refinement((Q)=>$.test(Q),{validation:J,code:h.invalid_string,...a.errToObj(X)})}_addCheck($){return new i0({...this._def,checks:[...this._def.checks,$]})}email($){return this._addCheck({kind:"email",...a.errToObj($)})}url($){return this._addCheck({kind:"url",...a.errToObj($)})}emoji($){return this._addCheck({kind:"emoji",...a.errToObj($)})}uuid($){return this._addCheck({kind:"uuid",...a.errToObj($)})}nanoid($){return this._addCheck({kind:"nanoid",...a.errToObj($)})}cuid($){return this._addCheck({kind:"cuid",...a.errToObj($)})}cuid2($){return this._addCheck({kind:"cuid2",...a.errToObj($)})}ulid($){return this._addCheck({kind:"ulid",...a.errToObj($)})}base64($){return this._addCheck({kind:"base64",...a.errToObj($)})}base64url($){return this._addCheck({kind:"base64url",...a.errToObj($)})}jwt($){return this._addCheck({kind:"jwt",...a.errToObj($)})}ip($){return this._addCheck({kind:"ip",...a.errToObj($)})}cidr($){return this._addCheck({kind:"cidr",...a.errToObj($)})}datetime($){if(typeof $==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:$});return this._addCheck({kind:"datetime",precision:typeof $?.precision>"u"?null:$?.precision,offset:$?.offset??!1,local:$?.local??!1,...a.errToObj($?.message)})}date($){return this._addCheck({kind:"date",message:$})}time($){if(typeof $==="string")return this._addCheck({kind:"time",precision:null,message:$});return this._addCheck({kind:"time",precision:typeof $?.precision>"u"?null:$?.precision,...a.errToObj($?.message)})}duration($){return this._addCheck({kind:"duration",...a.errToObj($)})}regex($,J){return this._addCheck({kind:"regex",regex:$,...a.errToObj(J)})}includes($,J){return this._addCheck({kind:"includes",value:$,position:J?.position,...a.errToObj(J?.message)})}startsWith($,J){return this._addCheck({kind:"startsWith",value:$,...a.errToObj(J)})}endsWith($,J){return this._addCheck({kind:"endsWith",value:$,...a.errToObj(J)})}min($,J){return this._addCheck({kind:"min",value:$,...a.errToObj(J)})}max($,J){return this._addCheck({kind:"max",value:$,...a.errToObj(J)})}length($,J){return this._addCheck({kind:"length",value:$,...a.errToObj(J)})}nonempty($){return this.min(1,a.errToObj($))}trim(){return new i0({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new i0({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new i0({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find(($)=>$.kind==="datetime")}get isDate(){return!!this._def.checks.find(($)=>$.kind==="date")}get isTime(){return!!this._def.checks.find(($)=>$.kind==="time")}get isDuration(){return!!this._def.checks.find(($)=>$.kind==="duration")}get isEmail(){return!!this._def.checks.find(($)=>$.kind==="email")}get isURL(){return!!this._def.checks.find(($)=>$.kind==="url")}get isEmoji(){return!!this._def.checks.find(($)=>$.kind==="emoji")}get isUUID(){return!!this._def.checks.find(($)=>$.kind==="uuid")}get isNANOID(){return!!this._def.checks.find(($)=>$.kind==="nanoid")}get isCUID(){return!!this._def.checks.find(($)=>$.kind==="cuid")}get isCUID2(){return!!this._def.checks.find(($)=>$.kind==="cuid2")}get isULID(){return!!this._def.checks.find(($)=>$.kind==="ulid")}get isIP(){return!!this._def.checks.find(($)=>$.kind==="ip")}get isCIDR(){return!!this._def.checks.find(($)=>$.kind==="cidr")}get isBase64(){return!!this._def.checks.find(($)=>$.kind==="base64")}get isBase64url(){return!!this._def.checks.find(($)=>$.kind==="base64url")}get minLength(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxLength(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}i0.create=($)=>{return new i0({checks:[],typeName:X$.ZodString,coerce:$?.coerce??!1,...V$($)})};function J6($,J){let X=($.toString().split(".")[1]||"").length,Q=(J.toString().split(".")[1]||"").length,Y=X>Q?X:Q,G=Number.parseInt($.toFixed(Y).replace(".","")),W=Number.parseInt(J.toFixed(Y).replace(".",""));return G%W/10**Y}class pJ extends E${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse($){if(this._def.coerce)$.data=Number($.data);if(this._getType($)!==m.number){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.number,received:Y.parsedType}),J$}let X=void 0,Q=new W0;for(let Y of this._def.checks)if(Y.kind==="int"){if(!L$.isInteger($.data))X=this._getOrReturnCtx($,X),c(X,{code:h.invalid_type,expected:"integer",received:"float",message:Y.message}),Q.dirty()}else if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_small,minimum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_big,maximum:Y.value,type:"number",inclusive:Y.inclusive,exact:!1,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if(J6($.data,Y.value)!==0)X=this._getOrReturnCtx($,X),c(X,{code:h.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else if(Y.kind==="finite"){if(!Number.isFinite($.data))X=this._getOrReturnCtx($,X),c(X,{code:h.not_finite,message:Y.message}),Q.dirty()}else L$.assertNever(Y);return{status:Q.value,value:$.data}}gte($,J){return this.setLimit("min",$,!0,a.toString(J))}gt($,J){return this.setLimit("min",$,!1,a.toString(J))}lte($,J){return this.setLimit("max",$,!0,a.toString(J))}lt($,J){return this.setLimit("max",$,!1,a.toString(J))}setLimit($,J,X,Q){return new pJ({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:a.toString(Q)}]})}_addCheck($){return new pJ({...this._def,checks:[...this._def.checks,$]})}int($){return this._addCheck({kind:"int",message:a.toString($)})}positive($){return this._addCheck({kind:"min",value:0,inclusive:!1,message:a.toString($)})}negative($){return this._addCheck({kind:"max",value:0,inclusive:!1,message:a.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:0,inclusive:!0,message:a.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:0,inclusive:!0,message:a.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:a.toString(J)})}finite($){return this._addCheck({kind:"finite",message:a.toString($)})}safe($){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:a.toString($)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:a.toString($)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}get isInt(){return!!this._def.checks.find(($)=>$.kind==="int"||$.kind==="multipleOf"&&L$.isInteger($.value))}get isFinite(){let $=null,J=null;for(let X of this._def.checks)if(X.kind==="finite"||X.kind==="int"||X.kind==="multipleOf")return!0;else if(X.kind==="min"){if(J===null||X.value>J)J=X.value}else if(X.kind==="max"){if($===null||X.value<$)$=X.value}return Number.isFinite(J)&&Number.isFinite($)}}pJ.create=($)=>{return new pJ({checks:[],typeName:X$.ZodNumber,coerce:$?.coerce||!1,...V$($)})};class cJ extends E${constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse($){if(this._def.coerce)try{$.data=BigInt($.data)}catch{return this._getInvalidInput($)}if(this._getType($)!==m.bigint)return this._getInvalidInput($);let X=void 0,Q=new W0;for(let Y of this._def.checks)if(Y.kind==="min"){if(Y.inclusive?$.data<Y.value:$.data<=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_small,type:"bigint",minimum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="max"){if(Y.inclusive?$.data>Y.value:$.data>=Y.value)X=this._getOrReturnCtx($,X),c(X,{code:h.too_big,type:"bigint",maximum:Y.value,inclusive:Y.inclusive,message:Y.message}),Q.dirty()}else if(Y.kind==="multipleOf"){if($.data%Y.value!==BigInt(0))X=this._getOrReturnCtx($,X),c(X,{code:h.not_multiple_of,multipleOf:Y.value,message:Y.message}),Q.dirty()}else L$.assertNever(Y);return{status:Q.value,value:$.data}}_getInvalidInput($){let J=this._getOrReturnCtx($);return c(J,{code:h.invalid_type,expected:m.bigint,received:J.parsedType}),J$}gte($,J){return this.setLimit("min",$,!0,a.toString(J))}gt($,J){return this.setLimit("min",$,!1,a.toString(J))}lte($,J){return this.setLimit("max",$,!0,a.toString(J))}lt($,J){return this.setLimit("max",$,!1,a.toString(J))}setLimit($,J,X,Q){return new cJ({...this._def,checks:[...this._def.checks,{kind:$,value:J,inclusive:X,message:a.toString(Q)}]})}_addCheck($){return new cJ({...this._def,checks:[...this._def.checks,$]})}positive($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:a.toString($)})}negative($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:a.toString($)})}nonpositive($){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:a.toString($)})}nonnegative($){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:a.toString($)})}multipleOf($,J){return this._addCheck({kind:"multipleOf",value:$,message:a.toString(J)})}get minValue(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $}get maxValue(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $}}cJ.create=($)=>{return new cJ({checks:[],typeName:X$.ZodBigInt,coerce:$?.coerce??!1,...V$($)})};class nQ extends E${_parse($){if(this._def.coerce)$.data=Boolean($.data);if(this._getType($)!==m.boolean){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.boolean,received:X.parsedType}),J$}return z0($.data)}}nQ.create=($)=>{return new nQ({typeName:X$.ZodBoolean,coerce:$?.coerce||!1,...V$($)})};class qQ extends E${_parse($){if(this._def.coerce)$.data=new Date($.data);if(this._getType($)!==m.date){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_type,expected:m.date,received:Y.parsedType}),J$}if(Number.isNaN($.data.getTime())){let Y=this._getOrReturnCtx($);return c(Y,{code:h.invalid_date}),J$}let X=new W0,Q=void 0;for(let Y of this._def.checks)if(Y.kind==="min"){if($.data.getTime()<Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_small,message:Y.message,inclusive:!0,exact:!1,minimum:Y.value,type:"date"}),X.dirty()}else if(Y.kind==="max"){if($.data.getTime()>Y.value)Q=this._getOrReturnCtx($,Q),c(Q,{code:h.too_big,message:Y.message,inclusive:!0,exact:!1,maximum:Y.value,type:"date"}),X.dirty()}else L$.assertNever(Y);return{status:X.value,value:new Date($.data.getTime())}}_addCheck($){return new qQ({...this._def,checks:[...this._def.checks,$]})}min($,J){return this._addCheck({kind:"min",value:$.getTime(),message:a.toString(J)})}max($,J){return this._addCheck({kind:"max",value:$.getTime(),message:a.toString(J)})}get minDate(){let $=null;for(let J of this._def.checks)if(J.kind==="min"){if($===null||J.value>$)$=J.value}return $!=null?new Date($):null}get maxDate(){let $=null;for(let J of this._def.checks)if(J.kind==="max"){if($===null||J.value<$)$=J.value}return $!=null?new Date($):null}}qQ.create=($)=>{return new qQ({checks:[],coerce:$?.coerce||!1,typeName:X$.ZodDate,...V$($)})};class mX extends E${_parse($){if(this._getType($)!==m.symbol){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.symbol,received:X.parsedType}),J$}return z0($.data)}}mX.create=($)=>{return new mX({typeName:X$.ZodSymbol,...V$($)})};class iQ extends E${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.undefined,received:X.parsedType}),J$}return z0($.data)}}iQ.create=($)=>{return new iQ({typeName:X$.ZodUndefined,...V$($)})};class oQ extends E${_parse($){if(this._getType($)!==m.null){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.null,received:X.parsedType}),J$}return z0($.data)}}oQ.create=($)=>{return new oQ({typeName:X$.ZodNull,...V$($)})};class KQ extends E${constructor(){super(...arguments);this._any=!0}_parse($){return z0($.data)}}KQ.create=($)=>{return new KQ({typeName:X$.ZodAny,...V$($)})};class dJ extends E${constructor(){super(...arguments);this._unknown=!0}_parse($){return z0($.data)}}dJ.create=($)=>{return new dJ({typeName:X$.ZodUnknown,...V$($)})};class UJ extends E${_parse($){let J=this._getOrReturnCtx($);return c(J,{code:h.invalid_type,expected:m.never,received:J.parsedType}),J$}}UJ.create=($)=>{return new UJ({typeName:X$.ZodNever,...V$($)})};class gX extends E${_parse($){if(this._getType($)!==m.undefined){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.void,received:X.parsedType}),J$}return z0($.data)}}gX.create=($)=>{return new gX({typeName:X$.ZodVoid,...V$($)})};class o0 extends E${_parse($){let{ctx:J,status:X}=this._processInputParams($),Q=this._def;if(J.parsedType!==m.array)return c(J,{code:h.invalid_type,expected:m.array,received:J.parsedType}),J$;if(Q.exactLength!==null){let G=J.data.length>Q.exactLength.value,W=J.data.length<Q.exactLength.value;if(G||W)c(J,{code:G?h.too_big:h.too_small,minimum:W?Q.exactLength.value:void 0,maximum:G?Q.exactLength.value:void 0,type:"array",inclusive:!0,exact:!0,message:Q.exactLength.message}),X.dirty()}if(Q.minLength!==null){if(J.data.length<Q.minLength.value)c(J,{code:h.too_small,minimum:Q.minLength.value,type:"array",inclusive:!0,exact:!1,message:Q.minLength.message}),X.dirty()}if(Q.maxLength!==null){if(J.data.length>Q.maxLength.value)c(J,{code:h.too_big,maximum:Q.maxLength.value,type:"array",inclusive:!0,exact:!1,message:Q.maxLength.message}),X.dirty()}if(J.common.async)return Promise.all([...J.data].map((G,W)=>{return Q.type._parseAsync(new r0(J,G,J.path,W))})).then((G)=>{return W0.mergeArray(X,G)});let Y=[...J.data].map((G,W)=>{return Q.type._parseSync(new r0(J,G,J.path,W))});return W0.mergeArray(X,Y)}get element(){return this._def.type}min($,J){return new o0({...this._def,minLength:{value:$,message:a.toString(J)}})}max($,J){return new o0({...this._def,maxLength:{value:$,message:a.toString(J)}})}length($,J){return new o0({...this._def,exactLength:{value:$,message:a.toString(J)}})}nonempty($){return this.min(1,$)}}o0.create=($,J)=>{return new o0({type:$,minLength:null,maxLength:null,exactLength:null,typeName:X$.ZodArray,...V$(J)})};function pQ($){if($ instanceof m$){let J={};for(let X in $.shape){let Q=$.shape[X];J[X]=a0.create(pQ(Q))}return new m$({...$._def,shape:()=>J})}else if($ instanceof o0)return new o0({...$._def,type:pQ($.element)});else if($ instanceof a0)return a0.create(pQ($.unwrap()));else if($ instanceof ZJ)return ZJ.create(pQ($.unwrap()));else if($ instanceof HJ)return HJ.create($.items.map((J)=>pQ(J)));else return $}class m$ extends E${constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let $=this._def.shape(),J=L$.objectKeys($);return this._cached={shape:$,keys:J},this._cached}_parse($){if(this._getType($)!==m.object){let M=this._getOrReturnCtx($);return c(M,{code:h.invalid_type,expected:m.object,received:M.parsedType}),J$}let{status:X,ctx:Q}=this._processInputParams($),{shape:Y,keys:G}=this._getCached(),W=[];if(!(this._def.catchall instanceof UJ&&this._def.unknownKeys==="strip")){for(let M in Q.data)if(!G.includes(M))W.push(M)}let O=[];for(let M of G){let U=Y[M],H=Q.data[M];O.push({key:{status:"valid",value:M},value:U._parse(new r0(Q,H,Q.path,M)),alwaysSet:M in Q.data})}if(this._def.catchall instanceof UJ){let M=this._def.unknownKeys;if(M==="passthrough")for(let U of W)O.push({key:{status:"valid",value:U},value:{status:"valid",value:Q.data[U]}});else if(M==="strict"){if(W.length>0)c(Q,{code:h.unrecognized_keys,keys:W}),X.dirty()}else if(M==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let M=this._def.catchall;for(let U of W){let H=Q.data[U];O.push({key:{status:"valid",value:U},value:M._parse(new r0(Q,H,Q.path,U)),alwaysSet:U in Q.data})}}if(Q.common.async)return Promise.resolve().then(async()=>{let M=[];for(let U of O){let H=await U.key,V=await U.value;M.push({key:H,value:V,alwaysSet:U.alwaysSet})}return M}).then((M)=>{return W0.mergeObjectSync(X,M)});else return W0.mergeObjectSync(X,O)}get shape(){return this._def.shape()}strict($){return a.errToObj,new m$({...this._def,unknownKeys:"strict",...$!==void 0?{errorMap:(J,X)=>{let Q=this._def.errorMap?.(J,X).message??X.defaultError;if(J.code==="unrecognized_keys")return{message:a.errToObj($).message??Q};return{message:Q}}}:{}})}strip(){return new m$({...this._def,unknownKeys:"strip"})}passthrough(){return new m$({...this._def,unknownKeys:"passthrough"})}extend($){return new m$({...this._def,shape:()=>({...this._def.shape(),...$})})}merge($){return new m$({unknownKeys:$._def.unknownKeys,catchall:$._def.catchall,shape:()=>({...this._def.shape(),...$._def.shape()}),typeName:X$.ZodObject})}setKey($,J){return this.augment({[$]:J})}catchall($){return new m$({...this._def,catchall:$})}pick($){let J={};for(let X of L$.objectKeys($))if($[X]&&this.shape[X])J[X]=this.shape[X];return new m$({...this._def,shape:()=>J})}omit($){let J={};for(let X of L$.objectKeys(this.shape))if(!$[X])J[X]=this.shape[X];return new m$({...this._def,shape:()=>J})}deepPartial(){return pQ(this)}partial($){let J={};for(let X of L$.objectKeys(this.shape)){let Q=this.shape[X];if($&&!$[X])J[X]=Q;else J[X]=Q.optional()}return new m$({...this._def,shape:()=>J})}required($){let J={};for(let X of L$.objectKeys(this.shape))if($&&!$[X])J[X]=this.shape[X];else{let Y=this.shape[X];while(Y instanceof a0)Y=Y._def.innerType;J[X]=Y}return new m$({...this._def,shape:()=>J})}keyof(){return K5(L$.objectKeys(this.shape))}}m$.create=($,J)=>{return new m$({shape:()=>$,unknownKeys:"strip",catchall:UJ.create(),typeName:X$.ZodObject,...V$(J)})};m$.strictCreate=($,J)=>{return new m$({shape:()=>$,unknownKeys:"strict",catchall:UJ.create(),typeName:X$.ZodObject,...V$(J)})};m$.lazycreate=($,J)=>{return new m$({shape:$,unknownKeys:"strip",catchall:UJ.create(),typeName:X$.ZodObject,...V$(J)})};class aQ extends E${_parse($){let{ctx:J}=this._processInputParams($),X=this._def.options;function Q(Y){for(let W of Y)if(W.result.status==="valid")return W.result;for(let W of Y)if(W.result.status==="dirty")return J.common.issues.push(...W.ctx.common.issues),W.result;let G=Y.map((W)=>new B0(W.ctx.common.issues));return c(J,{code:h.invalid_union,unionErrors:G}),J$}if(J.common.async)return Promise.all(X.map(async(Y)=>{let G={...J,common:{...J.common,issues:[]},parent:null};return{result:await Y._parseAsync({data:J.data,path:J.path,parent:G}),ctx:G}})).then(Q);else{let Y=void 0,G=[];for(let O of X){let M={...J,common:{...J.common,issues:[]},parent:null},U=O._parseSync({data:J.data,path:J.path,parent:M});if(U.status==="valid")return U;else if(U.status==="dirty"&&!Y)Y={result:U,ctx:M};if(M.common.issues.length)G.push(M.common.issues)}if(Y)return J.common.issues.push(...Y.ctx.common.issues),Y.result;let W=G.map((O)=>new B0(O));return c(J,{code:h.invalid_union,unionErrors:W}),J$}}get options(){return this._def.options}}aQ.create=($,J)=>{return new aQ({options:$,typeName:X$.ZodUnion,...V$(J)})};var RJ=($)=>{if($ instanceof sQ)return RJ($.schema);else if($ instanceof s0)return RJ($.innerType());else if($ instanceof tQ)return[$.value];else if($ instanceof nJ)return $.options;else if($ instanceof eQ)return L$.objectValues($.enum);else if($ instanceof $X)return RJ($._def.innerType);else if($ instanceof iQ)return[void 0];else if($ instanceof oQ)return[null];else if($ instanceof a0)return[void 0,...RJ($.unwrap())];else if($ instanceof ZJ)return[null,...RJ($.unwrap())];else if($ instanceof z9)return RJ($.unwrap());else if($ instanceof QX)return RJ($.unwrap());else if($ instanceof JX)return RJ($._def.innerType);else return[]};class E9 extends E${_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.object)return c(J,{code:h.invalid_type,expected:m.object,received:J.parsedType}),J$;let X=this.discriminator,Q=J.data[X],Y=this.optionsMap.get(Q);if(!Y)return c(J,{code:h.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[X]}),J$;if(J.common.async)return Y._parseAsync({data:J.data,path:J.path,parent:J});else return Y._parseSync({data:J.data,path:J.path,parent:J})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create($,J,X){let Q=new Map;for(let Y of J){let G=RJ(Y.shape[$]);if(!G.length)throw Error(`A discriminator value for key \`${$}\` could not be extracted from all schema options`);for(let W of G){if(Q.has(W))throw Error(`Discriminator property ${String($)} has duplicate value ${String(W)}`);Q.set(W,Y)}}return new E9({typeName:X$.ZodDiscriminatedUnion,discriminator:$,options:J,optionsMap:Q,...V$(X)})}}function _G($,J){let X=MJ($),Q=MJ(J);if($===J)return{valid:!0,data:$};else if(X===m.object&&Q===m.object){let Y=L$.objectKeys(J),G=L$.objectKeys($).filter((O)=>Y.indexOf(O)!==-1),W={...$,...J};for(let O of G){let M=_G($[O],J[O]);if(!M.valid)return{valid:!1};W[O]=M.data}return{valid:!0,data:W}}else if(X===m.array&&Q===m.array){if($.length!==J.length)return{valid:!1};let Y=[];for(let G=0;G<$.length;G++){let W=$[G],O=J[G],M=_G(W,O);if(!M.valid)return{valid:!1};Y.push(M.data)}return{valid:!0,data:Y}}else if(X===m.date&&Q===m.date&&+$===+J)return{valid:!0,data:$};else return{valid:!1}}class rQ extends E${_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=(Y,G)=>{if(q9(Y)||q9(G))return J$;let W=_G(Y.value,G.value);if(!W.valid)return c(X,{code:h.invalid_intersection_types}),J$;if(K9(Y)||K9(G))J.dirty();return{status:J.value,value:W.data}};if(X.common.async)return Promise.all([this._def.left._parseAsync({data:X.data,path:X.path,parent:X}),this._def.right._parseAsync({data:X.data,path:X.path,parent:X})]).then(([Y,G])=>Q(Y,G));else return Q(this._def.left._parseSync({data:X.data,path:X.path,parent:X}),this._def.right._parseSync({data:X.data,path:X.path,parent:X}))}}rQ.create=($,J,X)=>{return new rQ({left:$,right:J,typeName:X$.ZodIntersection,...V$(X)})};class HJ extends E${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.array)return c(X,{code:h.invalid_type,expected:m.array,received:X.parsedType}),J$;if(X.data.length<this._def.items.length)return c(X,{code:h.too_small,minimum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),J$;if(!this._def.rest&&X.data.length>this._def.items.length)c(X,{code:h.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),J.dirty();let Y=[...X.data].map((G,W)=>{let O=this._def.items[W]||this._def.rest;if(!O)return null;return O._parse(new r0(X,G,X.path,W))}).filter((G)=>!!G);if(X.common.async)return Promise.all(Y).then((G)=>{return W0.mergeArray(J,G)});else return W0.mergeArray(J,Y)}get items(){return this._def.items}rest($){return new HJ({...this._def,rest:$})}}HJ.create=($,J)=>{if(!Array.isArray($))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new HJ({items:$,typeName:X$.ZodTuple,rest:null,...V$(J)})};class lX extends E${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.object)return c(X,{code:h.invalid_type,expected:m.object,received:X.parsedType}),J$;let Q=[],Y=this._def.keyType,G=this._def.valueType;for(let W in X.data)Q.push({key:Y._parse(new r0(X,W,X.path,W)),value:G._parse(new r0(X,X.data[W],X.path,W)),alwaysSet:W in X.data});if(X.common.async)return W0.mergeObjectAsync(J,Q);else return W0.mergeObjectSync(J,Q)}get element(){return this._def.valueType}static create($,J,X){if(J instanceof E$)return new lX({keyType:$,valueType:J,typeName:X$.ZodRecord,...V$(X)});return new lX({keyType:i0.create(),valueType:$,typeName:X$.ZodRecord,...V$(J)})}}class dX extends E${get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.map)return c(X,{code:h.invalid_type,expected:m.map,received:X.parsedType}),J$;let Q=this._def.keyType,Y=this._def.valueType,G=[...X.data.entries()].map(([W,O],M)=>{return{key:Q._parse(new r0(X,W,X.path,[M,"key"])),value:Y._parse(new r0(X,O,X.path,[M,"value"]))}});if(X.common.async){let W=new Map;return Promise.resolve().then(async()=>{for(let O of G){let M=await O.key,U=await O.value;if(M.status==="aborted"||U.status==="aborted")return J$;if(M.status==="dirty"||U.status==="dirty")J.dirty();W.set(M.value,U.value)}return{status:J.value,value:W}})}else{let W=new Map;for(let O of G){let{key:M,value:U}=O;if(M.status==="aborted"||U.status==="aborted")return J$;if(M.status==="dirty"||U.status==="dirty")J.dirty();W.set(M.value,U.value)}return{status:J.value,value:W}}}}dX.create=($,J,X)=>{return new dX({valueType:J,keyType:$,typeName:X$.ZodMap,...V$(X)})};class EQ extends E${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.parsedType!==m.set)return c(X,{code:h.invalid_type,expected:m.set,received:X.parsedType}),J$;let Q=this._def;if(Q.minSize!==null){if(X.data.size<Q.minSize.value)c(X,{code:h.too_small,minimum:Q.minSize.value,type:"set",inclusive:!0,exact:!1,message:Q.minSize.message}),J.dirty()}if(Q.maxSize!==null){if(X.data.size>Q.maxSize.value)c(X,{code:h.too_big,maximum:Q.maxSize.value,type:"set",inclusive:!0,exact:!1,message:Q.maxSize.message}),J.dirty()}let Y=this._def.valueType;function G(O){let M=new Set;for(let U of O){if(U.status==="aborted")return J$;if(U.status==="dirty")J.dirty();M.add(U.value)}return{status:J.value,value:M}}let W=[...X.data.values()].map((O,M)=>Y._parse(new r0(X,O,X.path,M)));if(X.common.async)return Promise.all(W).then((O)=>G(O));else return G(W)}min($,J){return new EQ({...this._def,minSize:{value:$,message:a.toString(J)}})}max($,J){return new EQ({...this._def,maxSize:{value:$,message:a.toString(J)}})}size($,J){return this.min($,J).max($,J)}nonempty($){return this.min(1,$)}}EQ.create=($,J)=>{return new EQ({valueType:$,minSize:null,maxSize:null,typeName:X$.ZodSet,...V$(J)})};class cQ extends E${constructor(){super(...arguments);this.validate=this.implement}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.function)return c(J,{code:h.invalid_type,expected:m.function,received:J.parsedType}),J$;function X(W,O){return uX({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,lQ(),DJ].filter((M)=>!!M),issueData:{code:h.invalid_arguments,argumentsError:O}})}function Q(W,O){return uX({data:W,path:J.path,errorMaps:[J.common.contextualErrorMap,J.schemaErrorMap,lQ(),DJ].filter((M)=>!!M),issueData:{code:h.invalid_return_type,returnTypeError:O}})}let Y={errorMap:J.common.contextualErrorMap},G=J.data;if(this._def.returns instanceof zQ){let W=this;return z0(async function(...O){let M=new B0([]),U=await W._def.args.parseAsync(O,Y).catch((q)=>{throw M.addIssue(X(O,q)),M}),H=await Reflect.apply(G,this,U);return await W._def.returns._def.type.parseAsync(H,Y).catch((q)=>{throw M.addIssue(Q(H,q)),M})})}else{let W=this;return z0(function(...O){let M=W._def.args.safeParse(O,Y);if(!M.success)throw new B0([X(O,M.error)]);let U=Reflect.apply(G,this,M.data),H=W._def.returns.safeParse(U,Y);if(!H.success)throw new B0([Q(U,H.error)]);return H.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(...$){return new cQ({...this._def,args:HJ.create($).rest(dJ.create())})}returns($){return new cQ({...this._def,returns:$})}implement($){return this.parse($)}strictImplement($){return this.parse($)}static create($,J,X){return new cQ({args:$?$:HJ.create([]).rest(dJ.create()),returns:J||dJ.create(),typeName:X$.ZodFunction,...V$(X)})}}class sQ extends E${get schema(){return this._def.getter()}_parse($){let{ctx:J}=this._processInputParams($);return this._def.getter()._parse({data:J.data,path:J.path,parent:J})}}sQ.create=($,J)=>{return new sQ({getter:$,typeName:X$.ZodLazy,...V$(J)})};class tQ extends E${_parse($){if($.data!==this._def.value){let J=this._getOrReturnCtx($);return c(J,{received:J.data,code:h.invalid_literal,expected:this._def.value}),J$}return{status:"valid",value:$.data}}get value(){return this._def.value}}tQ.create=($,J)=>{return new tQ({value:$,typeName:X$.ZodLiteral,...V$(J)})};function K5($,J){return new nJ({values:$,typeName:X$.ZodEnum,...V$(J)})}class nJ extends E${_parse($){if(typeof $.data!=="string"){let J=this._getOrReturnCtx($),X=this._def.values;return c(J,{expected:L$.joinValues(X),received:J.parsedType,code:h.invalid_type}),J$}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has($.data)){let J=this._getOrReturnCtx($),X=this._def.values;return c(J,{received:J.data,code:h.invalid_enum_value,options:X}),J$}return z0($.data)}get options(){return this._def.values}get enum(){let $={};for(let J of this._def.values)$[J]=J;return $}get Values(){let $={};for(let J of this._def.values)$[J]=J;return $}get Enum(){let $={};for(let J of this._def.values)$[J]=J;return $}extract($,J=this._def){return nJ.create($,{...this._def,...J})}exclude($,J=this._def){return nJ.create(this.options.filter((X)=>!$.includes(X)),{...this._def,...J})}}nJ.create=K5;class eQ extends E${_parse($){let J=L$.getValidEnumValues(this._def.values),X=this._getOrReturnCtx($);if(X.parsedType!==m.string&&X.parsedType!==m.number){let Q=L$.objectValues(J);return c(X,{expected:L$.joinValues(Q),received:X.parsedType,code:h.invalid_type}),J$}if(!this._cache)this._cache=new Set(L$.getValidEnumValues(this._def.values));if(!this._cache.has($.data)){let Q=L$.objectValues(J);return c(X,{received:X.data,code:h.invalid_enum_value,options:Q}),J$}return z0($.data)}get enum(){return this._def.values}}eQ.create=($,J)=>{return new eQ({values:$,typeName:X$.ZodNativeEnum,...V$(J)})};class zQ extends E${unwrap(){return this._def.type}_parse($){let{ctx:J}=this._processInputParams($);if(J.parsedType!==m.promise&&J.common.async===!1)return c(J,{code:h.invalid_type,expected:m.promise,received:J.parsedType}),J$;let X=J.parsedType===m.promise?J.data:Promise.resolve(J.data);return z0(X.then((Q)=>{return this._def.type.parseAsync(Q,{path:J.path,errorMap:J.common.contextualErrorMap})}))}}zQ.create=($,J)=>{return new zQ({type:$,typeName:X$.ZodPromise,...V$(J)})};class s0 extends E${innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===X$.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse($){let{status:J,ctx:X}=this._processInputParams($),Q=this._def.effect||null,Y={addIssue:(G)=>{if(c(X,G),G.fatal)J.abort();else J.dirty()},get path(){return X.path}};if(Y.addIssue=Y.addIssue.bind(Y),Q.type==="preprocess"){let G=Q.transform(X.data,Y);if(X.common.async)return Promise.resolve(G).then(async(W)=>{if(J.value==="aborted")return J$;let O=await this._def.schema._parseAsync({data:W,path:X.path,parent:X});if(O.status==="aborted")return J$;if(O.status==="dirty")return VQ(O.value);if(J.value==="dirty")return VQ(O.value);return O});else{if(J.value==="aborted")return J$;let W=this._def.schema._parseSync({data:G,path:X.path,parent:X});if(W.status==="aborted")return J$;if(W.status==="dirty")return VQ(W.value);if(J.value==="dirty")return VQ(W.value);return W}}if(Q.type==="refinement"){let G=(W)=>{let O=Q.refinement(W,Y);if(X.common.async)return Promise.resolve(O);if(O instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return W};if(X.common.async===!1){let W=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(W.status==="aborted")return J$;if(W.status==="dirty")J.dirty();return G(W.value),{status:J.value,value:W.value}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((W)=>{if(W.status==="aborted")return J$;if(W.status==="dirty")J.dirty();return G(W.value).then(()=>{return{status:J.value,value:W.value}})})}if(Q.type==="transform")if(X.common.async===!1){let G=this._def.schema._parseSync({data:X.data,path:X.path,parent:X});if(!lJ(G))return J$;let W=Q.transform(G.value,Y);if(W instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:J.value,value:W}}else return this._def.schema._parseAsync({data:X.data,path:X.path,parent:X}).then((G)=>{if(!lJ(G))return J$;return Promise.resolve(Q.transform(G.value,Y)).then((W)=>({status:J.value,value:W}))});L$.assertNever(Q)}}s0.create=($,J,X)=>{return new s0({schema:$,typeName:X$.ZodEffects,effect:J,...V$(X)})};s0.createWithPreprocess=($,J,X)=>{return new s0({schema:J,effect:{type:"preprocess",transform:$},typeName:X$.ZodEffects,...V$(X)})};class a0 extends E${_parse($){if(this._getType($)===m.undefined)return z0(void 0);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}a0.create=($,J)=>{return new a0({innerType:$,typeName:X$.ZodOptional,...V$(J)})};class ZJ extends E${_parse($){if(this._getType($)===m.null)return z0(null);return this._def.innerType._parse($)}unwrap(){return this._def.innerType}}ZJ.create=($,J)=>{return new ZJ({innerType:$,typeName:X$.ZodNullable,...V$(J)})};class $X extends E${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;if(J.parsedType===m.undefined)X=this._def.defaultValue();return this._def.innerType._parse({data:X,path:J.path,parent:J})}removeDefault(){return this._def.innerType}}$X.create=($,J)=>{return new $X({innerType:$,typeName:X$.ZodDefault,defaultValue:typeof J.default==="function"?J.default:()=>J.default,...V$(J)})};class JX extends E${_parse($){let{ctx:J}=this._processInputParams($),X={...J,common:{...J.common,issues:[]}},Q=this._def.innerType._parse({data:X.data,path:X.path,parent:{...X}});if(dQ(Q))return Q.then((Y)=>{return{status:"valid",value:Y.status==="valid"?Y.value:this._def.catchValue({get error(){return new B0(X.common.issues)},input:X.data})}});else return{status:"valid",value:Q.status==="valid"?Q.value:this._def.catchValue({get error(){return new B0(X.common.issues)},input:X.data})}}removeCatch(){return this._def.innerType}}JX.create=($,J)=>{return new JX({innerType:$,typeName:X$.ZodCatch,catchValue:typeof J.catch==="function"?J.catch:()=>J.catch,...V$(J)})};class pX extends E${_parse($){if(this._getType($)!==m.nan){let X=this._getOrReturnCtx($);return c(X,{code:h.invalid_type,expected:m.nan,received:X.parsedType}),J$}return{status:"valid",value:$.data}}}pX.create=($)=>{return new pX({typeName:X$.ZodNaN,...V$($)})};var Q6=Symbol("zod_brand");class z9 extends E${_parse($){let{ctx:J}=this._processInputParams($),X=J.data;return this._def.type._parse({data:X,path:J.path,parent:J})}unwrap(){return this._def.type}}class cX extends E${_parse($){let{status:J,ctx:X}=this._processInputParams($);if(X.common.async)return(async()=>{let Y=await this._def.in._parseAsync({data:X.data,path:X.path,parent:X});if(Y.status==="aborted")return J$;if(Y.status==="dirty")return J.dirty(),VQ(Y.value);else return this._def.out._parseAsync({data:Y.value,path:X.path,parent:X})})();else{let Q=this._def.in._parseSync({data:X.data,path:X.path,parent:X});if(Q.status==="aborted")return J$;if(Q.status==="dirty")return J.dirty(),{status:"dirty",value:Q.value};else return this._def.out._parseSync({data:Q.value,path:X.path,parent:X})}}static create($,J){return new cX({in:$,out:J,typeName:X$.ZodPipeline})}}class QX extends E${_parse($){let J=this._def.innerType._parse($),X=(Q)=>{if(lJ(Q))Q.value=Object.freeze(Q.value);return Q};return dQ(J)?J.then((Q)=>X(Q)):X(J)}unwrap(){return this._def.innerType}}QX.create=($,J)=>{return new QX({innerType:$,typeName:X$.ZodReadonly,...V$(J)})};function U5($,J){let X=typeof $==="function"?$(J):typeof $==="string"?{message:$}:$;return typeof X==="string"?{message:X}:X}function E5($,J={},X){if($)return KQ.create().superRefine((Q,Y)=>{let G=$(Q);if(G instanceof Promise)return G.then((W)=>{if(!W){let O=U5(J,Q),M=O.fatal??X??!0;Y.addIssue({code:"custom",...O,fatal:M})}});if(!G){let W=U5(J,Q),O=W.fatal??X??!0;Y.addIssue({code:"custom",...W,fatal:O})}return});return KQ.create()}var X6={object:m$.lazycreate},X$;(function($){$.ZodString="ZodString",$.ZodNumber="ZodNumber",$.ZodNaN="ZodNaN",$.ZodBigInt="ZodBigInt",$.ZodBoolean="ZodBoolean",$.ZodDate="ZodDate",$.ZodSymbol="ZodSymbol",$.ZodUndefined="ZodUndefined",$.ZodNull="ZodNull",$.ZodAny="ZodAny",$.ZodUnknown="ZodUnknown",$.ZodNever="ZodNever",$.ZodVoid="ZodVoid",$.ZodArray="ZodArray",$.ZodObject="ZodObject",$.ZodUnion="ZodUnion",$.ZodDiscriminatedUnion="ZodDiscriminatedUnion",$.ZodIntersection="ZodIntersection",$.ZodTuple="ZodTuple",$.ZodRecord="ZodRecord",$.ZodMap="ZodMap",$.ZodSet="ZodSet",$.ZodFunction="ZodFunction",$.ZodLazy="ZodLazy",$.ZodLiteral="ZodLiteral",$.ZodEnum="ZodEnum",$.ZodEffects="ZodEffects",$.ZodNativeEnum="ZodNativeEnum",$.ZodOptional="ZodOptional",$.ZodNullable="ZodNullable",$.ZodDefault="ZodDefault",$.ZodCatch="ZodCatch",$.ZodPromise="ZodPromise",$.ZodBranded="ZodBranded",$.ZodPipeline="ZodPipeline",$.ZodReadonly="ZodReadonly"})(X$||(X$={}));var Y6=($,J={message:`Input not instance of ${$.name}`})=>E5((X)=>X instanceof $,J),z5=i0.create,F5=pJ.create,G6=pX.create,W6=cJ.create,N5=nQ.create,O6=qQ.create,M6=mX.create,U6=iQ.create,H6=oQ.create,V6=KQ.create,q6=dJ.create,K6=UJ.create,E6=gX.create,z6=o0.create,F6=m$.create,N6=m$.strictCreate,A6=aQ.create,L6=E9.create,D6=rQ.create,R6=HJ.create,Z6=lX.create,B6=dX.create,T6=EQ.create,S6=cQ.create,j6=sQ.create,C6=tQ.create,I6=nJ.create,w6=eQ.create,P6=zQ.create,_6=s0.create,x6=a0.create,v6=ZJ.create,k6=s0.createWithPreprocess,f6=cX.create,y6=()=>z5().optional(),h6=()=>F5().optional(),b6=()=>N5().optional(),u6={string:($)=>i0.create({...$,coerce:!0}),number:($)=>pJ.create({...$,coerce:!0}),boolean:($)=>nQ.create({...$,coerce:!0}),bigint:($)=>cJ.create({...$,coerce:!0}),date:($)=>qQ.create({...$,coerce:!0})};var m6=J$;function vG($){if(g6($)===6)return!0;if($.includes("://")||$.includes("/")||$.includes(":"))return!1;if($==="localhost")return!0;if($.startsWith("*.")){let J=$.slice(2);if(!J.includes(".")||J.startsWith(".")||J.endsWith("."))return!1;let X=J.split(".");return X.length>=2&&X.every((Q)=>Q.length>0)}if($.includes("*"))return!1;return $.includes(".")&&!$.startsWith(".")&&!$.endsWith(".")}var kG='Invalid domain pattern. Must be a valid domain (e.g., "example.com"), a wildcard (e.g., "*.example.com"), or a bracketed IPv6 literal (e.g., "[::1]", "[2001:db8::1]:443"). Overly broad patterns like "*.com" or "*" are not allowed for security reasons.',N9=x.string().refine(vG,{message:kG});function L5($){let J=$.indexOf(":");return!(J!==-1&&$.indexOf(":",J+1)!==-1)||$.startsWith("[")}var d6=x.string().refine(($)=>L5($)&&vG(xX($).hostPattern),{message:kG+' An optional ":port" suffix (1-65535) restricts the entry to that port.'}),p6=x.string().refine(($)=>{if(!L5($))return!1;let{hostPattern:J}=xX($);return J==="*"||vG(J)},{message:kG+' In deniedDomains a bare "*" (deny-all) is also accepted, and an optional ":port" suffix (1-65535) restricts the entry to that port.'}),nX=x.string().min(1,"Path cannot be empty"),A5=x.string().min(1,"Path cannot be empty").refine(($)=>l6($),{message:"Binary path must be absolute"}),c6=x.object({socketPath:x.string().min(1).describe("Unix socket path to the MITM proxy"),domains:x.array(N9).min(1).describe('Domains to route through the MITM proxy (e.g., ["api.example.com", "*.internal.org"])')}),n6=x.object({http:x.string().url().optional().describe("Upstream proxy URL for plain HTTP traffic"),https:x.string().url().optional().describe("Upstream proxy URL for HTTPS/CONNECT traffic (falls back to http if unset)"),noProxy:x.string().optional().describe("Comma-separated NO_PROXY list (hostname suffixes and CIDR ranges). Matching destinations connect directly instead of via the parent proxy.")}),D5=x.enum(["deny","mask"]),F9=x.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/,"Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores"),R5=x.string().superRefine(($,J)=>{let X;try{X=new RegExp($)}catch(Y){J.addIssue({code:x.ZodIssueCode.custom,message:`extract is not a valid regular expression: ${Y.message}`});return}if(new RegExp(X.source+"|").exec("").length-1<1)J.addIssue({code:x.ZodIssueCode.custom,message:"extract must contain at least one capturing group \u2014 group 1 is "+'the credential value to mask (e.g. "token:\\s*(\\S+)").'})}),i6=x.object({path:nX.describe("Path to a credential file or directory. Supports the same path forms as filesystem.denyRead (absolute paths and ~ expansion)."),mode:D5.describe("Access mode for this path"),extract:R5.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the file is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe("What to do when extract matches nothing (or, with decode, no "+'candidate verifies): "warn" (default \u2014 stderr warning, file left '+'readable), "deny" (degrade to mode "deny" \u2014 file unreadable), or '+'"error" (throw at wrap time). Only meaningful with mode "mask" and extract or decode set.'),decode:x.enum(["jwt"]).optional().describe('Optional encoded-credential format. "jwt": decodes recognized JWTs so masking can target fields inside them (see maskClaims). Candidates are located with a built-in JWT regex (or the explicit extract pattern, if set) and verified to actually be JWTs before masking. Without maskClaims, the whole decoded value is treated as the credential and replaced with a structurally valid fake JWT, so client-side token parsing keeps working. If no candidate verifies, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches in any verified token, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskDuplicates:x.boolean().optional().describe("If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the "+"corresponding sentinel \u2014 for a secret repeated where the regex "+`does not reach (e.g. in a comment). Matches raw substrings: short or common credential values may corrupt unrelated content, so this is intended for long, high-entropy secrets. With decode, only values that passed verification are scanned; duplicates reuse the verified value's fake without re-verification. Defaults to false. Only meaningful with mode "mask" and extract or decode set; accepted but ignored otherwise.`),injectHosts:x.array(N9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),o6=x.object({name:F9.describe("Environment variable name"),mode:D5.describe("Access mode for this environment variable"),extract:R5.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the value is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:x.enum(["warn","deny","error"]).optional().describe('What to do when extract matches nothing: "warn" (default \u2014 stderr '+'warning, variable passes through unmasked), "deny" (variable unset inside the sandbox), or "error" (throw at wrap time). Only meaningful with mode "mask" and extract set.'),decode:x.enum(["jwt"]).optional().describe(`Optional encoded-credential format. "jwt": the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".`),maskClaims:x.array(x.string().min(1)).optional().describe('Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHosts:x.array(N9).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),a6=x.object({accessKeyIdVar:F9.describe("Name of the masked env var holding the AWS access key id."),secretAccessKeyVar:F9.describe("Name of the masked env var holding the AWS secret access key."),sessionTokenVar:F9.optional().describe("Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.")}).strict(),xG=x.enum(["deny","passthrough"]),r6=x.object({streaming:xG.optional().describe('Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. Default "deny".'),presigned:xG.optional().describe('Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. Default "deny".'),sigv4a:xG.optional().describe('Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. Default "deny".')}).strict(),Z5=x.object({files:x.array(i6).optional().describe("Credential files or directories to protect"),envVars:x.array(o6).optional().describe("Environment variables to protect"),allowPlaintextInject:x.boolean().optional().describe("Allow sentinel\u2192real substitution on the plain-HTTP proxy path. "+"Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures."),awsPairs:x.array(a6).optional().describe("Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked."),sigv4:r6.optional().describe('Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: "deny" (default) or "passthrough".')}).strict(),B5=x.object({allowedDomains:x.array(d6).describe('List of allowed domains (e.g., ["github.com", "*.npmjs.org", "api.example.com:443"]). An optional ":port" suffix restricts the entry to that destination port.'),deniedDomains:x.array(p6).describe('List of denied domains. Unlike allowedDomains, a bare "*" is accepted here (deny-all). An optional ":port" suffix (e.g., "*:22") restricts the entry to that destination port.'),deniedDomainReasons:x.record(x.string(),x.string().min(1)).optional().describe('Optional model-facing reason keyed by the exact deniedDomains entry it explains (e.g., {"github.com:22": "SSH pushes to GitHub are blocked; use an https remote"}). Reported in the <sandbox_violations> line when that entry denies a connection; entries without one use a generic reason. Keys are matched by exact entry string, so a key with no matching deniedDomains entry never fires.'),strictAllowlist:x.boolean().optional().describe("If true, hosts not in allowedDomains are denied without consulting the ask callback. Set this when allowedDomains is policy enforcement, not a prompt-suppression hint."),allowUnixSockets:x.array(x.string()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),allowAllUnixSockets:x.boolean().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),allowLocalBinding:x.boolean().optional().describe("Whether to allow binding to local ports (default: false)"),allowMachLookup:x.array(x.string().refine(($)=>{return!($.endsWith("*")?$.slice(0,-1):$).includes("*")},{message:'Wildcards are only allowed as a single trailing "*" (e.g., "com.example.*" or "*" for all services).'})).optional().describe('macOS only: Additional XPC/Mach service names to allow looking up. Supports trailing-wildcard prefix matching (e.g., "2BUA8C4S2C.com.1password.*"). Needed for tools like 1Password CLI, Playwright, or the iOS Simulator that communicate via XPC.'),httpProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external HTTP proxy to use instead of starting a local one. When provided, the library will skip starting its own HTTP proxy and use this port. The external proxy must handle domain filtering."),socksProxyPort:x.number().int().min(1).max(65535).optional().describe("Port of an external SOCKS proxy to use instead of starting a local one. When provided, the library will skip starting its own SOCKS proxy and use this port. The external proxy must handle domain filtering."),mitmProxy:c6.optional().describe("Optional MITM proxy configuration. Routes matching domains through an upstream proxy via Unix socket while SRT still handles allow/deny filtering."),filterRequest:x.custom(($)=>typeof $==="function",{message:"filterRequest must be a function"}).optional().describe("Per-request filter callback. Receives the parsed HTTP request (web-standard Request) and returns {action, reason?}. Denied requests get a 403 with the reason. If the callback throws, the request is denied. Applies to plain HTTP through the proxy and, when tlsTerminate is configured, to terminated HTTPS. SRT does not provide a policy language; library consumers own matching."),tlsTerminate:x.object({caCertPath:x.string().min(1).optional().describe("Path to a PEM-encoded CA certificate. The sandboxed child is configured to trust this CA, and the TLS-terminating proxy uses it to sign per-host certificates. If omitted, on Windows SRT generates-if-absent a persistent CA under %ProgramData%\\sandbox-runtime\\ca\\ and trusts it in the sandbox user's Root store; on other platforms SRT generates an ephemeral CA into a temp directory for the lifetime of the session."),caKeyPath:x.string().min(1).optional().describe("Path to the PEM-encoded private key for caCertPath."),excludeDomains:x.array(N9).optional().describe("Domain patterns (same syntax as allowedDomains) whose HTTPS connections are NOT terminated. Matching CONNECTs are opaque byte tunnels: still subject to the allow/deny domain lists, but the sandboxed client completes its own TLS handshake with the upstream, so filterRequest and credential injection do not apply to their HTTPS traffic (plain-HTTP requests to the same hosts keep the normal request pipeline). Use for hosts the proxy must not re-originate: mTLS upstreams (only the client holds the client certificate) and clients that pin the upstream certificate and would reject the MITM CA. Hosts still need to be reachable via allowedDomains; this list only changes how they are tunnelled."),extraCaCertPaths:x.array(x.string().min(1)).optional().describe("Paths to PEM CA certificate files appended to the trust bundle the sandboxed child is pointed at, after the MITM CA and the host's regular roots. Use for site-local roots (e.g. an internal mTLS CA) presented by excluded/passthrough hosts, so the child can verify them itself. Only the CERTIFICATE blocks of each file are copied; files that are missing, unreadable, or contain no PEM CERTIFICATE block are skipped (with a debug log), so paths that exist on only some hosts are safe to list.")}).refine(($)=>!$.caCertPath===!$.caKeyPath,{message:"caCertPath and caKeyPath must be provided together"}).optional().describe("[EXPERIMENTAL] Enable in-process TLS termination so HTTPS request/response bodies are visible to SRT. Provide a CA cert+key, or omit both to have SRT generate an ephemeral one."),parentProxy:n6.optional().describe("Upstream HTTP proxy for outbound connections. When set, SRT's proxy tunnels non-mitmProxy traffic through this parent instead of connecting directly. Falls back to HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars if unset.")}),T5=x.object({disabled:x.boolean().optional().describe("Disable all filesystem policy enforcement. When true, no read or write rules are emitted: denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, .claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process is trusted with full host filesystem access. Network and credential-env restrictions still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs."),denyRead:x.array(nX).describe("Paths denied for reading"),allowRead:x.array(nX).optional().describe("Paths to re-allow reading within denied regions (takes precedence over denyRead). Use with denyRead to deny a broad region then allow back specific subdirectories."),allowWrite:x.array(nX).describe("Paths allowed for writing"),denyWrite:x.array(nX).describe("Paths denied for writing (takes precedence over allowWrite)"),allowGitConfig:x.boolean().optional().describe("Allow writes to .git/config files (default: false). Enables git remote URL updates while keeping .git/hooks protected.")}),S5=x.record(x.string(),x.array(x.string())).describe('Map of command patterns to filesystem paths to ignore violations for. Use "*" to match all commands'),j5=x.object({command:x.string().describe("The ripgrep command to execute"),args:x.array(x.string()).optional().describe("Additional arguments to pass before ripgrep args"),argv0:x.string().optional().describe("Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])")}),C5=x.object({safeDirectories:x.array(x.string()).default([]).describe("Directories git should treat as safe (`safe.directory`) even though they're owned by a different user inside the sandbox. Use for the repo top-level when launching from a subdirectory. Does NOT grant write.")}),I5=x.object({path:x.string().min(1).describe("Path to the srt-win binary. Pass the exported VENDORED_SRT_WIN_EXE constant to use the packaged vendor/srt-win/<arch>/srt-win.exe (see its WARNING: in a dev checkout that file may sit inside your sandbox write grant). The binary is spawned with the `--srt-win` argv[1] sentinel so a multicall dispatcher can route to srt-win's CLI.")}),w5=x.object({sandboxUser:x.string().min(1).max(20,"Windows local usernames are limited to 20 characters").optional().describe("Name for the dedicated sandbox user account that `srt-win install` creates and the sandboxed child runs as. Default: `srt-sandbox`. Install refuses if an account by this name already exists and srt-win did not create it (it will not rotate the password of an account it does not own). Must match what `srt-win install --sandbox-user` was run with."),sublayerGuid:x.string().uuid().optional().describe("WFP sublayer GUID under which the filters were installed. Omit to use the srt-win compile-time default. Set this when filters were installed by enterprise tooling under a custom sublayer."),wfpSublayerGuid:x.string().uuid().optional().describe("Deprecated alias for sublayerGuid."),proxyPortRange:x.tuple([x.number().int().min(1),x.number().int().max(65535)]).refine(([$,J])=>$<=J&&J-$<=64,{message:"low must be \u2264 high and range width \u2264 64"}).optional().describe("Inclusive [low, high] port range the JS mux proxy listeners bind inside. MUST match the range passed to `srt-win install "+"--proxy-port-range` (default 60080\u201360089) \u2014 the WFP loopback "+"permit only covers ports in that range."),srtWin:I5.optional().describe("How to locate/invoke the srt-win helper binary. `srtWin.path` is "+"required to use the Windows sandbox \u2014 your own (multicall) binary, "+"or the exported VENDORED_SRT_WIN_EXE constant for the packaged exe.")}),s6=x.object({applyPath:x.string().optional().describe("Path to the apply-seccomp binary"),argv0:x.string().optional().describe("Invoke apply-seccomp as a multicall binary that dispatches on the ARGV0 environment variable. When set, applyPath is used verbatim (no existence check) and the invocation inside bwrap is prefixed with ARGV0=<this value>. The caller is responsible for ensuring applyPath resolves inside the bwrap namespace and that the target binary implements the apply-seccomp interface when ARGV0 matches.")}),t6=x.object({network:B5.describe("Network restrictions configuration"),filesystem:T5.describe("Filesystem restrictions configuration"),credentials:Z5.optional().describe("Credential handling configuration. Only the explicitly declared files and environment variables are restricted."),ignoreViolations:S5.optional().describe("Optional configuration for ignoring specific violations"),enableWeakerNestedSandbox:x.boolean().optional().describe("Enable weaker nested sandbox mode (for Docker environments)"),enableWeakerNetworkIsolation:x.boolean().optional().describe("Enable weaker network isolation to allow access to com.apple.trustd.agent (macOS only). This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data exfiltration vector through the trustd service. Only enable if you need Go TLS verification."),allowAppleEvents:x.boolean().optional().describe("Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or network restrictions), and can script running apps subject to TCC automation consent. Default: false."),ripgrep:j5.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),mandatoryDenySearchDepth:x.number().int().min(1).max(10).optional().describe("Maximum directory depth to search for dangerous files on Linux (default: 3). Higher values provide more protection but slower performance."),allowPty:x.boolean().optional().describe("Allow pseudo-terminal (pty) operations (macOS only)"),seccomp:s6.optional().describe("Custom seccomp binary paths (Linux only)."),bwrapPath:A5.optional().describe('Linux only: absolute path to the bwrap (bubblewrap) binary. When set, this path is used directly instead of resolving "bwrap" via PATH.'),socatPath:A5.optional().describe('Linux only: absolute path to the socat binary. When set, this path is used directly instead of resolving "socat" via PATH.'),windows:w5.optional().describe("Windows-specific settings (WFP sublayer, proxy port range)."),git:C5.optional().describe("Git configuration to inject via GIT_CONFIG_* env vars (cross-platform). `safeDirectories` marks paths as `safe.directory` without adding them to `filesystem.allowWrite`.")}).superRefine(($,J)=>{let X=$.credentials;if(!X)return;let Q=$.network.allowedDomains.map(vX),Y=(M,U)=>{for(let[H,V]of M.entries())if(!W9(V,Q))J.addIssue({code:x.ZodIssueCode.custom,path:[...U,H],message:`injectHosts entry "${V}" is not reachable via `+`network.allowedDomains \u2014 add "${V}" (or a covering wildcard) to allowedDomains, or remove it from injectHosts.`})},G=!1,W=(M,U)=>{if(M.injectHosts)Y(M.injectHosts,[...U,"injectHosts"]);if(M.mode!=="mask")return;G=!0;let H=$.network.tlsTerminate?.excludeDomains;if(H?.length){if(M.injectHosts){for(let[V,q]of M.injectHosts.entries())if(W9(q,H))J.addIssue({code:x.ZodIssueCode.custom,path:[...U,"injectHosts",V],message:`injectHosts entry "${q}" is entirely covered by network.tlsTerminate.excludeDomains. Credential injection only runs on TLS-terminated connections, so this host would receive the placeholder instead of the credential. Remove it from one of the two lists.`})}else if(Q.length>0&&Q.every((V)=>W9(V,H)))J.addIssue({code:x.ZodIssueCode.custom,path:U,message:"This masked credential has no injectHosts, so it defaults "+"to network.allowedDomains \u2014 but "+"network.tlsTerminate.excludeDomains covers every allowed domain, so it could never be injected anywhere. Credential injection only runs on TLS-terminated connections."})}if(M.injectHosts!==void 0&&M.injectHosts.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:U,message:"injectHosts is explicitly empty \u2014 the credential would be "+"masked but never injected. Omit injectHosts to default to network.allowedDomains, or list the intended hosts."})};for(let[M,U]of(X.envVars??[]).entries()){if(W(U,["credentials","envVars",M]),U.maskClaims!==void 0&&U.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the whole value.'});if(U.maskClaims!==void 0&&U.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","envVars",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."})}for(let[M,U]of(X.files??[]).entries()){if(W(U,["credentials","files",M]),U.maskClaims!==void 0&&U.decode===void 0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the extracted value whole.'});if(U.maskClaims!==void 0&&U.maskClaims.length===0)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."});if(U.mode==="mask"&&U.path.endsWith("/"))J.addIssue({code:x.ZodIssueCode.custom,path:["credentials","files",M,"path"],message:`Credential mode "mask" applies to a single file, not a directory. Use mode "deny" for "${U.path}", or point at the credential file inside it.`})}let O=new Set;for(let[M,U]of(X.awsPairs??[]).entries()){let H=[["accessKeyIdVar",U.accessKeyIdVar],["secretAccessKeyVar",U.secretAccessKeyVar]];if(U.sessionTokenVar!==void 0)H.push(["sessionTokenVar",U.sessionTokenVar]);for(let[V,q]of H){let z=["credentials","awsPairs",M,V];if(O.has(q)){J.addIssue({code:x.ZodIssueCode.custom,path:z,message:`"${q}" appears in more than one awsPairs slot (within `+"or across pairs) \u2014 each variable can fill exactly one slot."});continue}O.add(q);let K=(X.envVars??[]).find((L)=>L.name===q);if(K===void 0||K.mode!=="mask")J.addIssue({code:x.ZodIssueCode.custom,path:z,message:`"${q}" does not reference a credentials.envVars entry `+'with mode "mask" \u2014 an AWS pair links already-masked '+"variables; add the entry (masking is the opt-in for SigV4 re-signing)."});else if(K.extract!==void 0||K.decode!==void 0)J.addIssue({code:x.ZodIssueCode.custom,path:z,message:`"${q}" uses extract/decode, but an AWS pair member must be masked whole-value: the SigV4 trigger is an exact match of the fake access key id, and the signer needs the entire real value.`})}}if(G&&$.network.tlsTerminate===void 0&&!X.allowPlaintextInject)J.addIssue({code:x.ZodIssueCode.custom,path:["credentials"],message:"Credential masking requires network.tlsTerminate so substitution runs only over a verified TLS connection. Enable tlsTerminate, or set credentials.allowPlaintextInject to opt out (not recommended)."})});export{w4 as windowsTrustCaAsync,lq as windowsTrustCa,_4 as windowsStateDir,UG as windowsInstallInstructions,KG as verifyWindowsWfpEgress,SX as validateCaPair,cq as uninstallWindowsSandbox,AG as stampWindowsAcl,Y9 as revokeWindowsAcl,X9 as restoreWindowsAcl,I0 as resolveSrtWin,nq as parseWindowsSandboxError,eY as parseWindowsBinShell,GX as isUncPath,pq as installWindowsSandboxAsync,dq as installWindowsSandbox,LG as grantWindowsAcl,D9 as getWslVersion,I4 as getWindowsWfpStatusAsync,C4 as getWindowsWfpStatus,_X as getWindowsSandboxUserStatusAsync,EG as getWindowsSandboxUserStatus,zG as getWindowsSandboxCaCert,gq as getSrtWinPath,FQ as getDefaultWritePaths,xY as generateCa,Q9 as expandWindowsFsPaths,FG as ensurePersistentWindowsCa,j4 as checkWindowsSandboxStatusAsync,S4 as checkWindowsSandboxStatus,DG as checkWindowsDependenciesAsync,fQ as certThumbprint,WX as buildGitConfigEnv,z$ as WindowsSandboxError,w5 as WindowsConfigSchema,mq as VENDORED_SRT_WIN_EXE,I5 as SrtWinConfigSchema,rY as SandboxViolationStore,t6 as SandboxRuntimeConfigSchema,PK as SandboxManager,R4 as SRT_WIN_DISPATCH_ARG1,j5 as RipgrepConfigSchema,B5 as NetworkConfigSchema,S5 as IgnoreViolationsConfigSchema,C5 as GitConfigSchema,T5 as FilesystemConfigSchema,tY as DEFAULT_WINDOWS_PROXY_PORT_RANGE,Z5 as CredentialsConfigSchema};
|