@reason-machines/cli-linux-x64 0.2.454 → 0.2.456

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. package/bin/reason +1 -1
  2. package/bin/runtime/srt/sandbox-runtime.mjs +30 -30
  3. package/bin/vm-hands/{connect-cli-8hs8r4sp.js → connect-cli-k9kktr5n.js} +1 -1
  4. package/bin/vm-hands/{local-automation-rfebgp2b.js → local-automation-xxw9v90w.js} +1 -1
  5. package/bin/vm-hands/{local-capabilities-dpcprjp1.js → local-capabilities-7fmb64cw.js} +1 -1
  6. package/bin/vm-hands/{local-display-session-n3gwzhk7.js → local-display-session-z75gxcyv.js} +1 -1
  7. package/bin/vm-hands/local-display-video-d1zzmxx0.js +2 -0
  8. package/bin/vm-hands/{local-managed-process-6xdjhs07.js → local-managed-process-cw1axg5g.js} +1 -1
  9. package/bin/vm-hands/{managed-runtime-fxgmqrs6.js → managed-runtime-8v0yc2ah.js} +1 -1
  10. package/bin/vm-hands/{permissions-2jckn6ve.js → permissions-gh72bh8t.js} +1 -1
  11. package/bin/vm-hands/{serve-service-zy7z43p0.js → serve-service-kqg6s85c.js} +1 -1
  12. package/bin/vm-hands/{status-1zdvq0x0.js → status-r4t7ped0.js} +1 -1
  13. package/bin/vm-hands/version-nndm6t5j.js +2 -0
  14. package/bin/vm-hands/{vm-hands-entry-lite-em68c5f9.js → vm-hands-entry-lite-0hvjszsp.js} +1 -1
  15. package/bin/vm-hands/{vm-hands-entry-lite-8dnbkcbq.js → vm-hands-entry-lite-1e8tpz1t.js} +1 -1
  16. package/bin/vm-hands/{vm-hands-entry-lite-3xeqwy6s.js → vm-hands-entry-lite-53wwd6rh.js} +1 -1
  17. package/bin/vm-hands/{vm-hands-entry-lite-nrkgc2z8.js → vm-hands-entry-lite-6h0e1w34.js} +1 -1
  18. package/bin/vm-hands/{vm-hands-entry-lite-10ay1fwg.js → vm-hands-entry-lite-76rbdx3m.js} +1 -1
  19. package/bin/vm-hands/{vm-hands-entry-lite-v6dgv2y8.js → vm-hands-entry-lite-dbk2abyq.js} +1 -1
  20. package/bin/vm-hands/{vm-hands-entry-lite-5yf9bmb5.js → vm-hands-entry-lite-g03q6h68.js} +1 -1
  21. package/bin/vm-hands/vm-hands-entry-lite-hmbpv4gs.js +2 -0
  22. package/bin/vm-hands/{vm-hands-entry-lite-24vhwcqp.js → vm-hands-entry-lite-s29b2ttf.js} +1 -1
  23. package/bin/vm-hands/{vm-hands-entry-lite-my71sa5q.js → vm-hands-entry-lite-tazdhdpd.js} +1 -1
  24. package/bin/vm-hands/{vm-hands-entry-lite-jkm8830z.js → vm-hands-entry-lite-wfqfp12p.js} +1 -1
  25. package/bin/vm-hands/{vm-hands-entry-lite-58c2j5ts.js → vm-hands-entry-lite-wngx16r5.js} +1 -1
  26. package/bin/vm-hands/{vm-hands-entry-lite-fn86veh7.js → vm-hands-entry-lite-yhte7j3v.js} +1 -1
  27. package/bin/vm-hands/{vm-hands-entry-lite-pqywzemr.js → vm-hands-entry-lite-yyedjn2a.js} +1 -1
  28. package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
  29. package/bin/vm-hands/{vm-hands-executor-vxb86y5a.js → vm-hands-executor-yd63t0gb.js} +1 -1
  30. package/bin/vm-hands/{vm-hands-op-runner-jzhq035n.js → vm-hands-op-runner-fkd4kb9z.js} +1 -1
  31. package/bin/vm-hands/{vm-hands-runtime-kvf6zw4f.js → vm-hands-runtime-tw9t583e.js} +3 -3
  32. package/package.json +1 -1
  33. package/bin/vm-hands/local-display-video-6pm6xqpf.js +0 -2
  34. package/bin/vm-hands/version-sxz8d6nm.js +0 -2
  35. package/bin/vm-hands/vm-hands-entry-lite-07wbn8tf.js +0 -2
package/bin/runtime/srt/sandbox-runtime.mjs CHANGED
@@ -1,45 +1,45 @@
1
1
  // @bun
2
- var Gh=Object.create;var{getPrototypeOf:jh,defineProperty:kc,getOwnPropertyNames:zh}=Object;var Ic=Object.prototype.hasOwnProperty;function Qh(e){return this[e]}var Xh,Yh,Ga=(e,t,n)=>{var r=e!=null&&typeof e==="object";if(r){var i=t?Xh??=new WeakMap:Yh??=new WeakMap,s=i.get(e);if(s)return s}n=e!=null?Gh(jh(e)):{};let a=t||!e||!e.__esModule||!Ic.call(e,"default")?kc(n,"default",{value:e,enumerable:!0}):n;if(e&&typeof e==="object"||typeof e==="function"){for(let o of zh(e))if(!Ic.call(a,o))kc(a,o,{get:Qh.bind(e,o),enumerable:!0})}if(r)i.set(e,a);return a};var fe=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var ai=import.meta.require;var me=fe(function(NC,Nc){Nc.exports={options:{usePureJavaScript:!1}}});var Oc=fe(function(DC,Lc){var Qa={};Lc.exports=Qa;var Dc={};Qa.encode=function(e,t,n){if(typeof t!=="string")throw TypeError('"alphabet" must be a string.');if(n!==void 0&&typeof n!=="number")throw TypeError('"maxline" must be a number.');var r="";if(!(e instanceof Uint8Array))r=s0(e,t);else{var i=0,s=t.length,a=t.charAt(0),o=[0];for(i=0;i<e.length;++i){for(var l=0,c=e[i];l<o.length;++l)c+=o[l]<<8,o[l]=c%s,c=c/s|0;while(c>0)o.push(c%s),c=c/s|0}for(i=0;e[i]===0&&i<e.length-1;++i)r+=a;for(i=o.length-1;i>=0;--i)r+=t[o[i]]}if(n){var u=new RegExp(".{1,"+n+"}","g");r=r.match(u).join(`\r
3
- `)}return r};Qa.decode=function(e,t){if(typeof e!=="string")throw TypeError('"input" must be a string.');if(typeof t!=="string")throw TypeError('"alphabet" must be a string.');var n=Dc[t];if(!n){n=Dc[t]=[];for(var r=0;r<t.length;++r)n[t.charCodeAt(r)]=r}e=e.replace(/\s/g,"");var i=t.length,s=t.charAt(0),a=[0];for(var r=0;r<e.length;r++){var o=n[e.charCodeAt(r)];if(o===void 0)return;for(var l=0,c=o;l<a.length;++l)c+=a[l]*i,a[l]=c&255,c>>=8;while(c>0)a.push(c&255),c>>=8}for(var u=0;e[u]===s&&u<e.length-1;++u)a.push(0);if(typeof Buffer<"u")return Buffer.from(a.reverse());return new Uint8Array(a.reverse())};function s0(e,t){var n=0,r=t.length,i=t.charAt(0),s=[0];for(n=0;n<e.length();++n){for(var a=0,o=e.at(n);a<s.length;++a)o+=s[a]<<8,s[a]=o%r,o=o/r|0;while(o>0)s.push(o%r),o=o/r|0}var l="";for(n=0;e.at(n)===0&&n<e.length()-1;++n)l+=i;for(n=s.length-1;n>=0;--n)l+=t[s[n]];return l}});var Be=fe(function(LC,Mc){var Uc=me(),Vc=Oc(),T=Mc.exports=Uc.util=Uc.util||{};(function(){if(typeof process<"u"&&process.nextTick){if(T.nextTick=process.nextTick,typeof setImmediate==="function")T.setImmediate=setImmediate;else T.setImmediate=T.nextTick;return}if(typeof setImmediate==="function"){T.setImmediate=function(){return setImmediate.apply(void 0,arguments)},T.nextTick=function(o){return setImmediate(o)};return}if(T.setImmediate=function(o){setTimeout(o,0)},typeof window<"u"&&typeof window.postMessage==="function"){let o=function(l){if(l.source===window&&l.data===e){l.stopPropagation();var c=t.slice();t.length=0,c.forEach(function(u){u()})}};var a=o,e="forge.setImmediate",t=[];T.setImmediate=function(l){if(t.push(l),t.length===1)window.postMessage(e,"*")},window.addEventListener("message",o,!0)}if(typeof MutationObserver<"u"){var n=Date.now(),r=!0,i=document.createElement("div"),t=[];new MutationObserver(function(){var l=t.slice();t.length=0,l.forEach(function(c){c()})}).observe(i,{attributes:!0});var s=T.setImmediate;T.setImmediate=function(l){if(Date.now()-n>15)n=Date.now(),s(l);else if(t.push(l),t.length===1)i.setAttribute("a",r=!r)}}T.nextTick=T.setImmediate})();T.isNodejs=typeof process<"u"&&process.versions&&process.versions.node;T.globalScope=function(){if(T.isNodejs)return global;return typeof self>"u"?window:self}();T.isArray=Array.isArray||function(e){return Object.prototype.toString.call(e)==="[object Array]"};T.isArrayBuffer=function(e){return typeof ArrayBuffer<"u"&&e instanceof ArrayBuffer};T.isArrayBufferView=function(e){return e&&T.isArrayBuffer(e.buffer)&&e.byteLength!==void 0};function fi(e){if(!(e===8||e===16||e===24||e===32))throw Error("Only 8, 16, 24, or 32 bits supported: "+e)}T.ByteBuffer=Xa;function Xa(e){if(this.data="",this.read=0,typeof e==="string")this.data=e;else if(T.isArrayBuffer(e)||T.isArrayBufferView(e))if(typeof Buffer<"u"&&e instanceof Buffer)this.data=e.toString("binary");else{var t=new Uint8Array(e);try{this.data=String.fromCharCode.apply(null,t)}catch(r){for(var n=0;n<t.length;++n)this.putByte(t[n])}}else if(e instanceof Xa||typeof e==="object"&&typeof e.data==="string"&&typeof e.read==="number")this.data=e.data,this.read=e.read;this._constructedStringLength=0}T.ByteStringBuffer=Xa;var a0=4096;T.ByteStringBuffer.prototype._optimizeConstructedString=function(e){if(this._constructedStringLength+=e,this._constructedStringLength>a0)this.data.substr(0,1),this._constructedStringLength=0};T.ByteStringBuffer.prototype.length=function(){return this.data.length-this.read};T.ByteStringBuffer.prototype.isEmpty=function(){return this.length()<=0};T.ByteStringBuffer.prototype.putByte=function(e){return this.putBytes(String.fromCharCode(e))};T.ByteStringBuffer.prototype.fillWithByte=function(e,t){e=String.fromCharCode(e);var n=this.data;while(t>0){if(t&1)n+=e;if(t>>>=1,t>0)e+=e}return this.data=n,this._optimizeConstructedString(t),this};T.ByteStringBuffer.prototype.putBytes=function(e){return this.data+=e,this._optimizeConstructedString(e.length),this};T.ByteStringBuffer.prototype.putString=function(e){return this.putBytes(T.encodeUtf8(e))};T.ByteStringBuffer.prototype.putInt16=function(e){return this.putBytes(String.fromCharCode(e>>8&255)+String.fromCharCode(e&255))};T.ByteStringBuffer.prototype.putInt24=function(e){return this.putBytes(String.fromCharCode(e>>16&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e&255))};T.ByteStringBuffer.prototype.putInt32=function(e){return this.putBytes(String.fromCharCode(e>>24&255)+String.fromCharCode(e>>16&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e&255))};T.ByteStringBuffer.prototype.putInt16Le=function(e){return this.putBytes(String.fromCharCode(e&255)+String.fromCharCode(e>>8&255))};T.ByteStringBuffer.prototype.putInt24Le=function(e){return this.putBytes(String.fromCharCode(e&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e>>16&255))};T.ByteStringBuffer.prototype.putInt32Le=function(e){return this.putBytes(String.fromCharCode(e&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e>>16&255)+String.fromCharCode(e>>24&255))};T.ByteStringBuffer.prototype.putInt=function(e,t){fi(t);var n="";do t-=8,n+=String.fromCharCode(e>>t&255);while(t>0);return this.putBytes(n)};T.ByteStringBuffer.prototype.putSignedInt=function(e,t){if(e<0)e+=2<<t-1;return this.putInt(e,t)};T.ByteStringBuffer.prototype.putBuffer=function(e){return this.putBytes(e.getBytes())};T.ByteStringBuffer.prototype.getByte=function(){return this.data.charCodeAt(this.read++)};T.ByteStringBuffer.prototype.getInt16=function(){var e=this.data.charCodeAt(this.read)<<8^this.data.charCodeAt(this.read+1);return this.read+=2,e};T.ByteStringBuffer.prototype.getInt24=function(){var e=this.data.charCodeAt(this.read)<<16^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2);return this.read+=3,e};T.ByteStringBuffer.prototype.getInt32=function(){var e=this.data.charCodeAt(this.read)<<24^this.data.charCodeAt(this.read+1)<<16^this.data.charCodeAt(this.read+2)<<8^this.data.charCodeAt(this.read+3);return this.read+=4,e};T.ByteStringBuffer.prototype.getInt16Le=function(){var e=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8;return this.read+=2,e};T.ByteStringBuffer.prototype.getInt24Le=function(){var e=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16;return this.read+=3,e};T.ByteStringBuffer.prototype.getInt32Le=function(){var e=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16^this.data.charCodeAt(this.read+3)<<24;return this.read+=4,e};T.ByteStringBuffer.prototype.getInt=function(e){fi(e);var t=0;do t=(t<<8)+this.data.charCodeAt(this.read++),e-=8;while(e>0);return t};T.ByteStringBuffer.prototype.getSignedInt=function(e){var t=this.getInt(e),n=2<<e-2;if(t>=n)t-=n<<1;return t};T.ByteStringBuffer.prototype.getBytes=function(e){var t;if(e)e=Math.min(this.length(),e),t=this.data.slice(this.read,this.read+e),this.read+=e;else if(e===0)t="";else t=this.read===0?this.data:this.data.slice(this.read),this.clear();return t};T.ByteStringBuffer.prototype.bytes=function(e){return typeof e>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+e)};T.ByteStringBuffer.prototype.at=function(e){return this.data.charCodeAt(this.read+e)};T.ByteStringBuffer.prototype.setAt=function(e,t){return this.data=this.data.substr(0,this.read+e)+String.fromCharCode(t)+this.data.substr(this.read+e+1),this};T.ByteStringBuffer.prototype.last=function(){return this.data.charCodeAt(this.data.length-1)};T.ByteStringBuffer.prototype.copy=function(){var e=T.createBuffer(this.data);return e.read=this.read,e};T.ByteStringBuffer.prototype.compact=function(){if(this.read>0)this.data=this.data.slice(this.read),this.read=0;return this};T.ByteStringBuffer.prototype.clear=function(){return this.data="",this.read=0,this};T.ByteStringBuffer.prototype.truncate=function(e){var t=Math.max(0,this.length()-e);return this.data=this.data.substr(this.read,t),this.read=0,this};T.ByteStringBuffer.prototype.toHex=function(){var e="";for(var t=this.read;t<this.data.length;++t){var n=this.data.charCodeAt(t);if(n<16)e+="0";e+=n.toString(16)}return e};T.ByteStringBuffer.prototype.toString=function(){return T.decodeUtf8(this.bytes())};function o0(e,t){t=t||{},this.read=t.readOffset||0,this.growSize=t.growSize||1024;var n=T.isArrayBuffer(e),r=T.isArrayBufferView(e);if(n||r){if(n)this.data=new DataView(e);else this.data=new DataView(e.buffer,e.byteOffset,e.byteLength);this.write="writeOffset"in t?t.writeOffset:this.data.byteLength;return}if(this.data=new DataView(new ArrayBuffer(0)),this.write=0,e!==null&&e!==void 0)this.putBytes(e);if("writeOffset"in t)this.write=t.writeOffset}T.DataBuffer=o0;T.DataBuffer.prototype.length=function(){return this.write-this.read};T.DataBuffer.prototype.isEmpty=function(){return this.length()<=0};T.DataBuffer.prototype.accommodate=function(e,t){if(this.length()>=e)return this;t=Math.max(t||this.growSize,e);var n=new Uint8Array(this.data.buffer,this.data.byteOffset,this.data.byteLength),r=new Uint8Array(this.length()+t);return r.set(n),this.data=new DataView(r.buffer),this};T.DataBuffer.prototype.putByte=function(e){return this.accommodate(1),this.data.setUint8(this.write++,e),this};T.DataBuffer.prototype.fillWithByte=function(e,t){this.accommodate(t);for(var n=0;n<t;++n)this.data.setUint8(e);return this};T.DataBuffer.prototype.putBytes=function(e,t){if(T.isArrayBufferView(e)){var n=new Uint8Array(e.buffer,e.byteOffset,e.byteLength),r=n.byteLength-n.byteOffset;this.accommodate(r);var i=new Uint8Array(this.data.buffer,this.write);return i.set(n),this.write+=r,this}if(T.isArrayBuffer(e)){var n=new Uint8Array(e);this.accommodate(n.byteLength);var i=new Uint8Array(this.data.buffer);return i.set(n,this.write),this.write+=n.byteLength,this}if(e instanceof T.DataBuffer||typeof e==="object"&&typeof e.read==="number"&&typeof e.write==="number"&&T.isArrayBufferView(e.data)){var n=new Uint8Array(e.data.byteLength,e.read,e.length());this.accommodate(n.byteLength);var i=new Uint8Array(e.data.byteLength,this.write);return i.set(n),this.write+=n.byteLength,this}if(e instanceof T.ByteStringBuffer)e=e.data,t="binary";if(t=t||"binary",typeof e==="string"){var s;if(t==="hex")return this.accommodate(Math.ceil(e.length/2)),s=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.hex.decode(e,s,this.write),this;if(t==="base64")return this.accommodate(Math.ceil(e.length/4)*3),s=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.base64.decode(e,s,this.write),this;if(t==="utf8")e=T.encodeUtf8(e),t="binary";if(t==="binary"||t==="raw")return this.accommodate(e.length),s=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.raw.decode(s),this;if(t==="utf16")return this.accommodate(e.length*2),s=new Uint16Array(this.data.buffer,this.write),this.write+=T.text.utf16.encode(s),this;throw Error("Invalid encoding: "+t)}throw Error("Invalid parameter: "+e)};T.DataBuffer.prototype.putBuffer=function(e){return this.putBytes(e),e.clear(),this};T.DataBuffer.prototype.putString=function(e){return this.putBytes(e,"utf16")};T.DataBuffer.prototype.putInt16=function(e){return this.accommodate(2),this.data.setInt16(this.write,e),this.write+=2,this};T.DataBuffer.prototype.putInt24=function(e){return this.accommodate(3),this.data.setInt16(this.write,e>>8&65535),this.data.setInt8(this.write,e>>16&255),this.write+=3,this};T.DataBuffer.prototype.putInt32=function(e){return this.accommodate(4),this.data.setInt32(this.write,e),this.write+=4,this};T.DataBuffer.prototype.putInt16Le=function(e){return this.accommodate(2),this.data.setInt16(this.write,e,!0),this.write+=2,this};T.DataBuffer.prototype.putInt24Le=function(e){return this.accommodate(3),this.data.setInt8(this.write,e>>16&255),this.data.setInt16(this.write,e>>8&65535,!0),this.write+=3,this};T.DataBuffer.prototype.putInt32Le=function(e){return this.accommodate(4),this.data.setInt32(this.write,e,!0),this.write+=4,this};T.DataBuffer.prototype.putInt=function(e,t){fi(t),this.accommodate(t/8);do t-=8,this.data.setInt8(this.write++,e>>t&255);while(t>0);return this};T.DataBuffer.prototype.putSignedInt=function(e,t){if(fi(t),this.accommodate(t/8),e<0)e+=2<<t-1;return this.putInt(e,t)};T.DataBuffer.prototype.getByte=function(){return this.data.getInt8(this.read++)};T.DataBuffer.prototype.getInt16=function(){var e=this.data.getInt16(this.read);return this.read+=2,e};T.DataBuffer.prototype.getInt24=function(){var e=this.data.getInt16(this.read)<<8^this.data.getInt8(this.read+2);return this.read+=3,e};T.DataBuffer.prototype.getInt32=function(){var e=this.data.getInt32(this.read);return this.read+=4,e};T.DataBuffer.prototype.getInt16Le=function(){var e=this.data.getInt16(this.read,!0);return this.read+=2,e};T.DataBuffer.prototype.getInt24Le=function(){var e=this.data.getInt8(this.read)^this.data.getInt16(this.read+1,!0)<<8;return this.read+=3,e};T.DataBuffer.prototype.getInt32Le=function(){var e=this.data.getInt32(this.read,!0);return this.read+=4,e};T.DataBuffer.prototype.getInt=function(e){fi(e);var t=0;do t=(t<<8)+this.data.getInt8(this.read++),e-=8;while(e>0);return t};T.DataBuffer.prototype.getSignedInt=function(e){var t=this.getInt(e),n=2<<e-2;if(t>=n)t-=n<<1;return t};T.DataBuffer.prototype.getBytes=function(e){var t;if(e)e=Math.min(this.length(),e),t=this.data.slice(this.read,this.read+e),this.read+=e;else if(e===0)t="";else t=this.read===0?this.data:this.data.slice(this.read),this.clear();return t};T.DataBuffer.prototype.bytes=function(e){return typeof e>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+e)};T.DataBuffer.prototype.at=function(e){return this.data.getUint8(this.read+e)};T.DataBuffer.prototype.setAt=function(e,t){return this.data.setUint8(e,t),this};T.DataBuffer.prototype.last=function(){return this.data.getUint8(this.write-1)};T.DataBuffer.prototype.copy=function(){return new T.DataBuffer(this)};T.DataBuffer.prototype.compact=function(){if(this.read>0){var e=new Uint8Array(this.data.buffer,this.read),t=new Uint8Array(e.byteLength);t.set(e),this.data=new DataView(t),this.write-=this.read,this.read=0}return this};T.DataBuffer.prototype.clear=function(){return this.data=new DataView(new ArrayBuffer(0)),this.read=this.write=0,this};T.DataBuffer.prototype.truncate=function(e){return this.write=Math.max(0,this.length()-e),this.read=Math.min(this.read,this.write),this};T.DataBuffer.prototype.toHex=function(){var e="";for(var t=this.read;t<this.data.byteLength;++t){var n=this.data.getUint8(t);if(n<16)e+="0";e+=n.toString(16)}return e};T.DataBuffer.prototype.toString=function(e){var t=new Uint8Array(this.data,this.read,this.length());if(e=e||"utf8",e==="binary"||e==="raw")return T.binary.raw.encode(t);if(e==="hex")return T.binary.hex.encode(t);if(e==="base64")return T.binary.base64.encode(t);if(e==="utf8")return T.text.utf8.decode(t);if(e==="utf16")return T.text.utf16.decode(t);throw Error("Invalid encoding: "+e)};T.createBuffer=function(e,t){if(t=t||"raw",e!==void 0&&t==="utf8")e=T.encodeUtf8(e);return new T.ByteBuffer(e)};T.fillString=function(e,t){var n="";while(t>0){if(t&1)n+=e;if(t>>>=1,t>0)e+=e}return n};T.xorBytes=function(e,t,n){var r="",i="",s="",a=0,o=0;for(;n>0;--n,++a){if(i=e.charCodeAt(a)^t.charCodeAt(a),o>=10)r+=s,s="",o=0;s+=String.fromCharCode(i),++o}return r+=s,r};T.hexToBytes=function(e){var t="",n=0;if(e.length&!0)n=1,t+=String.fromCharCode(parseInt(e[0],16));for(;n<e.length;n+=2)t+=String.fromCharCode(parseInt(e.substr(n,2),16));return t};T.bytesToHex=function(e){return T.createBuffer(e).toHex()};T.int32ToBytes=function(e){return String.fromCharCode(e>>24&255)+String.fromCharCode(e>>16&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e&255)};var Br="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",Pr=[62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,64,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],Fc="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";T.encode64=function(e,t){var n="",r="",i,s,a,o=0;while(o<e.length){if(i=e.charCodeAt(o++),s=e.charCodeAt(o++),a=e.charCodeAt(o++),n+=Br.charAt(i>>2),n+=Br.charAt((i&3)<<4|s>>4),isNaN(s))n+="==";else n+=Br.charAt((s&15)<<2|a>>6),n+=isNaN(a)?"=":Br.charAt(a&63);if(t&&n.length>t)r+=n.substr(0,t)+`\r
4
- `,n=n.substr(t)}return r+=n,r};T.decode64=function(e){e=e.replace(/[^A-Za-z0-9\+\/\=]/g,"");var t="",n,r,i,s,a=0;while(a<e.length)if(n=Pr[e.charCodeAt(a++)-43],r=Pr[e.charCodeAt(a++)-43],i=Pr[e.charCodeAt(a++)-43],s=Pr[e.charCodeAt(a++)-43],t+=String.fromCharCode(n<<2|r>>4),i!==64){if(t+=String.fromCharCode((r&15)<<4|i>>2),s!==64)t+=String.fromCharCode((i&3)<<6|s)}return t};T.encodeUtf8=function(e){return unescape(encodeURIComponent(e))};T.decodeUtf8=function(e){return decodeURIComponent(escape(e))};T.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:Vc.encode,decode:Vc.decode}};T.binary.raw.encode=function(e){return String.fromCharCode.apply(null,e)};T.binary.raw.decode=function(e,t,n){var r=t;if(!r)r=new Uint8Array(e.length);n=n||0;var i=n;for(var s=0;s<e.length;++s)r[i++]=e.charCodeAt(s);return t?i-n:r};T.binary.hex.encode=T.bytesToHex;T.binary.hex.decode=function(e,t,n){var r=t;if(!r)r=new Uint8Array(Math.ceil(e.length/2));n=n||0;var i=0,s=n;if(e.length&1)i=1,r[s++]=parseInt(e[0],16);for(;i<e.length;i+=2)r[s++]=parseInt(e.substr(i,2),16);return t?s-n:r};T.binary.base64.encode=function(e,t){var n="",r="",i,s,a,o=0;while(o<e.byteLength){if(i=e[o++],s=e[o++],a=e[o++],n+=Br.charAt(i>>2),n+=Br.charAt((i&3)<<4|s>>4),isNaN(s))n+="==";else n+=Br.charAt((s&15)<<2|a>>6),n+=isNaN(a)?"=":Br.charAt(a&63);if(t&&n.length>t)r+=n.substr(0,t)+`\r
5
- `,n=n.substr(t)}return r+=n,r};T.binary.base64.decode=function(e,t,n){var r=t;if(!r)r=new Uint8Array(Math.ceil(e.length/4)*3);e=e.replace(/[^A-Za-z0-9\+\/\=]/g,""),n=n||0;var i,s,a,o,l=0,c=n;while(l<e.length)if(i=Pr[e.charCodeAt(l++)-43],s=Pr[e.charCodeAt(l++)-43],a=Pr[e.charCodeAt(l++)-43],o=Pr[e.charCodeAt(l++)-43],r[c++]=i<<2|s>>4,a!==64){if(r[c++]=(s&15)<<4|a>>2,o!==64)r[c++]=(a&3)<<6|o}return t?c-n:r.subarray(0,c)};T.binary.base58.encode=function(e,t){return T.binary.baseN.encode(e,Fc,t)};T.binary.base58.decode=function(e,t){return T.binary.baseN.decode(e,Fc,t)};T.text={utf8:{},utf16:{}};T.text.utf8.encode=function(e,t,n){e=T.encodeUtf8(e);var r=t;if(!r)r=new Uint8Array(e.length);n=n||0;var i=n;for(var s=0;s<e.length;++s)r[i++]=e.charCodeAt(s);return t?i-n:r};T.text.utf8.decode=function(e){return T.decodeUtf8(String.fromCharCode.apply(null,e))};T.text.utf16.encode=function(e,t,n){var r=t;if(!r)r=new Uint8Array(e.length*2);var i=new Uint16Array(r.buffer);n=n||0;var s=n,a=n;for(var o=0;o<e.length;++o)i[a++]=e.charCodeAt(o),s+=2;return t?s-n:r};T.text.utf16.decode=function(e){return String.fromCharCode.apply(null,new Uint16Array(e.buffer))};T.deflate=function(e,t,n){if(t=T.decode64(e.deflate(T.encode64(t)).rval),n){var r=2,i=t.charCodeAt(1);if(i&32)r=6;t=t.substring(r,t.length-4)}return t};T.inflate=function(e,t,n){var r=e.inflate(T.encode64(t)).rval;return r===null?null:T.decode64(r)};var Ya=function(e,t,n){if(!e)throw Error("WebStorage not available.");var r;if(n===null)r=e.removeItem(t);else n=T.encode64(JSON.stringify(n)),r=e.setItem(t,n);if(typeof r<"u"&&r.rval!==!0){var i=Error(r.error.message);throw i.id=r.error.id,i.name=r.error.name,i}},Ja=function(e,t){if(!e)throw Error("WebStorage not available.");var n=e.getItem(t);if(e.init)if(n.rval===null){if(n.error){var r=Error(n.error.message);throw r.id=n.error.id,r.name=n.error.name,r}n=null}else n=n.rval;if(n!==null)n=JSON.parse(T.decode64(n));return n},l0=function(e,t,n,r){var i=Ja(e,t);if(i===null)i={};i[n]=r,Ya(e,t,i)},c0=function(e,t,n){var r=Ja(e,t);if(r!==null)r=n in r?r[n]:null;return r},u0=function(e,t,n){var r=Ja(e,t);if(r!==null&&n in r){delete r[n];var i=!0;for(var s in r){i=!1;break}if(i)r=null;Ya(e,t,r)}},d0=function(e,t){Ya(e,t,null)},vs=function(e,t,n){var r=null;if(typeof n>"u")n=["web","flash"];var i,s=!1,a=null;for(var o in n){i=n[o];try{if(i==="flash"||i==="both"){if(t[0]===null)throw Error("Flash local storage not available.");r=e.apply(this,t),s=i==="flash"}if(i==="web"||i==="both")t[0]=localStorage,r=e.apply(this,t),s=!0}catch(l){a=l}if(s)break}if(!s)throw a;return r};T.setItem=function(e,t,n,r,i){vs(l0,arguments,i)};T.getItem=function(e,t,n,r){return vs(c0,arguments,r)};T.removeItem=function(e,t,n,r){vs(u0,arguments,r)};T.clearItems=function(e,t,n){vs(d0,arguments,n)};T.isEmpty=function(e){for(var t in e)if(e.hasOwnProperty(t))return!1;return!0};T.format=function(e){var t=/%./g,n,r,i=0,s=[],a=0;while(n=t.exec(e)){if(r=e.substring(a,t.lastIndex-2),r.length>0)s.push(r);a=t.lastIndex;var o=n[0][1];switch(o){case"s":case"o":if(i<arguments.length)s.push(arguments[i+++1]);else s.push("<?>");break;case"%":s.push("%");break;default:s.push("<%"+o+"?>")}}return s.push(e.substring(a)),s.join("")};T.formatNumber=function(e,t,n,r){var i=e,s=isNaN(t=Math.abs(t))?2:t,a=n===void 0?",":n,o=r===void 0?".":r,l=i<0?"-":"",c=parseInt(i=Math.abs(+i||0).toFixed(s),10)+"",u=c.length>3?c.length%3:0;return l+(u?c.substr(0,u)+o:"")+c.substr(u).replace(/(\d{3})(?=\d)/g,"$1"+o)+(s?a+Math.abs(i-c).toFixed(s).slice(2):"")};T.formatSize=function(e){if(e>=1073741824)e=T.formatNumber(e/1073741824,2,".","")+" GiB";else if(e>=1048576)e=T.formatNumber(e/1048576,2,".","")+" MiB";else if(e>=1024)e=T.formatNumber(e/1024,0)+" KiB";else e=T.formatNumber(e,0)+" bytes";return e};T.bytesFromIP=function(e){if(e.indexOf(".")!==-1)return T.bytesFromIPv4(e);if(e.indexOf(":")!==-1)return T.bytesFromIPv6(e);return null};T.bytesFromIPv4=function(e){if(e=e.split("."),e.length!==4)return null;var t=T.createBuffer();for(var n=0;n<e.length;++n){var r=parseInt(e[n],10);if(isNaN(r))return null;t.putByte(r)}return t.getBytes()};T.bytesFromIPv6=function(e){var t=0;e=e.split(":").filter(function(a){if(a.length===0)++t;return!0});var n=(8-e.length+t)*2,r=T.createBuffer();for(var i=0;i<8;++i){if(!e[i]||e[i].length===0){r.fillWithByte(0,n),n=0;continue}var s=T.hexToBytes(e[i]);if(s.length<2)r.putByte(0);r.putBytes(s)}return r.getBytes()};T.bytesToIP=function(e){if(e.length===4)return T.bytesToIPv4(e);if(e.length===16)return T.bytesToIPv6(e);return null};T.bytesToIPv4=function(e){if(e.length!==4)return null;var t=[];for(var n=0;n<e.length;++n)t.push(e.charCodeAt(n));return t.join(".")};T.bytesToIPv6=function(e){if(e.length!==16)return null;var t=[],n=[],r=0;for(var i=0;i<e.length;i+=2){var s=T.bytesToHex(e[i]+e[i+1]);while(s[0]==="0"&&s!=="0")s=s.substr(1);if(s==="0"){var a=n[n.length-1],o=t.length;if(!a||o!==a.end+1)n.push({start:o,end:o});else if(a.end=o,a.end-a.start>n[r].end-n[r].start)r=n.length-1}t.push(s)}if(n.length>0){var l=n[r];if(l.end-l.start>0){if(t.splice(l.start,l.end-l.start+1,""),l.start===0)t.unshift("");if(l.end===7)t.push("")}}return t.join(":")};T.estimateCores=function(e,t){if(typeof e==="function")t=e,e={};if(e=e||{},"cores"in T&&!e.update)return t(null,T.cores);if(typeof navigator<"u"&&"hardwareConcurrency"in navigator&&navigator.hardwareConcurrency>0)return T.cores=navigator.hardwareConcurrency,t(null,T.cores);if(typeof Worker>"u")return T.cores=1,t(null,T.cores);if(typeof Blob>"u")return T.cores=2,t(null,T.cores);var n=URL.createObjectURL(new Blob(["(",function(){self.addEventListener("message",function(a){var o=Date.now(),l=o+4;while(Date.now()<l);self.postMessage({st:o,et:l})})}.toString(),")()"],{type:"application/javascript"}));r([],5,16);function r(a,o,l){if(o===0){var c=Math.floor(a.reduce(function(u,d){return u+d},0)/a.length);return T.cores=Math.max(1,c),URL.revokeObjectURL(n),t(null,T.cores)}i(l,function(u,d){a.push(s(l,d)),r(a,o-1,l)})}function i(a,o){var l=[],c=[];for(var u=0;u<a;++u){var d=new Worker(n);d.addEventListener("message",function(f){if(c.push(f.data),c.length===a){for(var y=0;y<a;++y)l[y].terminate();o(null,c)}}),l.push(d)}for(var u=0;u<a;++u)l[u].postMessage(u)}function s(a,o){var l=[];for(var c=0;c<a;++c){var u=o[c],d=l[c]=[];for(var f=0;f<a;++f){if(c===f)continue;var y=o[f];if(u.st>y.st&&u.st<y.et||y.st>u.st&&y.st<u.et)d.push(f)}}return l.reduce(function(p,v){return Math.max(p,v.length)},0)}}});var xs=fe(function(OC,Wc){var ut=me();Be();Wc.exports=ut.cipher=ut.cipher||{};ut.cipher.algorithms=ut.cipher.algorithms||{};ut.cipher.createCipher=function(e,t){var n=e;if(typeof n==="string"){if(n=ut.cipher.getAlgorithm(n),n)n=n()}if(!n)throw Error("Unsupported algorithm: "+e);return new ut.cipher.BlockCipher({algorithm:n,key:t,decrypt:!1})};ut.cipher.createDecipher=function(e,t){var n=e;if(typeof n==="string"){if(n=ut.cipher.getAlgorithm(n),n)n=n()}if(!n)throw Error("Unsupported algorithm: "+e);return new ut.cipher.BlockCipher({algorithm:n,key:t,decrypt:!0})};ut.cipher.registerAlgorithm=function(e,t){e=e.toUpperCase(),ut.cipher.algorithms[e]=t};ut.cipher.getAlgorithm=function(e){if(e=e.toUpperCase(),e in ut.cipher.algorithms)return ut.cipher.algorithms[e];return null};var Za=ut.cipher.BlockCipher=function(e){this.algorithm=e.algorithm,this.mode=this.algorithm.mode,this.blockSize=this.mode.blockSize,this._finish=!1,this._input=null,this.output=null,this._op=e.decrypt?this.mode.decrypt:this.mode.encrypt,this._decrypt=e.decrypt,this.algorithm.initialize(e)};Za.prototype.start=function(e){e=e||{};var t={};for(var n in e)t[n]=e[n];t.decrypt=this._decrypt,this._finish=!1,this._input=ut.util.createBuffer(),this.output=e.output||ut.util.createBuffer(),this.mode.start(t)};Za.prototype.update=function(e){if(e)this._input.putBuffer(e);while(!this._op.call(this.mode,this._input,this.output,this._finish)&&!this._finish);this._input.compact()};Za.prototype.finish=function(e){if(e&&(this.mode.name==="ECB"||this.mode.name==="CBC"))this.mode.pad=function(n){return e(this.blockSize,n,!1)},this.mode.unpad=function(n){return e(this.blockSize,n,!0)};var t={};if(t.decrypt=this._decrypt,t.overflow=this._input.length()%this.blockSize,!this._decrypt&&this.mode.pad){if(!this.mode.pad(this._input,t))return!1}if(this._finish=!0,this.update(),this._decrypt&&this.mode.unpad){if(!this.mode.unpad(this.output,t))return!1}if(this.mode.afterFinish){if(!this.mode.afterFinish(this.output,t))return!1}return!0}});var to=fe(function(UC,$c){var dt=me();Be();dt.cipher=dt.cipher||{};var be=$c.exports=dt.cipher.modes=dt.cipher.modes||{};be.ecb=function(e){e=e||{},this.name="ECB",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};be.ecb.prototype.start=function(e){};be.ecb.prototype.encrypt=function(e,t,n){if(e.length()<this.blockSize&&!(n&&e.length()>0))return!0;for(var r=0;r<this._ints;++r)this._inBlock[r]=e.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var r=0;r<this._ints;++r)t.putInt32(this._outBlock[r])};be.ecb.prototype.decrypt=function(e,t,n){if(e.length()<this.blockSize&&!(n&&e.length()>0))return!0;for(var r=0;r<this._ints;++r)this._inBlock[r]=e.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var r=0;r<this._ints;++r)t.putInt32(this._outBlock[r])};be.ecb.prototype.pad=function(e,t){var n=e.length()===this.blockSize?this.blockSize:this.blockSize-e.length();return e.fillWithByte(n,n),!0};be.ecb.prototype.unpad=function(e,t){if(t.overflow>0)return!1;var n=e.length(),r=e.at(n-1);if(r>this.blockSize<<2)return!1;return e.truncate(r),!0};be.cbc=function(e){e=e||{},this.name="CBC",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};be.cbc.prototype.start=function(e){if(e.iv===null){if(!this._prev)throw Error("Invalid IV parameter.");this._iv=this._prev.slice(0)}else if(!("iv"in e))throw Error("Invalid IV parameter.");else this._iv=Ss(e.iv,this.blockSize),this._prev=this._iv.slice(0)};be.cbc.prototype.encrypt=function(e,t,n){if(e.length()<this.blockSize&&!(n&&e.length()>0))return!0;for(var r=0;r<this._ints;++r)this._inBlock[r]=this._prev[r]^e.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var r=0;r<this._ints;++r)t.putInt32(this._outBlock[r]);this._prev=this._outBlock};be.cbc.prototype.decrypt=function(e,t,n){if(e.length()<this.blockSize&&!(n&&e.length()>0))return!0;for(var r=0;r<this._ints;++r)this._inBlock[r]=e.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var r=0;r<this._ints;++r)t.putInt32(this._prev[r]^this._outBlock[r]);this._prev=this._inBlock.slice(0)};be.cbc.prototype.pad=function(e,t){var n=e.length()===this.blockSize?this.blockSize:this.blockSize-e.length();return e.fillWithByte(n,n),!0};be.cbc.prototype.unpad=function(e,t){if(t.overflow>0)return!1;var n=e.length(),r=e.at(n-1);if(r>this.blockSize<<2)return!1;return e.truncate(r),!0};be.cfb=function(e){e=e||{},this.name="CFB",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialBlock=Array(this._ints),this._partialOutput=dt.util.createBuffer(),this._partialBytes=0};be.cfb.prototype.start=function(e){if(!("iv"in e))throw Error("Invalid IV parameter.");this._iv=Ss(e.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};be.cfb.prototype.encrypt=function(e,t,n){var r=e.length();if(r===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize){for(var i=0;i<this._ints;++i)this._inBlock[i]=e.getInt32()^this._outBlock[i],t.putInt32(this._inBlock[i]);return}var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialBlock[i]=e.getInt32()^this._outBlock[i],this._partialOutput.putInt32(this._partialBlock[i]);if(s>0)e.read-=this.blockSize;else for(var i=0;i<this._ints;++i)this._inBlock[i]=this._partialBlock[i];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0};be.cfb.prototype.decrypt=function(e,t,n){var r=e.length();if(r===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize){for(var i=0;i<this._ints;++i)this._inBlock[i]=e.getInt32(),t.putInt32(this._inBlock[i]^this._outBlock[i]);return}var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialBlock[i]=e.getInt32(),this._partialOutput.putInt32(this._partialBlock[i]^this._outBlock[i]);if(s>0)e.read-=this.blockSize;else for(var i=0;i<this._ints;++i)this._inBlock[i]=this._partialBlock[i];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0};be.ofb=function(e){e=e||{},this.name="OFB",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=dt.util.createBuffer(),this._partialBytes=0};be.ofb.prototype.start=function(e){if(!("iv"in e))throw Error("Invalid IV parameter.");this._iv=Ss(e.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};be.ofb.prototype.encrypt=function(e,t,n){var r=e.length();if(e.length()===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize){for(var i=0;i<this._ints;++i)t.putInt32(e.getInt32()^this._outBlock[i]),this._inBlock[i]=this._outBlock[i];return}var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialOutput.putInt32(e.getInt32()^this._outBlock[i]);if(s>0)e.read-=this.blockSize;else for(var i=0;i<this._ints;++i)this._inBlock[i]=this._outBlock[i];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0};be.ofb.prototype.decrypt=be.ofb.prototype.encrypt;be.ctr=function(e){e=e||{},this.name="CTR",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=dt.util.createBuffer(),this._partialBytes=0};be.ctr.prototype.start=function(e){if(!("iv"in e))throw Error("Invalid IV parameter.");this._iv=Ss(e.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};be.ctr.prototype.encrypt=function(e,t,n){var r=e.length();if(r===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize)for(var i=0;i<this._ints;++i)t.putInt32(e.getInt32()^this._outBlock[i]);else{var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialOutput.putInt32(e.getInt32()^this._outBlock[i]);if(s>0)e.read-=this.blockSize;if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0}bs(this._inBlock)};be.ctr.prototype.decrypt=be.ctr.prototype.encrypt;be.gcm=function(e){e=e||{},this.name="GCM",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints),this._partialOutput=dt.util.createBuffer(),this._partialBytes=0,this._R=3774873600};be.gcm.prototype.start=function(e){if(!("iv"in e))throw Error("Invalid IV parameter.");var t=dt.util.createBuffer(e.iv);this._cipherLength=0;var n;if("additionalData"in e)n=dt.util.createBuffer(e.additionalData);else n=dt.util.createBuffer();if("tagLength"in e)this._tagLength=e.tagLength;else this._tagLength=128;if(this._tag=null,e.decrypt){if(this._tag=dt.util.createBuffer(e.tag).getBytes(),this._tag.length!==this._tagLength/8)throw Error("Authentication tag does not match tag length.")}this._hashBlock=Array(this._ints),this.tag=null,this._hashSubkey=Array(this._ints),this.cipher.encrypt([0,0,0,0],this._hashSubkey),this.componentBits=4,this._m=this.generateHashTable(this._hashSubkey,this.componentBits);var r=t.length();if(r===12)this._j0=[t.getInt32(),t.getInt32(),t.getInt32(),1];else{this._j0=[0,0,0,0];while(t.length()>0)this._j0=this.ghash(this._hashSubkey,this._j0,[t.getInt32(),t.getInt32(),t.getInt32(),t.getInt32()]);this._j0=this.ghash(this._hashSubkey,this._j0,[0,0].concat(eo(r*8)))}this._inBlock=this._j0.slice(0),bs(this._inBlock),this._partialBytes=0,n=dt.util.createBuffer(n),this._aDataLength=eo(n.length()*8);var i=n.length()%this.blockSize;if(i)n.fillWithByte(0,this.blockSize-i);this._s=[0,0,0,0];while(n.length()>0)this._s=this.ghash(this._hashSubkey,this._s,[n.getInt32(),n.getInt32(),n.getInt32(),n.getInt32()])};be.gcm.prototype.encrypt=function(e,t,n){var r=e.length();if(r===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize){for(var i=0;i<this._ints;++i)t.putInt32(this._outBlock[i]^=e.getInt32());this._cipherLength+=this.blockSize}else{var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialOutput.putInt32(e.getInt32()^this._outBlock[i]);if(s<=0||n){if(n){var a=r%this.blockSize;this._cipherLength+=a,this._partialOutput.truncate(this.blockSize-a)}else this._cipherLength+=this.blockSize;for(var i=0;i<this._ints;++i)this._outBlock[i]=this._partialOutput.getInt32();this._partialOutput.read-=this.blockSize}if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return e.read-=this.blockSize,t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0}this._s=this.ghash(this._hashSubkey,this._s,this._outBlock),bs(this._inBlock)};be.gcm.prototype.decrypt=function(e,t,n){var r=e.length();if(r<this.blockSize&&!(n&&r>0))return!0;this.cipher.encrypt(this._inBlock,this._outBlock),bs(this._inBlock),this._hashBlock[0]=e.getInt32(),this._hashBlock[1]=e.getInt32(),this._hashBlock[2]=e.getInt32(),this._hashBlock[3]=e.getInt32(),this._s=this.ghash(this._hashSubkey,this._s,this._hashBlock);for(var i=0;i<this._ints;++i)t.putInt32(this._outBlock[i]^this._hashBlock[i]);if(r<this.blockSize)this._cipherLength+=r%this.blockSize;else this._cipherLength+=this.blockSize};be.gcm.prototype.afterFinish=function(e,t){var n=!0;if(t.decrypt&&t.overflow)e.truncate(this.blockSize-t.overflow);this.tag=dt.util.createBuffer();var r=this._aDataLength.concat(eo(this._cipherLength*8));this._s=this.ghash(this._hashSubkey,this._s,r);var i=[];this.cipher.encrypt(this._j0,i);for(var s=0;s<this._ints;++s)this.tag.putInt32(this._s[s]^i[s]);if(this.tag.truncate(this.tag.length()%(this._tagLength/8)),t.decrypt&&this.tag.bytes()!==this._tag)n=!1;return n};be.gcm.prototype.multiply=function(e,t){var n=[0,0,0,0],r=t.slice(0);for(var i=0;i<128;++i){var s=e[i/32|0]&1<<31-i%32;if(s)n[0]^=r[0],n[1]^=r[1],n[2]^=r[2],n[3]^=r[3];this.pow(r,r)}return n};be.gcm.prototype.pow=function(e,t){var n=e[3]&1;for(var r=3;r>0;--r)t[r]=e[r]>>>1|(e[r-1]&1)<<31;if(t[0]=e[0]>>>1,n)t[0]^=this._R};be.gcm.prototype.tableMultiply=function(e){var t=[0,0,0,0];for(var n=0;n<32;++n){var r=n/8|0,i=e[r]>>>(7-n%8)*4&15,s=this._m[n][i];t[0]^=s[0],t[1]^=s[1],t[2]^=s[2],t[3]^=s[3]}return t};be.gcm.prototype.ghash=function(e,t,n){return t[0]^=n[0],t[1]^=n[1],t[2]^=n[2],t[3]^=n[3],this.tableMultiply(t)};be.gcm.prototype.generateHashTable=function(e,t){var n=8/t,r=4*n,i=16*n,s=Array(i);for(var a=0;a<i;++a){var o=[0,0,0,0],l=a/r|0,c=(r-1-a%r)*t;o[l]=1<<t-1<<c,s[a]=this.generateSubHashTable(this.multiply(o,e),t)}return s};be.gcm.prototype.generateSubHashTable=function(e,t){var n=1<<t,r=n>>>1,i=Array(n);i[r]=e.slice(0);var s=r>>>1;while(s>0)this.pow(i[2*s],i[s]=[]),s>>=1;s=2;while(s<r){for(var a=1;a<s;++a){var o=i[s],l=i[a];i[s+a]=[o[0]^l[0],o[1]^l[1],o[2]^l[2],o[3]^l[3]]}s*=2}i[0]=[0,0,0,0];for(s=r+1;s<n;++s){var c=i[s^r];i[s]=[e[0]^c[0],e[1]^c[1],e[2]^c[2],e[3]^c[3]]}return i};function Ss(e,t){if(typeof e==="string")e=dt.util.createBuffer(e);if(dt.util.isArray(e)&&e.length>4){var n=e;e=dt.util.createBuffer();for(var r=0;r<n.length;++r)e.putByte(n[r])}if(e.length()<t)throw Error("Invalid IV length; got "+e.length()+" bytes and expected "+t+" bytes.");if(!dt.util.isArray(e)){var i=[],s=t/4;for(var r=0;r<s;++r)i.push(e.getInt32());e=i}return e}function bs(e){e[e.length-1]=e[e.length-1]+1&4294967295}function eo(e){return[e/4294967296|0,e&4294967295]}});var Nr=fe(function(VC,Gc){var He=me();xs();to();Be();Gc.exports=He.aes=He.aes||{};He.aes.startEncrypting=function(e,t,n,r){var i=Cs({key:e,output:n,decrypt:!1,mode:r});return i.start(t),i};He.aes.createEncryptionCipher=function(e,t){return Cs({key:e,output:null,decrypt:!1,mode:t})};He.aes.startDecrypting=function(e,t,n,r){var i=Cs({key:e,output:n,decrypt:!0,mode:r});return i.start(t),i};He.aes.createDecryptionCipher=function(e,t){return Cs({key:e,output:null,decrypt:!0,mode:t})};He.aes.Algorithm=function(e,t){if(!io)Kc();var n=this;n.name=e,n.mode=new t({blockSize:16,cipher:{encrypt:function(r,i){return no(n._w,r,i,!1)},decrypt:function(r,i){return no(n._w,r,i,!0)}}}),n._init=!1};He.aes.Algorithm.prototype.initialize=function(e){if(this._init)return;var t=e.key,n;if(typeof t==="string"&&(t.length===16||t.length===24||t.length===32))t=He.util.createBuffer(t);else if(He.util.isArray(t)&&(t.length===16||t.length===24||t.length===32)){n=t,t=He.util.createBuffer();for(var r=0;r<n.length;++r)t.putByte(n[r])}if(!He.util.isArray(t)){n=t,t=[];var i=n.length();if(i===16||i===24||i===32){i=i>>>2;for(var r=0;r<i;++r)t.push(n.getInt32())}}if(!He.util.isArray(t)||!(t.length===4||t.length===6||t.length===8))throw Error("Invalid key parameter.");var s=this.mode.name,a=["CFB","OFB","CTR","GCM"].indexOf(s)!==-1;this._w=qc(t,e.decrypt&&!a),this._init=!0};He.aes._expandKey=function(e,t){if(!io)Kc();return qc(e,t)};He.aes._updateBlock=no;wn("AES-ECB",He.cipher.modes.ecb);wn("AES-CBC",He.cipher.modes.cbc);wn("AES-CFB",He.cipher.modes.cfb);wn("AES-OFB",He.cipher.modes.ofb);wn("AES-CTR",He.cipher.modes.ctr);wn("AES-GCM",He.cipher.modes.gcm);function wn(e,t){var n=function(){return new He.aes.Algorithm(e,t)};He.cipher.registerAlgorithm(e,n)}var io=!1,En=4,St,ro,Hc,rn,Ht;function Kc(){io=!0,Hc=[0,1,2,4,8,16,32,64,128,27,54];var e=Array(256);for(var t=0;t<128;++t)e[t]=t<<1,e[t+128]=t+128<<1^283;St=Array(256),ro=Array(256),rn=[,,,,],Ht=[,,,,];for(var t=0;t<4;++t)rn[t]=Array(256),Ht[t]=Array(256);var n=0,r=0,i,s,a,o,l,c,u;for(var t=0;t<256;++t){o=r^r<<1^r<<2^r<<3^r<<4,o=o>>8^o&255^99,St[n]=o,ro[o]=n,l=e[o],i=e[n],s=e[i],a=e[s],c=l<<24^o<<16^o<<8^(o^l),u=(i^s^a)<<24^(n^a)<<16^(n^s^a)<<8^(n^i^a);for(var d=0;d<4;++d)rn[d][n]=c,Ht[d][o]=u,c=c<<24|c>>>8,u=u<<24|u>>>8;if(n===0)n=r=1;else n=i^e[e[e[i^a]]],r^=e[e[r]]}}function qc(e,t){var n=e.slice(0),r,i=1,s=n.length,a=s+6+1,o=En*a;for(var l=s;l<o;++l){if(r=n[l-1],l%s===0)r=St[r>>>16&255]<<24^St[r>>>8&255]<<16^St[r&255]<<8^St[r>>>24]^Hc[i]<<24,i++;else if(s>6&&l%s===4)r=St[r>>>24]<<24^St[r>>>16&255]<<16^St[r>>>8&255]<<8^St[r&255];n[l]=n[l-s]^r}if(t){var c,u=Ht[0],d=Ht[1],f=Ht[2],y=Ht[3],p=n.slice(0);o=n.length;for(var l=0,v=o-En;l<o;l+=En,v-=En)if(l===0||l===o-En)p[l]=n[v],p[l+1]=n[v+3],p[l+2]=n[v+2],p[l+3]=n[v+1];else for(var x=0;x<En;++x)c=n[v+x],p[l+(3&-x)]=u[St[c>>>24]]^d[St[c>>>16&255]]^f[St[c>>>8&255]]^y[St[c&255]];n=p}return n}function no(e,t,n,r){var i=e.length/4-1,s,a,o,l,c;if(r)s=Ht[0],a=Ht[1],o=Ht[2],l=Ht[3],c=ro;else s=rn[0],a=rn[1],o=rn[2],l=rn[3],c=St;var u,d,f,y,p,v,x;u=t[0]^e[0],d=t[r?3:1]^e[1],f=t[2]^e[2],y=t[r?1:3]^e[3];var b=3;for(var A=1;A<i;++A)p=s[u>>>24]^a[d>>>16&255]^o[f>>>8&255]^l[y&255]^e[++b],v=s[d>>>24]^a[f>>>16&255]^o[y>>>8&255]^l[u&255]^e[++b],x=s[f>>>24]^a[y>>>16&255]^o[u>>>8&255]^l[d&255]^e[++b],y=s[y>>>24]^a[u>>>16&255]^o[d>>>8&255]^l[f&255]^e[++b],u=p,d=v,f=x;n[0]=c[u>>>24]<<24^c[d>>>16&255]<<16^c[f>>>8&255]<<8^c[y&255]^e[++b],n[r?3:1]=c[d>>>24]<<24^c[f>>>16&255]<<16^c[y>>>8&255]<<8^c[u&255]^e[++b],n[2]=c[f>>>24]<<24^c[y>>>16&255]<<16^c[u>>>8&255]<<8^c[d&255]^e[++b],n[r?1:3]=c[y>>>24]<<24^c[u>>>16&255]<<16^c[d>>>8&255]<<8^c[f&255]^e[++b]}function Cs(e){e=e||{};var t=(e.mode||"CBC").toUpperCase(),n="AES-"+t,r;if(e.decrypt)r=He.cipher.createDecipher(n,e.key);else r=He.cipher.createCipher(n,e.key);var i=r.start;return r.start=function(s,a){var o=null;if(a instanceof He.util.ByteBuffer)o=a,a={};a=a||{},a.output=o,a.iv=s,i.call(r,a)},r}});var Dr=fe(function(FC,jc){var pi=me();pi.pki=pi.pki||{};var so=jc.exports=pi.pki.oids=pi.oids=pi.oids||{};function U(e,t){so[e]=t,so[t]=e}function De(e,t){so[e]=t}U("1.2.840.113549.1.1.1","rsaEncryption");U("1.2.840.113549.1.1.4","md5WithRSAEncryption");U("1.2.840.113549.1.1.5","sha1WithRSAEncryption");U("1.2.840.113549.1.1.7","RSAES-OAEP");U("1.2.840.113549.1.1.8","mgf1");U("1.2.840.113549.1.1.9","pSpecified");U("1.2.840.113549.1.1.10","RSASSA-PSS");U("1.2.840.113549.1.1.11","sha256WithRSAEncryption");U("1.2.840.113549.1.1.12","sha384WithRSAEncryption");U("1.2.840.113549.1.1.13","sha512WithRSAEncryption");U("1.3.101.112","EdDSA25519");U("1.2.840.10040.4.3","dsa-with-sha1");U("1.3.14.3.2.7","desCBC");U("1.3.14.3.2.26","sha1");U("1.3.14.3.2.29","sha1WithRSASignature");U("2.16.840.1.101.3.4.2.1","sha256");U("2.16.840.1.101.3.4.2.2","sha384");U("2.16.840.1.101.3.4.2.3","sha512");U("2.16.840.1.101.3.4.2.4","sha224");U("2.16.840.1.101.3.4.2.5","sha512-224");U("2.16.840.1.101.3.4.2.6","sha512-256");U("1.2.840.113549.2.2","md2");U("1.2.840.113549.2.5","md5");U("1.2.840.113549.1.7.1","data");U("1.2.840.113549.1.7.2","signedData");U("1.2.840.113549.1.7.3","envelopedData");U("1.2.840.113549.1.7.4","signedAndEnvelopedData");U("1.2.840.113549.1.7.5","digestedData");U("1.2.840.113549.1.7.6","encryptedData");U("1.2.840.113549.1.9.1","emailAddress");U("1.2.840.113549.1.9.2","unstructuredName");U("1.2.840.113549.1.9.3","contentType");U("1.2.840.113549.1.9.4","messageDigest");U("1.2.840.113549.1.9.5","signingTime");U("1.2.840.113549.1.9.6","counterSignature");U("1.2.840.113549.1.9.7","challengePassword");U("1.2.840.113549.1.9.8","unstructuredAddress");U("1.2.840.113549.1.9.14","extensionRequest");U("1.2.840.113549.1.9.20","friendlyName");U("1.2.840.113549.1.9.21","localKeyId");U("1.2.840.113549.1.9.22.1","x509Certificate");U("1.2.840.113549.1.12.10.1.1","keyBag");U("1.2.840.113549.1.12.10.1.2","pkcs8ShroudedKeyBag");U("1.2.840.113549.1.12.10.1.3","certBag");U("1.2.840.113549.1.12.10.1.4","crlBag");U("1.2.840.113549.1.12.10.1.5","secretBag");U("1.2.840.113549.1.12.10.1.6","safeContentsBag");U("1.2.840.113549.1.5.13","pkcs5PBES2");U("1.2.840.113549.1.5.12","pkcs5PBKDF2");U("1.2.840.113549.1.12.1.1","pbeWithSHAAnd128BitRC4");U("1.2.840.113549.1.12.1.2","pbeWithSHAAnd40BitRC4");U("1.2.840.113549.1.12.1.3","pbeWithSHAAnd3-KeyTripleDES-CBC");U("1.2.840.113549.1.12.1.4","pbeWithSHAAnd2-KeyTripleDES-CBC");U("1.2.840.113549.1.12.1.5","pbeWithSHAAnd128BitRC2-CBC");U("1.2.840.113549.1.12.1.6","pbewithSHAAnd40BitRC2-CBC");U("1.2.840.113549.2.7","hmacWithSHA1");U("1.2.840.113549.2.8","hmacWithSHA224");U("1.2.840.113549.2.9","hmacWithSHA256");U("1.2.840.113549.2.10","hmacWithSHA384");U("1.2.840.113549.2.11","hmacWithSHA512");U("1.2.840.113549.3.7","des-EDE3-CBC");U("2.16.840.1.101.3.4.1.2","aes128-CBC");U("2.16.840.1.101.3.4.1.22","aes192-CBC");U("2.16.840.1.101.3.4.1.42","aes256-CBC");U("2.5.4.3","commonName");U("2.5.4.4","surname");U("2.5.4.5","serialNumber");U("2.5.4.6","countryName");U("2.5.4.7","localityName");U("2.5.4.8","stateOrProvinceName");U("2.5.4.9","streetAddress");U("2.5.4.10","organizationName");U("2.5.4.11","organizationalUnitName");U("2.5.4.12","title");U("2.5.4.13","description");U("2.5.4.15","businessCategory");U("2.5.4.17","postalCode");U("2.5.4.42","givenName");U("2.5.4.65","pseudonym");U("1.3.6.1.4.1.311.60.2.1.2","jurisdictionOfIncorporationStateOrProvinceName");U("1.3.6.1.4.1.311.60.2.1.3","jurisdictionOfIncorporationCountryName");U("2.16.840.1.113730.1.1","nsCertType");U("2.16.840.1.113730.1.13","nsComment");De("2.5.29.1","authorityKeyIdentifier");De("2.5.29.2","keyAttributes");De("2.5.29.3","certificatePolicies");De("2.5.29.4","keyUsageRestriction");De("2.5.29.5","policyMapping");De("2.5.29.6","subtreesConstraint");De("2.5.29.7","subjectAltName");De("2.5.29.8","issuerAltName");De("2.5.29.9","subjectDirectoryAttributes");De("2.5.29.10","basicConstraints");De("2.5.29.11","nameConstraints");De("2.5.29.12","policyConstraints");De("2.5.29.13","basicConstraints");U("2.5.29.14","subjectKeyIdentifier");U("2.5.29.15","keyUsage");De("2.5.29.16","privateKeyUsagePeriod");U("2.5.29.17","subjectAltName");U("2.5.29.18","issuerAltName");U("2.5.29.19","basicConstraints");De("2.5.29.20","cRLNumber");De("2.5.29.21","cRLReason");De("2.5.29.22","expirationDate");De("2.5.29.23","instructionCode");De("2.5.29.24","invalidityDate");De("2.5.29.25","cRLDistributionPoints");De("2.5.29.26","issuingDistributionPoint");De("2.5.29.27","deltaCRLIndicator");De("2.5.29.28","issuingDistributionPoint");De("2.5.29.29","certificateIssuer");De("2.5.29.30","nameConstraints");U("2.5.29.31","cRLDistributionPoints");U("2.5.29.32","certificatePolicies");De("2.5.29.33","policyMappings");De("2.5.29.34","policyConstraints");U("2.5.29.35","authorityKeyIdentifier");De("2.5.29.36","policyConstraints");U("2.5.29.37","extKeyUsage");De("2.5.29.46","freshestCRL");De("2.5.29.54","inhibitAnyPolicy");U("1.3.6.1.4.1.11129.2.4.2","timestampList");U("1.3.6.1.5.5.7.1.1","authorityInfoAccess");U("1.3.6.1.5.5.7.3.1","serverAuth");U("1.3.6.1.5.5.7.3.2","clientAuth");U("1.3.6.1.5.5.7.3.3","codeSigning");U("1.3.6.1.5.5.7.3.4","emailProtection");U("1.3.6.1.5.5.7.3.8","timeStamping")});var Kt=fe(function(MC,Qc){var Ge=me();Be();Dr();var H=Qc.exports=Ge.asn1=Ge.asn1||{};H.Class={UNIVERSAL:0,APPLICATION:64,CONTEXT_SPECIFIC:128,PRIVATE:192};H.Type={NONE:0,BOOLEAN:1,INTEGER:2,BITSTRING:3,OCTETSTRING:4,NULL:5,OID:6,ODESC:7,EXTERNAL:8,REAL:9,ENUMERATED:10,EMBEDDED:11,UTF8:12,ROID:13,SEQUENCE:16,SET:17,PRINTABLESTRING:19,IA5STRING:22,UTCTIME:23,GENERALIZEDTIME:24,BMPSTRING:30};H.maxDepth=256;H.create=function(e,t,n,r,i){if(Ge.util.isArray(r)){var s=[];for(var a=0;a<r.length;++a)if(r[a]!==void 0)s.push(r[a]);r=s}var o={tagClass:e,type:t,constructed:n,composed:n||Ge.util.isArray(r),value:r};if(i&&"bitStringContents"in i)o.bitStringContents=i.bitStringContents,o.original=H.copy(o);return o};H.copy=function(e,t){var n;if(Ge.util.isArray(e)){n=[];for(var r=0;r<e.length;++r)n.push(H.copy(e[r],t));return n}if(typeof e==="string")return e;if(n={tagClass:e.tagClass,type:e.type,constructed:e.constructed,composed:e.composed,value:H.copy(e.value,t)},t&&!t.excludeBitStringContents)n.bitStringContents=e.bitStringContents;return n};H.equals=function(e,t,n){if(Ge.util.isArray(e)){if(!Ge.util.isArray(t))return!1;if(e.length!==t.length)return!1;for(var r=0;r<e.length;++r)if(!H.equals(e[r],t[r]))return!1;return!0}if(typeof e!==typeof t)return!1;if(typeof e==="string")return e===t;var i=e.tagClass===t.tagClass&&e.type===t.type&&e.constructed===t.constructed&&e.composed===t.composed&&H.equals(e.value,t.value);if(n&&n.includeBitStringContents)i=i&&e.bitStringContents===t.bitStringContents;return i};H.getBerValueLength=function(e){var t=e.getByte();if(t===128)return;var n,r=t&128;if(!r)n=t;else n=e.getInt((t&127)<<3);return n};function hi(e,t,n){if(n>t){var r=Error("Too few bytes to parse DER.");throw r.available=e.length(),r.remaining=t,r.requested=n,r}}var f0=function(e,t){var n=e.getByte();if(t--,n===128)return;var r,i=n&128;if(!i)r=n;else{var s=n&127;hi(e,t,s),r=e.getInt(s<<3)}if(r<0)throw Error("Negative length: "+r);return r};H.fromDer=function(e,t){if(t===void 0)t={strict:!0,parseAllBytes:!0,decodeBitStrings:!0};if(typeof t==="boolean")t={strict:t,parseAllBytes:!0,decodeBitStrings:!0};if(!("strict"in t))t.strict=!0;if(!("parseAllBytes"in t))t.parseAllBytes=!0;if(!("decodeBitStrings"in t))t.decodeBitStrings=!0;if(!("maxDepth"in t))t.maxDepth=H.maxDepth;if(typeof e==="string")e=Ge.util.createBuffer(e);var n=e.length(),r=Es(e,e.length(),0,t);if(t.parseAllBytes&&e.length()!==0){var i=Error("Unparsed DER bytes remain after ASN.1 parsing.");throw i.byteCount=n,i.remaining=e.length(),i}return r};function Es(e,t,n,r){if(n>=r.maxDepth)throw Error("ASN.1 parsing error: Max depth exceeded.");var i;hi(e,t,2);var s=e.getByte();t--;var a=s&192,o=s&31;i=e.length();var l=f0(e,t);if(t-=i-e.length(),l!==void 0&&l>t){if(r.strict){var c=Error("Too few bytes to read ASN.1 value.");throw c.available=e.length(),c.remaining=t,c.requested=l,c}l=t}var u,d,f=(s&32)===32;if(f)if(u=[],l===void 0)for(;;){if(hi(e,t,2),e.bytes(2)===String.fromCharCode(0,0)){e.getBytes(2),t-=2;break}i=e.length(),u.push(Es(e,t,n+1,r)),t-=i-e.length()}else while(l>0)i=e.length(),u.push(Es(e,l,n+1,r)),t-=i-e.length(),l-=i-e.length();if(u===void 0&&a===H.Class.UNIVERSAL&&o===H.Type.BITSTRING)d=e.bytes(l);if(u===void 0&&r.decodeBitStrings&&a===H.Class.UNIVERSAL&&o===H.Type.BITSTRING&&l>1){var y=e.read,p=t,v=0;if(o===H.Type.BITSTRING)hi(e,t,1),v=e.getByte(),t--;if(v===0)try{i=e.length();var x={strict:!0,decodeBitStrings:!0},b=Es(e,t,n+1,x),A=i-e.length();if(t-=A,o==H.Type.BITSTRING)A++;var E=b.tagClass;if(A===l&&(E===H.Class.UNIVERSAL||E===H.Class.CONTEXT_SPECIFIC))u=[b]}catch(I){}if(u===void 0)e.read=y,t=p}if(u===void 0){if(l===void 0){if(r.strict)throw Error("Non-constructed ASN.1 object of indefinite length.");l=t}if(o===H.Type.BMPSTRING){u="";for(;l>0;l-=2)hi(e,t,2),u+=String.fromCharCode(e.getInt16()),t-=2}else u=e.getBytes(l),t-=l}var k=d===void 0?null:{bitStringContents:d};return H.create(a,o,f,u,k)}H.toDer=function(e){var t=Ge.util.createBuffer(),n=e.tagClass|e.type,r=Ge.util.createBuffer(),i=!1;if("bitStringContents"in e){if(i=!0,e.original)i=H.equals(e,e.original)}if(i)r.putBytes(e.bitStringContents);else if(e.composed){if(e.constructed)n|=32;else r.putByte(0);for(var s=0;s<e.value.length;++s)if(e.value[s]!==void 0)r.putBuffer(H.toDer(e.value[s]))}else if(e.type===H.Type.BMPSTRING)for(var s=0;s<e.value.length;++s)r.putInt16(e.value.charCodeAt(s));else if(e.type===H.Type.INTEGER&&e.value.length>1&&(e.value.charCodeAt(0)===0&&(e.value.charCodeAt(1)&128)===0||e.value.charCodeAt(0)===255&&(e.value.charCodeAt(1)&128)===128))r.putBytes(e.value.substr(1));else r.putBytes(e.value);if(t.putByte(n),r.length()<=127)t.putByte(r.length()&127);else{var a=r.length(),o="";do o+=String.fromCharCode(a&255),a=a>>>8;while(a>0);t.putByte(o.length|128);for(var s=o.length-1;s>=0;--s)t.putByte(o.charCodeAt(s))}return t.putBuffer(r),t};H.oidToDer=function(e){var t=e.split("."),n=Ge.util.createBuffer();n.putByte(40*parseInt(t[0],10)+parseInt(t[1],10));var r,i,s,a;for(var o=2;o<t.length;++o){if(r=!0,i=[],s=parseInt(t[o],10),s>4294967295)throw Error("OID value too large; max is 32-bits.");do{if(a=s&127,s=s>>>7,!r)a|=128;i.push(a),r=!1}while(s>0);for(var l=i.length-1;l>=0;--l)n.putByte(i[l])}return n};H.derToOid=function(e){var t;if(typeof e==="string")e=Ge.util.createBuffer(e);var n=e.getByte();t=Math.floor(n/40)+"."+n%40;var r=0;while(e.length()>0){if(r>70368744177663)throw Error("OID value too large; max is 53-bits.");if(n=e.getByte(),r=r*128,n&128)r+=n&127;else t+="."+(r+n),r=0}return t};H.utcTimeToDate=function(e){var t=new Date,n=parseInt(e.substr(0,2),10);n=n>=50?1900+n:2000+n;var r=parseInt(e.substr(2,2),10)-1,i=parseInt(e.substr(4,2),10),s=parseInt(e.substr(6,2),10),a=parseInt(e.substr(8,2),10),o=0;if(e.length>11){var l=e.charAt(10),c=10;if(l!=="+"&&l!=="-")o=parseInt(e.substr(10,2),10),c+=2}if(t.setUTCFullYear(n,r,i),t.setUTCHours(s,a,o,0),c){if(l=e.charAt(c),l==="+"||l==="-"){var u=parseInt(e.substr(c+1,2),10),d=parseInt(e.substr(c+4,2),10),f=u*60+d;if(f*=60000,l==="+")t.setTime(+t-f);else t.setTime(+t+f)}}return t};H.generalizedTimeToDate=function(e){var t=new Date,n=parseInt(e.substr(0,4),10),r=parseInt(e.substr(4,2),10)-1,i=parseInt(e.substr(6,2),10),s=parseInt(e.substr(8,2),10),a=parseInt(e.substr(10,2),10),o=parseInt(e.substr(12,2),10),l=0,c=0,u=!1;if(e.charAt(e.length-1)==="Z")u=!0;var d=e.length-5,f=e.charAt(d);if(f==="+"||f==="-"){var y=parseInt(e.substr(d+1,2),10),p=parseInt(e.substr(d+4,2),10);if(c=y*60+p,c*=60000,f==="+")c*=-1;u=!0}if(e.charAt(14)===".")l=parseFloat(e.substr(14),10)*1000;if(u)t.setUTCFullYear(n,r,i),t.setUTCHours(s,a,o,l),t.setTime(+t+c);else t.setFullYear(n,r,i),t.setHours(s,a,o,l);return t};H.dateToUtcTime=function(e){if(typeof e==="string")return e;var t="",n=[];n.push((""+e.getUTCFullYear()).substr(2)),n.push(""+(e.getUTCMonth()+1)),n.push(""+e.getUTCDate()),n.push(""+e.getUTCHours()),n.push(""+e.getUTCMinutes()),n.push(""+e.getUTCSeconds());for(var r=0;r<n.length;++r){if(n[r].length<2)t+="0";t+=n[r]}return t+="Z",t};H.dateToGeneralizedTime=function(e){if(typeof e==="string")return e;var t="",n=[];n.push(""+e.getUTCFullYear()),n.push(""+(e.getUTCMonth()+1)),n.push(""+e.getUTCDate()),n.push(""+e.getUTCHours()),n.push(""+e.getUTCMinutes()),n.push(""+e.getUTCSeconds());for(var r=0;r<n.length;++r){if(n[r].length<2)t+="0";t+=n[r]}return t+="Z",t};H.integerToDer=function(e){var t=Ge.util.createBuffer();if(e>=-128&&e<128)return t.putSignedInt(e,8);if(e>=-32768&&e<32768)return t.putSignedInt(e,16);if(e>=-8388608&&e<8388608)return t.putSignedInt(e,24);if(e>=-2147483648&&e<2147483648)return t.putSignedInt(e,32);var n=Error("Integer too large; max is 32-bits.");throw n.integer=e,n};H.derToInteger=function(e){if(typeof e==="string")e=Ge.util.createBuffer(e);var t=e.length()*8;if(t>32)throw Error("Integer too large; max is 32-bits.");return e.getSignedInt(t)};H.validate=function(e,t,n,r){var i=!1;if((e.tagClass===t.tagClass||typeof t.tagClass>"u")&&(e.type===t.type||typeof t.type>"u")){if(e.constructed===t.constructed||typeof t.constructed>"u"){if(i=!0,t.value&&Ge.util.isArray(t.value)){var s=0;for(var a=0;i&&a<t.value.length;++a){var o=t.value[a];i=!!o.optional;var l=e.value[s];if(!l){if(!o.optional){if(i=!1,r)r.push("["+t.name+'] Missing required element. Expected tag class "'+o.tagClass+'", type "'+o.type+'"')}continue}var c=typeof o.tagClass<"u"&&typeof o.type<"u";if(c&&(l.tagClass!==o.tagClass||l.type!==o.type))if(o.optional){i=!0;continue}else{if(i=!1,r)r.push("["+t.name+"] Tag mismatch. Expected ("+o.tagClass+","+o.type+"), got ("+l.tagClass+","+l.type+")");break}var u=H.validate(l,o,n,r);if(u)++s,i=!0;else if(o.optional)i=!0;else{i=!1;break}}}if(i&&n){if(t.capture)n[t.capture]=e.value;if(t.captureAsn1)n[t.captureAsn1]=e;if(t.captureBitStringContents&&"bitStringContents"in e)n[t.captureBitStringContents]=e.bitStringContents;if(t.captureBitStringValue&&"bitStringContents"in e){var d;if(e.bitStringContents.length<2)n[t.captureBitStringValue]="";else{var f=e.bitStringContents.charCodeAt(0);if(f!==0)throw Error("captureBitStringValue only supported for zero unused bits");n[t.captureBitStringValue]=e.bitStringContents.slice(1)}}}}else if(r)r.push("["+t.name+'] Expected constructed "'+t.constructed+'", got "'+e.constructed+'"')}else if(r){if(e.tagClass!==t.tagClass)r.push("["+t.name+'] Expected tag class "'+t.tagClass+'", got "'+e.tagClass+'"');if(e.type!==t.type)r.push("["+t.name+'] Expected type "'+t.type+'", got "'+e.type+'"')}return i};var zc=/[^\\u0000-\\u00ff]/;H.prettyPrint=function(e,t,n){var r="";if(t=t||0,n=n||2,t>0)r+=`
2
+ var zh=Object.create;var{getPrototypeOf:Qh,defineProperty:Ic,getOwnPropertyNames:Xh}=Object;var Rc=Object.prototype.hasOwnProperty;function Yh(e){return this[e]}var Jh,Zh,ja=(e,t,n)=>{var r=e!=null&&typeof e==="object";if(r){var i=t?Jh??=new WeakMap:Zh??=new WeakMap,s=i.get(e);if(s)return s}n=e!=null?zh(Qh(e)):{};let a=t||!e||!e.__esModule||!Rc.call(e,"default")?Ic(n,"default",{value:e,enumerable:!0}):n;if(e&&typeof e==="object"||typeof e==="function"){for(let o of Xh(e))if(!Rc.call(a,o))Ic(a,o,{get:Yh.bind(e,o),enumerable:!0})}if(r)i.set(e,a);return a};var fe=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var oi=import.meta.require;var me=fe(function(LC,Dc){Dc.exports={options:{usePureJavaScript:!1}}});var Uc=fe(function(OC,Oc){var Xa={};Oc.exports=Xa;var Lc={};Xa.encode=function(e,t,n){if(typeof t!=="string")throw TypeError('"alphabet" must be a string.');if(n!==void 0&&typeof n!=="number")throw TypeError('"maxline" must be a number.');var r="";if(!(e instanceof Uint8Array))r=o0(e,t);else{var i=0,s=t.length,a=t.charAt(0),o=[0];for(i=0;i<e.length;++i){for(var l=0,c=e[i];l<o.length;++l)c+=o[l]<<8,o[l]=c%s,c=c/s|0;while(c>0)o.push(c%s),c=c/s|0}for(i=0;e[i]===0&&i<e.length-1;++i)r+=a;for(i=o.length-1;i>=0;--i)r+=t[o[i]]}if(n){var u=new RegExp(".{1,"+n+"}","g");r=r.match(u).join(`\r
3
+ `)}return r};Xa.decode=function(e,t){if(typeof e!=="string")throw TypeError('"input" must be a string.');if(typeof t!=="string")throw TypeError('"alphabet" must be a string.');var n=Lc[t];if(!n){n=Lc[t]=[];for(var r=0;r<t.length;++r)n[t.charCodeAt(r)]=r}e=e.replace(/\s/g,"");var i=t.length,s=t.charAt(0),a=[0];for(var r=0;r<e.length;r++){var o=n[e.charCodeAt(r)];if(o===void 0)return;for(var l=0,c=o;l<a.length;++l)c+=a[l]*i,a[l]=c&255,c>>=8;while(c>0)a.push(c&255),c>>=8}for(var u=0;e[u]===s&&u<e.length-1;++u)a.push(0);if(typeof Buffer<"u")return Buffer.from(a.reverse());return new Uint8Array(a.reverse())};function o0(e,t){var n=0,r=t.length,i=t.charAt(0),s=[0];for(n=0;n<e.length();++n){for(var a=0,o=e.at(n);a<s.length;++a)o+=s[a]<<8,s[a]=o%r,o=o/r|0;while(o>0)s.push(o%r),o=o/r|0}var l="";for(n=0;e.at(n)===0&&n<e.length()-1;++n)l+=i;for(n=s.length-1;n>=0;--n)l+=t[s[n]];return l}});var Be=fe(function(UC,Wc){var Vc=me(),Fc=Uc(),T=Wc.exports=Vc.util=Vc.util||{};(function(){if(typeof process<"u"&&process.nextTick){if(T.nextTick=process.nextTick,typeof setImmediate==="function")T.setImmediate=setImmediate;else T.setImmediate=T.nextTick;return}if(typeof setImmediate==="function"){T.setImmediate=function(){return setImmediate.apply(void 0,arguments)},T.nextTick=function(o){return setImmediate(o)};return}if(T.setImmediate=function(o){setTimeout(o,0)},typeof window<"u"&&typeof window.postMessage==="function"){let o=function(l){if(l.source===window&&l.data===e){l.stopPropagation();var c=t.slice();t.length=0,c.forEach(function(u){u()})}};var a=o,e="forge.setImmediate",t=[];T.setImmediate=function(l){if(t.push(l),t.length===1)window.postMessage(e,"*")},window.addEventListener("message",o,!0)}if(typeof MutationObserver<"u"){var n=Date.now(),r=!0,i=document.createElement("div"),t=[];new MutationObserver(function(){var l=t.slice();t.length=0,l.forEach(function(c){c()})}).observe(i,{attributes:!0});var s=T.setImmediate;T.setImmediate=function(l){if(Date.now()-n>15)n=Date.now(),s(l);else if(t.push(l),t.length===1)i.setAttribute("a",r=!r)}}T.nextTick=T.setImmediate})();T.isNodejs=typeof process<"u"&&process.versions&&process.versions.node;T.globalScope=function(){if(T.isNodejs)return global;return typeof self>"u"?window:self}();T.isArray=Array.isArray||function(e){return Object.prototype.toString.call(e)==="[object Array]"};T.isArrayBuffer=function(e){return typeof ArrayBuffer<"u"&&e instanceof ArrayBuffer};T.isArrayBufferView=function(e){return e&&T.isArrayBuffer(e.buffer)&&e.byteLength!==void 0};function pi(e){if(!(e===8||e===16||e===24||e===32))throw Error("Only 8, 16, 24, or 32 bits supported: "+e)}T.ByteBuffer=Ya;function Ya(e){if(this.data="",this.read=0,typeof e==="string")this.data=e;else if(T.isArrayBuffer(e)||T.isArrayBufferView(e))if(typeof Buffer<"u"&&e instanceof Buffer)this.data=e.toString("binary");else{var t=new Uint8Array(e);try{this.data=String.fromCharCode.apply(null,t)}catch(r){for(var n=0;n<t.length;++n)this.putByte(t[n])}}else if(e instanceof Ya||typeof e==="object"&&typeof e.data==="string"&&typeof e.read==="number")this.data=e.data,this.read=e.read;this._constructedStringLength=0}T.ByteStringBuffer=Ya;var l0=4096;T.ByteStringBuffer.prototype._optimizeConstructedString=function(e){if(this._constructedStringLength+=e,this._constructedStringLength>l0)this.data.substr(0,1),this._constructedStringLength=0};T.ByteStringBuffer.prototype.length=function(){return this.data.length-this.read};T.ByteStringBuffer.prototype.isEmpty=function(){return this.length()<=0};T.ByteStringBuffer.prototype.putByte=function(e){return this.putBytes(String.fromCharCode(e))};T.ByteStringBuffer.prototype.fillWithByte=function(e,t){e=String.fromCharCode(e);var n=this.data;while(t>0){if(t&1)n+=e;if(t>>>=1,t>0)e+=e}return this.data=n,this._optimizeConstructedString(t),this};T.ByteStringBuffer.prototype.putBytes=function(e){return this.data+=e,this._optimizeConstructedString(e.length),this};T.ByteStringBuffer.prototype.putString=function(e){return this.putBytes(T.encodeUtf8(e))};T.ByteStringBuffer.prototype.putInt16=function(e){return this.putBytes(String.fromCharCode(e>>8&255)+String.fromCharCode(e&255))};T.ByteStringBuffer.prototype.putInt24=function(e){return this.putBytes(String.fromCharCode(e>>16&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e&255))};T.ByteStringBuffer.prototype.putInt32=function(e){return this.putBytes(String.fromCharCode(e>>24&255)+String.fromCharCode(e>>16&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e&255))};T.ByteStringBuffer.prototype.putInt16Le=function(e){return this.putBytes(String.fromCharCode(e&255)+String.fromCharCode(e>>8&255))};T.ByteStringBuffer.prototype.putInt24Le=function(e){return this.putBytes(String.fromCharCode(e&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e>>16&255))};T.ByteStringBuffer.prototype.putInt32Le=function(e){return this.putBytes(String.fromCharCode(e&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e>>16&255)+String.fromCharCode(e>>24&255))};T.ByteStringBuffer.prototype.putInt=function(e,t){pi(t);var n="";do t-=8,n+=String.fromCharCode(e>>t&255);while(t>0);return this.putBytes(n)};T.ByteStringBuffer.prototype.putSignedInt=function(e,t){if(e<0)e+=2<<t-1;return this.putInt(e,t)};T.ByteStringBuffer.prototype.putBuffer=function(e){return this.putBytes(e.getBytes())};T.ByteStringBuffer.prototype.getByte=function(){return this.data.charCodeAt(this.read++)};T.ByteStringBuffer.prototype.getInt16=function(){var e=this.data.charCodeAt(this.read)<<8^this.data.charCodeAt(this.read+1);return this.read+=2,e};T.ByteStringBuffer.prototype.getInt24=function(){var e=this.data.charCodeAt(this.read)<<16^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2);return this.read+=3,e};T.ByteStringBuffer.prototype.getInt32=function(){var e=this.data.charCodeAt(this.read)<<24^this.data.charCodeAt(this.read+1)<<16^this.data.charCodeAt(this.read+2)<<8^this.data.charCodeAt(this.read+3);return this.read+=4,e};T.ByteStringBuffer.prototype.getInt16Le=function(){var e=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8;return this.read+=2,e};T.ByteStringBuffer.prototype.getInt24Le=function(){var e=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16;return this.read+=3,e};T.ByteStringBuffer.prototype.getInt32Le=function(){var e=this.data.charCodeAt(this.read)^this.data.charCodeAt(this.read+1)<<8^this.data.charCodeAt(this.read+2)<<16^this.data.charCodeAt(this.read+3)<<24;return this.read+=4,e};T.ByteStringBuffer.prototype.getInt=function(e){pi(e);var t=0;do t=(t<<8)+this.data.charCodeAt(this.read++),e-=8;while(e>0);return t};T.ByteStringBuffer.prototype.getSignedInt=function(e){var t=this.getInt(e),n=2<<e-2;if(t>=n)t-=n<<1;return t};T.ByteStringBuffer.prototype.getBytes=function(e){var t;if(e)e=Math.min(this.length(),e),t=this.data.slice(this.read,this.read+e),this.read+=e;else if(e===0)t="";else t=this.read===0?this.data:this.data.slice(this.read),this.clear();return t};T.ByteStringBuffer.prototype.bytes=function(e){return typeof e>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+e)};T.ByteStringBuffer.prototype.at=function(e){return this.data.charCodeAt(this.read+e)};T.ByteStringBuffer.prototype.setAt=function(e,t){return this.data=this.data.substr(0,this.read+e)+String.fromCharCode(t)+this.data.substr(this.read+e+1),this};T.ByteStringBuffer.prototype.last=function(){return this.data.charCodeAt(this.data.length-1)};T.ByteStringBuffer.prototype.copy=function(){var e=T.createBuffer(this.data);return e.read=this.read,e};T.ByteStringBuffer.prototype.compact=function(){if(this.read>0)this.data=this.data.slice(this.read),this.read=0;return this};T.ByteStringBuffer.prototype.clear=function(){return this.data="",this.read=0,this};T.ByteStringBuffer.prototype.truncate=function(e){var t=Math.max(0,this.length()-e);return this.data=this.data.substr(this.read,t),this.read=0,this};T.ByteStringBuffer.prototype.toHex=function(){var e="";for(var t=this.read;t<this.data.length;++t){var n=this.data.charCodeAt(t);if(n<16)e+="0";e+=n.toString(16)}return e};T.ByteStringBuffer.prototype.toString=function(){return T.decodeUtf8(this.bytes())};function c0(e,t){t=t||{},this.read=t.readOffset||0,this.growSize=t.growSize||1024;var n=T.isArrayBuffer(e),r=T.isArrayBufferView(e);if(n||r){if(n)this.data=new DataView(e);else this.data=new DataView(e.buffer,e.byteOffset,e.byteLength);this.write="writeOffset"in t?t.writeOffset:this.data.byteLength;return}if(this.data=new DataView(new ArrayBuffer(0)),this.write=0,e!==null&&e!==void 0)this.putBytes(e);if("writeOffset"in t)this.write=t.writeOffset}T.DataBuffer=c0;T.DataBuffer.prototype.length=function(){return this.write-this.read};T.DataBuffer.prototype.isEmpty=function(){return this.length()<=0};T.DataBuffer.prototype.accommodate=function(e,t){if(this.length()>=e)return this;t=Math.max(t||this.growSize,e);var n=new Uint8Array(this.data.buffer,this.data.byteOffset,this.data.byteLength),r=new Uint8Array(this.length()+t);return r.set(n),this.data=new DataView(r.buffer),this};T.DataBuffer.prototype.putByte=function(e){return this.accommodate(1),this.data.setUint8(this.write++,e),this};T.DataBuffer.prototype.fillWithByte=function(e,t){this.accommodate(t);for(var n=0;n<t;++n)this.data.setUint8(e);return this};T.DataBuffer.prototype.putBytes=function(e,t){if(T.isArrayBufferView(e)){var n=new Uint8Array(e.buffer,e.byteOffset,e.byteLength),r=n.byteLength-n.byteOffset;this.accommodate(r);var i=new Uint8Array(this.data.buffer,this.write);return i.set(n),this.write+=r,this}if(T.isArrayBuffer(e)){var n=new Uint8Array(e);this.accommodate(n.byteLength);var i=new Uint8Array(this.data.buffer);return i.set(n,this.write),this.write+=n.byteLength,this}if(e instanceof T.DataBuffer||typeof e==="object"&&typeof e.read==="number"&&typeof e.write==="number"&&T.isArrayBufferView(e.data)){var n=new Uint8Array(e.data.byteLength,e.read,e.length());this.accommodate(n.byteLength);var i=new Uint8Array(e.data.byteLength,this.write);return i.set(n),this.write+=n.byteLength,this}if(e instanceof T.ByteStringBuffer)e=e.data,t="binary";if(t=t||"binary",typeof e==="string"){var s;if(t==="hex")return this.accommodate(Math.ceil(e.length/2)),s=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.hex.decode(e,s,this.write),this;if(t==="base64")return this.accommodate(Math.ceil(e.length/4)*3),s=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.base64.decode(e,s,this.write),this;if(t==="utf8")e=T.encodeUtf8(e),t="binary";if(t==="binary"||t==="raw")return this.accommodate(e.length),s=new Uint8Array(this.data.buffer,this.write),this.write+=T.binary.raw.decode(s),this;if(t==="utf16")return this.accommodate(e.length*2),s=new Uint16Array(this.data.buffer,this.write),this.write+=T.text.utf16.encode(s),this;throw Error("Invalid encoding: "+t)}throw Error("Invalid parameter: "+e)};T.DataBuffer.prototype.putBuffer=function(e){return this.putBytes(e),e.clear(),this};T.DataBuffer.prototype.putString=function(e){return this.putBytes(e,"utf16")};T.DataBuffer.prototype.putInt16=function(e){return this.accommodate(2),this.data.setInt16(this.write,e),this.write+=2,this};T.DataBuffer.prototype.putInt24=function(e){return this.accommodate(3),this.data.setInt16(this.write,e>>8&65535),this.data.setInt8(this.write,e>>16&255),this.write+=3,this};T.DataBuffer.prototype.putInt32=function(e){return this.accommodate(4),this.data.setInt32(this.write,e),this.write+=4,this};T.DataBuffer.prototype.putInt16Le=function(e){return this.accommodate(2),this.data.setInt16(this.write,e,!0),this.write+=2,this};T.DataBuffer.prototype.putInt24Le=function(e){return this.accommodate(3),this.data.setInt8(this.write,e>>16&255),this.data.setInt16(this.write,e>>8&65535,!0),this.write+=3,this};T.DataBuffer.prototype.putInt32Le=function(e){return this.accommodate(4),this.data.setInt32(this.write,e,!0),this.write+=4,this};T.DataBuffer.prototype.putInt=function(e,t){pi(t),this.accommodate(t/8);do t-=8,this.data.setInt8(this.write++,e>>t&255);while(t>0);return this};T.DataBuffer.prototype.putSignedInt=function(e,t){if(pi(t),this.accommodate(t/8),e<0)e+=2<<t-1;return this.putInt(e,t)};T.DataBuffer.prototype.getByte=function(){return this.data.getInt8(this.read++)};T.DataBuffer.prototype.getInt16=function(){var e=this.data.getInt16(this.read);return this.read+=2,e};T.DataBuffer.prototype.getInt24=function(){var e=this.data.getInt16(this.read)<<8^this.data.getInt8(this.read+2);return this.read+=3,e};T.DataBuffer.prototype.getInt32=function(){var e=this.data.getInt32(this.read);return this.read+=4,e};T.DataBuffer.prototype.getInt16Le=function(){var e=this.data.getInt16(this.read,!0);return this.read+=2,e};T.DataBuffer.prototype.getInt24Le=function(){var e=this.data.getInt8(this.read)^this.data.getInt16(this.read+1,!0)<<8;return this.read+=3,e};T.DataBuffer.prototype.getInt32Le=function(){var e=this.data.getInt32(this.read,!0);return this.read+=4,e};T.DataBuffer.prototype.getInt=function(e){pi(e);var t=0;do t=(t<<8)+this.data.getInt8(this.read++),e-=8;while(e>0);return t};T.DataBuffer.prototype.getSignedInt=function(e){var t=this.getInt(e),n=2<<e-2;if(t>=n)t-=n<<1;return t};T.DataBuffer.prototype.getBytes=function(e){var t;if(e)e=Math.min(this.length(),e),t=this.data.slice(this.read,this.read+e),this.read+=e;else if(e===0)t="";else t=this.read===0?this.data:this.data.slice(this.read),this.clear();return t};T.DataBuffer.prototype.bytes=function(e){return typeof e>"u"?this.data.slice(this.read):this.data.slice(this.read,this.read+e)};T.DataBuffer.prototype.at=function(e){return this.data.getUint8(this.read+e)};T.DataBuffer.prototype.setAt=function(e,t){return this.data.setUint8(e,t),this};T.DataBuffer.prototype.last=function(){return this.data.getUint8(this.write-1)};T.DataBuffer.prototype.copy=function(){return new T.DataBuffer(this)};T.DataBuffer.prototype.compact=function(){if(this.read>0){var e=new Uint8Array(this.data.buffer,this.read),t=new Uint8Array(e.byteLength);t.set(e),this.data=new DataView(t),this.write-=this.read,this.read=0}return this};T.DataBuffer.prototype.clear=function(){return this.data=new DataView(new ArrayBuffer(0)),this.read=this.write=0,this};T.DataBuffer.prototype.truncate=function(e){return this.write=Math.max(0,this.length()-e),this.read=Math.min(this.read,this.write),this};T.DataBuffer.prototype.toHex=function(){var e="";for(var t=this.read;t<this.data.byteLength;++t){var n=this.data.getUint8(t);if(n<16)e+="0";e+=n.toString(16)}return e};T.DataBuffer.prototype.toString=function(e){var t=new Uint8Array(this.data,this.read,this.length());if(e=e||"utf8",e==="binary"||e==="raw")return T.binary.raw.encode(t);if(e==="hex")return T.binary.hex.encode(t);if(e==="base64")return T.binary.base64.encode(t);if(e==="utf8")return T.text.utf8.decode(t);if(e==="utf16")return T.text.utf16.decode(t);throw Error("Invalid encoding: "+e)};T.createBuffer=function(e,t){if(t=t||"raw",e!==void 0&&t==="utf8")e=T.encodeUtf8(e);return new T.ByteBuffer(e)};T.fillString=function(e,t){var n="";while(t>0){if(t&1)n+=e;if(t>>>=1,t>0)e+=e}return n};T.xorBytes=function(e,t,n){var r="",i="",s="",a=0,o=0;for(;n>0;--n,++a){if(i=e.charCodeAt(a)^t.charCodeAt(a),o>=10)r+=s,s="",o=0;s+=String.fromCharCode(i),++o}return r+=s,r};T.hexToBytes=function(e){var t="",n=0;if(e.length&!0)n=1,t+=String.fromCharCode(parseInt(e[0],16));for(;n<e.length;n+=2)t+=String.fromCharCode(parseInt(e.substr(n,2),16));return t};T.bytesToHex=function(e){return T.createBuffer(e).toHex()};T.int32ToBytes=function(e){return String.fromCharCode(e>>24&255)+String.fromCharCode(e>>16&255)+String.fromCharCode(e>>8&255)+String.fromCharCode(e&255)};var Br="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",Pr=[62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,64,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],Mc="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";T.encode64=function(e,t){var n="",r="",i,s,a,o=0;while(o<e.length){if(i=e.charCodeAt(o++),s=e.charCodeAt(o++),a=e.charCodeAt(o++),n+=Br.charAt(i>>2),n+=Br.charAt((i&3)<<4|s>>4),isNaN(s))n+="==";else n+=Br.charAt((s&15)<<2|a>>6),n+=isNaN(a)?"=":Br.charAt(a&63);if(t&&n.length>t)r+=n.substr(0,t)+`\r
4
+ `,n=n.substr(t)}return r+=n,r};T.decode64=function(e){e=e.replace(/[^A-Za-z0-9\+\/\=]/g,"");var t="",n,r,i,s,a=0;while(a<e.length)if(n=Pr[e.charCodeAt(a++)-43],r=Pr[e.charCodeAt(a++)-43],i=Pr[e.charCodeAt(a++)-43],s=Pr[e.charCodeAt(a++)-43],t+=String.fromCharCode(n<<2|r>>4),i!==64){if(t+=String.fromCharCode((r&15)<<4|i>>2),s!==64)t+=String.fromCharCode((i&3)<<6|s)}return t};T.encodeUtf8=function(e){return unescape(encodeURIComponent(e))};T.decodeUtf8=function(e){return decodeURIComponent(escape(e))};T.binary={raw:{},hex:{},base64:{},base58:{},baseN:{encode:Fc.encode,decode:Fc.decode}};T.binary.raw.encode=function(e){return String.fromCharCode.apply(null,e)};T.binary.raw.decode=function(e,t,n){var r=t;if(!r)r=new Uint8Array(e.length);n=n||0;var i=n;for(var s=0;s<e.length;++s)r[i++]=e.charCodeAt(s);return t?i-n:r};T.binary.hex.encode=T.bytesToHex;T.binary.hex.decode=function(e,t,n){var r=t;if(!r)r=new Uint8Array(Math.ceil(e.length/2));n=n||0;var i=0,s=n;if(e.length&1)i=1,r[s++]=parseInt(e[0],16);for(;i<e.length;i+=2)r[s++]=parseInt(e.substr(i,2),16);return t?s-n:r};T.binary.base64.encode=function(e,t){var n="",r="",i,s,a,o=0;while(o<e.byteLength){if(i=e[o++],s=e[o++],a=e[o++],n+=Br.charAt(i>>2),n+=Br.charAt((i&3)<<4|s>>4),isNaN(s))n+="==";else n+=Br.charAt((s&15)<<2|a>>6),n+=isNaN(a)?"=":Br.charAt(a&63);if(t&&n.length>t)r+=n.substr(0,t)+`\r
5
+ `,n=n.substr(t)}return r+=n,r};T.binary.base64.decode=function(e,t,n){var r=t;if(!r)r=new Uint8Array(Math.ceil(e.length/4)*3);e=e.replace(/[^A-Za-z0-9\+\/\=]/g,""),n=n||0;var i,s,a,o,l=0,c=n;while(l<e.length)if(i=Pr[e.charCodeAt(l++)-43],s=Pr[e.charCodeAt(l++)-43],a=Pr[e.charCodeAt(l++)-43],o=Pr[e.charCodeAt(l++)-43],r[c++]=i<<2|s>>4,a!==64){if(r[c++]=(s&15)<<4|a>>2,o!==64)r[c++]=(a&3)<<6|o}return t?c-n:r.subarray(0,c)};T.binary.base58.encode=function(e,t){return T.binary.baseN.encode(e,Mc,t)};T.binary.base58.decode=function(e,t){return T.binary.baseN.decode(e,Mc,t)};T.text={utf8:{},utf16:{}};T.text.utf8.encode=function(e,t,n){e=T.encodeUtf8(e);var r=t;if(!r)r=new Uint8Array(e.length);n=n||0;var i=n;for(var s=0;s<e.length;++s)r[i++]=e.charCodeAt(s);return t?i-n:r};T.text.utf8.decode=function(e){return T.decodeUtf8(String.fromCharCode.apply(null,e))};T.text.utf16.encode=function(e,t,n){var r=t;if(!r)r=new Uint8Array(e.length*2);var i=new Uint16Array(r.buffer);n=n||0;var s=n,a=n;for(var o=0;o<e.length;++o)i[a++]=e.charCodeAt(o),s+=2;return t?s-n:r};T.text.utf16.decode=function(e){return String.fromCharCode.apply(null,new Uint16Array(e.buffer))};T.deflate=function(e,t,n){if(t=T.decode64(e.deflate(T.encode64(t)).rval),n){var r=2,i=t.charCodeAt(1);if(i&32)r=6;t=t.substring(r,t.length-4)}return t};T.inflate=function(e,t,n){var r=e.inflate(T.encode64(t)).rval;return r===null?null:T.decode64(r)};var Ja=function(e,t,n){if(!e)throw Error("WebStorage not available.");var r;if(n===null)r=e.removeItem(t);else n=T.encode64(JSON.stringify(n)),r=e.setItem(t,n);if(typeof r<"u"&&r.rval!==!0){var i=Error(r.error.message);throw i.id=r.error.id,i.name=r.error.name,i}},Za=function(e,t){if(!e)throw Error("WebStorage not available.");var n=e.getItem(t);if(e.init)if(n.rval===null){if(n.error){var r=Error(n.error.message);throw r.id=n.error.id,r.name=n.error.name,r}n=null}else n=n.rval;if(n!==null)n=JSON.parse(T.decode64(n));return n},u0=function(e,t,n,r){var i=Za(e,t);if(i===null)i={};i[n]=r,Ja(e,t,i)},d0=function(e,t,n){var r=Za(e,t);if(r!==null)r=n in r?r[n]:null;return r},f0=function(e,t,n){var r=Za(e,t);if(r!==null&&n in r){delete r[n];var i=!0;for(var s in r){i=!1;break}if(i)r=null;Ja(e,t,r)}},p0=function(e,t){Ja(e,t,null)},xs=function(e,t,n){var r=null;if(typeof n>"u")n=["web","flash"];var i,s=!1,a=null;for(var o in n){i=n[o];try{if(i==="flash"||i==="both"){if(t[0]===null)throw Error("Flash local storage not available.");r=e.apply(this,t),s=i==="flash"}if(i==="web"||i==="both")t[0]=localStorage,r=e.apply(this,t),s=!0}catch(l){a=l}if(s)break}if(!s)throw a;return r};T.setItem=function(e,t,n,r,i){xs(u0,arguments,i)};T.getItem=function(e,t,n,r){return xs(d0,arguments,r)};T.removeItem=function(e,t,n,r){xs(f0,arguments,r)};T.clearItems=function(e,t,n){xs(p0,arguments,n)};T.isEmpty=function(e){for(var t in e)if(e.hasOwnProperty(t))return!1;return!0};T.format=function(e){var t=/%./g,n,r,i=0,s=[],a=0;while(n=t.exec(e)){if(r=e.substring(a,t.lastIndex-2),r.length>0)s.push(r);a=t.lastIndex;var o=n[0][1];switch(o){case"s":case"o":if(i<arguments.length)s.push(arguments[i+++1]);else s.push("<?>");break;case"%":s.push("%");break;default:s.push("<%"+o+"?>")}}return s.push(e.substring(a)),s.join("")};T.formatNumber=function(e,t,n,r){var i=e,s=isNaN(t=Math.abs(t))?2:t,a=n===void 0?",":n,o=r===void 0?".":r,l=i<0?"-":"",c=parseInt(i=Math.abs(+i||0).toFixed(s),10)+"",u=c.length>3?c.length%3:0;return l+(u?c.substr(0,u)+o:"")+c.substr(u).replace(/(\d{3})(?=\d)/g,"$1"+o)+(s?a+Math.abs(i-c).toFixed(s).slice(2):"")};T.formatSize=function(e){if(e>=1073741824)e=T.formatNumber(e/1073741824,2,".","")+" GiB";else if(e>=1048576)e=T.formatNumber(e/1048576,2,".","")+" MiB";else if(e>=1024)e=T.formatNumber(e/1024,0)+" KiB";else e=T.formatNumber(e,0)+" bytes";return e};T.bytesFromIP=function(e){if(e.indexOf(".")!==-1)return T.bytesFromIPv4(e);if(e.indexOf(":")!==-1)return T.bytesFromIPv6(e);return null};T.bytesFromIPv4=function(e){if(e=e.split("."),e.length!==4)return null;var t=T.createBuffer();for(var n=0;n<e.length;++n){var r=parseInt(e[n],10);if(isNaN(r))return null;t.putByte(r)}return t.getBytes()};T.bytesFromIPv6=function(e){var t=0;e=e.split(":").filter(function(a){if(a.length===0)++t;return!0});var n=(8-e.length+t)*2,r=T.createBuffer();for(var i=0;i<8;++i){if(!e[i]||e[i].length===0){r.fillWithByte(0,n),n=0;continue}var s=T.hexToBytes(e[i]);if(s.length<2)r.putByte(0);r.putBytes(s)}return r.getBytes()};T.bytesToIP=function(e){if(e.length===4)return T.bytesToIPv4(e);if(e.length===16)return T.bytesToIPv6(e);return null};T.bytesToIPv4=function(e){if(e.length!==4)return null;var t=[];for(var n=0;n<e.length;++n)t.push(e.charCodeAt(n));return t.join(".")};T.bytesToIPv6=function(e){if(e.length!==16)return null;var t=[],n=[],r=0;for(var i=0;i<e.length;i+=2){var s=T.bytesToHex(e[i]+e[i+1]);while(s[0]==="0"&&s!=="0")s=s.substr(1);if(s==="0"){var a=n[n.length-1],o=t.length;if(!a||o!==a.end+1)n.push({start:o,end:o});else if(a.end=o,a.end-a.start>n[r].end-n[r].start)r=n.length-1}t.push(s)}if(n.length>0){var l=n[r];if(l.end-l.start>0){if(t.splice(l.start,l.end-l.start+1,""),l.start===0)t.unshift("");if(l.end===7)t.push("")}}return t.join(":")};T.estimateCores=function(e,t){if(typeof e==="function")t=e,e={};if(e=e||{},"cores"in T&&!e.update)return t(null,T.cores);if(typeof navigator<"u"&&"hardwareConcurrency"in navigator&&navigator.hardwareConcurrency>0)return T.cores=navigator.hardwareConcurrency,t(null,T.cores);if(typeof Worker>"u")return T.cores=1,t(null,T.cores);if(typeof Blob>"u")return T.cores=2,t(null,T.cores);var n=URL.createObjectURL(new Blob(["(",function(){self.addEventListener("message",function(a){var o=Date.now(),l=o+4;while(Date.now()<l);self.postMessage({st:o,et:l})})}.toString(),")()"],{type:"application/javascript"}));r([],5,16);function r(a,o,l){if(o===0){var c=Math.floor(a.reduce(function(u,d){return u+d},0)/a.length);return T.cores=Math.max(1,c),URL.revokeObjectURL(n),t(null,T.cores)}i(l,function(u,d){a.push(s(l,d)),r(a,o-1,l)})}function i(a,o){var l=[],c=[];for(var u=0;u<a;++u){var d=new Worker(n);d.addEventListener("message",function(f){if(c.push(f.data),c.length===a){for(var y=0;y<a;++y)l[y].terminate();o(null,c)}}),l.push(d)}for(var u=0;u<a;++u)l[u].postMessage(u)}function s(a,o){var l=[];for(var c=0;c<a;++c){var u=o[c],d=l[c]=[];for(var f=0;f<a;++f){if(c===f)continue;var y=o[f];if(u.st>y.st&&u.st<y.et||y.st>u.st&&y.st<u.et)d.push(f)}}return l.reduce(function(p,v){return Math.max(p,v.length)},0)}}});var Ss=fe(function(VC,$c){var ut=me();Be();$c.exports=ut.cipher=ut.cipher||{};ut.cipher.algorithms=ut.cipher.algorithms||{};ut.cipher.createCipher=function(e,t){var n=e;if(typeof n==="string"){if(n=ut.cipher.getAlgorithm(n),n)n=n()}if(!n)throw Error("Unsupported algorithm: "+e);return new ut.cipher.BlockCipher({algorithm:n,key:t,decrypt:!1})};ut.cipher.createDecipher=function(e,t){var n=e;if(typeof n==="string"){if(n=ut.cipher.getAlgorithm(n),n)n=n()}if(!n)throw Error("Unsupported algorithm: "+e);return new ut.cipher.BlockCipher({algorithm:n,key:t,decrypt:!0})};ut.cipher.registerAlgorithm=function(e,t){e=e.toUpperCase(),ut.cipher.algorithms[e]=t};ut.cipher.getAlgorithm=function(e){if(e=e.toUpperCase(),e in ut.cipher.algorithms)return ut.cipher.algorithms[e];return null};var eo=ut.cipher.BlockCipher=function(e){this.algorithm=e.algorithm,this.mode=this.algorithm.mode,this.blockSize=this.mode.blockSize,this._finish=!1,this._input=null,this.output=null,this._op=e.decrypt?this.mode.decrypt:this.mode.encrypt,this._decrypt=e.decrypt,this.algorithm.initialize(e)};eo.prototype.start=function(e){e=e||{};var t={};for(var n in e)t[n]=e[n];t.decrypt=this._decrypt,this._finish=!1,this._input=ut.util.createBuffer(),this.output=e.output||ut.util.createBuffer(),this.mode.start(t)};eo.prototype.update=function(e){if(e)this._input.putBuffer(e);while(!this._op.call(this.mode,this._input,this.output,this._finish)&&!this._finish);this._input.compact()};eo.prototype.finish=function(e){if(e&&(this.mode.name==="ECB"||this.mode.name==="CBC"))this.mode.pad=function(n){return e(this.blockSize,n,!1)},this.mode.unpad=function(n){return e(this.blockSize,n,!0)};var t={};if(t.decrypt=this._decrypt,t.overflow=this._input.length()%this.blockSize,!this._decrypt&&this.mode.pad){if(!this.mode.pad(this._input,t))return!1}if(this._finish=!0,this.update(),this._decrypt&&this.mode.unpad){if(!this.mode.unpad(this.output,t))return!1}if(this.mode.afterFinish){if(!this.mode.afterFinish(this.output,t))return!1}return!0}});var ro=fe(function(FC,Hc){var dt=me();Be();dt.cipher=dt.cipher||{};var be=Hc.exports=dt.cipher.modes=dt.cipher.modes||{};be.ecb=function(e){e=e||{},this.name="ECB",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};be.ecb.prototype.start=function(e){};be.ecb.prototype.encrypt=function(e,t,n){if(e.length()<this.blockSize&&!(n&&e.length()>0))return!0;for(var r=0;r<this._ints;++r)this._inBlock[r]=e.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var r=0;r<this._ints;++r)t.putInt32(this._outBlock[r])};be.ecb.prototype.decrypt=function(e,t,n){if(e.length()<this.blockSize&&!(n&&e.length()>0))return!0;for(var r=0;r<this._ints;++r)this._inBlock[r]=e.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var r=0;r<this._ints;++r)t.putInt32(this._outBlock[r])};be.ecb.prototype.pad=function(e,t){var n=e.length()===this.blockSize?this.blockSize:this.blockSize-e.length();return e.fillWithByte(n,n),!0};be.ecb.prototype.unpad=function(e,t){if(t.overflow>0)return!1;var n=e.length(),r=e.at(n-1);if(r>this.blockSize<<2)return!1;return e.truncate(r),!0};be.cbc=function(e){e=e||{},this.name="CBC",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints)};be.cbc.prototype.start=function(e){if(e.iv===null){if(!this._prev)throw Error("Invalid IV parameter.");this._iv=this._prev.slice(0)}else if(!("iv"in e))throw Error("Invalid IV parameter.");else this._iv=bs(e.iv,this.blockSize),this._prev=this._iv.slice(0)};be.cbc.prototype.encrypt=function(e,t,n){if(e.length()<this.blockSize&&!(n&&e.length()>0))return!0;for(var r=0;r<this._ints;++r)this._inBlock[r]=this._prev[r]^e.getInt32();this.cipher.encrypt(this._inBlock,this._outBlock);for(var r=0;r<this._ints;++r)t.putInt32(this._outBlock[r]);this._prev=this._outBlock};be.cbc.prototype.decrypt=function(e,t,n){if(e.length()<this.blockSize&&!(n&&e.length()>0))return!0;for(var r=0;r<this._ints;++r)this._inBlock[r]=e.getInt32();this.cipher.decrypt(this._inBlock,this._outBlock);for(var r=0;r<this._ints;++r)t.putInt32(this._prev[r]^this._outBlock[r]);this._prev=this._inBlock.slice(0)};be.cbc.prototype.pad=function(e,t){var n=e.length()===this.blockSize?this.blockSize:this.blockSize-e.length();return e.fillWithByte(n,n),!0};be.cbc.prototype.unpad=function(e,t){if(t.overflow>0)return!1;var n=e.length(),r=e.at(n-1);if(r>this.blockSize<<2)return!1;return e.truncate(r),!0};be.cfb=function(e){e=e||{},this.name="CFB",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialBlock=Array(this._ints),this._partialOutput=dt.util.createBuffer(),this._partialBytes=0};be.cfb.prototype.start=function(e){if(!("iv"in e))throw Error("Invalid IV parameter.");this._iv=bs(e.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};be.cfb.prototype.encrypt=function(e,t,n){var r=e.length();if(r===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize){for(var i=0;i<this._ints;++i)this._inBlock[i]=e.getInt32()^this._outBlock[i],t.putInt32(this._inBlock[i]);return}var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialBlock[i]=e.getInt32()^this._outBlock[i],this._partialOutput.putInt32(this._partialBlock[i]);if(s>0)e.read-=this.blockSize;else for(var i=0;i<this._ints;++i)this._inBlock[i]=this._partialBlock[i];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0};be.cfb.prototype.decrypt=function(e,t,n){var r=e.length();if(r===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize){for(var i=0;i<this._ints;++i)this._inBlock[i]=e.getInt32(),t.putInt32(this._inBlock[i]^this._outBlock[i]);return}var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialBlock[i]=e.getInt32(),this._partialOutput.putInt32(this._partialBlock[i]^this._outBlock[i]);if(s>0)e.read-=this.blockSize;else for(var i=0;i<this._ints;++i)this._inBlock[i]=this._partialBlock[i];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0};be.ofb=function(e){e=e||{},this.name="OFB",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=dt.util.createBuffer(),this._partialBytes=0};be.ofb.prototype.start=function(e){if(!("iv"in e))throw Error("Invalid IV parameter.");this._iv=bs(e.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};be.ofb.prototype.encrypt=function(e,t,n){var r=e.length();if(e.length()===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize){for(var i=0;i<this._ints;++i)t.putInt32(e.getInt32()^this._outBlock[i]),this._inBlock[i]=this._outBlock[i];return}var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialOutput.putInt32(e.getInt32()^this._outBlock[i]);if(s>0)e.read-=this.blockSize;else for(var i=0;i<this._ints;++i)this._inBlock[i]=this._outBlock[i];if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0};be.ofb.prototype.decrypt=be.ofb.prototype.encrypt;be.ctr=function(e){e=e||{},this.name="CTR",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=null,this._outBlock=Array(this._ints),this._partialOutput=dt.util.createBuffer(),this._partialBytes=0};be.ctr.prototype.start=function(e){if(!("iv"in e))throw Error("Invalid IV parameter.");this._iv=bs(e.iv,this.blockSize),this._inBlock=this._iv.slice(0),this._partialBytes=0};be.ctr.prototype.encrypt=function(e,t,n){var r=e.length();if(r===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize)for(var i=0;i<this._ints;++i)t.putInt32(e.getInt32()^this._outBlock[i]);else{var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialOutput.putInt32(e.getInt32()^this._outBlock[i]);if(s>0)e.read-=this.blockSize;if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0}Cs(this._inBlock)};be.ctr.prototype.decrypt=be.ctr.prototype.encrypt;be.gcm=function(e){e=e||{},this.name="GCM",this.cipher=e.cipher,this.blockSize=e.blockSize||16,this._ints=this.blockSize/4,this._inBlock=Array(this._ints),this._outBlock=Array(this._ints),this._partialOutput=dt.util.createBuffer(),this._partialBytes=0,this._R=3774873600};be.gcm.prototype.start=function(e){if(!("iv"in e))throw Error("Invalid IV parameter.");var t=dt.util.createBuffer(e.iv);this._cipherLength=0;var n;if("additionalData"in e)n=dt.util.createBuffer(e.additionalData);else n=dt.util.createBuffer();if("tagLength"in e)this._tagLength=e.tagLength;else this._tagLength=128;if(this._tag=null,e.decrypt){if(this._tag=dt.util.createBuffer(e.tag).getBytes(),this._tag.length!==this._tagLength/8)throw Error("Authentication tag does not match tag length.")}this._hashBlock=Array(this._ints),this.tag=null,this._hashSubkey=Array(this._ints),this.cipher.encrypt([0,0,0,0],this._hashSubkey),this.componentBits=4,this._m=this.generateHashTable(this._hashSubkey,this.componentBits);var r=t.length();if(r===12)this._j0=[t.getInt32(),t.getInt32(),t.getInt32(),1];else{this._j0=[0,0,0,0];while(t.length()>0)this._j0=this.ghash(this._hashSubkey,this._j0,[t.getInt32(),t.getInt32(),t.getInt32(),t.getInt32()]);this._j0=this.ghash(this._hashSubkey,this._j0,[0,0].concat(to(r*8)))}this._inBlock=this._j0.slice(0),Cs(this._inBlock),this._partialBytes=0,n=dt.util.createBuffer(n),this._aDataLength=to(n.length()*8);var i=n.length()%this.blockSize;if(i)n.fillWithByte(0,this.blockSize-i);this._s=[0,0,0,0];while(n.length()>0)this._s=this.ghash(this._hashSubkey,this._s,[n.getInt32(),n.getInt32(),n.getInt32(),n.getInt32()])};be.gcm.prototype.encrypt=function(e,t,n){var r=e.length();if(r===0)return!0;if(this.cipher.encrypt(this._inBlock,this._outBlock),this._partialBytes===0&&r>=this.blockSize){for(var i=0;i<this._ints;++i)t.putInt32(this._outBlock[i]^=e.getInt32());this._cipherLength+=this.blockSize}else{var s=(this.blockSize-r)%this.blockSize;if(s>0)s=this.blockSize-s;this._partialOutput.clear();for(var i=0;i<this._ints;++i)this._partialOutput.putInt32(e.getInt32()^this._outBlock[i]);if(s<=0||n){if(n){var a=r%this.blockSize;this._cipherLength+=a,this._partialOutput.truncate(this.blockSize-a)}else this._cipherLength+=this.blockSize;for(var i=0;i<this._ints;++i)this._outBlock[i]=this._partialOutput.getInt32();this._partialOutput.read-=this.blockSize}if(this._partialBytes>0)this._partialOutput.getBytes(this._partialBytes);if(s>0&&!n)return e.read-=this.blockSize,t.putBytes(this._partialOutput.getBytes(s-this._partialBytes)),this._partialBytes=s,!0;t.putBytes(this._partialOutput.getBytes(r-this._partialBytes)),this._partialBytes=0}this._s=this.ghash(this._hashSubkey,this._s,this._outBlock),Cs(this._inBlock)};be.gcm.prototype.decrypt=function(e,t,n){var r=e.length();if(r<this.blockSize&&!(n&&r>0))return!0;this.cipher.encrypt(this._inBlock,this._outBlock),Cs(this._inBlock),this._hashBlock[0]=e.getInt32(),this._hashBlock[1]=e.getInt32(),this._hashBlock[2]=e.getInt32(),this._hashBlock[3]=e.getInt32(),this._s=this.ghash(this._hashSubkey,this._s,this._hashBlock);for(var i=0;i<this._ints;++i)t.putInt32(this._outBlock[i]^this._hashBlock[i]);if(r<this.blockSize)this._cipherLength+=r%this.blockSize;else this._cipherLength+=this.blockSize};be.gcm.prototype.afterFinish=function(e,t){var n=!0;if(t.decrypt&&t.overflow)e.truncate(this.blockSize-t.overflow);this.tag=dt.util.createBuffer();var r=this._aDataLength.concat(to(this._cipherLength*8));this._s=this.ghash(this._hashSubkey,this._s,r);var i=[];this.cipher.encrypt(this._j0,i);for(var s=0;s<this._ints;++s)this.tag.putInt32(this._s[s]^i[s]);if(this.tag.truncate(this.tag.length()%(this._tagLength/8)),t.decrypt&&this.tag.bytes()!==this._tag)n=!1;return n};be.gcm.prototype.multiply=function(e,t){var n=[0,0,0,0],r=t.slice(0);for(var i=0;i<128;++i){var s=e[i/32|0]&1<<31-i%32;if(s)n[0]^=r[0],n[1]^=r[1],n[2]^=r[2],n[3]^=r[3];this.pow(r,r)}return n};be.gcm.prototype.pow=function(e,t){var n=e[3]&1;for(var r=3;r>0;--r)t[r]=e[r]>>>1|(e[r-1]&1)<<31;if(t[0]=e[0]>>>1,n)t[0]^=this._R};be.gcm.prototype.tableMultiply=function(e){var t=[0,0,0,0];for(var n=0;n<32;++n){var r=n/8|0,i=e[r]>>>(7-n%8)*4&15,s=this._m[n][i];t[0]^=s[0],t[1]^=s[1],t[2]^=s[2],t[3]^=s[3]}return t};be.gcm.prototype.ghash=function(e,t,n){return t[0]^=n[0],t[1]^=n[1],t[2]^=n[2],t[3]^=n[3],this.tableMultiply(t)};be.gcm.prototype.generateHashTable=function(e,t){var n=8/t,r=4*n,i=16*n,s=Array(i);for(var a=0;a<i;++a){var o=[0,0,0,0],l=a/r|0,c=(r-1-a%r)*t;o[l]=1<<t-1<<c,s[a]=this.generateSubHashTable(this.multiply(o,e),t)}return s};be.gcm.prototype.generateSubHashTable=function(e,t){var n=1<<t,r=n>>>1,i=Array(n);i[r]=e.slice(0);var s=r>>>1;while(s>0)this.pow(i[2*s],i[s]=[]),s>>=1;s=2;while(s<r){for(var a=1;a<s;++a){var o=i[s],l=i[a];i[s+a]=[o[0]^l[0],o[1]^l[1],o[2]^l[2],o[3]^l[3]]}s*=2}i[0]=[0,0,0,0];for(s=r+1;s<n;++s){var c=i[s^r];i[s]=[e[0]^c[0],e[1]^c[1],e[2]^c[2],e[3]^c[3]]}return i};function bs(e,t){if(typeof e==="string")e=dt.util.createBuffer(e);if(dt.util.isArray(e)&&e.length>4){var n=e;e=dt.util.createBuffer();for(var r=0;r<n.length;++r)e.putByte(n[r])}if(e.length()<t)throw Error("Invalid IV length; got "+e.length()+" bytes and expected "+t+" bytes.");if(!dt.util.isArray(e)){var i=[],s=t/4;for(var r=0;r<s;++r)i.push(e.getInt32());e=i}return e}function Cs(e){e[e.length-1]=e[e.length-1]+1&4294967295}function to(e){return[e/4294967296|0,e&4294967295]}});var Nr=fe(function(MC,jc){var He=me();Ss();ro();Be();jc.exports=He.aes=He.aes||{};He.aes.startEncrypting=function(e,t,n,r){var i=Es({key:e,output:n,decrypt:!1,mode:r});return i.start(t),i};He.aes.createEncryptionCipher=function(e,t){return Es({key:e,output:null,decrypt:!1,mode:t})};He.aes.startDecrypting=function(e,t,n,r){var i=Es({key:e,output:n,decrypt:!0,mode:r});return i.start(t),i};He.aes.createDecryptionCipher=function(e,t){return Es({key:e,output:null,decrypt:!0,mode:t})};He.aes.Algorithm=function(e,t){if(!so)qc();var n=this;n.name=e,n.mode=new t({blockSize:16,cipher:{encrypt:function(r,i){return io(n._w,r,i,!1)},decrypt:function(r,i){return io(n._w,r,i,!0)}}}),n._init=!1};He.aes.Algorithm.prototype.initialize=function(e){if(this._init)return;var t=e.key,n;if(typeof t==="string"&&(t.length===16||t.length===24||t.length===32))t=He.util.createBuffer(t);else if(He.util.isArray(t)&&(t.length===16||t.length===24||t.length===32)){n=t,t=He.util.createBuffer();for(var r=0;r<n.length;++r)t.putByte(n[r])}if(!He.util.isArray(t)){n=t,t=[];var i=n.length();if(i===16||i===24||i===32){i=i>>>2;for(var r=0;r<i;++r)t.push(n.getInt32())}}if(!He.util.isArray(t)||!(t.length===4||t.length===6||t.length===8))throw Error("Invalid key parameter.");var s=this.mode.name,a=["CFB","OFB","CTR","GCM"].indexOf(s)!==-1;this._w=Gc(t,e.decrypt&&!a),this._init=!0};He.aes._expandKey=function(e,t){if(!so)qc();return Gc(e,t)};He.aes._updateBlock=io;wn("AES-ECB",He.cipher.modes.ecb);wn("AES-CBC",He.cipher.modes.cbc);wn("AES-CFB",He.cipher.modes.cfb);wn("AES-OFB",He.cipher.modes.ofb);wn("AES-CTR",He.cipher.modes.ctr);wn("AES-GCM",He.cipher.modes.gcm);function wn(e,t){var n=function(){return new He.aes.Algorithm(e,t)};He.cipher.registerAlgorithm(e,n)}var so=!1,En=4,St,no,Kc,rn,Ht;function qc(){so=!0,Kc=[0,1,2,4,8,16,32,64,128,27,54];var e=Array(256);for(var t=0;t<128;++t)e[t]=t<<1,e[t+128]=t+128<<1^283;St=Array(256),no=Array(256),rn=[,,,,],Ht=[,,,,];for(var t=0;t<4;++t)rn[t]=Array(256),Ht[t]=Array(256);var n=0,r=0,i,s,a,o,l,c,u;for(var t=0;t<256;++t){o=r^r<<1^r<<2^r<<3^r<<4,o=o>>8^o&255^99,St[n]=o,no[o]=n,l=e[o],i=e[n],s=e[i],a=e[s],c=l<<24^o<<16^o<<8^(o^l),u=(i^s^a)<<24^(n^a)<<16^(n^s^a)<<8^(n^i^a);for(var d=0;d<4;++d)rn[d][n]=c,Ht[d][o]=u,c=c<<24|c>>>8,u=u<<24|u>>>8;if(n===0)n=r=1;else n=i^e[e[e[i^a]]],r^=e[e[r]]}}function Gc(e,t){var n=e.slice(0),r,i=1,s=n.length,a=s+6+1,o=En*a;for(var l=s;l<o;++l){if(r=n[l-1],l%s===0)r=St[r>>>16&255]<<24^St[r>>>8&255]<<16^St[r&255]<<8^St[r>>>24]^Kc[i]<<24,i++;else if(s>6&&l%s===4)r=St[r>>>24]<<24^St[r>>>16&255]<<16^St[r>>>8&255]<<8^St[r&255];n[l]=n[l-s]^r}if(t){var c,u=Ht[0],d=Ht[1],f=Ht[2],y=Ht[3],p=n.slice(0);o=n.length;for(var l=0,v=o-En;l<o;l+=En,v-=En)if(l===0||l===o-En)p[l]=n[v],p[l+1]=n[v+3],p[l+2]=n[v+2],p[l+3]=n[v+1];else for(var x=0;x<En;++x)c=n[v+x],p[l+(3&-x)]=u[St[c>>>24]]^d[St[c>>>16&255]]^f[St[c>>>8&255]]^y[St[c&255]];n=p}return n}function io(e,t,n,r){var i=e.length/4-1,s,a,o,l,c;if(r)s=Ht[0],a=Ht[1],o=Ht[2],l=Ht[3],c=no;else s=rn[0],a=rn[1],o=rn[2],l=rn[3],c=St;var u,d,f,y,p,v,x;u=t[0]^e[0],d=t[r?3:1]^e[1],f=t[2]^e[2],y=t[r?1:3]^e[3];var b=3;for(var A=1;A<i;++A)p=s[u>>>24]^a[d>>>16&255]^o[f>>>8&255]^l[y&255]^e[++b],v=s[d>>>24]^a[f>>>16&255]^o[y>>>8&255]^l[u&255]^e[++b],x=s[f>>>24]^a[y>>>16&255]^o[u>>>8&255]^l[d&255]^e[++b],y=s[y>>>24]^a[u>>>16&255]^o[d>>>8&255]^l[f&255]^e[++b],u=p,d=v,f=x;n[0]=c[u>>>24]<<24^c[d>>>16&255]<<16^c[f>>>8&255]<<8^c[y&255]^e[++b],n[r?3:1]=c[d>>>24]<<24^c[f>>>16&255]<<16^c[y>>>8&255]<<8^c[u&255]^e[++b],n[2]=c[f>>>24]<<24^c[y>>>16&255]<<16^c[u>>>8&255]<<8^c[d&255]^e[++b],n[r?1:3]=c[y>>>24]<<24^c[u>>>16&255]<<16^c[d>>>8&255]<<8^c[f&255]^e[++b]}function Es(e){e=e||{};var t=(e.mode||"CBC").toUpperCase(),n="AES-"+t,r;if(e.decrypt)r=He.cipher.createDecipher(n,e.key);else r=He.cipher.createCipher(n,e.key);var i=r.start;return r.start=function(s,a){var o=null;if(a instanceof He.util.ByteBuffer)o=a,a={};a=a||{},a.output=o,a.iv=s,i.call(r,a)},r}});var Dr=fe(function(WC,zc){var hi=me();hi.pki=hi.pki||{};var ao=zc.exports=hi.pki.oids=hi.oids=hi.oids||{};function U(e,t){ao[e]=t,ao[t]=e}function De(e,t){ao[e]=t}U("1.2.840.113549.1.1.1","rsaEncryption");U("1.2.840.113549.1.1.4","md5WithRSAEncryption");U("1.2.840.113549.1.1.5","sha1WithRSAEncryption");U("1.2.840.113549.1.1.7","RSAES-OAEP");U("1.2.840.113549.1.1.8","mgf1");U("1.2.840.113549.1.1.9","pSpecified");U("1.2.840.113549.1.1.10","RSASSA-PSS");U("1.2.840.113549.1.1.11","sha256WithRSAEncryption");U("1.2.840.113549.1.1.12","sha384WithRSAEncryption");U("1.2.840.113549.1.1.13","sha512WithRSAEncryption");U("1.3.101.112","EdDSA25519");U("1.2.840.10040.4.3","dsa-with-sha1");U("1.3.14.3.2.7","desCBC");U("1.3.14.3.2.26","sha1");U("1.3.14.3.2.29","sha1WithRSASignature");U("2.16.840.1.101.3.4.2.1","sha256");U("2.16.840.1.101.3.4.2.2","sha384");U("2.16.840.1.101.3.4.2.3","sha512");U("2.16.840.1.101.3.4.2.4","sha224");U("2.16.840.1.101.3.4.2.5","sha512-224");U("2.16.840.1.101.3.4.2.6","sha512-256");U("1.2.840.113549.2.2","md2");U("1.2.840.113549.2.5","md5");U("1.2.840.113549.1.7.1","data");U("1.2.840.113549.1.7.2","signedData");U("1.2.840.113549.1.7.3","envelopedData");U("1.2.840.113549.1.7.4","signedAndEnvelopedData");U("1.2.840.113549.1.7.5","digestedData");U("1.2.840.113549.1.7.6","encryptedData");U("1.2.840.113549.1.9.1","emailAddress");U("1.2.840.113549.1.9.2","unstructuredName");U("1.2.840.113549.1.9.3","contentType");U("1.2.840.113549.1.9.4","messageDigest");U("1.2.840.113549.1.9.5","signingTime");U("1.2.840.113549.1.9.6","counterSignature");U("1.2.840.113549.1.9.7","challengePassword");U("1.2.840.113549.1.9.8","unstructuredAddress");U("1.2.840.113549.1.9.14","extensionRequest");U("1.2.840.113549.1.9.20","friendlyName");U("1.2.840.113549.1.9.21","localKeyId");U("1.2.840.113549.1.9.22.1","x509Certificate");U("1.2.840.113549.1.12.10.1.1","keyBag");U("1.2.840.113549.1.12.10.1.2","pkcs8ShroudedKeyBag");U("1.2.840.113549.1.12.10.1.3","certBag");U("1.2.840.113549.1.12.10.1.4","crlBag");U("1.2.840.113549.1.12.10.1.5","secretBag");U("1.2.840.113549.1.12.10.1.6","safeContentsBag");U("1.2.840.113549.1.5.13","pkcs5PBES2");U("1.2.840.113549.1.5.12","pkcs5PBKDF2");U("1.2.840.113549.1.12.1.1","pbeWithSHAAnd128BitRC4");U("1.2.840.113549.1.12.1.2","pbeWithSHAAnd40BitRC4");U("1.2.840.113549.1.12.1.3","pbeWithSHAAnd3-KeyTripleDES-CBC");U("1.2.840.113549.1.12.1.4","pbeWithSHAAnd2-KeyTripleDES-CBC");U("1.2.840.113549.1.12.1.5","pbeWithSHAAnd128BitRC2-CBC");U("1.2.840.113549.1.12.1.6","pbewithSHAAnd40BitRC2-CBC");U("1.2.840.113549.2.7","hmacWithSHA1");U("1.2.840.113549.2.8","hmacWithSHA224");U("1.2.840.113549.2.9","hmacWithSHA256");U("1.2.840.113549.2.10","hmacWithSHA384");U("1.2.840.113549.2.11","hmacWithSHA512");U("1.2.840.113549.3.7","des-EDE3-CBC");U("2.16.840.1.101.3.4.1.2","aes128-CBC");U("2.16.840.1.101.3.4.1.22","aes192-CBC");U("2.16.840.1.101.3.4.1.42","aes256-CBC");U("2.5.4.3","commonName");U("2.5.4.4","surname");U("2.5.4.5","serialNumber");U("2.5.4.6","countryName");U("2.5.4.7","localityName");U("2.5.4.8","stateOrProvinceName");U("2.5.4.9","streetAddress");U("2.5.4.10","organizationName");U("2.5.4.11","organizationalUnitName");U("2.5.4.12","title");U("2.5.4.13","description");U("2.5.4.15","businessCategory");U("2.5.4.17","postalCode");U("2.5.4.42","givenName");U("2.5.4.65","pseudonym");U("1.3.6.1.4.1.311.60.2.1.2","jurisdictionOfIncorporationStateOrProvinceName");U("1.3.6.1.4.1.311.60.2.1.3","jurisdictionOfIncorporationCountryName");U("2.16.840.1.113730.1.1","nsCertType");U("2.16.840.1.113730.1.13","nsComment");De("2.5.29.1","authorityKeyIdentifier");De("2.5.29.2","keyAttributes");De("2.5.29.3","certificatePolicies");De("2.5.29.4","keyUsageRestriction");De("2.5.29.5","policyMapping");De("2.5.29.6","subtreesConstraint");De("2.5.29.7","subjectAltName");De("2.5.29.8","issuerAltName");De("2.5.29.9","subjectDirectoryAttributes");De("2.5.29.10","basicConstraints");De("2.5.29.11","nameConstraints");De("2.5.29.12","policyConstraints");De("2.5.29.13","basicConstraints");U("2.5.29.14","subjectKeyIdentifier");U("2.5.29.15","keyUsage");De("2.5.29.16","privateKeyUsagePeriod");U("2.5.29.17","subjectAltName");U("2.5.29.18","issuerAltName");U("2.5.29.19","basicConstraints");De("2.5.29.20","cRLNumber");De("2.5.29.21","cRLReason");De("2.5.29.22","expirationDate");De("2.5.29.23","instructionCode");De("2.5.29.24","invalidityDate");De("2.5.29.25","cRLDistributionPoints");De("2.5.29.26","issuingDistributionPoint");De("2.5.29.27","deltaCRLIndicator");De("2.5.29.28","issuingDistributionPoint");De("2.5.29.29","certificateIssuer");De("2.5.29.30","nameConstraints");U("2.5.29.31","cRLDistributionPoints");U("2.5.29.32","certificatePolicies");De("2.5.29.33","policyMappings");De("2.5.29.34","policyConstraints");U("2.5.29.35","authorityKeyIdentifier");De("2.5.29.36","policyConstraints");U("2.5.29.37","extKeyUsage");De("2.5.29.46","freshestCRL");De("2.5.29.54","inhibitAnyPolicy");U("1.3.6.1.4.1.11129.2.4.2","timestampList");U("1.3.6.1.5.5.7.1.1","authorityInfoAccess");U("1.3.6.1.5.5.7.3.1","serverAuth");U("1.3.6.1.5.5.7.3.2","clientAuth");U("1.3.6.1.5.5.7.3.3","codeSigning");U("1.3.6.1.5.5.7.3.4","emailProtection");U("1.3.6.1.5.5.7.3.8","timeStamping")});var Kt=fe(function($C,Xc){var Ge=me();Be();Dr();var H=Xc.exports=Ge.asn1=Ge.asn1||{};H.Class={UNIVERSAL:0,APPLICATION:64,CONTEXT_SPECIFIC:128,PRIVATE:192};H.Type={NONE:0,BOOLEAN:1,INTEGER:2,BITSTRING:3,OCTETSTRING:4,NULL:5,OID:6,ODESC:7,EXTERNAL:8,REAL:9,ENUMERATED:10,EMBEDDED:11,UTF8:12,ROID:13,SEQUENCE:16,SET:17,PRINTABLESTRING:19,IA5STRING:22,UTCTIME:23,GENERALIZEDTIME:24,BMPSTRING:30};H.maxDepth=256;H.create=function(e,t,n,r,i){if(Ge.util.isArray(r)){var s=[];for(var a=0;a<r.length;++a)if(r[a]!==void 0)s.push(r[a]);r=s}var o={tagClass:e,type:t,constructed:n,composed:n||Ge.util.isArray(r),value:r};if(i&&"bitStringContents"in i)o.bitStringContents=i.bitStringContents,o.original=H.copy(o);return o};H.copy=function(e,t){var n;if(Ge.util.isArray(e)){n=[];for(var r=0;r<e.length;++r)n.push(H.copy(e[r],t));return n}if(typeof e==="string")return e;if(n={tagClass:e.tagClass,type:e.type,constructed:e.constructed,composed:e.composed,value:H.copy(e.value,t)},t&&!t.excludeBitStringContents)n.bitStringContents=e.bitStringContents;return n};H.equals=function(e,t,n){if(Ge.util.isArray(e)){if(!Ge.util.isArray(t))return!1;if(e.length!==t.length)return!1;for(var r=0;r<e.length;++r)if(!H.equals(e[r],t[r]))return!1;return!0}if(typeof e!==typeof t)return!1;if(typeof e==="string")return e===t;var i=e.tagClass===t.tagClass&&e.type===t.type&&e.constructed===t.constructed&&e.composed===t.composed&&H.equals(e.value,t.value);if(n&&n.includeBitStringContents)i=i&&e.bitStringContents===t.bitStringContents;return i};H.getBerValueLength=function(e){var t=e.getByte();if(t===128)return;var n,r=t&128;if(!r)n=t;else n=e.getInt((t&127)<<3);return n};function gi(e,t,n){if(n>t){var r=Error("Too few bytes to parse DER.");throw r.available=e.length(),r.remaining=t,r.requested=n,r}}var h0=function(e,t){var n=e.getByte();if(t--,n===128)return;var r,i=n&128;if(!i)r=n;else{var s=n&127;gi(e,t,s),r=e.getInt(s<<3)}if(r<0)throw Error("Negative length: "+r);return r};H.fromDer=function(e,t){if(t===void 0)t={strict:!0,parseAllBytes:!0,decodeBitStrings:!0};if(typeof t==="boolean")t={strict:t,parseAllBytes:!0,decodeBitStrings:!0};if(!("strict"in t))t.strict=!0;if(!("parseAllBytes"in t))t.parseAllBytes=!0;if(!("decodeBitStrings"in t))t.decodeBitStrings=!0;if(!("maxDepth"in t))t.maxDepth=H.maxDepth;if(typeof e==="string")e=Ge.util.createBuffer(e);var n=e.length(),r=ws(e,e.length(),0,t);if(t.parseAllBytes&&e.length()!==0){var i=Error("Unparsed DER bytes remain after ASN.1 parsing.");throw i.byteCount=n,i.remaining=e.length(),i}return r};function ws(e,t,n,r){if(n>=r.maxDepth)throw Error("ASN.1 parsing error: Max depth exceeded.");var i;gi(e,t,2);var s=e.getByte();t--;var a=s&192,o=s&31;i=e.length();var l=h0(e,t);if(t-=i-e.length(),l!==void 0&&l>t){if(r.strict){var c=Error("Too few bytes to read ASN.1 value.");throw c.available=e.length(),c.remaining=t,c.requested=l,c}l=t}var u,d,f=(s&32)===32;if(f)if(u=[],l===void 0)for(;;){if(gi(e,t,2),e.bytes(2)===String.fromCharCode(0,0)){e.getBytes(2),t-=2;break}i=e.length(),u.push(ws(e,t,n+1,r)),t-=i-e.length()}else while(l>0)i=e.length(),u.push(ws(e,l,n+1,r)),t-=i-e.length(),l-=i-e.length();if(u===void 0&&a===H.Class.UNIVERSAL&&o===H.Type.BITSTRING)d=e.bytes(l);if(u===void 0&&r.decodeBitStrings&&a===H.Class.UNIVERSAL&&o===H.Type.BITSTRING&&l>1){var y=e.read,p=t,v=0;if(o===H.Type.BITSTRING)gi(e,t,1),v=e.getByte(),t--;if(v===0)try{i=e.length();var x={strict:!0,decodeBitStrings:!0},b=ws(e,t,n+1,x),A=i-e.length();if(t-=A,o==H.Type.BITSTRING)A++;var E=b.tagClass;if(A===l&&(E===H.Class.UNIVERSAL||E===H.Class.CONTEXT_SPECIFIC))u=[b]}catch(I){}if(u===void 0)e.read=y,t=p}if(u===void 0){if(l===void 0){if(r.strict)throw Error("Non-constructed ASN.1 object of indefinite length.");l=t}if(o===H.Type.BMPSTRING){u="";for(;l>0;l-=2)gi(e,t,2),u+=String.fromCharCode(e.getInt16()),t-=2}else u=e.getBytes(l),t-=l}var k=d===void 0?null:{bitStringContents:d};return H.create(a,o,f,u,k)}H.toDer=function(e){var t=Ge.util.createBuffer(),n=e.tagClass|e.type,r=Ge.util.createBuffer(),i=!1;if("bitStringContents"in e){if(i=!0,e.original)i=H.equals(e,e.original)}if(i)r.putBytes(e.bitStringContents);else if(e.composed){if(e.constructed)n|=32;else r.putByte(0);for(var s=0;s<e.value.length;++s)if(e.value[s]!==void 0)r.putBuffer(H.toDer(e.value[s]))}else if(e.type===H.Type.BMPSTRING)for(var s=0;s<e.value.length;++s)r.putInt16(e.value.charCodeAt(s));else if(e.type===H.Type.INTEGER&&e.value.length>1&&(e.value.charCodeAt(0)===0&&(e.value.charCodeAt(1)&128)===0||e.value.charCodeAt(0)===255&&(e.value.charCodeAt(1)&128)===128))r.putBytes(e.value.substr(1));else r.putBytes(e.value);if(t.putByte(n),r.length()<=127)t.putByte(r.length()&127);else{var a=r.length(),o="";do o+=String.fromCharCode(a&255),a=a>>>8;while(a>0);t.putByte(o.length|128);for(var s=o.length-1;s>=0;--s)t.putByte(o.charCodeAt(s))}return t.putBuffer(r),t};H.oidToDer=function(e){var t=e.split("."),n=Ge.util.createBuffer();n.putByte(40*parseInt(t[0],10)+parseInt(t[1],10));var r,i,s,a;for(var o=2;o<t.length;++o){if(r=!0,i=[],s=parseInt(t[o],10),s>4294967295)throw Error("OID value too large; max is 32-bits.");do{if(a=s&127,s=s>>>7,!r)a|=128;i.push(a),r=!1}while(s>0);for(var l=i.length-1;l>=0;--l)n.putByte(i[l])}return n};H.derToOid=function(e){var t;if(typeof e==="string")e=Ge.util.createBuffer(e);var n=e.getByte();t=Math.floor(n/40)+"."+n%40;var r=0;while(e.length()>0){if(r>70368744177663)throw Error("OID value too large; max is 53-bits.");if(n=e.getByte(),r=r*128,n&128)r+=n&127;else t+="."+(r+n),r=0}return t};H.utcTimeToDate=function(e){var t=new Date,n=parseInt(e.substr(0,2),10);n=n>=50?1900+n:2000+n;var r=parseInt(e.substr(2,2),10)-1,i=parseInt(e.substr(4,2),10),s=parseInt(e.substr(6,2),10),a=parseInt(e.substr(8,2),10),o=0;if(e.length>11){var l=e.charAt(10),c=10;if(l!=="+"&&l!=="-")o=parseInt(e.substr(10,2),10),c+=2}if(t.setUTCFullYear(n,r,i),t.setUTCHours(s,a,o,0),c){if(l=e.charAt(c),l==="+"||l==="-"){var u=parseInt(e.substr(c+1,2),10),d=parseInt(e.substr(c+4,2),10),f=u*60+d;if(f*=60000,l==="+")t.setTime(+t-f);else t.setTime(+t+f)}}return t};H.generalizedTimeToDate=function(e){var t=new Date,n=parseInt(e.substr(0,4),10),r=parseInt(e.substr(4,2),10)-1,i=parseInt(e.substr(6,2),10),s=parseInt(e.substr(8,2),10),a=parseInt(e.substr(10,2),10),o=parseInt(e.substr(12,2),10),l=0,c=0,u=!1;if(e.charAt(e.length-1)==="Z")u=!0;var d=e.length-5,f=e.charAt(d);if(f==="+"||f==="-"){var y=parseInt(e.substr(d+1,2),10),p=parseInt(e.substr(d+4,2),10);if(c=y*60+p,c*=60000,f==="+")c*=-1;u=!0}if(e.charAt(14)===".")l=parseFloat(e.substr(14),10)*1000;if(u)t.setUTCFullYear(n,r,i),t.setUTCHours(s,a,o,l),t.setTime(+t+c);else t.setFullYear(n,r,i),t.setHours(s,a,o,l);return t};H.dateToUtcTime=function(e){if(typeof e==="string")return e;var t="",n=[];n.push((""+e.getUTCFullYear()).substr(2)),n.push(""+(e.getUTCMonth()+1)),n.push(""+e.getUTCDate()),n.push(""+e.getUTCHours()),n.push(""+e.getUTCMinutes()),n.push(""+e.getUTCSeconds());for(var r=0;r<n.length;++r){if(n[r].length<2)t+="0";t+=n[r]}return t+="Z",t};H.dateToGeneralizedTime=function(e){if(typeof e==="string")return e;var t="",n=[];n.push(""+e.getUTCFullYear()),n.push(""+(e.getUTCMonth()+1)),n.push(""+e.getUTCDate()),n.push(""+e.getUTCHours()),n.push(""+e.getUTCMinutes()),n.push(""+e.getUTCSeconds());for(var r=0;r<n.length;++r){if(n[r].length<2)t+="0";t+=n[r]}return t+="Z",t};H.integerToDer=function(e){var t=Ge.util.createBuffer();if(e>=-128&&e<128)return t.putSignedInt(e,8);if(e>=-32768&&e<32768)return t.putSignedInt(e,16);if(e>=-8388608&&e<8388608)return t.putSignedInt(e,24);if(e>=-2147483648&&e<2147483648)return t.putSignedInt(e,32);var n=Error("Integer too large; max is 32-bits.");throw n.integer=e,n};H.derToInteger=function(e){if(typeof e==="string")e=Ge.util.createBuffer(e);var t=e.length()*8;if(t>32)throw Error("Integer too large; max is 32-bits.");return e.getSignedInt(t)};H.validate=function(e,t,n,r){var i=!1;if((e.tagClass===t.tagClass||typeof t.tagClass>"u")&&(e.type===t.type||typeof t.type>"u")){if(e.constructed===t.constructed||typeof t.constructed>"u"){if(i=!0,t.value&&Ge.util.isArray(t.value)){var s=0;for(var a=0;i&&a<t.value.length;++a){var o=t.value[a];i=!!o.optional;var l=e.value[s];if(!l){if(!o.optional){if(i=!1,r)r.push("["+t.name+'] Missing required element. Expected tag class "'+o.tagClass+'", type "'+o.type+'"')}continue}var c=typeof o.tagClass<"u"&&typeof o.type<"u";if(c&&(l.tagClass!==o.tagClass||l.type!==o.type))if(o.optional){i=!0;continue}else{if(i=!1,r)r.push("["+t.name+"] Tag mismatch. Expected ("+o.tagClass+","+o.type+"), got ("+l.tagClass+","+l.type+")");break}var u=H.validate(l,o,n,r);if(u)++s,i=!0;else if(o.optional)i=!0;else{i=!1;break}}}if(i&&n){if(t.capture)n[t.capture]=e.value;if(t.captureAsn1)n[t.captureAsn1]=e;if(t.captureBitStringContents&&"bitStringContents"in e)n[t.captureBitStringContents]=e.bitStringContents;if(t.captureBitStringValue&&"bitStringContents"in e){var d;if(e.bitStringContents.length<2)n[t.captureBitStringValue]="";else{var f=e.bitStringContents.charCodeAt(0);if(f!==0)throw Error("captureBitStringValue only supported for zero unused bits");n[t.captureBitStringValue]=e.bitStringContents.slice(1)}}}}else if(r)r.push("["+t.name+'] Expected constructed "'+t.constructed+'", got "'+e.constructed+'"')}else if(r){if(e.tagClass!==t.tagClass)r.push("["+t.name+'] Expected tag class "'+t.tagClass+'", got "'+e.tagClass+'"');if(e.type!==t.type)r.push("["+t.name+'] Expected type "'+t.type+'", got "'+e.type+'"')}return i};var Qc=/[^\\u0000-\\u00ff]/;H.prettyPrint=function(e,t,n){var r="";if(t=t||0,n=n||2,t>0)r+=`
6
6
  `;var i="";for(var s=0;s<t*n;++s)i+=" ";switch(r+=i+"Tag: ",e.tagClass){case H.Class.UNIVERSAL:r+="Universal:";break;case H.Class.APPLICATION:r+="Application:";break;case H.Class.CONTEXT_SPECIFIC:r+="Context-Specific:";break;case H.Class.PRIVATE:r+="Private:";break}if(e.tagClass===H.Class.UNIVERSAL)switch(r+=e.type,e.type){case H.Type.NONE:r+=" (None)";break;case H.Type.BOOLEAN:r+=" (Boolean)";break;case H.Type.INTEGER:r+=" (Integer)";break;case H.Type.BITSTRING:r+=" (Bit string)";break;case H.Type.OCTETSTRING:r+=" (Octet string)";break;case H.Type.NULL:r+=" (Null)";break;case H.Type.OID:r+=" (Object Identifier)";break;case H.Type.ODESC:r+=" (Object Descriptor)";break;case H.Type.EXTERNAL:r+=" (External or Instance of)";break;case H.Type.REAL:r+=" (Real)";break;case H.Type.ENUMERATED:r+=" (Enumerated)";break;case H.Type.EMBEDDED:r+=" (Embedded PDV)";break;case H.Type.UTF8:r+=" (UTF8)";break;case H.Type.ROID:r+=" (Relative Object Identifier)";break;case H.Type.SEQUENCE:r+=" (Sequence)";break;case H.Type.SET:r+=" (Set)";break;case H.Type.PRINTABLESTRING:r+=" (Printable String)";break;case H.Type.IA5String:r+=" (IA5String (ASCII))";break;case H.Type.UTCTIME:r+=" (UTC time)";break;case H.Type.GENERALIZEDTIME:r+=" (Generalized time)";break;case H.Type.BMPSTRING:r+=" (BMP String)";break}else r+=e.type;if(r+=`
7
7
  `,r+=i+"Constructed: "+e.constructed+`
8
- `,e.composed){var a=0,o="";for(var s=0;s<e.value.length;++s)if(e.value[s]!==void 0){if(a+=1,o+=H.prettyPrint(e.value[s],t+1,n),s+1<e.value.length)o+=","}r+=i+"Sub values: "+a+o}else{if(r+=i+"Value: ",e.type===H.Type.OID){var l=H.derToOid(e.value);if(r+=l,Ge.pki&&Ge.pki.oids){if(l in Ge.pki.oids)r+=" ("+Ge.pki.oids[l]+") "}}if(e.type===H.Type.INTEGER)try{r+=H.derToInteger(e.value)}catch(u){r+="0x"+Ge.util.bytesToHex(e.value)}else if(e.type===H.Type.BITSTRING){if(e.value.length>1)r+="0x"+Ge.util.bytesToHex(e.value.slice(1));else r+="(none)";if(e.value.length>0){var c=e.value.charCodeAt(0);if(c==1)r+=" (1 unused bit shown)";else if(c>1)r+=" ("+c+" unused bits shown)"}}else if(e.type===H.Type.OCTETSTRING){if(!zc.test(e.value))r+="("+e.value+") ";r+="0x"+Ge.util.bytesToHex(e.value)}else if(e.type===H.Type.UTF8)try{r+=Ge.util.decodeUtf8(e.value)}catch(u){if(u.message==="URI malformed")r+="0x"+Ge.util.bytesToHex(e.value)+" (malformed UTF8)";else throw u}else if(e.type===H.Type.PRINTABLESTRING||e.type===H.Type.IA5String)r+=e.value;else if(zc.test(e.value))r+="0x"+Ge.util.bytesToHex(e.value);else if(e.value.length===0)r+="[null]";else r+=e.value}return r}});var er=fe(function(WC,Xc){var ws=me();Xc.exports=ws.md=ws.md||{};ws.md.algorithms=ws.md.algorithms||{}});var Tn=fe(function($C,Yc){var yr=me();er();Be();var p0=Yc.exports=yr.hmac=yr.hmac||{};p0.create=function(){var e=null,t=null,n=null,r=null,i={};return i.start=function(s,a){if(s!==null)if(typeof s==="string")if(s=s.toLowerCase(),s in yr.md.algorithms)t=yr.md.algorithms[s].create();else throw Error('Unknown hash algorithm "'+s+'"');else t=s;if(a===null)a=e;else{if(typeof a==="string")a=yr.util.createBuffer(a);else if(yr.util.isArray(a)){var o=a;a=yr.util.createBuffer();for(var l=0;l<o.length;++l)a.putByte(o[l])}var c=a.length();if(c>t.blockLength)t.start(),t.update(a.bytes()),a=t.digest();n=yr.util.createBuffer(),r=yr.util.createBuffer(),c=a.length();for(var l=0;l<c;++l){var o=a.at(l);n.putByte(54^o),r.putByte(92^o)}if(c<t.blockLength){var o=t.blockLength-c;for(var l=0;l<o;++l)n.putByte(54),r.putByte(92)}e=a,n=n.bytes(),r=r.bytes()}t.start(),t.update(n)},i.update=function(s){t.update(s)},i.getMac=function(){var s=t.digest().bytes();return t.start(),t.update(r),t.update(s),t.digest()},i.digest=i.getMac,i}});var As=fe(function(HC,tu){var tr=me();er();Be();var Zc=tu.exports=tr.md5=tr.md5||{};tr.md.md5=tr.md.algorithms.md5=Zc;Zc.create=function(){if(!eu)h0();var e=null,t=tr.util.createBuffer(),n=Array(16),r={algorithm:"md5",blockLength:64,digestLength:16,messageLength:0,fullMessageLength:null,messageLengthSize:8};return r.start=function(){r.messageLength=0,r.fullMessageLength=r.messageLength64=[];var i=r.messageLengthSize/4;for(var s=0;s<i;++s)r.fullMessageLength.push(0);return t=tr.util.createBuffer(),e={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878},r},r.start(),r.update=function(i,s){if(s==="utf8")i=tr.util.encodeUtf8(i);var a=i.length;r.messageLength+=a,a=[a/4294967296>>>0,a>>>0];for(var o=r.fullMessageLength.length-1;o>=0;--o)r.fullMessageLength[o]+=a[1],a[1]=a[0]+(r.fullMessageLength[o]/4294967296>>>0),r.fullMessageLength[o]=r.fullMessageLength[o]>>>0,a[0]=a[1]/4294967296>>>0;if(t.putBytes(i),Jc(e,n,t),t.read>2048||t.length()===0)t.compact();return r},r.digest=function(){var i=tr.util.createBuffer();i.putBytes(t.bytes());var s=r.fullMessageLength[r.fullMessageLength.length-1]+r.messageLengthSize,a=s&r.blockLength-1;i.putBytes(ao.substr(0,r.blockLength-a));var o,l=0;for(var c=r.fullMessageLength.length-1;c>=0;--c)o=r.fullMessageLength[c]*8+l,l=o/4294967296>>>0,i.putInt32Le(o>>>0);var u={h0:e.h0,h1:e.h1,h2:e.h2,h3:e.h3};Jc(u,n,i);var d=tr.util.createBuffer();return d.putInt32Le(u.h0),d.putInt32Le(u.h1),d.putInt32Le(u.h2),d.putInt32Le(u.h3),d},r};var ao=null,Ts=null,gi=null,An=null,eu=!1;function h0(){ao=String.fromCharCode(128),ao+=tr.util.fillString(String.fromCharCode(0),64),Ts=[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,1,6,11,0,5,10,15,4,9,14,3,8,13,2,7,12,5,8,11,14,1,4,7,10,13,0,3,6,9,12,15,2,0,7,14,5,12,3,10,1,8,15,6,13,4,11,2,9],gi=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],An=Array(64);for(var e=0;e<64;++e)An[e]=Math.floor(Math.abs(Math.sin(e+1))*4294967296);eu=!0}function Jc(e,t,n){var r,i,s,a,o,l,c,u,d=n.length();while(d>=64){i=e.h0,s=e.h1,a=e.h2,o=e.h3;for(u=0;u<16;++u)t[u]=n.getInt32Le(),l=o^s&(a^o),r=i+l+An[u]+t[u],c=gi[u],i=o,o=a,a=s,s+=r<<c|r>>>32-c;for(;u<32;++u)l=a^o&(s^a),r=i+l+An[u]+t[Ts[u]],c=gi[u],i=o,o=a,a=s,s+=r<<c|r>>>32-c;for(;u<48;++u)l=s^a^o,r=i+l+An[u]+t[Ts[u]],c=gi[u],i=o,o=a,a=s,s+=r<<c|r>>>32-c;for(;u<64;++u)l=a^(s|~o),r=i+l+An[u]+t[Ts[u]],c=gi[u],i=o,o=a,a=s,s+=r<<c|r>>>32-c;e.h0=e.h0+i|0,e.h1=e.h1+s|0,e.h2=e.h2+a|0,e.h3=e.h3+o|0,d-=64}}});var nn=fe(function(KC,nu){var ks=me();Be();var ru=nu.exports=ks.pem=ks.pem||{};ru.encode=function(e,t){t=t||{};var n="-----BEGIN "+e.type+`-----\r
9
- `,r;if(e.procType)r={name:"Proc-Type",values:[String(e.procType.version),e.procType.type]},n+=_s(r);if(e.contentDomain)r={name:"Content-Domain",values:[e.contentDomain]},n+=_s(r);if(e.dekInfo){if(r={name:"DEK-Info",values:[e.dekInfo.algorithm]},e.dekInfo.parameters)r.values.push(e.dekInfo.parameters);n+=_s(r)}if(e.headers)for(var i=0;i<e.headers.length;++i)n+=_s(e.headers[i]);if(e.procType)n+=`\r
10
- `;return n+=ks.util.encode64(e.body,t.maxline||64)+`\r
8
+ `,e.composed){var a=0,o="";for(var s=0;s<e.value.length;++s)if(e.value[s]!==void 0){if(a+=1,o+=H.prettyPrint(e.value[s],t+1,n),s+1<e.value.length)o+=","}r+=i+"Sub values: "+a+o}else{if(r+=i+"Value: ",e.type===H.Type.OID){var l=H.derToOid(e.value);if(r+=l,Ge.pki&&Ge.pki.oids){if(l in Ge.pki.oids)r+=" ("+Ge.pki.oids[l]+") "}}if(e.type===H.Type.INTEGER)try{r+=H.derToInteger(e.value)}catch(u){r+="0x"+Ge.util.bytesToHex(e.value)}else if(e.type===H.Type.BITSTRING){if(e.value.length>1)r+="0x"+Ge.util.bytesToHex(e.value.slice(1));else r+="(none)";if(e.value.length>0){var c=e.value.charCodeAt(0);if(c==1)r+=" (1 unused bit shown)";else if(c>1)r+=" ("+c+" unused bits shown)"}}else if(e.type===H.Type.OCTETSTRING){if(!Qc.test(e.value))r+="("+e.value+") ";r+="0x"+Ge.util.bytesToHex(e.value)}else if(e.type===H.Type.UTF8)try{r+=Ge.util.decodeUtf8(e.value)}catch(u){if(u.message==="URI malformed")r+="0x"+Ge.util.bytesToHex(e.value)+" (malformed UTF8)";else throw u}else if(e.type===H.Type.PRINTABLESTRING||e.type===H.Type.IA5String)r+=e.value;else if(Qc.test(e.value))r+="0x"+Ge.util.bytesToHex(e.value);else if(e.value.length===0)r+="[null]";else r+=e.value}return r}});var er=fe(function(HC,Yc){var Ts=me();Yc.exports=Ts.md=Ts.md||{};Ts.md.algorithms=Ts.md.algorithms||{}});var Tn=fe(function(KC,Jc){var yr=me();er();Be();var g0=Jc.exports=yr.hmac=yr.hmac||{};g0.create=function(){var e=null,t=null,n=null,r=null,i={};return i.start=function(s,a){if(s!==null)if(typeof s==="string")if(s=s.toLowerCase(),s in yr.md.algorithms)t=yr.md.algorithms[s].create();else throw Error('Unknown hash algorithm "'+s+'"');else t=s;if(a===null)a=e;else{if(typeof a==="string")a=yr.util.createBuffer(a);else if(yr.util.isArray(a)){var o=a;a=yr.util.createBuffer();for(var l=0;l<o.length;++l)a.putByte(o[l])}var c=a.length();if(c>t.blockLength)t.start(),t.update(a.bytes()),a=t.digest();n=yr.util.createBuffer(),r=yr.util.createBuffer(),c=a.length();for(var l=0;l<c;++l){var o=a.at(l);n.putByte(54^o),r.putByte(92^o)}if(c<t.blockLength){var o=t.blockLength-c;for(var l=0;l<o;++l)n.putByte(54),r.putByte(92)}e=a,n=n.bytes(),r=r.bytes()}t.start(),t.update(n)},i.update=function(s){t.update(s)},i.getMac=function(){var s=t.digest().bytes();return t.start(),t.update(r),t.update(s),t.digest()},i.digest=i.getMac,i}});var _s=fe(function(qC,ru){var tr=me();er();Be();var eu=ru.exports=tr.md5=tr.md5||{};tr.md.md5=tr.md.algorithms.md5=eu;eu.create=function(){if(!tu)m0();var e=null,t=tr.util.createBuffer(),n=Array(16),r={algorithm:"md5",blockLength:64,digestLength:16,messageLength:0,fullMessageLength:null,messageLengthSize:8};return r.start=function(){r.messageLength=0,r.fullMessageLength=r.messageLength64=[];var i=r.messageLengthSize/4;for(var s=0;s<i;++s)r.fullMessageLength.push(0);return t=tr.util.createBuffer(),e={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878},r},r.start(),r.update=function(i,s){if(s==="utf8")i=tr.util.encodeUtf8(i);var a=i.length;r.messageLength+=a,a=[a/4294967296>>>0,a>>>0];for(var o=r.fullMessageLength.length-1;o>=0;--o)r.fullMessageLength[o]+=a[1],a[1]=a[0]+(r.fullMessageLength[o]/4294967296>>>0),r.fullMessageLength[o]=r.fullMessageLength[o]>>>0,a[0]=a[1]/4294967296>>>0;if(t.putBytes(i),Zc(e,n,t),t.read>2048||t.length()===0)t.compact();return r},r.digest=function(){var i=tr.util.createBuffer();i.putBytes(t.bytes());var s=r.fullMessageLength[r.fullMessageLength.length-1]+r.messageLengthSize,a=s&r.blockLength-1;i.putBytes(oo.substr(0,r.blockLength-a));var o,l=0;for(var c=r.fullMessageLength.length-1;c>=0;--c)o=r.fullMessageLength[c]*8+l,l=o/4294967296>>>0,i.putInt32Le(o>>>0);var u={h0:e.h0,h1:e.h1,h2:e.h2,h3:e.h3};Zc(u,n,i);var d=tr.util.createBuffer();return d.putInt32Le(u.h0),d.putInt32Le(u.h1),d.putInt32Le(u.h2),d.putInt32Le(u.h3),d},r};var oo=null,As=null,mi=null,An=null,tu=!1;function m0(){oo=String.fromCharCode(128),oo+=tr.util.fillString(String.fromCharCode(0),64),As=[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,1,6,11,0,5,10,15,4,9,14,3,8,13,2,7,12,5,8,11,14,1,4,7,10,13,0,3,6,9,12,15,2,0,7,14,5,12,3,10,1,8,15,6,13,4,11,2,9],mi=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],An=Array(64);for(var e=0;e<64;++e)An[e]=Math.floor(Math.abs(Math.sin(e+1))*4294967296);tu=!0}function Zc(e,t,n){var r,i,s,a,o,l,c,u,d=n.length();while(d>=64){i=e.h0,s=e.h1,a=e.h2,o=e.h3;for(u=0;u<16;++u)t[u]=n.getInt32Le(),l=o^s&(a^o),r=i+l+An[u]+t[u],c=mi[u],i=o,o=a,a=s,s+=r<<c|r>>>32-c;for(;u<32;++u)l=a^o&(s^a),r=i+l+An[u]+t[As[u]],c=mi[u],i=o,o=a,a=s,s+=r<<c|r>>>32-c;for(;u<48;++u)l=s^a^o,r=i+l+An[u]+t[As[u]],c=mi[u],i=o,o=a,a=s,s+=r<<c|r>>>32-c;for(;u<64;++u)l=a^(s|~o),r=i+l+An[u]+t[As[u]],c=mi[u],i=o,o=a,a=s,s+=r<<c|r>>>32-c;e.h0=e.h0+i|0,e.h1=e.h1+s|0,e.h2=e.h2+a|0,e.h3=e.h3+o|0,d-=64}}});var nn=fe(function(GC,iu){var Is=me();Be();var nu=iu.exports=Is.pem=Is.pem||{};nu.encode=function(e,t){t=t||{};var n="-----BEGIN "+e.type+`-----\r
9
+ `,r;if(e.procType)r={name:"Proc-Type",values:[String(e.procType.version),e.procType.type]},n+=ks(r);if(e.contentDomain)r={name:"Content-Domain",values:[e.contentDomain]},n+=ks(r);if(e.dekInfo){if(r={name:"DEK-Info",values:[e.dekInfo.algorithm]},e.dekInfo.parameters)r.values.push(e.dekInfo.parameters);n+=ks(r)}if(e.headers)for(var i=0;i<e.headers.length;++i)n+=ks(e.headers[i]);if(e.procType)n+=`\r
10
+ `;return n+=Is.util.encode64(e.body,t.maxline||64)+`\r
11
11
  `,n+="-----END "+e.type+`-----\r
12
- `,n};ru.decode=function(e){var t=[],n=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g,r=/([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/,i=/\r?\n/,s;while(!0){if(s=n.exec(e),!s)break;var a=s[1];if(a==="NEW CERTIFICATE REQUEST")a="CERTIFICATE REQUEST";var o={type:a,procType:null,contentDomain:null,dekInfo:null,headers:[],body:ks.util.decode64(s[3])};if(t.push(o),!s[2])continue;var l=s[2].split(i),c=0;while(s&&c<l.length){var u=l[c].replace(/\s+$/,"");for(var d=c+1;d<l.length;++d){var f=l[d];if(!/\s/.test(f[0]))break;u+=f,c=d}if(s=u.match(r),s){var y={name:s[1],values:[]},p=s[2].split(",");for(var v=0;v<p.length;++v)y.values.push(g0(p[v]));if(!o.procType){if(y.name!=="Proc-Type")throw Error('Invalid PEM formatted message. The first encapsulated header must be "Proc-Type".');else if(y.values.length!==2)throw Error('Invalid PEM formatted message. The "Proc-Type" header must have two subfields.');o.procType={version:p[0],type:p[1]}}else if(!o.contentDomain&&y.name==="Content-Domain")o.contentDomain=p[0]||"";else if(!o.dekInfo&&y.name==="DEK-Info"){if(y.values.length===0)throw Error('Invalid PEM formatted message. The "DEK-Info" header must have at least one subfield.');o.dekInfo={algorithm:p[0],parameters:p[1]||null}}else o.headers.push(y)}++c}if(o.procType==="ENCRYPTED"&&!o.dekInfo)throw Error('Invalid PEM formatted message. The "DEK-Info" header must be present if "Proc-Type" is "ENCRYPTED".')}if(t.length===0)throw Error("Invalid PEM formatted message.");return t};function _s(e){var t=e.name+": ",n=[],r=function(l,c){return" "+c};for(var i=0;i<e.values.length;++i)n.push(e.values[i].replace(/^(\S+\r\n)/,r));t+=n.join(",")+`\r
12
+ `,n};nu.decode=function(e){var t=[],n=/\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g,r=/([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/,i=/\r?\n/,s;while(!0){if(s=n.exec(e),!s)break;var a=s[1];if(a==="NEW CERTIFICATE REQUEST")a="CERTIFICATE REQUEST";var o={type:a,procType:null,contentDomain:null,dekInfo:null,headers:[],body:Is.util.decode64(s[3])};if(t.push(o),!s[2])continue;var l=s[2].split(i),c=0;while(s&&c<l.length){var u=l[c].replace(/\s+$/,"");for(var d=c+1;d<l.length;++d){var f=l[d];if(!/\s/.test(f[0]))break;u+=f,c=d}if(s=u.match(r),s){var y={name:s[1],values:[]},p=s[2].split(",");for(var v=0;v<p.length;++v)y.values.push(y0(p[v]));if(!o.procType){if(y.name!=="Proc-Type")throw Error('Invalid PEM formatted message. The first encapsulated header must be "Proc-Type".');else if(y.values.length!==2)throw Error('Invalid PEM formatted message. The "Proc-Type" header must have two subfields.');o.procType={version:p[0],type:p[1]}}else if(!o.contentDomain&&y.name==="Content-Domain")o.contentDomain=p[0]||"";else if(!o.dekInfo&&y.name==="DEK-Info"){if(y.values.length===0)throw Error('Invalid PEM formatted message. The "DEK-Info" header must have at least one subfield.');o.dekInfo={algorithm:p[0],parameters:p[1]||null}}else o.headers.push(y)}++c}if(o.procType==="ENCRYPTED"&&!o.dekInfo)throw Error('Invalid PEM formatted message. The "DEK-Info" header must be present if "Proc-Type" is "ENCRYPTED".')}if(t.length===0)throw Error("Invalid PEM formatted message.");return t};function ks(e){var t=e.name+": ",n=[],r=function(l,c){return" "+c};for(var i=0;i<e.values.length;++i)n.push(e.values[i].replace(/^(\S+\r\n)/,r));t+=n.join(",")+`\r
13
13
  `;var s=0,a=-1;for(var i=0;i<t.length;++i,++s)if(s>65&&a!==-1){var o=t[a];if(o===",")++a,t=t.substr(0,a)+`\r
14
14
  `+t.substr(a);else t=t.substr(0,a)+`\r
15
- `+o+t.substr(a+1);s=i-a-1,a=-1,++i}else if(t[i]===" "||t[i]==="\t"||t[i]===",")a=i;return t}function g0(e){return e.replace(/^\s+/,"")}});var mi=fe(function(qC,su){var ze=me();xs();to();Be();su.exports=ze.des=ze.des||{};ze.des.startEncrypting=function(e,t,n,r){var i=Is({key:e,output:n,decrypt:!1,mode:r||(t===null?"ECB":"CBC")});return i.start(t),i};ze.des.createEncryptionCipher=function(e,t){return Is({key:e,output:null,decrypt:!1,mode:t})};ze.des.startDecrypting=function(e,t,n,r){var i=Is({key:e,output:n,decrypt:!0,mode:r||(t===null?"ECB":"CBC")});return i.start(t),i};ze.des.createDecryptionCipher=function(e,t){return Is({key:e,output:null,decrypt:!0,mode:t})};ze.des.Algorithm=function(e,t){var n=this;n.name=e,n.mode=new t({blockSize:8,cipher:{encrypt:function(r,i){return iu(n._keys,r,i,!1)},decrypt:function(r,i){return iu(n._keys,r,i,!0)}}}),n._init=!1};ze.des.Algorithm.prototype.initialize=function(e){if(this._init)return;var t=ze.util.createBuffer(e.key);if(this.name.indexOf("3DES")===0){if(t.length()!==24)throw Error("Invalid Triple-DES key size: "+t.length()*8)}this._keys=w0(t),this._init=!0};rr("DES-ECB",ze.cipher.modes.ecb);rr("DES-CBC",ze.cipher.modes.cbc);rr("DES-CFB",ze.cipher.modes.cfb);rr("DES-OFB",ze.cipher.modes.ofb);rr("DES-CTR",ze.cipher.modes.ctr);rr("3DES-ECB",ze.cipher.modes.ecb);rr("3DES-CBC",ze.cipher.modes.cbc);rr("3DES-CFB",ze.cipher.modes.cfb);rr("3DES-OFB",ze.cipher.modes.ofb);rr("3DES-CTR",ze.cipher.modes.ctr);function rr(e,t){var n=function(){return new ze.des.Algorithm(e,t)};ze.cipher.registerAlgorithm(e,n)}var m0=[16843776,0,65536,16843780,16842756,66564,4,65536,1024,16843776,16843780,1024,16778244,16842756,16777216,4,1028,16778240,16778240,66560,66560,16842752,16842752,16778244,65540,16777220,16777220,65540,0,1028,66564,16777216,65536,16843780,4,16842752,16843776,16777216,16777216,1024,16842756,65536,66560,16777220,1024,4,16778244,66564,16843780,65540,16842752,16778244,16777220,1028,66564,16843776,1028,16778240,16778240,0,65540,66560,0,16842756],y0=[-2146402272,-2147450880,32768,1081376,1048576,32,-2146435040,-2147450848,-2147483616,-2146402272,-2146402304,-2147483648,-2147450880,1048576,32,-2146435040,1081344,1048608,-2147450848,0,-2147483648,32768,1081376,-2146435072,1048608,-2147483616,0,1081344,32800,-2146402304,-2146435072,32800,0,1081376,-2146435040,1048576,-2147450848,-2146435072,-2146402304,32768,-2146435072,-2147450880,32,-2146402272,1081376,32,32768,-2147483648,32800,-2146402304,1048576,-2147483616,1048608,-2147450848,-2147483616,1048608,1081344,0,-2147450880,32800,-2147483648,-2146435040,-2146402272,1081344],v0=[520,134349312,0,134348808,134218240,0,131592,134218240,131080,134217736,134217736,131072,134349320,131080,134348800,520,134217728,8,134349312,512,131584,134348800,134348808,131592,134218248,131584,131072,134218248,8,134349320,512,134217728,134349312,134217728,131080,520,131072,134349312,134218240,0,512,131080,134349320,134218240,134217736,512,0,134348808,134218248,131072,134217728,134349320,8,131592,131584,134217736,134348800,134218248,520,134348800,131592,8,134348808,131584],x0=[8396801,8321,8321,128,8396928,8388737,8388609,8193,0,8396800,8396800,8396929,129,0,8388736,8388609,1,8192,8388608,8396801,128,8388608,8193,8320,8388737,1,8320,8388736,8192,8396928,8396929,129,8388736,8388609,8396800,8396929,129,0,0,8396800,8320,8388736,8388737,1,8396801,8321,8321,128,8396929,129,1,8192,8388609,8193,8396928,8388737,8193,8320,8388608,8396801,128,8388608,8192,8396928],S0=[256,34078976,34078720,1107296512,524288,256,1073741824,34078720,1074266368,524288,33554688,1074266368,1107296512,1107820544,524544,1073741824,33554432,1074266112,1074266112,0,1073742080,1107820800,1107820800,33554688,1107820544,1073742080,0,1107296256,34078976,33554432,1107296256,524544,524288,1107296512,256,33554432,1073741824,34078720,1107296512,1074266368,33554688,1073741824,1107820544,34078976,1074266368,256,33554432,1107820544,1107820800,524544,1107296256,1107820800,34078720,0,1074266112,1107296256,524544,33554688,1073742080,524288,0,1074266112,34078976,1073742080],b0=[536870928,541065216,16384,541081616,541065216,16,541081616,4194304,536887296,4210704,4194304,536870928,4194320,536887296,536870912,16400,0,4194320,536887312,16384,4210688,536887312,16,541065232,541065232,0,4210704,541081600,16400,4210688,541081600,536870912,536887296,16,541065232,4210688,541081616,4194304,16400,536870928,4194304,536887296,536870912,16400,536870928,541081616,4210688,541065216,4210704,541081600,0,541065232,16,16384,541065216,4210704,16384,4194320,536887312,0,541081600,536870912,4194320,536887312],C0=[2097152,69206018,67110914,0,2048,67110914,2099202,69208064,69208066,2097152,0,67108866,2,67108864,69206018,2050,67110912,2099202,2097154,67110912,67108866,69206016,69208064,2097154,69206016,2048,2050,69208066,2099200,2,67108864,2099200,67108864,2099200,2097152,67110914,67110914,69206018,69206018,2,2097154,67108864,67110912,2097152,69208064,2050,2099202,69208064,2050,67108866,69208066,69206016,2099200,0,2,69208066,0,2099202,69206016,2048,67108866,67110912,2048,2097154],E0=[268439616,4096,262144,268701760,268435456,268439616,64,268435456,262208,268697600,268701760,266240,268701696,266304,4096,64,268697600,268435520,268439552,4160,266240,262208,268697664,268701696,4160,0,0,268697664,268435520,268439552,266304,262144,266304,262144,268701696,4096,64,268697664,4096,266304,268439552,64,268435520,268697600,268697664,268435456,262144,268439616,0,268701760,262208,268435520,268697600,268439552,268439616,0,268701760,266240,266240,4160,4160,262208,268435456,268701696];function w0(e){var t=[0,4,536870912,536870916,65536,65540,536936448,536936452,512,516,536871424,536871428,66048,66052,536936960,536936964],n=[0,1,1048576,1048577,67108864,67108865,68157440,68157441,256,257,1048832,1048833,67109120,67109121,68157696,68157697],r=[0,8,2048,2056,16777216,16777224,16779264,16779272,0,8,2048,2056,16777216,16777224,16779264,16779272],i=[0,2097152,134217728,136314880,8192,2105344,134225920,136323072,131072,2228224,134348800,136445952,139264,2236416,134356992,136454144],s=[0,262144,16,262160,0,262144,16,262160,4096,266240,4112,266256,4096,266240,4112,266256],a=[0,1024,32,1056,0,1024,32,1056,33554432,33555456,33554464,33555488,33554432,33555456,33554464,33555488],o=[0,268435456,524288,268959744,2,268435458,524290,268959746,0,268435456,524288,268959744,2,268435458,524290,268959746],l=[0,65536,2048,67584,536870912,536936448,536872960,536938496,131072,196608,133120,198656,537001984,537067520,537004032,537069568],c=[0,262144,0,262144,2,262146,2,262146,33554432,33816576,33554432,33816576,33554434,33816578,33554434,33816578],u=[0,268435456,8,268435464,0,268435456,8,268435464,1024,268436480,1032,268436488,1024,268436480,1032,268436488],d=[0,32,0,32,1048576,1048608,1048576,1048608,8192,8224,8192,8224,1056768,1056800,1056768,1056800],f=[0,16777216,512,16777728,2097152,18874368,2097664,18874880,67108864,83886080,67109376,83886592,69206016,85983232,69206528,85983744],y=[0,4096,134217728,134221824,524288,528384,134742016,134746112,16,4112,134217744,134221840,524304,528400,134742032,134746128],p=[0,4,256,260,0,4,256,260,1,5,257,261,1,5,257,261],v=e.length()>8?3:1,x=[],b=[0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0],A=0,E;for(var k=0;k<v;k++){var I=e.getInt32(),R=e.getInt32();E=(I>>>4^R)&252645135,R^=E,I^=E<<4,E=(R>>>-16^I)&65535,I^=E,R^=E<<-16,E=(I>>>2^R)&858993459,R^=E,I^=E<<2,E=(R>>>-16^I)&65535,I^=E,R^=E<<-16,E=(I>>>1^R)&1431655765,R^=E,I^=E<<1,E=(R>>>8^I)&16711935,I^=E,R^=E<<8,E=(I>>>1^R)&1431655765,R^=E,I^=E<<1,E=I<<8|R>>>20&240,I=R<<24|R<<8&16711680|R>>>8&65280|R>>>24&240,R=E;for(var M=0;M<b.length;++M){if(b[M])I=I<<2|I>>>26,R=R<<2|R>>>26;else I=I<<1|I>>>27,R=R<<1|R>>>27;I&=-15,R&=-15;var ee=t[I>>>28]|n[I>>>24&15]|r[I>>>20&15]|i[I>>>16&15]|s[I>>>12&15]|a[I>>>8&15]|o[I>>>4&15],O=l[R>>>28]|c[R>>>24&15]|u[R>>>20&15]|d[R>>>16&15]|f[R>>>12&15]|y[R>>>8&15]|p[R>>>4&15];E=(O>>>16^ee)&65535,x[A++]=ee^E,x[A++]=O^E<<16}}return x}function iu(e,t,n,r){var i=e.length===32?3:9,s;if(i===3)s=r?[30,-2,-2]:[0,32,2];else s=r?[94,62,-2,32,64,2,30,-2,-2]:[0,32,2,62,30,-2,64,96,2];var a,o=t[0],l=t[1];a=(o>>>4^l)&252645135,l^=a,o^=a<<4,a=(o>>>16^l)&65535,l^=a,o^=a<<16,a=(l>>>2^o)&858993459,o^=a,l^=a<<2,a=(l>>>8^o)&16711935,o^=a,l^=a<<8,a=(o>>>1^l)&1431655765,l^=a,o^=a<<1,o=o<<1|o>>>31,l=l<<1|l>>>31;for(var c=0;c<i;c+=3){var u=s[c+1],d=s[c+2];for(var f=s[c];f!=u;f+=d){var y=l^e[f],p=(l>>>4|l<<28)^e[f+1];a=o,o=l,l=a^(y0[y>>>24&63]|x0[y>>>16&63]|b0[y>>>8&63]|E0[y&63]|m0[p>>>24&63]|v0[p>>>16&63]|S0[p>>>8&63]|C0[p&63])}a=o,o=l,l=a}o=o>>>1|o<<31,l=l>>>1|l<<31,a=(o>>>1^l)&1431655765,l^=a,o^=a<<1,a=(l>>>8^o)&16711935,o^=a,l^=a<<8,a=(l>>>2^o)&858993459,o^=a,l^=a<<2,a=(o>>>16^l)&65535,l^=a,o^=a<<16,a=(o>>>4^l)&252645135,l^=a,o^=a<<4,n[0]=o,n[1]=l}function Is(e){e=e||{};var t=(e.mode||"CBC").toUpperCase(),n="DES-"+t,r;if(e.decrypt)r=ze.cipher.createDecipher(n,e.key);else r=ze.cipher.createCipher(n,e.key);var i=r.start;return r.start=function(s,a){var o=null;if(a instanceof ze.util.ByteBuffer)o=a,a={};a=a||{},a.output=o,a.iv=s,i.call(r,a)},r}});var Rs=fe(function(GC,au){var bt=me();Tn();er();Be();var T0=bt.pkcs5=bt.pkcs5||{},vr;if(bt.util.isNodejs&&!bt.options.usePureJavaScript)vr=ai("crypto");au.exports=bt.pbkdf2=T0.pbkdf2=function(e,t,n,r,i,s){if(typeof i==="function")s=i,i=null;if(bt.util.isNodejs&&!bt.options.usePureJavaScript&&vr.pbkdf2&&(i===null||typeof i!=="object")&&(vr.pbkdf2Sync.length>4||(!i||i==="sha1"))){if(typeof i!=="string")i="sha1";if(e=Buffer.from(e,"binary"),t=Buffer.from(t,"binary"),!s){if(vr.pbkdf2Sync.length===4)return vr.pbkdf2Sync(e,t,n,r).toString("binary");return vr.pbkdf2Sync(e,t,n,r,i).toString("binary")}if(vr.pbkdf2Sync.length===4)return vr.pbkdf2(e,t,n,r,function(E,k){if(E)return s(E);s(null,k.toString("binary"))});return vr.pbkdf2(e,t,n,r,i,function(E,k){if(E)return s(E);s(null,k.toString("binary"))})}if(typeof i>"u"||i===null)i="sha1";if(typeof i==="string"){if(!(i in bt.md.algorithms))throw Error("Unknown hash algorithm: "+i);i=bt.md[i].create()}var a=i.digestLength;if(r>4294967295*a){var o=Error("Derived key is too long.");if(s)return s(o);throw o}var l=Math.ceil(r/a),c=r-(l-1)*a,u=bt.hmac.create();u.start(i,e);var d="",f,y,p;if(!s){for(var v=1;v<=l;++v){u.start(null,null),u.update(t),u.update(bt.util.int32ToBytes(v)),f=p=u.digest().getBytes();for(var x=2;x<=n;++x)u.start(null,null),u.update(p),y=u.digest().getBytes(),f=bt.util.xorBytes(f,y,a),p=y;d+=v<l?f:f.substr(0,c)}return d}var v=1,x;function b(){if(v>l)return s(null,d);u.start(null,null),u.update(t),u.update(bt.util.int32ToBytes(v)),f=p=u.digest().getBytes(),x=2,A()}function A(){if(x<=n)return u.start(null,null),u.update(p),y=u.digest().getBytes(),f=bt.util.xorBytes(f,y,a),p=y,++x,bt.util.setImmediate(A);d+=v<l?f:f.substr(0,c),++v,b()}b()}});var lo=fe(function(jC,du){var nr=me();er();Be();var lu=du.exports=nr.sha256=nr.sha256||{};nr.md.sha256=nr.md.algorithms.sha256=lu;lu.create=function(){if(!cu)A0();var e=null,t=nr.util.createBuffer(),n=Array(64),r={algorithm:"sha256",blockLength:64,digestLength:32,messageLength:0,fullMessageLength:null,messageLengthSize:8};return r.start=function(){r.messageLength=0,r.fullMessageLength=r.messageLength64=[];var i=r.messageLengthSize/4;for(var s=0;s<i;++s)r.fullMessageLength.push(0);return t=nr.util.createBuffer(),e={h0:1779033703,h1:3144134277,h2:1013904242,h3:2773480762,h4:1359893119,h5:2600822924,h6:528734635,h7:1541459225},r},r.start(),r.update=function(i,s){if(s==="utf8")i=nr.util.encodeUtf8(i);var a=i.length;r.messageLength+=a,a=[a/4294967296>>>0,a>>>0];for(var o=r.fullMessageLength.length-1;o>=0;--o)r.fullMessageLength[o]+=a[1],a[1]=a[0]+(r.fullMessageLength[o]/4294967296>>>0),r.fullMessageLength[o]=r.fullMessageLength[o]>>>0,a[0]=a[1]/4294967296>>>0;if(t.putBytes(i),ou(e,n,t),t.read>2048||t.length()===0)t.compact();return r},r.digest=function(){var i=nr.util.createBuffer();i.putBytes(t.bytes());var s=r.fullMessageLength[r.fullMessageLength.length-1]+r.messageLengthSize,a=s&r.blockLength-1;i.putBytes(oo.substr(0,r.blockLength-a));var o,l,c=r.fullMessageLength[0]*8;for(var u=0;u<r.fullMessageLength.length-1;++u)o=r.fullMessageLength[u+1]*8,l=o/4294967296>>>0,c+=l,i.putInt32(c>>>0),c=o>>>0;i.putInt32(c);var d={h0:e.h0,h1:e.h1,h2:e.h2,h3:e.h3,h4:e.h4,h5:e.h5,h6:e.h6,h7:e.h7};ou(d,n,i);var f=nr.util.createBuffer();return f.putInt32(d.h0),f.putInt32(d.h1),f.putInt32(d.h2),f.putInt32(d.h3),f.putInt32(d.h4),f.putInt32(d.h5),f.putInt32(d.h6),f.putInt32(d.h7),f},r};var oo=null,cu=!1,uu=null;function A0(){oo=String.fromCharCode(128),oo+=nr.util.fillString(String.fromCharCode(0),64),uu=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],cu=!0}function ou(e,t,n){var r,i,s,a,o,l,c,u,d,f,y,p,v,x,b,A=n.length();while(A>=64){for(c=0;c<16;++c)t[c]=n.getInt32();for(;c<64;++c)r=t[c-2],r=(r>>>17|r<<15)^(r>>>19|r<<13)^r>>>10,i=t[c-15],i=(i>>>7|i<<25)^(i>>>18|i<<14)^i>>>3,t[c]=r+t[c-7]+i+t[c-16]|0;u=e.h0,d=e.h1,f=e.h2,y=e.h3,p=e.h4,v=e.h5,x=e.h6,b=e.h7;for(c=0;c<64;++c)a=(p>>>6|p<<26)^(p>>>11|p<<21)^(p>>>25|p<<7),o=x^p&(v^x),s=(u>>>2|u<<30)^(u>>>13|u<<19)^(u>>>22|u<<10),l=u&d|f&(u^d),r=b+a+o+uu[c]+t[c],i=s+l,b=x,x=v,v=p,p=y+r>>>0,y=f,f=d,d=u,u=r+i>>>0;e.h0=e.h0+u|0,e.h1=e.h1+d|0,e.h2=e.h2+f|0,e.h3=e.h3+y|0,e.h4=e.h4+p|0,e.h5=e.h5+v|0,e.h6=e.h6+x|0,e.h7=e.h7+b|0,A-=64}}});var co=fe(function(zC,fu){var ir=me();Be();var Bs=null;if(ir.util.isNodejs&&!ir.options.usePureJavaScript&&!process.versions["node-webkit"])Bs=ai("crypto");var _0=fu.exports=ir.prng=ir.prng||{};_0.create=function(e){var t={plugin:e,key:null,seed:null,time:null,reseeds:0,generated:0,keyBytes:""},n=e.md,r=Array(32);for(var i=0;i<32;++i)r[i]=n.create();t.pools=r,t.pool=0,t.generate=function(c,u){if(!u)return t.generateSync(c);var d=t.plugin.cipher,f=t.plugin.increment,y=t.plugin.formatKey,p=t.plugin.formatSeed,v=ir.util.createBuffer();t.key=null,x();function x(b){if(b)return u(b);if(v.length()>=c)return u(null,v.getBytes(c));if(t.generated>1048575)t.key=null;if(t.key===null)return ir.util.nextTick(function(){s(x)});var A=d(t.key,t.seed);t.generated+=A.length,v.putBytes(A),t.key=y(d(t.key,f(t.seed))),t.seed=p(d(t.key,t.seed)),ir.util.setImmediate(x)}},t.generateSync=function(c){var u=t.plugin.cipher,d=t.plugin.increment,f=t.plugin.formatKey,y=t.plugin.formatSeed;t.key=null;var p=ir.util.createBuffer();while(p.length()<c){if(t.generated>1048575)t.key=null;if(t.key===null)a();var v=u(t.key,t.seed);t.generated+=v.length,p.putBytes(v),t.key=f(u(t.key,d(t.seed))),t.seed=y(u(t.key,t.seed))}return p.getBytes(c)};function s(c){if(t.pools[0].messageLength>=32)return o(),c();var u=32-t.pools[0].messageLength<<5;t.seedFile(u,function(d,f){if(d)return c(d);t.collect(f),o(),c()})}function a(){if(t.pools[0].messageLength>=32)return o();var c=32-t.pools[0].messageLength<<5;t.collect(t.seedFileSync(c)),o()}function o(){t.reseeds=t.reseeds===4294967295?0:t.reseeds+1;var c=t.plugin.md.create();c.update(t.keyBytes);var u=1;for(var d=0;d<32;++d){if(t.reseeds%u===0)c.update(t.pools[d].digest().getBytes()),t.pools[d].start();u=u<<1}t.keyBytes=c.digest().getBytes(),c.start(),c.update(t.keyBytes);var f=c.digest().getBytes();t.key=t.plugin.formatKey(t.keyBytes),t.seed=t.plugin.formatSeed(f),t.generated=0}function l(c){var u=null,d=ir.util.globalScope,f=d.crypto||d.msCrypto;if(f&&f.getRandomValues)u=function(I){return f.getRandomValues(I)};var y=ir.util.createBuffer();if(u)while(y.length()<c){var p=Math.max(1,Math.min(c-y.length(),65536)/4),v=new Uint32Array(Math.floor(p));try{u(v);for(var x=0;x<v.length;++x)y.putInt32(v[x])}catch(I){if(!(typeof QuotaExceededError<"u"&&I instanceof QuotaExceededError))throw I}}if(y.length()<c){var b,A,E,k=Math.floor(Math.random()*65536);while(y.length()<c){A=16807*(k&65535),b=16807*(k>>16),A+=(b&32767)<<16,A+=b>>15,A=(A&2147483647)+(A>>31),k=A&4294967295;for(var x=0;x<3;++x)E=k>>>(x<<3),E^=Math.floor(Math.random()*256),y.putByte(E&255)}}return y.getBytes(c)}if(Bs)t.seedFile=function(c,u){Bs.randomBytes(c,function(d,f){if(d)return u(d);u(null,f.toString())})},t.seedFileSync=function(c){return Bs.randomBytes(c).toString()};else t.seedFile=function(c,u){try{u(null,l(c))}catch(d){u(d)}},t.seedFileSync=l;return t.collect=function(c){var u=c.length;for(var d=0;d<u;++d)t.pools[t.pool].update(c.substr(d,1)),t.pool=t.pool===31?0:t.pool+1},t.collectInt=function(c,u){var d="";for(var f=0;f<u;f+=8)d+=String.fromCharCode(c>>f&255);t.collect(d)},t.registerWorker=function(c){if(c===self)t.seedFile=function(d,f){function y(p){var v=p.data;if(v.forge&&v.forge.prng)self.removeEventListener("message",y),f(v.forge.prng.err,v.forge.prng.bytes)}self.addEventListener("message",y),self.postMessage({forge:{prng:{needed:d}}})};else{var u=function(d){var f=d.data;if(f.forge&&f.forge.prng)t.seedFile(f.forge.prng.needed,function(y,p){c.postMessage({forge:{prng:{err:y,bytes:p}}})})};c.addEventListener("message",u)}},t}});var Dt=fe(function(QC,uo){var ft=me();Nr();lo();co();Be();(function(){if(ft.random&&ft.random.getBytes){uo.exports=ft.random;return}(function(e){var t={},n=[,,,,],r=ft.util.createBuffer();t.formatKey=function(d){var f=ft.util.createBuffer(d);return d=[,,,,],d[0]=f.getInt32(),d[1]=f.getInt32(),d[2]=f.getInt32(),d[3]=f.getInt32(),ft.aes._expandKey(d,!1)},t.formatSeed=function(d){var f=ft.util.createBuffer(d);return d=[,,,,],d[0]=f.getInt32(),d[1]=f.getInt32(),d[2]=f.getInt32(),d[3]=f.getInt32(),d},t.cipher=function(d,f){return ft.aes._updateBlock(d,f,n,!1),r.putInt32(n[0]),r.putInt32(n[1]),r.putInt32(n[2]),r.putInt32(n[3]),r.getBytes()},t.increment=function(d){return++d[3],d},t.md=ft.md.sha256;function i(){var d=ft.prng.create(t);return d.getBytes=function(f,y){return d.generate(f,y)},d.getBytesSync=function(f){return d.generate(f)},d}var s=i(),a=null,o=ft.util.globalScope,l=o.crypto||o.msCrypto;if(l&&l.getRandomValues)a=function(d){return l.getRandomValues(d)};if(ft.options.usePureJavaScript||!ft.util.isNodejs&&!a){if(typeof window>"u"||window.document===void 0);if(s.collectInt(+new Date,32),typeof navigator<"u"){var c="";for(var u in navigator)try{if(typeof navigator[u]=="string")c+=navigator[u]}catch(d){}s.collect(c),c=null}if(e)e().mousemove(function(d){s.collectInt(d.clientX,16),s.collectInt(d.clientY,16)}),e().keypress(function(d){s.collectInt(d.charCode,8)})}if(!ft.random)ft.random=s;else for(var u in s)ft.random[u]=s[u];ft.random.createInstance=i,uo.exports=ft.random})(typeof jQuery<"u"?jQuery:null)})()});var po=fe(function(XC,gu){var Tt=me();Be();var fo=[217,120,249,196,25,221,181,237,40,233,253,121,74,160,216,157,198,126,55,131,43,118,83,142,98,76,100,136,68,139,251,162,23,154,89,245,135,179,79,19,97,69,109,141,9,129,125,50,189,143,64,235,134,183,123,11,240,149,33,34,92,107,78,130,84,214,101,147,206,96,178,28,115,86,192,20,167,140,241,220,18,117,202,31,59,190,228,209,66,61,212,48,163,60,182,38,111,191,14,218,70,105,7,87,39,242,29,155,188,148,67,3,248,17,199,246,144,239,62,231,6,195,213,47,200,102,30,215,8,232,234,222,128,82,238,247,132,170,114,172,53,77,106,42,150,26,210,113,90,21,73,116,75,159,208,94,4,24,164,236,194,224,65,110,15,81,203,204,36,145,175,80,161,244,112,57,153,124,58,133,35,184,180,122,252,2,54,91,37,85,151,49,45,93,250,152,227,138,146,174,5,223,41,16,103,108,186,201,211,0,230,207,225,158,168,44,99,22,1,63,88,226,137,169,13,56,52,27,171,51,255,176,187,72,12,95,185,177,205,46,197,243,219,71,229,165,156,119,10,166,32,104,254,127,193,173],pu=[1,2,3,5],k0=function(e,t){return e<<t&65535|(e&65535)>>16-t},I0=function(e,t){return(e&65535)>>t|e<<16-t&65535};gu.exports=Tt.rc2=Tt.rc2||{};Tt.rc2.expandKey=function(e,t){if(typeof e==="string")e=Tt.util.createBuffer(e);t=t||128;var n=e,r=e.length(),i=t,s=Math.ceil(i/8),a=255>>(i&7),o;for(o=r;o<128;o++)n.putByte(fo[n.at(o-1)+n.at(o-r)&255]);n.setAt(128-s,fo[n.at(128-s)&a]);for(o=127-s;o>=0;o--)n.setAt(o,fo[n.at(o+1)^n.at(o+s)]);return n};var hu=function(e,t,n){var r=!1,i=null,s=null,a=null,o,l,c,u,d=[];e=Tt.rc2.expandKey(e,t);for(c=0;c<64;c++)d.push(e.getInt16Le());if(n)o=function(p){for(c=0;c<4;c++)p[c]+=d[u]+(p[(c+3)%4]&p[(c+2)%4])+(~p[(c+3)%4]&p[(c+1)%4]),p[c]=k0(p[c],pu[c]),u++},l=function(p){for(c=0;c<4;c++)p[c]+=d[p[(c+3)%4]&63]};else o=function(p){for(c=3;c>=0;c--)p[c]=I0(p[c],pu[c]),p[c]-=d[u]+(p[(c+3)%4]&p[(c+2)%4])+(~p[(c+3)%4]&p[(c+1)%4]),u--},l=function(p){for(c=3;c>=0;c--)p[c]-=d[p[(c+3)%4]&63]};var f=function(p){var v=[];for(c=0;c<4;c++){var x=i.getInt16Le();if(a!==null)if(n)x^=a.getInt16Le();else a.putInt16Le(x);v.push(x&65535)}u=n?0:63;for(var b=0;b<p.length;b++)for(var A=0;A<p[b][0];A++)p[b][1](v);for(c=0;c<4;c++){if(a!==null)if(n)a.putInt16Le(v[c]);else v[c]^=a.getInt16Le();s.putInt16Le(v[c])}},y=null;return y={start:function(p,v){if(p){if(typeof p==="string")p=Tt.util.createBuffer(p)}r=!1,i=Tt.util.createBuffer(),s=v||new Tt.util.createBuffer,a=p,y.output=s},update:function(p){if(!r)i.putBuffer(p);while(i.length()>=8)f([[5,o],[1,l],[6,o],[1,l],[5,o]])},finish:function(p){var v=!0;if(n)if(p)v=p(8,i,!n);else{var x=i.length()===8?8:8-i.length();i.fillWithByte(x,x)}if(v)r=!0,y.update();if(!n){if(v=i.length()===0,v)if(p)v=p(8,s,!n);else{var b=s.length(),A=s.at(b-1);if(A>b)v=!1;else s.truncate(A)}}return v}},y};Tt.rc2.startEncrypting=function(e,t,n){var r=Tt.rc2.createEncryptionCipher(e,128);return r.start(t,n),r};Tt.rc2.createEncryptionCipher=function(e,t){return hu(e,t,!0)};Tt.rc2.startDecrypting=function(e,t,n){var r=Tt.rc2.createDecryptionCipher(e,128);return r.start(t,n),r};Tt.rc2.createDecryptionCipher=function(e,t){return hu(e,t,!1)}});var vi=fe(function(YC,Eu){var ho=me();Eu.exports=ho.jsbn=ho.jsbn||{};var xr,R0=244837814094590,mu=(R0&16777215)==15715070;function D(e,t,n){if(this.data=[],e!=null)if(typeof e=="number")this.fromNumber(e,t,n);else if(t==null&&typeof e!="string")this.fromString(e,256);else this.fromString(e,t)}ho.jsbn.BigInteger=D;function Ie(){return new D(null)}function B0(e,t,n,r,i,s){while(--s>=0){var a=t*this.data[e++]+n.data[r]+i;i=Math.floor(a/67108864),n.data[r++]=a&67108863}return i}function P0(e,t,n,r,i,s){var a=t&32767,o=t>>15;while(--s>=0){var l=this.data[e]&32767,c=this.data[e++]>>15,u=o*l+c*a;l=a*l+((u&32767)<<15)+n.data[r]+(i&1073741823),i=(l>>>30)+(u>>>15)+o*c+(i>>>30),n.data[r++]=l&1073741823}return i}function yu(e,t,n,r,i,s){var a=t&16383,o=t>>14;while(--s>=0){var l=this.data[e]&16383,c=this.data[e++]>>14,u=o*l+c*a;l=a*l+((u&16383)<<14)+n.data[r]+i,i=(l>>28)+(u>>14)+o*c,n.data[r++]=l&268435455}return i}if(typeof navigator>"u")D.prototype.am=yu,xr=28;else if(mu&&navigator.appName=="Microsoft Internet Explorer")D.prototype.am=P0,xr=30;else if(mu&&navigator.appName!="Netscape")D.prototype.am=B0,xr=26;else D.prototype.am=yu,xr=28;D.prototype.DB=xr;D.prototype.DM=(1<<xr)-1;D.prototype.DV=1<<xr;var go=52;D.prototype.FV=Math.pow(2,go);D.prototype.F1=go-xr;D.prototype.F2=2*xr-go;var N0="0123456789abcdefghijklmnopqrstuvwxyz",Ps=[],_n,Lt;_n=48;for(Lt=0;Lt<=9;++Lt)Ps[_n++]=Lt;_n=97;for(Lt=10;Lt<36;++Lt)Ps[_n++]=Lt;_n=65;for(Lt=10;Lt<36;++Lt)Ps[_n++]=Lt;function vu(e){return N0.charAt(e)}function xu(e,t){var n=Ps[e.charCodeAt(t)];return n==null?-1:n}function D0(e){for(var t=this.t-1;t>=0;--t)e.data[t]=this.data[t];e.t=this.t,e.s=this.s}function L0(e){if(this.t=1,this.s=e<0?-1:0,e>0)this.data[0]=e;else if(e<-1)this.data[0]=e+this.DV;else this.t=0}function Lr(e){var t=Ie();return t.fromInt(e),t}function O0(e,t){var n;if(t==16)n=4;else if(t==8)n=3;else if(t==256)n=8;else if(t==2)n=1;else if(t==32)n=5;else if(t==4)n=2;else{this.fromRadix(e,t);return}this.t=0,this.s=0;var r=e.length,i=!1,s=0;while(--r>=0){var a=n==8?e[r]&255:xu(e,r);if(a<0){if(e.charAt(r)=="-")i=!0;continue}if(i=!1,s==0)this.data[this.t++]=a;else if(s+n>this.DB)this.data[this.t-1]|=(a&(1<<this.DB-s)-1)<<s,this.data[this.t++]=a>>this.DB-s;else this.data[this.t-1]|=a<<s;if(s+=n,s>=this.DB)s-=this.DB}if(n==8&&(e[0]&128)!=0){if(this.s=-1,s>0)this.data[this.t-1]|=(1<<this.DB-s)-1<<s}if(this.clamp(),i)D.ZERO.subTo(this,this)}function U0(){var e=this.s&this.DM;while(this.t>0&&this.data[this.t-1]==e)--this.t}function V0(e){if(this.s<0)return"-"+this.negate().toString(e);var t;if(e==16)t=4;else if(e==8)t=3;else if(e==2)t=1;else if(e==32)t=5;else if(e==4)t=2;else return this.toRadix(e);var n=(1<<t)-1,r,i=!1,s="",a=this.t,o=this.DB-a*this.DB%t;if(a-- >0){if(o<this.DB&&(r=this.data[a]>>o)>0)i=!0,s=vu(r);while(a>=0){if(o<t)r=(this.data[a]&(1<<o)-1)<<t-o,r|=this.data[--a]>>(o+=this.DB-t);else if(r=this.data[a]>>(o-=t)&n,o<=0)o+=this.DB,--a;if(r>0)i=!0;if(i)s+=vu(r)}}return i?s:"0"}function F0(){var e=Ie();return D.ZERO.subTo(this,e),e}function M0(){return this.s<0?this.negate():this}function W0(e){var t=this.s-e.s;if(t!=0)return t;var n=this.t;if(t=n-e.t,t!=0)return this.s<0?-t:t;while(--n>=0)if((t=this.data[n]-e.data[n])!=0)return t;return 0}function Ns(e){var t=1,n;if((n=e>>>16)!=0)e=n,t+=16;if((n=e>>8)!=0)e=n,t+=8;if((n=e>>4)!=0)e=n,t+=4;if((n=e>>2)!=0)e=n,t+=2;if((n=e>>1)!=0)e=n,t+=1;return t}function $0(){if(this.t<=0)return 0;return this.DB*(this.t-1)+Ns(this.data[this.t-1]^this.s&this.DM)}function H0(e,t){var n;for(n=this.t-1;n>=0;--n)t.data[n+e]=this.data[n];for(n=e-1;n>=0;--n)t.data[n]=0;t.t=this.t+e,t.s=this.s}function K0(e,t){for(var n=e;n<this.t;++n)t.data[n-e]=this.data[n];t.t=Math.max(this.t-e,0),t.s=this.s}function q0(e,t){var n=e%this.DB,r=this.DB-n,i=(1<<r)-1,s=Math.floor(e/this.DB),a=this.s<<n&this.DM,o;for(o=this.t-1;o>=0;--o)t.data[o+s+1]=this.data[o]>>r|a,a=(this.data[o]&i)<<n;for(o=s-1;o>=0;--o)t.data[o]=0;t.data[s]=a,t.t=this.t+s+1,t.s=this.s,t.clamp()}function G0(e,t){t.s=this.s;var n=Math.floor(e/this.DB);if(n>=this.t){t.t=0;return}var r=e%this.DB,i=this.DB-r,s=(1<<r)-1;t.data[0]=this.data[n]>>r;for(var a=n+1;a<this.t;++a)t.data[a-n-1]|=(this.data[a]&s)<<i,t.data[a-n]=this.data[a]>>r;if(r>0)t.data[this.t-n-1]|=(this.s&s)<<i;t.t=this.t-n,t.clamp()}function j0(e,t){var n=0,r=0,i=Math.min(e.t,this.t);while(n<i)r+=this.data[n]-e.data[n],t.data[n++]=r&this.DM,r>>=this.DB;if(e.t<this.t){r-=e.s;while(n<this.t)r+=this.data[n],t.data[n++]=r&this.DM,r>>=this.DB;r+=this.s}else{r+=this.s;while(n<e.t)r-=e.data[n],t.data[n++]=r&this.DM,r>>=this.DB;r-=e.s}if(t.s=r<0?-1:0,r<-1)t.data[n++]=this.DV+r;else if(r>0)t.data[n++]=r;t.t=n,t.clamp()}function z0(e,t){var n=this.abs(),r=e.abs(),i=n.t;t.t=i+r.t;while(--i>=0)t.data[i]=0;for(i=0;i<r.t;++i)t.data[i+n.t]=n.am(0,r.data[i],t,i,0,n.t);if(t.s=0,t.clamp(),this.s!=e.s)D.ZERO.subTo(t,t)}function Q0(e){var t=this.abs(),n=e.t=2*t.t;while(--n>=0)e.data[n]=0;for(n=0;n<t.t-1;++n){var r=t.am(n,t.data[n],e,2*n,0,1);if((e.data[n+t.t]+=t.am(n+1,2*t.data[n],e,2*n+1,r,t.t-n-1))>=t.DV)e.data[n+t.t]-=t.DV,e.data[n+t.t+1]=1}if(e.t>0)e.data[e.t-1]+=t.am(n,t.data[n],e,2*n,0,1);e.s=0,e.clamp()}function X0(e,t,n){var r=e.abs();if(r.t<=0)return;var i=this.abs();if(i.t<r.t){if(t!=null)t.fromInt(0);if(n!=null)this.copyTo(n);return}if(n==null)n=Ie();var s=Ie(),a=this.s,o=e.s,l=this.DB-Ns(r.data[r.t-1]);if(l>0)r.lShiftTo(l,s),i.lShiftTo(l,n);else r.copyTo(s),i.copyTo(n);var c=s.t,u=s.data[c-1];if(u==0)return;var d=u*(1<<this.F1)+(c>1?s.data[c-2]>>this.F2:0),f=this.FV/d,y=(1<<this.F1)/d,p=1<<this.F2,v=n.t,x=v-c,b=t==null?Ie():t;if(s.dlShiftTo(x,b),n.compareTo(b)>=0)n.data[n.t++]=1,n.subTo(b,n);D.ONE.dlShiftTo(c,b),b.subTo(s,s);while(s.t<c)s.data[s.t++]=0;while(--x>=0){var A=n.data[--v]==u?this.DM:Math.floor(n.data[v]*f+(n.data[v-1]+p)*y);if((n.data[v]+=s.am(0,A,n,x,0,c))<A){s.dlShiftTo(x,b),n.subTo(b,n);while(n.data[v]<--A)n.subTo(b,n)}}if(t!=null){if(n.drShiftTo(c,t),a!=o)D.ZERO.subTo(t,t)}if(n.t=c,n.clamp(),l>0)n.rShiftTo(l,n);if(a<0)D.ZERO.subTo(n,n)}function Y0(e){var t=Ie();if(this.abs().divRemTo(e,null,t),this.s<0&&t.compareTo(D.ZERO)>0)e.subTo(t,t);return t}function sn(e){this.m=e}function J0(e){if(e.s<0||e.compareTo(this.m)>=0)return e.mod(this.m);else return e}function Z0(e){return e}function eg(e){e.divRemTo(this.m,null,e)}function tg(e,t,n){e.multiplyTo(t,n),this.reduce(n)}function rg(e,t){e.squareTo(t),this.reduce(t)}sn.prototype.convert=J0;sn.prototype.revert=Z0;sn.prototype.reduce=eg;sn.prototype.mulTo=tg;sn.prototype.sqrTo=rg;function ng(){if(this.t<1)return 0;var e=this.data[0];if((e&1)==0)return 0;var t=e&3;return t=t*(2-(e&15)*t)&15,t=t*(2-(e&255)*t)&255,t=t*(2-((e&65535)*t&65535))&65535,t=t*(2-e*t%this.DV)%this.DV,t>0?this.DV-t:-t}function an(e){this.m=e,this.mp=e.invDigit(),this.mpl=this.mp&32767,this.mph=this.mp>>15,this.um=(1<<e.DB-15)-1,this.mt2=2*e.t}function ig(e){var t=Ie();if(e.abs().dlShiftTo(this.m.t,t),t.divRemTo(this.m,null,t),e.s<0&&t.compareTo(D.ZERO)>0)this.m.subTo(t,t);return t}function sg(e){var t=Ie();return e.copyTo(t),this.reduce(t),t}function ag(e){while(e.t<=this.mt2)e.data[e.t++]=0;for(var t=0;t<this.m.t;++t){var n=e.data[t]&32767,r=n*this.mpl+((n*this.mph+(e.data[t]>>15)*this.mpl&this.um)<<15)&e.DM;n=t+this.m.t,e.data[n]+=this.m.am(0,r,e,t,0,this.m.t);while(e.data[n]>=e.DV)e.data[n]-=e.DV,e.data[++n]++}if(e.clamp(),e.drShiftTo(this.m.t,e),e.compareTo(this.m)>=0)e.subTo(this.m,e)}function og(e,t){e.squareTo(t),this.reduce(t)}function lg(e,t,n){e.multiplyTo(t,n),this.reduce(n)}an.prototype.convert=ig;an.prototype.revert=sg;an.prototype.reduce=ag;an.prototype.mulTo=lg;an.prototype.sqrTo=og;function cg(){return(this.t>0?this.data[0]&1:this.s)==0}function ug(e,t){if(e>4294967295||e<1)return D.ONE;var n=Ie(),r=Ie(),i=t.convert(this),s=Ns(e)-1;i.copyTo(n);while(--s>=0)if(t.sqrTo(n,r),(e&1<<s)>0)t.mulTo(r,i,n);else{var a=n;n=r,r=a}return t.revert(n)}function dg(e,t){var n;if(e<256||t.isEven())n=new sn(t);else n=new an(t);return this.exp(e,n)}D.prototype.copyTo=D0;D.prototype.fromInt=L0;D.prototype.fromString=O0;D.prototype.clamp=U0;D.prototype.dlShiftTo=H0;D.prototype.drShiftTo=K0;D.prototype.lShiftTo=q0;D.prototype.rShiftTo=G0;D.prototype.subTo=j0;D.prototype.multiplyTo=z0;D.prototype.squareTo=Q0;D.prototype.divRemTo=X0;D.prototype.invDigit=ng;D.prototype.isEven=cg;D.prototype.exp=ug;D.prototype.toString=V0;D.prototype.negate=F0;D.prototype.abs=M0;D.prototype.compareTo=W0;D.prototype.bitLength=$0;D.prototype.mod=Y0;D.prototype.modPowInt=dg;D.ZERO=Lr(0);D.ONE=Lr(1);function fg(){var e=Ie();return this.copyTo(e),e}function pg(){if(this.s<0){if(this.t==1)return this.data[0]-this.DV;else if(this.t==0)return-1}else if(this.t==1)return this.data[0];else if(this.t==0)return 0;return(this.data[1]&(1<<32-this.DB)-1)<<this.DB|this.data[0]}function hg(){return this.t==0?this.s:this.data[0]<<24>>24}function gg(){return this.t==0?this.s:this.data[0]<<16>>16}function mg(e){return Math.floor(Math.LN2*this.DB/Math.log(e))}function yg(){if(this.s<0)return-1;else if(this.t<=0||this.t==1&&this.data[0]<=0)return 0;else return 1}function vg(e){if(e==null)e=10;if(this.signum()==0||e<2||e>36)return"0";var t=this.chunkSize(e),n=Math.pow(e,t),r=Lr(n),i=Ie(),s=Ie(),a="";this.divRemTo(r,i,s);while(i.signum()>0)a=(n+s.intValue()).toString(e).substr(1)+a,i.divRemTo(r,i,s);return s.intValue().toString(e)+a}function xg(e,t){if(this.fromInt(0),t==null)t=10;var n=this.chunkSize(t),r=Math.pow(t,n),i=!1,s=0,a=0;for(var o=0;o<e.length;++o){var l=xu(e,o);if(l<0){if(e.charAt(o)=="-"&&this.signum()==0)i=!0;continue}if(a=t*a+l,++s>=n)this.dMultiply(r),this.dAddOffset(a,0),s=0,a=0}if(s>0)this.dMultiply(Math.pow(t,s)),this.dAddOffset(a,0);if(i)D.ZERO.subTo(this,this)}function Sg(e,t,n){if(typeof t=="number")if(e<2)this.fromInt(1);else{if(this.fromNumber(e,n),!this.testBit(e-1))this.bitwiseTo(D.ONE.shiftLeft(e-1),mo,this);if(this.isEven())this.dAddOffset(1,0);while(!this.isProbablePrime(t))if(this.dAddOffset(2,0),this.bitLength()>e)this.subTo(D.ONE.shiftLeft(e-1),this)}else{var r=[],i=e&7;if(r.length=(e>>3)+1,t.nextBytes(r),i>0)r[0]&=(1<<i)-1;else r[0]=0;this.fromString(r,256)}}function bg(){var e=this.t,t=[];t[0]=this.s;var n=this.DB-e*this.DB%8,r,i=0;if(e-- >0){if(n<this.DB&&(r=this.data[e]>>n)!=(this.s&this.DM)>>n)t[i++]=r|this.s<<this.DB-n;while(e>=0){if(n<8)r=(this.data[e]&(1<<n)-1)<<8-n,r|=this.data[--e]>>(n+=this.DB-8);else if(r=this.data[e]>>(n-=8)&255,n<=0)n+=this.DB,--e;if((r&128)!=0)r|=-256;if(i==0&&(this.s&128)!=(r&128))++i;if(i>0||r!=this.s)t[i++]=r}}return t}function Cg(e){return this.compareTo(e)==0}function Eg(e){return this.compareTo(e)<0?this:e}function wg(e){return this.compareTo(e)>0?this:e}function Tg(e,t,n){var r,i,s=Math.min(e.t,this.t);for(r=0;r<s;++r)n.data[r]=t(this.data[r],e.data[r]);if(e.t<this.t){i=e.s&this.DM;for(r=s;r<this.t;++r)n.data[r]=t(this.data[r],i);n.t=this.t}else{i=this.s&this.DM;for(r=s;r<e.t;++r)n.data[r]=t(i,e.data[r]);n.t=e.t}n.s=t(this.s,e.s),n.clamp()}function Ag(e,t){return e&t}function _g(e){var t=Ie();return this.bitwiseTo(e,Ag,t),t}function mo(e,t){return e|t}function kg(e){var t=Ie();return this.bitwiseTo(e,mo,t),t}function Su(e,t){return e^t}function Ig(e){var t=Ie();return this.bitwiseTo(e,Su,t),t}function bu(e,t){return e&~t}function Rg(e){var t=Ie();return this.bitwiseTo(e,bu,t),t}function Bg(){var e=Ie();for(var t=0;t<this.t;++t)e.data[t]=this.DM&~this.data[t];return e.t=this.t,e.s=~this.s,e}function Pg(e){var t=Ie();if(e<0)this.rShiftTo(-e,t);else this.lShiftTo(e,t);return t}function Ng(e){var t=Ie();if(e<0)this.lShiftTo(-e,t);else this.rShiftTo(e,t);return t}function Dg(e){if(e==0)return-1;var t=0;if((e&65535)==0)e>>=16,t+=16;if((e&255)==0)e>>=8,t+=8;if((e&15)==0)e>>=4,t+=4;if((e&3)==0)e>>=2,t+=2;if((e&1)==0)++t;return t}function Lg(){for(var e=0;e<this.t;++e)if(this.data[e]!=0)return e*this.DB+Dg(this.data[e]);if(this.s<0)return this.t*this.DB;return-1}function Og(e){var t=0;while(e!=0)e&=e-1,++t;return t}function Ug(){var e=0,t=this.s&this.DM;for(var n=0;n<this.t;++n)e+=Og(this.data[n]^t);return e}function Vg(e){var t=Math.floor(e/this.DB);if(t>=this.t)return this.s!=0;return(this.data[t]&1<<e%this.DB)!=0}function Fg(e,t){var n=D.ONE.shiftLeft(e);return this.bitwiseTo(n,t,n),n}function Mg(e){return this.changeBit(e,mo)}function Wg(e){return this.changeBit(e,bu)}function $g(e){return this.changeBit(e,Su)}function Hg(e,t){var n=0,r=0,i=Math.min(e.t,this.t);while(n<i)r+=this.data[n]+e.data[n],t.data[n++]=r&this.DM,r>>=this.DB;if(e.t<this.t){r+=e.s;while(n<this.t)r+=this.data[n],t.data[n++]=r&this.DM,r>>=this.DB;r+=this.s}else{r+=this.s;while(n<e.t)r+=e.data[n],t.data[n++]=r&this.DM,r>>=this.DB;r+=e.s}if(t.s=r<0?-1:0,r>0)t.data[n++]=r;else if(r<-1)t.data[n++]=this.DV+r;t.t=n,t.clamp()}function Kg(e){var t=Ie();return this.addTo(e,t),t}function qg(e){var t=Ie();return this.subTo(e,t),t}function Gg(e){var t=Ie();return this.multiplyTo(e,t),t}function jg(){var e=Ie();return this.squareTo(e),e}function zg(e){var t=Ie();return this.divRemTo(e,t,null),t}function Qg(e){var t=Ie();return this.divRemTo(e,null,t),t}function Xg(e){var t=Ie(),n=Ie();return this.divRemTo(e,t,n),[t,n]}function Yg(e){this.data[this.t]=this.am(0,e-1,this,0,0,this.t),++this.t,this.clamp()}function Jg(e,t){if(e==0)return;while(this.t<=t)this.data[this.t++]=0;this.data[t]+=e;while(this.data[t]>=this.DV){if(this.data[t]-=this.DV,++t>=this.t)this.data[this.t++]=0;++this.data[t]}}function yi(){}function Cu(e){return e}function Zg(e,t,n){e.multiplyTo(t,n)}function em(e,t){e.squareTo(t)}yi.prototype.convert=Cu;yi.prototype.revert=Cu;yi.prototype.mulTo=Zg;yi.prototype.sqrTo=em;function tm(e){return this.exp(e,new yi)}function rm(e,t,n){var r=Math.min(this.t+e.t,t);n.s=0,n.t=r;while(r>0)n.data[--r]=0;var i;for(i=n.t-this.t;r<i;++r)n.data[r+this.t]=this.am(0,e.data[r],n,r,0,this.t);for(i=Math.min(e.t,t);r<i;++r)this.am(0,e.data[r],n,r,0,t-r);n.clamp()}function nm(e,t,n){--t;var r=n.t=this.t+e.t-t;n.s=0;while(--r>=0)n.data[r]=0;for(r=Math.max(t-this.t,0);r<e.t;++r)n.data[this.t+r-t]=this.am(t-r,e.data[r],n,0,0,this.t+r-t);n.clamp(),n.drShiftTo(1,n)}function kn(e){this.r2=Ie(),this.q3=Ie(),D.ONE.dlShiftTo(2*e.t,this.r2),this.mu=this.r2.divide(e),this.m=e}function im(e){if(e.s<0||e.t>2*this.m.t)return e.mod(this.m);else if(e.compareTo(this.m)<0)return e;else{var t=Ie();return e.copyTo(t),this.reduce(t),t}}function sm(e){return e}function am(e){if(e.drShiftTo(this.m.t-1,this.r2),e.t>this.m.t+1)e.t=this.m.t+1,e.clamp();this.mu.multiplyUpperTo(this.r2,this.m.t+1,this.q3),this.m.multiplyLowerTo(this.q3,this.m.t+1,this.r2);while(e.compareTo(this.r2)<0)e.dAddOffset(1,this.m.t+1);e.subTo(this.r2,e);while(e.compareTo(this.m)>=0)e.subTo(this.m,e)}function om(e,t){e.squareTo(t),this.reduce(t)}function lm(e,t,n){e.multiplyTo(t,n),this.reduce(n)}kn.prototype.convert=im;kn.prototype.revert=sm;kn.prototype.reduce=am;kn.prototype.mulTo=lm;kn.prototype.sqrTo=om;function cm(e,t){var n=e.bitLength(),r,i=Lr(1),s;if(n<=0)return i;else if(n<18)r=1;else if(n<48)r=3;else if(n<144)r=4;else if(n<768)r=5;else r=6;if(n<8)s=new sn(t);else if(t.isEven())s=new kn(t);else s=new an(t);var a=[],o=3,l=r-1,c=(1<<r)-1;if(a[1]=s.convert(this),r>1){var u=Ie();s.sqrTo(a[1],u);while(o<=c)a[o]=Ie(),s.mulTo(u,a[o-2],a[o]),o+=2}var d=e.t-1,f,y=!0,p=Ie(),v;n=Ns(e.data[d])-1;while(d>=0){if(n>=l)f=e.data[d]>>n-l&c;else if(f=(e.data[d]&(1<<n+1)-1)<<l-n,d>0)f|=e.data[d-1]>>this.DB+n-l;o=r;while((f&1)==0)f>>=1,--o;if((n-=o)<0)n+=this.DB,--d;if(y)a[f].copyTo(i),y=!1;else{while(o>1)s.sqrTo(i,p),s.sqrTo(p,i),o-=2;if(o>0)s.sqrTo(i,p);else v=i,i=p,p=v;s.mulTo(p,a[f],i)}while(d>=0&&(e.data[d]&1<<n)==0)if(s.sqrTo(i,p),v=i,i=p,p=v,--n<0)n=this.DB-1,--d}return s.revert(i)}function um(e){var t=this.s<0?this.negate():this.clone(),n=e.s<0?e.negate():e.clone();if(t.compareTo(n)<0){var r=t;t=n,n=r}var i=t.getLowestSetBit(),s=n.getLowestSetBit();if(s<0)return t;if(i<s)s=i;if(s>0)t.rShiftTo(s,t),n.rShiftTo(s,n);while(t.signum()>0){if((i=t.getLowestSetBit())>0)t.rShiftTo(i,t);if((i=n.getLowestSetBit())>0)n.rShiftTo(i,n);if(t.compareTo(n)>=0)t.subTo(n,t),t.rShiftTo(1,t);else n.subTo(t,n),n.rShiftTo(1,n)}if(s>0)n.lShiftTo(s,n);return n}function dm(e){if(e<=0)return 0;var t=this.DV%e,n=this.s<0?e-1:0;if(this.t>0)if(t==0)n=this.data[0]%e;else for(var r=this.t-1;r>=0;--r)n=(t*n+this.data[r])%e;return n}function fm(e){if(this.signum()==0)return D.ZERO;var t=e.isEven();if(this.isEven()&&t||e.signum()==0)return D.ZERO;var n=e.clone(),r=this.clone(),i=Lr(1),s=Lr(0),a=Lr(0),o=Lr(1);while(n.signum()!=0){while(n.isEven()){if(n.rShiftTo(1,n),t){if(!i.isEven()||!s.isEven())i.addTo(this,i),s.subTo(e,s);i.rShiftTo(1,i)}else if(!s.isEven())s.subTo(e,s);s.rShiftTo(1,s)}while(r.isEven()){if(r.rShiftTo(1,r),t){if(!a.isEven()||!o.isEven())a.addTo(this,a),o.subTo(e,o);a.rShiftTo(1,a)}else if(!o.isEven())o.subTo(e,o);o.rShiftTo(1,o)}if(n.compareTo(r)>=0){if(n.subTo(r,n),t)i.subTo(a,i);s.subTo(o,s)}else{if(r.subTo(n,r),t)a.subTo(i,a);o.subTo(s,o)}}if(r.compareTo(D.ONE)!=0)return D.ZERO;if(o.compareTo(e)>=0)return o.subtract(e);if(o.signum()<0)o.addTo(e,o);else return o;if(o.signum()<0)return o.add(e);else return o}var qt=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997],pm=67108864/qt[qt.length-1];function hm(e){var t,n=this.abs();if(n.t==1&&n.data[0]<=qt[qt.length-1]){for(t=0;t<qt.length;++t)if(n.data[0]==qt[t])return!0;return!1}if(n.isEven())return!1;t=1;while(t<qt.length){var r=qt[t],i=t+1;while(i<qt.length&&r<pm)r*=qt[i++];r=n.modInt(r);while(t<i)if(r%qt[t++]==0)return!1}return n.millerRabin(e)}function gm(e){var t=this.subtract(D.ONE),n=t.getLowestSetBit();if(n<=0)return!1;var r=t.shiftRight(n),i=mm(),s;for(var a=0;a<e;++a){do s=new D(this.bitLength(),i);while(s.compareTo(D.ONE)<=0||s.compareTo(t)>=0);var o=s.modPow(r,this);if(o.compareTo(D.ONE)!=0&&o.compareTo(t)!=0){var l=1;while(l++<n&&o.compareTo(t)!=0)if(o=o.modPowInt(2,this),o.compareTo(D.ONE)==0)return!1;if(o.compareTo(t)!=0)return!1}}return!0}function mm(){return{nextBytes:function(e){for(var t=0;t<e.length;++t)e[t]=Math.floor(Math.random()*256)}}}D.prototype.chunkSize=mg;D.prototype.toRadix=vg;D.prototype.fromRadix=xg;D.prototype.fromNumber=Sg;D.prototype.bitwiseTo=Tg;D.prototype.changeBit=Fg;D.prototype.addTo=Hg;D.prototype.dMultiply=Yg;D.prototype.dAddOffset=Jg;D.prototype.multiplyLowerTo=rm;D.prototype.multiplyUpperTo=nm;D.prototype.modInt=dm;D.prototype.millerRabin=gm;D.prototype.clone=fg;D.prototype.intValue=pg;D.prototype.byteValue=hg;D.prototype.shortValue=gg;D.prototype.signum=yg;D.prototype.toByteArray=bg;D.prototype.equals=Cg;D.prototype.min=Eg;D.prototype.max=wg;D.prototype.and=_g;D.prototype.or=kg;D.prototype.xor=Ig;D.prototype.andNot=Rg;D.prototype.not=Bg;D.prototype.shiftLeft=Pg;D.prototype.shiftRight=Ng;D.prototype.getLowestSetBit=Lg;D.prototype.bitCount=Ug;D.prototype.testBit=Vg;D.prototype.setBit=Mg;D.prototype.clearBit=Wg;D.prototype.flipBit=$g;D.prototype.add=Kg;D.prototype.subtract=qg;D.prototype.multiply=Gg;D.prototype.divide=zg;D.prototype.remainder=Qg;D.prototype.divideAndRemainder=Xg;D.prototype.modPow=cm;D.prototype.modInverse=fm;D.prototype.pow=tm;D.prototype.gcd=um;D.prototype.isProbablePrime=hm;D.prototype.square=jg});var In=fe(function(JC,_u){var sr=me();er();Be();var Tu=_u.exports=sr.sha1=sr.sha1||{};sr.md.sha1=sr.md.algorithms.sha1=Tu;Tu.create=function(){if(!Au)ym();var e=null,t=sr.util.createBuffer(),n=Array(80),r={algorithm:"sha1",blockLength:64,digestLength:20,messageLength:0,fullMessageLength:null,messageLengthSize:8};return r.start=function(){r.messageLength=0,r.fullMessageLength=r.messageLength64=[];var i=r.messageLengthSize/4;for(var s=0;s<i;++s)r.fullMessageLength.push(0);return t=sr.util.createBuffer(),e={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878,h4:3285377520},r},r.start(),r.update=function(i,s){if(s==="utf8")i=sr.util.encodeUtf8(i);var a=i.length;r.messageLength+=a,a=[a/4294967296>>>0,a>>>0];for(var o=r.fullMessageLength.length-1;o>=0;--o)r.fullMessageLength[o]+=a[1],a[1]=a[0]+(r.fullMessageLength[o]/4294967296>>>0),r.fullMessageLength[o]=r.fullMessageLength[o]>>>0,a[0]=a[1]/4294967296>>>0;if(t.putBytes(i),wu(e,n,t),t.read>2048||t.length()===0)t.compact();return r},r.digest=function(){var i=sr.util.createBuffer();i.putBytes(t.bytes());var s=r.fullMessageLength[r.fullMessageLength.length-1]+r.messageLengthSize,a=s&r.blockLength-1;i.putBytes(yo.substr(0,r.blockLength-a));var o,l,c=r.fullMessageLength[0]*8;for(var u=0;u<r.fullMessageLength.length-1;++u)o=r.fullMessageLength[u+1]*8,l=o/4294967296>>>0,c+=l,i.putInt32(c>>>0),c=o>>>0;i.putInt32(c);var d={h0:e.h0,h1:e.h1,h2:e.h2,h3:e.h3,h4:e.h4};wu(d,n,i);var f=sr.util.createBuffer();return f.putInt32(d.h0),f.putInt32(d.h1),f.putInt32(d.h2),f.putInt32(d.h3),f.putInt32(d.h4),f},r};var yo=null,Au=!1;function ym(){yo=String.fromCharCode(128),yo+=sr.util.fillString(String.fromCharCode(0),64),Au=!0}function wu(e,t,n){var r,i,s,a,o,l,c,u,d=n.length();while(d>=64){i=e.h0,s=e.h1,a=e.h2,o=e.h3,l=e.h4;for(u=0;u<16;++u)r=n.getInt32(),t[u]=r,c=o^s&(a^o),r=(i<<5|i>>>27)+c+l+1518500249+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<20;++u)r=t[u-3]^t[u-8]^t[u-14]^t[u-16],r=r<<1|r>>>31,t[u]=r,c=o^s&(a^o),r=(i<<5|i>>>27)+c+l+1518500249+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<32;++u)r=t[u-3]^t[u-8]^t[u-14]^t[u-16],r=r<<1|r>>>31,t[u]=r,c=s^a^o,r=(i<<5|i>>>27)+c+l+1859775393+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<40;++u)r=t[u-6]^t[u-16]^t[u-28]^t[u-32],r=r<<2|r>>>30,t[u]=r,c=s^a^o,r=(i<<5|i>>>27)+c+l+1859775393+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<60;++u)r=t[u-6]^t[u-16]^t[u-28]^t[u-32],r=r<<2|r>>>30,t[u]=r,c=s&a|o&(s^a),r=(i<<5|i>>>27)+c+l+2400959708+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<80;++u)r=t[u-6]^t[u-16]^t[u-28]^t[u-32],r=r<<2|r>>>30,t[u]=r,c=s^a^o,r=(i<<5|i>>>27)+c+l+3395469782+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;e.h0=e.h0+i|0,e.h1=e.h1+s|0,e.h2=e.h2+a|0,e.h3=e.h3+o|0,e.h4=e.h4+l|0,d-=64}}});var vo=fe(function(ZC,Iu){var ar=me();Be();Dt();In();var ku=Iu.exports=ar.pkcs1=ar.pkcs1||{};ku.encode_rsa_oaep=function(e,t,n){var r,i,s,a;if(typeof n==="string")r=n,i=arguments[3]||void 0,s=arguments[4]||void 0;else if(n){if(r=n.label||void 0,i=n.seed||void 0,s=n.md||void 0,n.mgf1&&n.mgf1.md)a=n.mgf1.md}if(!s)s=ar.md.sha1.create();else s.start();if(!a)a=s;var o=Math.ceil(e.n.bitLength()/8),l=o-2*s.digestLength-2;if(t.length>l){var c=Error("RSAES-OAEP input message length is too long.");throw c.length=t.length,c.maxLength=l,c}if(!r)r="";s.update(r,"raw");var u=s.digest(),d="",f=l-t.length;for(var y=0;y<f;y++)d+="\x00";var p=u.getBytes()+d+"\x01"+t;if(!i)i=ar.random.getBytes(s.digestLength);else if(i.length!==s.digestLength){var c=Error("Invalid RSAES-OAEP seed. The seed length must match the digest length.");throw c.seedLength=i.length,c.digestLength=s.digestLength,c}var v=Ds(i,o-s.digestLength-1,a),x=ar.util.xorBytes(p,v,p.length),b=Ds(x,s.digestLength,a),A=ar.util.xorBytes(i,b,i.length);return"\x00"+A+x};ku.decode_rsa_oaep=function(e,t,n){var r,i,s;if(typeof n==="string")r=n,i=arguments[3]||void 0;else if(n){if(r=n.label||void 0,i=n.md||void 0,n.mgf1&&n.mgf1.md)s=n.mgf1.md}var a=Math.ceil(e.n.bitLength()/8);if(t.length!==a){var x=Error("RSAES-OAEP encoded message length is invalid.");throw x.length=t.length,x.expectedLength=a,x}if(i===void 0)i=ar.md.sha1.create();else i.start();if(!s)s=i;if(a<2*i.digestLength+2)throw Error("RSAES-OAEP key is too short for the hash function.");if(!r)r="";i.update(r,"raw");var o=i.digest().getBytes(),l=t.charAt(0),c=t.substring(1,i.digestLength+1),u=t.substring(1+i.digestLength),d=Ds(u,i.digestLength,s),f=ar.util.xorBytes(c,d,c.length),y=Ds(f,a-i.digestLength-1,s),p=ar.util.xorBytes(u,y,u.length),v=p.substring(0,i.digestLength),x=l!=="\x00";for(var b=0;b<i.digestLength;++b)x|=o.charAt(b)!==v.charAt(b);var A=1,E=i.digestLength;for(var k=i.digestLength;k<p.length;k++){var I=p.charCodeAt(k),R=I&1^1,M=A?65534:0;x|=I&M,A=A&R,E+=A}if(x||p.charCodeAt(E)!==1)throw Error("Invalid RSAES-OAEP padding.");return p.substring(E+1)};function Ds(e,t,n){if(!n)n=ar.md.sha1.create();var r="",i=Math.ceil(t/n.digestLength);for(var s=0;s<i;++s){var a=String.fromCharCode(s>>24&255,s>>16&255,s>>8&255,s&255);n.start(),n.update(e+a),r+=n.digest().getBytes()}return r.substring(0,t)}});var So=fe(function(e1,xo){var Or=me();Be();vi();Dt();(function(){if(Or.prime){xo.exports=Or.prime;return}var e=xo.exports=Or.prime=Or.prime||{},t=Or.jsbn.BigInteger,n=[6,4,2,4,2,4,6,2],r=new t(null);r.fromInt(30);var i=function(d,f){return d|f};e.generateProbablePrime=function(d,f,y){if(typeof f==="function")y=f,f={};f=f||{};var p=f.algorithm||"PRIMEINC";if(typeof p==="string")p={name:p};p.options=p.options||{};var v=f.prng||Or.random,x={nextBytes:function(b){var A=v.getBytesSync(b.length);for(var E=0;E<b.length;++E)b[E]=A.charCodeAt(E)}};if(p.name==="PRIMEINC")return s(d,x,p.options,y);throw Error("Invalid prime generation algorithm: "+p.name)};function s(d,f,y,p){if("workers"in y)return l(d,f,y,p);return a(d,f,y,p)}function a(d,f,y,p){var v=c(d,f),x=0,b=u(v.bitLength());if("millerRabinTests"in y)b=y.millerRabinTests;var A=10;if("maxBlockTime"in y)A=y.maxBlockTime;o(v,d,f,x,b,A,p)}function o(d,f,y,p,v,x,b){var A=+new Date;do{if(d.bitLength()>f)d=c(f,y);if(d.isProbablePrime(v))return b(null,d);d.dAddOffset(n[p++%8],0)}while(x<0||+new Date-A<x);Or.util.setImmediate(function(){o(d,f,y,p,v,x,b)})}function l(d,f,y,p){if(typeof Worker>"u")return a(d,f,y,p);var v=c(d,f),x=y.workers,b=y.workLoad||100,A=b*30/8,E=y.workerScript||"forge/prime.worker.js";if(x===-1)return Or.util.estimateCores(function(I,R){if(I)R=2;x=R-1,k()});k();function k(){x=Math.max(1,x);var I=[];for(var R=0;R<x;++R)I[R]=new Worker(E);var M=x;for(var R=0;R<x;++R)I[R].addEventListener("message",O);var ee=!1;function O(K){if(ee)return;--M;var ie=K.data;if(ie.found){for(var ve=0;ve<I.length;++ve)I[ve].terminate();return ee=!0,p(null,new t(ie.prime,16))}if(v.bitLength()>d)v=c(d,f);var we=v.toString(16);K.target.postMessage({hex:we,workLoad:b}),v.dAddOffset(A,0)}}}function c(d,f){var y=new t(d,f),p=d-1;if(!y.testBit(p))y.bitwiseTo(t.ONE.shiftLeft(p),i,y);return y.dAddOffset(31-y.mod(r).byteValue(),0),y}function u(d){if(d<=100)return 27;if(d<=150)return 18;if(d<=200)return 15;if(d<=250)return 12;if(d<=300)return 9;if(d<=350)return 8;if(d<=400)return 7;if(d<=500)return 6;if(d<=600)return 5;if(d<=800)return 4;if(d<=1250)return 3;return 2}})()});var xi=fe(function(t1,Ou){var re=me();Kt();vi();Dr();vo();So();Dt();Be();if(typeof ke>"u")ke=re.jsbn.BigInteger;var ke,bo=re.util.isNodejs?ai("crypto"):null,{asn1:_,util:Ot}=re;re.pki=re.pki||{};Ou.exports=re.pki.rsa=re.rsa=re.rsa||{};var pe=re.pki,vm=[6,4,2,4,2,4,6,2],xm={name:"PrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]},Sm={name:"RSAPrivateKey",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPrivateKey.version",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"RSAPrivateKey.modulus",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyModulus"},{name:"RSAPrivateKey.publicExponent",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyPublicExponent"},{name:"RSAPrivateKey.privateExponent",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyPrivateExponent"},{name:"RSAPrivateKey.prime1",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyPrime1"},{name:"RSAPrivateKey.prime2",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyPrime2"},{name:"RSAPrivateKey.exponent1",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyExponent1"},{name:"RSAPrivateKey.exponent2",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyExponent2"},{name:"RSAPrivateKey.coefficient",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyCoefficient"}]},bm={name:"RSAPublicKey",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPublicKey.modulus",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"publicKeyModulus"},{name:"RSAPublicKey.exponent",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"publicKeyExponent"}]},Cm=re.pki.rsa.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{name:"SubjectPublicKeyInfo.subjectPublicKey",tagClass:_.Class.UNIVERSAL,type:_.Type.BITSTRING,constructed:!1,value:[{name:"SubjectPublicKeyInfo.subjectPublicKey.RSAPublicKey",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"rsaPublicKey"}]}]},Em={name:"DigestInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm.algorithmIdentifier",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"algorithmIdentifier"},{name:"DigestInfo.DigestAlgorithm.parameters",tagClass:_.Class.UNIVERSAL,type:_.Type.NULL,capture:"parameters",optional:!0,constructed:!1}]},{name:"DigestInfo.digest",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"digest"}]},wm=function(e){var t;if(e.algorithm in pe.oids)t=pe.oids[e.algorithm];else{var n=Error("Unknown message digest algorithm.");throw n.algorithm=e.algorithm,n}var r=_.oidToDer(t).getBytes(),i=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[]),s=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[]);s.value.push(_.create(_.Class.UNIVERSAL,_.Type.OID,!1,r)),s.value.push(_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,""));var a=_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,e.digest().getBytes());return i.value.push(s),i.value.push(a),_.toDer(i).getBytes()},Du=function(e,t,n){if(n)return e.modPow(t.e,t.n);if(!t.p||!t.q)return e.modPow(t.d,t.n);if(!t.dP)t.dP=t.d.mod(t.p.subtract(ke.ONE));if(!t.dQ)t.dQ=t.d.mod(t.q.subtract(ke.ONE));if(!t.qInv)t.qInv=t.q.modInverse(t.p);var r;do r=new ke(re.util.bytesToHex(re.random.getBytes(t.n.bitLength()/8)),16);while(r.compareTo(t.n)>=0||!r.gcd(t.n).equals(ke.ONE));e=e.multiply(r.modPow(t.e,t.n)).mod(t.n);var i=e.mod(t.p).modPow(t.dP,t.p),s=e.mod(t.q).modPow(t.dQ,t.q);while(i.compareTo(s)<0)i=i.add(t.p);var a=i.subtract(s).multiply(t.qInv).mod(t.p).multiply(t.q).add(s);return a=a.multiply(r.modInverse(t.n)).mod(t.n),a};pe.rsa.encrypt=function(e,t,n){var r=n,i,s=Math.ceil(t.n.bitLength()/8);if(n!==!1&&n!==!0)r=n===2,i=Lu(e,t,n);else i=re.util.createBuffer(),i.putBytes(e);var a=new ke(i.toHex(),16),o=Du(a,t,r),l=o.toString(16),c=re.util.createBuffer(),u=s-Math.ceil(l.length/2);while(u>0)c.putByte(0),--u;return c.putBytes(re.util.hexToBytes(l)),c.getBytes()};pe.rsa.decrypt=function(e,t,n,r){var i=Math.ceil(t.n.bitLength()/8);if(e.length!==i){var s=Error("Encrypted message length is invalid.");throw s.length=e.length,s.expected=i,s}var a=new ke(re.util.createBuffer(e).toHex(),16);if(a.compareTo(t.n)>=0)throw Error("Encrypted message is invalid.");var o=Du(a,t,n),l=o.toString(16),c=re.util.createBuffer(),u=i-Math.ceil(l.length/2);while(u>0)c.putByte(0),--u;if(c.putBytes(re.util.hexToBytes(l)),r!==!1)return Ls(c.getBytes(),t,n);return c.getBytes()};pe.rsa.createKeyPairGenerationState=function(e,t,n){if(typeof e==="string")e=parseInt(e,10);e=e||2048,n=n||{};var r=n.prng||re.random,i={nextBytes:function(o){var l=r.getBytesSync(o.length);for(var c=0;c<o.length;++c)o[c]=l.charCodeAt(c)}},s=n.algorithm||"PRIMEINC",a;if(s==="PRIMEINC")a={algorithm:s,state:0,bits:e,rng:i,eInt:t||65537,e:new ke(null),p:null,q:null,qBits:e>>1,pBits:e-(e>>1),pqState:0,num:null,keys:null},a.e.fromInt(a.eInt);else throw Error("Invalid key generation algorithm: "+s);return a};pe.rsa.stepKeyPairGenerationState=function(e,t){if(!("algorithm"in e))e.algorithm="PRIMEINC";var n=new ke(null);n.fromInt(30);var r=0,i=function(d,f){return d|f},s=+new Date,a,o=0;while(e.keys===null&&(t<=0||o<t)){if(e.state===0){var l=e.p===null?e.pBits:e.qBits,c=l-1;if(e.pqState===0){if(e.num=new ke(l,e.rng),!e.num.testBit(c))e.num.bitwiseTo(ke.ONE.shiftLeft(c),i,e.num);e.num.dAddOffset(31-e.num.mod(n).byteValue(),0),r=0,++e.pqState}else if(e.pqState===1)if(e.num.bitLength()>l)e.pqState=0;else if(e.num.isProbablePrime(Am(e.num.bitLength())))++e.pqState;else e.num.dAddOffset(vm[r++%8],0);else if(e.pqState===2)e.pqState=e.num.subtract(ke.ONE).gcd(e.e).compareTo(ke.ONE)===0?3:0;else if(e.pqState===3){if(e.pqState=0,e.p===null)e.p=e.num;else e.q=e.num;if(e.p!==null&&e.q!==null)++e.state;e.num=null}}else if(e.state===1){if(e.p.compareTo(e.q)<0)e.num=e.p,e.p=e.q,e.q=e.num;++e.state}else if(e.state===2)e.p1=e.p.subtract(ke.ONE),e.q1=e.q.subtract(ke.ONE),e.phi=e.p1.multiply(e.q1),++e.state;else if(e.state===3)if(e.phi.gcd(e.e).compareTo(ke.ONE)===0)++e.state;else e.p=null,e.q=null,e.state=0;else if(e.state===4)if(e.n=e.p.multiply(e.q),e.n.bitLength()===e.bits)++e.state;else e.q=null,e.state=0;else if(e.state===5){var u=e.e.modInverse(e.phi);e.keys={privateKey:pe.rsa.setPrivateKey(e.n,e.e,u,e.p,e.q,u.mod(e.p1),u.mod(e.q1),e.q.modInverse(e.p)),publicKey:pe.rsa.setPublicKey(e.n,e.e)}}a=+new Date,o+=a-s,s=a}return e.keys!==null};pe.rsa.generateKeyPair=function(e,t,n,r){if(arguments.length===1){if(typeof e==="object")n=e,e=void 0;else if(typeof e==="function")r=e,e=void 0}else if(arguments.length===2)if(typeof e==="number"){if(typeof t==="function")r=t,t=void 0;else if(typeof t!=="number")n=t,t=void 0}else n=e,r=t,e=void 0,t=void 0;else if(arguments.length===3)if(typeof t==="number"){if(typeof n==="function")r=n,n=void 0}else r=n,n=t,t=void 0;if(n=n||{},e===void 0)e=n.bits||2048;if(t===void 0)t=n.e||65537;if(!re.options.usePureJavaScript&&!n.prng&&e>=256&&e<=16384&&(t===65537||t===3)){if(r){if(Ru("generateKeyPair"))return bo.generateKeyPair("rsa",{modulusLength:e,publicExponent:t,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}},function(o,l,c){if(o)return r(o);r(null,{privateKey:pe.privateKeyFromPem(c),publicKey:pe.publicKeyFromPem(l)})});if(Bu("generateKey")&&Bu("exportKey"))return Ot.globalScope.crypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:e,publicExponent:Nu(t),hash:{name:"SHA-256"}},!0,["sign","verify"]).then(function(o){return Ot.globalScope.crypto.subtle.exportKey("pkcs8",o.privateKey)}).then(void 0,function(o){r(o)}).then(function(o){if(o){var l=pe.privateKeyFromAsn1(_.fromDer(re.util.createBuffer(o)));r(null,{privateKey:l,publicKey:pe.setRsaPublicKey(l.n,l.e)})}});if(Pu("generateKey")&&Pu("exportKey")){var i=Ot.globalScope.msCrypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:e,publicExponent:Nu(t),hash:{name:"SHA-256"}},!0,["sign","verify"]);i.oncomplete=function(o){var l=o.target.result,c=Ot.globalScope.msCrypto.subtle.exportKey("pkcs8",l.privateKey);c.oncomplete=function(u){var d=u.target.result,f=pe.privateKeyFromAsn1(_.fromDer(re.util.createBuffer(d)));r(null,{privateKey:f,publicKey:pe.setRsaPublicKey(f.n,f.e)})},c.onerror=function(u){r(u)}},i.onerror=function(o){r(o)};return}}else if(Ru("generateKeyPairSync")){var s=bo.generateKeyPairSync("rsa",{modulusLength:e,publicExponent:t,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{privateKey:pe.privateKeyFromPem(s.privateKey),publicKey:pe.publicKeyFromPem(s.publicKey)}}}var a=pe.rsa.createKeyPairGenerationState(e,t,n);if(!r)return pe.rsa.stepKeyPairGenerationState(a,0),a.keys;Tm(a,n,r)};pe.setRsaPublicKey=pe.rsa.setPublicKey=function(e,t){var n={n:e,e:t};return n.encrypt=function(r,i,s){if(typeof i==="string")i=i.toUpperCase();else if(i===void 0)i="RSAES-PKCS1-V1_5";if(i==="RSAES-PKCS1-V1_5")i={encode:function(o,l,c){return Lu(o,l,2).getBytes()}};else if(i==="RSA-OAEP"||i==="RSAES-OAEP")i={encode:function(o,l){return re.pkcs1.encode_rsa_oaep(l,o,s)}};else if(["RAW","NONE","NULL",null].indexOf(i)!==-1)i={encode:function(o){return o}};else if(typeof i==="string")throw Error('Unsupported encryption scheme: "'+i+'".');var a=i.encode(r,n,!0);return pe.rsa.encrypt(a,n,!0)},n.verify=function(r,i,s,a){if(typeof s==="string")s=s.toUpperCase();else if(s===void 0)s="RSASSA-PKCS1-V1_5";if(a===void 0)a={_parseAllDigestBytes:!0,_skipPaddingChecks:!1};if(!("_parseAllDigestBytes"in a))a._parseAllDigestBytes=!0;if(!("_skipPaddingChecks"in a))a._skipPaddingChecks=!1;if(s==="RSASSA-PKCS1-V1_5")s={verify:function(l,c){c=Ls(c,n,!0,void 0,a);var u=_.fromDer(c,{parseAllBytes:a._parseAllDigestBytes}),d={},f=[];if(!_.validate(u,Em,d,f)||u.value.length!==2){var y=Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.");throw y.errors=f,y}var p=_.derToOid(d.algorithmIdentifier);if(!(p===re.oids.md2||p===re.oids.md5||p===re.oids.sha1||p===re.oids.sha224||p===re.oids.sha256||p===re.oids.sha384||p===re.oids.sha512||p===re.oids["sha512-224"]||p===re.oids["sha512-256"])){var y=Error("Unknown RSASSA-PKCS1-v1_5 DigestAlgorithm identifier.");throw y.oid=p,y}if(p===re.oids.md2||p===re.oids.md5){if(!("parameters"in d))throw Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value. Missing algorithm identifier NULL parameters.")}return l===d.digest}};else if(s==="NONE"||s==="NULL"||s===null)s={verify:function(l,c){return c=Ls(c,n,!0,void 0,a),l===c}};var o=pe.rsa.decrypt(i,n,!0,!1);return s.verify(r,o,n.n.bitLength())},n};pe.setRsaPrivateKey=pe.rsa.setPrivateKey=function(e,t,n,r,i,s,a,o){var l={n:e,e:t,d:n,p:r,q:i,dP:s,dQ:a,qInv:o};return l.decrypt=function(c,u,d){if(typeof u==="string")u=u.toUpperCase();else if(u===void 0)u="RSAES-PKCS1-V1_5";var f=pe.rsa.decrypt(c,l,!1,!1);if(u==="RSAES-PKCS1-V1_5")u={decode:Ls};else if(u==="RSA-OAEP"||u==="RSAES-OAEP")u={decode:function(y,p){return re.pkcs1.decode_rsa_oaep(p,y,d)}};else if(["RAW","NONE","NULL",null].indexOf(u)!==-1)u={decode:function(y){return y}};else throw Error('Unsupported encryption scheme: "'+u+'".');return u.decode(f,l,!1)},l.sign=function(c,u){var d=!1;if(typeof u==="string")u=u.toUpperCase();if(u===void 0||u==="RSASSA-PKCS1-V1_5")u={encode:wm},d=1;else if(u==="NONE"||u==="NULL"||u===null)u={encode:function(){return c}},d=1;var f=u.encode(c,l.n.bitLength());return pe.rsa.encrypt(f,l,d)},l};pe.wrapRsaPrivateKey=function(e){return _.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,_.integerToDer(0).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(pe.oids.rsaEncryption).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]),_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,_.toDer(e).getBytes())])};pe.privateKeyFromAsn1=function(e){var t={},n=[];if(_.validate(e,xm,t,n))e=_.fromDer(re.util.createBuffer(t.privateKey));if(t={},n=[],!_.validate(e,Sm,t,n)){var r=Error("Cannot read private key. ASN.1 object does not contain an RSAPrivateKey.");throw r.errors=n,r}var i,s,a,o,l,c,u,d;return i=re.util.createBuffer(t.privateKeyModulus).toHex(),s=re.util.createBuffer(t.privateKeyPublicExponent).toHex(),a=re.util.createBuffer(t.privateKeyPrivateExponent).toHex(),o=re.util.createBuffer(t.privateKeyPrime1).toHex(),l=re.util.createBuffer(t.privateKeyPrime2).toHex(),c=re.util.createBuffer(t.privateKeyExponent1).toHex(),u=re.util.createBuffer(t.privateKeyExponent2).toHex(),d=re.util.createBuffer(t.privateKeyCoefficient).toHex(),pe.setRsaPrivateKey(new ke(i,16),new ke(s,16),new ke(a,16),new ke(o,16),new ke(l,16),new ke(c,16),new ke(u,16),new ke(d,16))};pe.privateKeyToAsn1=pe.privateKeyToRSAPrivateKey=function(e){return _.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,_.integerToDer(0).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.n)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.e)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.d)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.p)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.q)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.dP)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.dQ)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.qInv))])};pe.publicKeyFromAsn1=function(e){var t={},n=[];if(_.validate(e,Cm,t,n)){var r=_.derToOid(t.publicKeyOid);if(r!==pe.oids.rsaEncryption){var i=Error("Cannot read public key. Unknown OID.");throw i.oid=r,i}e=t.rsaPublicKey}if(n=[],!_.validate(e,bm,t,n)){var i=Error("Cannot read public key. ASN.1 object does not contain an RSAPublicKey.");throw i.errors=n,i}var s=re.util.createBuffer(t.publicKeyModulus).toHex(),a=re.util.createBuffer(t.publicKeyExponent).toHex();return pe.setRsaPublicKey(new ke(s,16),new ke(a,16))};pe.publicKeyToAsn1=pe.publicKeyToSubjectPublicKeyInfo=function(e){return _.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(pe.oids.rsaEncryption).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]),_.create(_.Class.UNIVERSAL,_.Type.BITSTRING,!1,[pe.publicKeyToRSAPublicKey(e)])])};pe.publicKeyToRSAPublicKey=function(e){return _.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.n)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.e))])};function Lu(e,t,n){var r=re.util.createBuffer(),i=Math.ceil(t.n.bitLength()/8);if(e.length>i-11){var s=Error("Message is too long for PKCS#1 v1.5 padding.");throw s.length=e.length,s.max=i-11,s}r.putByte(0),r.putByte(n);var a=i-3-e.length,o;if(n===0||n===1){o=n===0?0:255;for(var l=0;l<a;++l)r.putByte(o)}else while(a>0){var c=0,u=re.random.getBytes(a);for(var l=0;l<a;++l)if(o=u.charCodeAt(l),o===0)++c;else r.putByte(o);a=c}return r.putByte(0),r.putBytes(e),r}function Ls(e,t,n,r,i){var s=Math.ceil(t.n.bitLength()/8),a=re.util.createBuffer(e),o=a.getByte(),l=a.getByte();if(o!==0||n&&l!==0&&l!==1||!n&&l!==2||n&&l===0&&typeof r>"u")throw Error("Encryption block is invalid.");var c=0;if(l===0){c=s-3-r;for(var u=0;u<c;++u)if(a.getByte()!==0)throw Error("Encryption block is invalid.")}else if(l===1){c=0;while(a.length()>1){if(a.getByte()!==255){--a.read;break}++c}if(c<8&&!(i?i._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}else if(l===2){c=0;while(a.length()>1){if(a.getByte()===0){--a.read;break}++c}if(c<8&&!(i?i._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}var d=a.getByte();if(d!==0||c!==s-3-a.length())throw Error("Encryption block is invalid.");return a.getBytes()}function Tm(e,t,n){if(typeof t==="function")n=t,t={};t=t||{};var r={algorithm:{name:t.algorithm||"PRIMEINC",options:{workers:t.workers||2,workLoad:t.workLoad||100,workerScript:t.workerScript}}};if("prng"in t)r.prng=t.prng;i();function i(){s(e.pBits,function(o,l){if(o)return n(o);if(e.p=l,e.q!==null)return a(o,e.q);s(e.qBits,a)})}function s(o,l){re.prime.generateProbablePrime(o,r,l)}function a(o,l){if(o)return n(o);if(e.q=l,e.p.compareTo(e.q)<0){var c=e.p;e.p=e.q,e.q=c}if(e.p.subtract(ke.ONE).gcd(e.e).compareTo(ke.ONE)!==0){e.p=null,i();return}if(e.q.subtract(ke.ONE).gcd(e.e).compareTo(ke.ONE)!==0){e.q=null,s(e.qBits,a);return}if(e.p1=e.p.subtract(ke.ONE),e.q1=e.q.subtract(ke.ONE),e.phi=e.p1.multiply(e.q1),e.phi.gcd(e.e).compareTo(ke.ONE)!==0){e.p=e.q=null,i();return}if(e.n=e.p.multiply(e.q),e.n.bitLength()!==e.bits){e.q=null,s(e.qBits,a);return}var u=e.e.modInverse(e.phi);e.keys={privateKey:pe.rsa.setPrivateKey(e.n,e.e,u,e.p,e.q,u.mod(e.p1),u.mod(e.q1),e.q.modInverse(e.p)),publicKey:pe.rsa.setPublicKey(e.n,e.e)},n(null,e.keys)}}function or(e){var t=e.toString(16);if(t[0]>="8")t="00"+t;var n=re.util.hexToBytes(t);if(n.length>1&&(n.charCodeAt(0)===0&&(n.charCodeAt(1)&128)===0||n.charCodeAt(0)===255&&(n.charCodeAt(1)&128)===128))return n.substr(1);return n}function Am(e){if(e<=100)return 27;if(e<=150)return 18;if(e<=200)return 15;if(e<=250)return 12;if(e<=300)return 9;if(e<=350)return 8;if(e<=400)return 7;if(e<=500)return 6;if(e<=600)return 5;if(e<=800)return 4;if(e<=1250)return 3;return 2}function Ru(e){return re.util.isNodejs&&typeof bo[e]==="function"}function Bu(e){return typeof Ot.globalScope<"u"&&typeof Ot.globalScope.crypto==="object"&&typeof Ot.globalScope.crypto.subtle==="object"&&typeof Ot.globalScope.crypto.subtle[e]==="function"}function Pu(e){return typeof Ot.globalScope<"u"&&typeof Ot.globalScope.msCrypto==="object"&&typeof Ot.globalScope.msCrypto.subtle==="object"&&typeof Ot.globalScope.msCrypto.subtle[e]==="function"}function Nu(e){var t=re.util.hexToBytes(e.toString(16)),n=new Uint8Array(t.length);for(var r=0;r<t.length;++r)n[r]=t.charCodeAt(r);return n}});var Eo=fe(function(r1,Mu){var j=me();Nr();Kt();mi();er();Dr();Rs();nn();Dt();po();xi();Be();if(typeof Co>"u")Co=j.jsbn.BigInteger;var Co,B=j.asn1,ge=j.pki=j.pki||{};Mu.exports=ge.pbe=j.pbe=j.pbe||{};var on=ge.oids,_m={name:"EncryptedPrivateKeyInfo",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedPrivateKeyInfo.encryptionAlgorithm",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:B.Class.UNIVERSAL,type:B.Type.OID,constructed:!1,capture:"encryptionOid"},{name:"AlgorithmIdentifier.parameters",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,captureAsn1:"encryptionParams"}]},{name:"EncryptedPrivateKeyInfo.encryptedData",tagClass:B.Class.UNIVERSAL,type:B.Type.OCTETSTRING,constructed:!1,capture:"encryptedData"}]},km={name:"PBES2Algorithms",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc.oid",tagClass:B.Class.UNIVERSAL,type:B.Type.OID,constructed:!1,capture:"kdfOid"},{name:"PBES2Algorithms.params",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.params.salt",tagClass:B.Class.UNIVERSAL,type:B.Type.OCTETSTRING,constructed:!1,capture:"kdfSalt"},{name:"PBES2Algorithms.params.iterationCount",tagClass:B.Class.UNIVERSAL,type:B.Type.INTEGER,constructed:!1,capture:"kdfIterationCount"},{name:"PBES2Algorithms.params.keyLength",tagClass:B.Class.UNIVERSAL,type:B.Type.INTEGER,constructed:!1,optional:!0,capture:"keyLength"},{name:"PBES2Algorithms.params.prf",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,optional:!0,value:[{name:"PBES2Algorithms.params.prf.algorithm",tagClass:B.Class.UNIVERSAL,type:B.Type.OID,constructed:!1,capture:"prfOid"}]}]}]},{name:"PBES2Algorithms.encryptionScheme",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.encryptionScheme.oid",tagClass:B.Class.UNIVERSAL,type:B.Type.OID,constructed:!1,capture:"encOid"},{name:"PBES2Algorithms.encryptionScheme.iv",tagClass:B.Class.UNIVERSAL,type:B.Type.OCTETSTRING,constructed:!1,capture:"encIv"}]}]},Im={name:"pkcs-12PbeParams",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"pkcs-12PbeParams.salt",tagClass:B.Class.UNIVERSAL,type:B.Type.OCTETSTRING,constructed:!1,capture:"salt"},{name:"pkcs-12PbeParams.iterations",tagClass:B.Class.UNIVERSAL,type:B.Type.INTEGER,constructed:!1,capture:"iterations"}]};ge.encryptPrivateKeyInfo=function(e,t,n){n=n||{},n.saltSize=n.saltSize||8,n.count=n.count||2048,n.algorithm=n.algorithm||"aes128",n.prfAlgorithm=n.prfAlgorithm||"sha1";var r=j.random.getBytesSync(n.saltSize),i=n.count,s=B.integerToDer(i),a,o,l;if(n.algorithm.indexOf("aes")===0||n.algorithm==="des"){var c,u,d;switch(n.algorithm){case"aes128":a=16,c=16,u=on["aes128-CBC"],d=j.aes.createEncryptionCipher;break;case"aes192":a=24,c=16,u=on["aes192-CBC"],d=j.aes.createEncryptionCipher;break;case"aes256":a=32,c=16,u=on["aes256-CBC"],d=j.aes.createEncryptionCipher;break;case"des":a=8,c=8,u=on.desCBC,d=j.des.createEncryptionCipher;break;default:var f=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw f.algorithm=n.algorithm,f}var y="hmacWith"+n.prfAlgorithm.toUpperCase(),p=Fu(y),v=j.pkcs5.pbkdf2(t,r,i,a,p),x=j.random.getBytesSync(c),b=d(v);b.start(x),b.update(B.toDer(e)),b.finish(),l=b.output.getBytes();var A=Rm(r,s,a,y);o=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(on.pkcs5PBES2).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(on.pkcs5PBKDF2).getBytes()),A]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(u).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,x)])])])}else if(n.algorithm==="3des"){a=24;var E=new j.util.ByteBuffer(r),v=ge.pbe.generatePkcs12Key(t,E,1,i,a),x=ge.pbe.generatePkcs12Key(t,E,2,i,a),b=j.des.createEncryptionCipher(v);b.start(x),b.update(B.toDer(e)),b.finish(),l=b.output.getBytes(),o=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(on["pbeWithSHAAnd3-KeyTripleDES-CBC"]).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,r),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,s.getBytes())])])}else{var f=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw f.algorithm=n.algorithm,f}var k=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[o,B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,l)]);return k};ge.decryptPrivateKeyInfo=function(e,t){var n=null,r={},i=[];if(!B.validate(e,_m,r,i)){var s=Error("Cannot read encrypted private key. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw s.errors=i,s}var a=B.derToOid(r.encryptionOid),o=ge.pbe.getCipher(a,r.encryptionParams,t),l=j.util.createBuffer(r.encryptedData);if(o.update(l),o.finish())n=B.fromDer(o.output);return n};ge.encryptedPrivateKeyToPem=function(e,t){var n={type:"ENCRYPTED PRIVATE KEY",body:B.toDer(e).getBytes()};return j.pem.encode(n,{maxline:t})};ge.encryptedPrivateKeyFromPem=function(e){var t=j.pem.decode(e)[0];if(t.type!=="ENCRYPTED PRIVATE KEY"){var n=Error('Could not convert encrypted private key from PEM; PEM header type is "ENCRYPTED PRIVATE KEY".');throw n.headerType=t.type,n}if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert encrypted private key from PEM; PEM is encrypted.");return B.fromDer(t.body)};ge.encryptRsaPrivateKey=function(e,t,n){if(n=n||{},!n.legacy){var r=ge.wrapRsaPrivateKey(ge.privateKeyToAsn1(e));return r=ge.encryptPrivateKeyInfo(r,t,n),ge.encryptedPrivateKeyToPem(r)}var i,s,a,o;switch(n.algorithm){case"aes128":i="AES-128-CBC",a=16,s=j.random.getBytesSync(16),o=j.aes.createEncryptionCipher;break;case"aes192":i="AES-192-CBC",a=24,s=j.random.getBytesSync(16),o=j.aes.createEncryptionCipher;break;case"aes256":i="AES-256-CBC",a=32,s=j.random.getBytesSync(16),o=j.aes.createEncryptionCipher;break;case"3des":i="DES-EDE3-CBC",a=24,s=j.random.getBytesSync(8),o=j.des.createEncryptionCipher;break;case"des":i="DES-CBC",a=8,s=j.random.getBytesSync(8),o=j.des.createEncryptionCipher;break;default:var l=Error('Could not encrypt RSA private key; unsupported encryption algorithm "'+n.algorithm+'".');throw l.algorithm=n.algorithm,l}var c=j.pbe.opensslDeriveBytes(t,s.substr(0,8),a),u=o(c);u.start(s),u.update(B.toDer(ge.privateKeyToAsn1(e))),u.finish();var d={type:"RSA PRIVATE KEY",procType:{version:"4",type:"ENCRYPTED"},dekInfo:{algorithm:i,parameters:j.util.bytesToHex(s).toUpperCase()},body:u.output.getBytes()};return j.pem.encode(d)};ge.decryptRsaPrivateKey=function(e,t){var n=null,r=j.pem.decode(e)[0];if(r.type!=="ENCRYPTED PRIVATE KEY"&&r.type!=="PRIVATE KEY"&&r.type!=="RSA PRIVATE KEY"){var i=Error('Could not convert private key from PEM; PEM header type is not "ENCRYPTED PRIVATE KEY", "PRIVATE KEY", or "RSA PRIVATE KEY".');throw i.headerType=i,i}if(r.procType&&r.procType.type==="ENCRYPTED"){var s,a;switch(r.dekInfo.algorithm){case"DES-CBC":s=8,a=j.des.createDecryptionCipher;break;case"DES-EDE3-CBC":s=24,a=j.des.createDecryptionCipher;break;case"AES-128-CBC":s=16,a=j.aes.createDecryptionCipher;break;case"AES-192-CBC":s=24,a=j.aes.createDecryptionCipher;break;case"AES-256-CBC":s=32,a=j.aes.createDecryptionCipher;break;case"RC2-40-CBC":s=5,a=function(d){return j.rc2.createDecryptionCipher(d,40)};break;case"RC2-64-CBC":s=8,a=function(d){return j.rc2.createDecryptionCipher(d,64)};break;case"RC2-128-CBC":s=16,a=function(d){return j.rc2.createDecryptionCipher(d,128)};break;default:var i=Error('Could not decrypt private key; unsupported encryption algorithm "'+r.dekInfo.algorithm+'".');throw i.algorithm=r.dekInfo.algorithm,i}var o=j.util.hexToBytes(r.dekInfo.parameters),l=j.pbe.opensslDeriveBytes(t,o.substr(0,8),s),c=a(l);if(c.start(o),c.update(j.util.createBuffer(r.body)),c.finish())n=c.output.getBytes();else return n}else n=r.body;if(r.type==="ENCRYPTED PRIVATE KEY")n=ge.decryptPrivateKeyInfo(B.fromDer(n),t);else n=B.fromDer(n);if(n!==null)n=ge.privateKeyFromAsn1(n);return n};ge.pbe.generatePkcs12Key=function(e,t,n,r,i,s){var a,o;if(typeof s>"u"||s===null){if(!("sha1"in j.md))throw Error('"sha1" hash algorithm unavailable.');s=j.md.sha1.create()}var l=s.digestLength,c=s.blockLength,u=new j.util.ByteBuffer,d=new j.util.ByteBuffer;if(e!==null&&e!==void 0){for(o=0;o<e.length;o++)d.putInt16(e.charCodeAt(o));d.putInt16(0)}var f=d.length(),y=t.length(),p=new j.util.ByteBuffer;p.fillWithByte(n,c);var v=c*Math.ceil(y/c),x=new j.util.ByteBuffer;for(o=0;o<v;o++)x.putByte(t.at(o%y));var b=c*Math.ceil(f/c),A=new j.util.ByteBuffer;for(o=0;o<b;o++)A.putByte(d.at(o%f));var E=x;E.putBuffer(A);var k=Math.ceil(i/l);for(var I=1;I<=k;I++){var R=new j.util.ByteBuffer;R.putBytes(p.bytes()),R.putBytes(E.bytes());for(var M=0;M<r;M++)s.start(),s.update(R.getBytes()),R=s.digest();var ee=new j.util.ByteBuffer;for(o=0;o<c;o++)ee.putByte(R.at(o%l));var O=Math.ceil(y/c)+Math.ceil(f/c),K=new j.util.ByteBuffer;for(a=0;a<O;a++){var ie=new j.util.ByteBuffer(E.getBytes(c)),ve=511;for(o=ee.length()-1;o>=0;o--)ve=ve>>8,ve+=ee.at(o)+ie.at(o),ie.setAt(o,ve&255);K.putBuffer(ie)}E=K,u.putBuffer(R)}return u.truncate(u.length()-i),u};ge.pbe.getCipher=function(e,t,n){switch(e){case ge.oids.pkcs5PBES2:return ge.pbe.getCipherForPBES2(e,t,n);case ge.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:case ge.oids["pbewithSHAAnd40BitRC2-CBC"]:return ge.pbe.getCipherForPKCS12PBE(e,t,n);default:var r=Error("Cannot read encrypted PBE data block. Unsupported OID.");throw r.oid=e,r.supportedOids=["pkcs5PBES2","pbeWithSHAAnd3-KeyTripleDES-CBC","pbewithSHAAnd40BitRC2-CBC"],r}};ge.pbe.getCipherForPBES2=function(e,t,n){var r={},i=[];if(!B.validate(t,km,r,i)){var s=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw s.errors=i,s}if(e=B.derToOid(r.kdfOid),e!==ge.oids.pkcs5PBKDF2){var s=Error("Cannot read encrypted private key. Unsupported key derivation function OID.");throw s.oid=e,s.supportedOids=["pkcs5PBKDF2"],s}if(e=B.derToOid(r.encOid),e!==ge.oids["aes128-CBC"]&&e!==ge.oids["aes192-CBC"]&&e!==ge.oids["aes256-CBC"]&&e!==ge.oids["des-EDE3-CBC"]&&e!==ge.oids.desCBC){var s=Error("Cannot read encrypted private key. Unsupported encryption scheme OID.");throw s.oid=e,s.supportedOids=["aes128-CBC","aes192-CBC","aes256-CBC","des-EDE3-CBC","desCBC"],s}var a=r.kdfSalt,o=j.util.createBuffer(r.kdfIterationCount);o=o.getInt(o.length()<<3);var l,c;switch(ge.oids[e]){case"aes128-CBC":l=16,c=j.aes.createDecryptionCipher;break;case"aes192-CBC":l=24,c=j.aes.createDecryptionCipher;break;case"aes256-CBC":l=32,c=j.aes.createDecryptionCipher;break;case"des-EDE3-CBC":l=24,c=j.des.createDecryptionCipher;break;case"desCBC":l=8,c=j.des.createDecryptionCipher;break}var u=Vu(r.prfOid),d=j.pkcs5.pbkdf2(n,a,o,l,u),f=r.encIv,y=c(d);return y.start(f),y};ge.pbe.getCipherForPKCS12PBE=function(e,t,n){var r={},i=[];if(!B.validate(t,Im,r,i)){var s=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw s.errors=i,s}var a=j.util.createBuffer(r.salt),o=j.util.createBuffer(r.iterations);o=o.getInt(o.length()<<3);var l,c,u;switch(e){case ge.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:l=24,c=8,u=j.des.startDecrypting;break;case ge.oids["pbewithSHAAnd40BitRC2-CBC"]:l=5,c=8,u=function(v,x){var b=j.rc2.createDecryptionCipher(v,40);return b.start(x,null),b};break;default:var s=Error("Cannot read PKCS #12 PBE data block. Unsupported OID.");throw s.oid=e,s}var d=Vu(r.prfOid),f=ge.pbe.generatePkcs12Key(n,a,1,o,l,d);d.start();var y=ge.pbe.generatePkcs12Key(n,a,2,o,c,d);return u(f,y)};ge.pbe.opensslDeriveBytes=function(e,t,n,r){if(typeof r>"u"||r===null){if(!("md5"in j.md))throw Error('"md5" hash algorithm unavailable.');r=j.md.md5.create()}if(t===null)t="";var i=[Uu(r,e+t)];for(var s=16,a=1;s<n;++a,s+=16)i.push(Uu(r,i[a-1]+e+t));return i.join("").substr(0,n)};function Uu(e,t){return e.start().update(t).digest().getBytes()}function Vu(e){var t;if(!e)t="hmacWithSHA1";else if(t=ge.oids[B.derToOid(e)],!t){var n=Error("Unsupported PRF OID.");throw n.oid=e,n.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],n}return Fu(t)}function Fu(e){var t=j.md;switch(e){case"hmacWithSHA224":t=j.md.sha512;case"hmacWithSHA1":case"hmacWithSHA256":case"hmacWithSHA384":case"hmacWithSHA512":e=e.substr(8).toLowerCase();break;default:var n=Error("Unsupported PRF algorithm.");throw n.algorithm=e,n.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],n}if(!t||!(e in t))throw Error("Unknown hash algorithm: "+e);return t[e].create()}function Rm(e,t,n,r){var i=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,e),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,t.getBytes())]);if(r!=="hmacWithSHA1")i.value.push(B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,j.util.hexToBytes(n.toString(16))),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(ge.oids[r]).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]));return i}});var wo=fe(function(n1,Hu){var Rn=me();Kt();Be();var G=Rn.asn1,Bn=Hu.exports=Rn.pkcs7asn1=Rn.pkcs7asn1||{};Rn.pkcs7=Rn.pkcs7||{};Rn.pkcs7.asn1=Bn;var Wu={name:"ContentInfo",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.ContentType",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:G.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,captureAsn1:"content"}]};Bn.contentInfoValidator=Wu;var $u={name:"EncryptedContentInfo",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentType",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"contentType"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentEncryptionAlgorithm.algorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm.parameter",tagClass:G.Class.UNIVERSAL,captureAsn1:"encParameter"}]},{name:"EncryptedContentInfo.encryptedContent",tagClass:G.Class.CONTEXT_SPECIFIC,type:0,capture:"encryptedContent",captureAsn1:"encryptedContentAsn1"}]};Bn.envelopedDataValidator={name:"EnvelopedData",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"EnvelopedData.Version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"version"},{name:"EnvelopedData.RecipientInfos",tagClass:G.Class.UNIVERSAL,type:G.Type.SET,constructed:!0,captureAsn1:"recipientInfos"}].concat($u)};Bn.encryptedDataValidator={name:"EncryptedData",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedData.Version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"version"}].concat($u)};var Bm={name:"SignerInfo",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1},{name:"SignerInfo.issuerAndSerialNumber",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.issuerAndSerialNumber.issuer",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"SignerInfo.issuerAndSerialNumber.serialNumber",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"SignerInfo.digestAlgorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.digestAlgorithm.algorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"digestAlgorithm"},{name:"SignerInfo.digestAlgorithm.parameter",tagClass:G.Class.UNIVERSAL,constructed:!1,captureAsn1:"digestParameter",optional:!0}]},{name:"SignerInfo.authenticatedAttributes",tagClass:G.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"authenticatedAttributes"},{name:"SignerInfo.digestEncryptionAlgorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,capture:"signatureAlgorithm"},{name:"SignerInfo.encryptedDigest",tagClass:G.Class.UNIVERSAL,type:G.Type.OCTETSTRING,constructed:!1,capture:"signature"},{name:"SignerInfo.unauthenticatedAttributes",tagClass:G.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,capture:"unauthenticatedAttributes"}]};Bn.signedDataValidator={name:"SignedData",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"SignedData.Version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"version"},{name:"SignedData.DigestAlgorithms",tagClass:G.Class.UNIVERSAL,type:G.Type.SET,constructed:!0,captureAsn1:"digestAlgorithms"},Wu,{name:"SignedData.Certificates",tagClass:G.Class.CONTEXT_SPECIFIC,type:0,optional:!0,captureAsn1:"certificates"},{name:"SignedData.CertificateRevocationLists",tagClass:G.Class.CONTEXT_SPECIFIC,type:1,optional:!0,captureAsn1:"crls"},{name:"SignedData.SignerInfos",tagClass:G.Class.UNIVERSAL,type:G.Type.SET,capture:"signerInfos",optional:!0,value:[Bm]}]};Bn.recipientInfoValidator={name:"RecipientInfo",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"version"},{name:"RecipientInfo.issuerAndSerial",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.issuerAndSerial.issuer",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"RecipientInfo.issuerAndSerial.serialNumber",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"RecipientInfo.keyEncryptionAlgorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.keyEncryptionAlgorithm.algorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"RecipientInfo.keyEncryptionAlgorithm.parameter",tagClass:G.Class.UNIVERSAL,constructed:!1,captureAsn1:"encParameter",optional:!0}]},{name:"RecipientInfo.encryptedKey",tagClass:G.Class.UNIVERSAL,type:G.Type.OCTETSTRING,constructed:!1,capture:"encKey"}]}});var To=fe(function(i1,Ku){var ln=me();Be();ln.mgf=ln.mgf||{};var Pm=Ku.exports=ln.mgf.mgf1=ln.mgf1=ln.mgf1||{};Pm.create=function(e){var t={generate:function(n,r){var i=new ln.util.ByteBuffer,s=Math.ceil(r/e.digestLength);for(var a=0;a<s;a++){var o=new ln.util.ByteBuffer;o.putInt32(a),e.start(),e.update(n+o.getBytes()),i.putBuffer(e.digest())}return i.truncate(i.length()-r),i.getBytes()}};return t}});var Gu=fe(function(s1,qu){var Os=me();To();qu.exports=Os.mgf=Os.mgf||{};Os.mgf.mgf1=Os.mgf1});var Us=fe(function(a1,ju){var cn=me();Dt();Be();var Nm=ju.exports=cn.pss=cn.pss||{};Nm.create=function(e){if(arguments.length===3)e={md:arguments[0],mgf:arguments[1],saltLength:arguments[2]};var t=e.md,n=e.mgf,r=t.digestLength,i=e.salt||null;if(typeof i==="string")i=cn.util.createBuffer(i);var s;if("saltLength"in e)s=e.saltLength;else if(i!==null)s=i.length();else throw Error("Salt length not specified or specific salt not given.");if(i!==null&&i.length()!==s)throw Error("Given salt length does not match length of given salt.");var a=e.prng||cn.random,o={};return o.encode=function(l,c){var u,d=c-1,f=Math.ceil(d/8),y=l.digest().getBytes();if(f<r+s+2)throw Error("Message is too long to encrypt.");var p;if(i===null)p=a.getBytesSync(s);else p=i.bytes();var v=new cn.util.ByteBuffer;v.fillWithByte(0,8),v.putBytes(y),v.putBytes(p),t.start(),t.update(v.getBytes());var x=t.digest().getBytes(),b=new cn.util.ByteBuffer;b.fillWithByte(0,f-s-r-2),b.putByte(1),b.putBytes(p);var A=b.getBytes(),E=f-r-1,k=n.generate(x,E),I="";for(u=0;u<E;u++)I+=String.fromCharCode(A.charCodeAt(u)^k.charCodeAt(u));var R=65280>>8*f-d&255;return I=String.fromCharCode(I.charCodeAt(0)&~R)+I.substr(1),I+x+String.fromCharCode(188)},o.verify=function(l,c,u){var d,f=u-1,y=Math.ceil(f/8);if(c=c.substr(-y),y<r+s+2)throw Error("Inconsistent parameters to PSS signature verification.");if(c.charCodeAt(y-1)!==188)throw Error("Encoded message does not end in 0xBC.");var p=y-r-1,v=c.substr(0,p),x=c.substr(p,r),b=65280>>8*y-f&255;if((v.charCodeAt(0)&b)!==0)throw Error("Bits beyond keysize not zero as expected.");var A=n.generate(x,p),E="";for(d=0;d<p;d++)E+=String.fromCharCode(v.charCodeAt(d)^A.charCodeAt(d));E=String.fromCharCode(E.charCodeAt(0)&~b)+E.substr(1);var k=y-r-s-2;for(d=0;d<k;d++)if(E.charCodeAt(d)!==0)throw Error("Leftmost octets not zero as expected");if(E.charCodeAt(k)!==1)throw Error("Inconsistent PSS signature, 0x01 marker not found");var I=E.substr(-s),R=new cn.util.ByteBuffer;R.fillWithByte(0,8),R.putBytes(l),R.putBytes(I),t.start(),t.update(R.getBytes());var M=t.digest().getBytes();return x===M},o}});var Ms=fe(function(o1,Ju){var ne=me();Nr();Kt();mi();er();Gu();Dr();nn();Us();xi();Be();var h=ne.asn1,F=Ju.exports=ne.pki=ne.pki||{},Re=F.oids,Je={};Je.CN=Re.commonName;Je.commonName="CN";Je.C=Re.countryName;Je.countryName="C";Je.L=Re.localityName;Je.localityName="L";Je.ST=Re.stateOrProvinceName;Je.stateOrProvinceName="ST";Je.O=Re.organizationName;Je.organizationName="O";Je.OU=Re.organizationalUnitName;Je.organizationalUnitName="OU";Je.E=Re.emailAddress;Je.emailAddress="E";var Qu=ne.pki.rsa.publicKeyValidator,Dm={name:"Certificate",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"tbsCertificate",value:[{name:"Certificate.TBSCertificate.version",tagClass:h.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.version.integer",tagClass:h.Class.UNIVERSAL,type:h.Type.INTEGER,constructed:!1,capture:"certVersion"}]},{name:"Certificate.TBSCertificate.serialNumber",tagClass:h.Class.UNIVERSAL,type:h.Type.INTEGER,constructed:!1,capture:"certSerialNumber"},{name:"Certificate.TBSCertificate.signature",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.signature.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"certinfoSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:h.Class.UNIVERSAL,optional:!0,captureAsn1:"certinfoSignatureParams"}]},{name:"Certificate.TBSCertificate.issuer",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"certIssuer"},{name:"Certificate.TBSCertificate.validity",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.validity.notBefore (utc)",tagClass:h.Class.UNIVERSAL,type:h.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity1UTCTime"},{name:"Certificate.TBSCertificate.validity.notBefore (generalized)",tagClass:h.Class.UNIVERSAL,type:h.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity2GeneralizedTime"},{name:"Certificate.TBSCertificate.validity.notAfter (utc)",tagClass:h.Class.UNIVERSAL,type:h.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity3UTCTime"},{name:"Certificate.TBSCertificate.validity.notAfter (generalized)",tagClass:h.Class.UNIVERSAL,type:h.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity4GeneralizedTime"}]},{name:"Certificate.TBSCertificate.subject",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"certSubject"},Qu,{name:"Certificate.TBSCertificate.issuerUniqueID",tagClass:h.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.issuerUniqueID.id",tagClass:h.Class.UNIVERSAL,type:h.Type.BITSTRING,constructed:!1,captureBitStringValue:"certIssuerUniqueId"}]},{name:"Certificate.TBSCertificate.subjectUniqueID",tagClass:h.Class.CONTEXT_SPECIFIC,type:2,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.subjectUniqueID.id",tagClass:h.Class.UNIVERSAL,type:h.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSubjectUniqueId"}]},{name:"Certificate.TBSCertificate.extensions",tagClass:h.Class.CONTEXT_SPECIFIC,type:3,constructed:!0,captureAsn1:"certExtensions",optional:!0}]},{name:"Certificate.signatureAlgorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.signatureAlgorithm.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"certSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:h.Class.UNIVERSAL,optional:!0,captureAsn1:"certSignatureParams"}]},{name:"Certificate.signatureValue",tagClass:h.Class.UNIVERSAL,type:h.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSignature"}]},Lm={name:"rsapss",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.hashAlgorithm",tagClass:h.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier",tagClass:h.Class.UNIVERSAL,type:h.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"hashOid"}]}]},{name:"rsapss.maskGenAlgorithm",tagClass:h.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier",tagClass:h.Class.UNIVERSAL,type:h.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"maskGenOid"},{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"maskGenHashOid"}]}]}]},{name:"rsapss.saltLength",tagClass:h.Class.CONTEXT_SPECIFIC,type:2,optional:!0,value:[{name:"rsapss.saltLength.saltLength",tagClass:h.Class.UNIVERSAL,type:h.Class.INTEGER,constructed:!1,capture:"saltLength"}]},{name:"rsapss.trailerField",tagClass:h.Class.CONTEXT_SPECIFIC,type:3,optional:!0,value:[{name:"rsapss.trailer.trailer",tagClass:h.Class.UNIVERSAL,type:h.Class.INTEGER,constructed:!1,capture:"trailer"}]}]},Om={name:"CertificationRequestInfo",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfo",value:[{name:"CertificationRequestInfo.integer",tagClass:h.Class.UNIVERSAL,type:h.Type.INTEGER,constructed:!1,capture:"certificationRequestInfoVersion"},{name:"CertificationRequestInfo.subject",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfoSubject"},Qu,{name:"CertificationRequestInfo.attributes",tagClass:h.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"certificationRequestInfoAttributes",value:[{name:"CertificationRequestInfo.attributes",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequestInfo.attributes.type",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1},{name:"CertificationRequestInfo.attributes.value",tagClass:h.Class.UNIVERSAL,type:h.Type.SET,constructed:!0}]}]}]},Um={name:"CertificationRequest",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"csr",value:[Om,{name:"CertificationRequest.signatureAlgorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequest.signatureAlgorithm.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"csrSignatureOid"},{name:"CertificationRequest.signatureAlgorithm.parameters",tagClass:h.Class.UNIVERSAL,optional:!0,captureAsn1:"csrSignatureParams"}]},{name:"CertificationRequest.signature",tagClass:h.Class.UNIVERSAL,type:h.Type.BITSTRING,constructed:!1,captureBitStringValue:"csrSignature"}]};F.RDNAttributesAsArray=function(e,t){var n=[],r,i,s;for(var a=0;a<e.value.length;++a){r=e.value[a];for(var o=0;o<r.value.length;++o){if(s={},i=r.value[o],s.type=h.derToOid(i.value[0].value),s.value=i.value[1].value,s.valueTagClass=i.value[1].type,s.type in Re){if(s.name=Re[s.type],s.name in Je)s.shortName=Je[s.name]}if(t)t.update(s.type),t.update(s.value);n.push(s)}}return n};F.CRIAttributesAsArray=function(e){var t=[];for(var n=0;n<e.length;++n){var r=e[n],i=h.derToOid(r.value[0].value),s=r.value[1].value;for(var a=0;a<s.length;++a){var o={};if(o.type=i,o.value=s[a].value,o.valueTagClass=s[a].type,o.type in Re){if(o.name=Re[o.type],o.name in Je)o.shortName=Je[o.name]}if(o.type===Re.extensionRequest){o.extensions=[];for(var l=0;l<o.value.length;++l)o.extensions.push(F.certificateExtensionFromAsn1(o.value[l]))}t.push(o)}}return t};function Ur(e,t){if(typeof t==="string")t={shortName:t};var n=null,r;for(var i=0;n===null&&i<e.attributes.length;++i)if(r=e.attributes[i],t.type&&t.type===r.type)n=r;else if(t.name&&t.name===r.name)n=r;else if(t.shortName&&t.shortName===r.shortName)n=r;return n}var Vs=function(e,t,n){var r={};if(e!==Re["RSASSA-PSS"])return r;if(n)r={hash:{algorithmOid:Re.sha1},mgf:{algorithmOid:Re.mgf1,hash:{algorithmOid:Re.sha1}},saltLength:20};var i={},s=[];if(!h.validate(t,Lm,i,s)){var a=Error("Cannot read RSASSA-PSS parameter block.");throw a.errors=s,a}if(i.hashOid!==void 0)r.hash=r.hash||{},r.hash.algorithmOid=h.derToOid(i.hashOid);if(i.maskGenOid!==void 0)r.mgf=r.mgf||{},r.mgf.algorithmOid=h.derToOid(i.maskGenOid),r.mgf.hash=r.mgf.hash||{},r.mgf.hash.algorithmOid=h.derToOid(i.maskGenHashOid);if(i.saltLength!==void 0)r.saltLength=i.saltLength.charCodeAt(0);return r},Fs=function(e){switch(Re[e.signatureOid]){case"sha1WithRSAEncryption":case"sha1WithRSASignature":return ne.md.sha1.create();case"md5WithRSAEncryption":return ne.md.md5.create();case"sha256WithRSAEncryption":return ne.md.sha256.create();case"sha384WithRSAEncryption":return ne.md.sha384.create();case"sha512WithRSAEncryption":return ne.md.sha512.create();case"RSASSA-PSS":return ne.md.sha256.create();default:var t=Error("Could not compute "+e.type+" digest. Unknown signature OID.");throw t.signatureOid=e.signatureOid,t}},Xu=function(e){var t=e.certificate,n;switch(t.signatureOid){case Re.sha1WithRSAEncryption:case Re.sha1WithRSASignature:break;case Re["RSASSA-PSS"]:var r,i;if(r=Re[t.signatureParameters.mgf.hash.algorithmOid],r===void 0||ne.md[r]===void 0){var s=Error("Unsupported MGF hash function.");throw s.oid=t.signatureParameters.mgf.hash.algorithmOid,s.name=r,s}if(i=Re[t.signatureParameters.mgf.algorithmOid],i===void 0||ne.mgf[i]===void 0){var s=Error("Unsupported MGF function.");throw s.oid=t.signatureParameters.mgf.algorithmOid,s.name=i,s}if(i=ne.mgf[i].create(ne.md[r].create()),r=Re[t.signatureParameters.hash.algorithmOid],r===void 0||ne.md[r]===void 0){var s=Error("Unsupported RSASSA-PSS hash function.");throw s.oid=t.signatureParameters.hash.algorithmOid,s.name=r,s}n=ne.pss.create(ne.md[r].create(),i,t.signatureParameters.saltLength);break}return t.publicKey.verify(e.md.digest().getBytes(),e.signature,n)};F.certificateFromPem=function(e,t,n){var r=ne.pem.decode(e)[0];if(r.type!=="CERTIFICATE"&&r.type!=="X509 CERTIFICATE"&&r.type!=="TRUSTED CERTIFICATE"){var i=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw i.headerType=r.type,i}if(r.procType&&r.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var s=h.fromDer(r.body,n);return F.certificateFromAsn1(s,t)};F.certificateToPem=function(e,t){var n={type:"CERTIFICATE",body:h.toDer(F.certificateToAsn1(e)).getBytes()};return ne.pem.encode(n,{maxline:t})};F.publicKeyFromPem=function(e){var t=ne.pem.decode(e)[0];if(t.type!=="PUBLIC KEY"&&t.type!=="RSA PUBLIC KEY"){var n=Error('Could not convert public key from PEM; PEM header type is not "PUBLIC KEY" or "RSA PUBLIC KEY".');throw n.headerType=t.type,n}if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert public key from PEM; PEM is encrypted.");var r=h.fromDer(t.body);return F.publicKeyFromAsn1(r)};F.publicKeyToPem=function(e,t){var n={type:"PUBLIC KEY",body:h.toDer(F.publicKeyToAsn1(e)).getBytes()};return ne.pem.encode(n,{maxline:t})};F.publicKeyToRSAPublicKeyPem=function(e,t){var n={type:"RSA PUBLIC KEY",body:h.toDer(F.publicKeyToRSAPublicKey(e)).getBytes()};return ne.pem.encode(n,{maxline:t})};F.getPublicKeyFingerprint=function(e,t){t=t||{};var n=t.md||ne.md.sha1.create(),r=t.type||"RSAPublicKey",i;switch(r){case"RSAPublicKey":i=h.toDer(F.publicKeyToRSAPublicKey(e)).getBytes();break;case"SubjectPublicKeyInfo":i=h.toDer(F.publicKeyToAsn1(e)).getBytes();break;default:throw Error('Unknown fingerprint type "'+t.type+'".')}n.start(),n.update(i);var s=n.digest();if(t.encoding==="hex"){var a=s.toHex();if(t.delimiter)return a.match(/.{2}/g).join(t.delimiter);return a}else if(t.encoding==="binary")return s.getBytes();else if(t.encoding)throw Error('Unknown encoding "'+t.encoding+'".');return s};F.certificationRequestFromPem=function(e,t,n){var r=ne.pem.decode(e)[0];if(r.type!=="CERTIFICATE REQUEST"){var i=Error('Could not convert certification request from PEM; PEM header type is not "CERTIFICATE REQUEST".');throw i.headerType=r.type,i}if(r.procType&&r.procType.type==="ENCRYPTED")throw Error("Could not convert certification request from PEM; PEM is encrypted.");var s=h.fromDer(r.body,n);return F.certificationRequestFromAsn1(s,t)};F.certificationRequestToPem=function(e,t){var n={type:"CERTIFICATE REQUEST",body:h.toDer(F.certificationRequestToAsn1(e)).getBytes()};return ne.pem.encode(n,{maxline:t})};F.createCertificate=function(){var e={};return e.version=2,e.serialNumber="00",e.signatureOid=null,e.signature=null,e.siginfo={},e.siginfo.algorithmOid=null,e.validity={},e.validity.notBefore=new Date,e.validity.notAfter=new Date,e.issuer={},e.issuer.getField=function(t){return Ur(e.issuer,t)},e.issuer.addField=function(t){Ut([t]),e.issuer.attributes.push(t)},e.issuer.attributes=[],e.issuer.hash=null,e.subject={},e.subject.getField=function(t){return Ur(e.subject,t)},e.subject.addField=function(t){Ut([t]),e.subject.attributes.push(t)},e.subject.attributes=[],e.subject.hash=null,e.extensions=[],e.publicKey=null,e.md=null,e.setSubject=function(t,n){if(Ut(t),e.subject.attributes=t,delete e.subject.uniqueId,n)e.subject.uniqueId=n;e.subject.hash=null},e.setIssuer=function(t,n){if(Ut(t),e.issuer.attributes=t,delete e.issuer.uniqueId,n)e.issuer.uniqueId=n;e.issuer.hash=null},e.setExtensions=function(t){for(var n=0;n<t.length;++n)Yu(t[n],{cert:e});e.extensions=t},e.getExtension=function(t){if(typeof t==="string")t={name:t};var n=null,r;for(var i=0;n===null&&i<e.extensions.length;++i)if(r=e.extensions[i],t.id&&r.id===t.id)n=r;else if(t.name&&r.name===t.name)n=r;return n},e.sign=function(t,n){e.md=n||ne.md.sha1.create();var r=Re[e.md.algorithm+"WithRSAEncryption"];if(!r){var i=Error("Could not compute certificate digest. Unknown message digest algorithm OID.");throw i.algorithm=e.md.algorithm,i}e.signatureOid=e.siginfo.algorithmOid=r,e.tbsCertificate=F.getTBSCertificate(e);var s=h.toDer(e.tbsCertificate);e.md.update(s.getBytes()),e.signature=t.sign(e.md)},e.verify=function(t){var n=!1;if(!e.issued(t)){var r=t.issuer,i=e.subject,s=Error("The parent certificate did not issue the given child certificate; the child certificate's issuer does not match the parent's subject.");throw s.expectedIssuer=i.attributes,s.actualIssuer=r.attributes,s}var a=t.md;if(a===null){a=Fs({signatureOid:t.signatureOid,type:"certificate"});var o=t.tbsCertificate||F.getTBSCertificate(t),l=h.toDer(o);a.update(l.getBytes())}if(a!==null)n=Xu({certificate:e,md:a,signature:t.signature});return n},e.isIssuer=function(t){var n=!1,r=e.issuer,i=t.subject;if(r.hash&&i.hash)n=r.hash===i.hash;else if(r.attributes.length===i.attributes.length){n=!0;var s,a;for(var o=0;n&&o<r.attributes.length;++o)if(s=r.attributes[o],a=i.attributes[o],s.type!==a.type||s.value!==a.value)n=!1}return n},e.issued=function(t){return t.isIssuer(e)},e.generateSubjectKeyIdentifier=function(){return F.getPublicKeyFingerprint(e.publicKey,{type:"RSAPublicKey"})},e.verifySubjectKeyIdentifier=function(){var t=Re.subjectKeyIdentifier;for(var n=0;n<e.extensions.length;++n){var r=e.extensions[n];if(r.id===t){var i=e.generateSubjectKeyIdentifier().getBytes();return ne.util.hexToBytes(r.subjectKeyIdentifier)===i}}return!1},e};F.certificateFromAsn1=function(e,t){var n={},r=[];if(!h.validate(e,Dm,n,r)){var i=Error("Cannot read X.509 certificate. ASN.1 object is not an X509v3 Certificate.");throw i.errors=r,i}var s=h.derToOid(n.publicKeyOid);if(s!==F.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var a=F.createCertificate();a.version=n.certVersion?n.certVersion.charCodeAt(0):0;var o=ne.util.createBuffer(n.certSerialNumber);a.serialNumber=o.toHex(),a.signatureOid=ne.asn1.derToOid(n.certSignatureOid),a.signatureParameters=Vs(a.signatureOid,n.certSignatureParams,!0),a.siginfo.algorithmOid=ne.asn1.derToOid(n.certinfoSignatureOid),a.siginfo.parameters=Vs(a.siginfo.algorithmOid,n.certinfoSignatureParams,!1),a.signature=n.certSignature;var l=[];if(n.certValidity1UTCTime!==void 0)l.push(h.utcTimeToDate(n.certValidity1UTCTime));if(n.certValidity2GeneralizedTime!==void 0)l.push(h.generalizedTimeToDate(n.certValidity2GeneralizedTime));if(n.certValidity3UTCTime!==void 0)l.push(h.utcTimeToDate(n.certValidity3UTCTime));if(n.certValidity4GeneralizedTime!==void 0)l.push(h.generalizedTimeToDate(n.certValidity4GeneralizedTime));if(l.length>2)throw Error("Cannot read notBefore/notAfter validity times; more than two times were provided in the certificate.");if(l.length<2)throw Error("Cannot read notBefore/notAfter validity times; they were not provided as either UTCTime or GeneralizedTime.");if(a.validity.notBefore=l[0],a.validity.notAfter=l[1],a.tbsCertificate=n.tbsCertificate,t){a.md=Fs({signatureOid:a.signatureOid,type:"certificate"});var c=h.toDer(a.tbsCertificate);a.md.update(c.getBytes())}var u=ne.md.sha1.create(),d=h.toDer(n.certIssuer);if(u.update(d.getBytes()),a.issuer.getField=function(p){return Ur(a.issuer,p)},a.issuer.addField=function(p){Ut([p]),a.issuer.attributes.push(p)},a.issuer.attributes=F.RDNAttributesAsArray(n.certIssuer),n.certIssuerUniqueId)a.issuer.uniqueId=n.certIssuerUniqueId;a.issuer.hash=u.digest().toHex();var f=ne.md.sha1.create(),y=h.toDer(n.certSubject);if(f.update(y.getBytes()),a.subject.getField=function(p){return Ur(a.subject,p)},a.subject.addField=function(p){Ut([p]),a.subject.attributes.push(p)},a.subject.attributes=F.RDNAttributesAsArray(n.certSubject),n.certSubjectUniqueId)a.subject.uniqueId=n.certSubjectUniqueId;if(a.subject.hash=f.digest().toHex(),n.certExtensions)a.extensions=F.certificateExtensionsFromAsn1(n.certExtensions);else a.extensions=[];return a.publicKey=F.publicKeyFromAsn1(n.subjectPublicKeyInfo),a};F.certificateExtensionsFromAsn1=function(e){var t=[];for(var n=0;n<e.value.length;++n){var r=e.value[n];for(var i=0;i<r.value.length;++i)t.push(F.certificateExtensionFromAsn1(r.value[i]))}return t};F.certificateExtensionFromAsn1=function(e){var t={};if(t.id=h.derToOid(e.value[0].value),t.critical=!1,e.value[1].type===h.Type.BOOLEAN)t.critical=e.value[1].value.charCodeAt(0)!==0,t.value=e.value[2].value;else t.value=e.value[1].value;if(t.id in Re){if(t.name=Re[t.id],t.name==="keyUsage"){var n=h.fromDer(t.value),r=0,i=0;if(n.value.length>1)r=n.value.charCodeAt(1),i=n.value.length>2?n.value.charCodeAt(2):0;t.digitalSignature=(r&128)===128,t.nonRepudiation=(r&64)===64,t.keyEncipherment=(r&32)===32,t.dataEncipherment=(r&16)===16,t.keyAgreement=(r&8)===8,t.keyCertSign=(r&4)===4,t.cRLSign=(r&2)===2,t.encipherOnly=(r&1)===1,t.decipherOnly=(i&128)===128}else if(t.name==="basicConstraints"){var n=h.fromDer(t.value);if(n.value.length>0&&n.value[0].type===h.Type.BOOLEAN)t.cA=n.value[0].value.charCodeAt(0)!==0;else t.cA=!1;var s=null;if(n.value.length>0&&n.value[0].type===h.Type.INTEGER)s=n.value[0].value;else if(n.value.length>1)s=n.value[1].value;if(s!==null)t.pathLenConstraint=h.derToInteger(s)}else if(t.name==="extKeyUsage"){var n=h.fromDer(t.value);for(var a=0;a<n.value.length;++a){var o=h.derToOid(n.value[a].value);if(o in Re)t[Re[o]]=!0;else t[o]=!0}}else if(t.name==="nsCertType"){var n=h.fromDer(t.value),r=0;if(n.value.length>1)r=n.value.charCodeAt(1);t.client=(r&128)===128,t.server=(r&64)===64,t.email=(r&32)===32,t.objsign=(r&16)===16,t.reserved=(r&8)===8,t.sslCA=(r&4)===4,t.emailCA=(r&2)===2,t.objCA=(r&1)===1}else if(t.name==="subjectAltName"||t.name==="issuerAltName"){t.altNames=[];var l,n=h.fromDer(t.value);for(var c=0;c<n.value.length;++c){l=n.value[c];var u={type:l.type,value:l.value};switch(t.altNames.push(u),l.type){case 1:case 2:case 6:break;case 7:u.ip=ne.util.bytesToIP(l.value);break;case 8:u.oid=h.derToOid(l.value);break;default:}}}else if(t.name==="subjectKeyIdentifier"){var n=h.fromDer(t.value);t.subjectKeyIdentifier=ne.util.bytesToHex(n.value)}}return t};F.certificationRequestFromAsn1=function(e,t){var n={},r=[];if(!h.validate(e,Um,n,r)){var i=Error("Cannot read PKCS#10 certificate request. ASN.1 object is not a PKCS#10 CertificationRequest.");throw i.errors=r,i}var s=h.derToOid(n.publicKeyOid);if(s!==F.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var a=F.createCertificationRequest();if(a.version=n.csrVersion?n.csrVersion.charCodeAt(0):0,a.signatureOid=ne.asn1.derToOid(n.csrSignatureOid),a.signatureParameters=Vs(a.signatureOid,n.csrSignatureParams,!0),a.siginfo.algorithmOid=ne.asn1.derToOid(n.csrSignatureOid),a.siginfo.parameters=Vs(a.siginfo.algorithmOid,n.csrSignatureParams,!1),a.signature=n.csrSignature,a.certificationRequestInfo=n.certificationRequestInfo,t){a.md=Fs({signatureOid:a.signatureOid,type:"certification request"});var o=h.toDer(a.certificationRequestInfo);a.md.update(o.getBytes())}var l=ne.md.sha1.create();return a.subject.getField=function(c){return Ur(a.subject,c)},a.subject.addField=function(c){Ut([c]),a.subject.attributes.push(c)},a.subject.attributes=F.RDNAttributesAsArray(n.certificationRequestInfoSubject,l),a.subject.hash=l.digest().toHex(),a.publicKey=F.publicKeyFromAsn1(n.subjectPublicKeyInfo),a.getAttribute=function(c){return Ur(a,c)},a.addAttribute=function(c){Ut([c]),a.attributes.push(c)},a.attributes=F.CRIAttributesAsArray(n.certificationRequestInfoAttributes||[]),a};F.createCertificationRequest=function(){var e={};return e.version=0,e.signatureOid=null,e.signature=null,e.siginfo={},e.siginfo.algorithmOid=null,e.subject={},e.subject.getField=function(t){return Ur(e.subject,t)},e.subject.addField=function(t){Ut([t]),e.subject.attributes.push(t)},e.subject.attributes=[],e.subject.hash=null,e.publicKey=null,e.attributes=[],e.getAttribute=function(t){return Ur(e,t)},e.addAttribute=function(t){Ut([t]),e.attributes.push(t)},e.md=null,e.setSubject=function(t){Ut(t),e.subject.attributes=t,e.subject.hash=null},e.setAttributes=function(t){Ut(t),e.attributes=t},e.sign=function(t,n){e.md=n||ne.md.sha1.create();var r=Re[e.md.algorithm+"WithRSAEncryption"];if(!r){var i=Error("Could not compute certification request digest. Unknown message digest algorithm OID.");throw i.algorithm=e.md.algorithm,i}e.signatureOid=e.siginfo.algorithmOid=r,e.certificationRequestInfo=F.getCertificationRequestInfo(e);var s=h.toDer(e.certificationRequestInfo);e.md.update(s.getBytes()),e.signature=t.sign(e.md)},e.verify=function(){var t=!1,n=e.md;if(n===null){n=Fs({signatureOid:e.signatureOid,type:"certification request"});var r=e.certificationRequestInfo||F.getCertificationRequestInfo(e),i=h.toDer(r);n.update(i.getBytes())}if(n!==null)t=Xu({certificate:e,md:n,signature:e.signature});return t},e};function Pn(e){var t=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]),n,r,i=e.attributes;for(var s=0;s<i.length;++s){n=i[s];var a=n.value,o=h.Type.PRINTABLESTRING;if("valueTagClass"in n){if(o=n.valueTagClass,o===h.Type.UTF8)a=ne.util.encodeUtf8(a)}r=h.create(h.Class.UNIVERSAL,h.Type.SET,!0,[h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(n.type).getBytes()),h.create(h.Class.UNIVERSAL,o,!1,a)])]),t.value.push(r)}return t}function Ut(e){var t;for(var n=0;n<e.length;++n){if(t=e[n],typeof t.name>"u"){if(t.type&&t.type in F.oids)t.name=F.oids[t.type];else if(t.shortName&&t.shortName in Je)t.name=F.oids[Je[t.shortName]]}if(typeof t.type>"u")if(t.name&&t.name in F.oids)t.type=F.oids[t.name];else{var r=Error("Attribute type not specified.");throw r.attribute=t,r}if(typeof t.shortName>"u"){if(t.name&&t.name in Je)t.shortName=Je[t.name]}if(t.type===Re.extensionRequest){if(t.valueConstructed=!0,t.valueTagClass=h.Type.SEQUENCE,!t.value&&t.extensions){t.value=[];for(var i=0;i<t.extensions.length;++i)t.value.push(F.certificateExtensionToAsn1(Yu(t.extensions[i])))}}if(typeof t.value>"u"){var r=Error("Attribute value not specified.");throw r.attribute=t,r}}}function Yu(e,t){if(t=t||{},typeof e.name>"u"){if(e.id&&e.id in F.oids)e.name=F.oids[e.id]}if(typeof e.id>"u")if(e.name&&e.name in F.oids)e.id=F.oids[e.name];else{var n=Error("Extension ID not specified.");throw n.extension=e,n}if(typeof e.value<"u")return e;if(e.name==="keyUsage"){var r=0,i=0,s=0;if(e.digitalSignature)i|=128,r=7;if(e.nonRepudiation)i|=64,r=6;if(e.keyEncipherment)i|=32,r=5;if(e.dataEncipherment)i|=16,r=4;if(e.keyAgreement)i|=8,r=3;if(e.keyCertSign)i|=4,r=2;if(e.cRLSign)i|=2,r=1;if(e.encipherOnly)i|=1,r=0;if(e.decipherOnly)s|=128,r=7;var a=String.fromCharCode(r);if(s!==0)a+=String.fromCharCode(i)+String.fromCharCode(s);else if(i!==0)a+=String.fromCharCode(i);e.value=h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,a)}else if(e.name==="basicConstraints"){if(e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]),e.cA)e.value.value.push(h.create(h.Class.UNIVERSAL,h.Type.BOOLEAN,!1,String.fromCharCode(255)));if("pathLenConstraint"in e)e.value.value.push(h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,h.integerToDer(e.pathLenConstraint).getBytes()))}else if(e.name==="extKeyUsage"){e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);var o=e.value.value;for(var l in e){if(e[l]!==!0)continue;if(l in Re)o.push(h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(Re[l]).getBytes()));else if(l.indexOf(".")!==-1)o.push(h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(l).getBytes()))}}else if(e.name==="nsCertType"){var r=0,i=0;if(e.client)i|=128,r=7;if(e.server)i|=64,r=6;if(e.email)i|=32,r=5;if(e.objsign)i|=16,r=4;if(e.reserved)i|=8,r=3;if(e.sslCA)i|=4,r=2;if(e.emailCA)i|=2,r=1;if(e.objCA)i|=1,r=0;var a=String.fromCharCode(r);if(i!==0)a+=String.fromCharCode(i);e.value=h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,a)}else if(e.name==="subjectAltName"||e.name==="issuerAltName"){e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);var c;for(var u=0;u<e.altNames.length;++u){c=e.altNames[u];var a=c.value;if(c.type===7&&c.ip){if(a=ne.util.bytesFromIP(c.ip),a===null){var n=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw n.extension=e,n}}else if(c.type===8)if(c.oid)a=h.oidToDer(h.oidToDer(c.oid));else a=h.oidToDer(a);e.value.value.push(h.create(h.Class.CONTEXT_SPECIFIC,c.type,!1,a))}}else if(e.name==="nsComment"&&t.cert){if(!/^[\x00-\x7F]*$/.test(e.comment)||e.comment.length<1||e.comment.length>128)throw Error('Invalid "nsComment" content.');e.value=h.create(h.Class.UNIVERSAL,h.Type.IA5STRING,!1,e.comment)}else if(e.name==="subjectKeyIdentifier"&&t.cert){var d=t.cert.generateSubjectKeyIdentifier();e.subjectKeyIdentifier=d.toHex(),e.value=h.create(h.Class.UNIVERSAL,h.Type.OCTETSTRING,!1,d.getBytes())}else if(e.name==="authorityKeyIdentifier"&&t.cert){e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);var o=e.value.value;if(e.keyIdentifier){var f=e.keyIdentifier===!0?t.cert.generateSubjectKeyIdentifier().getBytes():e.keyIdentifier;o.push(h.create(h.Class.CONTEXT_SPECIFIC,0,!1,f))}if(e.authorityCertIssuer){var y=[h.create(h.Class.CONTEXT_SPECIFIC,4,!0,[Pn(e.authorityCertIssuer===!0?t.cert.issuer:e.authorityCertIssuer)])];o.push(h.create(h.Class.CONTEXT_SPECIFIC,1,!0,y))}if(e.serialNumber){var p=ne.util.hexToBytes(e.serialNumber===!0?t.cert.serialNumber:e.serialNumber);o.push(h.create(h.Class.CONTEXT_SPECIFIC,2,!1,p))}}else if(e.name==="cRLDistributionPoints"){e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);var o=e.value.value,v=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]),x=h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[]),c;for(var u=0;u<e.altNames.length;++u){c=e.altNames[u];var a=c.value;if(c.type===7&&c.ip){if(a=ne.util.bytesFromIP(c.ip),a===null){var n=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw n.extension=e,n}}else if(c.type===8)if(c.oid)a=h.oidToDer(h.oidToDer(c.oid));else a=h.oidToDer(a);x.value.push(h.create(h.Class.CONTEXT_SPECIFIC,c.type,!1,a))}v.value.push(h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[x])),o.push(v)}if(typeof e.value>"u"){var n=Error("Extension value not specified.");throw n.extension=e,n}return e}function Ao(e,t){switch(e){case Re["RSASSA-PSS"]:var n=[];if(t.hash.algorithmOid!==void 0)n.push(h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(t.hash.algorithmOid).getBytes()),h.create(h.Class.UNIVERSAL,h.Type.NULL,!1,"")])]));if(t.mgf.algorithmOid!==void 0)n.push(h.create(h.Class.CONTEXT_SPECIFIC,1,!0,[h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(t.mgf.algorithmOid).getBytes()),h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(t.mgf.hash.algorithmOid).getBytes()),h.create(h.Class.UNIVERSAL,h.Type.NULL,!1,"")])])]));if(t.saltLength!==void 0)n.push(h.create(h.Class.CONTEXT_SPECIFIC,2,!0,[h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,h.integerToDer(t.saltLength).getBytes())]));return h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,n);default:return h.create(h.Class.UNIVERSAL,h.Type.NULL,!1,"")}}function Vm(e){var t=h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[]);if(e.attributes.length===0)return t;var n=e.attributes;for(var r=0;r<n.length;++r){var i=n[r],s=i.value,a=h.Type.UTF8;if("valueTagClass"in i)a=i.valueTagClass;if(a===h.Type.UTF8)s=ne.util.encodeUtf8(s);var o=!1;if("valueConstructed"in i)o=i.valueConstructed;var l=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(i.type).getBytes()),h.create(h.Class.UNIVERSAL,h.Type.SET,!0,[h.create(h.Class.UNIVERSAL,a,o,s)])]);t.value.push(l)}return t}var Fm=new Date("1950-01-01T00:00:00Z"),Mm=new Date("2050-01-01T00:00:00Z");function zu(e){if(e>=Fm&&e<Mm)return h.create(h.Class.UNIVERSAL,h.Type.UTCTIME,!1,h.dateToUtcTime(e));else return h.create(h.Class.UNIVERSAL,h.Type.GENERALIZEDTIME,!1,h.dateToGeneralizedTime(e))}F.getTBSCertificate=function(e){var t=zu(e.validity.notBefore),n=zu(e.validity.notAfter),r=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,h.integerToDer(e.version).getBytes())]),h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,ne.util.hexToBytes(e.serialNumber)),h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(e.siginfo.algorithmOid).getBytes()),Ao(e.siginfo.algorithmOid,e.siginfo.parameters)]),Pn(e.issuer),h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[t,n]),Pn(e.subject),F.publicKeyToAsn1(e.publicKey)]);if(e.issuer.uniqueId)r.value.push(h.create(h.Class.CONTEXT_SPECIFIC,1,!0,[h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,String.fromCharCode(0)+e.issuer.uniqueId)]));if(e.subject.uniqueId)r.value.push(h.create(h.Class.CONTEXT_SPECIFIC,2,!0,[h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,String.fromCharCode(0)+e.subject.uniqueId)]));if(e.extensions.length>0)r.value.push(F.certificateExtensionsToAsn1(e.extensions));return r};F.getCertificationRequestInfo=function(e){var t=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,h.integerToDer(e.version).getBytes()),Pn(e.subject),F.publicKeyToAsn1(e.publicKey),Vm(e)]);return t};F.distinguishedNameToAsn1=function(e){return Pn(e)};F.certificateToAsn1=function(e){var t=e.tbsCertificate||F.getTBSCertificate(e);return h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[t,h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(e.signatureOid).getBytes()),Ao(e.signatureOid,e.signatureParameters)]),h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,String.fromCharCode(0)+e.signature)])};F.certificateExtensionsToAsn1=function(e){var t=h.create(h.Class.CONTEXT_SPECIFIC,3,!0,[]),n=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);t.value.push(n);for(var r=0;r<e.length;++r)n.value.push(F.certificateExtensionToAsn1(e[r]));return t};F.certificateExtensionToAsn1=function(e){var t=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);if(t.value.push(h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(e.id).getBytes())),e.critical)t.value.push(h.create(h.Class.UNIVERSAL,h.Type.BOOLEAN,!1,String.fromCharCode(255)));var n=e.value;if(typeof e.value!=="string")n=h.toDer(n).getBytes();return t.value.push(h.create(h.Class.UNIVERSAL,h.Type.OCTETSTRING,!1,n)),t};F.certificationRequestToAsn1=function(e){var t=e.certificationRequestInfo||F.getCertificationRequestInfo(e);return h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[t,h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(e.signatureOid).getBytes()),Ao(e.signatureOid,e.signatureParameters)]),h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,String.fromCharCode(0)+e.signature)])};F.createCaStore=function(e){var t={certs:{}};t.getIssuer=function(a){var o=n(a.issuer);return o},t.addCertificate=function(a){if(typeof a==="string")a=ne.pki.certificateFromPem(a);if(r(a.subject),!t.hasCertificate(a))if(a.subject.hash in t.certs){var o=t.certs[a.subject.hash];if(!ne.util.isArray(o))o=[o];o.push(a),t.certs[a.subject.hash]=o}else t.certs[a.subject.hash]=a},t.hasCertificate=function(a){if(typeof a==="string")a=ne.pki.certificateFromPem(a);var o=n(a.subject);if(!o)return!1;if(!ne.util.isArray(o))o=[o];var l=h.toDer(F.certificateToAsn1(a)).getBytes();for(var c=0;c<o.length;++c){var u=h.toDer(F.certificateToAsn1(o[c])).getBytes();if(l===u)return!0}return!1},t.listAllCertificates=function(){var a=[];for(var o in t.certs)if(t.certs.hasOwnProperty(o)){var l=t.certs[o];if(!ne.util.isArray(l))a.push(l);else for(var c=0;c<l.length;++c)a.push(l[c])}return a},t.removeCertificate=function(a){var o;if(typeof a==="string")a=ne.pki.certificateFromPem(a);if(r(a.subject),!t.hasCertificate(a))return null;var l=n(a.subject);if(!ne.util.isArray(l))return o=t.certs[a.subject.hash],delete t.certs[a.subject.hash],o;var c=h.toDer(F.certificateToAsn1(a)).getBytes();for(var u=0;u<l.length;++u){var d=h.toDer(F.certificateToAsn1(l[u])).getBytes();if(c===d)o=l[u],l.splice(u,1)}if(l.length===0)delete t.certs[a.subject.hash];return o};function n(a){return r(a),t.certs[a.hash]||null}function r(a){if(!a.hash){var o=ne.md.sha1.create();a.attributes=F.RDNAttributesAsArray(Pn(a),o),a.hash=o.digest().toHex()}}if(e)for(var i=0;i<e.length;++i){var s=e[i];t.addCertificate(s)}return t};F.certificateError={bad_certificate:"forge.pki.BadCertificate",unsupported_certificate:"forge.pki.UnsupportedCertificate",certificate_revoked:"forge.pki.CertificateRevoked",certificate_expired:"forge.pki.CertificateExpired",certificate_unknown:"forge.pki.CertificateUnknown",unknown_ca:"forge.pki.UnknownCertificateAuthority"};F.verifyCertificateChain=function(e,t,n){if(typeof n==="function")n={verify:n};n=n||{},t=t.slice(0);var r=t.slice(0),i=n.validityCheckDate;if(typeof i>"u")i=new Date;var s=!0,a=null,o=0;do{var l=t.shift(),c=null,u=!1;if(i){if(i<l.validity.notBefore||i>l.validity.notAfter)a={message:"Certificate is not valid yet or has expired.",error:F.certificateError.certificate_expired,notBefore:l.validity.notBefore,notAfter:l.validity.notAfter,now:i}}if(a===null){if(c=t[0]||e.getIssuer(l),c===null){if(l.isIssuer(l))u=!0,c=l}if(c){var d=c;if(!ne.util.isArray(d))d=[d];var f=!1;while(!f&&d.length>0){c=d.shift();try{f=c.verify(l)}catch(I){}}if(!f)a={message:"Certificate signature is invalid.",error:F.certificateError.bad_certificate}}if(a===null&&(!c||u)&&!e.hasCertificate(l))a={message:"Certificate is not trusted.",error:F.certificateError.unknown_ca}}if(a===null&&c&&!l.isIssuer(c))a={message:"Certificate issuer is invalid.",error:F.certificateError.bad_certificate};if(a===null){var y={keyUsage:!0,basicConstraints:!0};for(var p=0;a===null&&p<l.extensions.length;++p){var v=l.extensions[p];if(v.critical&&!(v.name in y))a={message:"Certificate has an unsupported critical extension.",error:F.certificateError.unsupported_certificate}}}if(a===null&&(!s||t.length===0&&(!c||u))){var x=l.getExtension("basicConstraints"),b=l.getExtension("keyUsage");if(b!==null){if(!b.keyCertSign||x===null)a={message:"Certificate keyUsage or basicConstraints conflict or indicate that the certificate is not a CA. If the certificate is the only one in the chain or isn't the first then the certificate must be a valid CA.",error:F.certificateError.bad_certificate}}if(a===null&&x===null)a={message:"Certificate is missing basicConstraints extension and cannot be used as a CA.",error:F.certificateError.bad_certificate};if(a===null&&x!==null&&!x.cA)a={message:"Certificate basicConstraints indicates the certificate is not a CA.",error:F.certificateError.bad_certificate};if(a===null&&b!==null&&"pathLenConstraint"in x){var A=o-1;if(A>x.pathLenConstraint)a={message:"Certificate basicConstraints pathLenConstraint violated.",error:F.certificateError.bad_certificate}}}var E=a===null?!0:a.error,k=n.verify?n.verify(E,o,r):E;if(k===!0)a=null;else{if(E===!0)a={message:"The application rejected the certificate.",error:F.certificateError.bad_certificate};if(k||k===0){if(typeof k==="object"&&!ne.util.isArray(k)){if(k.message)a.message=k.message;if(k.error)a.error=k.error}else if(typeof k==="string")a.error=k}throw a}s=!1,++o}while(t.length>0);return!0}});var ko=fe(function(l1,ed){var Ke=me();Kt();Tn();Dr();wo();Eo();Dt();xi();In();Be();Ms();var{asn1:S,pki:Ce}=Ke,bi=ed.exports=Ke.pkcs12=Ke.pkcs12||{},Zu={name:"ContentInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.contentType",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:S.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"content"}]},Wm={name:"PFX",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.version",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"version"},Zu,{name:"PFX.macData",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"mac",value:[{name:"PFX.macData.mac",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm.algorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"macAlgorithm"},{name:"PFX.macData.mac.digestAlgorithm.parameters",optional:!0,tagClass:S.Class.UNIVERSAL,captureAsn1:"macAlgorithmParameters"}]},{name:"PFX.macData.mac.digest",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"macDigest"}]},{name:"PFX.macData.macSalt",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"macSalt"},{name:"PFX.macData.iterations",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,optional:!0,capture:"macIterations"}]}]},$m={name:"SafeBag",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"SafeBag.bagId",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"bagId"},{name:"SafeBag.bagValue",tagClass:S.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"bagValue"},{name:"SafeBag.bagAttributes",tagClass:S.Class.UNIVERSAL,type:S.Type.SET,constructed:!0,optional:!0,capture:"bagAttributes"}]},Hm={name:"Attribute",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"Attribute.attrId",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"oid"},{name:"Attribute.attrValues",tagClass:S.Class.UNIVERSAL,type:S.Type.SET,constructed:!0,capture:"values"}]},Km={name:"CertBag",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"CertBag.certId",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"certId"},{name:"CertBag.certValue",tagClass:S.Class.CONTEXT_SPECIFIC,constructed:!0,value:[{name:"CertBag.certValue[0]",tagClass:S.Class.UNIVERSAL,type:S.Class.OCTETSTRING,constructed:!1,capture:"cert"}]}]};function Si(e,t,n,r){var i=[];for(var s=0;s<e.length;s++)for(var a=0;a<e[s].safeBags.length;a++){var o=e[s].safeBags[a];if(r!==void 0&&o.type!==r)continue;if(t===null){i.push(o);continue}if(o.attributes[t]!==void 0&&o.attributes[t].indexOf(n)>=0)i.push(o)}return i}bi.pkcs12FromAsn1=function(e,t,n){if(typeof t==="string")n=t,t=!0;else if(t===void 0)t=!0;var r={},i=[];if(!S.validate(e,Wm,r,i)){var s=Error("Cannot read PKCS#12 PFX. ASN.1 object is not an PKCS#12 PFX.");throw s.errors=s,s}var a={version:r.version.charCodeAt(0),safeContents:[],getBags:function(x){var b={},A;if("localKeyId"in x)A=x.localKeyId;else if("localKeyIdHex"in x)A=Ke.util.hexToBytes(x.localKeyIdHex);if(A===void 0&&!("friendlyName"in x)&&"bagType"in x)b[x.bagType]=Si(a.safeContents,null,null,x.bagType);if(A!==void 0)b.localKeyId=Si(a.safeContents,"localKeyId",A,x.bagType);if("friendlyName"in x)b.friendlyName=Si(a.safeContents,"friendlyName",x.friendlyName,x.bagType);return b},getBagsByFriendlyName:function(x,b){return Si(a.safeContents,"friendlyName",x,b)},getBagsByLocalKeyId:function(x,b){return Si(a.safeContents,"localKeyId",x,b)}};if(r.version.charCodeAt(0)!==3){var s=Error("PKCS#12 PFX of version other than 3 not supported.");throw s.version=r.version.charCodeAt(0),s}if(S.derToOid(r.contentType)!==Ce.oids.data){var s=Error("Only PKCS#12 PFX in password integrity mode supported.");throw s.oid=S.derToOid(r.contentType),s}var o=r.content.value[0];if(o.tagClass!==S.Class.UNIVERSAL||o.type!==S.Type.OCTETSTRING)throw Error("PKCS#12 authSafe content data is not an OCTET STRING.");if(o=_o(o),r.mac){var l=null,c=0,u=S.derToOid(r.macAlgorithm);switch(u){case Ce.oids.sha1:l=Ke.md.sha1.create(),c=20;break;case Ce.oids.sha256:l=Ke.md.sha256.create(),c=32;break;case Ce.oids.sha384:l=Ke.md.sha384.create(),c=48;break;case Ce.oids.sha512:l=Ke.md.sha512.create(),c=64;break;case Ce.oids.md5:l=Ke.md.md5.create(),c=16;break}if(l===null)throw Error("PKCS#12 uses unsupported MAC algorithm: "+u);var d=new Ke.util.ByteBuffer(r.macSalt),f="macIterations"in r?parseInt(Ke.util.bytesToHex(r.macIterations),16):1,y=bi.generateKey(n,d,3,f,c,l),p=Ke.hmac.create();p.start(l,y),p.update(o.value);var v=p.getMac();if(v.getBytes()!==r.macDigest)throw Error("PKCS#12 MAC could not be verified. Invalid password?")}else if(Array.isArray(e.value)&&e.value.length>2)throw Error("Invalid PKCS#12. macData field present but MAC was not validated.");return qm(a,o.value,t,n),a};function _o(e){if(e.composed||e.constructed){var t=Ke.util.createBuffer();for(var n=0;n<e.value.length;++n)t.putBytes(e.value[n].value);e.composed=e.constructed=!1,e.value=t.getBytes()}return e}function qm(e,t,n,r){if(t=S.fromDer(t,n),t.tagClass!==S.Class.UNIVERSAL||t.type!==S.Type.SEQUENCE||t.constructed!==!0)throw Error("PKCS#12 AuthenticatedSafe expected to be a SEQUENCE OF ContentInfo");for(var i=0;i<t.value.length;i++){var s=t.value[i],a={},o=[];if(!S.validate(s,Zu,a,o)){var l=Error("Cannot read ContentInfo.");throw l.errors=o,l}var c={encrypted:!1},u=null,d=a.content.value[0];switch(S.derToOid(a.contentType)){case Ce.oids.data:if(d.tagClass!==S.Class.UNIVERSAL||d.type!==S.Type.OCTETSTRING)throw Error("PKCS#12 SafeContents Data is not an OCTET STRING.");u=_o(d).value;break;case Ce.oids.encryptedData:u=Gm(d,r),c.encrypted=!0;break;default:var l=Error("Unsupported PKCS#12 contentType.");throw l.contentType=S.derToOid(a.contentType),l}c.safeBags=jm(u,n,r),e.safeContents.push(c)}}function Gm(e,t){var n={},r=[];if(!S.validate(e,Ke.pkcs7.asn1.encryptedDataValidator,n,r)){var i=Error("Cannot read EncryptedContentInfo.");throw i.errors=r,i}var s=S.derToOid(n.contentType);if(s!==Ce.oids.data){var i=Error("PKCS#12 EncryptedContentInfo ContentType is not Data.");throw i.oid=s,i}s=S.derToOid(n.encAlgorithm);var a=Ce.pbe.getCipher(s,n.encParameter,t),o=_o(n.encryptedContentAsn1),l=Ke.util.createBuffer(o.value);if(a.update(l),!a.finish())throw Error("Failed to decrypt PKCS#12 SafeContents.");return a.output.getBytes()}function jm(e,t,n){if(!t&&e.length===0)return[];if(e=S.fromDer(e,t),e.tagClass!==S.Class.UNIVERSAL||e.type!==S.Type.SEQUENCE||e.constructed!==!0)throw Error("PKCS#12 SafeContents expected to be a SEQUENCE OF SafeBag.");var r=[];for(var i=0;i<e.value.length;i++){var s=e.value[i],a={},o=[];if(!S.validate(s,$m,a,o)){var l=Error("Cannot read SafeBag.");throw l.errors=o,l}var c={type:S.derToOid(a.bagId),attributes:zm(a.bagAttributes)};r.push(c);var u,d,f=a.bagValue.value[0];switch(c.type){case Ce.oids.pkcs8ShroudedKeyBag:if(f=Ce.decryptPrivateKeyInfo(f,n),f===null)throw Error("Unable to decrypt PKCS#8 ShroudedKeyBag, wrong password?");case Ce.oids.keyBag:try{c.key=Ce.privateKeyFromAsn1(f)}catch(p){c.key=null,c.asn1=f}continue;case Ce.oids.certBag:u=Km,d=function(){if(S.derToOid(a.certId)!==Ce.oids.x509Certificate){var p=Error("Unsupported certificate type, only X.509 supported.");throw p.oid=S.derToOid(a.certId),p}var v=S.fromDer(a.cert,t);try{c.cert=Ce.certificateFromAsn1(v,!0)}catch(x){c.cert=null,c.asn1=v}};break;default:var l=Error("Unsupported PKCS#12 SafeBag type.");throw l.oid=c.type,l}if(u!==void 0&&!S.validate(f,u,a,o)){var l=Error("Cannot read PKCS#12 "+u.name);throw l.errors=o,l}d()}return r}function zm(e){var t={};if(e!==void 0)for(var n=0;n<e.length;++n){var r={},i=[];if(!S.validate(e[n],Hm,r,i)){var s=Error("Cannot read PKCS#12 BagAttribute.");throw s.errors=i,s}var a=S.derToOid(r.oid);if(Ce.oids[a]===void 0)continue;t[Ce.oids[a]]=[];for(var o=0;o<r.values.length;++o)t[Ce.oids[a]].push(r.values[o].value)}return t}bi.toPkcs12Asn1=function(e,t,n,r){if(r=r||{},r.saltSize=r.saltSize||8,r.count=r.count||2048,r.algorithm=r.algorithm||r.encAlgorithm||"aes128",!("useMac"in r))r.useMac=!0;if(!("localKeyId"in r))r.localKeyId=null;if(!("generateLocalKeyId"in r))r.generateLocalKeyId=!0;var i=r.localKeyId,s;if(i!==null)i=Ke.util.hexToBytes(i);else if(r.generateLocalKeyId)if(t){var a=Ke.util.isArray(t)?t[0]:t;if(typeof a==="string")a=Ce.certificateFromPem(a);var o=Ke.md.sha1.create();o.update(S.toDer(Ce.certificateToAsn1(a)).getBytes()),i=o.digest().getBytes()}else i=Ke.random.getBytes(20);var l=[];if(i!==null)l.push(S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.localKeyId).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SET,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,i)])]));if("friendlyName"in r)l.push(S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.friendlyName).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SET,!0,[S.create(S.Class.UNIVERSAL,S.Type.BMPSTRING,!1,r.friendlyName)])]));if(l.length>0)s=S.create(S.Class.UNIVERSAL,S.Type.SET,!0,l);var c=[],u=[];if(t!==null)if(Ke.util.isArray(t))u=t;else u=[t];var d=[];for(var f=0;f<u.length;++f){if(t=u[f],typeof t==="string")t=Ce.certificateFromPem(t);var y=f===0?s:void 0,p=Ce.certificateToAsn1(t),v=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.certBag).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.x509Certificate).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer(p).getBytes())])])]),y]);d.push(v)}if(d.length>0){var x=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,d),b=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.data).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer(x).getBytes())])]);c.push(b)}var A=null;if(e!==null){var E=Ce.wrapRsaPrivateKey(Ce.privateKeyToAsn1(e));if(n===null)A=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.keyBag).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[E]),s]);else A=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.pkcs8ShroudedKeyBag).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[Ce.encryptPrivateKeyInfo(E,n,r)]),s]);var k=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[A]),I=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.data).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer(k).getBytes())])]);c.push(I)}var R=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,c),M;if(r.useMac){var o=Ke.md.sha1.create(),ee=new Ke.util.ByteBuffer(Ke.random.getBytes(r.saltSize)),O=r.count,e=bi.generateKey(n,ee,3,O,20),K=Ke.hmac.create();K.start(o,e),K.update(S.toDer(R).getBytes());var ie=K.getMac();M=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.sha1).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,"")]),S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,ie.getBytes())]),S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,ee.getBytes()),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(O).getBytes())])}return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(3).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.data).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer(R).getBytes())])]),M])};bi.generateKey=Ke.pbe.generatePkcs12Key});var Ro=fe(function(c1,td){var Vr=me();Kt();Dr();Eo();nn();Rs();ko();Us();xi();Be();Ms();var Io=Vr.asn1,Nn=td.exports=Vr.pki=Vr.pki||{};Nn.pemToDer=function(e){var t=Vr.pem.decode(e)[0];if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert PEM to DER; PEM is encrypted.");return Vr.util.createBuffer(t.body)};Nn.privateKeyFromPem=function(e){var t=Vr.pem.decode(e)[0];if(t.type!=="PRIVATE KEY"&&t.type!=="RSA PRIVATE KEY"){var n=Error('Could not convert private key from PEM; PEM header type is not "PRIVATE KEY" or "RSA PRIVATE KEY".');throw n.headerType=t.type,n}if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert private key from PEM; PEM is encrypted.");var r=Io.fromDer(t.body);return Nn.privateKeyFromAsn1(r)};Nn.privateKeyToPem=function(e,t){var n={type:"RSA PRIVATE KEY",body:Io.toDer(Nn.privateKeyToAsn1(e)).getBytes()};return Vr.pem.encode(n,{maxline:t})};Nn.privateKeyInfoToPem=function(e,t){var n={type:"PRIVATE KEY",body:Io.toDer(e).getBytes()};return Vr.pem.encode(n,{maxline:t})}});var Oo=fe(function(u1,cd){var L=me();Kt();Tn();As();nn();Ro();Dt();In();Be();var Hs=function(e,t,n,r){var i=L.util.createBuffer(),s=e.length>>1,a=s+(e.length&1),o=e.substr(0,a),l=e.substr(s,a),c=L.util.createBuffer(),u=L.hmac.create();n=t+n;var d=Math.ceil(r/16),f=Math.ceil(r/20);u.start("MD5",o);var y=L.util.createBuffer();c.putBytes(n);for(var p=0;p<d;++p)u.start(null,null),u.update(c.getBytes()),c.putBuffer(u.digest()),u.start(null,null),u.update(c.bytes()+n),y.putBuffer(u.digest());u.start("SHA1",l);var v=L.util.createBuffer();c.clear(),c.putBytes(n);for(var p=0;p<f;++p)u.start(null,null),u.update(c.getBytes()),c.putBuffer(u.digest()),u.start(null,null),u.update(c.bytes()+n),v.putBuffer(u.digest());return i.putBytes(L.util.xorBytes(y.getBytes(),v.getBytes(),r)),i},Qm=function(e,t,n){var r=L.hmac.create();r.start("SHA1",e);var i=L.util.createBuffer();return i.putInt32(t[0]),i.putInt32(t[1]),i.putByte(n.type),i.putByte(n.version.major),i.putByte(n.version.minor),i.putInt16(n.length),i.putBytes(n.fragment.bytes()),r.update(i.getBytes()),r.digest().getBytes()},Xm=function(e,t,n){var r=!1;try{var i=e.deflate(t.fragment.getBytes());t.fragment=L.util.createBuffer(i),t.length=i.length,r=!0}catch(s){}return r},Ym=function(e,t,n){var r=!1;try{var i=e.inflate(t.fragment.getBytes());t.fragment=L.util.createBuffer(i),t.length=i.length,r=!0}catch(s){}return r},It=function(e,t){var n=0;switch(t){case 1:n=e.getByte();break;case 2:n=e.getInt16();break;case 3:n=e.getInt24();break;case 4:n=e.getInt32();break}return L.util.createBuffer(e.getBytes(n))},Vt=function(e,t,n){e.putInt(n.length(),t<<3),e.putBuffer(n)},m={};m.Versions={TLS_1_0:{major:3,minor:1},TLS_1_1:{major:3,minor:2},TLS_1_2:{major:3,minor:3}};m.SupportedVersions=[m.Versions.TLS_1_1,m.Versions.TLS_1_0];m.Version=m.SupportedVersions[0];m.MaxFragment=15360;m.ConnectionEnd={server:0,client:1};m.PRFAlgorithm={tls_prf_sha256:0};m.BulkCipherAlgorithm={none:null,rc4:0,des3:1,aes:2};m.CipherType={stream:0,block:1,aead:2};m.MACAlgorithm={none:null,hmac_md5:0,hmac_sha1:1,hmac_sha256:2,hmac_sha384:3,hmac_sha512:4};m.CompressionMethod={none:0,deflate:1};m.ContentType={change_cipher_spec:20,alert:21,handshake:22,application_data:23,heartbeat:24};m.HandshakeType={hello_request:0,client_hello:1,server_hello:2,certificate:11,server_key_exchange:12,certificate_request:13,server_hello_done:14,certificate_verify:15,client_key_exchange:16,finished:20};m.Alert={};m.Alert.Level={warning:1,fatal:2};m.Alert.Description={close_notify:0,unexpected_message:10,bad_record_mac:20,decryption_failed:21,record_overflow:22,decompression_failure:30,handshake_failure:40,bad_certificate:42,unsupported_certificate:43,certificate_revoked:44,certificate_expired:45,certificate_unknown:46,illegal_parameter:47,unknown_ca:48,access_denied:49,decode_error:50,decrypt_error:51,export_restriction:60,protocol_version:70,insufficient_security:71,internal_error:80,user_canceled:90,no_renegotiation:100};m.HeartbeatMessageType={heartbeat_request:1,heartbeat_response:2};m.CipherSuites={};m.getCipherSuite=function(e){var t=null;for(var n in m.CipherSuites){var r=m.CipherSuites[n];if(r.id[0]===e.charCodeAt(0)&&r.id[1]===e.charCodeAt(1)){t=r;break}}return t};m.handleUnexpected=function(e,t){var n=!e.open&&e.entity===m.ConnectionEnd.client;if(!n)e.error(e,{message:"Unexpected message. Received TLS record out of order.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.unexpected_message}})};m.handleHelloRequest=function(e,t,n){if(!e.handshaking&&e.handshakes>0)m.queue(e,m.createAlert(e,{level:m.Alert.Level.warning,description:m.Alert.Description.no_renegotiation})),m.flush(e);e.process()};m.parseHelloMessage=function(e,t,n){var r=null,i=e.entity===m.ConnectionEnd.client;if(n<38)e.error(e,{message:i?"Invalid ServerHello message. Message too short.":"Invalid ClientHello message. Message too short.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});else{var s=t.fragment,a=s.length();if(r={version:{major:s.getByte(),minor:s.getByte()},random:L.util.createBuffer(s.getBytes(32)),session_id:It(s,1),extensions:[]},i)r.cipher_suite=s.getBytes(2),r.compression_method=s.getByte();else r.cipher_suites=It(s,2),r.compression_methods=It(s,1);if(a=n-(a-s.length()),a>0){var o=It(s,2);while(o.length()>0)r.extensions.push({type:[o.getByte(),o.getByte()],data:It(o,2)});if(!i)for(var l=0;l<r.extensions.length;++l){var c=r.extensions[l];if(c.type[0]===0&&c.type[1]===0){var u=It(c.data,2);while(u.length()>0){var d=u.getByte();if(d!==0)break;e.session.extensions.server_name.serverNameList.push(It(u,2).getBytes())}}}}if(e.session.version){if(r.version.major!==e.session.version.major||r.version.minor!==e.session.version.minor)return e.error(e,{message:"TLS version change is disallowed during renegotiation.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.protocol_version}})}if(i)e.session.cipherSuite=m.getCipherSuite(r.cipher_suite);else{var f=L.util.createBuffer(r.cipher_suites.bytes());while(f.length()>0)if(e.session.cipherSuite=m.getCipherSuite(f.getBytes(2)),e.session.cipherSuite!==null)break}if(e.session.cipherSuite===null)return e.error(e,{message:"No cipher suites in common.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.handshake_failure},cipherSuite:L.util.bytesToHex(r.cipher_suite)});if(i)e.session.compressionMethod=r.compression_method;else e.session.compressionMethod=m.CompressionMethod.none}return r};m.createSecurityParameters=function(e,t){var n=e.entity===m.ConnectionEnd.client,r=t.random.bytes(),i=n?e.session.sp.client_random:r,s=n?r:m.createRandom().getBytes();e.session.sp={entity:e.entity,prf_algorithm:m.PRFAlgorithm.tls_prf_sha256,bulk_cipher_algorithm:null,cipher_type:null,enc_key_length:null,block_length:null,fixed_iv_length:null,record_iv_length:null,mac_algorithm:null,mac_length:null,mac_key_length:null,compression_algorithm:e.session.compressionMethod,pre_master_secret:null,master_secret:null,client_random:i,server_random:s}};m.handleServerHello=function(e,t,n){var r=m.parseHelloMessage(e,t,n);if(e.fail)return;if(r.version.minor<=e.version.minor)e.version.minor=r.version.minor;else return e.error(e,{message:"Incompatible TLS version.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.protocol_version}});e.session.version=e.version;var i=r.session_id.bytes();if(i.length>0&&i===e.session.id)e.expect=id,e.session.resuming=!0,e.session.sp.server_random=r.random.bytes();else e.expect=Zm,e.session.resuming=!1,m.createSecurityParameters(e,r);e.session.id=i,e.process()};m.handleClientHello=function(e,t,n){var r=m.parseHelloMessage(e,t,n);if(e.fail)return;var i=r.session_id.bytes(),s=null;if(e.sessionCache){if(s=e.sessionCache.getSession(i),s===null)i="";else if(s.version.major!==r.version.major||s.version.minor>r.version.minor)s=null,i=""}if(i.length===0)i=L.random.getBytes(32);if(e.session.id=i,e.session.clientHelloVersion=r.version,e.session.sp={},s)e.version=e.session.version=s.version,e.session.sp=s.sp;else{var a;for(var o=1;o<m.SupportedVersions.length;++o)if(a=m.SupportedVersions[o],a.minor<=r.version.minor)break;e.version={major:a.major,minor:a.minor},e.session.version=e.version}if(s!==null)e.expect=Do,e.session.resuming=!0,e.session.sp.client_random=r.random.bytes();else e.expect=e.verifyClient!==!1?ay:No,e.session.resuming=!1,m.createSecurityParameters(e,r);if(e.open=!0,m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createServerHello(e)})),e.session.resuming)m.queue(e,m.createRecord(e,{type:m.ContentType.change_cipher_spec,data:m.createChangeCipherSpec()})),e.state.pending=m.createConnectionState(e),e.state.current.write=e.state.pending.write,m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createFinished(e)}));else if(m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createCertificate(e)})),!e.fail){if(m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createServerKeyExchange(e)})),e.verifyClient!==!1)m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createCertificateRequest(e)}));m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createServerHelloDone(e)}))}m.flush(e),e.process()};m.handleCertificate=function(e,t,n){if(n<3)return e.error(e,{message:"Invalid Certificate message. Message too short.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});var r=t.fragment,i={certificate_list:It(r,3)},s,a,o=[];try{while(i.certificate_list.length()>0)s=It(i.certificate_list,3),a=L.asn1.fromDer(s),s=L.pki.certificateFromAsn1(a,!0),o.push(s)}catch(c){return e.error(e,{message:"Could not parse certificate list.",cause:c,send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.bad_certificate}})}var l=e.entity===m.ConnectionEnd.client;if((l||e.verifyClient===!0)&&o.length===0)e.error(e,{message:l?"No server certificate provided.":"No client certificate provided.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});else if(o.length===0)e.expect=l?rd:No;else{if(l)e.session.serverCertificate=o[0];else e.session.clientCertificate=o[0];if(m.verifyCertificateChain(e,o))e.expect=l?rd:No}e.process()};m.handleServerKeyExchange=function(e,t,n){if(n>0)return e.error(e,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.unsupported_certificate}});e.expect=ey,e.process()};m.handleClientKeyExchange=function(e,t,n){if(n<48)return e.error(e,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.unsupported_certificate}});var r=t.fragment,i={enc_pre_master_secret:It(r,2).getBytes()},s=null;if(e.getPrivateKey)try{s=e.getPrivateKey(e,e.session.serverCertificate),s=L.pki.privateKeyFromPem(s)}catch(l){e.error(e,{message:"Could not get private key.",cause:l,send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}})}if(s===null)return e.error(e,{message:"No private key set.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}});try{var a=e.session.sp;a.pre_master_secret=s.decrypt(i.enc_pre_master_secret);var o=e.session.clientHelloVersion;if(o.major!==a.pre_master_secret.charCodeAt(0)||o.minor!==a.pre_master_secret.charCodeAt(1))throw Error("TLS version rollback attack detected.")}catch(l){a.pre_master_secret=L.random.getBytes(48)}if(e.expect=Do,e.session.clientCertificate!==null)e.expect=oy;e.process()};m.handleCertificateRequest=function(e,t,n){if(n<3)return e.error(e,{message:"Invalid CertificateRequest. Message too short.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});var r=t.fragment,i={certificate_types:It(r,1),certificate_authorities:It(r,2)};e.session.certificateRequest=i,e.expect=ty,e.process()};m.handleCertificateVerify=function(e,t,n){if(n<2)return e.error(e,{message:"Invalid CertificateVerify. Message too short.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});var r=t.fragment;r.read-=4;var i=r.bytes();r.read+=4;var s={signature:It(r,2).getBytes()},a=L.util.createBuffer();a.putBuffer(e.session.md5.digest()),a.putBuffer(e.session.sha1.digest()),a=a.getBytes();try{var o=e.session.clientCertificate;if(!o.publicKey.verify(a,s.signature,"NONE"))throw Error("CertificateVerify signature does not match.");e.session.md5.update(i),e.session.sha1.update(i)}catch(l){return e.error(e,{message:"Bad signature in CertificateVerify.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.handshake_failure}})}e.expect=Do,e.process()};m.handleServerHelloDone=function(e,t,n){if(n>0)return e.error(e,{message:"Invalid ServerHelloDone message. Invalid length.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.record_overflow}});if(e.serverCertificate===null){var r={message:"No server certificate provided. Not enough security.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.insufficient_security}},i=0,s=e.verify(e,r.alert.description,i,[]);if(s!==!0){if(s||s===0){if(typeof s==="object"&&!L.util.isArray(s)){if(s.message)r.message=s.message;if(s.alert)r.alert.description=s.alert}else if(typeof s==="number")r.alert.description=s}return e.error(e,r)}}if(e.session.certificateRequest!==null)t=m.createRecord(e,{type:m.ContentType.handshake,data:m.createCertificate(e)}),m.queue(e,t);t=m.createRecord(e,{type:m.ContentType.handshake,data:m.createClientKeyExchange(e)}),m.queue(e,t),e.expect=iy;var a=function(o,l){if(o.session.certificateRequest!==null&&o.session.clientCertificate!==null)m.queue(o,m.createRecord(o,{type:m.ContentType.handshake,data:m.createCertificateVerify(o,l)}));m.queue(o,m.createRecord(o,{type:m.ContentType.change_cipher_spec,data:m.createChangeCipherSpec()})),o.state.pending=m.createConnectionState(o),o.state.current.write=o.state.pending.write,m.queue(o,m.createRecord(o,{type:m.ContentType.handshake,data:m.createFinished(o)})),o.expect=id,m.flush(o),o.process()};if(e.session.certificateRequest===null||e.session.clientCertificate===null)return a(e,null);m.getClientSignature(e,a)};m.handleChangeCipherSpec=function(e,t){if(t.fragment.getByte()!==1)return e.error(e,{message:"Invalid ChangeCipherSpec message received.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});var n=e.entity===m.ConnectionEnd.client;if(e.session.resuming&&n||!e.session.resuming&&!n)e.state.pending=m.createConnectionState(e);if(e.state.current.read=e.state.pending.read,!e.session.resuming&&n||e.session.resuming&&!n)e.state.pending=null;e.expect=n?ry:ly,e.process()};m.handleFinished=function(e,t,n){var r=t.fragment;r.read-=4;var i=r.bytes();r.read+=4;var s=t.fragment.getBytes();r=L.util.createBuffer(),r.putBuffer(e.session.md5.digest()),r.putBuffer(e.session.sha1.digest());var a=e.entity===m.ConnectionEnd.client,o=a?"server finished":"client finished",l=e.session.sp,c=12,u=Hs;if(r=u(l.master_secret,o,r.getBytes(),c),r.getBytes()!==s)return e.error(e,{message:"Invalid verify_data in Finished message.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.decrypt_error}});if(e.session.md5.update(i),e.session.sha1.update(i),e.session.resuming&&a||!e.session.resuming&&!a)m.queue(e,m.createRecord(e,{type:m.ContentType.change_cipher_spec,data:m.createChangeCipherSpec()})),e.state.current.write=e.state.pending.write,e.state.pending=null,m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createFinished(e)}));e.expect=a?ny:cy,e.handshaking=!1,++e.handshakes,e.peerCertificate=a?e.session.serverCertificate:e.session.clientCertificate,m.flush(e),e.isConnected=!0,e.connected(e),e.process()};m.handleAlert=function(e,t){var n=t.fragment,r={level:n.getByte(),description:n.getByte()},i;switch(r.description){case m.Alert.Description.close_notify:i="Connection closed.";break;case m.Alert.Description.unexpected_message:i="Unexpected message.";break;case m.Alert.Description.bad_record_mac:i="Bad record MAC.";break;case m.Alert.Description.decryption_failed:i="Decryption failed.";break;case m.Alert.Description.record_overflow:i="Record overflow.";break;case m.Alert.Description.decompression_failure:i="Decompression failed.";break;case m.Alert.Description.handshake_failure:i="Handshake failure.";break;case m.Alert.Description.bad_certificate:i="Bad certificate.";break;case m.Alert.Description.unsupported_certificate:i="Unsupported certificate.";break;case m.Alert.Description.certificate_revoked:i="Certificate revoked.";break;case m.Alert.Description.certificate_expired:i="Certificate expired.";break;case m.Alert.Description.certificate_unknown:i="Certificate unknown.";break;case m.Alert.Description.illegal_parameter:i="Illegal parameter.";break;case m.Alert.Description.unknown_ca:i="Unknown certificate authority.";break;case m.Alert.Description.access_denied:i="Access denied.";break;case m.Alert.Description.decode_error:i="Decode error.";break;case m.Alert.Description.decrypt_error:i="Decrypt error.";break;case m.Alert.Description.export_restriction:i="Export restriction.";break;case m.Alert.Description.protocol_version:i="Unsupported protocol version.";break;case m.Alert.Description.insufficient_security:i="Insufficient security.";break;case m.Alert.Description.internal_error:i="Internal error.";break;case m.Alert.Description.user_canceled:i="User canceled.";break;case m.Alert.Description.no_renegotiation:i="Renegotiation not supported.";break;default:i="Unknown error.";break}if(r.description===m.Alert.Description.close_notify)return e.close();e.error(e,{message:i,send:!1,origin:e.entity===m.ConnectionEnd.client?"server":"client",alert:r}),e.process()};m.handleHandshake=function(e,t){var n=t.fragment,r=n.getByte(),i=n.getInt24();if(i>n.length())return e.fragmented=t,t.fragment=L.util.createBuffer(),n.read-=4,e.process();e.fragmented=null,n.read-=4;var s=n.bytes(i+4);if(n.read+=4,r in $s[e.entity][e.expect]){if(e.entity===m.ConnectionEnd.server&&!e.open&&!e.fail)e.handshaking=!0,e.session={version:null,extensions:{server_name:{serverNameList:[]}},cipherSuite:null,compressionMethod:null,serverCertificate:null,clientCertificate:null,md5:L.md.md5.create(),sha1:L.md.sha1.create()};if(r!==m.HandshakeType.hello_request&&r!==m.HandshakeType.certificate_verify&&r!==m.HandshakeType.finished)e.session.md5.update(s),e.session.sha1.update(s);$s[e.entity][e.expect][r](e,t,i)}else m.handleUnexpected(e,t)};m.handleApplicationData=function(e,t){e.data.putBuffer(t.fragment),e.dataReady(e),e.process()};m.handleHeartbeat=function(e,t){var n=t.fragment,r=n.getByte(),i=n.getInt16(),s=n.getBytes(i);if(r===m.HeartbeatMessageType.heartbeat_request){if(e.handshaking||i>s.length)return e.process();m.queue(e,m.createRecord(e,{type:m.ContentType.heartbeat,data:m.createHeartbeat(m.HeartbeatMessageType.heartbeat_response,s)})),m.flush(e)}else if(r===m.HeartbeatMessageType.heartbeat_response){if(s!==e.expectedHeartbeatPayload)return e.process();if(e.heartbeatReceived)e.heartbeatReceived(e,L.util.createBuffer(s))}e.process()};var Jm=0,Zm=1,rd=2,ey=3,ty=4,id=5,ry=6,ny=7,iy=8,sy=0,ay=1,No=2,oy=3,Do=4,ly=5,cy=6,{handleUnexpected:g,handleChangeCipherSpec:sd,handleAlert:gt,handleHandshake:Ct,handleApplicationData:ad,handleHeartbeat:mt}=m,Lo=[];Lo[m.ConnectionEnd.client]=[[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[sd,gt,g,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,ad,mt],[g,gt,Ct,g,mt]];Lo[m.ConnectionEnd.server]=[[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[sd,gt,g,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,ad,mt],[g,gt,Ct,g,mt]];var{handleHelloRequest:Fr,handleServerHello:uy,handleCertificate:od,handleServerKeyExchange:nd,handleCertificateRequest:Bo,handleServerHelloDone:Ws,handleFinished:ld}=m,$s=[];$s[m.ConnectionEnd.client]=[[g,g,uy,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,od,nd,Bo,Ws,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,nd,Bo,Ws,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,Bo,Ws,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,Ws,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,ld],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g]];var{handleClientHello:dy,handleClientKeyExchange:fy,handleCertificateVerify:py}=m;$s[m.ConnectionEnd.server]=[[g,dy,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,od,g,g,g,g,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,fy,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,py,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,ld],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g]];m.generateKeys=function(e,t){var n=Hs,r=t.client_random+t.server_random;if(!e.session.resuming)t.master_secret=n(t.pre_master_secret,"master secret",r,48).bytes(),t.pre_master_secret=null;r=t.server_random+t.client_random;var i=2*t.mac_key_length+2*t.enc_key_length,s=e.version.major===m.Versions.TLS_1_0.major&&e.version.minor===m.Versions.TLS_1_0.minor;if(s)i+=2*t.fixed_iv_length;var a=n(t.master_secret,"key expansion",r,i),o={client_write_MAC_key:a.getBytes(t.mac_key_length),server_write_MAC_key:a.getBytes(t.mac_key_length),client_write_key:a.getBytes(t.enc_key_length),server_write_key:a.getBytes(t.enc_key_length)};if(s)o.client_write_IV=a.getBytes(t.fixed_iv_length),o.server_write_IV=a.getBytes(t.fixed_iv_length);return o};m.createConnectionState=function(e){var t=e.entity===m.ConnectionEnd.client,n=function(){var s={sequenceNumber:[0,0],macKey:null,macLength:0,macFunction:null,cipherState:null,cipherFunction:function(a){return!0},compressionState:null,compressFunction:function(a){return!0},updateSequenceNumber:function(){if(s.sequenceNumber[1]===4294967295)s.sequenceNumber[1]=0,++s.sequenceNumber[0];else++s.sequenceNumber[1]}};return s},r={read:n(),write:n()};if(r.read.update=function(s,a){if(!r.read.cipherFunction(a,r.read))s.error(s,{message:"Could not decrypt record or bad MAC.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.bad_record_mac}});else if(!r.read.compressFunction(s,a,r.read))s.error(s,{message:"Could not decompress record.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.decompression_failure}});return!s.fail},r.write.update=function(s,a){if(!r.write.compressFunction(s,a,r.write))s.error(s,{message:"Could not compress record.",send:!1,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}});else if(!r.write.cipherFunction(a,r.write))s.error(s,{message:"Could not encrypt record.",send:!1,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}});return!s.fail},e.session){var i=e.session.sp;switch(e.session.cipherSuite.initSecurityParameters(i),i.keys=m.generateKeys(e,i),r.read.macKey=t?i.keys.server_write_MAC_key:i.keys.client_write_MAC_key,r.write.macKey=t?i.keys.client_write_MAC_key:i.keys.server_write_MAC_key,e.session.cipherSuite.initConnectionState(r,e,i),i.compression_algorithm){case m.CompressionMethod.none:break;case m.CompressionMethod.deflate:r.read.compressFunction=Ym,r.write.compressFunction=Xm;break;default:throw Error("Unsupported compression algorithm.")}}return r};m.createRandom=function(){var e=new Date,t=+e+e.getTimezoneOffset()*60000,n=L.util.createBuffer();return n.putInt32(t),n.putBytes(L.random.getBytes(28)),n};m.createRecord=function(e,t){if(!t.data)return null;var n={type:t.type,version:{major:e.version.major,minor:e.version.minor},length:t.data.length(),fragment:t.data};return n};m.createAlert=function(e,t){var n=L.util.createBuffer();return n.putByte(t.level),n.putByte(t.description),m.createRecord(e,{type:m.ContentType.alert,data:n})};m.createClientHello=function(e){e.session.clientHelloVersion={major:e.version.major,minor:e.version.minor};var t=L.util.createBuffer();for(var n=0;n<e.cipherSuites.length;++n){var r=e.cipherSuites[n];t.putByte(r.id[0]),t.putByte(r.id[1])}var i=t.length(),s=L.util.createBuffer();s.putByte(m.CompressionMethod.none);var a=s.length(),o=L.util.createBuffer();if(e.virtualHost){var l=L.util.createBuffer();l.putByte(0),l.putByte(0);var c=L.util.createBuffer();c.putByte(0),Vt(c,2,L.util.createBuffer(e.virtualHost));var u=L.util.createBuffer();Vt(u,2,c),Vt(l,2,u),o.putBuffer(l)}var d=o.length();if(d>0)d+=2;var f=e.session.id,y=f.length+1+2+4+28+2+i+1+a+d,p=L.util.createBuffer();if(p.putByte(m.HandshakeType.client_hello),p.putInt24(y),p.putByte(e.version.major),p.putByte(e.version.minor),p.putBytes(e.session.sp.client_random),Vt(p,1,L.util.createBuffer(f)),Vt(p,2,t),Vt(p,1,s),d>0)Vt(p,2,o);return p};m.createServerHello=function(e){var t=e.session.id,n=t.length+1+2+4+28+2+1,r=L.util.createBuffer();return r.putByte(m.HandshakeType.server_hello),r.putInt24(n),r.putByte(e.version.major),r.putByte(e.version.minor),r.putBytes(e.session.sp.server_random),Vt(r,1,L.util.createBuffer(t)),r.putByte(e.session.cipherSuite.id[0]),r.putByte(e.session.cipherSuite.id[1]),r.putByte(e.session.compressionMethod),r};m.createCertificate=function(e){var t=e.entity===m.ConnectionEnd.client,n=null;if(e.getCertificate){var r;if(t)r=e.session.certificateRequest;else r=e.session.extensions.server_name.serverNameList;n=e.getCertificate(e,r)}var i=L.util.createBuffer();if(n!==null)try{if(!L.util.isArray(n))n=[n];var s=null;for(var a=0;a<n.length;++a){var o=L.pem.decode(n[a])[0];if(o.type!=="CERTIFICATE"&&o.type!=="X509 CERTIFICATE"&&o.type!=="TRUSTED CERTIFICATE"){var l=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw l.headerType=o.type,l}if(o.procType&&o.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var c=L.util.createBuffer(o.body);if(s===null)s=L.asn1.fromDer(c.bytes(),!1);var u=L.util.createBuffer();Vt(u,3,c),i.putBuffer(u)}if(n=L.pki.certificateFromAsn1(s),t)e.session.clientCertificate=n;else e.session.serverCertificate=n}catch(y){return e.error(e,{message:"Could not send certificate list.",cause:y,send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.bad_certificate}})}var d=3+i.length(),f=L.util.createBuffer();return f.putByte(m.HandshakeType.certificate),f.putInt24(d),Vt(f,3,i),f};m.createClientKeyExchange=function(e){var t=L.util.createBuffer();t.putByte(e.session.clientHelloVersion.major),t.putByte(e.session.clientHelloVersion.minor),t.putBytes(L.random.getBytes(46));var n=e.session.sp;n.pre_master_secret=t.getBytes();var r=e.session.serverCertificate.publicKey;t=r.encrypt(n.pre_master_secret);var i=t.length+2,s=L.util.createBuffer();return s.putByte(m.HandshakeType.client_key_exchange),s.putInt24(i),s.putInt16(t.length),s.putBytes(t),s};m.createServerKeyExchange=function(e){var t=0,n=L.util.createBuffer();if(t>0)n.putByte(m.HandshakeType.server_key_exchange),n.putInt24(t);return n};m.getClientSignature=function(e,t){var n=L.util.createBuffer();n.putBuffer(e.session.md5.digest()),n.putBuffer(e.session.sha1.digest()),n=n.getBytes(),e.getSignature=e.getSignature||function(r,i,s){var a=null;if(r.getPrivateKey)try{a=r.getPrivateKey(r,r.session.clientCertificate),a=L.pki.privateKeyFromPem(a)}catch(o){r.error(r,{message:"Could not get private key.",cause:o,send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}})}if(a===null)r.error(r,{message:"No private key set.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}});else i=a.sign(i,null);s(r,i)},e.getSignature(e,n,t)};m.createCertificateVerify=function(e,t){var n=t.length+2,r=L.util.createBuffer();return r.putByte(m.HandshakeType.certificate_verify),r.putInt24(n),r.putInt16(t.length),r.putBytes(t),r};m.createCertificateRequest=function(e){var t=L.util.createBuffer();t.putByte(1);var n=L.util.createBuffer();for(var r in e.caStore.certs){var i=e.caStore.certs[r],s=L.pki.distinguishedNameToAsn1(i.subject),a=L.asn1.toDer(s);n.putInt16(a.length()),n.putBuffer(a)}var o=1+t.length()+2+n.length(),l=L.util.createBuffer();return l.putByte(m.HandshakeType.certificate_request),l.putInt24(o),Vt(l,1,t),Vt(l,2,n),l};m.createServerHelloDone=function(e){var t=L.util.createBuffer();return t.putByte(m.HandshakeType.server_hello_done),t.putInt24(0),t};m.createChangeCipherSpec=function(){var e=L.util.createBuffer();return e.putByte(1),e};m.createFinished=function(e){var t=L.util.createBuffer();t.putBuffer(e.session.md5.digest()),t.putBuffer(e.session.sha1.digest());var n=e.entity===m.ConnectionEnd.client,r=e.session.sp,i=12,s=Hs,a=n?"client finished":"server finished";t=s(r.master_secret,a,t.getBytes(),i);var o=L.util.createBuffer();return o.putByte(m.HandshakeType.finished),o.putInt24(t.length()),o.putBuffer(t),o};m.createHeartbeat=function(e,t,n){if(typeof n>"u")n=t.length;var r=L.util.createBuffer();r.putByte(e),r.putInt16(n),r.putBytes(t);var i=r.length(),s=Math.max(16,i-n-3);return r.putBytes(L.random.getBytes(s)),r};m.queue=function(e,t){if(!t)return;if(t.fragment.length()===0){if(t.type===m.ContentType.handshake||t.type===m.ContentType.alert||t.type===m.ContentType.change_cipher_spec)return}if(t.type===m.ContentType.handshake){var n=t.fragment.bytes();e.session.md5.update(n),e.session.sha1.update(n),n=null}var r;if(t.fragment.length()<=m.MaxFragment)r=[t];else{r=[];var i=t.fragment.bytes();while(i.length>m.MaxFragment)r.push(m.createRecord(e,{type:t.type,data:L.util.createBuffer(i.slice(0,m.MaxFragment))})),i=i.slice(m.MaxFragment);if(i.length>0)r.push(m.createRecord(e,{type:t.type,data:L.util.createBuffer(i)}))}for(var s=0;s<r.length&&!e.fail;++s){var a=r[s],o=e.state.current.write;if(o.update(e,a))e.records.push(a)}};m.flush=function(e){for(var t=0;t<e.records.length;++t){var n=e.records[t];e.tlsData.putByte(n.type),e.tlsData.putByte(n.version.major),e.tlsData.putByte(n.version.minor),e.tlsData.putInt16(n.fragment.length()),e.tlsData.putBuffer(e.records[t].fragment)}return e.records=[],e.tlsDataReady(e)};var Po=function(e){switch(e){case!0:return!0;case L.pki.certificateError.bad_certificate:return m.Alert.Description.bad_certificate;case L.pki.certificateError.unsupported_certificate:return m.Alert.Description.unsupported_certificate;case L.pki.certificateError.certificate_revoked:return m.Alert.Description.certificate_revoked;case L.pki.certificateError.certificate_expired:return m.Alert.Description.certificate_expired;case L.pki.certificateError.certificate_unknown:return m.Alert.Description.certificate_unknown;case L.pki.certificateError.unknown_ca:return m.Alert.Description.unknown_ca;default:return m.Alert.Description.bad_certificate}},hy=function(e){switch(e){case!0:return!0;case m.Alert.Description.bad_certificate:return L.pki.certificateError.bad_certificate;case m.Alert.Description.unsupported_certificate:return L.pki.certificateError.unsupported_certificate;case m.Alert.Description.certificate_revoked:return L.pki.certificateError.certificate_revoked;case m.Alert.Description.certificate_expired:return L.pki.certificateError.certificate_expired;case m.Alert.Description.certificate_unknown:return L.pki.certificateError.certificate_unknown;case m.Alert.Description.unknown_ca:return L.pki.certificateError.unknown_ca;default:return L.pki.certificateError.bad_certificate}};m.verifyCertificateChain=function(e,t){try{var n={};for(var r in e.verifyOptions)n[r]=e.verifyOptions[r];n.verify=function(s,a,o){var l=Po(s),c=e.verify(e,s,a,o);if(c!==!0){if(typeof c==="object"&&!L.util.isArray(c)){var u=Error("The application rejected the certificate.");if(u.send=!0,u.alert={level:m.Alert.Level.fatal,description:m.Alert.Description.bad_certificate},c.message)u.message=c.message;if(c.alert)u.alert.description=c.alert;throw u}if(c!==s)c=hy(c)}return c},L.pki.verifyCertificateChain(e.caStore,t,n)}catch(s){var i=s;if(typeof i!=="object"||L.util.isArray(i))i={send:!0,alert:{level:m.Alert.Level.fatal,description:Po(s)}};if(!("send"in i))i.send=!0;if(!("alert"in i))i.alert={level:m.Alert.Level.fatal,description:Po(i.error)};e.error(e,i)}return!e.fail};m.createSessionCache=function(e,t){var n=null;if(e&&e.getSession&&e.setSession&&e.order)n=e;else{n={},n.cache=e||{},n.capacity=Math.max(t||100,1),n.order=[];for(var r in e)if(n.order.length<=t)n.order.push(r);else delete e[r];n.getSession=function(i){var s=null,a=null;if(i)a=L.util.bytesToHex(i);else if(n.order.length>0)a=n.order[0];if(a!==null&&a in n.cache){s=n.cache[a],delete n.cache[a];for(var o in n.order)if(n.order[o]===a){n.order.splice(o,1);break}}return s},n.setSession=function(i,s){if(n.order.length===n.capacity){var a=n.order.shift();delete n.cache[a]}var a=L.util.bytesToHex(i);n.order.push(a),n.cache[a]=s}}return n};m.createConnection=function(e){var t=null;if(e.caStore)if(L.util.isArray(e.caStore))t=L.pki.createCaStore(e.caStore);else t=e.caStore;else t=L.pki.createCaStore();var n=e.cipherSuites||null;if(n===null){n=[];for(var r in m.CipherSuites)n.push(m.CipherSuites[r])}var i=e.server?m.ConnectionEnd.server:m.ConnectionEnd.client,s=e.sessionCache?m.createSessionCache(e.sessionCache):null,a={version:{major:m.Version.major,minor:m.Version.minor},entity:i,sessionId:e.sessionId,caStore:t,sessionCache:s,cipherSuites:n,connected:e.connected,virtualHost:e.virtualHost||null,verifyClient:e.verifyClient||!1,verify:e.verify||function(u,d,f,y){return d},verifyOptions:e.verifyOptions||{},getCertificate:e.getCertificate||null,getPrivateKey:e.getPrivateKey||null,getSignature:e.getSignature||null,input:L.util.createBuffer(),tlsData:L.util.createBuffer(),data:L.util.createBuffer(),tlsDataReady:e.tlsDataReady,dataReady:e.dataReady,heartbeatReceived:e.heartbeatReceived,closed:e.closed,error:function(u,d){if(d.origin=d.origin||(u.entity===m.ConnectionEnd.client?"client":"server"),d.send)m.queue(u,m.createAlert(u,d.alert)),m.flush(u);var f=d.fatal!==!1;if(f)u.fail=!0;if(e.error(u,d),f)u.close(!1)},deflate:e.deflate||null,inflate:e.inflate||null};a.reset=function(u){a.version={major:m.Version.major,minor:m.Version.minor},a.record=null,a.session=null,a.peerCertificate=null,a.state={pending:null,current:null},a.expect=a.entity===m.ConnectionEnd.client?Jm:sy,a.fragmented=null,a.records=[],a.open=!1,a.handshakes=0,a.handshaking=!1,a.isConnected=!1,a.fail=!(u||typeof u>"u"),a.input.clear(),a.tlsData.clear(),a.data.clear(),a.state.current=m.createConnectionState(a)},a.reset();var o=function(u,d){var f=d.type-m.ContentType.change_cipher_spec,y=Lo[u.entity][u.expect];if(f in y)y[f](u,d);else m.handleUnexpected(u,d)},l=function(u){var d=0,f=u.input,y=f.length();if(y<5)d=5-y;else{u.record={type:f.getByte(),version:{major:f.getByte(),minor:f.getByte()},length:f.getInt16(),fragment:L.util.createBuffer(),ready:!1};var p=u.record.version.major===u.version.major;if(p&&u.session&&u.session.version)p=u.record.version.minor===u.version.minor;if(!p)u.error(u,{message:"Incompatible TLS version.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.protocol_version}})}return d},c=function(u){var d=0,f=u.input,y=f.length();if(y<u.record.length)d=u.record.length-y;else{u.record.fragment.putBytes(f.getBytes(u.record.length)),f.compact();var p=u.state.current.read;if(p.update(u,u.record)){if(u.fragmented!==null)if(u.fragmented.type===u.record.type)u.fragmented.fragment.putBuffer(u.record.fragment),u.record=u.fragmented;else u.error(u,{message:"Invalid fragmented record.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.unexpected_message}});u.record.ready=!0}}return d};return a.handshake=function(u){if(a.entity!==m.ConnectionEnd.client)a.error(a,{message:"Cannot initiate handshake as a server.",fatal:!1});else if(a.handshaking)a.error(a,{message:"Handshake already in progress.",fatal:!1});else{if(a.fail&&!a.open&&a.handshakes===0)a.fail=!1;a.handshaking=!0,u=u||"";var d=null;if(u.length>0){if(a.sessionCache)d=a.sessionCache.getSession(u);if(d===null)u=""}if(u.length===0&&a.sessionCache){if(d=a.sessionCache.getSession(),d!==null)u=d.id}if(a.session={id:u,version:null,cipherSuite:null,compressionMethod:null,serverCertificate:null,certificateRequest:null,clientCertificate:null,sp:{},md5:L.md.md5.create(),sha1:L.md.sha1.create()},d)a.version=d.version,a.session.sp=d.sp;a.session.sp.client_random=m.createRandom().getBytes(),a.open=!0,m.queue(a,m.createRecord(a,{type:m.ContentType.handshake,data:m.createClientHello(a)})),m.flush(a)}},a.process=function(u){var d=0;if(u)a.input.putBytes(u);if(!a.fail){if(a.record!==null&&a.record.ready&&a.record.fragment.isEmpty())a.record=null;if(a.record===null)d=l(a);if(!a.fail&&a.record!==null&&!a.record.ready)d=c(a);if(!a.fail&&a.record!==null&&a.record.ready)o(a,a.record)}return d},a.prepare=function(u){return m.queue(a,m.createRecord(a,{type:m.ContentType.application_data,data:L.util.createBuffer(u)})),m.flush(a)},a.prepareHeartbeatRequest=function(u,d){if(u instanceof L.util.ByteBuffer)u=u.bytes();if(typeof d>"u")d=u.length;return a.expectedHeartbeatPayload=u,m.queue(a,m.createRecord(a,{type:m.ContentType.heartbeat,data:m.createHeartbeat(m.HeartbeatMessageType.heartbeat_request,u,d)})),m.flush(a)},a.close=function(u){if(!a.fail&&a.sessionCache&&a.session){var d={id:a.session.id,version:a.session.version,sp:a.session.sp};d.sp.keys=null,a.sessionCache.setSession(d.id,d)}if(a.open){if(a.open=!1,a.input.clear(),a.isConnected||a.handshaking)a.isConnected=a.handshaking=!1,m.queue(a,m.createAlert(a,{level:m.Alert.Level.warning,description:m.Alert.Description.close_notify})),m.flush(a);a.closed(a)}a.reset(u)},a};cd.exports=L.tls=L.tls||{};for(Ci in m)if(typeof m[Ci]!=="function")L.tls[Ci]=m[Ci];var Ci;L.tls.prf_tls1=Hs;L.tls.hmac_sha1=Qm;L.tls.createSessionCache=m.createSessionCache;L.tls.createConnection=m.createConnection});var fd=fe(function(d1,dd){var Mr=me();Nr();Oo();var Ft=dd.exports=Mr.tls;Ft.CipherSuites.TLS_RSA_WITH_AES_128_CBC_SHA={id:[0,47],name:"TLS_RSA_WITH_AES_128_CBC_SHA",initSecurityParameters:function(e){e.bulk_cipher_algorithm=Ft.BulkCipherAlgorithm.aes,e.cipher_type=Ft.CipherType.block,e.enc_key_length=16,e.block_length=16,e.fixed_iv_length=16,e.record_iv_length=16,e.mac_algorithm=Ft.MACAlgorithm.hmac_sha1,e.mac_length=20,e.mac_key_length=20},initConnectionState:ud};Ft.CipherSuites.TLS_RSA_WITH_AES_256_CBC_SHA={id:[0,53],name:"TLS_RSA_WITH_AES_256_CBC_SHA",initSecurityParameters:function(e){e.bulk_cipher_algorithm=Ft.BulkCipherAlgorithm.aes,e.cipher_type=Ft.CipherType.block,e.enc_key_length=32,e.block_length=16,e.fixed_iv_length=16,e.record_iv_length=16,e.mac_algorithm=Ft.MACAlgorithm.hmac_sha1,e.mac_length=20,e.mac_key_length=20},initConnectionState:ud};function ud(e,t,n){var r=t.entity===Mr.tls.ConnectionEnd.client;e.read.cipherState={init:!1,cipher:Mr.cipher.createDecipher("AES-CBC",r?n.keys.server_write_key:n.keys.client_write_key),iv:r?n.keys.server_write_IV:n.keys.client_write_IV},e.write.cipherState={init:!1,cipher:Mr.cipher.createCipher("AES-CBC",r?n.keys.client_write_key:n.keys.server_write_key),iv:r?n.keys.client_write_IV:n.keys.server_write_IV},e.read.cipherFunction=vy,e.write.cipherFunction=gy,e.read.macLength=e.write.macLength=n.mac_length,e.read.macFunction=e.write.macFunction=Ft.hmac_sha1}function gy(e,t){var n=!1,r=t.macFunction(t.macKey,t.sequenceNumber,e);e.fragment.putBytes(r),t.updateSequenceNumber();var i;if(e.version.minor===Ft.Versions.TLS_1_0.minor)i=t.cipherState.init?null:t.cipherState.iv;else i=Mr.random.getBytesSync(16);t.cipherState.init=!0;var s=t.cipherState.cipher;if(s.start({iv:i}),e.version.minor>=Ft.Versions.TLS_1_1.minor)s.output.putBytes(i);if(s.update(e.fragment),s.finish(my))e.fragment=s.output,e.length=e.fragment.length(),n=!0;return n}function my(e,t,n){if(!n){var r=e-t.length()%e;t.fillWithByte(r-1,r)}return!0}function yy(e,t,n){var r=!0;if(n){var i=t.length(),s=t.last();for(var a=i-1-s;a<i-1;++a)r=r&&t.at(a)==s;if(r)t.truncate(s+1)}return r}function vy(e,t){var n=!1,r;if(e.version.minor===Ft.Versions.TLS_1_0.minor)r=t.cipherState.init?null:t.cipherState.iv;else r=e.fragment.getBytes(16);t.cipherState.init=!0;var i=t.cipherState.cipher;i.start({iv:r}),i.update(e.fragment),n=i.finish(yy);var s=t.macLength,a=Mr.random.getBytesSync(s),o=i.output.length();if(o>=s)e.fragment=i.output.getBytes(o-s),a=i.output.getBytes(s);else e.fragment=i.output.getBytes();e.fragment=Mr.util.createBuffer(e.fragment),e.length=e.fragment.length();var l=t.macFunction(t.macKey,t.sequenceNumber,e);return t.updateSequenceNumber(),n=xy(t.macKey,a,l)&&n,n}function xy(e,t,n){var r=Mr.hmac.create();return r.start("SHA1",e),r.update(t),t=r.digest().getBytes(),r.start(null,null),r.update(n),n=r.digest().getBytes(),t===n}});var Fo=fe(function(f1,md){var je=me();er();Be();var Ei=md.exports=je.sha512=je.sha512||{};je.md.sha512=je.md.algorithms.sha512=Ei;var hd=je.sha384=je.sha512.sha384=je.sha512.sha384||{};hd.create=function(){return Ei.create("SHA-384")};je.md.sha384=je.md.algorithms.sha384=hd;je.sha512.sha256=je.sha512.sha256||{create:function(){return Ei.create("SHA-512/256")}};je.md["sha512/256"]=je.md.algorithms["sha512/256"]=je.sha512.sha256;je.sha512.sha224=je.sha512.sha224||{create:function(){return Ei.create("SHA-512/224")}};je.md["sha512/224"]=je.md.algorithms["sha512/224"]=je.sha512.sha224;Ei.create=function(e){if(!gd)Sy();if(typeof e>"u")e="SHA-512";if(!(e in un))throw Error("Invalid SHA-512 algorithm: "+e);var t=un[e],n=null,r=je.util.createBuffer(),i=Array(80);for(var s=0;s<80;++s)i[s]=[,,];var a=64;switch(e){case"SHA-384":a=48;break;case"SHA-512/256":a=32;break;case"SHA-512/224":a=28;break}var o={algorithm:e.replace("-","").toLowerCase(),blockLength:128,digestLength:a,messageLength:0,fullMessageLength:null,messageLengthSize:16};return o.start=function(){o.messageLength=0,o.fullMessageLength=o.messageLength128=[];var l=o.messageLengthSize/4;for(var c=0;c<l;++c)o.fullMessageLength.push(0);r=je.util.createBuffer(),n=Array(t.length);for(var c=0;c<t.length;++c)n[c]=t[c].slice(0);return o},o.start(),o.update=function(l,c){if(c==="utf8")l=je.util.encodeUtf8(l);var u=l.length;o.messageLength+=u,u=[u/4294967296>>>0,u>>>0];for(var d=o.fullMessageLength.length-1;d>=0;--d)o.fullMessageLength[d]+=u[1],u[1]=u[0]+(o.fullMessageLength[d]/4294967296>>>0),o.fullMessageLength[d]=o.fullMessageLength[d]>>>0,u[0]=u[1]/4294967296>>>0;if(r.putBytes(l),pd(n,i,r),r.read>2048||r.length()===0)r.compact();return o},o.digest=function(){var l=je.util.createBuffer();l.putBytes(r.bytes());var c=o.fullMessageLength[o.fullMessageLength.length-1]+o.messageLengthSize,u=c&o.blockLength-1;l.putBytes(Uo.substr(0,o.blockLength-u));var d,f,y=o.fullMessageLength[0]*8;for(var p=0;p<o.fullMessageLength.length-1;++p)d=o.fullMessageLength[p+1]*8,f=d/4294967296>>>0,y+=f,l.putInt32(y>>>0),y=d>>>0;l.putInt32(y);var v=Array(n.length);for(var p=0;p<n.length;++p)v[p]=n[p].slice(0);pd(v,i,l);var x=je.util.createBuffer(),b;if(e==="SHA-512")b=v.length;else if(e==="SHA-384")b=v.length-2;else b=v.length-4;for(var p=0;p<b;++p)if(x.putInt32(v[p][0]),p!==b-1||e!=="SHA-512/224")x.putInt32(v[p][1]);return x},o};var Uo=null,gd=!1,Vo=null,un=null;function Sy(){Uo=String.fromCharCode(128),Uo+=je.util.fillString(String.fromCharCode(0),128),Vo=[[1116352408,3609767458],[1899447441,602891725],[3049323471,3964484399],[3921009573,2173295548],[961987163,4081628472],[1508970993,3053834265],[2453635748,2937671579],[2870763221,3664609560],[3624381080,2734883394],[310598401,1164996542],[607225278,1323610764],[1426881987,3590304994],[1925078388,4068182383],[2162078206,991336113],[2614888103,633803317],[3248222580,3479774868],[3835390401,2666613458],[4022224774,944711139],[264347078,2341262773],[604807628,2007800933],[770255983,1495990901],[1249150122,1856431235],[1555081692,3175218132],[1996064986,2198950837],[2554220882,3999719339],[2821834349,766784016],[2952996808,2566594879],[3210313671,3203337956],[3336571891,1034457026],[3584528711,2466948901],[113926993,3758326383],[338241895,168717936],[666307205,1188179964],[773529912,1546045734],[1294757372,1522805485],[1396182291,2643833823],[1695183700,2343527390],[1986661051,1014477480],[2177026350,1206759142],[2456956037,344077627],[2730485921,1290863460],[2820302411,3158454273],[3259730800,3505952657],[3345764771,106217008],[3516065817,3606008344],[3600352804,1432725776],[4094571909,1467031594],[275423344,851169720],[430227734,3100823752],[506948616,1363258195],[659060556,3750685593],[883997877,3785050280],[958139571,3318307427],[1322822218,3812723403],[1537002063,2003034995],[1747873779,3602036899],[1955562222,1575990012],[2024104815,1125592928],[2227730452,2716904306],[2361852424,442776044],[2428436474,593698344],[2756734187,3733110249],[3204031479,2999351573],[3329325298,3815920427],[3391569614,3928383900],[3515267271,566280711],[3940187606,3454069534],[4118630271,4000239992],[116418474,1914138554],[174292421,2731055270],[289380356,3203993006],[460393269,320620315],[685471733,587496836],[852142971,1086792851],[1017036298,365543100],[1126000580,2618297676],[1288033470,3409855158],[1501505948,4234509866],[1607167915,987167468],[1816402316,1246189591]],un={},un["SHA-512"]=[[1779033703,4089235720],[3144134277,2227873595],[1013904242,4271175723],[2773480762,1595750129],[1359893119,2917565137],[2600822924,725511199],[528734635,4215389547],[1541459225,327033209]],un["SHA-384"]=[[3418070365,3238371032],[1654270250,914150663],[2438529370,812702999],[355462360,4144912697],[1731405415,4290775857],[2394180231,1750603025],[3675008525,1694076839],[1203062813,3204075428]],un["SHA-512/256"]=[[573645204,4230739756],[2673172387,3360449730],[596883563,1867755857],[2520282905,1497426621],[2519219938,2827943907],[3193839141,1401305490],[721525244,746961066],[246885852,2177182882]],un["SHA-512/224"]=[[2352822216,424955298],[1944164710,2312950998],[502970286,855612546],[1738396948,1479516111],[258812777,2077511080],[2011393907,79989058],[1067287976,1780299464],[286451373,2446758561]],gd=!0}function pd(e,t,n){var r,i,s,a,o,l,c,u,d,f,y,p,v,x,b,A,E,k,I,R,M,ee,O,K,ie,ve,we,nt,_e,Ve,V,te,Q,ue,ce,Z=n.length();while(Z>=128){for(_e=0;_e<16;++_e)t[_e][0]=n.getInt32()>>>0,t[_e][1]=n.getInt32()>>>0;for(;_e<80;++_e)te=t[_e-2],Ve=te[0],V=te[1],r=((Ve>>>19|V<<13)^(V>>>29|Ve<<3)^Ve>>>6)>>>0,i=((Ve<<13|V>>>19)^(V<<3|Ve>>>29)^(Ve<<26|V>>>6))>>>0,ue=t[_e-15],Ve=ue[0],V=ue[1],s=((Ve>>>1|V<<31)^(Ve>>>8|V<<24)^Ve>>>7)>>>0,a=((Ve<<31|V>>>1)^(Ve<<24|V>>>8)^(Ve<<25|V>>>7))>>>0,Q=t[_e-7],ce=t[_e-16],V=i+Q[1]+a+ce[1],t[_e][0]=r+Q[0]+s+ce[0]+(V/4294967296>>>0)>>>0,t[_e][1]=V>>>0;v=e[0][0],x=e[0][1],b=e[1][0],A=e[1][1],E=e[2][0],k=e[2][1],I=e[3][0],R=e[3][1],M=e[4][0],ee=e[4][1],O=e[5][0],K=e[5][1],ie=e[6][0],ve=e[6][1],we=e[7][0],nt=e[7][1];for(_e=0;_e<80;++_e)c=((M>>>14|ee<<18)^(M>>>18|ee<<14)^(ee>>>9|M<<23))>>>0,u=((M<<18|ee>>>14)^(M<<14|ee>>>18)^(ee<<23|M>>>9))>>>0,d=(ie^M&(O^ie))>>>0,f=(ve^ee&(K^ve))>>>0,o=((v>>>28|x<<4)^(x>>>2|v<<30)^(x>>>7|v<<25))>>>0,l=((v<<4|x>>>28)^(x<<30|v>>>2)^(x<<25|v>>>7))>>>0,y=(v&b|E&(v^b))>>>0,p=(x&A|k&(x^A))>>>0,V=nt+u+f+Vo[_e][1]+t[_e][1],r=we+c+d+Vo[_e][0]+t[_e][0]+(V/4294967296>>>0)>>>0,i=V>>>0,V=l+p,s=o+y+(V/4294967296>>>0)>>>0,a=V>>>0,we=ie,nt=ve,ie=O,ve=K,O=M,K=ee,V=R+i,M=I+r+(V/4294967296>>>0)>>>0,ee=V>>>0,I=E,R=k,E=b,k=A,b=v,A=x,V=i+a,v=r+s+(V/4294967296>>>0)>>>0,x=V>>>0;V=e[0][1]+x,e[0][0]=e[0][0]+v+(V/4294967296>>>0)>>>0,e[0][1]=V>>>0,V=e[1][1]+A,e[1][0]=e[1][0]+b+(V/4294967296>>>0)>>>0,e[1][1]=V>>>0,V=e[2][1]+k,e[2][0]=e[2][0]+E+(V/4294967296>>>0)>>>0,e[2][1]=V>>>0,V=e[3][1]+R,e[3][0]=e[3][0]+I+(V/4294967296>>>0)>>>0,e[3][1]=V>>>0,V=e[4][1]+ee,e[4][0]=e[4][0]+M+(V/4294967296>>>0)>>>0,e[4][1]=V>>>0,V=e[5][1]+K,e[5][0]=e[5][0]+O+(V/4294967296>>>0)>>>0,e[5][1]=V>>>0,V=e[6][1]+ve,e[6][0]=e[6][0]+ie+(V/4294967296>>>0)>>>0,e[6][1]=V>>>0,V=e[7][1]+nt,e[7][0]=e[7][0]+we+(V/4294967296>>>0)>>>0,e[7][1]=V>>>0,Z-=128}}});var yd=fe(function(Cy){var by=me();Kt();var pt=by.asn1;Cy.privateKeyValidator={name:"PrivateKeyInfo",tagClass:pt.Class.UNIVERSAL,type:pt.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:pt.Class.UNIVERSAL,type:pt.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:pt.Class.UNIVERSAL,type:pt.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:pt.Class.UNIVERSAL,type:pt.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:pt.Class.UNIVERSAL,type:pt.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]};Cy.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:pt.Class.UNIVERSAL,type:pt.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:pt.Class.UNIVERSAL,type:pt.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:pt.Class.UNIVERSAL,type:pt.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{tagClass:pt.Class.UNIVERSAL,type:pt.Type.BITSTRING,constructed:!1,composed:!0,captureBitStringValue:"ed25519PublicKey"}]}});var Id=fe(function(h1,kd){var yt=me();vi();Dt();Fo();Be();var Cd=yd(),{publicKeyValidator:Ty,privateKeyValidator:Ay}=Cd;if(typeof Wo>"u")Wo=yt.jsbn.BigInteger;var Wo,$o=yt.util.ByteBuffer,At=typeof Buffer>"u"?Uint8Array:Buffer;yt.pki=yt.pki||{};kd.exports=yt.pki.ed25519=yt.ed25519=yt.ed25519||{};var Ee=yt.ed25519;Ee.constants={};Ee.constants.PUBLIC_KEY_BYTE_LENGTH=32;Ee.constants.PRIVATE_KEY_BYTE_LENGTH=64;Ee.constants.SEED_BYTE_LENGTH=32;Ee.constants.SIGN_BYTE_LENGTH=64;Ee.constants.HASH_BYTE_LENGTH=64;Ee.generateKeyPair=function(e){e=e||{};var t=e.seed;if(t===void 0)t=yt.random.getBytesSync(Ee.constants.SEED_BYTE_LENGTH);else if(typeof t==="string"){if(t.length!==Ee.constants.SEED_BYTE_LENGTH)throw TypeError('"seed" must be '+Ee.constants.SEED_BYTE_LENGTH+" bytes in length.")}else if(!(t instanceof Uint8Array))throw TypeError('"seed" must be a node.js Buffer, Uint8Array, or a binary string.');t=Sr({message:t,encoding:"binary"});var n=new At(Ee.constants.PUBLIC_KEY_BYTE_LENGTH),r=new At(Ee.constants.PRIVATE_KEY_BYTE_LENGTH);for(var i=0;i<32;++i)r[i]=t[i];return Ry(n,r),{publicKey:n,privateKey:r}};Ee.privateKeyFromAsn1=function(e){var t={},n=[],r=yt.asn1.validate(e,Ay,t,n);if(!r){var i=Error("Invalid Key.");throw i.errors=n,i}var s=yt.asn1.derToOid(t.privateKeyOid),a=yt.oids.EdDSA25519;if(s!==a)throw Error('Invalid OID "'+s+'"; OID must be "'+a+'".');var o=t.privateKey,l=Sr({message:yt.asn1.fromDer(o).value,encoding:"binary"});return{privateKeyBytes:l}};Ee.publicKeyFromAsn1=function(e){var t={},n=[],r=yt.asn1.validate(e,Ty,t,n);if(!r){var i=Error("Invalid Key.");throw i.errors=n,i}var s=yt.asn1.derToOid(t.publicKeyOid),a=yt.oids.EdDSA25519;if(s!==a)throw Error('Invalid OID "'+s+'"; OID must be "'+a+'".');var o=t.ed25519PublicKey;if(o.length!==Ee.constants.PUBLIC_KEY_BYTE_LENGTH)throw Error("Key length is invalid.");return Sr({message:o,encoding:"binary"})};Ee.publicKeyFromPrivateKey=function(e){e=e||{};var t=Sr({message:e.privateKey,encoding:"binary"});if(t.length!==Ee.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Ee.constants.PRIVATE_KEY_BYTE_LENGTH);var n=new At(Ee.constants.PUBLIC_KEY_BYTE_LENGTH);for(var r=0;r<n.length;++r)n[r]=t[32+r];return n};Ee.sign=function(e){e=e||{};var t=Sr(e),n=Sr({message:e.privateKey,encoding:"binary"});if(n.length===Ee.constants.SEED_BYTE_LENGTH){var r=Ee.generateKeyPair({seed:n});n=r.privateKey}else if(n.length!==Ee.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Ee.constants.SEED_BYTE_LENGTH+" or "+Ee.constants.PRIVATE_KEY_BYTE_LENGTH);var i=new At(Ee.constants.SIGN_BYTE_LENGTH+t.length);By(i,t,t.length,n);var s=new At(Ee.constants.SIGN_BYTE_LENGTH);for(var a=0;a<s.length;++a)s[a]=i[a];return s};Ee.verify=function(e){e=e||{};var t=Sr(e);if(e.signature===void 0)throw TypeError('"options.signature" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a binary string.');var n=Sr({message:e.signature,encoding:"binary"});if(n.length!==Ee.constants.SIGN_BYTE_LENGTH)throw TypeError('"options.signature" must have a byte length of '+Ee.constants.SIGN_BYTE_LENGTH);var r=Sr({message:e.publicKey,encoding:"binary"});if(r.length!==Ee.constants.PUBLIC_KEY_BYTE_LENGTH)throw TypeError('"options.publicKey" must have a byte length of '+Ee.constants.PUBLIC_KEY_BYTE_LENGTH);var i=new At(Ee.constants.SIGN_BYTE_LENGTH+t.length),s=new At(Ee.constants.SIGN_BYTE_LENGTH+t.length),a;for(a=0;a<Ee.constants.SIGN_BYTE_LENGTH;++a)i[a]=n[a];for(a=0;a<t.length;++a)i[a+Ee.constants.SIGN_BYTE_LENGTH]=t[a];return Py(s,i,i.length,r)>=0};function Sr(e){var t=e.message;if(t instanceof Uint8Array||t instanceof At)return t;var n=e.encoding;if(t===void 0)if(e.md)t=e.md.digest().getBytes(),n="binary";else throw TypeError('"options.message" or "options.md" not specified.');if(typeof t==="string"&&!n)throw TypeError('"options.encoding" must be "binary" or "utf8".');if(typeof t==="string"){if(typeof Buffer<"u")return Buffer.from(t,n);t=new $o(t,n)}else if(!(t instanceof $o))throw TypeError('"options.message" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a string with "options.encoding" specifying its encoding.');var r=new At(t.length());for(var i=0;i<r.length;++i)r[i]=t.at(i);return r}var Ho=se(),Ks=se([1]),_y=se([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),ky=se([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),vd=se([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),xd=se([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),wi=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]),Iy=se([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function Ti(e,t){var n=yt.md.sha512.create(),r=new $o(e);n.update(r.getBytes(t),"binary");var i=n.digest().getBytes();if(typeof Buffer<"u")return Buffer.from(i,"binary");var s=new At(Ee.constants.HASH_BYTE_LENGTH);for(var a=0;a<64;++a)s[a]=i.charCodeAt(a);return s}function Ry(e,t){var n=[se(),se(),se(),se()],r,i=Ti(t,32);i[0]&=248,i[31]&=127,i[31]|=64,jo(n,i),Go(e,n);for(r=0;r<32;++r)t[r+32]=e[r];return 0}function By(e,t,n,r){var i,s,a=new Float64Array(64),o=[se(),se(),se(),se()],l=Ti(r,32);l[0]&=248,l[31]&=127,l[31]|=64;var c=n+64;for(i=0;i<n;++i)e[64+i]=t[i];for(i=0;i<32;++i)e[32+i]=l[32+i];var u=Ti(e.subarray(32),n+32);Ko(u),jo(o,u),Go(e,o);for(i=32;i<64;++i)e[i]=r[i];var d=Ti(e,n+64);Ko(d);for(i=32;i<64;++i)a[i]=0;for(i=0;i<32;++i)a[i]=u[i];for(i=0;i<32;++i)for(s=0;s<32;s++)a[i+s]+=d[i]*l[s];return Ed(e.subarray(32),a),c}function Py(e,t,n,r){var i,s,a=new At(32),o=[se(),se(),se(),se()],l=[se(),se(),se(),se()];if(s=-1,n<64)return-1;if(Dy(l,r))return-1;if(!Ny(t,32))return-1;for(i=0;i<n;++i)e[i]=t[i];for(i=0;i<32;++i)e[i+32]=r[i];var c=Ti(e,n);if(Ko(c),Ad(o,l,c),jo(l,t.subarray(32)),qo(o,l),Go(a,o),n-=64,wd(t,0,a,0)){for(i=0;i<n;++i)e[i]=0;return-1}for(i=0;i<n;++i)e[i]=t[i+64];return s=n,s}function Ny(e,t){var n;for(n=31;n>=0;--n){if(e[t+n]<wi[n])return!0;if(e[t+n]>wi[n])return!1}return!1}function Ed(e,t){var n,r,i,s;for(r=63;r>=32;--r){n=0;for(i=r-32,s=r-12;i<s;++i)t[i]+=n-16*t[r]*wi[i-(r-32)],n=t[i]+128>>8,t[i]-=n*256;t[i]+=n,t[r]=0}n=0;for(i=0;i<32;++i)t[i]+=n-(t[31]>>4)*wi[i],n=t[i]>>8,t[i]&=255;for(i=0;i<32;++i)t[i]-=n*wi[i];for(r=0;r<32;++r)t[r+1]+=t[r]>>8,e[r]=t[r]&255}function Ko(e){var t=new Float64Array(64);for(var n=0;n<64;++n)t[n]=e[n],e[n]=0;Ed(e,t)}function qo(e,t){var n=se(),r=se(),i=se(),s=se(),a=se(),o=se(),l=se(),c=se(),u=se();Ln(n,e[1],e[0]),Ln(u,t[1],t[0]),We(n,n,u),Dn(r,e[0],e[1]),Dn(u,t[0],t[1]),We(r,r,u),We(i,e[3],t[3]),We(i,i,ky),We(s,e[2],t[2]),Dn(s,s,s),Ln(a,r,n),Ln(o,s,i),Dn(l,s,i),Dn(c,r,n),We(e[0],a,o),We(e[1],c,l),We(e[2],l,o),We(e[3],a,c)}function Sd(e,t,n){for(var r=0;r<4;++r)_d(e[r],t[r],n)}function Go(e,t){var n=se(),r=se(),i=se();Vy(i,t[2]),We(n,t[0],i),We(r,t[1],i),qs(e,r),e[31]^=Td(n)<<7}function qs(e,t){var n,r,i,s=se(),a=se();for(n=0;n<16;++n)a[n]=t[n];Mo(a),Mo(a),Mo(a);for(r=0;r<2;++r){s[0]=a[0]-65517;for(n=1;n<15;++n)s[n]=a[n]-65535-(s[n-1]>>16&1),s[n-1]&=65535;s[15]=a[15]-32767-(s[14]>>16&1),i=s[15]>>16&1,s[14]&=65535,_d(a,s,1-i)}for(n=0;n<16;n++)e[2*n]=a[n]&255,e[2*n+1]=a[n]>>8}function Dy(e,t){var n=se(),r=se(),i=se(),s=se(),a=se(),o=se(),l=se();if(Wr(e[2],Ks),Ly(e[1],t),dn(i,e[1]),We(s,i,_y),Ln(i,i,e[2]),Dn(s,e[2],s),dn(a,s),dn(o,a),We(l,o,a),We(n,l,i),We(n,n,s),Oy(n,n),We(n,n,i),We(n,n,s),We(n,n,s),We(e[0],n,s),dn(r,e[0]),We(r,r,s),bd(r,i))We(e[0],e[0],Iy);if(dn(r,e[0]),We(r,r,s),bd(r,i))return-1;if(Td(e[0])===t[31]>>7)Ln(e[0],Ho,e[0]);return We(e[3],e[0],e[1]),0}function Ly(e,t){var n;for(n=0;n<16;++n)e[n]=t[2*n]+(t[2*n+1]<<8);e[15]&=32767}function Oy(e,t){var n=se(),r;for(r=0;r<16;++r)n[r]=t[r];for(r=250;r>=0;--r)if(dn(n,n),r!==1)We(n,n,t);for(r=0;r<16;++r)e[r]=n[r]}function bd(e,t){var n=new At(32),r=new At(32);return qs(n,e),qs(r,t),wd(n,0,r,0)}function wd(e,t,n,r){return Uy(e,t,n,r,32)}function Uy(e,t,n,r,i){var s,a=0;for(s=0;s<i;++s)a|=e[t+s]^n[r+s];return(1&a-1>>>8)-1}function Td(e){var t=new At(32);return qs(t,e),t[0]&1}function Ad(e,t,n){var r,i;Wr(e[0],Ho),Wr(e[1],Ks),Wr(e[2],Ks),Wr(e[3],Ho);for(i=255;i>=0;--i)r=n[i/8|0]>>(i&7)&1,Sd(e,t,r),qo(t,e),qo(e,e),Sd(e,t,r)}function jo(e,t){var n=[se(),se(),se(),se()];Wr(n[0],vd),Wr(n[1],xd),Wr(n[2],Ks),We(n[3],vd,xd),Ad(e,n,t)}function Wr(e,t){var n;for(n=0;n<16;n++)e[n]=t[n]|0}function Vy(e,t){var n=se(),r;for(r=0;r<16;++r)n[r]=t[r];for(r=253;r>=0;--r)if(dn(n,n),r!==2&&r!==4)We(n,n,t);for(r=0;r<16;++r)e[r]=n[r]}function Mo(e){var t,n,r=1;for(t=0;t<16;++t)n=e[t]+r+65535,r=Math.floor(n/65536),e[t]=n-r*65536;e[0]+=r-1+37*(r-1)}function _d(e,t,n){var r,i=~(n-1);for(var s=0;s<16;++s)r=i&(e[s]^t[s]),e[s]^=r,t[s]^=r}function se(e){var t,n=new Float64Array(16);if(e)for(t=0;t<e.length;++t)n[t]=e[t];return n}function Dn(e,t,n){for(var r=0;r<16;++r)e[r]=t[r]+n[r]}function Ln(e,t,n){for(var r=0;r<16;++r)e[r]=t[r]-n[r]}function dn(e,t){We(e,t,t)}function We(e,t,n){var r,i,s=0,a=0,o=0,l=0,c=0,u=0,d=0,f=0,y=0,p=0,v=0,x=0,b=0,A=0,E=0,k=0,I=0,R=0,M=0,ee=0,O=0,K=0,ie=0,ve=0,we=0,nt=0,_e=0,Ve=0,V=0,te=0,Q=0,ue=n[0],ce=n[1],Z=n[2],Pe=n[3],Fe=n[4],le=n[5],Me=n[6],de=n[7],qe=n[8],Oe=n[9],at=n[10],Xe=n[11],ot=n[12],lt=n[13],Ye=n[14],Ue=n[15];r=t[0],s+=r*ue,a+=r*ce,o+=r*Z,l+=r*Pe,c+=r*Fe,u+=r*le,d+=r*Me,f+=r*de,y+=r*qe,p+=r*Oe,v+=r*at,x+=r*Xe,b+=r*ot,A+=r*lt,E+=r*Ye,k+=r*Ue,r=t[1],a+=r*ue,o+=r*ce,l+=r*Z,c+=r*Pe,u+=r*Fe,d+=r*le,f+=r*Me,y+=r*de,p+=r*qe,v+=r*Oe,x+=r*at,b+=r*Xe,A+=r*ot,E+=r*lt,k+=r*Ye,I+=r*Ue,r=t[2],o+=r*ue,l+=r*ce,c+=r*Z,u+=r*Pe,d+=r*Fe,f+=r*le,y+=r*Me,p+=r*de,v+=r*qe,x+=r*Oe,b+=r*at,A+=r*Xe,E+=r*ot,k+=r*lt,I+=r*Ye,R+=r*Ue,r=t[3],l+=r*ue,c+=r*ce,u+=r*Z,d+=r*Pe,f+=r*Fe,y+=r*le,p+=r*Me,v+=r*de,x+=r*qe,b+=r*Oe,A+=r*at,E+=r*Xe,k+=r*ot,I+=r*lt,R+=r*Ye,M+=r*Ue,r=t[4],c+=r*ue,u+=r*ce,d+=r*Z,f+=r*Pe,y+=r*Fe,p+=r*le,v+=r*Me,x+=r*de,b+=r*qe,A+=r*Oe,E+=r*at,k+=r*Xe,I+=r*ot,R+=r*lt,M+=r*Ye,ee+=r*Ue,r=t[5],u+=r*ue,d+=r*ce,f+=r*Z,y+=r*Pe,p+=r*Fe,v+=r*le,x+=r*Me,b+=r*de,A+=r*qe,E+=r*Oe,k+=r*at,I+=r*Xe,R+=r*ot,M+=r*lt,ee+=r*Ye,O+=r*Ue,r=t[6],d+=r*ue,f+=r*ce,y+=r*Z,p+=r*Pe,v+=r*Fe,x+=r*le,b+=r*Me,A+=r*de,E+=r*qe,k+=r*Oe,I+=r*at,R+=r*Xe,M+=r*ot,ee+=r*lt,O+=r*Ye,K+=r*Ue,r=t[7],f+=r*ue,y+=r*ce,p+=r*Z,v+=r*Pe,x+=r*Fe,b+=r*le,A+=r*Me,E+=r*de,k+=r*qe,I+=r*Oe,R+=r*at,M+=r*Xe,ee+=r*ot,O+=r*lt,K+=r*Ye,ie+=r*Ue,r=t[8],y+=r*ue,p+=r*ce,v+=r*Z,x+=r*Pe,b+=r*Fe,A+=r*le,E+=r*Me,k+=r*de,I+=r*qe,R+=r*Oe,M+=r*at,ee+=r*Xe,O+=r*ot,K+=r*lt,ie+=r*Ye,ve+=r*Ue,r=t[9],p+=r*ue,v+=r*ce,x+=r*Z,b+=r*Pe,A+=r*Fe,E+=r*le,k+=r*Me,I+=r*de,R+=r*qe,M+=r*Oe,ee+=r*at,O+=r*Xe,K+=r*ot,ie+=r*lt,ve+=r*Ye,we+=r*Ue,r=t[10],v+=r*ue,x+=r*ce,b+=r*Z,A+=r*Pe,E+=r*Fe,k+=r*le,I+=r*Me,R+=r*de,M+=r*qe,ee+=r*Oe,O+=r*at,K+=r*Xe,ie+=r*ot,ve+=r*lt,we+=r*Ye,nt+=r*Ue,r=t[11],x+=r*ue,b+=r*ce,A+=r*Z,E+=r*Pe,k+=r*Fe,I+=r*le,R+=r*Me,M+=r*de,ee+=r*qe,O+=r*Oe,K+=r*at,ie+=r*Xe,ve+=r*ot,we+=r*lt,nt+=r*Ye,_e+=r*Ue,r=t[12],b+=r*ue,A+=r*ce,E+=r*Z,k+=r*Pe,I+=r*Fe,R+=r*le,M+=r*Me,ee+=r*de,O+=r*qe,K+=r*Oe,ie+=r*at,ve+=r*Xe,we+=r*ot,nt+=r*lt,_e+=r*Ye,Ve+=r*Ue,r=t[13],A+=r*ue,E+=r*ce,k+=r*Z,I+=r*Pe,R+=r*Fe,M+=r*le,ee+=r*Me,O+=r*de,K+=r*qe,ie+=r*Oe,ve+=r*at,we+=r*Xe,nt+=r*ot,_e+=r*lt,Ve+=r*Ye,V+=r*Ue,r=t[14],E+=r*ue,k+=r*ce,I+=r*Z,R+=r*Pe,M+=r*Fe,ee+=r*le,O+=r*Me,K+=r*de,ie+=r*qe,ve+=r*Oe,we+=r*at,nt+=r*Xe,_e+=r*ot,Ve+=r*lt,V+=r*Ye,te+=r*Ue,r=t[15],k+=r*ue,I+=r*ce,R+=r*Z,M+=r*Pe,ee+=r*Fe,O+=r*le,K+=r*Me,ie+=r*de,ve+=r*qe,we+=r*Oe,nt+=r*at,_e+=r*Xe,Ve+=r*ot,V+=r*lt,te+=r*Ye,Q+=r*Ue,s+=38*I,a+=38*R,o+=38*M,l+=38*ee,c+=38*O,u+=38*K,d+=38*ie,f+=38*ve,y+=38*we,p+=38*nt,v+=38*_e,x+=38*Ve,b+=38*V,A+=38*te,E+=38*Q,i=1,r=s+i+65535,i=Math.floor(r/65536),s=r-i*65536,r=a+i+65535,i=Math.floor(r/65536),a=r-i*65536,r=o+i+65535,i=Math.floor(r/65536),o=r-i*65536,r=l+i+65535,i=Math.floor(r/65536),l=r-i*65536,r=c+i+65535,i=Math.floor(r/65536),c=r-i*65536,r=u+i+65535,i=Math.floor(r/65536),u=r-i*65536,r=d+i+65535,i=Math.floor(r/65536),d=r-i*65536,r=f+i+65535,i=Math.floor(r/65536),f=r-i*65536,r=y+i+65535,i=Math.floor(r/65536),y=r-i*65536,r=p+i+65535,i=Math.floor(r/65536),p=r-i*65536,r=v+i+65535,i=Math.floor(r/65536),v=r-i*65536,r=x+i+65535,i=Math.floor(r/65536),x=r-i*65536,r=b+i+65535,i=Math.floor(r/65536),b=r-i*65536,r=A+i+65535,i=Math.floor(r/65536),A=r-i*65536,r=E+i+65535,i=Math.floor(r/65536),E=r-i*65536,r=k+i+65535,i=Math.floor(r/65536),k=r-i*65536,s+=i-1+37*(i-1),i=1,r=s+i+65535,i=Math.floor(r/65536),s=r-i*65536,r=a+i+65535,i=Math.floor(r/65536),a=r-i*65536,r=o+i+65535,i=Math.floor(r/65536),o=r-i*65536,r=l+i+65535,i=Math.floor(r/65536),l=r-i*65536,r=c+i+65535,i=Math.floor(r/65536),c=r-i*65536,r=u+i+65535,i=Math.floor(r/65536),u=r-i*65536,r=d+i+65535,i=Math.floor(r/65536),d=r-i*65536,r=f+i+65535,i=Math.floor(r/65536),f=r-i*65536,r=y+i+65535,i=Math.floor(r/65536),y=r-i*65536,r=p+i+65535,i=Math.floor(r/65536),p=r-i*65536,r=v+i+65535,i=Math.floor(r/65536),v=r-i*65536,r=x+i+65535,i=Math.floor(r/65536),x=r-i*65536,r=b+i+65535,i=Math.floor(r/65536),b=r-i*65536,r=A+i+65535,i=Math.floor(r/65536),A=r-i*65536,r=E+i+65535,i=Math.floor(r/65536),E=r-i*65536,r=k+i+65535,i=Math.floor(r/65536),k=r-i*65536,s+=i-1+37*(i-1),e[0]=s,e[1]=a,e[2]=o,e[3]=l,e[4]=c,e[5]=u,e[6]=d,e[7]=f,e[8]=y,e[9]=p,e[10]=v,e[11]=x,e[12]=b,e[13]=A,e[14]=E,e[15]=k}});var Nd=fe(function(g1,Pd){var Rt=me();Be();Dt();vi();Pd.exports=Rt.kem=Rt.kem||{};var Rd=Rt.jsbn.BigInteger;Rt.kem.rsa={};Rt.kem.rsa.create=function(e,t){t=t||{};var n=t.prng||Rt.random,r={};return r.encrypt=function(i,s){var a=Math.ceil(i.n.bitLength()/8),o;do o=new Rd(Rt.util.bytesToHex(n.getBytesSync(a)),16).mod(i.n);while(o.compareTo(Rd.ONE)<=0);o=Rt.util.hexToBytes(o.toString(16));var l=a-o.length;if(l>0)o=Rt.util.fillString(String.fromCharCode(0),l)+o;var c=i.encrypt(o,"NONE"),u=e.generate(o,s);return{encapsulation:c,key:u}},r.decrypt=function(i,s,a){var o=i.decrypt(s,"NONE");return e.generate(o,a)},r};Rt.kem.kdf1=function(e,t){Bd(this,e,0,t||e.digestLength)};Rt.kem.kdf2=function(e,t){Bd(this,e,1,t||e.digestLength)};function Bd(e,t,n,r){e.generate=function(i,s){var a=new Rt.util.ByteBuffer,o=Math.ceil(s/r)+n,l=new Rt.util.ByteBuffer;for(var c=n;c<o;++c){l.putInt32(c),t.start(),t.update(i+l.getBytes());var u=t.digest();a.putBytes(u.getBytes(r))}return a.truncate(a.length()-s),a.getBytes()}}});var Ld=fe(function(m1,Dd){var Te=me();Be();Dd.exports=Te.log=Te.log||{};Te.log.levels=["none","error","warning","info","debug","verbose","max"];var zs={},zo=[],Ai=null;Te.log.LEVEL_LOCKED=2;Te.log.NO_LEVEL_CHECK=4;Te.log.INTERPOLATE=8;for(Mt=0;Mt<Te.log.levels.length;++Mt)Gs=Te.log.levels[Mt],zs[Gs]={index:Mt,name:Gs.toUpperCase()};var Gs,Mt;Te.log.logMessage=function(e){var t=zs[e.level].index;for(var n=0;n<zo.length;++n){var r=zo[n];if(r.flags&Te.log.NO_LEVEL_CHECK)r.f(e);else{var i=zs[r.level].index;if(t<=i)r.f(r,e)}}};Te.log.prepareStandard=function(e){if(!("standard"in e))e.standard=zs[e.level].name+" ["+e.category+"] "+e.message};Te.log.prepareFull=function(e){if(!("full"in e)){var t=[e.message];t=t.concat([]),e.full=Te.util.format.apply(this,t)}};Te.log.prepareStandardFull=function(e){if(!("standardFull"in e))Te.log.prepareStandard(e),e.standardFull=e.standard};js=["error","warning","info","debug","verbose"];for(Mt=0;Mt<js.length;++Mt)(function(t){Te.log[t]=function(n,r){var i=Array.prototype.slice.call(arguments).slice(2),s={timestamp:new Date,level:t,category:n,message:r,arguments:i};Te.log.logMessage(s)}})(js[Mt]);var js,Mt;Te.log.makeLogger=function(e){var t={flags:0,f:e};return Te.log.setLevel(t,"none"),t};Te.log.setLevel=function(e,t){var n=!1;if(e&&!(e.flags&Te.log.LEVEL_LOCKED))for(var r=0;r<Te.log.levels.length;++r){var i=Te.log.levels[r];if(t==i){e.level=t,n=!0;break}}return n};Te.log.lock=function(e,t){if(typeof t>"u"||t)e.flags|=Te.log.LEVEL_LOCKED;else e.flags&=~Te.log.LEVEL_LOCKED};Te.log.addLogger=function(e){zo.push(e)};if(typeof console<"u"&&"log"in console){if(console.error&&console.warn&&console.info&&console.debug)Qo={error:console.error,warning:console.warn,info:console.info,debug:console.debug,verbose:console.debug},Un=function(e,t){Te.log.prepareStandard(t);var n=Qo[t.level],r=[t.standard];r=r.concat(t.arguments.slice()),n.apply(console,r)},fn=Te.log.makeLogger(Un);else Un=function(t,n){Te.log.prepareStandardFull(n),console.log(n.standardFull)},fn=Te.log.makeLogger(Un);Te.log.setLevel(fn,"debug"),Te.log.addLogger(fn),Ai=fn}else console={log:function(){}};var fn,Qo,Un;if(Ai!==null&&typeof window<"u"&&window.location){if(On=new URL(window.location.href).searchParams,On.has("console.level"))Te.log.setLevel(Ai,On.get("console.level").slice(-1)[0]);if(On.has("console.lock")){if(Xo=On.get("console.lock").slice(-1)[0],Xo=="true")Te.log.lock(Ai)}}var On,Xo;Te.log.consoleLogger=Ai});var Ud=fe(function(y1,Od){Od.exports=er();As();In();lo();Fo()});var Md=fe(function(v1,Fd){var W=me();Nr();Kt();mi();Dr();nn();wo();Dt();Be();Ms();var w=W.asn1,Et=Fd.exports=W.pkcs7=W.pkcs7||{};Et.messageFromPem=function(e){var t=W.pem.decode(e)[0];if(t.type!=="PKCS7"){var n=Error('Could not convert PKCS#7 message from PEM; PEM header type is not "PKCS#7".');throw n.headerType=t.type,n}if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert PKCS#7 message from PEM; PEM is encrypted.");var r=w.fromDer(t.body);return Et.messageFromAsn1(r)};Et.messageToPem=function(e,t){var n={type:"PKCS7",body:w.toDer(e.toAsn1()).getBytes()};return W.pem.encode(n,{maxline:t})};Et.messageFromAsn1=function(e){var t={},n=[];if(!w.validate(e,Et.asn1.contentInfoValidator,t,n)){var r=Error("Cannot read PKCS#7 message. ASN.1 object is not an PKCS#7 ContentInfo.");throw r.errors=n,r}var i=w.derToOid(t.contentType),s;switch(i){case W.pki.oids.envelopedData:s=Et.createEnvelopedData();break;case W.pki.oids.encryptedData:s=Et.createEncryptedData();break;case W.pki.oids.signedData:s=Et.createSignedData();break;default:throw Error("Cannot read PKCS#7 message. ContentType with OID "+i+" is not (yet) supported.")}return s.fromAsn1(t.content.value[0]),s};Et.createSignedData=function(){var e=null;return e={type:W.pki.oids.signedData,version:1,certificates:[],crls:[],signers:[],digestAlgorithmIdentifiers:[],contentInfo:null,signerInfos:[],fromAsn1:function(r){if(Jo(e,r,Et.asn1.signedDataValidator),e.certificates=[],e.crls=[],e.digestAlgorithmIdentifiers=[],e.contentInfo=null,e.signerInfos=[],e.rawCapture.certificates){var i=e.rawCapture.certificates.value;for(var s=0;s<i.length;++s)e.certificates.push(W.pki.certificateFromAsn1(i[s]))}},toAsn1:function(){if(!e.contentInfo)e.sign();var r=[];for(var i=0;i<e.certificates.length;++i)r.push(W.pki.certificateToAsn1(e.certificates[i]));var s=[],a=w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,w.integerToDer(e.version).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SET,!0,e.digestAlgorithmIdentifiers),e.contentInfo])]);if(r.length>0)a.value[0].value.push(w.create(w.Class.CONTEXT_SPECIFIC,0,!0,r));if(s.length>0)a.value[0].value.push(w.create(w.Class.CONTEXT_SPECIFIC,1,!0,s));return a.value[0].value.push(w.create(w.Class.UNIVERSAL,w.Type.SET,!0,e.signerInfos)),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.type).getBytes()),a])},addSigner:function(r){var{issuer:i,serialNumber:s}=r;if(r.certificate){var a=r.certificate;if(typeof a==="string")a=W.pki.certificateFromPem(a);i=a.issuer.attributes,s=a.serialNumber}var o=r.key;if(!o)throw Error("Could not add PKCS#7 signer; no private key specified.");if(typeof o==="string")o=W.pki.privateKeyFromPem(o);var l=r.digestAlgorithm||W.pki.oids.sha1;switch(l){case W.pki.oids.sha1:case W.pki.oids.sha256:case W.pki.oids.sha384:case W.pki.oids.sha512:case W.pki.oids.md5:break;default:throw Error("Could not add PKCS#7 signer; unknown message digest algorithm: "+l)}var c=r.authenticatedAttributes||[];if(c.length>0){var u=!1,d=!1;for(var f=0;f<c.length;++f){var y=c[f];if(!u&&y.type===W.pki.oids.contentType){if(u=!0,d)break;continue}if(!d&&y.type===W.pki.oids.messageDigest){if(d=!0,u)break;continue}}if(!u||!d)throw Error("Invalid signer.authenticatedAttributes. If signer.authenticatedAttributes is specified, then it must contain at least two attributes, PKCS #9 content-type and PKCS #9 message-digest.")}e.signers.push({key:o,version:1,issuer:i,serialNumber:s,digestAlgorithm:l,signatureAlgorithm:W.pki.oids.rsaEncryption,signature:null,authenticatedAttributes:c,unauthenticatedAttributes:[]})},sign:function(r){if(r=r||{},typeof e.content!=="object"||e.contentInfo===null){if(e.contentInfo=w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(W.pki.oids.data).getBytes())]),"content"in e){var i;if(e.content instanceof W.util.ByteBuffer)i=e.content.bytes();else if(typeof e.content==="string")i=W.util.encodeUtf8(e.content);if(r.detached)e.detachedContent=w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,i);else e.contentInfo.value.push(w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,i)]))}}if(e.signers.length===0)return;var s=t();n(s)},verify:function(){throw Error("PKCS#7 signature verification not yet implemented.")},addCertificate:function(r){if(typeof r==="string")r=W.pki.certificateFromPem(r);e.certificates.push(r)},addCertificateRevokationList:function(r){throw Error("PKCS#7 CRL support not yet implemented.")}},e;function t(){var r={};for(var i=0;i<e.signers.length;++i){var s=e.signers[i],a=s.digestAlgorithm;if(!(a in r))r[a]=W.md[W.pki.oids[a]].create();if(s.authenticatedAttributes.length===0)s.md=r[a];else s.md=W.md[W.pki.oids[a]].create()}e.digestAlgorithmIdentifiers=[];for(var a in r)e.digestAlgorithmIdentifiers.push(w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(a).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.NULL,!1,"")]));return r}function n(r){var i;if(e.detachedContent)i=e.detachedContent;else i=e.contentInfo.value[1],i=i.value[0];if(!i)throw Error("Could not sign PKCS#7 message; there is no content to sign.");var s=w.derToOid(e.contentInfo.value[0].value),a=w.toDer(i);a.getByte(),w.getBerValueLength(a),a=a.getBytes();for(var o in r)r[o].start().update(a);var l=new Date;for(var c=0;c<e.signers.length;++c){var u=e.signers[c];if(u.authenticatedAttributes.length===0){if(s!==W.pki.oids.data)throw Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.")}else{u.authenticatedAttributesAsn1=w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[]);var d=w.create(w.Class.UNIVERSAL,w.Type.SET,!0,[]);for(var f=0;f<u.authenticatedAttributes.length;++f){var y=u.authenticatedAttributes[f];if(y.type===W.pki.oids.messageDigest)y.value=r[u.digestAlgorithm].digest();else if(y.type===W.pki.oids.signingTime){if(!y.value)y.value=l}d.value.push(Yo(y)),u.authenticatedAttributesAsn1.value.push(Yo(y))}a=w.toDer(d).getBytes(),u.md.start().update(a)}u.signature=u.key.sign(u.md,"RSASSA-PKCS1-V1_5")}e.signerInfos=Ky(e.signers)}};Et.createEncryptedData=function(){var e=null;return e={type:W.pki.oids.encryptedData,version:0,encryptedContent:{algorithm:W.pki.oids["aes256-CBC"]},fromAsn1:function(t){Jo(e,t,Et.asn1.encryptedDataValidator)},decrypt:function(t){if(t!==void 0)e.encryptedContent.key=t;Vd(e)}},e};Et.createEnvelopedData=function(){var e=null;return e={type:W.pki.oids.envelopedData,version:0,recipients:[],encryptedContent:{algorithm:W.pki.oids["aes256-CBC"]},fromAsn1:function(t){var n=Jo(e,t,Et.asn1.envelopedDataValidator);e.recipients=Wy(n.recipientInfos.value)},toAsn1:function(){return w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.type).getBytes()),w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,w.integerToDer(e.version).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SET,!0,$y(e.recipients)),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,qy(e.encryptedContent))])])])},findRecipient:function(t){var n=t.issuer.attributes;for(var r=0;r<e.recipients.length;++r){var i=e.recipients[r],s=i.issuer;if(i.serialNumber!==t.serialNumber)continue;if(s.length!==n.length)continue;var a=!0;for(var o=0;o<n.length;++o)if(s[o].type!==n[o].type||s[o].value!==n[o].value){a=!1;break}if(a)return i}return null},decrypt:function(t,n){if(e.encryptedContent.key===void 0&&t!==void 0&&n!==void 0)switch(t.encryptedContent.algorithm){case W.pki.oids.rsaEncryption:case W.pki.oids.desCBC:var r=n.decrypt(t.encryptedContent.content);e.encryptedContent.key=W.util.createBuffer(r);break;default:throw Error("Unsupported asymmetric cipher, OID "+t.encryptedContent.algorithm)}Vd(e)},addRecipient:function(t){e.recipients.push({version:0,issuer:t.issuer.attributes,serialNumber:t.serialNumber,encryptedContent:{algorithm:W.pki.oids.rsaEncryption,key:t.publicKey}})},encrypt:function(t,n){if(e.encryptedContent.content===void 0){n=n||e.encryptedContent.algorithm,t=t||e.encryptedContent.key;var r,i,s;switch(n){case W.pki.oids["aes128-CBC"]:r=16,i=16,s=W.aes.createEncryptionCipher;break;case W.pki.oids["aes192-CBC"]:r=24,i=16,s=W.aes.createEncryptionCipher;break;case W.pki.oids["aes256-CBC"]:r=32,i=16,s=W.aes.createEncryptionCipher;break;case W.pki.oids["des-EDE3-CBC"]:r=24,i=8,s=W.des.createEncryptionCipher;break;default:throw Error("Unsupported symmetric cipher, OID "+n)}if(t===void 0)t=W.util.createBuffer(W.random.getBytes(r));else if(t.length()!=r)throw Error("Symmetric key has wrong length; got "+t.length()+" bytes, expected "+r+".");e.encryptedContent.algorithm=n,e.encryptedContent.key=t,e.encryptedContent.parameter=W.util.createBuffer(W.random.getBytes(i));var a=s(t);if(a.start(e.encryptedContent.parameter.copy()),a.update(e.content),!a.finish())throw Error("Symmetric encryption failed.");e.encryptedContent.content=a.output}for(var o=0;o<e.recipients.length;++o){var l=e.recipients[o];if(l.encryptedContent.content!==void 0)continue;switch(l.encryptedContent.algorithm){case W.pki.oids.rsaEncryption:l.encryptedContent.content=l.encryptedContent.key.encrypt(e.encryptedContent.key.data);break;default:throw Error("Unsupported asymmetric cipher, OID "+l.encryptedContent.algorithm)}}}},e};function Fy(e){var t={},n=[];if(!w.validate(e,Et.asn1.recipientInfoValidator,t,n)){var r=Error("Cannot read PKCS#7 RecipientInfo. ASN.1 object is not an PKCS#7 RecipientInfo.");throw r.errors=n,r}return{version:t.version.charCodeAt(0),issuer:W.pki.RDNAttributesAsArray(t.issuer),serialNumber:W.util.createBuffer(t.serial).toHex(),encryptedContent:{algorithm:w.derToOid(t.encAlgorithm),parameter:t.encParameter?t.encParameter.value:void 0,content:t.encKey}}}function My(e){return w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,w.integerToDer(e.version).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[W.pki.distinguishedNameToAsn1({attributes:e.issuer}),w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,W.util.hexToBytes(e.serialNumber))]),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.encryptedContent.algorithm).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.NULL,!1,"")]),w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.encryptedContent.content)])}function Wy(e){var t=[];for(var n=0;n<e.length;++n)t.push(Fy(e[n]));return t}function $y(e){var t=[];for(var n=0;n<e.length;++n)t.push(My(e[n]));return t}function Hy(e){var t=w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,w.integerToDer(e.version).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[W.pki.distinguishedNameToAsn1({attributes:e.issuer}),w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,W.util.hexToBytes(e.serialNumber))]),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.digestAlgorithm).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.NULL,!1,"")])]);if(e.authenticatedAttributesAsn1)t.value.push(e.authenticatedAttributesAsn1);if(t.value.push(w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.signatureAlgorithm).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.NULL,!1,"")])),t.value.push(w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.signature)),e.unauthenticatedAttributes.length>0){var n=w.create(w.Class.CONTEXT_SPECIFIC,1,!0,[]);for(var r=0;r<e.unauthenticatedAttributes.length;++r){var i=e.unauthenticatedAttributes[r];n.values.push(Yo(i))}t.value.push(n)}return t}function Ky(e){var t=[];for(var n=0;n<e.length;++n)t.push(Hy(e[n]));return t}function Yo(e){var t;if(e.type===W.pki.oids.contentType)t=w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.value).getBytes());else if(e.type===W.pki.oids.messageDigest)t=w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.value.bytes());else if(e.type===W.pki.oids.signingTime){var n=new Date("1950-01-01T00:00:00Z"),r=new Date("2050-01-01T00:00:00Z"),i=e.value;if(typeof i==="string"){var s=Date.parse(i);if(!isNaN(s))i=new Date(s);else if(i.length===13)i=w.utcTimeToDate(i);else i=w.generalizedTimeToDate(i)}if(i>=n&&i<r)t=w.create(w.Class.UNIVERSAL,w.Type.UTCTIME,!1,w.dateToUtcTime(i));else t=w.create(w.Class.UNIVERSAL,w.Type.GENERALIZEDTIME,!1,w.dateToGeneralizedTime(i))}return w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.type).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SET,!0,[t])])}function qy(e){return[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(W.pki.oids.data).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.algorithm).getBytes()),!e.parameter?void 0:w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.parameter.getBytes())]),w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.content.getBytes())])]}function Jo(e,t,n){var r={},i=[];if(!w.validate(t,n,r,i)){var s=Error("Cannot read PKCS#7 message. ASN.1 object is not a supported PKCS#7 message.");throw s.errors=s,s}var a=w.derToOid(r.contentType);if(a!==W.pki.oids.data)throw Error("Unsupported PKCS#7 message. Only wrapped ContentType Data supported.");if(r.encryptedContent){var o="";if(W.util.isArray(r.encryptedContent))for(var l=0;l<r.encryptedContent.length;++l){if(r.encryptedContent[l].type!==w.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting encrypted content constructed of only OCTET STRING objects.");o+=r.encryptedContent[l].value}else o=r.encryptedContent;e.encryptedContent={algorithm:w.derToOid(r.encAlgorithm),parameter:W.util.createBuffer(r.encParameter.value),content:W.util.createBuffer(o)}}if(r.content){var o="";if(W.util.isArray(r.content))for(var l=0;l<r.content.length;++l){if(r.content[l].type!==w.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting content constructed of only OCTET STRING objects.");o+=r.content[l].value}else o=r.content;e.content=W.util.createBuffer(o)}return e.version=r.version.charCodeAt(0),e.rawCapture=r,r}function Vd(e){if(e.encryptedContent.key===void 0)throw Error("Symmetric key not available.");if(e.content===void 0){var t;switch(e.encryptedContent.algorithm){case W.pki.oids["aes128-CBC"]:case W.pki.oids["aes192-CBC"]:case W.pki.oids["aes256-CBC"]:t=W.aes.createDecryptionCipher(e.encryptedContent.key);break;case W.pki.oids.desCBC:case W.pki.oids["des-EDE3-CBC"]:t=W.des.createDecryptionCipher(e.encryptedContent.key);break;default:throw Error("Unsupported symmetric cipher, OID "+e.encryptedContent.algorithm)}if(t.start(e.encryptedContent.parameter),t.update(e.encryptedContent.content),!t.finish())throw Error("Symmetric decryption failed.");e.content=t.output}}});var $d=fe(function(x1,Wd){var st=me();Nr();Tn();As();In();Be();var Xs=Wd.exports=st.ssh=st.ssh||{};Xs.privateKeyToPutty=function(e,t,n){n=n||"",t=t||"";var r="ssh-rsa",i=t===""?"none":"aes256-cbc",s="PuTTY-User-Key-File-2: "+r+`\r
15
+ `+o+t.substr(a+1);s=i-a-1,a=-1,++i}else if(t[i]===" "||t[i]==="\t"||t[i]===",")a=i;return t}function y0(e){return e.replace(/^\s+/,"")}});var yi=fe(function(jC,au){var ze=me();Ss();ro();Be();au.exports=ze.des=ze.des||{};ze.des.startEncrypting=function(e,t,n,r){var i=Rs({key:e,output:n,decrypt:!1,mode:r||(t===null?"ECB":"CBC")});return i.start(t),i};ze.des.createEncryptionCipher=function(e,t){return Rs({key:e,output:null,decrypt:!1,mode:t})};ze.des.startDecrypting=function(e,t,n,r){var i=Rs({key:e,output:n,decrypt:!0,mode:r||(t===null?"ECB":"CBC")});return i.start(t),i};ze.des.createDecryptionCipher=function(e,t){return Rs({key:e,output:null,decrypt:!0,mode:t})};ze.des.Algorithm=function(e,t){var n=this;n.name=e,n.mode=new t({blockSize:8,cipher:{encrypt:function(r,i){return su(n._keys,r,i,!1)},decrypt:function(r,i){return su(n._keys,r,i,!0)}}}),n._init=!1};ze.des.Algorithm.prototype.initialize=function(e){if(this._init)return;var t=ze.util.createBuffer(e.key);if(this.name.indexOf("3DES")===0){if(t.length()!==24)throw Error("Invalid Triple-DES key size: "+t.length()*8)}this._keys=A0(t),this._init=!0};rr("DES-ECB",ze.cipher.modes.ecb);rr("DES-CBC",ze.cipher.modes.cbc);rr("DES-CFB",ze.cipher.modes.cfb);rr("DES-OFB",ze.cipher.modes.ofb);rr("DES-CTR",ze.cipher.modes.ctr);rr("3DES-ECB",ze.cipher.modes.ecb);rr("3DES-CBC",ze.cipher.modes.cbc);rr("3DES-CFB",ze.cipher.modes.cfb);rr("3DES-OFB",ze.cipher.modes.ofb);rr("3DES-CTR",ze.cipher.modes.ctr);function rr(e,t){var n=function(){return new ze.des.Algorithm(e,t)};ze.cipher.registerAlgorithm(e,n)}var v0=[16843776,0,65536,16843780,16842756,66564,4,65536,1024,16843776,16843780,1024,16778244,16842756,16777216,4,1028,16778240,16778240,66560,66560,16842752,16842752,16778244,65540,16777220,16777220,65540,0,1028,66564,16777216,65536,16843780,4,16842752,16843776,16777216,16777216,1024,16842756,65536,66560,16777220,1024,4,16778244,66564,16843780,65540,16842752,16778244,16777220,1028,66564,16843776,1028,16778240,16778240,0,65540,66560,0,16842756],x0=[-2146402272,-2147450880,32768,1081376,1048576,32,-2146435040,-2147450848,-2147483616,-2146402272,-2146402304,-2147483648,-2147450880,1048576,32,-2146435040,1081344,1048608,-2147450848,0,-2147483648,32768,1081376,-2146435072,1048608,-2147483616,0,1081344,32800,-2146402304,-2146435072,32800,0,1081376,-2146435040,1048576,-2147450848,-2146435072,-2146402304,32768,-2146435072,-2147450880,32,-2146402272,1081376,32,32768,-2147483648,32800,-2146402304,1048576,-2147483616,1048608,-2147450848,-2147483616,1048608,1081344,0,-2147450880,32800,-2147483648,-2146435040,-2146402272,1081344],S0=[520,134349312,0,134348808,134218240,0,131592,134218240,131080,134217736,134217736,131072,134349320,131080,134348800,520,134217728,8,134349312,512,131584,134348800,134348808,131592,134218248,131584,131072,134218248,8,134349320,512,134217728,134349312,134217728,131080,520,131072,134349312,134218240,0,512,131080,134349320,134218240,134217736,512,0,134348808,134218248,131072,134217728,134349320,8,131592,131584,134217736,134348800,134218248,520,134348800,131592,8,134348808,131584],b0=[8396801,8321,8321,128,8396928,8388737,8388609,8193,0,8396800,8396800,8396929,129,0,8388736,8388609,1,8192,8388608,8396801,128,8388608,8193,8320,8388737,1,8320,8388736,8192,8396928,8396929,129,8388736,8388609,8396800,8396929,129,0,0,8396800,8320,8388736,8388737,1,8396801,8321,8321,128,8396929,129,1,8192,8388609,8193,8396928,8388737,8193,8320,8388608,8396801,128,8388608,8192,8396928],C0=[256,34078976,34078720,1107296512,524288,256,1073741824,34078720,1074266368,524288,33554688,1074266368,1107296512,1107820544,524544,1073741824,33554432,1074266112,1074266112,0,1073742080,1107820800,1107820800,33554688,1107820544,1073742080,0,1107296256,34078976,33554432,1107296256,524544,524288,1107296512,256,33554432,1073741824,34078720,1107296512,1074266368,33554688,1073741824,1107820544,34078976,1074266368,256,33554432,1107820544,1107820800,524544,1107296256,1107820800,34078720,0,1074266112,1107296256,524544,33554688,1073742080,524288,0,1074266112,34078976,1073742080],E0=[536870928,541065216,16384,541081616,541065216,16,541081616,4194304,536887296,4210704,4194304,536870928,4194320,536887296,536870912,16400,0,4194320,536887312,16384,4210688,536887312,16,541065232,541065232,0,4210704,541081600,16400,4210688,541081600,536870912,536887296,16,541065232,4210688,541081616,4194304,16400,536870928,4194304,536887296,536870912,16400,536870928,541081616,4210688,541065216,4210704,541081600,0,541065232,16,16384,541065216,4210704,16384,4194320,536887312,0,541081600,536870912,4194320,536887312],w0=[2097152,69206018,67110914,0,2048,67110914,2099202,69208064,69208066,2097152,0,67108866,2,67108864,69206018,2050,67110912,2099202,2097154,67110912,67108866,69206016,69208064,2097154,69206016,2048,2050,69208066,2099200,2,67108864,2099200,67108864,2099200,2097152,67110914,67110914,69206018,69206018,2,2097154,67108864,67110912,2097152,69208064,2050,2099202,69208064,2050,67108866,69208066,69206016,2099200,0,2,69208066,0,2099202,69206016,2048,67108866,67110912,2048,2097154],T0=[268439616,4096,262144,268701760,268435456,268439616,64,268435456,262208,268697600,268701760,266240,268701696,266304,4096,64,268697600,268435520,268439552,4160,266240,262208,268697664,268701696,4160,0,0,268697664,268435520,268439552,266304,262144,266304,262144,268701696,4096,64,268697664,4096,266304,268439552,64,268435520,268697600,268697664,268435456,262144,268439616,0,268701760,262208,268435520,268697600,268439552,268439616,0,268701760,266240,266240,4160,4160,262208,268435456,268701696];function A0(e){var t=[0,4,536870912,536870916,65536,65540,536936448,536936452,512,516,536871424,536871428,66048,66052,536936960,536936964],n=[0,1,1048576,1048577,67108864,67108865,68157440,68157441,256,257,1048832,1048833,67109120,67109121,68157696,68157697],r=[0,8,2048,2056,16777216,16777224,16779264,16779272,0,8,2048,2056,16777216,16777224,16779264,16779272],i=[0,2097152,134217728,136314880,8192,2105344,134225920,136323072,131072,2228224,134348800,136445952,139264,2236416,134356992,136454144],s=[0,262144,16,262160,0,262144,16,262160,4096,266240,4112,266256,4096,266240,4112,266256],a=[0,1024,32,1056,0,1024,32,1056,33554432,33555456,33554464,33555488,33554432,33555456,33554464,33555488],o=[0,268435456,524288,268959744,2,268435458,524290,268959746,0,268435456,524288,268959744,2,268435458,524290,268959746],l=[0,65536,2048,67584,536870912,536936448,536872960,536938496,131072,196608,133120,198656,537001984,537067520,537004032,537069568],c=[0,262144,0,262144,2,262146,2,262146,33554432,33816576,33554432,33816576,33554434,33816578,33554434,33816578],u=[0,268435456,8,268435464,0,268435456,8,268435464,1024,268436480,1032,268436488,1024,268436480,1032,268436488],d=[0,32,0,32,1048576,1048608,1048576,1048608,8192,8224,8192,8224,1056768,1056800,1056768,1056800],f=[0,16777216,512,16777728,2097152,18874368,2097664,18874880,67108864,83886080,67109376,83886592,69206016,85983232,69206528,85983744],y=[0,4096,134217728,134221824,524288,528384,134742016,134746112,16,4112,134217744,134221840,524304,528400,134742032,134746128],p=[0,4,256,260,0,4,256,260,1,5,257,261,1,5,257,261],v=e.length()>8?3:1,x=[],b=[0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0],A=0,E;for(var k=0;k<v;k++){var I=e.getInt32(),R=e.getInt32();E=(I>>>4^R)&252645135,R^=E,I^=E<<4,E=(R>>>-16^I)&65535,I^=E,R^=E<<-16,E=(I>>>2^R)&858993459,R^=E,I^=E<<2,E=(R>>>-16^I)&65535,I^=E,R^=E<<-16,E=(I>>>1^R)&1431655765,R^=E,I^=E<<1,E=(R>>>8^I)&16711935,I^=E,R^=E<<8,E=(I>>>1^R)&1431655765,R^=E,I^=E<<1,E=I<<8|R>>>20&240,I=R<<24|R<<8&16711680|R>>>8&65280|R>>>24&240,R=E;for(var M=0;M<b.length;++M){if(b[M])I=I<<2|I>>>26,R=R<<2|R>>>26;else I=I<<1|I>>>27,R=R<<1|R>>>27;I&=-15,R&=-15;var ee=t[I>>>28]|n[I>>>24&15]|r[I>>>20&15]|i[I>>>16&15]|s[I>>>12&15]|a[I>>>8&15]|o[I>>>4&15],O=l[R>>>28]|c[R>>>24&15]|u[R>>>20&15]|d[R>>>16&15]|f[R>>>12&15]|y[R>>>8&15]|p[R>>>4&15];E=(O>>>16^ee)&65535,x[A++]=ee^E,x[A++]=O^E<<16}}return x}function su(e,t,n,r){var i=e.length===32?3:9,s;if(i===3)s=r?[30,-2,-2]:[0,32,2];else s=r?[94,62,-2,32,64,2,30,-2,-2]:[0,32,2,62,30,-2,64,96,2];var a,o=t[0],l=t[1];a=(o>>>4^l)&252645135,l^=a,o^=a<<4,a=(o>>>16^l)&65535,l^=a,o^=a<<16,a=(l>>>2^o)&858993459,o^=a,l^=a<<2,a=(l>>>8^o)&16711935,o^=a,l^=a<<8,a=(o>>>1^l)&1431655765,l^=a,o^=a<<1,o=o<<1|o>>>31,l=l<<1|l>>>31;for(var c=0;c<i;c+=3){var u=s[c+1],d=s[c+2];for(var f=s[c];f!=u;f+=d){var y=l^e[f],p=(l>>>4|l<<28)^e[f+1];a=o,o=l,l=a^(x0[y>>>24&63]|b0[y>>>16&63]|E0[y>>>8&63]|T0[y&63]|v0[p>>>24&63]|S0[p>>>16&63]|C0[p>>>8&63]|w0[p&63])}a=o,o=l,l=a}o=o>>>1|o<<31,l=l>>>1|l<<31,a=(o>>>1^l)&1431655765,l^=a,o^=a<<1,a=(l>>>8^o)&16711935,o^=a,l^=a<<8,a=(l>>>2^o)&858993459,o^=a,l^=a<<2,a=(o>>>16^l)&65535,l^=a,o^=a<<16,a=(o>>>4^l)&252645135,l^=a,o^=a<<4,n[0]=o,n[1]=l}function Rs(e){e=e||{};var t=(e.mode||"CBC").toUpperCase(),n="DES-"+t,r;if(e.decrypt)r=ze.cipher.createDecipher(n,e.key);else r=ze.cipher.createCipher(n,e.key);var i=r.start;return r.start=function(s,a){var o=null;if(a instanceof ze.util.ByteBuffer)o=a,a={};a=a||{},a.output=o,a.iv=s,i.call(r,a)},r}});var Bs=fe(function(zC,ou){var bt=me();Tn();er();Be();var _0=bt.pkcs5=bt.pkcs5||{},vr;if(bt.util.isNodejs&&!bt.options.usePureJavaScript)vr=oi("crypto");ou.exports=bt.pbkdf2=_0.pbkdf2=function(e,t,n,r,i,s){if(typeof i==="function")s=i,i=null;if(bt.util.isNodejs&&!bt.options.usePureJavaScript&&vr.pbkdf2&&(i===null||typeof i!=="object")&&(vr.pbkdf2Sync.length>4||(!i||i==="sha1"))){if(typeof i!=="string")i="sha1";if(e=Buffer.from(e,"binary"),t=Buffer.from(t,"binary"),!s){if(vr.pbkdf2Sync.length===4)return vr.pbkdf2Sync(e,t,n,r).toString("binary");return vr.pbkdf2Sync(e,t,n,r,i).toString("binary")}if(vr.pbkdf2Sync.length===4)return vr.pbkdf2(e,t,n,r,function(E,k){if(E)return s(E);s(null,k.toString("binary"))});return vr.pbkdf2(e,t,n,r,i,function(E,k){if(E)return s(E);s(null,k.toString("binary"))})}if(typeof i>"u"||i===null)i="sha1";if(typeof i==="string"){if(!(i in bt.md.algorithms))throw Error("Unknown hash algorithm: "+i);i=bt.md[i].create()}var a=i.digestLength;if(r>4294967295*a){var o=Error("Derived key is too long.");if(s)return s(o);throw o}var l=Math.ceil(r/a),c=r-(l-1)*a,u=bt.hmac.create();u.start(i,e);var d="",f,y,p;if(!s){for(var v=1;v<=l;++v){u.start(null,null),u.update(t),u.update(bt.util.int32ToBytes(v)),f=p=u.digest().getBytes();for(var x=2;x<=n;++x)u.start(null,null),u.update(p),y=u.digest().getBytes(),f=bt.util.xorBytes(f,y,a),p=y;d+=v<l?f:f.substr(0,c)}return d}var v=1,x;function b(){if(v>l)return s(null,d);u.start(null,null),u.update(t),u.update(bt.util.int32ToBytes(v)),f=p=u.digest().getBytes(),x=2,A()}function A(){if(x<=n)return u.start(null,null),u.update(p),y=u.digest().getBytes(),f=bt.util.xorBytes(f,y,a),p=y,++x,bt.util.setImmediate(A);d+=v<l?f:f.substr(0,c),++v,b()}b()}});var co=fe(function(QC,fu){var nr=me();er();Be();var cu=fu.exports=nr.sha256=nr.sha256||{};nr.md.sha256=nr.md.algorithms.sha256=cu;cu.create=function(){if(!uu)k0();var e=null,t=nr.util.createBuffer(),n=Array(64),r={algorithm:"sha256",blockLength:64,digestLength:32,messageLength:0,fullMessageLength:null,messageLengthSize:8};return r.start=function(){r.messageLength=0,r.fullMessageLength=r.messageLength64=[];var i=r.messageLengthSize/4;for(var s=0;s<i;++s)r.fullMessageLength.push(0);return t=nr.util.createBuffer(),e={h0:1779033703,h1:3144134277,h2:1013904242,h3:2773480762,h4:1359893119,h5:2600822924,h6:528734635,h7:1541459225},r},r.start(),r.update=function(i,s){if(s==="utf8")i=nr.util.encodeUtf8(i);var a=i.length;r.messageLength+=a,a=[a/4294967296>>>0,a>>>0];for(var o=r.fullMessageLength.length-1;o>=0;--o)r.fullMessageLength[o]+=a[1],a[1]=a[0]+(r.fullMessageLength[o]/4294967296>>>0),r.fullMessageLength[o]=r.fullMessageLength[o]>>>0,a[0]=a[1]/4294967296>>>0;if(t.putBytes(i),lu(e,n,t),t.read>2048||t.length()===0)t.compact();return r},r.digest=function(){var i=nr.util.createBuffer();i.putBytes(t.bytes());var s=r.fullMessageLength[r.fullMessageLength.length-1]+r.messageLengthSize,a=s&r.blockLength-1;i.putBytes(lo.substr(0,r.blockLength-a));var o,l,c=r.fullMessageLength[0]*8;for(var u=0;u<r.fullMessageLength.length-1;++u)o=r.fullMessageLength[u+1]*8,l=o/4294967296>>>0,c+=l,i.putInt32(c>>>0),c=o>>>0;i.putInt32(c);var d={h0:e.h0,h1:e.h1,h2:e.h2,h3:e.h3,h4:e.h4,h5:e.h5,h6:e.h6,h7:e.h7};lu(d,n,i);var f=nr.util.createBuffer();return f.putInt32(d.h0),f.putInt32(d.h1),f.putInt32(d.h2),f.putInt32(d.h3),f.putInt32(d.h4),f.putInt32(d.h5),f.putInt32(d.h6),f.putInt32(d.h7),f},r};var lo=null,uu=!1,du=null;function k0(){lo=String.fromCharCode(128),lo+=nr.util.fillString(String.fromCharCode(0),64),du=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],uu=!0}function lu(e,t,n){var r,i,s,a,o,l,c,u,d,f,y,p,v,x,b,A=n.length();while(A>=64){for(c=0;c<16;++c)t[c]=n.getInt32();for(;c<64;++c)r=t[c-2],r=(r>>>17|r<<15)^(r>>>19|r<<13)^r>>>10,i=t[c-15],i=(i>>>7|i<<25)^(i>>>18|i<<14)^i>>>3,t[c]=r+t[c-7]+i+t[c-16]|0;u=e.h0,d=e.h1,f=e.h2,y=e.h3,p=e.h4,v=e.h5,x=e.h6,b=e.h7;for(c=0;c<64;++c)a=(p>>>6|p<<26)^(p>>>11|p<<21)^(p>>>25|p<<7),o=x^p&(v^x),s=(u>>>2|u<<30)^(u>>>13|u<<19)^(u>>>22|u<<10),l=u&d|f&(u^d),r=b+a+o+du[c]+t[c],i=s+l,b=x,x=v,v=p,p=y+r>>>0,y=f,f=d,d=u,u=r+i>>>0;e.h0=e.h0+u|0,e.h1=e.h1+d|0,e.h2=e.h2+f|0,e.h3=e.h3+y|0,e.h4=e.h4+p|0,e.h5=e.h5+v|0,e.h6=e.h6+x|0,e.h7=e.h7+b|0,A-=64}}});var uo=fe(function(XC,pu){var ir=me();Be();var Ps=null;if(ir.util.isNodejs&&!ir.options.usePureJavaScript&&!process.versions["node-webkit"])Ps=oi("crypto");var I0=pu.exports=ir.prng=ir.prng||{};I0.create=function(e){var t={plugin:e,key:null,seed:null,time:null,reseeds:0,generated:0,keyBytes:""},n=e.md,r=Array(32);for(var i=0;i<32;++i)r[i]=n.create();t.pools=r,t.pool=0,t.generate=function(c,u){if(!u)return t.generateSync(c);var d=t.plugin.cipher,f=t.plugin.increment,y=t.plugin.formatKey,p=t.plugin.formatSeed,v=ir.util.createBuffer();t.key=null,x();function x(b){if(b)return u(b);if(v.length()>=c)return u(null,v.getBytes(c));if(t.generated>1048575)t.key=null;if(t.key===null)return ir.util.nextTick(function(){s(x)});var A=d(t.key,t.seed);t.generated+=A.length,v.putBytes(A),t.key=y(d(t.key,f(t.seed))),t.seed=p(d(t.key,t.seed)),ir.util.setImmediate(x)}},t.generateSync=function(c){var u=t.plugin.cipher,d=t.plugin.increment,f=t.plugin.formatKey,y=t.plugin.formatSeed;t.key=null;var p=ir.util.createBuffer();while(p.length()<c){if(t.generated>1048575)t.key=null;if(t.key===null)a();var v=u(t.key,t.seed);t.generated+=v.length,p.putBytes(v),t.key=f(u(t.key,d(t.seed))),t.seed=y(u(t.key,t.seed))}return p.getBytes(c)};function s(c){if(t.pools[0].messageLength>=32)return o(),c();var u=32-t.pools[0].messageLength<<5;t.seedFile(u,function(d,f){if(d)return c(d);t.collect(f),o(),c()})}function a(){if(t.pools[0].messageLength>=32)return o();var c=32-t.pools[0].messageLength<<5;t.collect(t.seedFileSync(c)),o()}function o(){t.reseeds=t.reseeds===4294967295?0:t.reseeds+1;var c=t.plugin.md.create();c.update(t.keyBytes);var u=1;for(var d=0;d<32;++d){if(t.reseeds%u===0)c.update(t.pools[d].digest().getBytes()),t.pools[d].start();u=u<<1}t.keyBytes=c.digest().getBytes(),c.start(),c.update(t.keyBytes);var f=c.digest().getBytes();t.key=t.plugin.formatKey(t.keyBytes),t.seed=t.plugin.formatSeed(f),t.generated=0}function l(c){var u=null,d=ir.util.globalScope,f=d.crypto||d.msCrypto;if(f&&f.getRandomValues)u=function(I){return f.getRandomValues(I)};var y=ir.util.createBuffer();if(u)while(y.length()<c){var p=Math.max(1,Math.min(c-y.length(),65536)/4),v=new Uint32Array(Math.floor(p));try{u(v);for(var x=0;x<v.length;++x)y.putInt32(v[x])}catch(I){if(!(typeof QuotaExceededError<"u"&&I instanceof QuotaExceededError))throw I}}if(y.length()<c){var b,A,E,k=Math.floor(Math.random()*65536);while(y.length()<c){A=16807*(k&65535),b=16807*(k>>16),A+=(b&32767)<<16,A+=b>>15,A=(A&2147483647)+(A>>31),k=A&4294967295;for(var x=0;x<3;++x)E=k>>>(x<<3),E^=Math.floor(Math.random()*256),y.putByte(E&255)}}return y.getBytes(c)}if(Ps)t.seedFile=function(c,u){Ps.randomBytes(c,function(d,f){if(d)return u(d);u(null,f.toString())})},t.seedFileSync=function(c){return Ps.randomBytes(c).toString()};else t.seedFile=function(c,u){try{u(null,l(c))}catch(d){u(d)}},t.seedFileSync=l;return t.collect=function(c){var u=c.length;for(var d=0;d<u;++d)t.pools[t.pool].update(c.substr(d,1)),t.pool=t.pool===31?0:t.pool+1},t.collectInt=function(c,u){var d="";for(var f=0;f<u;f+=8)d+=String.fromCharCode(c>>f&255);t.collect(d)},t.registerWorker=function(c){if(c===self)t.seedFile=function(d,f){function y(p){var v=p.data;if(v.forge&&v.forge.prng)self.removeEventListener("message",y),f(v.forge.prng.err,v.forge.prng.bytes)}self.addEventListener("message",y),self.postMessage({forge:{prng:{needed:d}}})};else{var u=function(d){var f=d.data;if(f.forge&&f.forge.prng)t.seedFile(f.forge.prng.needed,function(y,p){c.postMessage({forge:{prng:{err:y,bytes:p}}})})};c.addEventListener("message",u)}},t}});var Dt=fe(function(YC,fo){var ft=me();Nr();co();uo();Be();(function(){if(ft.random&&ft.random.getBytes){fo.exports=ft.random;return}(function(e){var t={},n=[,,,,],r=ft.util.createBuffer();t.formatKey=function(d){var f=ft.util.createBuffer(d);return d=[,,,,],d[0]=f.getInt32(),d[1]=f.getInt32(),d[2]=f.getInt32(),d[3]=f.getInt32(),ft.aes._expandKey(d,!1)},t.formatSeed=function(d){var f=ft.util.createBuffer(d);return d=[,,,,],d[0]=f.getInt32(),d[1]=f.getInt32(),d[2]=f.getInt32(),d[3]=f.getInt32(),d},t.cipher=function(d,f){return ft.aes._updateBlock(d,f,n,!1),r.putInt32(n[0]),r.putInt32(n[1]),r.putInt32(n[2]),r.putInt32(n[3]),r.getBytes()},t.increment=function(d){return++d[3],d},t.md=ft.md.sha256;function i(){var d=ft.prng.create(t);return d.getBytes=function(f,y){return d.generate(f,y)},d.getBytesSync=function(f){return d.generate(f)},d}var s=i(),a=null,o=ft.util.globalScope,l=o.crypto||o.msCrypto;if(l&&l.getRandomValues)a=function(d){return l.getRandomValues(d)};if(ft.options.usePureJavaScript||!ft.util.isNodejs&&!a){if(typeof window>"u"||window.document===void 0);if(s.collectInt(+new Date,32),typeof navigator<"u"){var c="";for(var u in navigator)try{if(typeof navigator[u]=="string")c+=navigator[u]}catch(d){}s.collect(c),c=null}if(e)e().mousemove(function(d){s.collectInt(d.clientX,16),s.collectInt(d.clientY,16)}),e().keypress(function(d){s.collectInt(d.charCode,8)})}if(!ft.random)ft.random=s;else for(var u in s)ft.random[u]=s[u];ft.random.createInstance=i,fo.exports=ft.random})(typeof jQuery<"u"?jQuery:null)})()});var ho=fe(function(JC,mu){var Tt=me();Be();var po=[217,120,249,196,25,221,181,237,40,233,253,121,74,160,216,157,198,126,55,131,43,118,83,142,98,76,100,136,68,139,251,162,23,154,89,245,135,179,79,19,97,69,109,141,9,129,125,50,189,143,64,235,134,183,123,11,240,149,33,34,92,107,78,130,84,214,101,147,206,96,178,28,115,86,192,20,167,140,241,220,18,117,202,31,59,190,228,209,66,61,212,48,163,60,182,38,111,191,14,218,70,105,7,87,39,242,29,155,188,148,67,3,248,17,199,246,144,239,62,231,6,195,213,47,200,102,30,215,8,232,234,222,128,82,238,247,132,170,114,172,53,77,106,42,150,26,210,113,90,21,73,116,75,159,208,94,4,24,164,236,194,224,65,110,15,81,203,204,36,145,175,80,161,244,112,57,153,124,58,133,35,184,180,122,252,2,54,91,37,85,151,49,45,93,250,152,227,138,146,174,5,223,41,16,103,108,186,201,211,0,230,207,225,158,168,44,99,22,1,63,88,226,137,169,13,56,52,27,171,51,255,176,187,72,12,95,185,177,205,46,197,243,219,71,229,165,156,119,10,166,32,104,254,127,193,173],hu=[1,2,3,5],R0=function(e,t){return e<<t&65535|(e&65535)>>16-t},B0=function(e,t){return(e&65535)>>t|e<<16-t&65535};mu.exports=Tt.rc2=Tt.rc2||{};Tt.rc2.expandKey=function(e,t){if(typeof e==="string")e=Tt.util.createBuffer(e);t=t||128;var n=e,r=e.length(),i=t,s=Math.ceil(i/8),a=255>>(i&7),o;for(o=r;o<128;o++)n.putByte(po[n.at(o-1)+n.at(o-r)&255]);n.setAt(128-s,po[n.at(128-s)&a]);for(o=127-s;o>=0;o--)n.setAt(o,po[n.at(o+1)^n.at(o+s)]);return n};var gu=function(e,t,n){var r=!1,i=null,s=null,a=null,o,l,c,u,d=[];e=Tt.rc2.expandKey(e,t);for(c=0;c<64;c++)d.push(e.getInt16Le());if(n)o=function(p){for(c=0;c<4;c++)p[c]+=d[u]+(p[(c+3)%4]&p[(c+2)%4])+(~p[(c+3)%4]&p[(c+1)%4]),p[c]=R0(p[c],hu[c]),u++},l=function(p){for(c=0;c<4;c++)p[c]+=d[p[(c+3)%4]&63]};else o=function(p){for(c=3;c>=0;c--)p[c]=B0(p[c],hu[c]),p[c]-=d[u]+(p[(c+3)%4]&p[(c+2)%4])+(~p[(c+3)%4]&p[(c+1)%4]),u--},l=function(p){for(c=3;c>=0;c--)p[c]-=d[p[(c+3)%4]&63]};var f=function(p){var v=[];for(c=0;c<4;c++){var x=i.getInt16Le();if(a!==null)if(n)x^=a.getInt16Le();else a.putInt16Le(x);v.push(x&65535)}u=n?0:63;for(var b=0;b<p.length;b++)for(var A=0;A<p[b][0];A++)p[b][1](v);for(c=0;c<4;c++){if(a!==null)if(n)a.putInt16Le(v[c]);else v[c]^=a.getInt16Le();s.putInt16Le(v[c])}},y=null;return y={start:function(p,v){if(p){if(typeof p==="string")p=Tt.util.createBuffer(p)}r=!1,i=Tt.util.createBuffer(),s=v||new Tt.util.createBuffer,a=p,y.output=s},update:function(p){if(!r)i.putBuffer(p);while(i.length()>=8)f([[5,o],[1,l],[6,o],[1,l],[5,o]])},finish:function(p){var v=!0;if(n)if(p)v=p(8,i,!n);else{var x=i.length()===8?8:8-i.length();i.fillWithByte(x,x)}if(v)r=!0,y.update();if(!n){if(v=i.length()===0,v)if(p)v=p(8,s,!n);else{var b=s.length(),A=s.at(b-1);if(A>b)v=!1;else s.truncate(A)}}return v}},y};Tt.rc2.startEncrypting=function(e,t,n){var r=Tt.rc2.createEncryptionCipher(e,128);return r.start(t,n),r};Tt.rc2.createEncryptionCipher=function(e,t){return gu(e,t,!0)};Tt.rc2.startDecrypting=function(e,t,n){var r=Tt.rc2.createDecryptionCipher(e,128);return r.start(t,n),r};Tt.rc2.createDecryptionCipher=function(e,t){return gu(e,t,!1)}});var xi=fe(function(ZC,wu){var go=me();wu.exports=go.jsbn=go.jsbn||{};var xr,P0=244837814094590,yu=(P0&16777215)==15715070;function D(e,t,n){if(this.data=[],e!=null)if(typeof e=="number")this.fromNumber(e,t,n);else if(t==null&&typeof e!="string")this.fromString(e,256);else this.fromString(e,t)}go.jsbn.BigInteger=D;function Ie(){return new D(null)}function N0(e,t,n,r,i,s){while(--s>=0){var a=t*this.data[e++]+n.data[r]+i;i=Math.floor(a/67108864),n.data[r++]=a&67108863}return i}function D0(e,t,n,r,i,s){var a=t&32767,o=t>>15;while(--s>=0){var l=this.data[e]&32767,c=this.data[e++]>>15,u=o*l+c*a;l=a*l+((u&32767)<<15)+n.data[r]+(i&1073741823),i=(l>>>30)+(u>>>15)+o*c+(i>>>30),n.data[r++]=l&1073741823}return i}function vu(e,t,n,r,i,s){var a=t&16383,o=t>>14;while(--s>=0){var l=this.data[e]&16383,c=this.data[e++]>>14,u=o*l+c*a;l=a*l+((u&16383)<<14)+n.data[r]+i,i=(l>>28)+(u>>14)+o*c,n.data[r++]=l&268435455}return i}if(typeof navigator>"u")D.prototype.am=vu,xr=28;else if(yu&&navigator.appName=="Microsoft Internet Explorer")D.prototype.am=D0,xr=30;else if(yu&&navigator.appName!="Netscape")D.prototype.am=N0,xr=26;else D.prototype.am=vu,xr=28;D.prototype.DB=xr;D.prototype.DM=(1<<xr)-1;D.prototype.DV=1<<xr;var mo=52;D.prototype.FV=Math.pow(2,mo);D.prototype.F1=mo-xr;D.prototype.F2=2*xr-mo;var L0="0123456789abcdefghijklmnopqrstuvwxyz",Ns=[],_n,Lt;_n=48;for(Lt=0;Lt<=9;++Lt)Ns[_n++]=Lt;_n=97;for(Lt=10;Lt<36;++Lt)Ns[_n++]=Lt;_n=65;for(Lt=10;Lt<36;++Lt)Ns[_n++]=Lt;function xu(e){return L0.charAt(e)}function Su(e,t){var n=Ns[e.charCodeAt(t)];return n==null?-1:n}function O0(e){for(var t=this.t-1;t>=0;--t)e.data[t]=this.data[t];e.t=this.t,e.s=this.s}function U0(e){if(this.t=1,this.s=e<0?-1:0,e>0)this.data[0]=e;else if(e<-1)this.data[0]=e+this.DV;else this.t=0}function Lr(e){var t=Ie();return t.fromInt(e),t}function V0(e,t){var n;if(t==16)n=4;else if(t==8)n=3;else if(t==256)n=8;else if(t==2)n=1;else if(t==32)n=5;else if(t==4)n=2;else{this.fromRadix(e,t);return}this.t=0,this.s=0;var r=e.length,i=!1,s=0;while(--r>=0){var a=n==8?e[r]&255:Su(e,r);if(a<0){if(e.charAt(r)=="-")i=!0;continue}if(i=!1,s==0)this.data[this.t++]=a;else if(s+n>this.DB)this.data[this.t-1]|=(a&(1<<this.DB-s)-1)<<s,this.data[this.t++]=a>>this.DB-s;else this.data[this.t-1]|=a<<s;if(s+=n,s>=this.DB)s-=this.DB}if(n==8&&(e[0]&128)!=0){if(this.s=-1,s>0)this.data[this.t-1]|=(1<<this.DB-s)-1<<s}if(this.clamp(),i)D.ZERO.subTo(this,this)}function F0(){var e=this.s&this.DM;while(this.t>0&&this.data[this.t-1]==e)--this.t}function M0(e){if(this.s<0)return"-"+this.negate().toString(e);var t;if(e==16)t=4;else if(e==8)t=3;else if(e==2)t=1;else if(e==32)t=5;else if(e==4)t=2;else return this.toRadix(e);var n=(1<<t)-1,r,i=!1,s="",a=this.t,o=this.DB-a*this.DB%t;if(a-- >0){if(o<this.DB&&(r=this.data[a]>>o)>0)i=!0,s=xu(r);while(a>=0){if(o<t)r=(this.data[a]&(1<<o)-1)<<t-o,r|=this.data[--a]>>(o+=this.DB-t);else if(r=this.data[a]>>(o-=t)&n,o<=0)o+=this.DB,--a;if(r>0)i=!0;if(i)s+=xu(r)}}return i?s:"0"}function W0(){var e=Ie();return D.ZERO.subTo(this,e),e}function $0(){return this.s<0?this.negate():this}function H0(e){var t=this.s-e.s;if(t!=0)return t;var n=this.t;if(t=n-e.t,t!=0)return this.s<0?-t:t;while(--n>=0)if((t=this.data[n]-e.data[n])!=0)return t;return 0}function Ds(e){var t=1,n;if((n=e>>>16)!=0)e=n,t+=16;if((n=e>>8)!=0)e=n,t+=8;if((n=e>>4)!=0)e=n,t+=4;if((n=e>>2)!=0)e=n,t+=2;if((n=e>>1)!=0)e=n,t+=1;return t}function K0(){if(this.t<=0)return 0;return this.DB*(this.t-1)+Ds(this.data[this.t-1]^this.s&this.DM)}function q0(e,t){var n;for(n=this.t-1;n>=0;--n)t.data[n+e]=this.data[n];for(n=e-1;n>=0;--n)t.data[n]=0;t.t=this.t+e,t.s=this.s}function G0(e,t){for(var n=e;n<this.t;++n)t.data[n-e]=this.data[n];t.t=Math.max(this.t-e,0),t.s=this.s}function j0(e,t){var n=e%this.DB,r=this.DB-n,i=(1<<r)-1,s=Math.floor(e/this.DB),a=this.s<<n&this.DM,o;for(o=this.t-1;o>=0;--o)t.data[o+s+1]=this.data[o]>>r|a,a=(this.data[o]&i)<<n;for(o=s-1;o>=0;--o)t.data[o]=0;t.data[s]=a,t.t=this.t+s+1,t.s=this.s,t.clamp()}function z0(e,t){t.s=this.s;var n=Math.floor(e/this.DB);if(n>=this.t){t.t=0;return}var r=e%this.DB,i=this.DB-r,s=(1<<r)-1;t.data[0]=this.data[n]>>r;for(var a=n+1;a<this.t;++a)t.data[a-n-1]|=(this.data[a]&s)<<i,t.data[a-n]=this.data[a]>>r;if(r>0)t.data[this.t-n-1]|=(this.s&s)<<i;t.t=this.t-n,t.clamp()}function Q0(e,t){var n=0,r=0,i=Math.min(e.t,this.t);while(n<i)r+=this.data[n]-e.data[n],t.data[n++]=r&this.DM,r>>=this.DB;if(e.t<this.t){r-=e.s;while(n<this.t)r+=this.data[n],t.data[n++]=r&this.DM,r>>=this.DB;r+=this.s}else{r+=this.s;while(n<e.t)r-=e.data[n],t.data[n++]=r&this.DM,r>>=this.DB;r-=e.s}if(t.s=r<0?-1:0,r<-1)t.data[n++]=this.DV+r;else if(r>0)t.data[n++]=r;t.t=n,t.clamp()}function X0(e,t){var n=this.abs(),r=e.abs(),i=n.t;t.t=i+r.t;while(--i>=0)t.data[i]=0;for(i=0;i<r.t;++i)t.data[i+n.t]=n.am(0,r.data[i],t,i,0,n.t);if(t.s=0,t.clamp(),this.s!=e.s)D.ZERO.subTo(t,t)}function Y0(e){var t=this.abs(),n=e.t=2*t.t;while(--n>=0)e.data[n]=0;for(n=0;n<t.t-1;++n){var r=t.am(n,t.data[n],e,2*n,0,1);if((e.data[n+t.t]+=t.am(n+1,2*t.data[n],e,2*n+1,r,t.t-n-1))>=t.DV)e.data[n+t.t]-=t.DV,e.data[n+t.t+1]=1}if(e.t>0)e.data[e.t-1]+=t.am(n,t.data[n],e,2*n,0,1);e.s=0,e.clamp()}function J0(e,t,n){var r=e.abs();if(r.t<=0)return;var i=this.abs();if(i.t<r.t){if(t!=null)t.fromInt(0);if(n!=null)this.copyTo(n);return}if(n==null)n=Ie();var s=Ie(),a=this.s,o=e.s,l=this.DB-Ds(r.data[r.t-1]);if(l>0)r.lShiftTo(l,s),i.lShiftTo(l,n);else r.copyTo(s),i.copyTo(n);var c=s.t,u=s.data[c-1];if(u==0)return;var d=u*(1<<this.F1)+(c>1?s.data[c-2]>>this.F2:0),f=this.FV/d,y=(1<<this.F1)/d,p=1<<this.F2,v=n.t,x=v-c,b=t==null?Ie():t;if(s.dlShiftTo(x,b),n.compareTo(b)>=0)n.data[n.t++]=1,n.subTo(b,n);D.ONE.dlShiftTo(c,b),b.subTo(s,s);while(s.t<c)s.data[s.t++]=0;while(--x>=0){var A=n.data[--v]==u?this.DM:Math.floor(n.data[v]*f+(n.data[v-1]+p)*y);if((n.data[v]+=s.am(0,A,n,x,0,c))<A){s.dlShiftTo(x,b),n.subTo(b,n);while(n.data[v]<--A)n.subTo(b,n)}}if(t!=null){if(n.drShiftTo(c,t),a!=o)D.ZERO.subTo(t,t)}if(n.t=c,n.clamp(),l>0)n.rShiftTo(l,n);if(a<0)D.ZERO.subTo(n,n)}function Z0(e){var t=Ie();if(this.abs().divRemTo(e,null,t),this.s<0&&t.compareTo(D.ZERO)>0)e.subTo(t,t);return t}function sn(e){this.m=e}function eg(e){if(e.s<0||e.compareTo(this.m)>=0)return e.mod(this.m);else return e}function tg(e){return e}function rg(e){e.divRemTo(this.m,null,e)}function ng(e,t,n){e.multiplyTo(t,n),this.reduce(n)}function ig(e,t){e.squareTo(t),this.reduce(t)}sn.prototype.convert=eg;sn.prototype.revert=tg;sn.prototype.reduce=rg;sn.prototype.mulTo=ng;sn.prototype.sqrTo=ig;function sg(){if(this.t<1)return 0;var e=this.data[0];if((e&1)==0)return 0;var t=e&3;return t=t*(2-(e&15)*t)&15,t=t*(2-(e&255)*t)&255,t=t*(2-((e&65535)*t&65535))&65535,t=t*(2-e*t%this.DV)%this.DV,t>0?this.DV-t:-t}function an(e){this.m=e,this.mp=e.invDigit(),this.mpl=this.mp&32767,this.mph=this.mp>>15,this.um=(1<<e.DB-15)-1,this.mt2=2*e.t}function ag(e){var t=Ie();if(e.abs().dlShiftTo(this.m.t,t),t.divRemTo(this.m,null,t),e.s<0&&t.compareTo(D.ZERO)>0)this.m.subTo(t,t);return t}function og(e){var t=Ie();return e.copyTo(t),this.reduce(t),t}function lg(e){while(e.t<=this.mt2)e.data[e.t++]=0;for(var t=0;t<this.m.t;++t){var n=e.data[t]&32767,r=n*this.mpl+((n*this.mph+(e.data[t]>>15)*this.mpl&this.um)<<15)&e.DM;n=t+this.m.t,e.data[n]+=this.m.am(0,r,e,t,0,this.m.t);while(e.data[n]>=e.DV)e.data[n]-=e.DV,e.data[++n]++}if(e.clamp(),e.drShiftTo(this.m.t,e),e.compareTo(this.m)>=0)e.subTo(this.m,e)}function cg(e,t){e.squareTo(t),this.reduce(t)}function ug(e,t,n){e.multiplyTo(t,n),this.reduce(n)}an.prototype.convert=ag;an.prototype.revert=og;an.prototype.reduce=lg;an.prototype.mulTo=ug;an.prototype.sqrTo=cg;function dg(){return(this.t>0?this.data[0]&1:this.s)==0}function fg(e,t){if(e>4294967295||e<1)return D.ONE;var n=Ie(),r=Ie(),i=t.convert(this),s=Ds(e)-1;i.copyTo(n);while(--s>=0)if(t.sqrTo(n,r),(e&1<<s)>0)t.mulTo(r,i,n);else{var a=n;n=r,r=a}return t.revert(n)}function pg(e,t){var n;if(e<256||t.isEven())n=new sn(t);else n=new an(t);return this.exp(e,n)}D.prototype.copyTo=O0;D.prototype.fromInt=U0;D.prototype.fromString=V0;D.prototype.clamp=F0;D.prototype.dlShiftTo=q0;D.prototype.drShiftTo=G0;D.prototype.lShiftTo=j0;D.prototype.rShiftTo=z0;D.prototype.subTo=Q0;D.prototype.multiplyTo=X0;D.prototype.squareTo=Y0;D.prototype.divRemTo=J0;D.prototype.invDigit=sg;D.prototype.isEven=dg;D.prototype.exp=fg;D.prototype.toString=M0;D.prototype.negate=W0;D.prototype.abs=$0;D.prototype.compareTo=H0;D.prototype.bitLength=K0;D.prototype.mod=Z0;D.prototype.modPowInt=pg;D.ZERO=Lr(0);D.ONE=Lr(1);function hg(){var e=Ie();return this.copyTo(e),e}function gg(){if(this.s<0){if(this.t==1)return this.data[0]-this.DV;else if(this.t==0)return-1}else if(this.t==1)return this.data[0];else if(this.t==0)return 0;return(this.data[1]&(1<<32-this.DB)-1)<<this.DB|this.data[0]}function mg(){return this.t==0?this.s:this.data[0]<<24>>24}function yg(){return this.t==0?this.s:this.data[0]<<16>>16}function vg(e){return Math.floor(Math.LN2*this.DB/Math.log(e))}function xg(){if(this.s<0)return-1;else if(this.t<=0||this.t==1&&this.data[0]<=0)return 0;else return 1}function Sg(e){if(e==null)e=10;if(this.signum()==0||e<2||e>36)return"0";var t=this.chunkSize(e),n=Math.pow(e,t),r=Lr(n),i=Ie(),s=Ie(),a="";this.divRemTo(r,i,s);while(i.signum()>0)a=(n+s.intValue()).toString(e).substr(1)+a,i.divRemTo(r,i,s);return s.intValue().toString(e)+a}function bg(e,t){if(this.fromInt(0),t==null)t=10;var n=this.chunkSize(t),r=Math.pow(t,n),i=!1,s=0,a=0;for(var o=0;o<e.length;++o){var l=Su(e,o);if(l<0){if(e.charAt(o)=="-"&&this.signum()==0)i=!0;continue}if(a=t*a+l,++s>=n)this.dMultiply(r),this.dAddOffset(a,0),s=0,a=0}if(s>0)this.dMultiply(Math.pow(t,s)),this.dAddOffset(a,0);if(i)D.ZERO.subTo(this,this)}function Cg(e,t,n){if(typeof t=="number")if(e<2)this.fromInt(1);else{if(this.fromNumber(e,n),!this.testBit(e-1))this.bitwiseTo(D.ONE.shiftLeft(e-1),yo,this);if(this.isEven())this.dAddOffset(1,0);while(!this.isProbablePrime(t))if(this.dAddOffset(2,0),this.bitLength()>e)this.subTo(D.ONE.shiftLeft(e-1),this)}else{var r=[],i=e&7;if(r.length=(e>>3)+1,t.nextBytes(r),i>0)r[0]&=(1<<i)-1;else r[0]=0;this.fromString(r,256)}}function Eg(){var e=this.t,t=[];t[0]=this.s;var n=this.DB-e*this.DB%8,r,i=0;if(e-- >0){if(n<this.DB&&(r=this.data[e]>>n)!=(this.s&this.DM)>>n)t[i++]=r|this.s<<this.DB-n;while(e>=0){if(n<8)r=(this.data[e]&(1<<n)-1)<<8-n,r|=this.data[--e]>>(n+=this.DB-8);else if(r=this.data[e]>>(n-=8)&255,n<=0)n+=this.DB,--e;if((r&128)!=0)r|=-256;if(i==0&&(this.s&128)!=(r&128))++i;if(i>0||r!=this.s)t[i++]=r}}return t}function wg(e){return this.compareTo(e)==0}function Tg(e){return this.compareTo(e)<0?this:e}function Ag(e){return this.compareTo(e)>0?this:e}function _g(e,t,n){var r,i,s=Math.min(e.t,this.t);for(r=0;r<s;++r)n.data[r]=t(this.data[r],e.data[r]);if(e.t<this.t){i=e.s&this.DM;for(r=s;r<this.t;++r)n.data[r]=t(this.data[r],i);n.t=this.t}else{i=this.s&this.DM;for(r=s;r<e.t;++r)n.data[r]=t(i,e.data[r]);n.t=e.t}n.s=t(this.s,e.s),n.clamp()}function kg(e,t){return e&t}function Ig(e){var t=Ie();return this.bitwiseTo(e,kg,t),t}function yo(e,t){return e|t}function Rg(e){var t=Ie();return this.bitwiseTo(e,yo,t),t}function bu(e,t){return e^t}function Bg(e){var t=Ie();return this.bitwiseTo(e,bu,t),t}function Cu(e,t){return e&~t}function Pg(e){var t=Ie();return this.bitwiseTo(e,Cu,t),t}function Ng(){var e=Ie();for(var t=0;t<this.t;++t)e.data[t]=this.DM&~this.data[t];return e.t=this.t,e.s=~this.s,e}function Dg(e){var t=Ie();if(e<0)this.rShiftTo(-e,t);else this.lShiftTo(e,t);return t}function Lg(e){var t=Ie();if(e<0)this.lShiftTo(-e,t);else this.rShiftTo(e,t);return t}function Og(e){if(e==0)return-1;var t=0;if((e&65535)==0)e>>=16,t+=16;if((e&255)==0)e>>=8,t+=8;if((e&15)==0)e>>=4,t+=4;if((e&3)==0)e>>=2,t+=2;if((e&1)==0)++t;return t}function Ug(){for(var e=0;e<this.t;++e)if(this.data[e]!=0)return e*this.DB+Og(this.data[e]);if(this.s<0)return this.t*this.DB;return-1}function Vg(e){var t=0;while(e!=0)e&=e-1,++t;return t}function Fg(){var e=0,t=this.s&this.DM;for(var n=0;n<this.t;++n)e+=Vg(this.data[n]^t);return e}function Mg(e){var t=Math.floor(e/this.DB);if(t>=this.t)return this.s!=0;return(this.data[t]&1<<e%this.DB)!=0}function Wg(e,t){var n=D.ONE.shiftLeft(e);return this.bitwiseTo(n,t,n),n}function $g(e){return this.changeBit(e,yo)}function Hg(e){return this.changeBit(e,Cu)}function Kg(e){return this.changeBit(e,bu)}function qg(e,t){var n=0,r=0,i=Math.min(e.t,this.t);while(n<i)r+=this.data[n]+e.data[n],t.data[n++]=r&this.DM,r>>=this.DB;if(e.t<this.t){r+=e.s;while(n<this.t)r+=this.data[n],t.data[n++]=r&this.DM,r>>=this.DB;r+=this.s}else{r+=this.s;while(n<e.t)r+=e.data[n],t.data[n++]=r&this.DM,r>>=this.DB;r+=e.s}if(t.s=r<0?-1:0,r>0)t.data[n++]=r;else if(r<-1)t.data[n++]=this.DV+r;t.t=n,t.clamp()}function Gg(e){var t=Ie();return this.addTo(e,t),t}function jg(e){var t=Ie();return this.subTo(e,t),t}function zg(e){var t=Ie();return this.multiplyTo(e,t),t}function Qg(){var e=Ie();return this.squareTo(e),e}function Xg(e){var t=Ie();return this.divRemTo(e,t,null),t}function Yg(e){var t=Ie();return this.divRemTo(e,null,t),t}function Jg(e){var t=Ie(),n=Ie();return this.divRemTo(e,t,n),[t,n]}function Zg(e){this.data[this.t]=this.am(0,e-1,this,0,0,this.t),++this.t,this.clamp()}function em(e,t){if(e==0)return;while(this.t<=t)this.data[this.t++]=0;this.data[t]+=e;while(this.data[t]>=this.DV){if(this.data[t]-=this.DV,++t>=this.t)this.data[this.t++]=0;++this.data[t]}}function vi(){}function Eu(e){return e}function tm(e,t,n){e.multiplyTo(t,n)}function rm(e,t){e.squareTo(t)}vi.prototype.convert=Eu;vi.prototype.revert=Eu;vi.prototype.mulTo=tm;vi.prototype.sqrTo=rm;function nm(e){return this.exp(e,new vi)}function im(e,t,n){var r=Math.min(this.t+e.t,t);n.s=0,n.t=r;while(r>0)n.data[--r]=0;var i;for(i=n.t-this.t;r<i;++r)n.data[r+this.t]=this.am(0,e.data[r],n,r,0,this.t);for(i=Math.min(e.t,t);r<i;++r)this.am(0,e.data[r],n,r,0,t-r);n.clamp()}function sm(e,t,n){--t;var r=n.t=this.t+e.t-t;n.s=0;while(--r>=0)n.data[r]=0;for(r=Math.max(t-this.t,0);r<e.t;++r)n.data[this.t+r-t]=this.am(t-r,e.data[r],n,0,0,this.t+r-t);n.clamp(),n.drShiftTo(1,n)}function kn(e){this.r2=Ie(),this.q3=Ie(),D.ONE.dlShiftTo(2*e.t,this.r2),this.mu=this.r2.divide(e),this.m=e}function am(e){if(e.s<0||e.t>2*this.m.t)return e.mod(this.m);else if(e.compareTo(this.m)<0)return e;else{var t=Ie();return e.copyTo(t),this.reduce(t),t}}function om(e){return e}function lm(e){if(e.drShiftTo(this.m.t-1,this.r2),e.t>this.m.t+1)e.t=this.m.t+1,e.clamp();this.mu.multiplyUpperTo(this.r2,this.m.t+1,this.q3),this.m.multiplyLowerTo(this.q3,this.m.t+1,this.r2);while(e.compareTo(this.r2)<0)e.dAddOffset(1,this.m.t+1);e.subTo(this.r2,e);while(e.compareTo(this.m)>=0)e.subTo(this.m,e)}function cm(e,t){e.squareTo(t),this.reduce(t)}function um(e,t,n){e.multiplyTo(t,n),this.reduce(n)}kn.prototype.convert=am;kn.prototype.revert=om;kn.prototype.reduce=lm;kn.prototype.mulTo=um;kn.prototype.sqrTo=cm;function dm(e,t){var n=e.bitLength(),r,i=Lr(1),s;if(n<=0)return i;else if(n<18)r=1;else if(n<48)r=3;else if(n<144)r=4;else if(n<768)r=5;else r=6;if(n<8)s=new sn(t);else if(t.isEven())s=new kn(t);else s=new an(t);var a=[],o=3,l=r-1,c=(1<<r)-1;if(a[1]=s.convert(this),r>1){var u=Ie();s.sqrTo(a[1],u);while(o<=c)a[o]=Ie(),s.mulTo(u,a[o-2],a[o]),o+=2}var d=e.t-1,f,y=!0,p=Ie(),v;n=Ds(e.data[d])-1;while(d>=0){if(n>=l)f=e.data[d]>>n-l&c;else if(f=(e.data[d]&(1<<n+1)-1)<<l-n,d>0)f|=e.data[d-1]>>this.DB+n-l;o=r;while((f&1)==0)f>>=1,--o;if((n-=o)<0)n+=this.DB,--d;if(y)a[f].copyTo(i),y=!1;else{while(o>1)s.sqrTo(i,p),s.sqrTo(p,i),o-=2;if(o>0)s.sqrTo(i,p);else v=i,i=p,p=v;s.mulTo(p,a[f],i)}while(d>=0&&(e.data[d]&1<<n)==0)if(s.sqrTo(i,p),v=i,i=p,p=v,--n<0)n=this.DB-1,--d}return s.revert(i)}function fm(e){var t=this.s<0?this.negate():this.clone(),n=e.s<0?e.negate():e.clone();if(t.compareTo(n)<0){var r=t;t=n,n=r}var i=t.getLowestSetBit(),s=n.getLowestSetBit();if(s<0)return t;if(i<s)s=i;if(s>0)t.rShiftTo(s,t),n.rShiftTo(s,n);while(t.signum()>0){if((i=t.getLowestSetBit())>0)t.rShiftTo(i,t);if((i=n.getLowestSetBit())>0)n.rShiftTo(i,n);if(t.compareTo(n)>=0)t.subTo(n,t),t.rShiftTo(1,t);else n.subTo(t,n),n.rShiftTo(1,n)}if(s>0)n.lShiftTo(s,n);return n}function pm(e){if(e<=0)return 0;var t=this.DV%e,n=this.s<0?e-1:0;if(this.t>0)if(t==0)n=this.data[0]%e;else for(var r=this.t-1;r>=0;--r)n=(t*n+this.data[r])%e;return n}function hm(e){if(this.signum()==0)return D.ZERO;var t=e.isEven();if(this.isEven()&&t||e.signum()==0)return D.ZERO;var n=e.clone(),r=this.clone(),i=Lr(1),s=Lr(0),a=Lr(0),o=Lr(1);while(n.signum()!=0){while(n.isEven()){if(n.rShiftTo(1,n),t){if(!i.isEven()||!s.isEven())i.addTo(this,i),s.subTo(e,s);i.rShiftTo(1,i)}else if(!s.isEven())s.subTo(e,s);s.rShiftTo(1,s)}while(r.isEven()){if(r.rShiftTo(1,r),t){if(!a.isEven()||!o.isEven())a.addTo(this,a),o.subTo(e,o);a.rShiftTo(1,a)}else if(!o.isEven())o.subTo(e,o);o.rShiftTo(1,o)}if(n.compareTo(r)>=0){if(n.subTo(r,n),t)i.subTo(a,i);s.subTo(o,s)}else{if(r.subTo(n,r),t)a.subTo(i,a);o.subTo(s,o)}}if(r.compareTo(D.ONE)!=0)return D.ZERO;if(o.compareTo(e)>=0)return o.subtract(e);if(o.signum()<0)o.addTo(e,o);else return o;if(o.signum()<0)return o.add(e);else return o}var qt=[2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997],gm=67108864/qt[qt.length-1];function mm(e){var t,n=this.abs();if(n.t==1&&n.data[0]<=qt[qt.length-1]){for(t=0;t<qt.length;++t)if(n.data[0]==qt[t])return!0;return!1}if(n.isEven())return!1;t=1;while(t<qt.length){var r=qt[t],i=t+1;while(i<qt.length&&r<gm)r*=qt[i++];r=n.modInt(r);while(t<i)if(r%qt[t++]==0)return!1}return n.millerRabin(e)}function ym(e){var t=this.subtract(D.ONE),n=t.getLowestSetBit();if(n<=0)return!1;var r=t.shiftRight(n),i=vm(),s;for(var a=0;a<e;++a){do s=new D(this.bitLength(),i);while(s.compareTo(D.ONE)<=0||s.compareTo(t)>=0);var o=s.modPow(r,this);if(o.compareTo(D.ONE)!=0&&o.compareTo(t)!=0){var l=1;while(l++<n&&o.compareTo(t)!=0)if(o=o.modPowInt(2,this),o.compareTo(D.ONE)==0)return!1;if(o.compareTo(t)!=0)return!1}}return!0}function vm(){return{nextBytes:function(e){for(var t=0;t<e.length;++t)e[t]=Math.floor(Math.random()*256)}}}D.prototype.chunkSize=vg;D.prototype.toRadix=Sg;D.prototype.fromRadix=bg;D.prototype.fromNumber=Cg;D.prototype.bitwiseTo=_g;D.prototype.changeBit=Wg;D.prototype.addTo=qg;D.prototype.dMultiply=Zg;D.prototype.dAddOffset=em;D.prototype.multiplyLowerTo=im;D.prototype.multiplyUpperTo=sm;D.prototype.modInt=pm;D.prototype.millerRabin=ym;D.prototype.clone=hg;D.prototype.intValue=gg;D.prototype.byteValue=mg;D.prototype.shortValue=yg;D.prototype.signum=xg;D.prototype.toByteArray=Eg;D.prototype.equals=wg;D.prototype.min=Tg;D.prototype.max=Ag;D.prototype.and=Ig;D.prototype.or=Rg;D.prototype.xor=Bg;D.prototype.andNot=Pg;D.prototype.not=Ng;D.prototype.shiftLeft=Dg;D.prototype.shiftRight=Lg;D.prototype.getLowestSetBit=Ug;D.prototype.bitCount=Fg;D.prototype.testBit=Mg;D.prototype.setBit=$g;D.prototype.clearBit=Hg;D.prototype.flipBit=Kg;D.prototype.add=Gg;D.prototype.subtract=jg;D.prototype.multiply=zg;D.prototype.divide=Xg;D.prototype.remainder=Yg;D.prototype.divideAndRemainder=Jg;D.prototype.modPow=dm;D.prototype.modInverse=hm;D.prototype.pow=nm;D.prototype.gcd=fm;D.prototype.isProbablePrime=mm;D.prototype.square=Qg});var In=fe(function(e1,ku){var sr=me();er();Be();var Au=ku.exports=sr.sha1=sr.sha1||{};sr.md.sha1=sr.md.algorithms.sha1=Au;Au.create=function(){if(!_u)xm();var e=null,t=sr.util.createBuffer(),n=Array(80),r={algorithm:"sha1",blockLength:64,digestLength:20,messageLength:0,fullMessageLength:null,messageLengthSize:8};return r.start=function(){r.messageLength=0,r.fullMessageLength=r.messageLength64=[];var i=r.messageLengthSize/4;for(var s=0;s<i;++s)r.fullMessageLength.push(0);return t=sr.util.createBuffer(),e={h0:1732584193,h1:4023233417,h2:2562383102,h3:271733878,h4:3285377520},r},r.start(),r.update=function(i,s){if(s==="utf8")i=sr.util.encodeUtf8(i);var a=i.length;r.messageLength+=a,a=[a/4294967296>>>0,a>>>0];for(var o=r.fullMessageLength.length-1;o>=0;--o)r.fullMessageLength[o]+=a[1],a[1]=a[0]+(r.fullMessageLength[o]/4294967296>>>0),r.fullMessageLength[o]=r.fullMessageLength[o]>>>0,a[0]=a[1]/4294967296>>>0;if(t.putBytes(i),Tu(e,n,t),t.read>2048||t.length()===0)t.compact();return r},r.digest=function(){var i=sr.util.createBuffer();i.putBytes(t.bytes());var s=r.fullMessageLength[r.fullMessageLength.length-1]+r.messageLengthSize,a=s&r.blockLength-1;i.putBytes(vo.substr(0,r.blockLength-a));var o,l,c=r.fullMessageLength[0]*8;for(var u=0;u<r.fullMessageLength.length-1;++u)o=r.fullMessageLength[u+1]*8,l=o/4294967296>>>0,c+=l,i.putInt32(c>>>0),c=o>>>0;i.putInt32(c);var d={h0:e.h0,h1:e.h1,h2:e.h2,h3:e.h3,h4:e.h4};Tu(d,n,i);var f=sr.util.createBuffer();return f.putInt32(d.h0),f.putInt32(d.h1),f.putInt32(d.h2),f.putInt32(d.h3),f.putInt32(d.h4),f},r};var vo=null,_u=!1;function xm(){vo=String.fromCharCode(128),vo+=sr.util.fillString(String.fromCharCode(0),64),_u=!0}function Tu(e,t,n){var r,i,s,a,o,l,c,u,d=n.length();while(d>=64){i=e.h0,s=e.h1,a=e.h2,o=e.h3,l=e.h4;for(u=0;u<16;++u)r=n.getInt32(),t[u]=r,c=o^s&(a^o),r=(i<<5|i>>>27)+c+l+1518500249+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<20;++u)r=t[u-3]^t[u-8]^t[u-14]^t[u-16],r=r<<1|r>>>31,t[u]=r,c=o^s&(a^o),r=(i<<5|i>>>27)+c+l+1518500249+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<32;++u)r=t[u-3]^t[u-8]^t[u-14]^t[u-16],r=r<<1|r>>>31,t[u]=r,c=s^a^o,r=(i<<5|i>>>27)+c+l+1859775393+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<40;++u)r=t[u-6]^t[u-16]^t[u-28]^t[u-32],r=r<<2|r>>>30,t[u]=r,c=s^a^o,r=(i<<5|i>>>27)+c+l+1859775393+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<60;++u)r=t[u-6]^t[u-16]^t[u-28]^t[u-32],r=r<<2|r>>>30,t[u]=r,c=s&a|o&(s^a),r=(i<<5|i>>>27)+c+l+2400959708+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;for(;u<80;++u)r=t[u-6]^t[u-16]^t[u-28]^t[u-32],r=r<<2|r>>>30,t[u]=r,c=s^a^o,r=(i<<5|i>>>27)+c+l+3395469782+r,l=o,o=a,a=(s<<30|s>>>2)>>>0,s=i,i=r;e.h0=e.h0+i|0,e.h1=e.h1+s|0,e.h2=e.h2+a|0,e.h3=e.h3+o|0,e.h4=e.h4+l|0,d-=64}}});var xo=fe(function(t1,Ru){var ar=me();Be();Dt();In();var Iu=Ru.exports=ar.pkcs1=ar.pkcs1||{};Iu.encode_rsa_oaep=function(e,t,n){var r,i,s,a;if(typeof n==="string")r=n,i=arguments[3]||void 0,s=arguments[4]||void 0;else if(n){if(r=n.label||void 0,i=n.seed||void 0,s=n.md||void 0,n.mgf1&&n.mgf1.md)a=n.mgf1.md}if(!s)s=ar.md.sha1.create();else s.start();if(!a)a=s;var o=Math.ceil(e.n.bitLength()/8),l=o-2*s.digestLength-2;if(t.length>l){var c=Error("RSAES-OAEP input message length is too long.");throw c.length=t.length,c.maxLength=l,c}if(!r)r="";s.update(r,"raw");var u=s.digest(),d="",f=l-t.length;for(var y=0;y<f;y++)d+="\x00";var p=u.getBytes()+d+"\x01"+t;if(!i)i=ar.random.getBytes(s.digestLength);else if(i.length!==s.digestLength){var c=Error("Invalid RSAES-OAEP seed. The seed length must match the digest length.");throw c.seedLength=i.length,c.digestLength=s.digestLength,c}var v=Ls(i,o-s.digestLength-1,a),x=ar.util.xorBytes(p,v,p.length),b=Ls(x,s.digestLength,a),A=ar.util.xorBytes(i,b,i.length);return"\x00"+A+x};Iu.decode_rsa_oaep=function(e,t,n){var r,i,s;if(typeof n==="string")r=n,i=arguments[3]||void 0;else if(n){if(r=n.label||void 0,i=n.md||void 0,n.mgf1&&n.mgf1.md)s=n.mgf1.md}var a=Math.ceil(e.n.bitLength()/8);if(t.length!==a){var x=Error("RSAES-OAEP encoded message length is invalid.");throw x.length=t.length,x.expectedLength=a,x}if(i===void 0)i=ar.md.sha1.create();else i.start();if(!s)s=i;if(a<2*i.digestLength+2)throw Error("RSAES-OAEP key is too short for the hash function.");if(!r)r="";i.update(r,"raw");var o=i.digest().getBytes(),l=t.charAt(0),c=t.substring(1,i.digestLength+1),u=t.substring(1+i.digestLength),d=Ls(u,i.digestLength,s),f=ar.util.xorBytes(c,d,c.length),y=Ls(f,a-i.digestLength-1,s),p=ar.util.xorBytes(u,y,u.length),v=p.substring(0,i.digestLength),x=l!=="\x00";for(var b=0;b<i.digestLength;++b)x|=o.charAt(b)!==v.charAt(b);var A=1,E=i.digestLength;for(var k=i.digestLength;k<p.length;k++){var I=p.charCodeAt(k),R=I&1^1,M=A?65534:0;x|=I&M,A=A&R,E+=A}if(x||p.charCodeAt(E)!==1)throw Error("Invalid RSAES-OAEP padding.");return p.substring(E+1)};function Ls(e,t,n){if(!n)n=ar.md.sha1.create();var r="",i=Math.ceil(t/n.digestLength);for(var s=0;s<i;++s){var a=String.fromCharCode(s>>24&255,s>>16&255,s>>8&255,s&255);n.start(),n.update(e+a),r+=n.digest().getBytes()}return r.substring(0,t)}});var bo=fe(function(r1,So){var Or=me();Be();xi();Dt();(function(){if(Or.prime){So.exports=Or.prime;return}var e=So.exports=Or.prime=Or.prime||{},t=Or.jsbn.BigInteger,n=[6,4,2,4,2,4,6,2],r=new t(null);r.fromInt(30);var i=function(d,f){return d|f};e.generateProbablePrime=function(d,f,y){if(typeof f==="function")y=f,f={};f=f||{};var p=f.algorithm||"PRIMEINC";if(typeof p==="string")p={name:p};p.options=p.options||{};var v=f.prng||Or.random,x={nextBytes:function(b){var A=v.getBytesSync(b.length);for(var E=0;E<b.length;++E)b[E]=A.charCodeAt(E)}};if(p.name==="PRIMEINC")return s(d,x,p.options,y);throw Error("Invalid prime generation algorithm: "+p.name)};function s(d,f,y,p){if("workers"in y)return l(d,f,y,p);return a(d,f,y,p)}function a(d,f,y,p){var v=c(d,f),x=0,b=u(v.bitLength());if("millerRabinTests"in y)b=y.millerRabinTests;var A=10;if("maxBlockTime"in y)A=y.maxBlockTime;o(v,d,f,x,b,A,p)}function o(d,f,y,p,v,x,b){var A=+new Date;do{if(d.bitLength()>f)d=c(f,y);if(d.isProbablePrime(v))return b(null,d);d.dAddOffset(n[p++%8],0)}while(x<0||+new Date-A<x);Or.util.setImmediate(function(){o(d,f,y,p,v,x,b)})}function l(d,f,y,p){if(typeof Worker>"u")return a(d,f,y,p);var v=c(d,f),x=y.workers,b=y.workLoad||100,A=b*30/8,E=y.workerScript||"forge/prime.worker.js";if(x===-1)return Or.util.estimateCores(function(I,R){if(I)R=2;x=R-1,k()});k();function k(){x=Math.max(1,x);var I=[];for(var R=0;R<x;++R)I[R]=new Worker(E);var M=x;for(var R=0;R<x;++R)I[R].addEventListener("message",O);var ee=!1;function O(K){if(ee)return;--M;var ie=K.data;if(ie.found){for(var ve=0;ve<I.length;++ve)I[ve].terminate();return ee=!0,p(null,new t(ie.prime,16))}if(v.bitLength()>d)v=c(d,f);var we=v.toString(16);K.target.postMessage({hex:we,workLoad:b}),v.dAddOffset(A,0)}}}function c(d,f){var y=new t(d,f),p=d-1;if(!y.testBit(p))y.bitwiseTo(t.ONE.shiftLeft(p),i,y);return y.dAddOffset(31-y.mod(r).byteValue(),0),y}function u(d){if(d<=100)return 27;if(d<=150)return 18;if(d<=200)return 15;if(d<=250)return 12;if(d<=300)return 9;if(d<=350)return 8;if(d<=400)return 7;if(d<=500)return 6;if(d<=600)return 5;if(d<=800)return 4;if(d<=1250)return 3;return 2}})()});var Si=fe(function(n1,Uu){var re=me();Kt();xi();Dr();xo();bo();Dt();Be();if(typeof ke>"u")ke=re.jsbn.BigInteger;var ke,Co=re.util.isNodejs?oi("crypto"):null,{asn1:_,util:Ot}=re;re.pki=re.pki||{};Uu.exports=re.pki.rsa=re.rsa=re.rsa||{};var pe=re.pki,Sm=[6,4,2,4,2,4,6,2],bm={name:"PrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]},Cm={name:"RSAPrivateKey",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPrivateKey.version",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"RSAPrivateKey.modulus",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyModulus"},{name:"RSAPrivateKey.publicExponent",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyPublicExponent"},{name:"RSAPrivateKey.privateExponent",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyPrivateExponent"},{name:"RSAPrivateKey.prime1",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyPrime1"},{name:"RSAPrivateKey.prime2",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyPrime2"},{name:"RSAPrivateKey.exponent1",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyExponent1"},{name:"RSAPrivateKey.exponent2",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyExponent2"},{name:"RSAPrivateKey.coefficient",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"privateKeyCoefficient"}]},Em={name:"RSAPublicKey",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"RSAPublicKey.modulus",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"publicKeyModulus"},{name:"RSAPublicKey.exponent",tagClass:_.Class.UNIVERSAL,type:_.Type.INTEGER,constructed:!1,capture:"publicKeyExponent"}]},wm=re.pki.rsa.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{name:"SubjectPublicKeyInfo.subjectPublicKey",tagClass:_.Class.UNIVERSAL,type:_.Type.BITSTRING,constructed:!1,value:[{name:"SubjectPublicKeyInfo.subjectPublicKey.RSAPublicKey",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"rsaPublicKey"}]}]},Tm={name:"DigestInfo",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm",tagClass:_.Class.UNIVERSAL,type:_.Type.SEQUENCE,constructed:!0,value:[{name:"DigestInfo.DigestAlgorithm.algorithmIdentifier",tagClass:_.Class.UNIVERSAL,type:_.Type.OID,constructed:!1,capture:"algorithmIdentifier"},{name:"DigestInfo.DigestAlgorithm.parameters",tagClass:_.Class.UNIVERSAL,type:_.Type.NULL,capture:"parameters",optional:!0,constructed:!1}]},{name:"DigestInfo.digest",tagClass:_.Class.UNIVERSAL,type:_.Type.OCTETSTRING,constructed:!1,capture:"digest"}]},Am=function(e){var t;if(e.algorithm in pe.oids)t=pe.oids[e.algorithm];else{var n=Error("Unknown message digest algorithm.");throw n.algorithm=e.algorithm,n}var r=_.oidToDer(t).getBytes(),i=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[]),s=_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[]);s.value.push(_.create(_.Class.UNIVERSAL,_.Type.OID,!1,r)),s.value.push(_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,""));var a=_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,e.digest().getBytes());return i.value.push(s),i.value.push(a),_.toDer(i).getBytes()},Lu=function(e,t,n){if(n)return e.modPow(t.e,t.n);if(!t.p||!t.q)return e.modPow(t.d,t.n);if(!t.dP)t.dP=t.d.mod(t.p.subtract(ke.ONE));if(!t.dQ)t.dQ=t.d.mod(t.q.subtract(ke.ONE));if(!t.qInv)t.qInv=t.q.modInverse(t.p);var r;do r=new ke(re.util.bytesToHex(re.random.getBytes(t.n.bitLength()/8)),16);while(r.compareTo(t.n)>=0||!r.gcd(t.n).equals(ke.ONE));e=e.multiply(r.modPow(t.e,t.n)).mod(t.n);var i=e.mod(t.p).modPow(t.dP,t.p),s=e.mod(t.q).modPow(t.dQ,t.q);while(i.compareTo(s)<0)i=i.add(t.p);var a=i.subtract(s).multiply(t.qInv).mod(t.p).multiply(t.q).add(s);return a=a.multiply(r.modInverse(t.n)).mod(t.n),a};pe.rsa.encrypt=function(e,t,n){var r=n,i,s=Math.ceil(t.n.bitLength()/8);if(n!==!1&&n!==!0)r=n===2,i=Ou(e,t,n);else i=re.util.createBuffer(),i.putBytes(e);var a=new ke(i.toHex(),16),o=Lu(a,t,r),l=o.toString(16),c=re.util.createBuffer(),u=s-Math.ceil(l.length/2);while(u>0)c.putByte(0),--u;return c.putBytes(re.util.hexToBytes(l)),c.getBytes()};pe.rsa.decrypt=function(e,t,n,r){var i=Math.ceil(t.n.bitLength()/8);if(e.length!==i){var s=Error("Encrypted message length is invalid.");throw s.length=e.length,s.expected=i,s}var a=new ke(re.util.createBuffer(e).toHex(),16);if(a.compareTo(t.n)>=0)throw Error("Encrypted message is invalid.");var o=Lu(a,t,n),l=o.toString(16),c=re.util.createBuffer(),u=i-Math.ceil(l.length/2);while(u>0)c.putByte(0),--u;if(c.putBytes(re.util.hexToBytes(l)),r!==!1)return Os(c.getBytes(),t,n);return c.getBytes()};pe.rsa.createKeyPairGenerationState=function(e,t,n){if(typeof e==="string")e=parseInt(e,10);e=e||2048,n=n||{};var r=n.prng||re.random,i={nextBytes:function(o){var l=r.getBytesSync(o.length);for(var c=0;c<o.length;++c)o[c]=l.charCodeAt(c)}},s=n.algorithm||"PRIMEINC",a;if(s==="PRIMEINC")a={algorithm:s,state:0,bits:e,rng:i,eInt:t||65537,e:new ke(null),p:null,q:null,qBits:e>>1,pBits:e-(e>>1),pqState:0,num:null,keys:null},a.e.fromInt(a.eInt);else throw Error("Invalid key generation algorithm: "+s);return a};pe.rsa.stepKeyPairGenerationState=function(e,t){if(!("algorithm"in e))e.algorithm="PRIMEINC";var n=new ke(null);n.fromInt(30);var r=0,i=function(d,f){return d|f},s=+new Date,a,o=0;while(e.keys===null&&(t<=0||o<t)){if(e.state===0){var l=e.p===null?e.pBits:e.qBits,c=l-1;if(e.pqState===0){if(e.num=new ke(l,e.rng),!e.num.testBit(c))e.num.bitwiseTo(ke.ONE.shiftLeft(c),i,e.num);e.num.dAddOffset(31-e.num.mod(n).byteValue(),0),r=0,++e.pqState}else if(e.pqState===1)if(e.num.bitLength()>l)e.pqState=0;else if(e.num.isProbablePrime(km(e.num.bitLength())))++e.pqState;else e.num.dAddOffset(Sm[r++%8],0);else if(e.pqState===2)e.pqState=e.num.subtract(ke.ONE).gcd(e.e).compareTo(ke.ONE)===0?3:0;else if(e.pqState===3){if(e.pqState=0,e.p===null)e.p=e.num;else e.q=e.num;if(e.p!==null&&e.q!==null)++e.state;e.num=null}}else if(e.state===1){if(e.p.compareTo(e.q)<0)e.num=e.p,e.p=e.q,e.q=e.num;++e.state}else if(e.state===2)e.p1=e.p.subtract(ke.ONE),e.q1=e.q.subtract(ke.ONE),e.phi=e.p1.multiply(e.q1),++e.state;else if(e.state===3)if(e.phi.gcd(e.e).compareTo(ke.ONE)===0)++e.state;else e.p=null,e.q=null,e.state=0;else if(e.state===4)if(e.n=e.p.multiply(e.q),e.n.bitLength()===e.bits)++e.state;else e.q=null,e.state=0;else if(e.state===5){var u=e.e.modInverse(e.phi);e.keys={privateKey:pe.rsa.setPrivateKey(e.n,e.e,u,e.p,e.q,u.mod(e.p1),u.mod(e.q1),e.q.modInverse(e.p)),publicKey:pe.rsa.setPublicKey(e.n,e.e)}}a=+new Date,o+=a-s,s=a}return e.keys!==null};pe.rsa.generateKeyPair=function(e,t,n,r){if(arguments.length===1){if(typeof e==="object")n=e,e=void 0;else if(typeof e==="function")r=e,e=void 0}else if(arguments.length===2)if(typeof e==="number"){if(typeof t==="function")r=t,t=void 0;else if(typeof t!=="number")n=t,t=void 0}else n=e,r=t,e=void 0,t=void 0;else if(arguments.length===3)if(typeof t==="number"){if(typeof n==="function")r=n,n=void 0}else r=n,n=t,t=void 0;if(n=n||{},e===void 0)e=n.bits||2048;if(t===void 0)t=n.e||65537;if(!re.options.usePureJavaScript&&!n.prng&&e>=256&&e<=16384&&(t===65537||t===3)){if(r){if(Bu("generateKeyPair"))return Co.generateKeyPair("rsa",{modulusLength:e,publicExponent:t,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}},function(o,l,c){if(o)return r(o);r(null,{privateKey:pe.privateKeyFromPem(c),publicKey:pe.publicKeyFromPem(l)})});if(Pu("generateKey")&&Pu("exportKey"))return Ot.globalScope.crypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:e,publicExponent:Du(t),hash:{name:"SHA-256"}},!0,["sign","verify"]).then(function(o){return Ot.globalScope.crypto.subtle.exportKey("pkcs8",o.privateKey)}).then(void 0,function(o){r(o)}).then(function(o){if(o){var l=pe.privateKeyFromAsn1(_.fromDer(re.util.createBuffer(o)));r(null,{privateKey:l,publicKey:pe.setRsaPublicKey(l.n,l.e)})}});if(Nu("generateKey")&&Nu("exportKey")){var i=Ot.globalScope.msCrypto.subtle.generateKey({name:"RSASSA-PKCS1-v1_5",modulusLength:e,publicExponent:Du(t),hash:{name:"SHA-256"}},!0,["sign","verify"]);i.oncomplete=function(o){var l=o.target.result,c=Ot.globalScope.msCrypto.subtle.exportKey("pkcs8",l.privateKey);c.oncomplete=function(u){var d=u.target.result,f=pe.privateKeyFromAsn1(_.fromDer(re.util.createBuffer(d)));r(null,{privateKey:f,publicKey:pe.setRsaPublicKey(f.n,f.e)})},c.onerror=function(u){r(u)}},i.onerror=function(o){r(o)};return}}else if(Bu("generateKeyPairSync")){var s=Co.generateKeyPairSync("rsa",{modulusLength:e,publicExponent:t,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{privateKey:pe.privateKeyFromPem(s.privateKey),publicKey:pe.publicKeyFromPem(s.publicKey)}}}var a=pe.rsa.createKeyPairGenerationState(e,t,n);if(!r)return pe.rsa.stepKeyPairGenerationState(a,0),a.keys;_m(a,n,r)};pe.setRsaPublicKey=pe.rsa.setPublicKey=function(e,t){var n={n:e,e:t};return n.encrypt=function(r,i,s){if(typeof i==="string")i=i.toUpperCase();else if(i===void 0)i="RSAES-PKCS1-V1_5";if(i==="RSAES-PKCS1-V1_5")i={encode:function(o,l,c){return Ou(o,l,2).getBytes()}};else if(i==="RSA-OAEP"||i==="RSAES-OAEP")i={encode:function(o,l){return re.pkcs1.encode_rsa_oaep(l,o,s)}};else if(["RAW","NONE","NULL",null].indexOf(i)!==-1)i={encode:function(o){return o}};else if(typeof i==="string")throw Error('Unsupported encryption scheme: "'+i+'".');var a=i.encode(r,n,!0);return pe.rsa.encrypt(a,n,!0)},n.verify=function(r,i,s,a){if(typeof s==="string")s=s.toUpperCase();else if(s===void 0)s="RSASSA-PKCS1-V1_5";if(a===void 0)a={_parseAllDigestBytes:!0,_skipPaddingChecks:!1};if(!("_parseAllDigestBytes"in a))a._parseAllDigestBytes=!0;if(!("_skipPaddingChecks"in a))a._skipPaddingChecks=!1;if(s==="RSASSA-PKCS1-V1_5")s={verify:function(l,c){c=Os(c,n,!0,void 0,a);var u=_.fromDer(c,{parseAllBytes:a._parseAllDigestBytes}),d={},f=[];if(!_.validate(u,Tm,d,f)||u.value.length!==2){var y=Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.");throw y.errors=f,y}var p=_.derToOid(d.algorithmIdentifier);if(!(p===re.oids.md2||p===re.oids.md5||p===re.oids.sha1||p===re.oids.sha224||p===re.oids.sha256||p===re.oids.sha384||p===re.oids.sha512||p===re.oids["sha512-224"]||p===re.oids["sha512-256"])){var y=Error("Unknown RSASSA-PKCS1-v1_5 DigestAlgorithm identifier.");throw y.oid=p,y}if(p===re.oids.md2||p===re.oids.md5){if(!("parameters"in d))throw Error("ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value. Missing algorithm identifier NULL parameters.")}return l===d.digest}};else if(s==="NONE"||s==="NULL"||s===null)s={verify:function(l,c){return c=Os(c,n,!0,void 0,a),l===c}};var o=pe.rsa.decrypt(i,n,!0,!1);return s.verify(r,o,n.n.bitLength())},n};pe.setRsaPrivateKey=pe.rsa.setPrivateKey=function(e,t,n,r,i,s,a,o){var l={n:e,e:t,d:n,p:r,q:i,dP:s,dQ:a,qInv:o};return l.decrypt=function(c,u,d){if(typeof u==="string")u=u.toUpperCase();else if(u===void 0)u="RSAES-PKCS1-V1_5";var f=pe.rsa.decrypt(c,l,!1,!1);if(u==="RSAES-PKCS1-V1_5")u={decode:Os};else if(u==="RSA-OAEP"||u==="RSAES-OAEP")u={decode:function(y,p){return re.pkcs1.decode_rsa_oaep(p,y,d)}};else if(["RAW","NONE","NULL",null].indexOf(u)!==-1)u={decode:function(y){return y}};else throw Error('Unsupported encryption scheme: "'+u+'".');return u.decode(f,l,!1)},l.sign=function(c,u){var d=!1;if(typeof u==="string")u=u.toUpperCase();if(u===void 0||u==="RSASSA-PKCS1-V1_5")u={encode:Am},d=1;else if(u==="NONE"||u==="NULL"||u===null)u={encode:function(){return c}},d=1;var f=u.encode(c,l.n.bitLength());return pe.rsa.encrypt(f,l,d)},l};pe.wrapRsaPrivateKey=function(e){return _.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,_.integerToDer(0).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(pe.oids.rsaEncryption).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]),_.create(_.Class.UNIVERSAL,_.Type.OCTETSTRING,!1,_.toDer(e).getBytes())])};pe.privateKeyFromAsn1=function(e){var t={},n=[];if(_.validate(e,bm,t,n))e=_.fromDer(re.util.createBuffer(t.privateKey));if(t={},n=[],!_.validate(e,Cm,t,n)){var r=Error("Cannot read private key. ASN.1 object does not contain an RSAPrivateKey.");throw r.errors=n,r}var i,s,a,o,l,c,u,d;return i=re.util.createBuffer(t.privateKeyModulus).toHex(),s=re.util.createBuffer(t.privateKeyPublicExponent).toHex(),a=re.util.createBuffer(t.privateKeyPrivateExponent).toHex(),o=re.util.createBuffer(t.privateKeyPrime1).toHex(),l=re.util.createBuffer(t.privateKeyPrime2).toHex(),c=re.util.createBuffer(t.privateKeyExponent1).toHex(),u=re.util.createBuffer(t.privateKeyExponent2).toHex(),d=re.util.createBuffer(t.privateKeyCoefficient).toHex(),pe.setRsaPrivateKey(new ke(i,16),new ke(s,16),new ke(a,16),new ke(o,16),new ke(l,16),new ke(c,16),new ke(u,16),new ke(d,16))};pe.privateKeyToAsn1=pe.privateKeyToRSAPrivateKey=function(e){return _.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,_.integerToDer(0).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.n)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.e)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.d)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.p)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.q)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.dP)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.dQ)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.qInv))])};pe.publicKeyFromAsn1=function(e){var t={},n=[];if(_.validate(e,wm,t,n)){var r=_.derToOid(t.publicKeyOid);if(r!==pe.oids.rsaEncryption){var i=Error("Cannot read public key. Unknown OID.");throw i.oid=r,i}e=t.rsaPublicKey}if(n=[],!_.validate(e,Em,t,n)){var i=Error("Cannot read public key. ASN.1 object does not contain an RSAPublicKey.");throw i.errors=n,i}var s=re.util.createBuffer(t.publicKeyModulus).toHex(),a=re.util.createBuffer(t.publicKeyExponent).toHex();return pe.setRsaPublicKey(new ke(s,16),new ke(a,16))};pe.publicKeyToAsn1=pe.publicKeyToSubjectPublicKeyInfo=function(e){return _.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.OID,!1,_.oidToDer(pe.oids.rsaEncryption).getBytes()),_.create(_.Class.UNIVERSAL,_.Type.NULL,!1,"")]),_.create(_.Class.UNIVERSAL,_.Type.BITSTRING,!1,[pe.publicKeyToRSAPublicKey(e)])])};pe.publicKeyToRSAPublicKey=function(e){return _.create(_.Class.UNIVERSAL,_.Type.SEQUENCE,!0,[_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.n)),_.create(_.Class.UNIVERSAL,_.Type.INTEGER,!1,or(e.e))])};function Ou(e,t,n){var r=re.util.createBuffer(),i=Math.ceil(t.n.bitLength()/8);if(e.length>i-11){var s=Error("Message is too long for PKCS#1 v1.5 padding.");throw s.length=e.length,s.max=i-11,s}r.putByte(0),r.putByte(n);var a=i-3-e.length,o;if(n===0||n===1){o=n===0?0:255;for(var l=0;l<a;++l)r.putByte(o)}else while(a>0){var c=0,u=re.random.getBytes(a);for(var l=0;l<a;++l)if(o=u.charCodeAt(l),o===0)++c;else r.putByte(o);a=c}return r.putByte(0),r.putBytes(e),r}function Os(e,t,n,r,i){var s=Math.ceil(t.n.bitLength()/8),a=re.util.createBuffer(e),o=a.getByte(),l=a.getByte();if(o!==0||n&&l!==0&&l!==1||!n&&l!==2||n&&l===0&&typeof r>"u")throw Error("Encryption block is invalid.");var c=0;if(l===0){c=s-3-r;for(var u=0;u<c;++u)if(a.getByte()!==0)throw Error("Encryption block is invalid.")}else if(l===1){c=0;while(a.length()>1){if(a.getByte()!==255){--a.read;break}++c}if(c<8&&!(i?i._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}else if(l===2){c=0;while(a.length()>1){if(a.getByte()===0){--a.read;break}++c}if(c<8&&!(i?i._skipPaddingChecks:!1))throw Error("Encryption block is invalid.")}var d=a.getByte();if(d!==0||c!==s-3-a.length())throw Error("Encryption block is invalid.");return a.getBytes()}function _m(e,t,n){if(typeof t==="function")n=t,t={};t=t||{};var r={algorithm:{name:t.algorithm||"PRIMEINC",options:{workers:t.workers||2,workLoad:t.workLoad||100,workerScript:t.workerScript}}};if("prng"in t)r.prng=t.prng;i();function i(){s(e.pBits,function(o,l){if(o)return n(o);if(e.p=l,e.q!==null)return a(o,e.q);s(e.qBits,a)})}function s(o,l){re.prime.generateProbablePrime(o,r,l)}function a(o,l){if(o)return n(o);if(e.q=l,e.p.compareTo(e.q)<0){var c=e.p;e.p=e.q,e.q=c}if(e.p.subtract(ke.ONE).gcd(e.e).compareTo(ke.ONE)!==0){e.p=null,i();return}if(e.q.subtract(ke.ONE).gcd(e.e).compareTo(ke.ONE)!==0){e.q=null,s(e.qBits,a);return}if(e.p1=e.p.subtract(ke.ONE),e.q1=e.q.subtract(ke.ONE),e.phi=e.p1.multiply(e.q1),e.phi.gcd(e.e).compareTo(ke.ONE)!==0){e.p=e.q=null,i();return}if(e.n=e.p.multiply(e.q),e.n.bitLength()!==e.bits){e.q=null,s(e.qBits,a);return}var u=e.e.modInverse(e.phi);e.keys={privateKey:pe.rsa.setPrivateKey(e.n,e.e,u,e.p,e.q,u.mod(e.p1),u.mod(e.q1),e.q.modInverse(e.p)),publicKey:pe.rsa.setPublicKey(e.n,e.e)},n(null,e.keys)}}function or(e){var t=e.toString(16);if(t[0]>="8")t="00"+t;var n=re.util.hexToBytes(t);if(n.length>1&&(n.charCodeAt(0)===0&&(n.charCodeAt(1)&128)===0||n.charCodeAt(0)===255&&(n.charCodeAt(1)&128)===128))return n.substr(1);return n}function km(e){if(e<=100)return 27;if(e<=150)return 18;if(e<=200)return 15;if(e<=250)return 12;if(e<=300)return 9;if(e<=350)return 8;if(e<=400)return 7;if(e<=500)return 6;if(e<=600)return 5;if(e<=800)return 4;if(e<=1250)return 3;return 2}function Bu(e){return re.util.isNodejs&&typeof Co[e]==="function"}function Pu(e){return typeof Ot.globalScope<"u"&&typeof Ot.globalScope.crypto==="object"&&typeof Ot.globalScope.crypto.subtle==="object"&&typeof Ot.globalScope.crypto.subtle[e]==="function"}function Nu(e){return typeof Ot.globalScope<"u"&&typeof Ot.globalScope.msCrypto==="object"&&typeof Ot.globalScope.msCrypto.subtle==="object"&&typeof Ot.globalScope.msCrypto.subtle[e]==="function"}function Du(e){var t=re.util.hexToBytes(e.toString(16)),n=new Uint8Array(t.length);for(var r=0;r<t.length;++r)n[r]=t.charCodeAt(r);return n}});var wo=fe(function(i1,Wu){var j=me();Nr();Kt();yi();er();Dr();Bs();nn();Dt();ho();Si();Be();if(typeof Eo>"u")Eo=j.jsbn.BigInteger;var Eo,B=j.asn1,ge=j.pki=j.pki||{};Wu.exports=ge.pbe=j.pbe=j.pbe||{};var on=ge.oids,Im={name:"EncryptedPrivateKeyInfo",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedPrivateKeyInfo.encryptionAlgorithm",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:B.Class.UNIVERSAL,type:B.Type.OID,constructed:!1,capture:"encryptionOid"},{name:"AlgorithmIdentifier.parameters",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,captureAsn1:"encryptionParams"}]},{name:"EncryptedPrivateKeyInfo.encryptedData",tagClass:B.Class.UNIVERSAL,type:B.Type.OCTETSTRING,constructed:!1,capture:"encryptedData"}]},Rm={name:"PBES2Algorithms",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.keyDerivationFunc.oid",tagClass:B.Class.UNIVERSAL,type:B.Type.OID,constructed:!1,capture:"kdfOid"},{name:"PBES2Algorithms.params",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.params.salt",tagClass:B.Class.UNIVERSAL,type:B.Type.OCTETSTRING,constructed:!1,capture:"kdfSalt"},{name:"PBES2Algorithms.params.iterationCount",tagClass:B.Class.UNIVERSAL,type:B.Type.INTEGER,constructed:!1,capture:"kdfIterationCount"},{name:"PBES2Algorithms.params.keyLength",tagClass:B.Class.UNIVERSAL,type:B.Type.INTEGER,constructed:!1,optional:!0,capture:"keyLength"},{name:"PBES2Algorithms.params.prf",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,optional:!0,value:[{name:"PBES2Algorithms.params.prf.algorithm",tagClass:B.Class.UNIVERSAL,type:B.Type.OID,constructed:!1,capture:"prfOid"}]}]}]},{name:"PBES2Algorithms.encryptionScheme",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"PBES2Algorithms.encryptionScheme.oid",tagClass:B.Class.UNIVERSAL,type:B.Type.OID,constructed:!1,capture:"encOid"},{name:"PBES2Algorithms.encryptionScheme.iv",tagClass:B.Class.UNIVERSAL,type:B.Type.OCTETSTRING,constructed:!1,capture:"encIv"}]}]},Bm={name:"pkcs-12PbeParams",tagClass:B.Class.UNIVERSAL,type:B.Type.SEQUENCE,constructed:!0,value:[{name:"pkcs-12PbeParams.salt",tagClass:B.Class.UNIVERSAL,type:B.Type.OCTETSTRING,constructed:!1,capture:"salt"},{name:"pkcs-12PbeParams.iterations",tagClass:B.Class.UNIVERSAL,type:B.Type.INTEGER,constructed:!1,capture:"iterations"}]};ge.encryptPrivateKeyInfo=function(e,t,n){n=n||{},n.saltSize=n.saltSize||8,n.count=n.count||2048,n.algorithm=n.algorithm||"aes128",n.prfAlgorithm=n.prfAlgorithm||"sha1";var r=j.random.getBytesSync(n.saltSize),i=n.count,s=B.integerToDer(i),a,o,l;if(n.algorithm.indexOf("aes")===0||n.algorithm==="des"){var c,u,d;switch(n.algorithm){case"aes128":a=16,c=16,u=on["aes128-CBC"],d=j.aes.createEncryptionCipher;break;case"aes192":a=24,c=16,u=on["aes192-CBC"],d=j.aes.createEncryptionCipher;break;case"aes256":a=32,c=16,u=on["aes256-CBC"],d=j.aes.createEncryptionCipher;break;case"des":a=8,c=8,u=on.desCBC,d=j.des.createEncryptionCipher;break;default:var f=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw f.algorithm=n.algorithm,f}var y="hmacWith"+n.prfAlgorithm.toUpperCase(),p=Mu(y),v=j.pkcs5.pbkdf2(t,r,i,a,p),x=j.random.getBytesSync(c),b=d(v);b.start(x),b.update(B.toDer(e)),b.finish(),l=b.output.getBytes();var A=Pm(r,s,a,y);o=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(on.pkcs5PBES2).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(on.pkcs5PBKDF2).getBytes()),A]),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(u).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,x)])])])}else if(n.algorithm==="3des"){a=24;var E=new j.util.ByteBuffer(r),v=ge.pbe.generatePkcs12Key(t,E,1,i,a),x=ge.pbe.generatePkcs12Key(t,E,2,i,a),b=j.des.createEncryptionCipher(v);b.start(x),b.update(B.toDer(e)),b.finish(),l=b.output.getBytes(),o=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(on["pbeWithSHAAnd3-KeyTripleDES-CBC"]).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,r),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,s.getBytes())])])}else{var f=Error("Cannot encrypt private key. Unknown encryption algorithm.");throw f.algorithm=n.algorithm,f}var k=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[o,B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,l)]);return k};ge.decryptPrivateKeyInfo=function(e,t){var n=null,r={},i=[];if(!B.validate(e,Im,r,i)){var s=Error("Cannot read encrypted private key. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw s.errors=i,s}var a=B.derToOid(r.encryptionOid),o=ge.pbe.getCipher(a,r.encryptionParams,t),l=j.util.createBuffer(r.encryptedData);if(o.update(l),o.finish())n=B.fromDer(o.output);return n};ge.encryptedPrivateKeyToPem=function(e,t){var n={type:"ENCRYPTED PRIVATE KEY",body:B.toDer(e).getBytes()};return j.pem.encode(n,{maxline:t})};ge.encryptedPrivateKeyFromPem=function(e){var t=j.pem.decode(e)[0];if(t.type!=="ENCRYPTED PRIVATE KEY"){var n=Error('Could not convert encrypted private key from PEM; PEM header type is "ENCRYPTED PRIVATE KEY".');throw n.headerType=t.type,n}if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert encrypted private key from PEM; PEM is encrypted.");return B.fromDer(t.body)};ge.encryptRsaPrivateKey=function(e,t,n){if(n=n||{},!n.legacy){var r=ge.wrapRsaPrivateKey(ge.privateKeyToAsn1(e));return r=ge.encryptPrivateKeyInfo(r,t,n),ge.encryptedPrivateKeyToPem(r)}var i,s,a,o;switch(n.algorithm){case"aes128":i="AES-128-CBC",a=16,s=j.random.getBytesSync(16),o=j.aes.createEncryptionCipher;break;case"aes192":i="AES-192-CBC",a=24,s=j.random.getBytesSync(16),o=j.aes.createEncryptionCipher;break;case"aes256":i="AES-256-CBC",a=32,s=j.random.getBytesSync(16),o=j.aes.createEncryptionCipher;break;case"3des":i="DES-EDE3-CBC",a=24,s=j.random.getBytesSync(8),o=j.des.createEncryptionCipher;break;case"des":i="DES-CBC",a=8,s=j.random.getBytesSync(8),o=j.des.createEncryptionCipher;break;default:var l=Error('Could not encrypt RSA private key; unsupported encryption algorithm "'+n.algorithm+'".');throw l.algorithm=n.algorithm,l}var c=j.pbe.opensslDeriveBytes(t,s.substr(0,8),a),u=o(c);u.start(s),u.update(B.toDer(ge.privateKeyToAsn1(e))),u.finish();var d={type:"RSA PRIVATE KEY",procType:{version:"4",type:"ENCRYPTED"},dekInfo:{algorithm:i,parameters:j.util.bytesToHex(s).toUpperCase()},body:u.output.getBytes()};return j.pem.encode(d)};ge.decryptRsaPrivateKey=function(e,t){var n=null,r=j.pem.decode(e)[0];if(r.type!=="ENCRYPTED PRIVATE KEY"&&r.type!=="PRIVATE KEY"&&r.type!=="RSA PRIVATE KEY"){var i=Error('Could not convert private key from PEM; PEM header type is not "ENCRYPTED PRIVATE KEY", "PRIVATE KEY", or "RSA PRIVATE KEY".');throw i.headerType=i,i}if(r.procType&&r.procType.type==="ENCRYPTED"){var s,a;switch(r.dekInfo.algorithm){case"DES-CBC":s=8,a=j.des.createDecryptionCipher;break;case"DES-EDE3-CBC":s=24,a=j.des.createDecryptionCipher;break;case"AES-128-CBC":s=16,a=j.aes.createDecryptionCipher;break;case"AES-192-CBC":s=24,a=j.aes.createDecryptionCipher;break;case"AES-256-CBC":s=32,a=j.aes.createDecryptionCipher;break;case"RC2-40-CBC":s=5,a=function(d){return j.rc2.createDecryptionCipher(d,40)};break;case"RC2-64-CBC":s=8,a=function(d){return j.rc2.createDecryptionCipher(d,64)};break;case"RC2-128-CBC":s=16,a=function(d){return j.rc2.createDecryptionCipher(d,128)};break;default:var i=Error('Could not decrypt private key; unsupported encryption algorithm "'+r.dekInfo.algorithm+'".');throw i.algorithm=r.dekInfo.algorithm,i}var o=j.util.hexToBytes(r.dekInfo.parameters),l=j.pbe.opensslDeriveBytes(t,o.substr(0,8),s),c=a(l);if(c.start(o),c.update(j.util.createBuffer(r.body)),c.finish())n=c.output.getBytes();else return n}else n=r.body;if(r.type==="ENCRYPTED PRIVATE KEY")n=ge.decryptPrivateKeyInfo(B.fromDer(n),t);else n=B.fromDer(n);if(n!==null)n=ge.privateKeyFromAsn1(n);return n};ge.pbe.generatePkcs12Key=function(e,t,n,r,i,s){var a,o;if(typeof s>"u"||s===null){if(!("sha1"in j.md))throw Error('"sha1" hash algorithm unavailable.');s=j.md.sha1.create()}var l=s.digestLength,c=s.blockLength,u=new j.util.ByteBuffer,d=new j.util.ByteBuffer;if(e!==null&&e!==void 0){for(o=0;o<e.length;o++)d.putInt16(e.charCodeAt(o));d.putInt16(0)}var f=d.length(),y=t.length(),p=new j.util.ByteBuffer;p.fillWithByte(n,c);var v=c*Math.ceil(y/c),x=new j.util.ByteBuffer;for(o=0;o<v;o++)x.putByte(t.at(o%y));var b=c*Math.ceil(f/c),A=new j.util.ByteBuffer;for(o=0;o<b;o++)A.putByte(d.at(o%f));var E=x;E.putBuffer(A);var k=Math.ceil(i/l);for(var I=1;I<=k;I++){var R=new j.util.ByteBuffer;R.putBytes(p.bytes()),R.putBytes(E.bytes());for(var M=0;M<r;M++)s.start(),s.update(R.getBytes()),R=s.digest();var ee=new j.util.ByteBuffer;for(o=0;o<c;o++)ee.putByte(R.at(o%l));var O=Math.ceil(y/c)+Math.ceil(f/c),K=new j.util.ByteBuffer;for(a=0;a<O;a++){var ie=new j.util.ByteBuffer(E.getBytes(c)),ve=511;for(o=ee.length()-1;o>=0;o--)ve=ve>>8,ve+=ee.at(o)+ie.at(o),ie.setAt(o,ve&255);K.putBuffer(ie)}E=K,u.putBuffer(R)}return u.truncate(u.length()-i),u};ge.pbe.getCipher=function(e,t,n){switch(e){case ge.oids.pkcs5PBES2:return ge.pbe.getCipherForPBES2(e,t,n);case ge.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:case ge.oids["pbewithSHAAnd40BitRC2-CBC"]:return ge.pbe.getCipherForPKCS12PBE(e,t,n);default:var r=Error("Cannot read encrypted PBE data block. Unsupported OID.");throw r.oid=e,r.supportedOids=["pkcs5PBES2","pbeWithSHAAnd3-KeyTripleDES-CBC","pbewithSHAAnd40BitRC2-CBC"],r}};ge.pbe.getCipherForPBES2=function(e,t,n){var r={},i=[];if(!B.validate(t,Rm,r,i)){var s=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw s.errors=i,s}if(e=B.derToOid(r.kdfOid),e!==ge.oids.pkcs5PBKDF2){var s=Error("Cannot read encrypted private key. Unsupported key derivation function OID.");throw s.oid=e,s.supportedOids=["pkcs5PBKDF2"],s}if(e=B.derToOid(r.encOid),e!==ge.oids["aes128-CBC"]&&e!==ge.oids["aes192-CBC"]&&e!==ge.oids["aes256-CBC"]&&e!==ge.oids["des-EDE3-CBC"]&&e!==ge.oids.desCBC){var s=Error("Cannot read encrypted private key. Unsupported encryption scheme OID.");throw s.oid=e,s.supportedOids=["aes128-CBC","aes192-CBC","aes256-CBC","des-EDE3-CBC","desCBC"],s}var a=r.kdfSalt,o=j.util.createBuffer(r.kdfIterationCount);o=o.getInt(o.length()<<3);var l,c;switch(ge.oids[e]){case"aes128-CBC":l=16,c=j.aes.createDecryptionCipher;break;case"aes192-CBC":l=24,c=j.aes.createDecryptionCipher;break;case"aes256-CBC":l=32,c=j.aes.createDecryptionCipher;break;case"des-EDE3-CBC":l=24,c=j.des.createDecryptionCipher;break;case"desCBC":l=8,c=j.des.createDecryptionCipher;break}var u=Fu(r.prfOid),d=j.pkcs5.pbkdf2(n,a,o,l,u),f=r.encIv,y=c(d);return y.start(f),y};ge.pbe.getCipherForPKCS12PBE=function(e,t,n){var r={},i=[];if(!B.validate(t,Bm,r,i)){var s=Error("Cannot read password-based-encryption algorithm parameters. ASN.1 object is not a supported EncryptedPrivateKeyInfo.");throw s.errors=i,s}var a=j.util.createBuffer(r.salt),o=j.util.createBuffer(r.iterations);o=o.getInt(o.length()<<3);var l,c,u;switch(e){case ge.oids["pbeWithSHAAnd3-KeyTripleDES-CBC"]:l=24,c=8,u=j.des.startDecrypting;break;case ge.oids["pbewithSHAAnd40BitRC2-CBC"]:l=5,c=8,u=function(v,x){var b=j.rc2.createDecryptionCipher(v,40);return b.start(x,null),b};break;default:var s=Error("Cannot read PKCS #12 PBE data block. Unsupported OID.");throw s.oid=e,s}var d=Fu(r.prfOid),f=ge.pbe.generatePkcs12Key(n,a,1,o,l,d);d.start();var y=ge.pbe.generatePkcs12Key(n,a,2,o,c,d);return u(f,y)};ge.pbe.opensslDeriveBytes=function(e,t,n,r){if(typeof r>"u"||r===null){if(!("md5"in j.md))throw Error('"md5" hash algorithm unavailable.');r=j.md.md5.create()}if(t===null)t="";var i=[Vu(r,e+t)];for(var s=16,a=1;s<n;++a,s+=16)i.push(Vu(r,i[a-1]+e+t));return i.join("").substr(0,n)};function Vu(e,t){return e.start().update(t).digest().getBytes()}function Fu(e){var t;if(!e)t="hmacWithSHA1";else if(t=ge.oids[B.derToOid(e)],!t){var n=Error("Unsupported PRF OID.");throw n.oid=e,n.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],n}return Mu(t)}function Mu(e){var t=j.md;switch(e){case"hmacWithSHA224":t=j.md.sha512;case"hmacWithSHA1":case"hmacWithSHA256":case"hmacWithSHA384":case"hmacWithSHA512":e=e.substr(8).toLowerCase();break;default:var n=Error("Unsupported PRF algorithm.");throw n.algorithm=e,n.supported=["hmacWithSHA1","hmacWithSHA224","hmacWithSHA256","hmacWithSHA384","hmacWithSHA512"],n}if(!t||!(e in t))throw Error("Unknown hash algorithm: "+e);return t[e].create()}function Pm(e,t,n,r){var i=B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OCTETSTRING,!1,e),B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,t.getBytes())]);if(r!=="hmacWithSHA1")i.value.push(B.create(B.Class.UNIVERSAL,B.Type.INTEGER,!1,j.util.hexToBytes(n.toString(16))),B.create(B.Class.UNIVERSAL,B.Type.SEQUENCE,!0,[B.create(B.Class.UNIVERSAL,B.Type.OID,!1,B.oidToDer(ge.oids[r]).getBytes()),B.create(B.Class.UNIVERSAL,B.Type.NULL,!1,"")]));return i}});var To=fe(function(s1,Ku){var Rn=me();Kt();Be();var G=Rn.asn1,Bn=Ku.exports=Rn.pkcs7asn1=Rn.pkcs7asn1||{};Rn.pkcs7=Rn.pkcs7||{};Rn.pkcs7.asn1=Bn;var $u={name:"ContentInfo",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.ContentType",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:G.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,captureAsn1:"content"}]};Bn.contentInfoValidator=$u;var Hu={name:"EncryptedContentInfo",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentType",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"contentType"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedContentInfo.contentEncryptionAlgorithm.algorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"EncryptedContentInfo.contentEncryptionAlgorithm.parameter",tagClass:G.Class.UNIVERSAL,captureAsn1:"encParameter"}]},{name:"EncryptedContentInfo.encryptedContent",tagClass:G.Class.CONTEXT_SPECIFIC,type:0,capture:"encryptedContent",captureAsn1:"encryptedContentAsn1"}]};Bn.envelopedDataValidator={name:"EnvelopedData",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"EnvelopedData.Version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"version"},{name:"EnvelopedData.RecipientInfos",tagClass:G.Class.UNIVERSAL,type:G.Type.SET,constructed:!0,captureAsn1:"recipientInfos"}].concat(Hu)};Bn.encryptedDataValidator={name:"EncryptedData",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"EncryptedData.Version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"version"}].concat(Hu)};var Nm={name:"SignerInfo",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1},{name:"SignerInfo.issuerAndSerialNumber",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.issuerAndSerialNumber.issuer",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"SignerInfo.issuerAndSerialNumber.serialNumber",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"SignerInfo.digestAlgorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"SignerInfo.digestAlgorithm.algorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"digestAlgorithm"},{name:"SignerInfo.digestAlgorithm.parameter",tagClass:G.Class.UNIVERSAL,constructed:!1,captureAsn1:"digestParameter",optional:!0}]},{name:"SignerInfo.authenticatedAttributes",tagClass:G.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"authenticatedAttributes"},{name:"SignerInfo.digestEncryptionAlgorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,capture:"signatureAlgorithm"},{name:"SignerInfo.encryptedDigest",tagClass:G.Class.UNIVERSAL,type:G.Type.OCTETSTRING,constructed:!1,capture:"signature"},{name:"SignerInfo.unauthenticatedAttributes",tagClass:G.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,capture:"unauthenticatedAttributes"}]};Bn.signedDataValidator={name:"SignedData",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"SignedData.Version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"version"},{name:"SignedData.DigestAlgorithms",tagClass:G.Class.UNIVERSAL,type:G.Type.SET,constructed:!0,captureAsn1:"digestAlgorithms"},$u,{name:"SignedData.Certificates",tagClass:G.Class.CONTEXT_SPECIFIC,type:0,optional:!0,captureAsn1:"certificates"},{name:"SignedData.CertificateRevocationLists",tagClass:G.Class.CONTEXT_SPECIFIC,type:1,optional:!0,captureAsn1:"crls"},{name:"SignedData.SignerInfos",tagClass:G.Class.UNIVERSAL,type:G.Type.SET,capture:"signerInfos",optional:!0,value:[Nm]}]};Bn.recipientInfoValidator={name:"RecipientInfo",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.version",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"version"},{name:"RecipientInfo.issuerAndSerial",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.issuerAndSerial.issuer",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,captureAsn1:"issuer"},{name:"RecipientInfo.issuerAndSerial.serialNumber",tagClass:G.Class.UNIVERSAL,type:G.Type.INTEGER,constructed:!1,capture:"serial"}]},{name:"RecipientInfo.keyEncryptionAlgorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.SEQUENCE,constructed:!0,value:[{name:"RecipientInfo.keyEncryptionAlgorithm.algorithm",tagClass:G.Class.UNIVERSAL,type:G.Type.OID,constructed:!1,capture:"encAlgorithm"},{name:"RecipientInfo.keyEncryptionAlgorithm.parameter",tagClass:G.Class.UNIVERSAL,constructed:!1,captureAsn1:"encParameter",optional:!0}]},{name:"RecipientInfo.encryptedKey",tagClass:G.Class.UNIVERSAL,type:G.Type.OCTETSTRING,constructed:!1,capture:"encKey"}]}});var Ao=fe(function(a1,qu){var ln=me();Be();ln.mgf=ln.mgf||{};var Dm=qu.exports=ln.mgf.mgf1=ln.mgf1=ln.mgf1||{};Dm.create=function(e){var t={generate:function(n,r){var i=new ln.util.ByteBuffer,s=Math.ceil(r/e.digestLength);for(var a=0;a<s;a++){var o=new ln.util.ByteBuffer;o.putInt32(a),e.start(),e.update(n+o.getBytes()),i.putBuffer(e.digest())}return i.truncate(i.length()-r),i.getBytes()}};return t}});var ju=fe(function(o1,Gu){var Us=me();Ao();Gu.exports=Us.mgf=Us.mgf||{};Us.mgf.mgf1=Us.mgf1});var Vs=fe(function(l1,zu){var cn=me();Dt();Be();var Lm=zu.exports=cn.pss=cn.pss||{};Lm.create=function(e){if(arguments.length===3)e={md:arguments[0],mgf:arguments[1],saltLength:arguments[2]};var t=e.md,n=e.mgf,r=t.digestLength,i=e.salt||null;if(typeof i==="string")i=cn.util.createBuffer(i);var s;if("saltLength"in e)s=e.saltLength;else if(i!==null)s=i.length();else throw Error("Salt length not specified or specific salt not given.");if(i!==null&&i.length()!==s)throw Error("Given salt length does not match length of given salt.");var a=e.prng||cn.random,o={};return o.encode=function(l,c){var u,d=c-1,f=Math.ceil(d/8),y=l.digest().getBytes();if(f<r+s+2)throw Error("Message is too long to encrypt.");var p;if(i===null)p=a.getBytesSync(s);else p=i.bytes();var v=new cn.util.ByteBuffer;v.fillWithByte(0,8),v.putBytes(y),v.putBytes(p),t.start(),t.update(v.getBytes());var x=t.digest().getBytes(),b=new cn.util.ByteBuffer;b.fillWithByte(0,f-s-r-2),b.putByte(1),b.putBytes(p);var A=b.getBytes(),E=f-r-1,k=n.generate(x,E),I="";for(u=0;u<E;u++)I+=String.fromCharCode(A.charCodeAt(u)^k.charCodeAt(u));var R=65280>>8*f-d&255;return I=String.fromCharCode(I.charCodeAt(0)&~R)+I.substr(1),I+x+String.fromCharCode(188)},o.verify=function(l,c,u){var d,f=u-1,y=Math.ceil(f/8);if(c=c.substr(-y),y<r+s+2)throw Error("Inconsistent parameters to PSS signature verification.");if(c.charCodeAt(y-1)!==188)throw Error("Encoded message does not end in 0xBC.");var p=y-r-1,v=c.substr(0,p),x=c.substr(p,r),b=65280>>8*y-f&255;if((v.charCodeAt(0)&b)!==0)throw Error("Bits beyond keysize not zero as expected.");var A=n.generate(x,p),E="";for(d=0;d<p;d++)E+=String.fromCharCode(v.charCodeAt(d)^A.charCodeAt(d));E=String.fromCharCode(E.charCodeAt(0)&~b)+E.substr(1);var k=y-r-s-2;for(d=0;d<k;d++)if(E.charCodeAt(d)!==0)throw Error("Leftmost octets not zero as expected");if(E.charCodeAt(k)!==1)throw Error("Inconsistent PSS signature, 0x01 marker not found");var I=E.substr(-s),R=new cn.util.ByteBuffer;R.fillWithByte(0,8),R.putBytes(l),R.putBytes(I),t.start(),t.update(R.getBytes());var M=t.digest().getBytes();return x===M},o}});var Ws=fe(function(c1,Zu){var ne=me();Nr();Kt();yi();er();ju();Dr();nn();Vs();Si();Be();var h=ne.asn1,F=Zu.exports=ne.pki=ne.pki||{},Re=F.oids,Je={};Je.CN=Re.commonName;Je.commonName="CN";Je.C=Re.countryName;Je.countryName="C";Je.L=Re.localityName;Je.localityName="L";Je.ST=Re.stateOrProvinceName;Je.stateOrProvinceName="ST";Je.O=Re.organizationName;Je.organizationName="O";Je.OU=Re.organizationalUnitName;Je.organizationalUnitName="OU";Je.E=Re.emailAddress;Je.emailAddress="E";var Xu=ne.pki.rsa.publicKeyValidator,Om={name:"Certificate",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"tbsCertificate",value:[{name:"Certificate.TBSCertificate.version",tagClass:h.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.version.integer",tagClass:h.Class.UNIVERSAL,type:h.Type.INTEGER,constructed:!1,capture:"certVersion"}]},{name:"Certificate.TBSCertificate.serialNumber",tagClass:h.Class.UNIVERSAL,type:h.Type.INTEGER,constructed:!1,capture:"certSerialNumber"},{name:"Certificate.TBSCertificate.signature",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.signature.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"certinfoSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:h.Class.UNIVERSAL,optional:!0,captureAsn1:"certinfoSignatureParams"}]},{name:"Certificate.TBSCertificate.issuer",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"certIssuer"},{name:"Certificate.TBSCertificate.validity",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.TBSCertificate.validity.notBefore (utc)",tagClass:h.Class.UNIVERSAL,type:h.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity1UTCTime"},{name:"Certificate.TBSCertificate.validity.notBefore (generalized)",tagClass:h.Class.UNIVERSAL,type:h.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity2GeneralizedTime"},{name:"Certificate.TBSCertificate.validity.notAfter (utc)",tagClass:h.Class.UNIVERSAL,type:h.Type.UTCTIME,constructed:!1,optional:!0,capture:"certValidity3UTCTime"},{name:"Certificate.TBSCertificate.validity.notAfter (generalized)",tagClass:h.Class.UNIVERSAL,type:h.Type.GENERALIZEDTIME,constructed:!1,optional:!0,capture:"certValidity4GeneralizedTime"}]},{name:"Certificate.TBSCertificate.subject",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"certSubject"},Xu,{name:"Certificate.TBSCertificate.issuerUniqueID",tagClass:h.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.issuerUniqueID.id",tagClass:h.Class.UNIVERSAL,type:h.Type.BITSTRING,constructed:!1,captureBitStringValue:"certIssuerUniqueId"}]},{name:"Certificate.TBSCertificate.subjectUniqueID",tagClass:h.Class.CONTEXT_SPECIFIC,type:2,constructed:!0,optional:!0,value:[{name:"Certificate.TBSCertificate.subjectUniqueID.id",tagClass:h.Class.UNIVERSAL,type:h.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSubjectUniqueId"}]},{name:"Certificate.TBSCertificate.extensions",tagClass:h.Class.CONTEXT_SPECIFIC,type:3,constructed:!0,captureAsn1:"certExtensions",optional:!0}]},{name:"Certificate.signatureAlgorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"Certificate.signatureAlgorithm.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"certSignatureOid"},{name:"Certificate.TBSCertificate.signature.parameters",tagClass:h.Class.UNIVERSAL,optional:!0,captureAsn1:"certSignatureParams"}]},{name:"Certificate.signatureValue",tagClass:h.Class.UNIVERSAL,type:h.Type.BITSTRING,constructed:!1,captureBitStringValue:"certSignature"}]},Um={name:"rsapss",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.hashAlgorithm",tagClass:h.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier",tagClass:h.Class.UNIVERSAL,type:h.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.hashAlgorithm.AlgorithmIdentifier.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"hashOid"}]}]},{name:"rsapss.maskGenAlgorithm",tagClass:h.Class.CONTEXT_SPECIFIC,type:1,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier",tagClass:h.Class.UNIVERSAL,type:h.Class.SEQUENCE,constructed:!0,optional:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"maskGenOid"},{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"rsapss.maskGenAlgorithm.AlgorithmIdentifier.params.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"maskGenHashOid"}]}]}]},{name:"rsapss.saltLength",tagClass:h.Class.CONTEXT_SPECIFIC,type:2,optional:!0,value:[{name:"rsapss.saltLength.saltLength",tagClass:h.Class.UNIVERSAL,type:h.Class.INTEGER,constructed:!1,capture:"saltLength"}]},{name:"rsapss.trailerField",tagClass:h.Class.CONTEXT_SPECIFIC,type:3,optional:!0,value:[{name:"rsapss.trailer.trailer",tagClass:h.Class.UNIVERSAL,type:h.Class.INTEGER,constructed:!1,capture:"trailer"}]}]},Vm={name:"CertificationRequestInfo",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfo",value:[{name:"CertificationRequestInfo.integer",tagClass:h.Class.UNIVERSAL,type:h.Type.INTEGER,constructed:!1,capture:"certificationRequestInfoVersion"},{name:"CertificationRequestInfo.subject",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"certificationRequestInfoSubject"},Xu,{name:"CertificationRequestInfo.attributes",tagClass:h.Class.CONTEXT_SPECIFIC,type:0,constructed:!0,optional:!0,capture:"certificationRequestInfoAttributes",value:[{name:"CertificationRequestInfo.attributes",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequestInfo.attributes.type",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1},{name:"CertificationRequestInfo.attributes.value",tagClass:h.Class.UNIVERSAL,type:h.Type.SET,constructed:!0}]}]}]},Fm={name:"CertificationRequest",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,captureAsn1:"csr",value:[Vm,{name:"CertificationRequest.signatureAlgorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.SEQUENCE,constructed:!0,value:[{name:"CertificationRequest.signatureAlgorithm.algorithm",tagClass:h.Class.UNIVERSAL,type:h.Type.OID,constructed:!1,capture:"csrSignatureOid"},{name:"CertificationRequest.signatureAlgorithm.parameters",tagClass:h.Class.UNIVERSAL,optional:!0,captureAsn1:"csrSignatureParams"}]},{name:"CertificationRequest.signature",tagClass:h.Class.UNIVERSAL,type:h.Type.BITSTRING,constructed:!1,captureBitStringValue:"csrSignature"}]};F.RDNAttributesAsArray=function(e,t){var n=[],r,i,s;for(var a=0;a<e.value.length;++a){r=e.value[a];for(var o=0;o<r.value.length;++o){if(s={},i=r.value[o],s.type=h.derToOid(i.value[0].value),s.value=i.value[1].value,s.valueTagClass=i.value[1].type,s.type in Re){if(s.name=Re[s.type],s.name in Je)s.shortName=Je[s.name]}if(t)t.update(s.type),t.update(s.value);n.push(s)}}return n};F.CRIAttributesAsArray=function(e){var t=[];for(var n=0;n<e.length;++n){var r=e[n],i=h.derToOid(r.value[0].value),s=r.value[1].value;for(var a=0;a<s.length;++a){var o={};if(o.type=i,o.value=s[a].value,o.valueTagClass=s[a].type,o.type in Re){if(o.name=Re[o.type],o.name in Je)o.shortName=Je[o.name]}if(o.type===Re.extensionRequest){o.extensions=[];for(var l=0;l<o.value.length;++l)o.extensions.push(F.certificateExtensionFromAsn1(o.value[l]))}t.push(o)}}return t};function Ur(e,t){if(typeof t==="string")t={shortName:t};var n=null,r;for(var i=0;n===null&&i<e.attributes.length;++i)if(r=e.attributes[i],t.type&&t.type===r.type)n=r;else if(t.name&&t.name===r.name)n=r;else if(t.shortName&&t.shortName===r.shortName)n=r;return n}var Fs=function(e,t,n){var r={};if(e!==Re["RSASSA-PSS"])return r;if(n)r={hash:{algorithmOid:Re.sha1},mgf:{algorithmOid:Re.mgf1,hash:{algorithmOid:Re.sha1}},saltLength:20};var i={},s=[];if(!h.validate(t,Um,i,s)){var a=Error("Cannot read RSASSA-PSS parameter block.");throw a.errors=s,a}if(i.hashOid!==void 0)r.hash=r.hash||{},r.hash.algorithmOid=h.derToOid(i.hashOid);if(i.maskGenOid!==void 0)r.mgf=r.mgf||{},r.mgf.algorithmOid=h.derToOid(i.maskGenOid),r.mgf.hash=r.mgf.hash||{},r.mgf.hash.algorithmOid=h.derToOid(i.maskGenHashOid);if(i.saltLength!==void 0)r.saltLength=i.saltLength.charCodeAt(0);return r},Ms=function(e){switch(Re[e.signatureOid]){case"sha1WithRSAEncryption":case"sha1WithRSASignature":return ne.md.sha1.create();case"md5WithRSAEncryption":return ne.md.md5.create();case"sha256WithRSAEncryption":return ne.md.sha256.create();case"sha384WithRSAEncryption":return ne.md.sha384.create();case"sha512WithRSAEncryption":return ne.md.sha512.create();case"RSASSA-PSS":return ne.md.sha256.create();default:var t=Error("Could not compute "+e.type+" digest. Unknown signature OID.");throw t.signatureOid=e.signatureOid,t}},Yu=function(e){var t=e.certificate,n;switch(t.signatureOid){case Re.sha1WithRSAEncryption:case Re.sha1WithRSASignature:break;case Re["RSASSA-PSS"]:var r,i;if(r=Re[t.signatureParameters.mgf.hash.algorithmOid],r===void 0||ne.md[r]===void 0){var s=Error("Unsupported MGF hash function.");throw s.oid=t.signatureParameters.mgf.hash.algorithmOid,s.name=r,s}if(i=Re[t.signatureParameters.mgf.algorithmOid],i===void 0||ne.mgf[i]===void 0){var s=Error("Unsupported MGF function.");throw s.oid=t.signatureParameters.mgf.algorithmOid,s.name=i,s}if(i=ne.mgf[i].create(ne.md[r].create()),r=Re[t.signatureParameters.hash.algorithmOid],r===void 0||ne.md[r]===void 0){var s=Error("Unsupported RSASSA-PSS hash function.");throw s.oid=t.signatureParameters.hash.algorithmOid,s.name=r,s}n=ne.pss.create(ne.md[r].create(),i,t.signatureParameters.saltLength);break}return t.publicKey.verify(e.md.digest().getBytes(),e.signature,n)};F.certificateFromPem=function(e,t,n){var r=ne.pem.decode(e)[0];if(r.type!=="CERTIFICATE"&&r.type!=="X509 CERTIFICATE"&&r.type!=="TRUSTED CERTIFICATE"){var i=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw i.headerType=r.type,i}if(r.procType&&r.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var s=h.fromDer(r.body,n);return F.certificateFromAsn1(s,t)};F.certificateToPem=function(e,t){var n={type:"CERTIFICATE",body:h.toDer(F.certificateToAsn1(e)).getBytes()};return ne.pem.encode(n,{maxline:t})};F.publicKeyFromPem=function(e){var t=ne.pem.decode(e)[0];if(t.type!=="PUBLIC KEY"&&t.type!=="RSA PUBLIC KEY"){var n=Error('Could not convert public key from PEM; PEM header type is not "PUBLIC KEY" or "RSA PUBLIC KEY".');throw n.headerType=t.type,n}if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert public key from PEM; PEM is encrypted.");var r=h.fromDer(t.body);return F.publicKeyFromAsn1(r)};F.publicKeyToPem=function(e,t){var n={type:"PUBLIC KEY",body:h.toDer(F.publicKeyToAsn1(e)).getBytes()};return ne.pem.encode(n,{maxline:t})};F.publicKeyToRSAPublicKeyPem=function(e,t){var n={type:"RSA PUBLIC KEY",body:h.toDer(F.publicKeyToRSAPublicKey(e)).getBytes()};return ne.pem.encode(n,{maxline:t})};F.getPublicKeyFingerprint=function(e,t){t=t||{};var n=t.md||ne.md.sha1.create(),r=t.type||"RSAPublicKey",i;switch(r){case"RSAPublicKey":i=h.toDer(F.publicKeyToRSAPublicKey(e)).getBytes();break;case"SubjectPublicKeyInfo":i=h.toDer(F.publicKeyToAsn1(e)).getBytes();break;default:throw Error('Unknown fingerprint type "'+t.type+'".')}n.start(),n.update(i);var s=n.digest();if(t.encoding==="hex"){var a=s.toHex();if(t.delimiter)return a.match(/.{2}/g).join(t.delimiter);return a}else if(t.encoding==="binary")return s.getBytes();else if(t.encoding)throw Error('Unknown encoding "'+t.encoding+'".');return s};F.certificationRequestFromPem=function(e,t,n){var r=ne.pem.decode(e)[0];if(r.type!=="CERTIFICATE REQUEST"){var i=Error('Could not convert certification request from PEM; PEM header type is not "CERTIFICATE REQUEST".');throw i.headerType=r.type,i}if(r.procType&&r.procType.type==="ENCRYPTED")throw Error("Could not convert certification request from PEM; PEM is encrypted.");var s=h.fromDer(r.body,n);return F.certificationRequestFromAsn1(s,t)};F.certificationRequestToPem=function(e,t){var n={type:"CERTIFICATE REQUEST",body:h.toDer(F.certificationRequestToAsn1(e)).getBytes()};return ne.pem.encode(n,{maxline:t})};F.createCertificate=function(){var e={};return e.version=2,e.serialNumber="00",e.signatureOid=null,e.signature=null,e.siginfo={},e.siginfo.algorithmOid=null,e.validity={},e.validity.notBefore=new Date,e.validity.notAfter=new Date,e.issuer={},e.issuer.getField=function(t){return Ur(e.issuer,t)},e.issuer.addField=function(t){Ut([t]),e.issuer.attributes.push(t)},e.issuer.attributes=[],e.issuer.hash=null,e.subject={},e.subject.getField=function(t){return Ur(e.subject,t)},e.subject.addField=function(t){Ut([t]),e.subject.attributes.push(t)},e.subject.attributes=[],e.subject.hash=null,e.extensions=[],e.publicKey=null,e.md=null,e.setSubject=function(t,n){if(Ut(t),e.subject.attributes=t,delete e.subject.uniqueId,n)e.subject.uniqueId=n;e.subject.hash=null},e.setIssuer=function(t,n){if(Ut(t),e.issuer.attributes=t,delete e.issuer.uniqueId,n)e.issuer.uniqueId=n;e.issuer.hash=null},e.setExtensions=function(t){for(var n=0;n<t.length;++n)Ju(t[n],{cert:e});e.extensions=t},e.getExtension=function(t){if(typeof t==="string")t={name:t};var n=null,r;for(var i=0;n===null&&i<e.extensions.length;++i)if(r=e.extensions[i],t.id&&r.id===t.id)n=r;else if(t.name&&r.name===t.name)n=r;return n},e.sign=function(t,n){e.md=n||ne.md.sha1.create();var r=Re[e.md.algorithm+"WithRSAEncryption"];if(!r){var i=Error("Could not compute certificate digest. Unknown message digest algorithm OID.");throw i.algorithm=e.md.algorithm,i}e.signatureOid=e.siginfo.algorithmOid=r,e.tbsCertificate=F.getTBSCertificate(e);var s=h.toDer(e.tbsCertificate);e.md.update(s.getBytes()),e.signature=t.sign(e.md)},e.verify=function(t){var n=!1;if(!e.issued(t)){var r=t.issuer,i=e.subject,s=Error("The parent certificate did not issue the given child certificate; the child certificate's issuer does not match the parent's subject.");throw s.expectedIssuer=i.attributes,s.actualIssuer=r.attributes,s}var a=t.md;if(a===null){a=Ms({signatureOid:t.signatureOid,type:"certificate"});var o=t.tbsCertificate||F.getTBSCertificate(t),l=h.toDer(o);a.update(l.getBytes())}if(a!==null)n=Yu({certificate:e,md:a,signature:t.signature});return n},e.isIssuer=function(t){var n=!1,r=e.issuer,i=t.subject;if(r.hash&&i.hash)n=r.hash===i.hash;else if(r.attributes.length===i.attributes.length){n=!0;var s,a;for(var o=0;n&&o<r.attributes.length;++o)if(s=r.attributes[o],a=i.attributes[o],s.type!==a.type||s.value!==a.value)n=!1}return n},e.issued=function(t){return t.isIssuer(e)},e.generateSubjectKeyIdentifier=function(){return F.getPublicKeyFingerprint(e.publicKey,{type:"RSAPublicKey"})},e.verifySubjectKeyIdentifier=function(){var t=Re.subjectKeyIdentifier;for(var n=0;n<e.extensions.length;++n){var r=e.extensions[n];if(r.id===t){var i=e.generateSubjectKeyIdentifier().getBytes();return ne.util.hexToBytes(r.subjectKeyIdentifier)===i}}return!1},e};F.certificateFromAsn1=function(e,t){var n={},r=[];if(!h.validate(e,Om,n,r)){var i=Error("Cannot read X.509 certificate. ASN.1 object is not an X509v3 Certificate.");throw i.errors=r,i}var s=h.derToOid(n.publicKeyOid);if(s!==F.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var a=F.createCertificate();a.version=n.certVersion?n.certVersion.charCodeAt(0):0;var o=ne.util.createBuffer(n.certSerialNumber);a.serialNumber=o.toHex(),a.signatureOid=ne.asn1.derToOid(n.certSignatureOid),a.signatureParameters=Fs(a.signatureOid,n.certSignatureParams,!0),a.siginfo.algorithmOid=ne.asn1.derToOid(n.certinfoSignatureOid),a.siginfo.parameters=Fs(a.siginfo.algorithmOid,n.certinfoSignatureParams,!1),a.signature=n.certSignature;var l=[];if(n.certValidity1UTCTime!==void 0)l.push(h.utcTimeToDate(n.certValidity1UTCTime));if(n.certValidity2GeneralizedTime!==void 0)l.push(h.generalizedTimeToDate(n.certValidity2GeneralizedTime));if(n.certValidity3UTCTime!==void 0)l.push(h.utcTimeToDate(n.certValidity3UTCTime));if(n.certValidity4GeneralizedTime!==void 0)l.push(h.generalizedTimeToDate(n.certValidity4GeneralizedTime));if(l.length>2)throw Error("Cannot read notBefore/notAfter validity times; more than two times were provided in the certificate.");if(l.length<2)throw Error("Cannot read notBefore/notAfter validity times; they were not provided as either UTCTime or GeneralizedTime.");if(a.validity.notBefore=l[0],a.validity.notAfter=l[1],a.tbsCertificate=n.tbsCertificate,t){a.md=Ms({signatureOid:a.signatureOid,type:"certificate"});var c=h.toDer(a.tbsCertificate);a.md.update(c.getBytes())}var u=ne.md.sha1.create(),d=h.toDer(n.certIssuer);if(u.update(d.getBytes()),a.issuer.getField=function(p){return Ur(a.issuer,p)},a.issuer.addField=function(p){Ut([p]),a.issuer.attributes.push(p)},a.issuer.attributes=F.RDNAttributesAsArray(n.certIssuer),n.certIssuerUniqueId)a.issuer.uniqueId=n.certIssuerUniqueId;a.issuer.hash=u.digest().toHex();var f=ne.md.sha1.create(),y=h.toDer(n.certSubject);if(f.update(y.getBytes()),a.subject.getField=function(p){return Ur(a.subject,p)},a.subject.addField=function(p){Ut([p]),a.subject.attributes.push(p)},a.subject.attributes=F.RDNAttributesAsArray(n.certSubject),n.certSubjectUniqueId)a.subject.uniqueId=n.certSubjectUniqueId;if(a.subject.hash=f.digest().toHex(),n.certExtensions)a.extensions=F.certificateExtensionsFromAsn1(n.certExtensions);else a.extensions=[];return a.publicKey=F.publicKeyFromAsn1(n.subjectPublicKeyInfo),a};F.certificateExtensionsFromAsn1=function(e){var t=[];for(var n=0;n<e.value.length;++n){var r=e.value[n];for(var i=0;i<r.value.length;++i)t.push(F.certificateExtensionFromAsn1(r.value[i]))}return t};F.certificateExtensionFromAsn1=function(e){var t={};if(t.id=h.derToOid(e.value[0].value),t.critical=!1,e.value[1].type===h.Type.BOOLEAN)t.critical=e.value[1].value.charCodeAt(0)!==0,t.value=e.value[2].value;else t.value=e.value[1].value;if(t.id in Re){if(t.name=Re[t.id],t.name==="keyUsage"){var n=h.fromDer(t.value),r=0,i=0;if(n.value.length>1)r=n.value.charCodeAt(1),i=n.value.length>2?n.value.charCodeAt(2):0;t.digitalSignature=(r&128)===128,t.nonRepudiation=(r&64)===64,t.keyEncipherment=(r&32)===32,t.dataEncipherment=(r&16)===16,t.keyAgreement=(r&8)===8,t.keyCertSign=(r&4)===4,t.cRLSign=(r&2)===2,t.encipherOnly=(r&1)===1,t.decipherOnly=(i&128)===128}else if(t.name==="basicConstraints"){var n=h.fromDer(t.value);if(n.value.length>0&&n.value[0].type===h.Type.BOOLEAN)t.cA=n.value[0].value.charCodeAt(0)!==0;else t.cA=!1;var s=null;if(n.value.length>0&&n.value[0].type===h.Type.INTEGER)s=n.value[0].value;else if(n.value.length>1)s=n.value[1].value;if(s!==null)t.pathLenConstraint=h.derToInteger(s)}else if(t.name==="extKeyUsage"){var n=h.fromDer(t.value);for(var a=0;a<n.value.length;++a){var o=h.derToOid(n.value[a].value);if(o in Re)t[Re[o]]=!0;else t[o]=!0}}else if(t.name==="nsCertType"){var n=h.fromDer(t.value),r=0;if(n.value.length>1)r=n.value.charCodeAt(1);t.client=(r&128)===128,t.server=(r&64)===64,t.email=(r&32)===32,t.objsign=(r&16)===16,t.reserved=(r&8)===8,t.sslCA=(r&4)===4,t.emailCA=(r&2)===2,t.objCA=(r&1)===1}else if(t.name==="subjectAltName"||t.name==="issuerAltName"){t.altNames=[];var l,n=h.fromDer(t.value);for(var c=0;c<n.value.length;++c){l=n.value[c];var u={type:l.type,value:l.value};switch(t.altNames.push(u),l.type){case 1:case 2:case 6:break;case 7:u.ip=ne.util.bytesToIP(l.value);break;case 8:u.oid=h.derToOid(l.value);break;default:}}}else if(t.name==="subjectKeyIdentifier"){var n=h.fromDer(t.value);t.subjectKeyIdentifier=ne.util.bytesToHex(n.value)}}return t};F.certificationRequestFromAsn1=function(e,t){var n={},r=[];if(!h.validate(e,Fm,n,r)){var i=Error("Cannot read PKCS#10 certificate request. ASN.1 object is not a PKCS#10 CertificationRequest.");throw i.errors=r,i}var s=h.derToOid(n.publicKeyOid);if(s!==F.oids.rsaEncryption)throw Error("Cannot read public key. OID is not RSA.");var a=F.createCertificationRequest();if(a.version=n.csrVersion?n.csrVersion.charCodeAt(0):0,a.signatureOid=ne.asn1.derToOid(n.csrSignatureOid),a.signatureParameters=Fs(a.signatureOid,n.csrSignatureParams,!0),a.siginfo.algorithmOid=ne.asn1.derToOid(n.csrSignatureOid),a.siginfo.parameters=Fs(a.siginfo.algorithmOid,n.csrSignatureParams,!1),a.signature=n.csrSignature,a.certificationRequestInfo=n.certificationRequestInfo,t){a.md=Ms({signatureOid:a.signatureOid,type:"certification request"});var o=h.toDer(a.certificationRequestInfo);a.md.update(o.getBytes())}var l=ne.md.sha1.create();return a.subject.getField=function(c){return Ur(a.subject,c)},a.subject.addField=function(c){Ut([c]),a.subject.attributes.push(c)},a.subject.attributes=F.RDNAttributesAsArray(n.certificationRequestInfoSubject,l),a.subject.hash=l.digest().toHex(),a.publicKey=F.publicKeyFromAsn1(n.subjectPublicKeyInfo),a.getAttribute=function(c){return Ur(a,c)},a.addAttribute=function(c){Ut([c]),a.attributes.push(c)},a.attributes=F.CRIAttributesAsArray(n.certificationRequestInfoAttributes||[]),a};F.createCertificationRequest=function(){var e={};return e.version=0,e.signatureOid=null,e.signature=null,e.siginfo={},e.siginfo.algorithmOid=null,e.subject={},e.subject.getField=function(t){return Ur(e.subject,t)},e.subject.addField=function(t){Ut([t]),e.subject.attributes.push(t)},e.subject.attributes=[],e.subject.hash=null,e.publicKey=null,e.attributes=[],e.getAttribute=function(t){return Ur(e,t)},e.addAttribute=function(t){Ut([t]),e.attributes.push(t)},e.md=null,e.setSubject=function(t){Ut(t),e.subject.attributes=t,e.subject.hash=null},e.setAttributes=function(t){Ut(t),e.attributes=t},e.sign=function(t,n){e.md=n||ne.md.sha1.create();var r=Re[e.md.algorithm+"WithRSAEncryption"];if(!r){var i=Error("Could not compute certification request digest. Unknown message digest algorithm OID.");throw i.algorithm=e.md.algorithm,i}e.signatureOid=e.siginfo.algorithmOid=r,e.certificationRequestInfo=F.getCertificationRequestInfo(e);var s=h.toDer(e.certificationRequestInfo);e.md.update(s.getBytes()),e.signature=t.sign(e.md)},e.verify=function(){var t=!1,n=e.md;if(n===null){n=Ms({signatureOid:e.signatureOid,type:"certification request"});var r=e.certificationRequestInfo||F.getCertificationRequestInfo(e),i=h.toDer(r);n.update(i.getBytes())}if(n!==null)t=Yu({certificate:e,md:n,signature:e.signature});return t},e};function Pn(e){var t=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]),n,r,i=e.attributes;for(var s=0;s<i.length;++s){n=i[s];var a=n.value,o=h.Type.PRINTABLESTRING;if("valueTagClass"in n){if(o=n.valueTagClass,o===h.Type.UTF8)a=ne.util.encodeUtf8(a)}r=h.create(h.Class.UNIVERSAL,h.Type.SET,!0,[h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(n.type).getBytes()),h.create(h.Class.UNIVERSAL,o,!1,a)])]),t.value.push(r)}return t}function Ut(e){var t;for(var n=0;n<e.length;++n){if(t=e[n],typeof t.name>"u"){if(t.type&&t.type in F.oids)t.name=F.oids[t.type];else if(t.shortName&&t.shortName in Je)t.name=F.oids[Je[t.shortName]]}if(typeof t.type>"u")if(t.name&&t.name in F.oids)t.type=F.oids[t.name];else{var r=Error("Attribute type not specified.");throw r.attribute=t,r}if(typeof t.shortName>"u"){if(t.name&&t.name in Je)t.shortName=Je[t.name]}if(t.type===Re.extensionRequest){if(t.valueConstructed=!0,t.valueTagClass=h.Type.SEQUENCE,!t.value&&t.extensions){t.value=[];for(var i=0;i<t.extensions.length;++i)t.value.push(F.certificateExtensionToAsn1(Ju(t.extensions[i])))}}if(typeof t.value>"u"){var r=Error("Attribute value not specified.");throw r.attribute=t,r}}}function Ju(e,t){if(t=t||{},typeof e.name>"u"){if(e.id&&e.id in F.oids)e.name=F.oids[e.id]}if(typeof e.id>"u")if(e.name&&e.name in F.oids)e.id=F.oids[e.name];else{var n=Error("Extension ID not specified.");throw n.extension=e,n}if(typeof e.value<"u")return e;if(e.name==="keyUsage"){var r=0,i=0,s=0;if(e.digitalSignature)i|=128,r=7;if(e.nonRepudiation)i|=64,r=6;if(e.keyEncipherment)i|=32,r=5;if(e.dataEncipherment)i|=16,r=4;if(e.keyAgreement)i|=8,r=3;if(e.keyCertSign)i|=4,r=2;if(e.cRLSign)i|=2,r=1;if(e.encipherOnly)i|=1,r=0;if(e.decipherOnly)s|=128,r=7;var a=String.fromCharCode(r);if(s!==0)a+=String.fromCharCode(i)+String.fromCharCode(s);else if(i!==0)a+=String.fromCharCode(i);e.value=h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,a)}else if(e.name==="basicConstraints"){if(e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]),e.cA)e.value.value.push(h.create(h.Class.UNIVERSAL,h.Type.BOOLEAN,!1,String.fromCharCode(255)));if("pathLenConstraint"in e)e.value.value.push(h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,h.integerToDer(e.pathLenConstraint).getBytes()))}else if(e.name==="extKeyUsage"){e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);var o=e.value.value;for(var l in e){if(e[l]!==!0)continue;if(l in Re)o.push(h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(Re[l]).getBytes()));else if(l.indexOf(".")!==-1)o.push(h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(l).getBytes()))}}else if(e.name==="nsCertType"){var r=0,i=0;if(e.client)i|=128,r=7;if(e.server)i|=64,r=6;if(e.email)i|=32,r=5;if(e.objsign)i|=16,r=4;if(e.reserved)i|=8,r=3;if(e.sslCA)i|=4,r=2;if(e.emailCA)i|=2,r=1;if(e.objCA)i|=1,r=0;var a=String.fromCharCode(r);if(i!==0)a+=String.fromCharCode(i);e.value=h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,a)}else if(e.name==="subjectAltName"||e.name==="issuerAltName"){e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);var c;for(var u=0;u<e.altNames.length;++u){c=e.altNames[u];var a=c.value;if(c.type===7&&c.ip){if(a=ne.util.bytesFromIP(c.ip),a===null){var n=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw n.extension=e,n}}else if(c.type===8)if(c.oid)a=h.oidToDer(h.oidToDer(c.oid));else a=h.oidToDer(a);e.value.value.push(h.create(h.Class.CONTEXT_SPECIFIC,c.type,!1,a))}}else if(e.name==="nsComment"&&t.cert){if(!/^[\x00-\x7F]*$/.test(e.comment)||e.comment.length<1||e.comment.length>128)throw Error('Invalid "nsComment" content.');e.value=h.create(h.Class.UNIVERSAL,h.Type.IA5STRING,!1,e.comment)}else if(e.name==="subjectKeyIdentifier"&&t.cert){var d=t.cert.generateSubjectKeyIdentifier();e.subjectKeyIdentifier=d.toHex(),e.value=h.create(h.Class.UNIVERSAL,h.Type.OCTETSTRING,!1,d.getBytes())}else if(e.name==="authorityKeyIdentifier"&&t.cert){e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);var o=e.value.value;if(e.keyIdentifier){var f=e.keyIdentifier===!0?t.cert.generateSubjectKeyIdentifier().getBytes():e.keyIdentifier;o.push(h.create(h.Class.CONTEXT_SPECIFIC,0,!1,f))}if(e.authorityCertIssuer){var y=[h.create(h.Class.CONTEXT_SPECIFIC,4,!0,[Pn(e.authorityCertIssuer===!0?t.cert.issuer:e.authorityCertIssuer)])];o.push(h.create(h.Class.CONTEXT_SPECIFIC,1,!0,y))}if(e.serialNumber){var p=ne.util.hexToBytes(e.serialNumber===!0?t.cert.serialNumber:e.serialNumber);o.push(h.create(h.Class.CONTEXT_SPECIFIC,2,!1,p))}}else if(e.name==="cRLDistributionPoints"){e.value=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);var o=e.value.value,v=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]),x=h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[]),c;for(var u=0;u<e.altNames.length;++u){c=e.altNames[u];var a=c.value;if(c.type===7&&c.ip){if(a=ne.util.bytesFromIP(c.ip),a===null){var n=Error('Extension "ip" value is not a valid IPv4 or IPv6 address.');throw n.extension=e,n}}else if(c.type===8)if(c.oid)a=h.oidToDer(h.oidToDer(c.oid));else a=h.oidToDer(a);x.value.push(h.create(h.Class.CONTEXT_SPECIFIC,c.type,!1,a))}v.value.push(h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[x])),o.push(v)}if(typeof e.value>"u"){var n=Error("Extension value not specified.");throw n.extension=e,n}return e}function _o(e,t){switch(e){case Re["RSASSA-PSS"]:var n=[];if(t.hash.algorithmOid!==void 0)n.push(h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(t.hash.algorithmOid).getBytes()),h.create(h.Class.UNIVERSAL,h.Type.NULL,!1,"")])]));if(t.mgf.algorithmOid!==void 0)n.push(h.create(h.Class.CONTEXT_SPECIFIC,1,!0,[h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(t.mgf.algorithmOid).getBytes()),h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(t.mgf.hash.algorithmOid).getBytes()),h.create(h.Class.UNIVERSAL,h.Type.NULL,!1,"")])])]));if(t.saltLength!==void 0)n.push(h.create(h.Class.CONTEXT_SPECIFIC,2,!0,[h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,h.integerToDer(t.saltLength).getBytes())]));return h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,n);default:return h.create(h.Class.UNIVERSAL,h.Type.NULL,!1,"")}}function Mm(e){var t=h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[]);if(e.attributes.length===0)return t;var n=e.attributes;for(var r=0;r<n.length;++r){var i=n[r],s=i.value,a=h.Type.UTF8;if("valueTagClass"in i)a=i.valueTagClass;if(a===h.Type.UTF8)s=ne.util.encodeUtf8(s);var o=!1;if("valueConstructed"in i)o=i.valueConstructed;var l=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(i.type).getBytes()),h.create(h.Class.UNIVERSAL,h.Type.SET,!0,[h.create(h.Class.UNIVERSAL,a,o,s)])]);t.value.push(l)}return t}var Wm=new Date("1950-01-01T00:00:00Z"),$m=new Date("2050-01-01T00:00:00Z");function Qu(e){if(e>=Wm&&e<$m)return h.create(h.Class.UNIVERSAL,h.Type.UTCTIME,!1,h.dateToUtcTime(e));else return h.create(h.Class.UNIVERSAL,h.Type.GENERALIZEDTIME,!1,h.dateToGeneralizedTime(e))}F.getTBSCertificate=function(e){var t=Qu(e.validity.notBefore),n=Qu(e.validity.notAfter),r=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.CONTEXT_SPECIFIC,0,!0,[h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,h.integerToDer(e.version).getBytes())]),h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,ne.util.hexToBytes(e.serialNumber)),h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(e.siginfo.algorithmOid).getBytes()),_o(e.siginfo.algorithmOid,e.siginfo.parameters)]),Pn(e.issuer),h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[t,n]),Pn(e.subject),F.publicKeyToAsn1(e.publicKey)]);if(e.issuer.uniqueId)r.value.push(h.create(h.Class.CONTEXT_SPECIFIC,1,!0,[h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,String.fromCharCode(0)+e.issuer.uniqueId)]));if(e.subject.uniqueId)r.value.push(h.create(h.Class.CONTEXT_SPECIFIC,2,!0,[h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,String.fromCharCode(0)+e.subject.uniqueId)]));if(e.extensions.length>0)r.value.push(F.certificateExtensionsToAsn1(e.extensions));return r};F.getCertificationRequestInfo=function(e){var t=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.INTEGER,!1,h.integerToDer(e.version).getBytes()),Pn(e.subject),F.publicKeyToAsn1(e.publicKey),Mm(e)]);return t};F.distinguishedNameToAsn1=function(e){return Pn(e)};F.certificateToAsn1=function(e){var t=e.tbsCertificate||F.getTBSCertificate(e);return h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[t,h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(e.signatureOid).getBytes()),_o(e.signatureOid,e.signatureParameters)]),h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,String.fromCharCode(0)+e.signature)])};F.certificateExtensionsToAsn1=function(e){var t=h.create(h.Class.CONTEXT_SPECIFIC,3,!0,[]),n=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);t.value.push(n);for(var r=0;r<e.length;++r)n.value.push(F.certificateExtensionToAsn1(e[r]));return t};F.certificateExtensionToAsn1=function(e){var t=h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[]);if(t.value.push(h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(e.id).getBytes())),e.critical)t.value.push(h.create(h.Class.UNIVERSAL,h.Type.BOOLEAN,!1,String.fromCharCode(255)));var n=e.value;if(typeof e.value!=="string")n=h.toDer(n).getBytes();return t.value.push(h.create(h.Class.UNIVERSAL,h.Type.OCTETSTRING,!1,n)),t};F.certificationRequestToAsn1=function(e){var t=e.certificationRequestInfo||F.getCertificationRequestInfo(e);return h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[t,h.create(h.Class.UNIVERSAL,h.Type.SEQUENCE,!0,[h.create(h.Class.UNIVERSAL,h.Type.OID,!1,h.oidToDer(e.signatureOid).getBytes()),_o(e.signatureOid,e.signatureParameters)]),h.create(h.Class.UNIVERSAL,h.Type.BITSTRING,!1,String.fromCharCode(0)+e.signature)])};F.createCaStore=function(e){var t={certs:{}};t.getIssuer=function(a){var o=n(a.issuer);return o},t.addCertificate=function(a){if(typeof a==="string")a=ne.pki.certificateFromPem(a);if(r(a.subject),!t.hasCertificate(a))if(a.subject.hash in t.certs){var o=t.certs[a.subject.hash];if(!ne.util.isArray(o))o=[o];o.push(a),t.certs[a.subject.hash]=o}else t.certs[a.subject.hash]=a},t.hasCertificate=function(a){if(typeof a==="string")a=ne.pki.certificateFromPem(a);var o=n(a.subject);if(!o)return!1;if(!ne.util.isArray(o))o=[o];var l=h.toDer(F.certificateToAsn1(a)).getBytes();for(var c=0;c<o.length;++c){var u=h.toDer(F.certificateToAsn1(o[c])).getBytes();if(l===u)return!0}return!1},t.listAllCertificates=function(){var a=[];for(var o in t.certs)if(t.certs.hasOwnProperty(o)){var l=t.certs[o];if(!ne.util.isArray(l))a.push(l);else for(var c=0;c<l.length;++c)a.push(l[c])}return a},t.removeCertificate=function(a){var o;if(typeof a==="string")a=ne.pki.certificateFromPem(a);if(r(a.subject),!t.hasCertificate(a))return null;var l=n(a.subject);if(!ne.util.isArray(l))return o=t.certs[a.subject.hash],delete t.certs[a.subject.hash],o;var c=h.toDer(F.certificateToAsn1(a)).getBytes();for(var u=0;u<l.length;++u){var d=h.toDer(F.certificateToAsn1(l[u])).getBytes();if(c===d)o=l[u],l.splice(u,1)}if(l.length===0)delete t.certs[a.subject.hash];return o};function n(a){return r(a),t.certs[a.hash]||null}function r(a){if(!a.hash){var o=ne.md.sha1.create();a.attributes=F.RDNAttributesAsArray(Pn(a),o),a.hash=o.digest().toHex()}}if(e)for(var i=0;i<e.length;++i){var s=e[i];t.addCertificate(s)}return t};F.certificateError={bad_certificate:"forge.pki.BadCertificate",unsupported_certificate:"forge.pki.UnsupportedCertificate",certificate_revoked:"forge.pki.CertificateRevoked",certificate_expired:"forge.pki.CertificateExpired",certificate_unknown:"forge.pki.CertificateUnknown",unknown_ca:"forge.pki.UnknownCertificateAuthority"};F.verifyCertificateChain=function(e,t,n){if(typeof n==="function")n={verify:n};n=n||{},t=t.slice(0);var r=t.slice(0),i=n.validityCheckDate;if(typeof i>"u")i=new Date;var s=!0,a=null,o=0;do{var l=t.shift(),c=null,u=!1;if(i){if(i<l.validity.notBefore||i>l.validity.notAfter)a={message:"Certificate is not valid yet or has expired.",error:F.certificateError.certificate_expired,notBefore:l.validity.notBefore,notAfter:l.validity.notAfter,now:i}}if(a===null){if(c=t[0]||e.getIssuer(l),c===null){if(l.isIssuer(l))u=!0,c=l}if(c){var d=c;if(!ne.util.isArray(d))d=[d];var f=!1;while(!f&&d.length>0){c=d.shift();try{f=c.verify(l)}catch(I){}}if(!f)a={message:"Certificate signature is invalid.",error:F.certificateError.bad_certificate}}if(a===null&&(!c||u)&&!e.hasCertificate(l))a={message:"Certificate is not trusted.",error:F.certificateError.unknown_ca}}if(a===null&&c&&!l.isIssuer(c))a={message:"Certificate issuer is invalid.",error:F.certificateError.bad_certificate};if(a===null){var y={keyUsage:!0,basicConstraints:!0};for(var p=0;a===null&&p<l.extensions.length;++p){var v=l.extensions[p];if(v.critical&&!(v.name in y))a={message:"Certificate has an unsupported critical extension.",error:F.certificateError.unsupported_certificate}}}if(a===null&&(!s||t.length===0&&(!c||u))){var x=l.getExtension("basicConstraints"),b=l.getExtension("keyUsage");if(b!==null){if(!b.keyCertSign||x===null)a={message:"Certificate keyUsage or basicConstraints conflict or indicate that the certificate is not a CA. If the certificate is the only one in the chain or isn't the first then the certificate must be a valid CA.",error:F.certificateError.bad_certificate}}if(a===null&&x===null)a={message:"Certificate is missing basicConstraints extension and cannot be used as a CA.",error:F.certificateError.bad_certificate};if(a===null&&x!==null&&!x.cA)a={message:"Certificate basicConstraints indicates the certificate is not a CA.",error:F.certificateError.bad_certificate};if(a===null&&b!==null&&"pathLenConstraint"in x){var A=o-1;if(A>x.pathLenConstraint)a={message:"Certificate basicConstraints pathLenConstraint violated.",error:F.certificateError.bad_certificate}}}var E=a===null?!0:a.error,k=n.verify?n.verify(E,o,r):E;if(k===!0)a=null;else{if(E===!0)a={message:"The application rejected the certificate.",error:F.certificateError.bad_certificate};if(k||k===0){if(typeof k==="object"&&!ne.util.isArray(k)){if(k.message)a.message=k.message;if(k.error)a.error=k.error}else if(typeof k==="string")a.error=k}throw a}s=!1,++o}while(t.length>0);return!0}});var Io=fe(function(u1,td){var Ke=me();Kt();Tn();Dr();To();wo();Dt();Si();In();Be();Ws();var{asn1:S,pki:Ce}=Ke,Ci=td.exports=Ke.pkcs12=Ke.pkcs12||{},ed={name:"ContentInfo",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"ContentInfo.contentType",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"contentType"},{name:"ContentInfo.content",tagClass:S.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"content"}]},Hm={name:"PFX",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.version",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,capture:"version"},ed,{name:"PFX.macData",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,optional:!0,captureAsn1:"mac",value:[{name:"PFX.macData.mac",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"PFX.macData.mac.digestAlgorithm.algorithm",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"macAlgorithm"},{name:"PFX.macData.mac.digestAlgorithm.parameters",optional:!0,tagClass:S.Class.UNIVERSAL,captureAsn1:"macAlgorithmParameters"}]},{name:"PFX.macData.mac.digest",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"macDigest"}]},{name:"PFX.macData.macSalt",tagClass:S.Class.UNIVERSAL,type:S.Type.OCTETSTRING,constructed:!1,capture:"macSalt"},{name:"PFX.macData.iterations",tagClass:S.Class.UNIVERSAL,type:S.Type.INTEGER,constructed:!1,optional:!0,capture:"macIterations"}]}]},Km={name:"SafeBag",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"SafeBag.bagId",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"bagId"},{name:"SafeBag.bagValue",tagClass:S.Class.CONTEXT_SPECIFIC,constructed:!0,captureAsn1:"bagValue"},{name:"SafeBag.bagAttributes",tagClass:S.Class.UNIVERSAL,type:S.Type.SET,constructed:!0,optional:!0,capture:"bagAttributes"}]},qm={name:"Attribute",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"Attribute.attrId",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"oid"},{name:"Attribute.attrValues",tagClass:S.Class.UNIVERSAL,type:S.Type.SET,constructed:!0,capture:"values"}]},Gm={name:"CertBag",tagClass:S.Class.UNIVERSAL,type:S.Type.SEQUENCE,constructed:!0,value:[{name:"CertBag.certId",tagClass:S.Class.UNIVERSAL,type:S.Type.OID,constructed:!1,capture:"certId"},{name:"CertBag.certValue",tagClass:S.Class.CONTEXT_SPECIFIC,constructed:!0,value:[{name:"CertBag.certValue[0]",tagClass:S.Class.UNIVERSAL,type:S.Class.OCTETSTRING,constructed:!1,capture:"cert"}]}]};function bi(e,t,n,r){var i=[];for(var s=0;s<e.length;s++)for(var a=0;a<e[s].safeBags.length;a++){var o=e[s].safeBags[a];if(r!==void 0&&o.type!==r)continue;if(t===null){i.push(o);continue}if(o.attributes[t]!==void 0&&o.attributes[t].indexOf(n)>=0)i.push(o)}return i}Ci.pkcs12FromAsn1=function(e,t,n){if(typeof t==="string")n=t,t=!0;else if(t===void 0)t=!0;var r={},i=[];if(!S.validate(e,Hm,r,i)){var s=Error("Cannot read PKCS#12 PFX. ASN.1 object is not an PKCS#12 PFX.");throw s.errors=s,s}var a={version:r.version.charCodeAt(0),safeContents:[],getBags:function(x){var b={},A;if("localKeyId"in x)A=x.localKeyId;else if("localKeyIdHex"in x)A=Ke.util.hexToBytes(x.localKeyIdHex);if(A===void 0&&!("friendlyName"in x)&&"bagType"in x)b[x.bagType]=bi(a.safeContents,null,null,x.bagType);if(A!==void 0)b.localKeyId=bi(a.safeContents,"localKeyId",A,x.bagType);if("friendlyName"in x)b.friendlyName=bi(a.safeContents,"friendlyName",x.friendlyName,x.bagType);return b},getBagsByFriendlyName:function(x,b){return bi(a.safeContents,"friendlyName",x,b)},getBagsByLocalKeyId:function(x,b){return bi(a.safeContents,"localKeyId",x,b)}};if(r.version.charCodeAt(0)!==3){var s=Error("PKCS#12 PFX of version other than 3 not supported.");throw s.version=r.version.charCodeAt(0),s}if(S.derToOid(r.contentType)!==Ce.oids.data){var s=Error("Only PKCS#12 PFX in password integrity mode supported.");throw s.oid=S.derToOid(r.contentType),s}var o=r.content.value[0];if(o.tagClass!==S.Class.UNIVERSAL||o.type!==S.Type.OCTETSTRING)throw Error("PKCS#12 authSafe content data is not an OCTET STRING.");if(o=ko(o),r.mac){var l=null,c=0,u=S.derToOid(r.macAlgorithm);switch(u){case Ce.oids.sha1:l=Ke.md.sha1.create(),c=20;break;case Ce.oids.sha256:l=Ke.md.sha256.create(),c=32;break;case Ce.oids.sha384:l=Ke.md.sha384.create(),c=48;break;case Ce.oids.sha512:l=Ke.md.sha512.create(),c=64;break;case Ce.oids.md5:l=Ke.md.md5.create(),c=16;break}if(l===null)throw Error("PKCS#12 uses unsupported MAC algorithm: "+u);var d=new Ke.util.ByteBuffer(r.macSalt),f="macIterations"in r?parseInt(Ke.util.bytesToHex(r.macIterations),16):1,y=Ci.generateKey(n,d,3,f,c,l),p=Ke.hmac.create();p.start(l,y),p.update(o.value);var v=p.getMac();if(v.getBytes()!==r.macDigest)throw Error("PKCS#12 MAC could not be verified. Invalid password?")}else if(Array.isArray(e.value)&&e.value.length>2)throw Error("Invalid PKCS#12. macData field present but MAC was not validated.");return jm(a,o.value,t,n),a};function ko(e){if(e.composed||e.constructed){var t=Ke.util.createBuffer();for(var n=0;n<e.value.length;++n)t.putBytes(e.value[n].value);e.composed=e.constructed=!1,e.value=t.getBytes()}return e}function jm(e,t,n,r){if(t=S.fromDer(t,n),t.tagClass!==S.Class.UNIVERSAL||t.type!==S.Type.SEQUENCE||t.constructed!==!0)throw Error("PKCS#12 AuthenticatedSafe expected to be a SEQUENCE OF ContentInfo");for(var i=0;i<t.value.length;i++){var s=t.value[i],a={},o=[];if(!S.validate(s,ed,a,o)){var l=Error("Cannot read ContentInfo.");throw l.errors=o,l}var c={encrypted:!1},u=null,d=a.content.value[0];switch(S.derToOid(a.contentType)){case Ce.oids.data:if(d.tagClass!==S.Class.UNIVERSAL||d.type!==S.Type.OCTETSTRING)throw Error("PKCS#12 SafeContents Data is not an OCTET STRING.");u=ko(d).value;break;case Ce.oids.encryptedData:u=zm(d,r),c.encrypted=!0;break;default:var l=Error("Unsupported PKCS#12 contentType.");throw l.contentType=S.derToOid(a.contentType),l}c.safeBags=Qm(u,n,r),e.safeContents.push(c)}}function zm(e,t){var n={},r=[];if(!S.validate(e,Ke.pkcs7.asn1.encryptedDataValidator,n,r)){var i=Error("Cannot read EncryptedContentInfo.");throw i.errors=r,i}var s=S.derToOid(n.contentType);if(s!==Ce.oids.data){var i=Error("PKCS#12 EncryptedContentInfo ContentType is not Data.");throw i.oid=s,i}s=S.derToOid(n.encAlgorithm);var a=Ce.pbe.getCipher(s,n.encParameter,t),o=ko(n.encryptedContentAsn1),l=Ke.util.createBuffer(o.value);if(a.update(l),!a.finish())throw Error("Failed to decrypt PKCS#12 SafeContents.");return a.output.getBytes()}function Qm(e,t,n){if(!t&&e.length===0)return[];if(e=S.fromDer(e,t),e.tagClass!==S.Class.UNIVERSAL||e.type!==S.Type.SEQUENCE||e.constructed!==!0)throw Error("PKCS#12 SafeContents expected to be a SEQUENCE OF SafeBag.");var r=[];for(var i=0;i<e.value.length;i++){var s=e.value[i],a={},o=[];if(!S.validate(s,Km,a,o)){var l=Error("Cannot read SafeBag.");throw l.errors=o,l}var c={type:S.derToOid(a.bagId),attributes:Xm(a.bagAttributes)};r.push(c);var u,d,f=a.bagValue.value[0];switch(c.type){case Ce.oids.pkcs8ShroudedKeyBag:if(f=Ce.decryptPrivateKeyInfo(f,n),f===null)throw Error("Unable to decrypt PKCS#8 ShroudedKeyBag, wrong password?");case Ce.oids.keyBag:try{c.key=Ce.privateKeyFromAsn1(f)}catch(p){c.key=null,c.asn1=f}continue;case Ce.oids.certBag:u=Gm,d=function(){if(S.derToOid(a.certId)!==Ce.oids.x509Certificate){var p=Error("Unsupported certificate type, only X.509 supported.");throw p.oid=S.derToOid(a.certId),p}var v=S.fromDer(a.cert,t);try{c.cert=Ce.certificateFromAsn1(v,!0)}catch(x){c.cert=null,c.asn1=v}};break;default:var l=Error("Unsupported PKCS#12 SafeBag type.");throw l.oid=c.type,l}if(u!==void 0&&!S.validate(f,u,a,o)){var l=Error("Cannot read PKCS#12 "+u.name);throw l.errors=o,l}d()}return r}function Xm(e){var t={};if(e!==void 0)for(var n=0;n<e.length;++n){var r={},i=[];if(!S.validate(e[n],qm,r,i)){var s=Error("Cannot read PKCS#12 BagAttribute.");throw s.errors=i,s}var a=S.derToOid(r.oid);if(Ce.oids[a]===void 0)continue;t[Ce.oids[a]]=[];for(var o=0;o<r.values.length;++o)t[Ce.oids[a]].push(r.values[o].value)}return t}Ci.toPkcs12Asn1=function(e,t,n,r){if(r=r||{},r.saltSize=r.saltSize||8,r.count=r.count||2048,r.algorithm=r.algorithm||r.encAlgorithm||"aes128",!("useMac"in r))r.useMac=!0;if(!("localKeyId"in r))r.localKeyId=null;if(!("generateLocalKeyId"in r))r.generateLocalKeyId=!0;var i=r.localKeyId,s;if(i!==null)i=Ke.util.hexToBytes(i);else if(r.generateLocalKeyId)if(t){var a=Ke.util.isArray(t)?t[0]:t;if(typeof a==="string")a=Ce.certificateFromPem(a);var o=Ke.md.sha1.create();o.update(S.toDer(Ce.certificateToAsn1(a)).getBytes()),i=o.digest().getBytes()}else i=Ke.random.getBytes(20);var l=[];if(i!==null)l.push(S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.localKeyId).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SET,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,i)])]));if("friendlyName"in r)l.push(S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.friendlyName).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SET,!0,[S.create(S.Class.UNIVERSAL,S.Type.BMPSTRING,!1,r.friendlyName)])]));if(l.length>0)s=S.create(S.Class.UNIVERSAL,S.Type.SET,!0,l);var c=[],u=[];if(t!==null)if(Ke.util.isArray(t))u=t;else u=[t];var d=[];for(var f=0;f<u.length;++f){if(t=u[f],typeof t==="string")t=Ce.certificateFromPem(t);var y=f===0?s:void 0,p=Ce.certificateToAsn1(t),v=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.certBag).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.x509Certificate).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer(p).getBytes())])])]),y]);d.push(v)}if(d.length>0){var x=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,d),b=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.data).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer(x).getBytes())])]);c.push(b)}var A=null;if(e!==null){var E=Ce.wrapRsaPrivateKey(Ce.privateKeyToAsn1(e));if(n===null)A=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.keyBag).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[E]),s]);else A=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.pkcs8ShroudedKeyBag).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[Ce.encryptPrivateKeyInfo(E,n,r)]),s]);var k=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[A]),I=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.data).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer(k).getBytes())])]);c.push(I)}var R=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,c),M;if(r.useMac){var o=Ke.md.sha1.create(),ee=new Ke.util.ByteBuffer(Ke.random.getBytes(r.saltSize)),O=r.count,e=Ci.generateKey(n,ee,3,O,20),K=Ke.hmac.create();K.start(o,e),K.update(S.toDer(R).getBytes());var ie=K.getMac();M=S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.sha1).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.NULL,!1,"")]),S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,ie.getBytes())]),S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,ee.getBytes()),S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(O).getBytes())])}return S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.INTEGER,!1,S.integerToDer(3).getBytes()),S.create(S.Class.UNIVERSAL,S.Type.SEQUENCE,!0,[S.create(S.Class.UNIVERSAL,S.Type.OID,!1,S.oidToDer(Ce.oids.data).getBytes()),S.create(S.Class.CONTEXT_SPECIFIC,0,!0,[S.create(S.Class.UNIVERSAL,S.Type.OCTETSTRING,!1,S.toDer(R).getBytes())])]),M])};Ci.generateKey=Ke.pbe.generatePkcs12Key});var Bo=fe(function(d1,rd){var Vr=me();Kt();Dr();wo();nn();Bs();Io();Vs();Si();Be();Ws();var Ro=Vr.asn1,Nn=rd.exports=Vr.pki=Vr.pki||{};Nn.pemToDer=function(e){var t=Vr.pem.decode(e)[0];if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert PEM to DER; PEM is encrypted.");return Vr.util.createBuffer(t.body)};Nn.privateKeyFromPem=function(e){var t=Vr.pem.decode(e)[0];if(t.type!=="PRIVATE KEY"&&t.type!=="RSA PRIVATE KEY"){var n=Error('Could not convert private key from PEM; PEM header type is not "PRIVATE KEY" or "RSA PRIVATE KEY".');throw n.headerType=t.type,n}if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert private key from PEM; PEM is encrypted.");var r=Ro.fromDer(t.body);return Nn.privateKeyFromAsn1(r)};Nn.privateKeyToPem=function(e,t){var n={type:"RSA PRIVATE KEY",body:Ro.toDer(Nn.privateKeyToAsn1(e)).getBytes()};return Vr.pem.encode(n,{maxline:t})};Nn.privateKeyInfoToPem=function(e,t){var n={type:"PRIVATE KEY",body:Ro.toDer(e).getBytes()};return Vr.pem.encode(n,{maxline:t})}});var Uo=fe(function(f1,ud){var L=me();Kt();Tn();_s();nn();Bo();Dt();In();Be();var Ks=function(e,t,n,r){var i=L.util.createBuffer(),s=e.length>>1,a=s+(e.length&1),o=e.substr(0,a),l=e.substr(s,a),c=L.util.createBuffer(),u=L.hmac.create();n=t+n;var d=Math.ceil(r/16),f=Math.ceil(r/20);u.start("MD5",o);var y=L.util.createBuffer();c.putBytes(n);for(var p=0;p<d;++p)u.start(null,null),u.update(c.getBytes()),c.putBuffer(u.digest()),u.start(null,null),u.update(c.bytes()+n),y.putBuffer(u.digest());u.start("SHA1",l);var v=L.util.createBuffer();c.clear(),c.putBytes(n);for(var p=0;p<f;++p)u.start(null,null),u.update(c.getBytes()),c.putBuffer(u.digest()),u.start(null,null),u.update(c.bytes()+n),v.putBuffer(u.digest());return i.putBytes(L.util.xorBytes(y.getBytes(),v.getBytes(),r)),i},Ym=function(e,t,n){var r=L.hmac.create();r.start("SHA1",e);var i=L.util.createBuffer();return i.putInt32(t[0]),i.putInt32(t[1]),i.putByte(n.type),i.putByte(n.version.major),i.putByte(n.version.minor),i.putInt16(n.length),i.putBytes(n.fragment.bytes()),r.update(i.getBytes()),r.digest().getBytes()},Jm=function(e,t,n){var r=!1;try{var i=e.deflate(t.fragment.getBytes());t.fragment=L.util.createBuffer(i),t.length=i.length,r=!0}catch(s){}return r},Zm=function(e,t,n){var r=!1;try{var i=e.inflate(t.fragment.getBytes());t.fragment=L.util.createBuffer(i),t.length=i.length,r=!0}catch(s){}return r},It=function(e,t){var n=0;switch(t){case 1:n=e.getByte();break;case 2:n=e.getInt16();break;case 3:n=e.getInt24();break;case 4:n=e.getInt32();break}return L.util.createBuffer(e.getBytes(n))},Vt=function(e,t,n){e.putInt(n.length(),t<<3),e.putBuffer(n)},m={};m.Versions={TLS_1_0:{major:3,minor:1},TLS_1_1:{major:3,minor:2},TLS_1_2:{major:3,minor:3}};m.SupportedVersions=[m.Versions.TLS_1_1,m.Versions.TLS_1_0];m.Version=m.SupportedVersions[0];m.MaxFragment=15360;m.ConnectionEnd={server:0,client:1};m.PRFAlgorithm={tls_prf_sha256:0};m.BulkCipherAlgorithm={none:null,rc4:0,des3:1,aes:2};m.CipherType={stream:0,block:1,aead:2};m.MACAlgorithm={none:null,hmac_md5:0,hmac_sha1:1,hmac_sha256:2,hmac_sha384:3,hmac_sha512:4};m.CompressionMethod={none:0,deflate:1};m.ContentType={change_cipher_spec:20,alert:21,handshake:22,application_data:23,heartbeat:24};m.HandshakeType={hello_request:0,client_hello:1,server_hello:2,certificate:11,server_key_exchange:12,certificate_request:13,server_hello_done:14,certificate_verify:15,client_key_exchange:16,finished:20};m.Alert={};m.Alert.Level={warning:1,fatal:2};m.Alert.Description={close_notify:0,unexpected_message:10,bad_record_mac:20,decryption_failed:21,record_overflow:22,decompression_failure:30,handshake_failure:40,bad_certificate:42,unsupported_certificate:43,certificate_revoked:44,certificate_expired:45,certificate_unknown:46,illegal_parameter:47,unknown_ca:48,access_denied:49,decode_error:50,decrypt_error:51,export_restriction:60,protocol_version:70,insufficient_security:71,internal_error:80,user_canceled:90,no_renegotiation:100};m.HeartbeatMessageType={heartbeat_request:1,heartbeat_response:2};m.CipherSuites={};m.getCipherSuite=function(e){var t=null;for(var n in m.CipherSuites){var r=m.CipherSuites[n];if(r.id[0]===e.charCodeAt(0)&&r.id[1]===e.charCodeAt(1)){t=r;break}}return t};m.handleUnexpected=function(e,t){var n=!e.open&&e.entity===m.ConnectionEnd.client;if(!n)e.error(e,{message:"Unexpected message. Received TLS record out of order.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.unexpected_message}})};m.handleHelloRequest=function(e,t,n){if(!e.handshaking&&e.handshakes>0)m.queue(e,m.createAlert(e,{level:m.Alert.Level.warning,description:m.Alert.Description.no_renegotiation})),m.flush(e);e.process()};m.parseHelloMessage=function(e,t,n){var r=null,i=e.entity===m.ConnectionEnd.client;if(n<38)e.error(e,{message:i?"Invalid ServerHello message. Message too short.":"Invalid ClientHello message. Message too short.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});else{var s=t.fragment,a=s.length();if(r={version:{major:s.getByte(),minor:s.getByte()},random:L.util.createBuffer(s.getBytes(32)),session_id:It(s,1),extensions:[]},i)r.cipher_suite=s.getBytes(2),r.compression_method=s.getByte();else r.cipher_suites=It(s,2),r.compression_methods=It(s,1);if(a=n-(a-s.length()),a>0){var o=It(s,2);while(o.length()>0)r.extensions.push({type:[o.getByte(),o.getByte()],data:It(o,2)});if(!i)for(var l=0;l<r.extensions.length;++l){var c=r.extensions[l];if(c.type[0]===0&&c.type[1]===0){var u=It(c.data,2);while(u.length()>0){var d=u.getByte();if(d!==0)break;e.session.extensions.server_name.serverNameList.push(It(u,2).getBytes())}}}}if(e.session.version){if(r.version.major!==e.session.version.major||r.version.minor!==e.session.version.minor)return e.error(e,{message:"TLS version change is disallowed during renegotiation.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.protocol_version}})}if(i)e.session.cipherSuite=m.getCipherSuite(r.cipher_suite);else{var f=L.util.createBuffer(r.cipher_suites.bytes());while(f.length()>0)if(e.session.cipherSuite=m.getCipherSuite(f.getBytes(2)),e.session.cipherSuite!==null)break}if(e.session.cipherSuite===null)return e.error(e,{message:"No cipher suites in common.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.handshake_failure},cipherSuite:L.util.bytesToHex(r.cipher_suite)});if(i)e.session.compressionMethod=r.compression_method;else e.session.compressionMethod=m.CompressionMethod.none}return r};m.createSecurityParameters=function(e,t){var n=e.entity===m.ConnectionEnd.client,r=t.random.bytes(),i=n?e.session.sp.client_random:r,s=n?r:m.createRandom().getBytes();e.session.sp={entity:e.entity,prf_algorithm:m.PRFAlgorithm.tls_prf_sha256,bulk_cipher_algorithm:null,cipher_type:null,enc_key_length:null,block_length:null,fixed_iv_length:null,record_iv_length:null,mac_algorithm:null,mac_length:null,mac_key_length:null,compression_algorithm:e.session.compressionMethod,pre_master_secret:null,master_secret:null,client_random:i,server_random:s}};m.handleServerHello=function(e,t,n){var r=m.parseHelloMessage(e,t,n);if(e.fail)return;if(r.version.minor<=e.version.minor)e.version.minor=r.version.minor;else return e.error(e,{message:"Incompatible TLS version.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.protocol_version}});e.session.version=e.version;var i=r.session_id.bytes();if(i.length>0&&i===e.session.id)e.expect=sd,e.session.resuming=!0,e.session.sp.server_random=r.random.bytes();else e.expect=ty,e.session.resuming=!1,m.createSecurityParameters(e,r);e.session.id=i,e.process()};m.handleClientHello=function(e,t,n){var r=m.parseHelloMessage(e,t,n);if(e.fail)return;var i=r.session_id.bytes(),s=null;if(e.sessionCache){if(s=e.sessionCache.getSession(i),s===null)i="";else if(s.version.major!==r.version.major||s.version.minor>r.version.minor)s=null,i=""}if(i.length===0)i=L.random.getBytes(32);if(e.session.id=i,e.session.clientHelloVersion=r.version,e.session.sp={},s)e.version=e.session.version=s.version,e.session.sp=s.sp;else{var a;for(var o=1;o<m.SupportedVersions.length;++o)if(a=m.SupportedVersions[o],a.minor<=r.version.minor)break;e.version={major:a.major,minor:a.minor},e.session.version=e.version}if(s!==null)e.expect=Lo,e.session.resuming=!0,e.session.sp.client_random=r.random.bytes();else e.expect=e.verifyClient!==!1?ly:Do,e.session.resuming=!1,m.createSecurityParameters(e,r);if(e.open=!0,m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createServerHello(e)})),e.session.resuming)m.queue(e,m.createRecord(e,{type:m.ContentType.change_cipher_spec,data:m.createChangeCipherSpec()})),e.state.pending=m.createConnectionState(e),e.state.current.write=e.state.pending.write,m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createFinished(e)}));else if(m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createCertificate(e)})),!e.fail){if(m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createServerKeyExchange(e)})),e.verifyClient!==!1)m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createCertificateRequest(e)}));m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createServerHelloDone(e)}))}m.flush(e),e.process()};m.handleCertificate=function(e,t,n){if(n<3)return e.error(e,{message:"Invalid Certificate message. Message too short.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});var r=t.fragment,i={certificate_list:It(r,3)},s,a,o=[];try{while(i.certificate_list.length()>0)s=It(i.certificate_list,3),a=L.asn1.fromDer(s),s=L.pki.certificateFromAsn1(a,!0),o.push(s)}catch(c){return e.error(e,{message:"Could not parse certificate list.",cause:c,send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.bad_certificate}})}var l=e.entity===m.ConnectionEnd.client;if((l||e.verifyClient===!0)&&o.length===0)e.error(e,{message:l?"No server certificate provided.":"No client certificate provided.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});else if(o.length===0)e.expect=l?nd:Do;else{if(l)e.session.serverCertificate=o[0];else e.session.clientCertificate=o[0];if(m.verifyCertificateChain(e,o))e.expect=l?nd:Do}e.process()};m.handleServerKeyExchange=function(e,t,n){if(n>0)return e.error(e,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.unsupported_certificate}});e.expect=ry,e.process()};m.handleClientKeyExchange=function(e,t,n){if(n<48)return e.error(e,{message:"Invalid key parameters. Only RSA is supported.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.unsupported_certificate}});var r=t.fragment,i={enc_pre_master_secret:It(r,2).getBytes()},s=null;if(e.getPrivateKey)try{s=e.getPrivateKey(e,e.session.serverCertificate),s=L.pki.privateKeyFromPem(s)}catch(l){e.error(e,{message:"Could not get private key.",cause:l,send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}})}if(s===null)return e.error(e,{message:"No private key set.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}});try{var a=e.session.sp;a.pre_master_secret=s.decrypt(i.enc_pre_master_secret);var o=e.session.clientHelloVersion;if(o.major!==a.pre_master_secret.charCodeAt(0)||o.minor!==a.pre_master_secret.charCodeAt(1))throw Error("TLS version rollback attack detected.")}catch(l){a.pre_master_secret=L.random.getBytes(48)}if(e.expect=Lo,e.session.clientCertificate!==null)e.expect=cy;e.process()};m.handleCertificateRequest=function(e,t,n){if(n<3)return e.error(e,{message:"Invalid CertificateRequest. Message too short.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});var r=t.fragment,i={certificate_types:It(r,1),certificate_authorities:It(r,2)};e.session.certificateRequest=i,e.expect=ny,e.process()};m.handleCertificateVerify=function(e,t,n){if(n<2)return e.error(e,{message:"Invalid CertificateVerify. Message too short.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});var r=t.fragment;r.read-=4;var i=r.bytes();r.read+=4;var s={signature:It(r,2).getBytes()},a=L.util.createBuffer();a.putBuffer(e.session.md5.digest()),a.putBuffer(e.session.sha1.digest()),a=a.getBytes();try{var o=e.session.clientCertificate;if(!o.publicKey.verify(a,s.signature,"NONE"))throw Error("CertificateVerify signature does not match.");e.session.md5.update(i),e.session.sha1.update(i)}catch(l){return e.error(e,{message:"Bad signature in CertificateVerify.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.handshake_failure}})}e.expect=Lo,e.process()};m.handleServerHelloDone=function(e,t,n){if(n>0)return e.error(e,{message:"Invalid ServerHelloDone message. Invalid length.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.record_overflow}});if(e.serverCertificate===null){var r={message:"No server certificate provided. Not enough security.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.insufficient_security}},i=0,s=e.verify(e,r.alert.description,i,[]);if(s!==!0){if(s||s===0){if(typeof s==="object"&&!L.util.isArray(s)){if(s.message)r.message=s.message;if(s.alert)r.alert.description=s.alert}else if(typeof s==="number")r.alert.description=s}return e.error(e,r)}}if(e.session.certificateRequest!==null)t=m.createRecord(e,{type:m.ContentType.handshake,data:m.createCertificate(e)}),m.queue(e,t);t=m.createRecord(e,{type:m.ContentType.handshake,data:m.createClientKeyExchange(e)}),m.queue(e,t),e.expect=ay;var a=function(o,l){if(o.session.certificateRequest!==null&&o.session.clientCertificate!==null)m.queue(o,m.createRecord(o,{type:m.ContentType.handshake,data:m.createCertificateVerify(o,l)}));m.queue(o,m.createRecord(o,{type:m.ContentType.change_cipher_spec,data:m.createChangeCipherSpec()})),o.state.pending=m.createConnectionState(o),o.state.current.write=o.state.pending.write,m.queue(o,m.createRecord(o,{type:m.ContentType.handshake,data:m.createFinished(o)})),o.expect=sd,m.flush(o),o.process()};if(e.session.certificateRequest===null||e.session.clientCertificate===null)return a(e,null);m.getClientSignature(e,a)};m.handleChangeCipherSpec=function(e,t){if(t.fragment.getByte()!==1)return e.error(e,{message:"Invalid ChangeCipherSpec message received.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.illegal_parameter}});var n=e.entity===m.ConnectionEnd.client;if(e.session.resuming&&n||!e.session.resuming&&!n)e.state.pending=m.createConnectionState(e);if(e.state.current.read=e.state.pending.read,!e.session.resuming&&n||e.session.resuming&&!n)e.state.pending=null;e.expect=n?iy:uy,e.process()};m.handleFinished=function(e,t,n){var r=t.fragment;r.read-=4;var i=r.bytes();r.read+=4;var s=t.fragment.getBytes();r=L.util.createBuffer(),r.putBuffer(e.session.md5.digest()),r.putBuffer(e.session.sha1.digest());var a=e.entity===m.ConnectionEnd.client,o=a?"server finished":"client finished",l=e.session.sp,c=12,u=Ks;if(r=u(l.master_secret,o,r.getBytes(),c),r.getBytes()!==s)return e.error(e,{message:"Invalid verify_data in Finished message.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.decrypt_error}});if(e.session.md5.update(i),e.session.sha1.update(i),e.session.resuming&&a||!e.session.resuming&&!a)m.queue(e,m.createRecord(e,{type:m.ContentType.change_cipher_spec,data:m.createChangeCipherSpec()})),e.state.current.write=e.state.pending.write,e.state.pending=null,m.queue(e,m.createRecord(e,{type:m.ContentType.handshake,data:m.createFinished(e)}));e.expect=a?sy:dy,e.handshaking=!1,++e.handshakes,e.peerCertificate=a?e.session.serverCertificate:e.session.clientCertificate,m.flush(e),e.isConnected=!0,e.connected(e),e.process()};m.handleAlert=function(e,t){var n=t.fragment,r={level:n.getByte(),description:n.getByte()},i;switch(r.description){case m.Alert.Description.close_notify:i="Connection closed.";break;case m.Alert.Description.unexpected_message:i="Unexpected message.";break;case m.Alert.Description.bad_record_mac:i="Bad record MAC.";break;case m.Alert.Description.decryption_failed:i="Decryption failed.";break;case m.Alert.Description.record_overflow:i="Record overflow.";break;case m.Alert.Description.decompression_failure:i="Decompression failed.";break;case m.Alert.Description.handshake_failure:i="Handshake failure.";break;case m.Alert.Description.bad_certificate:i="Bad certificate.";break;case m.Alert.Description.unsupported_certificate:i="Unsupported certificate.";break;case m.Alert.Description.certificate_revoked:i="Certificate revoked.";break;case m.Alert.Description.certificate_expired:i="Certificate expired.";break;case m.Alert.Description.certificate_unknown:i="Certificate unknown.";break;case m.Alert.Description.illegal_parameter:i="Illegal parameter.";break;case m.Alert.Description.unknown_ca:i="Unknown certificate authority.";break;case m.Alert.Description.access_denied:i="Access denied.";break;case m.Alert.Description.decode_error:i="Decode error.";break;case m.Alert.Description.decrypt_error:i="Decrypt error.";break;case m.Alert.Description.export_restriction:i="Export restriction.";break;case m.Alert.Description.protocol_version:i="Unsupported protocol version.";break;case m.Alert.Description.insufficient_security:i="Insufficient security.";break;case m.Alert.Description.internal_error:i="Internal error.";break;case m.Alert.Description.user_canceled:i="User canceled.";break;case m.Alert.Description.no_renegotiation:i="Renegotiation not supported.";break;default:i="Unknown error.";break}if(r.description===m.Alert.Description.close_notify)return e.close();e.error(e,{message:i,send:!1,origin:e.entity===m.ConnectionEnd.client?"server":"client",alert:r}),e.process()};m.handleHandshake=function(e,t){var n=t.fragment,r=n.getByte(),i=n.getInt24();if(i>n.length())return e.fragmented=t,t.fragment=L.util.createBuffer(),n.read-=4,e.process();e.fragmented=null,n.read-=4;var s=n.bytes(i+4);if(n.read+=4,r in Hs[e.entity][e.expect]){if(e.entity===m.ConnectionEnd.server&&!e.open&&!e.fail)e.handshaking=!0,e.session={version:null,extensions:{server_name:{serverNameList:[]}},cipherSuite:null,compressionMethod:null,serverCertificate:null,clientCertificate:null,md5:L.md.md5.create(),sha1:L.md.sha1.create()};if(r!==m.HandshakeType.hello_request&&r!==m.HandshakeType.certificate_verify&&r!==m.HandshakeType.finished)e.session.md5.update(s),e.session.sha1.update(s);Hs[e.entity][e.expect][r](e,t,i)}else m.handleUnexpected(e,t)};m.handleApplicationData=function(e,t){e.data.putBuffer(t.fragment),e.dataReady(e),e.process()};m.handleHeartbeat=function(e,t){var n=t.fragment,r=n.getByte(),i=n.getInt16(),s=n.getBytes(i);if(r===m.HeartbeatMessageType.heartbeat_request){if(e.handshaking||i>s.length)return e.process();m.queue(e,m.createRecord(e,{type:m.ContentType.heartbeat,data:m.createHeartbeat(m.HeartbeatMessageType.heartbeat_response,s)})),m.flush(e)}else if(r===m.HeartbeatMessageType.heartbeat_response){if(s!==e.expectedHeartbeatPayload)return e.process();if(e.heartbeatReceived)e.heartbeatReceived(e,L.util.createBuffer(s))}e.process()};var ey=0,ty=1,nd=2,ry=3,ny=4,sd=5,iy=6,sy=7,ay=8,oy=0,ly=1,Do=2,cy=3,Lo=4,uy=5,dy=6,{handleUnexpected:g,handleChangeCipherSpec:ad,handleAlert:gt,handleHandshake:Ct,handleApplicationData:od,handleHeartbeat:mt}=m,Oo=[];Oo[m.ConnectionEnd.client]=[[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[ad,gt,g,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,od,mt],[g,gt,Ct,g,mt]];Oo[m.ConnectionEnd.server]=[[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,g,mt],[ad,gt,g,g,mt],[g,gt,Ct,g,mt],[g,gt,Ct,od,mt],[g,gt,Ct,g,mt]];var{handleHelloRequest:Fr,handleServerHello:fy,handleCertificate:ld,handleServerKeyExchange:id,handleCertificateRequest:Po,handleServerHelloDone:$s,handleFinished:cd}=m,Hs=[];Hs[m.ConnectionEnd.client]=[[g,g,fy,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,ld,id,Po,$s,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,id,Po,$s,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,Po,$s,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,$s,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,cd],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[Fr,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g]];var{handleClientHello:py,handleClientKeyExchange:hy,handleCertificateVerify:gy}=m;Hs[m.ConnectionEnd.server]=[[g,py,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,ld,g,g,g,g,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,hy,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,gy,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,cd],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g],[g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g,g]];m.generateKeys=function(e,t){var n=Ks,r=t.client_random+t.server_random;if(!e.session.resuming)t.master_secret=n(t.pre_master_secret,"master secret",r,48).bytes(),t.pre_master_secret=null;r=t.server_random+t.client_random;var i=2*t.mac_key_length+2*t.enc_key_length,s=e.version.major===m.Versions.TLS_1_0.major&&e.version.minor===m.Versions.TLS_1_0.minor;if(s)i+=2*t.fixed_iv_length;var a=n(t.master_secret,"key expansion",r,i),o={client_write_MAC_key:a.getBytes(t.mac_key_length),server_write_MAC_key:a.getBytes(t.mac_key_length),client_write_key:a.getBytes(t.enc_key_length),server_write_key:a.getBytes(t.enc_key_length)};if(s)o.client_write_IV=a.getBytes(t.fixed_iv_length),o.server_write_IV=a.getBytes(t.fixed_iv_length);return o};m.createConnectionState=function(e){var t=e.entity===m.ConnectionEnd.client,n=function(){var s={sequenceNumber:[0,0],macKey:null,macLength:0,macFunction:null,cipherState:null,cipherFunction:function(a){return!0},compressionState:null,compressFunction:function(a){return!0},updateSequenceNumber:function(){if(s.sequenceNumber[1]===4294967295)s.sequenceNumber[1]=0,++s.sequenceNumber[0];else++s.sequenceNumber[1]}};return s},r={read:n(),write:n()};if(r.read.update=function(s,a){if(!r.read.cipherFunction(a,r.read))s.error(s,{message:"Could not decrypt record or bad MAC.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.bad_record_mac}});else if(!r.read.compressFunction(s,a,r.read))s.error(s,{message:"Could not decompress record.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.decompression_failure}});return!s.fail},r.write.update=function(s,a){if(!r.write.compressFunction(s,a,r.write))s.error(s,{message:"Could not compress record.",send:!1,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}});else if(!r.write.cipherFunction(a,r.write))s.error(s,{message:"Could not encrypt record.",send:!1,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}});return!s.fail},e.session){var i=e.session.sp;switch(e.session.cipherSuite.initSecurityParameters(i),i.keys=m.generateKeys(e,i),r.read.macKey=t?i.keys.server_write_MAC_key:i.keys.client_write_MAC_key,r.write.macKey=t?i.keys.client_write_MAC_key:i.keys.server_write_MAC_key,e.session.cipherSuite.initConnectionState(r,e,i),i.compression_algorithm){case m.CompressionMethod.none:break;case m.CompressionMethod.deflate:r.read.compressFunction=Zm,r.write.compressFunction=Jm;break;default:throw Error("Unsupported compression algorithm.")}}return r};m.createRandom=function(){var e=new Date,t=+e+e.getTimezoneOffset()*60000,n=L.util.createBuffer();return n.putInt32(t),n.putBytes(L.random.getBytes(28)),n};m.createRecord=function(e,t){if(!t.data)return null;var n={type:t.type,version:{major:e.version.major,minor:e.version.minor},length:t.data.length(),fragment:t.data};return n};m.createAlert=function(e,t){var n=L.util.createBuffer();return n.putByte(t.level),n.putByte(t.description),m.createRecord(e,{type:m.ContentType.alert,data:n})};m.createClientHello=function(e){e.session.clientHelloVersion={major:e.version.major,minor:e.version.minor};var t=L.util.createBuffer();for(var n=0;n<e.cipherSuites.length;++n){var r=e.cipherSuites[n];t.putByte(r.id[0]),t.putByte(r.id[1])}var i=t.length(),s=L.util.createBuffer();s.putByte(m.CompressionMethod.none);var a=s.length(),o=L.util.createBuffer();if(e.virtualHost){var l=L.util.createBuffer();l.putByte(0),l.putByte(0);var c=L.util.createBuffer();c.putByte(0),Vt(c,2,L.util.createBuffer(e.virtualHost));var u=L.util.createBuffer();Vt(u,2,c),Vt(l,2,u),o.putBuffer(l)}var d=o.length();if(d>0)d+=2;var f=e.session.id,y=f.length+1+2+4+28+2+i+1+a+d,p=L.util.createBuffer();if(p.putByte(m.HandshakeType.client_hello),p.putInt24(y),p.putByte(e.version.major),p.putByte(e.version.minor),p.putBytes(e.session.sp.client_random),Vt(p,1,L.util.createBuffer(f)),Vt(p,2,t),Vt(p,1,s),d>0)Vt(p,2,o);return p};m.createServerHello=function(e){var t=e.session.id,n=t.length+1+2+4+28+2+1,r=L.util.createBuffer();return r.putByte(m.HandshakeType.server_hello),r.putInt24(n),r.putByte(e.version.major),r.putByte(e.version.minor),r.putBytes(e.session.sp.server_random),Vt(r,1,L.util.createBuffer(t)),r.putByte(e.session.cipherSuite.id[0]),r.putByte(e.session.cipherSuite.id[1]),r.putByte(e.session.compressionMethod),r};m.createCertificate=function(e){var t=e.entity===m.ConnectionEnd.client,n=null;if(e.getCertificate){var r;if(t)r=e.session.certificateRequest;else r=e.session.extensions.server_name.serverNameList;n=e.getCertificate(e,r)}var i=L.util.createBuffer();if(n!==null)try{if(!L.util.isArray(n))n=[n];var s=null;for(var a=0;a<n.length;++a){var o=L.pem.decode(n[a])[0];if(o.type!=="CERTIFICATE"&&o.type!=="X509 CERTIFICATE"&&o.type!=="TRUSTED CERTIFICATE"){var l=Error('Could not convert certificate from PEM; PEM header type is not "CERTIFICATE", "X509 CERTIFICATE", or "TRUSTED CERTIFICATE".');throw l.headerType=o.type,l}if(o.procType&&o.procType.type==="ENCRYPTED")throw Error("Could not convert certificate from PEM; PEM is encrypted.");var c=L.util.createBuffer(o.body);if(s===null)s=L.asn1.fromDer(c.bytes(),!1);var u=L.util.createBuffer();Vt(u,3,c),i.putBuffer(u)}if(n=L.pki.certificateFromAsn1(s),t)e.session.clientCertificate=n;else e.session.serverCertificate=n}catch(y){return e.error(e,{message:"Could not send certificate list.",cause:y,send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.bad_certificate}})}var d=3+i.length(),f=L.util.createBuffer();return f.putByte(m.HandshakeType.certificate),f.putInt24(d),Vt(f,3,i),f};m.createClientKeyExchange=function(e){var t=L.util.createBuffer();t.putByte(e.session.clientHelloVersion.major),t.putByte(e.session.clientHelloVersion.minor),t.putBytes(L.random.getBytes(46));var n=e.session.sp;n.pre_master_secret=t.getBytes();var r=e.session.serverCertificate.publicKey;t=r.encrypt(n.pre_master_secret);var i=t.length+2,s=L.util.createBuffer();return s.putByte(m.HandshakeType.client_key_exchange),s.putInt24(i),s.putInt16(t.length),s.putBytes(t),s};m.createServerKeyExchange=function(e){var t=0,n=L.util.createBuffer();if(t>0)n.putByte(m.HandshakeType.server_key_exchange),n.putInt24(t);return n};m.getClientSignature=function(e,t){var n=L.util.createBuffer();n.putBuffer(e.session.md5.digest()),n.putBuffer(e.session.sha1.digest()),n=n.getBytes(),e.getSignature=e.getSignature||function(r,i,s){var a=null;if(r.getPrivateKey)try{a=r.getPrivateKey(r,r.session.clientCertificate),a=L.pki.privateKeyFromPem(a)}catch(o){r.error(r,{message:"Could not get private key.",cause:o,send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}})}if(a===null)r.error(r,{message:"No private key set.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.internal_error}});else i=a.sign(i,null);s(r,i)},e.getSignature(e,n,t)};m.createCertificateVerify=function(e,t){var n=t.length+2,r=L.util.createBuffer();return r.putByte(m.HandshakeType.certificate_verify),r.putInt24(n),r.putInt16(t.length),r.putBytes(t),r};m.createCertificateRequest=function(e){var t=L.util.createBuffer();t.putByte(1);var n=L.util.createBuffer();for(var r in e.caStore.certs){var i=e.caStore.certs[r],s=L.pki.distinguishedNameToAsn1(i.subject),a=L.asn1.toDer(s);n.putInt16(a.length()),n.putBuffer(a)}var o=1+t.length()+2+n.length(),l=L.util.createBuffer();return l.putByte(m.HandshakeType.certificate_request),l.putInt24(o),Vt(l,1,t),Vt(l,2,n),l};m.createServerHelloDone=function(e){var t=L.util.createBuffer();return t.putByte(m.HandshakeType.server_hello_done),t.putInt24(0),t};m.createChangeCipherSpec=function(){var e=L.util.createBuffer();return e.putByte(1),e};m.createFinished=function(e){var t=L.util.createBuffer();t.putBuffer(e.session.md5.digest()),t.putBuffer(e.session.sha1.digest());var n=e.entity===m.ConnectionEnd.client,r=e.session.sp,i=12,s=Ks,a=n?"client finished":"server finished";t=s(r.master_secret,a,t.getBytes(),i);var o=L.util.createBuffer();return o.putByte(m.HandshakeType.finished),o.putInt24(t.length()),o.putBuffer(t),o};m.createHeartbeat=function(e,t,n){if(typeof n>"u")n=t.length;var r=L.util.createBuffer();r.putByte(e),r.putInt16(n),r.putBytes(t);var i=r.length(),s=Math.max(16,i-n-3);return r.putBytes(L.random.getBytes(s)),r};m.queue=function(e,t){if(!t)return;if(t.fragment.length()===0){if(t.type===m.ContentType.handshake||t.type===m.ContentType.alert||t.type===m.ContentType.change_cipher_spec)return}if(t.type===m.ContentType.handshake){var n=t.fragment.bytes();e.session.md5.update(n),e.session.sha1.update(n),n=null}var r;if(t.fragment.length()<=m.MaxFragment)r=[t];else{r=[];var i=t.fragment.bytes();while(i.length>m.MaxFragment)r.push(m.createRecord(e,{type:t.type,data:L.util.createBuffer(i.slice(0,m.MaxFragment))})),i=i.slice(m.MaxFragment);if(i.length>0)r.push(m.createRecord(e,{type:t.type,data:L.util.createBuffer(i)}))}for(var s=0;s<r.length&&!e.fail;++s){var a=r[s],o=e.state.current.write;if(o.update(e,a))e.records.push(a)}};m.flush=function(e){for(var t=0;t<e.records.length;++t){var n=e.records[t];e.tlsData.putByte(n.type),e.tlsData.putByte(n.version.major),e.tlsData.putByte(n.version.minor),e.tlsData.putInt16(n.fragment.length()),e.tlsData.putBuffer(e.records[t].fragment)}return e.records=[],e.tlsDataReady(e)};var No=function(e){switch(e){case!0:return!0;case L.pki.certificateError.bad_certificate:return m.Alert.Description.bad_certificate;case L.pki.certificateError.unsupported_certificate:return m.Alert.Description.unsupported_certificate;case L.pki.certificateError.certificate_revoked:return m.Alert.Description.certificate_revoked;case L.pki.certificateError.certificate_expired:return m.Alert.Description.certificate_expired;case L.pki.certificateError.certificate_unknown:return m.Alert.Description.certificate_unknown;case L.pki.certificateError.unknown_ca:return m.Alert.Description.unknown_ca;default:return m.Alert.Description.bad_certificate}},my=function(e){switch(e){case!0:return!0;case m.Alert.Description.bad_certificate:return L.pki.certificateError.bad_certificate;case m.Alert.Description.unsupported_certificate:return L.pki.certificateError.unsupported_certificate;case m.Alert.Description.certificate_revoked:return L.pki.certificateError.certificate_revoked;case m.Alert.Description.certificate_expired:return L.pki.certificateError.certificate_expired;case m.Alert.Description.certificate_unknown:return L.pki.certificateError.certificate_unknown;case m.Alert.Description.unknown_ca:return L.pki.certificateError.unknown_ca;default:return L.pki.certificateError.bad_certificate}};m.verifyCertificateChain=function(e,t){try{var n={};for(var r in e.verifyOptions)n[r]=e.verifyOptions[r];n.verify=function(s,a,o){var l=No(s),c=e.verify(e,s,a,o);if(c!==!0){if(typeof c==="object"&&!L.util.isArray(c)){var u=Error("The application rejected the certificate.");if(u.send=!0,u.alert={level:m.Alert.Level.fatal,description:m.Alert.Description.bad_certificate},c.message)u.message=c.message;if(c.alert)u.alert.description=c.alert;throw u}if(c!==s)c=my(c)}return c},L.pki.verifyCertificateChain(e.caStore,t,n)}catch(s){var i=s;if(typeof i!=="object"||L.util.isArray(i))i={send:!0,alert:{level:m.Alert.Level.fatal,description:No(s)}};if(!("send"in i))i.send=!0;if(!("alert"in i))i.alert={level:m.Alert.Level.fatal,description:No(i.error)};e.error(e,i)}return!e.fail};m.createSessionCache=function(e,t){var n=null;if(e&&e.getSession&&e.setSession&&e.order)n=e;else{n={},n.cache=e||{},n.capacity=Math.max(t||100,1),n.order=[];for(var r in e)if(n.order.length<=t)n.order.push(r);else delete e[r];n.getSession=function(i){var s=null,a=null;if(i)a=L.util.bytesToHex(i);else if(n.order.length>0)a=n.order[0];if(a!==null&&a in n.cache){s=n.cache[a],delete n.cache[a];for(var o in n.order)if(n.order[o]===a){n.order.splice(o,1);break}}return s},n.setSession=function(i,s){if(n.order.length===n.capacity){var a=n.order.shift();delete n.cache[a]}var a=L.util.bytesToHex(i);n.order.push(a),n.cache[a]=s}}return n};m.createConnection=function(e){var t=null;if(e.caStore)if(L.util.isArray(e.caStore))t=L.pki.createCaStore(e.caStore);else t=e.caStore;else t=L.pki.createCaStore();var n=e.cipherSuites||null;if(n===null){n=[];for(var r in m.CipherSuites)n.push(m.CipherSuites[r])}var i=e.server?m.ConnectionEnd.server:m.ConnectionEnd.client,s=e.sessionCache?m.createSessionCache(e.sessionCache):null,a={version:{major:m.Version.major,minor:m.Version.minor},entity:i,sessionId:e.sessionId,caStore:t,sessionCache:s,cipherSuites:n,connected:e.connected,virtualHost:e.virtualHost||null,verifyClient:e.verifyClient||!1,verify:e.verify||function(u,d,f,y){return d},verifyOptions:e.verifyOptions||{},getCertificate:e.getCertificate||null,getPrivateKey:e.getPrivateKey||null,getSignature:e.getSignature||null,input:L.util.createBuffer(),tlsData:L.util.createBuffer(),data:L.util.createBuffer(),tlsDataReady:e.tlsDataReady,dataReady:e.dataReady,heartbeatReceived:e.heartbeatReceived,closed:e.closed,error:function(u,d){if(d.origin=d.origin||(u.entity===m.ConnectionEnd.client?"client":"server"),d.send)m.queue(u,m.createAlert(u,d.alert)),m.flush(u);var f=d.fatal!==!1;if(f)u.fail=!0;if(e.error(u,d),f)u.close(!1)},deflate:e.deflate||null,inflate:e.inflate||null};a.reset=function(u){a.version={major:m.Version.major,minor:m.Version.minor},a.record=null,a.session=null,a.peerCertificate=null,a.state={pending:null,current:null},a.expect=a.entity===m.ConnectionEnd.client?ey:oy,a.fragmented=null,a.records=[],a.open=!1,a.handshakes=0,a.handshaking=!1,a.isConnected=!1,a.fail=!(u||typeof u>"u"),a.input.clear(),a.tlsData.clear(),a.data.clear(),a.state.current=m.createConnectionState(a)},a.reset();var o=function(u,d){var f=d.type-m.ContentType.change_cipher_spec,y=Oo[u.entity][u.expect];if(f in y)y[f](u,d);else m.handleUnexpected(u,d)},l=function(u){var d=0,f=u.input,y=f.length();if(y<5)d=5-y;else{u.record={type:f.getByte(),version:{major:f.getByte(),minor:f.getByte()},length:f.getInt16(),fragment:L.util.createBuffer(),ready:!1};var p=u.record.version.major===u.version.major;if(p&&u.session&&u.session.version)p=u.record.version.minor===u.version.minor;if(!p)u.error(u,{message:"Incompatible TLS version.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.protocol_version}})}return d},c=function(u){var d=0,f=u.input,y=f.length();if(y<u.record.length)d=u.record.length-y;else{u.record.fragment.putBytes(f.getBytes(u.record.length)),f.compact();var p=u.state.current.read;if(p.update(u,u.record)){if(u.fragmented!==null)if(u.fragmented.type===u.record.type)u.fragmented.fragment.putBuffer(u.record.fragment),u.record=u.fragmented;else u.error(u,{message:"Invalid fragmented record.",send:!0,alert:{level:m.Alert.Level.fatal,description:m.Alert.Description.unexpected_message}});u.record.ready=!0}}return d};return a.handshake=function(u){if(a.entity!==m.ConnectionEnd.client)a.error(a,{message:"Cannot initiate handshake as a server.",fatal:!1});else if(a.handshaking)a.error(a,{message:"Handshake already in progress.",fatal:!1});else{if(a.fail&&!a.open&&a.handshakes===0)a.fail=!1;a.handshaking=!0,u=u||"";var d=null;if(u.length>0){if(a.sessionCache)d=a.sessionCache.getSession(u);if(d===null)u=""}if(u.length===0&&a.sessionCache){if(d=a.sessionCache.getSession(),d!==null)u=d.id}if(a.session={id:u,version:null,cipherSuite:null,compressionMethod:null,serverCertificate:null,certificateRequest:null,clientCertificate:null,sp:{},md5:L.md.md5.create(),sha1:L.md.sha1.create()},d)a.version=d.version,a.session.sp=d.sp;a.session.sp.client_random=m.createRandom().getBytes(),a.open=!0,m.queue(a,m.createRecord(a,{type:m.ContentType.handshake,data:m.createClientHello(a)})),m.flush(a)}},a.process=function(u){var d=0;if(u)a.input.putBytes(u);if(!a.fail){if(a.record!==null&&a.record.ready&&a.record.fragment.isEmpty())a.record=null;if(a.record===null)d=l(a);if(!a.fail&&a.record!==null&&!a.record.ready)d=c(a);if(!a.fail&&a.record!==null&&a.record.ready)o(a,a.record)}return d},a.prepare=function(u){return m.queue(a,m.createRecord(a,{type:m.ContentType.application_data,data:L.util.createBuffer(u)})),m.flush(a)},a.prepareHeartbeatRequest=function(u,d){if(u instanceof L.util.ByteBuffer)u=u.bytes();if(typeof d>"u")d=u.length;return a.expectedHeartbeatPayload=u,m.queue(a,m.createRecord(a,{type:m.ContentType.heartbeat,data:m.createHeartbeat(m.HeartbeatMessageType.heartbeat_request,u,d)})),m.flush(a)},a.close=function(u){if(!a.fail&&a.sessionCache&&a.session){var d={id:a.session.id,version:a.session.version,sp:a.session.sp};d.sp.keys=null,a.sessionCache.setSession(d.id,d)}if(a.open){if(a.open=!1,a.input.clear(),a.isConnected||a.handshaking)a.isConnected=a.handshaking=!1,m.queue(a,m.createAlert(a,{level:m.Alert.Level.warning,description:m.Alert.Description.close_notify})),m.flush(a);a.closed(a)}a.reset(u)},a};ud.exports=L.tls=L.tls||{};for(Ei in m)if(typeof m[Ei]!=="function")L.tls[Ei]=m[Ei];var Ei;L.tls.prf_tls1=Ks;L.tls.hmac_sha1=Ym;L.tls.createSessionCache=m.createSessionCache;L.tls.createConnection=m.createConnection});var pd=fe(function(p1,fd){var Mr=me();Nr();Uo();var Ft=fd.exports=Mr.tls;Ft.CipherSuites.TLS_RSA_WITH_AES_128_CBC_SHA={id:[0,47],name:"TLS_RSA_WITH_AES_128_CBC_SHA",initSecurityParameters:function(e){e.bulk_cipher_algorithm=Ft.BulkCipherAlgorithm.aes,e.cipher_type=Ft.CipherType.block,e.enc_key_length=16,e.block_length=16,e.fixed_iv_length=16,e.record_iv_length=16,e.mac_algorithm=Ft.MACAlgorithm.hmac_sha1,e.mac_length=20,e.mac_key_length=20},initConnectionState:dd};Ft.CipherSuites.TLS_RSA_WITH_AES_256_CBC_SHA={id:[0,53],name:"TLS_RSA_WITH_AES_256_CBC_SHA",initSecurityParameters:function(e){e.bulk_cipher_algorithm=Ft.BulkCipherAlgorithm.aes,e.cipher_type=Ft.CipherType.block,e.enc_key_length=32,e.block_length=16,e.fixed_iv_length=16,e.record_iv_length=16,e.mac_algorithm=Ft.MACAlgorithm.hmac_sha1,e.mac_length=20,e.mac_key_length=20},initConnectionState:dd};function dd(e,t,n){var r=t.entity===Mr.tls.ConnectionEnd.client;e.read.cipherState={init:!1,cipher:Mr.cipher.createDecipher("AES-CBC",r?n.keys.server_write_key:n.keys.client_write_key),iv:r?n.keys.server_write_IV:n.keys.client_write_IV},e.write.cipherState={init:!1,cipher:Mr.cipher.createCipher("AES-CBC",r?n.keys.client_write_key:n.keys.server_write_key),iv:r?n.keys.client_write_IV:n.keys.server_write_IV},e.read.cipherFunction=Sy,e.write.cipherFunction=yy,e.read.macLength=e.write.macLength=n.mac_length,e.read.macFunction=e.write.macFunction=Ft.hmac_sha1}function yy(e,t){var n=!1,r=t.macFunction(t.macKey,t.sequenceNumber,e);e.fragment.putBytes(r),t.updateSequenceNumber();var i;if(e.version.minor===Ft.Versions.TLS_1_0.minor)i=t.cipherState.init?null:t.cipherState.iv;else i=Mr.random.getBytesSync(16);t.cipherState.init=!0;var s=t.cipherState.cipher;if(s.start({iv:i}),e.version.minor>=Ft.Versions.TLS_1_1.minor)s.output.putBytes(i);if(s.update(e.fragment),s.finish(vy))e.fragment=s.output,e.length=e.fragment.length(),n=!0;return n}function vy(e,t,n){if(!n){var r=e-t.length()%e;t.fillWithByte(r-1,r)}return!0}function xy(e,t,n){var r=!0;if(n){var i=t.length(),s=t.last();for(var a=i-1-s;a<i-1;++a)r=r&&t.at(a)==s;if(r)t.truncate(s+1)}return r}function Sy(e,t){var n=!1,r;if(e.version.minor===Ft.Versions.TLS_1_0.minor)r=t.cipherState.init?null:t.cipherState.iv;else r=e.fragment.getBytes(16);t.cipherState.init=!0;var i=t.cipherState.cipher;i.start({iv:r}),i.update(e.fragment),n=i.finish(xy);var s=t.macLength,a=Mr.random.getBytesSync(s),o=i.output.length();if(o>=s)e.fragment=i.output.getBytes(o-s),a=i.output.getBytes(s);else e.fragment=i.output.getBytes();e.fragment=Mr.util.createBuffer(e.fragment),e.length=e.fragment.length();var l=t.macFunction(t.macKey,t.sequenceNumber,e);return t.updateSequenceNumber(),n=by(t.macKey,a,l)&&n,n}function by(e,t,n){var r=Mr.hmac.create();return r.start("SHA1",e),r.update(t),t=r.digest().getBytes(),r.start(null,null),r.update(n),n=r.digest().getBytes(),t===n}});var Mo=fe(function(h1,yd){var je=me();er();Be();var wi=yd.exports=je.sha512=je.sha512||{};je.md.sha512=je.md.algorithms.sha512=wi;var gd=je.sha384=je.sha512.sha384=je.sha512.sha384||{};gd.create=function(){return wi.create("SHA-384")};je.md.sha384=je.md.algorithms.sha384=gd;je.sha512.sha256=je.sha512.sha256||{create:function(){return wi.create("SHA-512/256")}};je.md["sha512/256"]=je.md.algorithms["sha512/256"]=je.sha512.sha256;je.sha512.sha224=je.sha512.sha224||{create:function(){return wi.create("SHA-512/224")}};je.md["sha512/224"]=je.md.algorithms["sha512/224"]=je.sha512.sha224;wi.create=function(e){if(!md)Cy();if(typeof e>"u")e="SHA-512";if(!(e in un))throw Error("Invalid SHA-512 algorithm: "+e);var t=un[e],n=null,r=je.util.createBuffer(),i=Array(80);for(var s=0;s<80;++s)i[s]=[,,];var a=64;switch(e){case"SHA-384":a=48;break;case"SHA-512/256":a=32;break;case"SHA-512/224":a=28;break}var o={algorithm:e.replace("-","").toLowerCase(),blockLength:128,digestLength:a,messageLength:0,fullMessageLength:null,messageLengthSize:16};return o.start=function(){o.messageLength=0,o.fullMessageLength=o.messageLength128=[];var l=o.messageLengthSize/4;for(var c=0;c<l;++c)o.fullMessageLength.push(0);r=je.util.createBuffer(),n=Array(t.length);for(var c=0;c<t.length;++c)n[c]=t[c].slice(0);return o},o.start(),o.update=function(l,c){if(c==="utf8")l=je.util.encodeUtf8(l);var u=l.length;o.messageLength+=u,u=[u/4294967296>>>0,u>>>0];for(var d=o.fullMessageLength.length-1;d>=0;--d)o.fullMessageLength[d]+=u[1],u[1]=u[0]+(o.fullMessageLength[d]/4294967296>>>0),o.fullMessageLength[d]=o.fullMessageLength[d]>>>0,u[0]=u[1]/4294967296>>>0;if(r.putBytes(l),hd(n,i,r),r.read>2048||r.length()===0)r.compact();return o},o.digest=function(){var l=je.util.createBuffer();l.putBytes(r.bytes());var c=o.fullMessageLength[o.fullMessageLength.length-1]+o.messageLengthSize,u=c&o.blockLength-1;l.putBytes(Vo.substr(0,o.blockLength-u));var d,f,y=o.fullMessageLength[0]*8;for(var p=0;p<o.fullMessageLength.length-1;++p)d=o.fullMessageLength[p+1]*8,f=d/4294967296>>>0,y+=f,l.putInt32(y>>>0),y=d>>>0;l.putInt32(y);var v=Array(n.length);for(var p=0;p<n.length;++p)v[p]=n[p].slice(0);hd(v,i,l);var x=je.util.createBuffer(),b;if(e==="SHA-512")b=v.length;else if(e==="SHA-384")b=v.length-2;else b=v.length-4;for(var p=0;p<b;++p)if(x.putInt32(v[p][0]),p!==b-1||e!=="SHA-512/224")x.putInt32(v[p][1]);return x},o};var Vo=null,md=!1,Fo=null,un=null;function Cy(){Vo=String.fromCharCode(128),Vo+=je.util.fillString(String.fromCharCode(0),128),Fo=[[1116352408,3609767458],[1899447441,602891725],[3049323471,3964484399],[3921009573,2173295548],[961987163,4081628472],[1508970993,3053834265],[2453635748,2937671579],[2870763221,3664609560],[3624381080,2734883394],[310598401,1164996542],[607225278,1323610764],[1426881987,3590304994],[1925078388,4068182383],[2162078206,991336113],[2614888103,633803317],[3248222580,3479774868],[3835390401,2666613458],[4022224774,944711139],[264347078,2341262773],[604807628,2007800933],[770255983,1495990901],[1249150122,1856431235],[1555081692,3175218132],[1996064986,2198950837],[2554220882,3999719339],[2821834349,766784016],[2952996808,2566594879],[3210313671,3203337956],[3336571891,1034457026],[3584528711,2466948901],[113926993,3758326383],[338241895,168717936],[666307205,1188179964],[773529912,1546045734],[1294757372,1522805485],[1396182291,2643833823],[1695183700,2343527390],[1986661051,1014477480],[2177026350,1206759142],[2456956037,344077627],[2730485921,1290863460],[2820302411,3158454273],[3259730800,3505952657],[3345764771,106217008],[3516065817,3606008344],[3600352804,1432725776],[4094571909,1467031594],[275423344,851169720],[430227734,3100823752],[506948616,1363258195],[659060556,3750685593],[883997877,3785050280],[958139571,3318307427],[1322822218,3812723403],[1537002063,2003034995],[1747873779,3602036899],[1955562222,1575990012],[2024104815,1125592928],[2227730452,2716904306],[2361852424,442776044],[2428436474,593698344],[2756734187,3733110249],[3204031479,2999351573],[3329325298,3815920427],[3391569614,3928383900],[3515267271,566280711],[3940187606,3454069534],[4118630271,4000239992],[116418474,1914138554],[174292421,2731055270],[289380356,3203993006],[460393269,320620315],[685471733,587496836],[852142971,1086792851],[1017036298,365543100],[1126000580,2618297676],[1288033470,3409855158],[1501505948,4234509866],[1607167915,987167468],[1816402316,1246189591]],un={},un["SHA-512"]=[[1779033703,4089235720],[3144134277,2227873595],[1013904242,4271175723],[2773480762,1595750129],[1359893119,2917565137],[2600822924,725511199],[528734635,4215389547],[1541459225,327033209]],un["SHA-384"]=[[3418070365,3238371032],[1654270250,914150663],[2438529370,812702999],[355462360,4144912697],[1731405415,4290775857],[2394180231,1750603025],[3675008525,1694076839],[1203062813,3204075428]],un["SHA-512/256"]=[[573645204,4230739756],[2673172387,3360449730],[596883563,1867755857],[2520282905,1497426621],[2519219938,2827943907],[3193839141,1401305490],[721525244,746961066],[246885852,2177182882]],un["SHA-512/224"]=[[2352822216,424955298],[1944164710,2312950998],[502970286,855612546],[1738396948,1479516111],[258812777,2077511080],[2011393907,79989058],[1067287976,1780299464],[286451373,2446758561]],md=!0}function hd(e,t,n){var r,i,s,a,o,l,c,u,d,f,y,p,v,x,b,A,E,k,I,R,M,ee,O,K,ie,ve,we,nt,_e,Ve,V,te,Q,ue,ce,Z=n.length();while(Z>=128){for(_e=0;_e<16;++_e)t[_e][0]=n.getInt32()>>>0,t[_e][1]=n.getInt32()>>>0;for(;_e<80;++_e)te=t[_e-2],Ve=te[0],V=te[1],r=((Ve>>>19|V<<13)^(V>>>29|Ve<<3)^Ve>>>6)>>>0,i=((Ve<<13|V>>>19)^(V<<3|Ve>>>29)^(Ve<<26|V>>>6))>>>0,ue=t[_e-15],Ve=ue[0],V=ue[1],s=((Ve>>>1|V<<31)^(Ve>>>8|V<<24)^Ve>>>7)>>>0,a=((Ve<<31|V>>>1)^(Ve<<24|V>>>8)^(Ve<<25|V>>>7))>>>0,Q=t[_e-7],ce=t[_e-16],V=i+Q[1]+a+ce[1],t[_e][0]=r+Q[0]+s+ce[0]+(V/4294967296>>>0)>>>0,t[_e][1]=V>>>0;v=e[0][0],x=e[0][1],b=e[1][0],A=e[1][1],E=e[2][0],k=e[2][1],I=e[3][0],R=e[3][1],M=e[4][0],ee=e[4][1],O=e[5][0],K=e[5][1],ie=e[6][0],ve=e[6][1],we=e[7][0],nt=e[7][1];for(_e=0;_e<80;++_e)c=((M>>>14|ee<<18)^(M>>>18|ee<<14)^(ee>>>9|M<<23))>>>0,u=((M<<18|ee>>>14)^(M<<14|ee>>>18)^(ee<<23|M>>>9))>>>0,d=(ie^M&(O^ie))>>>0,f=(ve^ee&(K^ve))>>>0,o=((v>>>28|x<<4)^(x>>>2|v<<30)^(x>>>7|v<<25))>>>0,l=((v<<4|x>>>28)^(x<<30|v>>>2)^(x<<25|v>>>7))>>>0,y=(v&b|E&(v^b))>>>0,p=(x&A|k&(x^A))>>>0,V=nt+u+f+Fo[_e][1]+t[_e][1],r=we+c+d+Fo[_e][0]+t[_e][0]+(V/4294967296>>>0)>>>0,i=V>>>0,V=l+p,s=o+y+(V/4294967296>>>0)>>>0,a=V>>>0,we=ie,nt=ve,ie=O,ve=K,O=M,K=ee,V=R+i,M=I+r+(V/4294967296>>>0)>>>0,ee=V>>>0,I=E,R=k,E=b,k=A,b=v,A=x,V=i+a,v=r+s+(V/4294967296>>>0)>>>0,x=V>>>0;V=e[0][1]+x,e[0][0]=e[0][0]+v+(V/4294967296>>>0)>>>0,e[0][1]=V>>>0,V=e[1][1]+A,e[1][0]=e[1][0]+b+(V/4294967296>>>0)>>>0,e[1][1]=V>>>0,V=e[2][1]+k,e[2][0]=e[2][0]+E+(V/4294967296>>>0)>>>0,e[2][1]=V>>>0,V=e[3][1]+R,e[3][0]=e[3][0]+I+(V/4294967296>>>0)>>>0,e[3][1]=V>>>0,V=e[4][1]+ee,e[4][0]=e[4][0]+M+(V/4294967296>>>0)>>>0,e[4][1]=V>>>0,V=e[5][1]+K,e[5][0]=e[5][0]+O+(V/4294967296>>>0)>>>0,e[5][1]=V>>>0,V=e[6][1]+ve,e[6][0]=e[6][0]+ie+(V/4294967296>>>0)>>>0,e[6][1]=V>>>0,V=e[7][1]+nt,e[7][0]=e[7][0]+we+(V/4294967296>>>0)>>>0,e[7][1]=V>>>0,Z-=128}}});var vd=fe(function(wy){var Ey=me();Kt();var pt=Ey.asn1;wy.privateKeyValidator={name:"PrivateKeyInfo",tagClass:pt.Class.UNIVERSAL,type:pt.Type.SEQUENCE,constructed:!0,value:[{name:"PrivateKeyInfo.version",tagClass:pt.Class.UNIVERSAL,type:pt.Type.INTEGER,constructed:!1,capture:"privateKeyVersion"},{name:"PrivateKeyInfo.privateKeyAlgorithm",tagClass:pt.Class.UNIVERSAL,type:pt.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:pt.Class.UNIVERSAL,type:pt.Type.OID,constructed:!1,capture:"privateKeyOid"}]},{name:"PrivateKeyInfo",tagClass:pt.Class.UNIVERSAL,type:pt.Type.OCTETSTRING,constructed:!1,capture:"privateKey"}]};wy.publicKeyValidator={name:"SubjectPublicKeyInfo",tagClass:pt.Class.UNIVERSAL,type:pt.Type.SEQUENCE,constructed:!0,captureAsn1:"subjectPublicKeyInfo",value:[{name:"SubjectPublicKeyInfo.AlgorithmIdentifier",tagClass:pt.Class.UNIVERSAL,type:pt.Type.SEQUENCE,constructed:!0,value:[{name:"AlgorithmIdentifier.algorithm",tagClass:pt.Class.UNIVERSAL,type:pt.Type.OID,constructed:!1,capture:"publicKeyOid"}]},{tagClass:pt.Class.UNIVERSAL,type:pt.Type.BITSTRING,constructed:!1,composed:!0,captureBitStringValue:"ed25519PublicKey"}]}});var Rd=fe(function(m1,Id){var yt=me();xi();Dt();Mo();Be();var Ed=vd(),{publicKeyValidator:_y,privateKeyValidator:ky}=Ed;if(typeof $o>"u")$o=yt.jsbn.BigInteger;var $o,Ho=yt.util.ByteBuffer,At=typeof Buffer>"u"?Uint8Array:Buffer;yt.pki=yt.pki||{};Id.exports=yt.pki.ed25519=yt.ed25519=yt.ed25519||{};var Ee=yt.ed25519;Ee.constants={};Ee.constants.PUBLIC_KEY_BYTE_LENGTH=32;Ee.constants.PRIVATE_KEY_BYTE_LENGTH=64;Ee.constants.SEED_BYTE_LENGTH=32;Ee.constants.SIGN_BYTE_LENGTH=64;Ee.constants.HASH_BYTE_LENGTH=64;Ee.generateKeyPair=function(e){e=e||{};var t=e.seed;if(t===void 0)t=yt.random.getBytesSync(Ee.constants.SEED_BYTE_LENGTH);else if(typeof t==="string"){if(t.length!==Ee.constants.SEED_BYTE_LENGTH)throw TypeError('"seed" must be '+Ee.constants.SEED_BYTE_LENGTH+" bytes in length.")}else if(!(t instanceof Uint8Array))throw TypeError('"seed" must be a node.js Buffer, Uint8Array, or a binary string.');t=Sr({message:t,encoding:"binary"});var n=new At(Ee.constants.PUBLIC_KEY_BYTE_LENGTH),r=new At(Ee.constants.PRIVATE_KEY_BYTE_LENGTH);for(var i=0;i<32;++i)r[i]=t[i];return Py(n,r),{publicKey:n,privateKey:r}};Ee.privateKeyFromAsn1=function(e){var t={},n=[],r=yt.asn1.validate(e,ky,t,n);if(!r){var i=Error("Invalid Key.");throw i.errors=n,i}var s=yt.asn1.derToOid(t.privateKeyOid),a=yt.oids.EdDSA25519;if(s!==a)throw Error('Invalid OID "'+s+'"; OID must be "'+a+'".');var o=t.privateKey,l=Sr({message:yt.asn1.fromDer(o).value,encoding:"binary"});return{privateKeyBytes:l}};Ee.publicKeyFromAsn1=function(e){var t={},n=[],r=yt.asn1.validate(e,_y,t,n);if(!r){var i=Error("Invalid Key.");throw i.errors=n,i}var s=yt.asn1.derToOid(t.publicKeyOid),a=yt.oids.EdDSA25519;if(s!==a)throw Error('Invalid OID "'+s+'"; OID must be "'+a+'".');var o=t.ed25519PublicKey;if(o.length!==Ee.constants.PUBLIC_KEY_BYTE_LENGTH)throw Error("Key length is invalid.");return Sr({message:o,encoding:"binary"})};Ee.publicKeyFromPrivateKey=function(e){e=e||{};var t=Sr({message:e.privateKey,encoding:"binary"});if(t.length!==Ee.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Ee.constants.PRIVATE_KEY_BYTE_LENGTH);var n=new At(Ee.constants.PUBLIC_KEY_BYTE_LENGTH);for(var r=0;r<n.length;++r)n[r]=t[32+r];return n};Ee.sign=function(e){e=e||{};var t=Sr(e),n=Sr({message:e.privateKey,encoding:"binary"});if(n.length===Ee.constants.SEED_BYTE_LENGTH){var r=Ee.generateKeyPair({seed:n});n=r.privateKey}else if(n.length!==Ee.constants.PRIVATE_KEY_BYTE_LENGTH)throw TypeError('"options.privateKey" must have a byte length of '+Ee.constants.SEED_BYTE_LENGTH+" or "+Ee.constants.PRIVATE_KEY_BYTE_LENGTH);var i=new At(Ee.constants.SIGN_BYTE_LENGTH+t.length);Ny(i,t,t.length,n);var s=new At(Ee.constants.SIGN_BYTE_LENGTH);for(var a=0;a<s.length;++a)s[a]=i[a];return s};Ee.verify=function(e){e=e||{};var t=Sr(e);if(e.signature===void 0)throw TypeError('"options.signature" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a binary string.');var n=Sr({message:e.signature,encoding:"binary"});if(n.length!==Ee.constants.SIGN_BYTE_LENGTH)throw TypeError('"options.signature" must have a byte length of '+Ee.constants.SIGN_BYTE_LENGTH);var r=Sr({message:e.publicKey,encoding:"binary"});if(r.length!==Ee.constants.PUBLIC_KEY_BYTE_LENGTH)throw TypeError('"options.publicKey" must have a byte length of '+Ee.constants.PUBLIC_KEY_BYTE_LENGTH);var i=new At(Ee.constants.SIGN_BYTE_LENGTH+t.length),s=new At(Ee.constants.SIGN_BYTE_LENGTH+t.length),a;for(a=0;a<Ee.constants.SIGN_BYTE_LENGTH;++a)i[a]=n[a];for(a=0;a<t.length;++a)i[a+Ee.constants.SIGN_BYTE_LENGTH]=t[a];return Dy(s,i,i.length,r)>=0};function Sr(e){var t=e.message;if(t instanceof Uint8Array||t instanceof At)return t;var n=e.encoding;if(t===void 0)if(e.md)t=e.md.digest().getBytes(),n="binary";else throw TypeError('"options.message" or "options.md" not specified.');if(typeof t==="string"&&!n)throw TypeError('"options.encoding" must be "binary" or "utf8".');if(typeof t==="string"){if(typeof Buffer<"u")return Buffer.from(t,n);t=new Ho(t,n)}else if(!(t instanceof Ho))throw TypeError('"options.message" must be a node.js Buffer, a Uint8Array, a forge ByteBuffer, or a string with "options.encoding" specifying its encoding.');var r=new At(t.length());for(var i=0;i<r.length;++i)r[i]=t.at(i);return r}var Ko=se(),qs=se([1]),Iy=se([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),Ry=se([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),xd=se([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),Sd=se([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),Ti=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]),By=se([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function Ai(e,t){var n=yt.md.sha512.create(),r=new Ho(e);n.update(r.getBytes(t),"binary");var i=n.digest().getBytes();if(typeof Buffer<"u")return Buffer.from(i,"binary");var s=new At(Ee.constants.HASH_BYTE_LENGTH);for(var a=0;a<64;++a)s[a]=i.charCodeAt(a);return s}function Py(e,t){var n=[se(),se(),se(),se()],r,i=Ai(t,32);i[0]&=248,i[31]&=127,i[31]|=64,zo(n,i),jo(e,n);for(r=0;r<32;++r)t[r+32]=e[r];return 0}function Ny(e,t,n,r){var i,s,a=new Float64Array(64),o=[se(),se(),se(),se()],l=Ai(r,32);l[0]&=248,l[31]&=127,l[31]|=64;var c=n+64;for(i=0;i<n;++i)e[64+i]=t[i];for(i=0;i<32;++i)e[32+i]=l[32+i];var u=Ai(e.subarray(32),n+32);qo(u),zo(o,u),jo(e,o);for(i=32;i<64;++i)e[i]=r[i];var d=Ai(e,n+64);qo(d);for(i=32;i<64;++i)a[i]=0;for(i=0;i<32;++i)a[i]=u[i];for(i=0;i<32;++i)for(s=0;s<32;s++)a[i+s]+=d[i]*l[s];return wd(e.subarray(32),a),c}function Dy(e,t,n,r){var i,s,a=new At(32),o=[se(),se(),se(),se()],l=[se(),se(),se(),se()];if(s=-1,n<64)return-1;if(Oy(l,r))return-1;if(!Ly(t,32))return-1;for(i=0;i<n;++i)e[i]=t[i];for(i=0;i<32;++i)e[i+32]=r[i];var c=Ai(e,n);if(qo(c),_d(o,l,c),zo(l,t.subarray(32)),Go(o,l),jo(a,o),n-=64,Td(t,0,a,0)){for(i=0;i<n;++i)e[i]=0;return-1}for(i=0;i<n;++i)e[i]=t[i+64];return s=n,s}function Ly(e,t){var n;for(n=31;n>=0;--n){if(e[t+n]<Ti[n])return!0;if(e[t+n]>Ti[n])return!1}return!1}function wd(e,t){var n,r,i,s;for(r=63;r>=32;--r){n=0;for(i=r-32,s=r-12;i<s;++i)t[i]+=n-16*t[r]*Ti[i-(r-32)],n=t[i]+128>>8,t[i]-=n*256;t[i]+=n,t[r]=0}n=0;for(i=0;i<32;++i)t[i]+=n-(t[31]>>4)*Ti[i],n=t[i]>>8,t[i]&=255;for(i=0;i<32;++i)t[i]-=n*Ti[i];for(r=0;r<32;++r)t[r+1]+=t[r]>>8,e[r]=t[r]&255}function qo(e){var t=new Float64Array(64);for(var n=0;n<64;++n)t[n]=e[n],e[n]=0;wd(e,t)}function Go(e,t){var n=se(),r=se(),i=se(),s=se(),a=se(),o=se(),l=se(),c=se(),u=se();Ln(n,e[1],e[0]),Ln(u,t[1],t[0]),We(n,n,u),Dn(r,e[0],e[1]),Dn(u,t[0],t[1]),We(r,r,u),We(i,e[3],t[3]),We(i,i,Ry),We(s,e[2],t[2]),Dn(s,s,s),Ln(a,r,n),Ln(o,s,i),Dn(l,s,i),Dn(c,r,n),We(e[0],a,o),We(e[1],c,l),We(e[2],l,o),We(e[3],a,c)}function bd(e,t,n){for(var r=0;r<4;++r)kd(e[r],t[r],n)}function jo(e,t){var n=se(),r=se(),i=se();My(i,t[2]),We(n,t[0],i),We(r,t[1],i),Gs(e,r),e[31]^=Ad(n)<<7}function Gs(e,t){var n,r,i,s=se(),a=se();for(n=0;n<16;++n)a[n]=t[n];Wo(a),Wo(a),Wo(a);for(r=0;r<2;++r){s[0]=a[0]-65517;for(n=1;n<15;++n)s[n]=a[n]-65535-(s[n-1]>>16&1),s[n-1]&=65535;s[15]=a[15]-32767-(s[14]>>16&1),i=s[15]>>16&1,s[14]&=65535,kd(a,s,1-i)}for(n=0;n<16;n++)e[2*n]=a[n]&255,e[2*n+1]=a[n]>>8}function Oy(e,t){var n=se(),r=se(),i=se(),s=se(),a=se(),o=se(),l=se();if(Wr(e[2],qs),Uy(e[1],t),dn(i,e[1]),We(s,i,Iy),Ln(i,i,e[2]),Dn(s,e[2],s),dn(a,s),dn(o,a),We(l,o,a),We(n,l,i),We(n,n,s),Vy(n,n),We(n,n,i),We(n,n,s),We(n,n,s),We(e[0],n,s),dn(r,e[0]),We(r,r,s),Cd(r,i))We(e[0],e[0],By);if(dn(r,e[0]),We(r,r,s),Cd(r,i))return-1;if(Ad(e[0])===t[31]>>7)Ln(e[0],Ko,e[0]);return We(e[3],e[0],e[1]),0}function Uy(e,t){var n;for(n=0;n<16;++n)e[n]=t[2*n]+(t[2*n+1]<<8);e[15]&=32767}function Vy(e,t){var n=se(),r;for(r=0;r<16;++r)n[r]=t[r];for(r=250;r>=0;--r)if(dn(n,n),r!==1)We(n,n,t);for(r=0;r<16;++r)e[r]=n[r]}function Cd(e,t){var n=new At(32),r=new At(32);return Gs(n,e),Gs(r,t),Td(n,0,r,0)}function Td(e,t,n,r){return Fy(e,t,n,r,32)}function Fy(e,t,n,r,i){var s,a=0;for(s=0;s<i;++s)a|=e[t+s]^n[r+s];return(1&a-1>>>8)-1}function Ad(e){var t=new At(32);return Gs(t,e),t[0]&1}function _d(e,t,n){var r,i;Wr(e[0],Ko),Wr(e[1],qs),Wr(e[2],qs),Wr(e[3],Ko);for(i=255;i>=0;--i)r=n[i/8|0]>>(i&7)&1,bd(e,t,r),Go(t,e),Go(e,e),bd(e,t,r)}function zo(e,t){var n=[se(),se(),se(),se()];Wr(n[0],xd),Wr(n[1],Sd),Wr(n[2],qs),We(n[3],xd,Sd),_d(e,n,t)}function Wr(e,t){var n;for(n=0;n<16;n++)e[n]=t[n]|0}function My(e,t){var n=se(),r;for(r=0;r<16;++r)n[r]=t[r];for(r=253;r>=0;--r)if(dn(n,n),r!==2&&r!==4)We(n,n,t);for(r=0;r<16;++r)e[r]=n[r]}function Wo(e){var t,n,r=1;for(t=0;t<16;++t)n=e[t]+r+65535,r=Math.floor(n/65536),e[t]=n-r*65536;e[0]+=r-1+37*(r-1)}function kd(e,t,n){var r,i=~(n-1);for(var s=0;s<16;++s)r=i&(e[s]^t[s]),e[s]^=r,t[s]^=r}function se(e){var t,n=new Float64Array(16);if(e)for(t=0;t<e.length;++t)n[t]=e[t];return n}function Dn(e,t,n){for(var r=0;r<16;++r)e[r]=t[r]+n[r]}function Ln(e,t,n){for(var r=0;r<16;++r)e[r]=t[r]-n[r]}function dn(e,t){We(e,t,t)}function We(e,t,n){var r,i,s=0,a=0,o=0,l=0,c=0,u=0,d=0,f=0,y=0,p=0,v=0,x=0,b=0,A=0,E=0,k=0,I=0,R=0,M=0,ee=0,O=0,K=0,ie=0,ve=0,we=0,nt=0,_e=0,Ve=0,V=0,te=0,Q=0,ue=n[0],ce=n[1],Z=n[2],Pe=n[3],Fe=n[4],le=n[5],Me=n[6],de=n[7],qe=n[8],Oe=n[9],at=n[10],Xe=n[11],ot=n[12],lt=n[13],Ye=n[14],Ue=n[15];r=t[0],s+=r*ue,a+=r*ce,o+=r*Z,l+=r*Pe,c+=r*Fe,u+=r*le,d+=r*Me,f+=r*de,y+=r*qe,p+=r*Oe,v+=r*at,x+=r*Xe,b+=r*ot,A+=r*lt,E+=r*Ye,k+=r*Ue,r=t[1],a+=r*ue,o+=r*ce,l+=r*Z,c+=r*Pe,u+=r*Fe,d+=r*le,f+=r*Me,y+=r*de,p+=r*qe,v+=r*Oe,x+=r*at,b+=r*Xe,A+=r*ot,E+=r*lt,k+=r*Ye,I+=r*Ue,r=t[2],o+=r*ue,l+=r*ce,c+=r*Z,u+=r*Pe,d+=r*Fe,f+=r*le,y+=r*Me,p+=r*de,v+=r*qe,x+=r*Oe,b+=r*at,A+=r*Xe,E+=r*ot,k+=r*lt,I+=r*Ye,R+=r*Ue,r=t[3],l+=r*ue,c+=r*ce,u+=r*Z,d+=r*Pe,f+=r*Fe,y+=r*le,p+=r*Me,v+=r*de,x+=r*qe,b+=r*Oe,A+=r*at,E+=r*Xe,k+=r*ot,I+=r*lt,R+=r*Ye,M+=r*Ue,r=t[4],c+=r*ue,u+=r*ce,d+=r*Z,f+=r*Pe,y+=r*Fe,p+=r*le,v+=r*Me,x+=r*de,b+=r*qe,A+=r*Oe,E+=r*at,k+=r*Xe,I+=r*ot,R+=r*lt,M+=r*Ye,ee+=r*Ue,r=t[5],u+=r*ue,d+=r*ce,f+=r*Z,y+=r*Pe,p+=r*Fe,v+=r*le,x+=r*Me,b+=r*de,A+=r*qe,E+=r*Oe,k+=r*at,I+=r*Xe,R+=r*ot,M+=r*lt,ee+=r*Ye,O+=r*Ue,r=t[6],d+=r*ue,f+=r*ce,y+=r*Z,p+=r*Pe,v+=r*Fe,x+=r*le,b+=r*Me,A+=r*de,E+=r*qe,k+=r*Oe,I+=r*at,R+=r*Xe,M+=r*ot,ee+=r*lt,O+=r*Ye,K+=r*Ue,r=t[7],f+=r*ue,y+=r*ce,p+=r*Z,v+=r*Pe,x+=r*Fe,b+=r*le,A+=r*Me,E+=r*de,k+=r*qe,I+=r*Oe,R+=r*at,M+=r*Xe,ee+=r*ot,O+=r*lt,K+=r*Ye,ie+=r*Ue,r=t[8],y+=r*ue,p+=r*ce,v+=r*Z,x+=r*Pe,b+=r*Fe,A+=r*le,E+=r*Me,k+=r*de,I+=r*qe,R+=r*Oe,M+=r*at,ee+=r*Xe,O+=r*ot,K+=r*lt,ie+=r*Ye,ve+=r*Ue,r=t[9],p+=r*ue,v+=r*ce,x+=r*Z,b+=r*Pe,A+=r*Fe,E+=r*le,k+=r*Me,I+=r*de,R+=r*qe,M+=r*Oe,ee+=r*at,O+=r*Xe,K+=r*ot,ie+=r*lt,ve+=r*Ye,we+=r*Ue,r=t[10],v+=r*ue,x+=r*ce,b+=r*Z,A+=r*Pe,E+=r*Fe,k+=r*le,I+=r*Me,R+=r*de,M+=r*qe,ee+=r*Oe,O+=r*at,K+=r*Xe,ie+=r*ot,ve+=r*lt,we+=r*Ye,nt+=r*Ue,r=t[11],x+=r*ue,b+=r*ce,A+=r*Z,E+=r*Pe,k+=r*Fe,I+=r*le,R+=r*Me,M+=r*de,ee+=r*qe,O+=r*Oe,K+=r*at,ie+=r*Xe,ve+=r*ot,we+=r*lt,nt+=r*Ye,_e+=r*Ue,r=t[12],b+=r*ue,A+=r*ce,E+=r*Z,k+=r*Pe,I+=r*Fe,R+=r*le,M+=r*Me,ee+=r*de,O+=r*qe,K+=r*Oe,ie+=r*at,ve+=r*Xe,we+=r*ot,nt+=r*lt,_e+=r*Ye,Ve+=r*Ue,r=t[13],A+=r*ue,E+=r*ce,k+=r*Z,I+=r*Pe,R+=r*Fe,M+=r*le,ee+=r*Me,O+=r*de,K+=r*qe,ie+=r*Oe,ve+=r*at,we+=r*Xe,nt+=r*ot,_e+=r*lt,Ve+=r*Ye,V+=r*Ue,r=t[14],E+=r*ue,k+=r*ce,I+=r*Z,R+=r*Pe,M+=r*Fe,ee+=r*le,O+=r*Me,K+=r*de,ie+=r*qe,ve+=r*Oe,we+=r*at,nt+=r*Xe,_e+=r*ot,Ve+=r*lt,V+=r*Ye,te+=r*Ue,r=t[15],k+=r*ue,I+=r*ce,R+=r*Z,M+=r*Pe,ee+=r*Fe,O+=r*le,K+=r*Me,ie+=r*de,ve+=r*qe,we+=r*Oe,nt+=r*at,_e+=r*Xe,Ve+=r*ot,V+=r*lt,te+=r*Ye,Q+=r*Ue,s+=38*I,a+=38*R,o+=38*M,l+=38*ee,c+=38*O,u+=38*K,d+=38*ie,f+=38*ve,y+=38*we,p+=38*nt,v+=38*_e,x+=38*Ve,b+=38*V,A+=38*te,E+=38*Q,i=1,r=s+i+65535,i=Math.floor(r/65536),s=r-i*65536,r=a+i+65535,i=Math.floor(r/65536),a=r-i*65536,r=o+i+65535,i=Math.floor(r/65536),o=r-i*65536,r=l+i+65535,i=Math.floor(r/65536),l=r-i*65536,r=c+i+65535,i=Math.floor(r/65536),c=r-i*65536,r=u+i+65535,i=Math.floor(r/65536),u=r-i*65536,r=d+i+65535,i=Math.floor(r/65536),d=r-i*65536,r=f+i+65535,i=Math.floor(r/65536),f=r-i*65536,r=y+i+65535,i=Math.floor(r/65536),y=r-i*65536,r=p+i+65535,i=Math.floor(r/65536),p=r-i*65536,r=v+i+65535,i=Math.floor(r/65536),v=r-i*65536,r=x+i+65535,i=Math.floor(r/65536),x=r-i*65536,r=b+i+65535,i=Math.floor(r/65536),b=r-i*65536,r=A+i+65535,i=Math.floor(r/65536),A=r-i*65536,r=E+i+65535,i=Math.floor(r/65536),E=r-i*65536,r=k+i+65535,i=Math.floor(r/65536),k=r-i*65536,s+=i-1+37*(i-1),i=1,r=s+i+65535,i=Math.floor(r/65536),s=r-i*65536,r=a+i+65535,i=Math.floor(r/65536),a=r-i*65536,r=o+i+65535,i=Math.floor(r/65536),o=r-i*65536,r=l+i+65535,i=Math.floor(r/65536),l=r-i*65536,r=c+i+65535,i=Math.floor(r/65536),c=r-i*65536,r=u+i+65535,i=Math.floor(r/65536),u=r-i*65536,r=d+i+65535,i=Math.floor(r/65536),d=r-i*65536,r=f+i+65535,i=Math.floor(r/65536),f=r-i*65536,r=y+i+65535,i=Math.floor(r/65536),y=r-i*65536,r=p+i+65535,i=Math.floor(r/65536),p=r-i*65536,r=v+i+65535,i=Math.floor(r/65536),v=r-i*65536,r=x+i+65535,i=Math.floor(r/65536),x=r-i*65536,r=b+i+65535,i=Math.floor(r/65536),b=r-i*65536,r=A+i+65535,i=Math.floor(r/65536),A=r-i*65536,r=E+i+65535,i=Math.floor(r/65536),E=r-i*65536,r=k+i+65535,i=Math.floor(r/65536),k=r-i*65536,s+=i-1+37*(i-1),e[0]=s,e[1]=a,e[2]=o,e[3]=l,e[4]=c,e[5]=u,e[6]=d,e[7]=f,e[8]=y,e[9]=p,e[10]=v,e[11]=x,e[12]=b,e[13]=A,e[14]=E,e[15]=k}});var Dd=fe(function(y1,Nd){var Rt=me();Be();Dt();xi();Nd.exports=Rt.kem=Rt.kem||{};var Bd=Rt.jsbn.BigInteger;Rt.kem.rsa={};Rt.kem.rsa.create=function(e,t){t=t||{};var n=t.prng||Rt.random,r={};return r.encrypt=function(i,s){var a=Math.ceil(i.n.bitLength()/8),o;do o=new Bd(Rt.util.bytesToHex(n.getBytesSync(a)),16).mod(i.n);while(o.compareTo(Bd.ONE)<=0);o=Rt.util.hexToBytes(o.toString(16));var l=a-o.length;if(l>0)o=Rt.util.fillString(String.fromCharCode(0),l)+o;var c=i.encrypt(o,"NONE"),u=e.generate(o,s);return{encapsulation:c,key:u}},r.decrypt=function(i,s,a){var o=i.decrypt(s,"NONE");return e.generate(o,a)},r};Rt.kem.kdf1=function(e,t){Pd(this,e,0,t||e.digestLength)};Rt.kem.kdf2=function(e,t){Pd(this,e,1,t||e.digestLength)};function Pd(e,t,n,r){e.generate=function(i,s){var a=new Rt.util.ByteBuffer,o=Math.ceil(s/r)+n,l=new Rt.util.ByteBuffer;for(var c=n;c<o;++c){l.putInt32(c),t.start(),t.update(i+l.getBytes());var u=t.digest();a.putBytes(u.getBytes(r))}return a.truncate(a.length()-s),a.getBytes()}}});var Od=fe(function(v1,Ld){var Te=me();Be();Ld.exports=Te.log=Te.log||{};Te.log.levels=["none","error","warning","info","debug","verbose","max"];var Qs={},Qo=[],_i=null;Te.log.LEVEL_LOCKED=2;Te.log.NO_LEVEL_CHECK=4;Te.log.INTERPOLATE=8;for(Mt=0;Mt<Te.log.levels.length;++Mt)js=Te.log.levels[Mt],Qs[js]={index:Mt,name:js.toUpperCase()};var js,Mt;Te.log.logMessage=function(e){var t=Qs[e.level].index;for(var n=0;n<Qo.length;++n){var r=Qo[n];if(r.flags&Te.log.NO_LEVEL_CHECK)r.f(e);else{var i=Qs[r.level].index;if(t<=i)r.f(r,e)}}};Te.log.prepareStandard=function(e){if(!("standard"in e))e.standard=Qs[e.level].name+" ["+e.category+"] "+e.message};Te.log.prepareFull=function(e){if(!("full"in e)){var t=[e.message];t=t.concat([]),e.full=Te.util.format.apply(this,t)}};Te.log.prepareStandardFull=function(e){if(!("standardFull"in e))Te.log.prepareStandard(e),e.standardFull=e.standard};zs=["error","warning","info","debug","verbose"];for(Mt=0;Mt<zs.length;++Mt)(function(t){Te.log[t]=function(n,r){var i=Array.prototype.slice.call(arguments).slice(2),s={timestamp:new Date,level:t,category:n,message:r,arguments:i};Te.log.logMessage(s)}})(zs[Mt]);var zs,Mt;Te.log.makeLogger=function(e){var t={flags:0,f:e};return Te.log.setLevel(t,"none"),t};Te.log.setLevel=function(e,t){var n=!1;if(e&&!(e.flags&Te.log.LEVEL_LOCKED))for(var r=0;r<Te.log.levels.length;++r){var i=Te.log.levels[r];if(t==i){e.level=t,n=!0;break}}return n};Te.log.lock=function(e,t){if(typeof t>"u"||t)e.flags|=Te.log.LEVEL_LOCKED;else e.flags&=~Te.log.LEVEL_LOCKED};Te.log.addLogger=function(e){Qo.push(e)};if(typeof console<"u"&&"log"in console){if(console.error&&console.warn&&console.info&&console.debug)Xo={error:console.error,warning:console.warn,info:console.info,debug:console.debug,verbose:console.debug},Un=function(e,t){Te.log.prepareStandard(t);var n=Xo[t.level],r=[t.standard];r=r.concat(t.arguments.slice()),n.apply(console,r)},fn=Te.log.makeLogger(Un);else Un=function(t,n){Te.log.prepareStandardFull(n),console.log(n.standardFull)},fn=Te.log.makeLogger(Un);Te.log.setLevel(fn,"debug"),Te.log.addLogger(fn),_i=fn}else console={log:function(){}};var fn,Xo,Un;if(_i!==null&&typeof window<"u"&&window.location){if(On=new URL(window.location.href).searchParams,On.has("console.level"))Te.log.setLevel(_i,On.get("console.level").slice(-1)[0]);if(On.has("console.lock")){if(Yo=On.get("console.lock").slice(-1)[0],Yo=="true")Te.log.lock(_i)}}var On,Yo;Te.log.consoleLogger=_i});var Vd=fe(function(x1,Ud){Ud.exports=er();_s();In();co();Mo()});var Wd=fe(function(S1,Md){var W=me();Nr();Kt();yi();Dr();nn();To();Dt();Be();Ws();var w=W.asn1,Et=Md.exports=W.pkcs7=W.pkcs7||{};Et.messageFromPem=function(e){var t=W.pem.decode(e)[0];if(t.type!=="PKCS7"){var n=Error('Could not convert PKCS#7 message from PEM; PEM header type is not "PKCS#7".');throw n.headerType=t.type,n}if(t.procType&&t.procType.type==="ENCRYPTED")throw Error("Could not convert PKCS#7 message from PEM; PEM is encrypted.");var r=w.fromDer(t.body);return Et.messageFromAsn1(r)};Et.messageToPem=function(e,t){var n={type:"PKCS7",body:w.toDer(e.toAsn1()).getBytes()};return W.pem.encode(n,{maxline:t})};Et.messageFromAsn1=function(e){var t={},n=[];if(!w.validate(e,Et.asn1.contentInfoValidator,t,n)){var r=Error("Cannot read PKCS#7 message. ASN.1 object is not an PKCS#7 ContentInfo.");throw r.errors=n,r}var i=w.derToOid(t.contentType),s;switch(i){case W.pki.oids.envelopedData:s=Et.createEnvelopedData();break;case W.pki.oids.encryptedData:s=Et.createEncryptedData();break;case W.pki.oids.signedData:s=Et.createSignedData();break;default:throw Error("Cannot read PKCS#7 message. ContentType with OID "+i+" is not (yet) supported.")}return s.fromAsn1(t.content.value[0]),s};Et.createSignedData=function(){var e=null;return e={type:W.pki.oids.signedData,version:1,certificates:[],crls:[],signers:[],digestAlgorithmIdentifiers:[],contentInfo:null,signerInfos:[],fromAsn1:function(r){if(Zo(e,r,Et.asn1.signedDataValidator),e.certificates=[],e.crls=[],e.digestAlgorithmIdentifiers=[],e.contentInfo=null,e.signerInfos=[],e.rawCapture.certificates){var i=e.rawCapture.certificates.value;for(var s=0;s<i.length;++s)e.certificates.push(W.pki.certificateFromAsn1(i[s]))}},toAsn1:function(){if(!e.contentInfo)e.sign();var r=[];for(var i=0;i<e.certificates.length;++i)r.push(W.pki.certificateToAsn1(e.certificates[i]));var s=[],a=w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,w.integerToDer(e.version).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SET,!0,e.digestAlgorithmIdentifiers),e.contentInfo])]);if(r.length>0)a.value[0].value.push(w.create(w.Class.CONTEXT_SPECIFIC,0,!0,r));if(s.length>0)a.value[0].value.push(w.create(w.Class.CONTEXT_SPECIFIC,1,!0,s));return a.value[0].value.push(w.create(w.Class.UNIVERSAL,w.Type.SET,!0,e.signerInfos)),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.type).getBytes()),a])},addSigner:function(r){var{issuer:i,serialNumber:s}=r;if(r.certificate){var a=r.certificate;if(typeof a==="string")a=W.pki.certificateFromPem(a);i=a.issuer.attributes,s=a.serialNumber}var o=r.key;if(!o)throw Error("Could not add PKCS#7 signer; no private key specified.");if(typeof o==="string")o=W.pki.privateKeyFromPem(o);var l=r.digestAlgorithm||W.pki.oids.sha1;switch(l){case W.pki.oids.sha1:case W.pki.oids.sha256:case W.pki.oids.sha384:case W.pki.oids.sha512:case W.pki.oids.md5:break;default:throw Error("Could not add PKCS#7 signer; unknown message digest algorithm: "+l)}var c=r.authenticatedAttributes||[];if(c.length>0){var u=!1,d=!1;for(var f=0;f<c.length;++f){var y=c[f];if(!u&&y.type===W.pki.oids.contentType){if(u=!0,d)break;continue}if(!d&&y.type===W.pki.oids.messageDigest){if(d=!0,u)break;continue}}if(!u||!d)throw Error("Invalid signer.authenticatedAttributes. If signer.authenticatedAttributes is specified, then it must contain at least two attributes, PKCS #9 content-type and PKCS #9 message-digest.")}e.signers.push({key:o,version:1,issuer:i,serialNumber:s,digestAlgorithm:l,signatureAlgorithm:W.pki.oids.rsaEncryption,signature:null,authenticatedAttributes:c,unauthenticatedAttributes:[]})},sign:function(r){if(r=r||{},typeof e.content!=="object"||e.contentInfo===null){if(e.contentInfo=w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(W.pki.oids.data).getBytes())]),"content"in e){var i;if(e.content instanceof W.util.ByteBuffer)i=e.content.bytes();else if(typeof e.content==="string")i=W.util.encodeUtf8(e.content);if(r.detached)e.detachedContent=w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,i);else e.contentInfo.value.push(w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,i)]))}}if(e.signers.length===0)return;var s=t();n(s)},verify:function(){throw Error("PKCS#7 signature verification not yet implemented.")},addCertificate:function(r){if(typeof r==="string")r=W.pki.certificateFromPem(r);e.certificates.push(r)},addCertificateRevokationList:function(r){throw Error("PKCS#7 CRL support not yet implemented.")}},e;function t(){var r={};for(var i=0;i<e.signers.length;++i){var s=e.signers[i],a=s.digestAlgorithm;if(!(a in r))r[a]=W.md[W.pki.oids[a]].create();if(s.authenticatedAttributes.length===0)s.md=r[a];else s.md=W.md[W.pki.oids[a]].create()}e.digestAlgorithmIdentifiers=[];for(var a in r)e.digestAlgorithmIdentifiers.push(w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(a).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.NULL,!1,"")]));return r}function n(r){var i;if(e.detachedContent)i=e.detachedContent;else i=e.contentInfo.value[1],i=i.value[0];if(!i)throw Error("Could not sign PKCS#7 message; there is no content to sign.");var s=w.derToOid(e.contentInfo.value[0].value),a=w.toDer(i);a.getByte(),w.getBerValueLength(a),a=a.getBytes();for(var o in r)r[o].start().update(a);var l=new Date;for(var c=0;c<e.signers.length;++c){var u=e.signers[c];if(u.authenticatedAttributes.length===0){if(s!==W.pki.oids.data)throw Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.")}else{u.authenticatedAttributesAsn1=w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[]);var d=w.create(w.Class.UNIVERSAL,w.Type.SET,!0,[]);for(var f=0;f<u.authenticatedAttributes.length;++f){var y=u.authenticatedAttributes[f];if(y.type===W.pki.oids.messageDigest)y.value=r[u.digestAlgorithm].digest();else if(y.type===W.pki.oids.signingTime){if(!y.value)y.value=l}d.value.push(Jo(y)),u.authenticatedAttributesAsn1.value.push(Jo(y))}a=w.toDer(d).getBytes(),u.md.start().update(a)}u.signature=u.key.sign(u.md,"RSASSA-PKCS1-V1_5")}e.signerInfos=Gy(e.signers)}};Et.createEncryptedData=function(){var e=null;return e={type:W.pki.oids.encryptedData,version:0,encryptedContent:{algorithm:W.pki.oids["aes256-CBC"]},fromAsn1:function(t){Zo(e,t,Et.asn1.encryptedDataValidator)},decrypt:function(t){if(t!==void 0)e.encryptedContent.key=t;Fd(e)}},e};Et.createEnvelopedData=function(){var e=null;return e={type:W.pki.oids.envelopedData,version:0,recipients:[],encryptedContent:{algorithm:W.pki.oids["aes256-CBC"]},fromAsn1:function(t){var n=Zo(e,t,Et.asn1.envelopedDataValidator);e.recipients=Hy(n.recipientInfos.value)},toAsn1:function(){return w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.type).getBytes()),w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,w.integerToDer(e.version).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SET,!0,Ky(e.recipients)),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,jy(e.encryptedContent))])])])},findRecipient:function(t){var n=t.issuer.attributes;for(var r=0;r<e.recipients.length;++r){var i=e.recipients[r],s=i.issuer;if(i.serialNumber!==t.serialNumber)continue;if(s.length!==n.length)continue;var a=!0;for(var o=0;o<n.length;++o)if(s[o].type!==n[o].type||s[o].value!==n[o].value){a=!1;break}if(a)return i}return null},decrypt:function(t,n){if(e.encryptedContent.key===void 0&&t!==void 0&&n!==void 0)switch(t.encryptedContent.algorithm){case W.pki.oids.rsaEncryption:case W.pki.oids.desCBC:var r=n.decrypt(t.encryptedContent.content);e.encryptedContent.key=W.util.createBuffer(r);break;default:throw Error("Unsupported asymmetric cipher, OID "+t.encryptedContent.algorithm)}Fd(e)},addRecipient:function(t){e.recipients.push({version:0,issuer:t.issuer.attributes,serialNumber:t.serialNumber,encryptedContent:{algorithm:W.pki.oids.rsaEncryption,key:t.publicKey}})},encrypt:function(t,n){if(e.encryptedContent.content===void 0){n=n||e.encryptedContent.algorithm,t=t||e.encryptedContent.key;var r,i,s;switch(n){case W.pki.oids["aes128-CBC"]:r=16,i=16,s=W.aes.createEncryptionCipher;break;case W.pki.oids["aes192-CBC"]:r=24,i=16,s=W.aes.createEncryptionCipher;break;case W.pki.oids["aes256-CBC"]:r=32,i=16,s=W.aes.createEncryptionCipher;break;case W.pki.oids["des-EDE3-CBC"]:r=24,i=8,s=W.des.createEncryptionCipher;break;default:throw Error("Unsupported symmetric cipher, OID "+n)}if(t===void 0)t=W.util.createBuffer(W.random.getBytes(r));else if(t.length()!=r)throw Error("Symmetric key has wrong length; got "+t.length()+" bytes, expected "+r+".");e.encryptedContent.algorithm=n,e.encryptedContent.key=t,e.encryptedContent.parameter=W.util.createBuffer(W.random.getBytes(i));var a=s(t);if(a.start(e.encryptedContent.parameter.copy()),a.update(e.content),!a.finish())throw Error("Symmetric encryption failed.");e.encryptedContent.content=a.output}for(var o=0;o<e.recipients.length;++o){var l=e.recipients[o];if(l.encryptedContent.content!==void 0)continue;switch(l.encryptedContent.algorithm){case W.pki.oids.rsaEncryption:l.encryptedContent.content=l.encryptedContent.key.encrypt(e.encryptedContent.key.data);break;default:throw Error("Unsupported asymmetric cipher, OID "+l.encryptedContent.algorithm)}}}},e};function Wy(e){var t={},n=[];if(!w.validate(e,Et.asn1.recipientInfoValidator,t,n)){var r=Error("Cannot read PKCS#7 RecipientInfo. ASN.1 object is not an PKCS#7 RecipientInfo.");throw r.errors=n,r}return{version:t.version.charCodeAt(0),issuer:W.pki.RDNAttributesAsArray(t.issuer),serialNumber:W.util.createBuffer(t.serial).toHex(),encryptedContent:{algorithm:w.derToOid(t.encAlgorithm),parameter:t.encParameter?t.encParameter.value:void 0,content:t.encKey}}}function $y(e){return w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,w.integerToDer(e.version).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[W.pki.distinguishedNameToAsn1({attributes:e.issuer}),w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,W.util.hexToBytes(e.serialNumber))]),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.encryptedContent.algorithm).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.NULL,!1,"")]),w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.encryptedContent.content)])}function Hy(e){var t=[];for(var n=0;n<e.length;++n)t.push(Wy(e[n]));return t}function Ky(e){var t=[];for(var n=0;n<e.length;++n)t.push($y(e[n]));return t}function qy(e){var t=w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,w.integerToDer(e.version).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[W.pki.distinguishedNameToAsn1({attributes:e.issuer}),w.create(w.Class.UNIVERSAL,w.Type.INTEGER,!1,W.util.hexToBytes(e.serialNumber))]),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.digestAlgorithm).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.NULL,!1,"")])]);if(e.authenticatedAttributesAsn1)t.value.push(e.authenticatedAttributesAsn1);if(t.value.push(w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.signatureAlgorithm).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.NULL,!1,"")])),t.value.push(w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.signature)),e.unauthenticatedAttributes.length>0){var n=w.create(w.Class.CONTEXT_SPECIFIC,1,!0,[]);for(var r=0;r<e.unauthenticatedAttributes.length;++r){var i=e.unauthenticatedAttributes[r];n.values.push(Jo(i))}t.value.push(n)}return t}function Gy(e){var t=[];for(var n=0;n<e.length;++n)t.push(qy(e[n]));return t}function Jo(e){var t;if(e.type===W.pki.oids.contentType)t=w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.value).getBytes());else if(e.type===W.pki.oids.messageDigest)t=w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.value.bytes());else if(e.type===W.pki.oids.signingTime){var n=new Date("1950-01-01T00:00:00Z"),r=new Date("2050-01-01T00:00:00Z"),i=e.value;if(typeof i==="string"){var s=Date.parse(i);if(!isNaN(s))i=new Date(s);else if(i.length===13)i=w.utcTimeToDate(i);else i=w.generalizedTimeToDate(i)}if(i>=n&&i<r)t=w.create(w.Class.UNIVERSAL,w.Type.UTCTIME,!1,w.dateToUtcTime(i));else t=w.create(w.Class.UNIVERSAL,w.Type.GENERALIZEDTIME,!1,w.dateToGeneralizedTime(i))}return w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.type).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SET,!0,[t])])}function jy(e){return[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(W.pki.oids.data).getBytes()),w.create(w.Class.UNIVERSAL,w.Type.SEQUENCE,!0,[w.create(w.Class.UNIVERSAL,w.Type.OID,!1,w.oidToDer(e.algorithm).getBytes()),!e.parameter?void 0:w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.parameter.getBytes())]),w.create(w.Class.CONTEXT_SPECIFIC,0,!0,[w.create(w.Class.UNIVERSAL,w.Type.OCTETSTRING,!1,e.content.getBytes())])]}function Zo(e,t,n){var r={},i=[];if(!w.validate(t,n,r,i)){var s=Error("Cannot read PKCS#7 message. ASN.1 object is not a supported PKCS#7 message.");throw s.errors=s,s}var a=w.derToOid(r.contentType);if(a!==W.pki.oids.data)throw Error("Unsupported PKCS#7 message. Only wrapped ContentType Data supported.");if(r.encryptedContent){var o="";if(W.util.isArray(r.encryptedContent))for(var l=0;l<r.encryptedContent.length;++l){if(r.encryptedContent[l].type!==w.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting encrypted content constructed of only OCTET STRING objects.");o+=r.encryptedContent[l].value}else o=r.encryptedContent;e.encryptedContent={algorithm:w.derToOid(r.encAlgorithm),parameter:W.util.createBuffer(r.encParameter.value),content:W.util.createBuffer(o)}}if(r.content){var o="";if(W.util.isArray(r.content))for(var l=0;l<r.content.length;++l){if(r.content[l].type!==w.Type.OCTETSTRING)throw Error("Malformed PKCS#7 message, expecting content constructed of only OCTET STRING objects.");o+=r.content[l].value}else o=r.content;e.content=W.util.createBuffer(o)}return e.version=r.version.charCodeAt(0),e.rawCapture=r,r}function Fd(e){if(e.encryptedContent.key===void 0)throw Error("Symmetric key not available.");if(e.content===void 0){var t;switch(e.encryptedContent.algorithm){case W.pki.oids["aes128-CBC"]:case W.pki.oids["aes192-CBC"]:case W.pki.oids["aes256-CBC"]:t=W.aes.createDecryptionCipher(e.encryptedContent.key);break;case W.pki.oids.desCBC:case W.pki.oids["des-EDE3-CBC"]:t=W.des.createDecryptionCipher(e.encryptedContent.key);break;default:throw Error("Unsupported symmetric cipher, OID "+e.encryptedContent.algorithm)}if(t.start(e.encryptedContent.parameter),t.update(e.encryptedContent.content),!t.finish())throw Error("Symmetric decryption failed.");e.content=t.output}}});var Hd=fe(function(b1,$d){var st=me();Nr();Tn();_s();In();Be();var Ys=$d.exports=st.ssh=st.ssh||{};Ys.privateKeyToPutty=function(e,t,n){n=n||"",t=t||"";var r="ssh-rsa",i=t===""?"none":"aes256-cbc",s="PuTTY-User-Key-File-2: "+r+`\r
16
16
  `;s+="Encryption: "+i+`\r
17
17
  `,s+="Comment: "+n+`\r
18
18
  `;var a=st.util.createBuffer();Vn(a,r),lr(a,e.e),lr(a,e.n);var o=st.util.encode64(a.bytes(),64),l=Math.floor(o.length/66)+1;s+="Public-Lines: "+l+`\r
19
- `,s+=o;var c=st.util.createBuffer();lr(c,e.d),lr(c,e.p),lr(c,e.q),lr(c,e.qInv);var u;if(!t)u=st.util.encode64(c.bytes(),64);else{var d=c.length()+16-1;d-=d%16;var f=Qs(c.bytes());f.truncate(f.length()-d+c.length()),c.putBuffer(f);var y=st.util.createBuffer();y.putBuffer(Qs("\x00\x00\x00\x00",t)),y.putBuffer(Qs("\x00\x00\x00\x01",t));var p=st.aes.createEncryptionCipher(y.truncate(8),"CBC");p.start(st.util.createBuffer().fillWithByte(0,16)),p.update(c.copy()),p.finish();var v=p.output;v.truncate(16),u=st.util.encode64(v.bytes(),64)}l=Math.floor(u.length/66)+1,s+=`\r
19
+ `,s+=o;var c=st.util.createBuffer();lr(c,e.d),lr(c,e.p),lr(c,e.q),lr(c,e.qInv);var u;if(!t)u=st.util.encode64(c.bytes(),64);else{var d=c.length()+16-1;d-=d%16;var f=Xs(c.bytes());f.truncate(f.length()-d+c.length()),c.putBuffer(f);var y=st.util.createBuffer();y.putBuffer(Xs("\x00\x00\x00\x00",t)),y.putBuffer(Xs("\x00\x00\x00\x01",t));var p=st.aes.createEncryptionCipher(y.truncate(8),"CBC");p.start(st.util.createBuffer().fillWithByte(0,16)),p.update(c.copy()),p.finish();var v=p.output;v.truncate(16),u=st.util.encode64(v.bytes(),64)}l=Math.floor(u.length/66)+1,s+=`\r
20
20
  Private-Lines: `+l+`\r
21
- `,s+=u;var x=Qs("putty-private-key-file-mac-key",t),b=st.util.createBuffer();Vn(b,r),Vn(b,i),Vn(b,n),b.putInt32(a.length()),b.putBuffer(a),b.putInt32(c.length()),b.putBuffer(c);var A=st.hmac.create();return A.start("sha1",x),A.update(b.bytes()),s+=`\r
21
+ `,s+=u;var x=Xs("putty-private-key-file-mac-key",t),b=st.util.createBuffer();Vn(b,r),Vn(b,i),Vn(b,n),b.putInt32(a.length()),b.putBuffer(a),b.putInt32(c.length()),b.putBuffer(c);var A=st.hmac.create();return A.start("sha1",x),A.update(b.bytes()),s+=`\r
22
22
  Private-MAC: `+A.digest().toHex()+`\r
23
- `,s};Xs.publicKeyToOpenSSH=function(e,t){var n="ssh-rsa";t=t||"";var r=st.util.createBuffer();return Vn(r,n),lr(r,e.e),lr(r,e.n),n+" "+st.util.encode64(r.bytes())+" "+t};Xs.privateKeyToOpenSSH=function(e,t){if(!t)return st.pki.privateKeyToPem(e);return st.pki.encryptRsaPrivateKey(e,t,{legacy:!0,algorithm:"aes128"})};Xs.getPublicKeyFingerprint=function(e,t){t=t||{};var n=t.md||st.md.md5.create(),r="ssh-rsa",i=st.util.createBuffer();Vn(i,r),lr(i,e.e),lr(i,e.n),n.start(),n.update(i.getBytes());var s=n.digest();if(t.encoding==="hex"){var a=s.toHex();if(t.delimiter)return a.match(/.{2}/g).join(t.delimiter);return a}else if(t.encoding==="binary")return s.getBytes();else if(t.encoding)throw Error('Unknown encoding "'+t.encoding+'".');return s};function lr(e,t){var n=t.toString(16);if(n[0]>="8")n="00"+n;var r=st.util.hexToBytes(n);e.putInt32(r.length),e.putBytes(r)}function Vn(e,t){e.putInt32(t.length),e.putString(t)}function Qs(){var e=st.md.sha1.create(),t=arguments.length;for(var n=0;n<t;++n)e.update(arguments[n]);return e.digest()}});var Zo=fe(function(S1,Hd){Hd.exports=me();Nr();fd();Kt();xs();mi();Id();Tn();Nd();Ld();Ud();To();Rs();nn();vo();ko();Md();Ro();So();co();Us();Dt();po();$d();Oo();Be()});var If=fe(function(CE,kf){var{create:Gv,defineProperty:aa,getOwnPropertyDescriptor:jv,getOwnPropertyNames:zv,getPrototypeOf:Qv}=Object,Xv=Object.prototype.hasOwnProperty,Yv=(e,t)=>{for(var n in t)aa(e,n,{get:t[n],enumerable:!0})},Ef=(e,t,n,r)=>{if(t&&typeof t==="object"||typeof t==="function"){for(let i of zv(t))if(!Xv.call(e,i)&&i!==n)aa(e,i,{get:()=>t[i],enumerable:!(r=jv(t,i))||r.enumerable})}return e},wf=(e,t,n)=>(n=e!=null?Gv(Qv(e)):{},Ef(t||!e||!e.__esModule?aa(n,"default",{value:e,enumerable:!0}):n,e)),Jv=(e)=>Ef(aa({},"__esModule",{value:!0}),e),Tf={};Yv(Tf,{Socks5Server:()=>_f,createServer:()=>rx,defaultConnectionHandler:()=>wl});kf.exports=Jv(Tf);var Zv=wf(ai("net")),Af=((e)=>(e[e.connect=1]="connect",e[e.bind=2]="bind",e[e.udp=3]="udp",e))(Af||{}),El=((e)=>(e[e.REQUEST_GRANTED=0]="REQUEST_GRANTED",e[e.GENERAL_FAILURE=1]="GENERAL_FAILURE",e[e.CONNECTION_NOT_ALLOWED=2]="CONNECTION_NOT_ALLOWED",e[e.NETWORK_UNREACHABLE=3]="NETWORK_UNREACHABLE",e[e.HOST_UNREACHABLE=4]="HOST_UNREACHABLE",e[e.CONNECTION_REFUSED=5]="CONNECTION_REFUSED",e[e.TTL_EXPIRED=6]="TTL_EXPIRED",e[e.COMMAND_NOT_SUPPORTED=7]="COMMAND_NOT_SUPPORTED",e[e.ADDRESS_TYPE_NOT_SUPPORTED=8]="ADDRESS_TYPE_NOT_SUPPORTED",e))(El||{}),ex=class{constructor(e,t){this.errorHandler=()=>{},this.metadata={},this.socket=t,this.server=e,t.on("error",this.errorHandler),t.pause(),this.handleGreeting()}readBytes(e){return new Promise((t)=>{let n=Buffer.allocUnsafe(e),r=0,i=(s)=>{let a=Math.min(s.length,e-r);if(s.copy(n,r,0,a),r+=a,r<e)return;this.socket.removeListener("data",i),this.socket.push(s.subarray(a)),t(n),this.socket.pause()};this.socket.on("data",i),this.socket.resume()})}async handleGreeting(){if((await this.readBytes(1)).readUInt8()!==5)return this.socket.destroy();let t=(await this.readBytes(1)).readUInt8();if(t>128||t===0)return this.socket.destroy();let n=await this.readBytes(t),r=this.server.authHandler?2:0;if(!n.includes(r))return this.socket.write(Buffer.from([5,255])),this.socket.destroy();if(this.socket.write(Buffer.from([5,r])),this.server.authHandler)this.handleUserPassword();else this.handleConnectionRequest()}async handleUserPassword(){await this.readBytes(1);let e=(await this.readBytes(1)).readUint8(),t=(await this.readBytes(e)).toString(),n=(await this.readBytes(1)).readUint8(),r=(await this.readBytes(n)).toString();this.username=t,this.password=r;let i=!1,s=()=>{if(i)return;i=!0,this.socket.write(Buffer.from([1,0])),this.handleConnectionRequest()},a=()=>{if(i)return;i=!0,this.socket.write(Buffer.from([1,1])),this.socket.destroy()},o=await this.server.authHandler(this,s,a);if(o===!0)s();else if(o===!1)a()}async handleConnectionRequest(){await this.readBytes(1);let e=(await this.readBytes(1))[0],t=Af[e];if(!t)return this.socket.destroy();this.command=t,await this.readBytes(1);let n=(await this.readBytes(1)).readUInt8(),r="";switch(n){case 1:r=(await this.readBytes(4)).join(".");break;case 3:let c=(await this.readBytes(1)).readUInt8();r=(await this.readBytes(c)).toString();break;case 4:let u=await this.readBytes(16);for(let d=0;d<16;d++){if(d%2===0&&d>0)r+=":";r+=`${u[d]<16?"0":""}${u[d].toString(16)}`}break;default:this.socket.destroy();return}let i=(await this.readBytes(2)).readUInt16BE();if(!this.server.supportedCommands.has(t))return this.socket.write(Buffer.from([5,7])),this.socket.destroy();this.destAddress=r,this.destPort=i;let s=!1,a=()=>{if(s)return;s=!0,this.connect()};if(!this.server.rulesetValidator)return a();let o=()=>{if(s)return;s=!0,this.socket.write(Buffer.from([5,2,0,1,0,0,0,0,0,0])),this.socket.destroy()},l=await this.server.rulesetValidator(this,a,o);if(l===!0)a();else if(l===!1)o()}connect(){this.socket.removeListener("error",this.errorHandler),this.server.connectionHandler(this,(e)=>{if(El[e]===void 0)throw Error(`"${e}" is not a valid status.`);if(this.socket.write(Buffer.from([5,El[e],0,1,0,0,0,0,0,0])),e!=="REQUEST_GRANTED")this.socket.destroy()}),this.socket.resume()}},tx=wf(ai("net"));function wl(e,t){if(e.command!=="connect")return t("COMMAND_NOT_SUPPORTED");e.socket.on("error",()=>{});let n=tx.default.createConnection({host:e.destAddress,port:e.destPort});n.setNoDelay();let r=!1;return n.on("error",(i)=>{if(!r)switch(i.code){case"EINVAL":case"ENOENT":case"ENOTFOUND":case"ETIMEDOUT":case"EADDRNOTAVAIL":case"EHOSTUNREACH":t("HOST_UNREACHABLE");break;case"ENETUNREACH":t("NETWORK_UNREACHABLE");break;case"ECONNREFUSED":t("CONNECTION_REFUSED");break;default:t("GENERAL_FAILURE")}}),n.on("ready",()=>{r=!0,t("REQUEST_GRANTED"),e.socket.pipe(n).pipe(e.socket)}),e.socket.on("close",()=>n.destroy()),n}var _f=class{constructor(){this.supportedCommands=new Set(["connect"]),this.connectionHandler=wl,this.server=Zv.default.createServer((e)=>{e.setNoDelay(),this._handleConnection(e)})}listen(...e){return this.server.listen(...e),this}close(e){return this.server.close(e),this}setAuthHandler(e){return this.authHandler=e,this}disableAuthHandler(){return this.authHandler=void 0,this}setRulesetValidator(e){return this.rulesetValidator=e,this}disableRulesetValidator(){return this.rulesetValidator=void 0,this}setConnectionHandler(e){return this.connectionHandler=e,this}useDefaultConnectionHandler(){return this.connectionHandler=wl,this}_handleConnection(e){return new ex(this,e),this}};function rx(e){let t=new _f;if(e?.auth)t.setAuthHandler((n)=>n.username===e.auth.username&&n.password===e.auth.password);if(e?.port)t.listen(e.port,e.hostname);return t}});import{Agent as Mv,createServer as Wv}from"http";import{request as Cl}from"http";import{request as Sf}from"https";import{connect as $v,isIP as Hv}from"net";import{URL as bf}from"url";function C(e,t){if(!process.env.SRT_DEBUG)return;let n=t?.level||"info",r="[SandboxDebug]";switch(n){case"error":console.error(`${r} ${e}`);break;case"warn":console.warn(`${r} ${e}`);break;default:console.error(`${r} ${e}`)}}import{timingSafeEqual as Jh}from"crypto";function fs(e,t){let n=Buffer.from(e),r=Buffer.from(t);if(n.length!==r.length)return!1;return Jh(n,r)}import{homedir as ps}from"os";import*as ct from"path";import*as Zr from"fs";import*as Rc from"fs";function ja(){if(process.platform!=="linux")return;try{let e=Rc.readFileSync("/proc/version",{encoding:"utf8"}),t=e.match(/WSL(\d+)/i);if(t&&t[1])return t[1];if(e.toLowerCase().includes("microsoft"))return"1";return}catch{return}}function Ne(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"unknown"}}var oi=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json"],Zh=[".git",".vscode",".idea"];function gs(){return[...Zh.filter((e)=>e!==".git"),".claude/commands",".claude/agents"]}function za(e){return e.toLowerCase()}function xt(e){return e.includes("*")||e.includes("?")||e.includes("[")||e.includes("]")}function li(e){return e.includes("*")||e.includes("?")}function Bc(e){return Ne()==="windows"?li(e):xt(e)}function Pc(e){if(/^\\\\\?\\unc\\/i.test(e))return"\\\\"+e.slice(8);if(e.startsWith("\\\\?\\"))return e.slice(4);return e}function ci(e){let t=ct.win32.toNamespacedPath(e);return/^[\\/]{2}[?.][\\/]unc[\\/]/i.test(t)}function mr(e){return e.replace(/\/\*\*$/,"")||"/"}function hs(e,t){let n=ct.normalize(e),r=ct.normalize(t);if(r===n)return!1;if(n.startsWith("/tmp/")&&r==="/private"+n)return!1;if(n.startsWith("/var/")&&r==="/private"+n)return!1;if(n.startsWith("/private/tmp/")&&r===n)return!1;if(n.startsWith("/private/var/")&&r===n)return!1;if(r==="/")return!0;if(r.split("/").filter(Boolean).length<=1)return!0;if(n.startsWith(r+"/"))return!0;let s=n;if(n.startsWith("/tmp/"))s="/private"+n;else if(n.startsWith("/var/"))s="/private"+n;if(s!==n&&s.startsWith(r+"/"))return!0;let a=r.startsWith(n+"/"),o=s!==n&&r.startsWith(s+"/");if(r!==n&&!(s!==n&&r===s)&&!a&&!o)return!0;return!1}function e0(e){if(e==="~")return ps();if(e.startsWith("~/")||process.platform==="win32"&&e.startsWith("~\\"))return ps()+e.slice(1);return e}function t0(e){let t=ps(),n=/^[A-Za-z]:/.test(t)?t.slice(0,2):"",r=n?t.slice(2):t;return e.replace(/%USERPROFILE%/gi,t).replace(/%HOMEDRIVE%/gi,n).replace(/%HOMEPATH%/gi,r)}function it(e){let t=process.cwd();if(Ne()==="windows"){if(e=Pc(t0(e)),/^[a-z]:/.test(e))e=e[0].toUpperCase()+e.slice(1);if(ci(e)&&!li(e))return ct.win32.normalize(e)}if(Ne()!=="windows"&&e.endsWith("/")&&e!=="/"&&!Bc(e))e=e.replace(/\/+$/,"")||"/";let n=e0(e);if(n!==e);else if(e.startsWith("./")||e.startsWith("../"))n=ct.resolve(t,e);else if(!ct.isAbsolute(e))n=ct.resolve(t,e);if(Bc(n)){let r=Ne()==="windows"?/[*?]/:/[*?[\]]/,i=n.split(r)[0];if(i&&i!=="/"){let s=i.endsWith("/")?i.slice(0,-1):ct.dirname(i);try{let a=Zr.realpathSync(s);if(!hs(s,a)){let o=n.slice(s.length);return a+o}}catch{}}return n}try{let r=Zr.realpathSync(n);if(hs(n,r));else n=r}catch{}return n}function bn(e){let t=e??ps();return["/dev/stdout","/dev/stderr","/dev/null","/dev/tty","/dev/dtracehelper","/dev/autofs_nowait","/tmp/claude","/private/tmp/claude",ct.join(t,".npm/_logs"),ct.join(t,".claude/debug")]}var r0=["NODE_EXTRA_CA_CERTS","SSL_CERT_FILE","CURL_CA_BUNDLE","REQUESTS_CA_BUNDLE","PIP_CERT","GIT_SSL_CAINFO","AWS_CA_BUNDLE","CARGO_HTTP_CAINFO","DENO_CERT","CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","NIX_SSL_CERT_FILE"];function Cn(e,t,n,r,i,s){let a=i0(s),o=a===gr?a:encodeURIComponent(a),l=r?`${o}:${r}@`:"",c=Ne()==="linux"?"127.0.0.1":"localhost",u=["SANDBOX_RUNTIME=1"];if(!i){let y=process.env.CLAUDE_CODE_TMPDIR||process.env.CLAUDE_TMPDIR||"/tmp/claude";u.push(`TMPDIR=${y}`)}if(n)for(let y of r0)u.push(`${y}=${n}`);if(!e&&!t)return u;let d=["localhost","127.0.0.1","::1","169.254.0.0/16","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"].join(",");if(u.push(`NO_PROXY=${d}`),u.push(`no_proxy=${d}`),e){if(u.push(`HTTP_PROXY=http://${l}${c}:${e}`),u.push(`HTTPS_PROXY=http://${l}${c}:${e}`),u.push(`http_proxy=http://${l}${c}:${e}`),u.push(`https_proxy=http://${l}${c}:${e}`),r)u.push("GIT_CONFIG_PARAMETERS='http.proxyAuthMethod=basic'")}let f=e?`http://${l}${c}:${e}`:`socks5h://${l}${c}:${t}`;if(u.push(`ALL_PROXY=${f}`),u.push(`all_proxy=${f}`),u.push(`GRPC_PROXY=${f}`),u.push(`grpc_proxy=${f}`),t){let p=Ne();if(p==="macos")u.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:${t} %h %p'`);else if(p==="linux"&&e){let v=r?`,proxyauth=${a}:${r}`:"";u.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='socat - PROXY:${c}:%h:%p,proxyport=${e}${v}'`)}if(u.push(`FTP_PROXY=socks5h://${l}${c}:${t}`),u.push(`ftp_proxy=socks5h://${l}${c}:${t}`),u.push(`RSYNC_PROXY=${c}:${t}`),u.push(`DOCKER_HTTP_PROXY=http://${l}${c}:${e||t}`),u.push(`DOCKER_HTTPS_PROXY=http://${l}${c}:${e||t}`),e){if(u.push("CLOUDSDK_PROXY_TYPE=http"),u.push(`CLOUDSDK_PROXY_ADDRESS=${c}`),u.push(`CLOUDSDK_PROXY_PORT=${e}`),r)u.push(`CLOUDSDK_PROXY_USERNAME=${a}`),u.push(`CLOUDSDK_PROXY_PASSWORD=${r}`)}}return u}var n0=8;function ui(e){if(e.baseEnv?.GIT_CONFIG_COUNT==="0")return{};let t=Number.parseInt(e.baseEnv?.GIT_CONFIG_COUNT??"",10),n=Number.isFinite(t)&&t>=0?t:0,r=n,i={},s=(o,l)=>{i[`GIT_CONFIG_KEY_${r}`]=o,i[`GIT_CONFIG_VALUE_${r}`]=l,r++},a=[...new Set(e.safeDirs.filter((o)=>!!o).map((o)=>{let c=o.replace(/\\/g,"/").replace(/\/+$/,"");if(c===""||/^[A-Za-z]:$/.test(c))return`${c}/`;return c}))];if(a.length>n0)s("safe.directory","*");else for(let o of a)s("safe.directory",o),s("safe.directory",o.endsWith("/")?`${o}*`:`${o}/*`);if(e.schannelCa)s("http.schannelUseSSLCAInfo","true"),s("http.schannelCheckRevoke","false");if(r===n)return{};return i.GIT_CONFIG_COUNT=String(r),i}function ms(e){let t={GIT_CONFIG_COUNT:process.env.GIT_CONFIG_COUNT};for(let n of e.unsetEnvVars??[])delete t[n];return Object.assign(t,e.setEnvVars??{}),ui({safeDirs:e.safeDirs,baseEnv:t})}function Nt(e){let t=e.slice(0,100);return Buffer.from(t).toString("base64")}function en(e){return Buffer.from(e,"base64").toString("utf8")}var gr="srt";function i0(e){if(!e)return gr;let t=`${gr}.${e}`;return Buffer.byteLength(t)<=255?t:gr}function ys(e){if(!e||!e.startsWith(`${gr}.`))return;return e.slice(gr.length+1)||void 0}function di(e){return"^"+e.replace(/[.^$+{}()|\\]/g,"\\$&").replace(/\[([^\]]*?)$/g,"\\[$1").replace(/\*\*\//g,"__GLOBSTAR_SLASH__").replace(/\*\*/g,"__GLOBSTAR__").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/__GLOBSTAR_SLASH__/g,"(.*/)?").replace(/__GLOBSTAR__/g,".*")+"$"}function tn(e,t={}){let n=(l)=>process.platform==="win32"?l.replace(/\\/g,"/"):l,r=n(it(e)),i=r.split(/[*?[\]]/)[0];if(!i||i==="/")return C(`[Sandbox] Glob pattern too broad, skipping: ${e}`),[];let s=i.endsWith("/")?i.slice(0,-1):ct.dirname(i);if(!Zr.existsSync(s))return C(`[Sandbox] Base directory for glob does not exist: ${s}`),[];let a=new RegExp(di(r),t.caseInsensitive?"i":""),o=[];try{let l=Zr.readdirSync(s,{recursive:!0,withFileTypes:!0});for(let c of l){let u=c.parentPath??c.path??s,d=ct.join(u,c.name);if(a.test(n(d)))o.push(d)}}catch(l){C(`[Sandbox] Error expanding glob pattern ${e}: ${l}`)}return o}var Gd=Ga(Zo(),1);import{sign as Gy,X509Certificate as jy}from"crypto";import{mkdtempSync as tl,readFileSync as rl,writeFileSync as nl}from"fs";import{rm as zy}from"fs/promises";import{tmpdir as il}from"os";import{join as Mn,dirname as el}from"path";import{rootCertificates as Qy}from"tls";var{asn1:Ze,pki:Gt,md:Xy,random:Yy,util:jd}=Gd.default,Jy=Gt.getTBSCertificate,Zy=/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g,Ys="/srt.crl";function sl(e){let t=e.getExtension("subjectKeyIdentifier");return t?.subjectKeyIdentifier?jd.hexToBytes(t.subjectKeyIdentifier):e.generateSubjectKeyIdentifier().getBytes()}function al(e,t){let n=Gt.oids.sha256WithRSAEncryption;e.siginfo.algorithmOid=n,e.signatureOid=n,e.tbsCertificate=Jy(e);let r=Ze.toDer(e.tbsCertificate).getBytes();e.signature=zd(r,t),e.md=Xy.sha256.create(),e.md.update(r)}function zd(e,t){return Gy("sha256",Buffer.from(e,"binary"),t).toString("binary")}function ol(e){if(e.caCertPem&&e.caKeyPem){let t=ki(e.caCertPem,e.caKeyPem);if(!t.ok)throw Error(`tlsTerminate: CA PEM pair: ${t.reason}`);return ll(e.caCertPem,e.caKeyPem,t.cert,t.key,{certPath:e.caCertPath??"",keyPath:e.caKeyPath??"",extraCaCertPaths:e.extraCaCertPaths})}if(e.caCertPath&&e.caKeyPath)return rv(e.caCertPath,e.caKeyPath,e.extraCaCertPaths);if(e.caCertPath||e.caKeyPath)throw Error("tlsTerminate: caCertPath and caKeyPath must be provided together");return nv(e.extraCaCertPaths)}async function Qd(e){let t=new Set([el(e.trustBundlePath)]);if(e.ephemeral){if(t.add(el(e.certPath)),e.keyPath)t.add(el(e.keyPath))}for(let n of t)try{await zy(n,{recursive:!0,force:!0})}catch(r){C(`[mitm-ca] cleanup failed: ${r.message}`,{level:"warn"})}}function ev(e,t,n){let r=[t.trim(),...Qy],i=process.env.NODE_EXTRA_CA_CERTS;if(i)try{r.push(rl(i,"utf8").trim())}catch{}for(let a of n??[]){let o;try{o=rl(a,"utf8")}catch(c){let u=c.code??String(c);C(`[mitm-ca] extraCaCertPaths: cannot read ${a} (${u}); skipping`,{level:"warn"});continue}let l=o.match(Zy);if(!l){C(`[mitm-ca] extraCaCertPaths: ${a} has no PEM CERTIFICATE block; skipping`,{level:"warn"});continue}r.push(...l)}let s=Mn(e,"trust-bundle.crt");return nl(s,r.join(`
23
+ `,s};Ys.publicKeyToOpenSSH=function(e,t){var n="ssh-rsa";t=t||"";var r=st.util.createBuffer();return Vn(r,n),lr(r,e.e),lr(r,e.n),n+" "+st.util.encode64(r.bytes())+" "+t};Ys.privateKeyToOpenSSH=function(e,t){if(!t)return st.pki.privateKeyToPem(e);return st.pki.encryptRsaPrivateKey(e,t,{legacy:!0,algorithm:"aes128"})};Ys.getPublicKeyFingerprint=function(e,t){t=t||{};var n=t.md||st.md.md5.create(),r="ssh-rsa",i=st.util.createBuffer();Vn(i,r),lr(i,e.e),lr(i,e.n),n.start(),n.update(i.getBytes());var s=n.digest();if(t.encoding==="hex"){var a=s.toHex();if(t.delimiter)return a.match(/.{2}/g).join(t.delimiter);return a}else if(t.encoding==="binary")return s.getBytes();else if(t.encoding)throw Error('Unknown encoding "'+t.encoding+'".');return s};function lr(e,t){var n=t.toString(16);if(n[0]>="8")n="00"+n;var r=st.util.hexToBytes(n);e.putInt32(r.length),e.putBytes(r)}function Vn(e,t){e.putInt32(t.length),e.putString(t)}function Xs(){var e=st.md.sha1.create(),t=arguments.length;for(var n=0;n<t;++n)e.update(arguments[n]);return e.digest()}});var el=fe(function(C1,Kd){Kd.exports=me();Nr();pd();Kt();Ss();yi();Rd();Tn();Dd();Od();Vd();Ao();Bs();nn();xo();Io();Wd();Bo();bo();uo();Vs();Dt();ho();Hd();Uo();Be()});var Rf=fe(function(wE,If){var{create:zv,defineProperty:oa,getOwnPropertyDescriptor:Qv,getOwnPropertyNames:Xv,getPrototypeOf:Yv}=Object,Jv=Object.prototype.hasOwnProperty,Zv=(e,t)=>{for(var n in t)oa(e,n,{get:t[n],enumerable:!0})},wf=(e,t,n,r)=>{if(t&&typeof t==="object"||typeof t==="function"){for(let i of Xv(t))if(!Jv.call(e,i)&&i!==n)oa(e,i,{get:()=>t[i],enumerable:!(r=Qv(t,i))||r.enumerable})}return e},Tf=(e,t,n)=>(n=e!=null?zv(Yv(e)):{},wf(t||!e||!e.__esModule?oa(n,"default",{value:e,enumerable:!0}):n,e)),ex=(e)=>wf(oa({},"__esModule",{value:!0}),e),Af={};Zv(Af,{Socks5Server:()=>kf,createServer:()=>ix,defaultConnectionHandler:()=>Tl});If.exports=ex(Af);var tx=Tf(oi("net")),_f=((e)=>(e[e.connect=1]="connect",e[e.bind=2]="bind",e[e.udp=3]="udp",e))(_f||{}),wl=((e)=>(e[e.REQUEST_GRANTED=0]="REQUEST_GRANTED",e[e.GENERAL_FAILURE=1]="GENERAL_FAILURE",e[e.CONNECTION_NOT_ALLOWED=2]="CONNECTION_NOT_ALLOWED",e[e.NETWORK_UNREACHABLE=3]="NETWORK_UNREACHABLE",e[e.HOST_UNREACHABLE=4]="HOST_UNREACHABLE",e[e.CONNECTION_REFUSED=5]="CONNECTION_REFUSED",e[e.TTL_EXPIRED=6]="TTL_EXPIRED",e[e.COMMAND_NOT_SUPPORTED=7]="COMMAND_NOT_SUPPORTED",e[e.ADDRESS_TYPE_NOT_SUPPORTED=8]="ADDRESS_TYPE_NOT_SUPPORTED",e))(wl||{}),rx=class{constructor(e,t){this.errorHandler=()=>{},this.metadata={},this.socket=t,this.server=e,t.on("error",this.errorHandler),t.pause(),this.handleGreeting()}readBytes(e){return new Promise((t)=>{let n=Buffer.allocUnsafe(e),r=0,i=(s)=>{let a=Math.min(s.length,e-r);if(s.copy(n,r,0,a),r+=a,r<e)return;this.socket.removeListener("data",i),this.socket.push(s.subarray(a)),t(n),this.socket.pause()};this.socket.on("data",i),this.socket.resume()})}async handleGreeting(){if((await this.readBytes(1)).readUInt8()!==5)return this.socket.destroy();let t=(await this.readBytes(1)).readUInt8();if(t>128||t===0)return this.socket.destroy();let n=await this.readBytes(t),r=this.server.authHandler?2:0;if(!n.includes(r))return this.socket.write(Buffer.from([5,255])),this.socket.destroy();if(this.socket.write(Buffer.from([5,r])),this.server.authHandler)this.handleUserPassword();else this.handleConnectionRequest()}async handleUserPassword(){await this.readBytes(1);let e=(await this.readBytes(1)).readUint8(),t=(await this.readBytes(e)).toString(),n=(await this.readBytes(1)).readUint8(),r=(await this.readBytes(n)).toString();this.username=t,this.password=r;let i=!1,s=()=>{if(i)return;i=!0,this.socket.write(Buffer.from([1,0])),this.handleConnectionRequest()},a=()=>{if(i)return;i=!0,this.socket.write(Buffer.from([1,1])),this.socket.destroy()},o=await this.server.authHandler(this,s,a);if(o===!0)s();else if(o===!1)a()}async handleConnectionRequest(){await this.readBytes(1);let e=(await this.readBytes(1))[0],t=_f[e];if(!t)return this.socket.destroy();this.command=t,await this.readBytes(1);let n=(await this.readBytes(1)).readUInt8(),r="";switch(n){case 1:r=(await this.readBytes(4)).join(".");break;case 3:let c=(await this.readBytes(1)).readUInt8();r=(await this.readBytes(c)).toString();break;case 4:let u=await this.readBytes(16);for(let d=0;d<16;d++){if(d%2===0&&d>0)r+=":";r+=`${u[d]<16?"0":""}${u[d].toString(16)}`}break;default:this.socket.destroy();return}let i=(await this.readBytes(2)).readUInt16BE();if(!this.server.supportedCommands.has(t))return this.socket.write(Buffer.from([5,7])),this.socket.destroy();this.destAddress=r,this.destPort=i;let s=!1,a=()=>{if(s)return;s=!0,this.connect()};if(!this.server.rulesetValidator)return a();let o=()=>{if(s)return;s=!0,this.socket.write(Buffer.from([5,2,0,1,0,0,0,0,0,0])),this.socket.destroy()},l=await this.server.rulesetValidator(this,a,o);if(l===!0)a();else if(l===!1)o()}connect(){this.socket.removeListener("error",this.errorHandler),this.server.connectionHandler(this,(e)=>{if(wl[e]===void 0)throw Error(`"${e}" is not a valid status.`);if(this.socket.write(Buffer.from([5,wl[e],0,1,0,0,0,0,0,0])),e!=="REQUEST_GRANTED")this.socket.destroy()}),this.socket.resume()}},nx=Tf(oi("net"));function Tl(e,t){if(e.command!=="connect")return t("COMMAND_NOT_SUPPORTED");e.socket.on("error",()=>{});let n=nx.default.createConnection({host:e.destAddress,port:e.destPort});n.setNoDelay();let r=!1;return n.on("error",(i)=>{if(!r)switch(i.code){case"EINVAL":case"ENOENT":case"ENOTFOUND":case"ETIMEDOUT":case"EADDRNOTAVAIL":case"EHOSTUNREACH":t("HOST_UNREACHABLE");break;case"ENETUNREACH":t("NETWORK_UNREACHABLE");break;case"ECONNREFUSED":t("CONNECTION_REFUSED");break;default:t("GENERAL_FAILURE")}}),n.on("ready",()=>{r=!0,t("REQUEST_GRANTED"),e.socket.pipe(n).pipe(e.socket)}),e.socket.on("close",()=>n.destroy()),n}var kf=class{constructor(){this.supportedCommands=new Set(["connect"]),this.connectionHandler=Tl,this.server=tx.default.createServer((e)=>{e.setNoDelay(),this._handleConnection(e)})}listen(...e){return this.server.listen(...e),this}close(e){return this.server.close(e),this}setAuthHandler(e){return this.authHandler=e,this}disableAuthHandler(){return this.authHandler=void 0,this}setRulesetValidator(e){return this.rulesetValidator=e,this}disableRulesetValidator(){return this.rulesetValidator=void 0,this}setConnectionHandler(e){return this.connectionHandler=e,this}useDefaultConnectionHandler(){return this.connectionHandler=Tl,this}_handleConnection(e){return new rx(this,e),this}};function ix(e){let t=new kf;if(e?.auth)t.setAuthHandler((n)=>n.username===e.auth.username&&n.password===e.auth.password);if(e?.port)t.listen(e.port,e.hostname);return t}});import{Agent as $v,createServer as Hv}from"http";import{request as El}from"http";import{request as bf}from"https";import{connect as Kv,isIP as qv}from"net";import{URL as Cf}from"url";function C(e,t){if(!process.env.SRT_DEBUG)return;let n=t?.level||"info",r="[SandboxDebug]";switch(n){case"error":console.error(`${r} ${e}`);break;case"warn":console.warn(`${r} ${e}`);break;default:console.error(`${r} ${e}`)}}import{timingSafeEqual as e0}from"crypto";function ps(e,t){let n=Buffer.from(e),r=Buffer.from(t);if(n.length!==r.length)return!1;return e0(n,r)}import{homedir as hs}from"os";import*as ct from"path";import*as Zr from"fs";import*as Bc from"fs";function za(){if(process.platform!=="linux")return;try{let e=Bc.readFileSync("/proc/version",{encoding:"utf8"}),t=e.match(/WSL(\d+)/i);if(t&&t[1])return t[1];if(e.toLowerCase().includes("microsoft"))return"1";return}catch{return}}function Ne(){switch(process.platform){case"darwin":return"macos";case"linux":return"linux";case"win32":return"windows";default:return"unknown"}}var li=[".gitconfig",".gitmodules",".bashrc",".bash_profile",".zshrc",".zprofile",".profile",".ripgreprc",".mcp.json"],t0=[".git",".vscode",".idea"];function ms(){return[...t0.filter((e)=>e!==".git"),".claude/commands",".claude/agents"]}function Qa(e){return e.toLowerCase()}function xt(e){return e.includes("*")||e.includes("?")||e.includes("[")||e.includes("]")}function ci(e){return e.includes("*")||e.includes("?")}function Pc(e){return Ne()==="windows"?ci(e):xt(e)}function Nc(e){if(/^\\\\\?\\unc\\/i.test(e))return"\\\\"+e.slice(8);if(e.startsWith("\\\\?\\"))return e.slice(4);return e}function ui(e){let t=ct.win32.toNamespacedPath(e);return/^[\\/]{2}[?.][\\/]unc[\\/]/i.test(t)}function mr(e){return e.replace(/\/\*\*$/,"")||"/"}function gs(e,t){let n=ct.normalize(e),r=ct.normalize(t);if(r===n)return!1;if(n.startsWith("/tmp/")&&r==="/private"+n)return!1;if(n.startsWith("/var/")&&r==="/private"+n)return!1;if(n.startsWith("/private/tmp/")&&r===n)return!1;if(n.startsWith("/private/var/")&&r===n)return!1;if(r==="/")return!0;if(r.split("/").filter(Boolean).length<=1)return!0;if(n.startsWith(r+"/"))return!0;let s=n;if(n.startsWith("/tmp/"))s="/private"+n;else if(n.startsWith("/var/"))s="/private"+n;if(s!==n&&s.startsWith(r+"/"))return!0;let a=r.startsWith(n+"/"),o=s!==n&&r.startsWith(s+"/");if(r!==n&&!(s!==n&&r===s)&&!a&&!o)return!0;return!1}function r0(e){if(e==="~")return hs();if(e.startsWith("~/")||process.platform==="win32"&&e.startsWith("~\\"))return hs()+e.slice(1);return e}function n0(e){let t=hs(),n=/^[A-Za-z]:/.test(t)?t.slice(0,2):"",r=n?t.slice(2):t;return e.replace(/%USERPROFILE%/gi,t).replace(/%HOMEDRIVE%/gi,n).replace(/%HOMEPATH%/gi,r)}function it(e){let t=process.cwd();if(Ne()==="windows"){if(e=Nc(n0(e)),/^[a-z]:/.test(e))e=e[0].toUpperCase()+e.slice(1);if(ui(e)&&!ci(e))return ct.win32.normalize(e)}if(Ne()!=="windows"&&e.endsWith("/")&&e!=="/"&&!Pc(e))e=e.replace(/\/+$/,"")||"/";let n=r0(e);if(n!==e);else if(e.startsWith("./")||e.startsWith("../"))n=ct.resolve(t,e);else if(!ct.isAbsolute(e))n=ct.resolve(t,e);if(Pc(n)){let r=Ne()==="windows"?/[*?]/:/[*?[\]]/,i=n.split(r)[0];if(i&&i!=="/"){let s=i.endsWith("/")?i.slice(0,-1):ct.dirname(i);try{let a=Zr.realpathSync(s);if(!gs(s,a)){let o=n.slice(s.length);return a+o}}catch{}}return n}try{let r=Zr.realpathSync(n);if(gs(n,r));else n=r}catch{}return n}function bn(e){let t=e??hs();return["/dev/stdout","/dev/stderr","/dev/null","/dev/tty","/dev/dtracehelper","/dev/autofs_nowait","/tmp/claude","/private/tmp/claude",ct.join(t,".npm/_logs"),ct.join(t,".claude/debug")]}var i0=["NODE_EXTRA_CA_CERTS","SSL_CERT_FILE","CURL_CA_BUNDLE","REQUESTS_CA_BUNDLE","PIP_CERT","GIT_SSL_CAINFO","AWS_CA_BUNDLE","CARGO_HTTP_CAINFO","DENO_CERT","CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","NIX_SSL_CERT_FILE"];function Cn(e,t,n,r,i,s){let a=a0(s),o=a===gr?a:encodeURIComponent(a),l=r?`${o}:${r}@`:"",c=Ne()==="linux"?"127.0.0.1":"localhost",u=["SANDBOX_RUNTIME=1"];if(!i){let y=process.env.CLAUDE_CODE_TMPDIR||process.env.CLAUDE_TMPDIR||"/tmp/claude";u.push(`TMPDIR=${y}`)}if(n)for(let y of i0)u.push(`${y}=${n}`);if(!e&&!t)return u;let d=["localhost","127.0.0.1","::1","169.254.0.0/16","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"].join(",");if(u.push(`NO_PROXY=${d}`),u.push(`no_proxy=${d}`),e){if(u.push(`HTTP_PROXY=http://${l}${c}:${e}`),u.push(`HTTPS_PROXY=http://${l}${c}:${e}`),u.push(`http_proxy=http://${l}${c}:${e}`),u.push(`https_proxy=http://${l}${c}:${e}`),r)u.push("GIT_CONFIG_PARAMETERS='http.proxyAuthMethod=basic'")}let f=e?`http://${l}${c}:${e}`:`socks5h://${l}${c}:${t}`;if(u.push(`ALL_PROXY=${f}`),u.push(`all_proxy=${f}`),u.push(`GRPC_PROXY=${f}`),u.push(`grpc_proxy=${f}`),t){let p=Ne();if(p==="macos")u.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:${t} %h %p'`);else if(p==="linux"&&e){let v=r?`,proxyauth=${a}:${r}`:"";u.push(`GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='socat - PROXY:${c}:%h:%p,proxyport=${e}${v}'`)}if(u.push(`FTP_PROXY=socks5h://${l}${c}:${t}`),u.push(`ftp_proxy=socks5h://${l}${c}:${t}`),u.push(`RSYNC_PROXY=${c}:${t}`),u.push(`DOCKER_HTTP_PROXY=http://${l}${c}:${e||t}`),u.push(`DOCKER_HTTPS_PROXY=http://${l}${c}:${e||t}`),e){if(u.push("CLOUDSDK_PROXY_TYPE=http"),u.push(`CLOUDSDK_PROXY_ADDRESS=${c}`),u.push(`CLOUDSDK_PROXY_PORT=${e}`),r)u.push(`CLOUDSDK_PROXY_USERNAME=${a}`),u.push(`CLOUDSDK_PROXY_PASSWORD=${r}`)}}return u}var s0=8;function di(e){if(e.baseEnv?.GIT_CONFIG_COUNT==="0")return{};let t=Number.parseInt(e.baseEnv?.GIT_CONFIG_COUNT??"",10),n=Number.isFinite(t)&&t>=0?t:0,r=n,i={},s=(o,l)=>{i[`GIT_CONFIG_KEY_${r}`]=o,i[`GIT_CONFIG_VALUE_${r}`]=l,r++},a=[...new Set(e.safeDirs.filter((o)=>!!o).map((o)=>{let c=o.replace(/\\/g,"/").replace(/\/+$/,"");if(c===""||/^[A-Za-z]:$/.test(c))return`${c}/`;return c}))];if(a.length>s0)s("safe.directory","*");else for(let o of a)s("safe.directory",o),s("safe.directory",o.endsWith("/")?`${o}*`:`${o}/*`);if(e.schannelCa)s("http.schannelUseSSLCAInfo","true"),s("http.schannelCheckRevoke","false");if(r===n)return{};return i.GIT_CONFIG_COUNT=String(r),i}function ys(e){let t={GIT_CONFIG_COUNT:process.env.GIT_CONFIG_COUNT};for(let n of e.unsetEnvVars??[])delete t[n];return Object.assign(t,e.setEnvVars??{}),di({safeDirs:e.safeDirs,baseEnv:t})}function Nt(e){let t=e.slice(0,100);return Buffer.from(t).toString("base64")}function en(e){return Buffer.from(e,"base64").toString("utf8")}var gr="srt";function a0(e){if(!e)return gr;let t=`${gr}.${e}`;return Buffer.byteLength(t)<=255?t:gr}function vs(e){if(!e||!e.startsWith(`${gr}.`))return;return e.slice(gr.length+1)||void 0}function fi(e){return"^"+e.replace(/[.^$+{}()|\\]/g,"\\$&").replace(/\[([^\]]*?)$/g,"\\[$1").replace(/\*\*\//g,"__GLOBSTAR_SLASH__").replace(/\*\*/g,"__GLOBSTAR__").replace(/\*/g,"[^/]*").replace(/\?/g,"[^/]").replace(/__GLOBSTAR_SLASH__/g,"(.*/)?").replace(/__GLOBSTAR__/g,".*")+"$"}function tn(e,t={}){let n=(l)=>process.platform==="win32"?l.replace(/\\/g,"/"):l,r=n(it(e)),i=r.split(/[*?[\]]/)[0];if(!i||i==="/")return C(`[Sandbox] Glob pattern too broad, skipping: ${e}`),[];let s=i.endsWith("/")?i.slice(0,-1):ct.dirname(i);if(!Zr.existsSync(s))return C(`[Sandbox] Base directory for glob does not exist: ${s}`),[];let a=new RegExp(fi(r),t.caseInsensitive?"i":""),o=[];try{let l=Zr.readdirSync(s,{recursive:!0,withFileTypes:!0});for(let c of l){let u=c.parentPath??c.path??s,d=ct.join(u,c.name);if(a.test(n(d)))o.push(d)}}catch(l){C(`[Sandbox] Error expanding glob pattern ${e}: ${l}`)}return o}var jd=ja(el(),1);import{sign as zy,X509Certificate as Qy}from"crypto";import{mkdtempSync as rl,readFileSync as nl,writeFileSync as il}from"fs";import{rm as Xy}from"fs/promises";import{tmpdir as sl}from"os";import{join as Mn,dirname as tl}from"path";import{rootCertificates as Yy}from"tls";var{asn1:Ze,pki:Gt,md:Jy,random:Zy,util:zd}=jd.default,ev=Gt.getTBSCertificate,tv=/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g,Js="/srt.crl";function al(e){let t=e.getExtension("subjectKeyIdentifier");return t?.subjectKeyIdentifier?zd.hexToBytes(t.subjectKeyIdentifier):e.generateSubjectKeyIdentifier().getBytes()}function ol(e,t){let n=Gt.oids.sha256WithRSAEncryption;e.siginfo.algorithmOid=n,e.signatureOid=n,e.tbsCertificate=ev(e);let r=Ze.toDer(e.tbsCertificate).getBytes();e.signature=Qd(r,t),e.md=Jy.sha256.create(),e.md.update(r)}function Qd(e,t){return zy("sha256",Buffer.from(e,"binary"),t).toString("binary")}function ll(e){if(e.caCertPem&&e.caKeyPem){let t=Ii(e.caCertPem,e.caKeyPem);if(!t.ok)throw Error(`tlsTerminate: CA PEM pair: ${t.reason}`);return cl(e.caCertPem,e.caKeyPem,t.cert,t.key,{certPath:e.caCertPath??"",keyPath:e.caKeyPath??"",extraCaCertPaths:e.extraCaCertPaths})}if(e.caCertPath&&e.caKeyPath)return iv(e.caCertPath,e.caKeyPath,e.extraCaCertPaths);if(e.caCertPath||e.caKeyPath)throw Error("tlsTerminate: caCertPath and caKeyPath must be provided together");return sv(e.extraCaCertPaths)}async function Xd(e){let t=new Set([tl(e.trustBundlePath)]);if(e.ephemeral){if(t.add(tl(e.certPath)),e.keyPath)t.add(tl(e.keyPath))}for(let n of t)try{await Xy(n,{recursive:!0,force:!0})}catch(r){C(`[mitm-ca] cleanup failed: ${r.message}`,{level:"warn"})}}function rv(e,t,n){let r=[t.trim(),...Yy],i=process.env.NODE_EXTRA_CA_CERTS;if(i)try{r.push(nl(i,"utf8").trim())}catch{}for(let a of n??[]){let o;try{o=nl(a,"utf8")}catch(c){let u=c.code??String(c);C(`[mitm-ca] extraCaCertPaths: cannot read ${a} (${u}); skipping`,{level:"warn"});continue}let l=o.match(tv);if(!l){C(`[mitm-ca] extraCaCertPaths: ${a} has no PEM CERTIFICATE block; skipping`,{level:"warn"});continue}r.push(...l)}let s=Mn(e,"trust-bundle.crt");return il(s,r.join(`
24
24
  `)+`
25
- `,{mode:420}),s}function tv(e,t){let n=Gt.oids.sha256WithRSAEncryption,r=()=>Fn([Ze.create(Wt.UNIVERSAL,cr.OID,!1,Ze.oidToDer(n).getBytes()),Ze.create(Wt.UNIVERSAL,cr.NULL,!1,"")]),i=(f,y)=>Fn([Ze.create(Wt.UNIVERSAL,cr.OID,!1,Ze.oidToDer(f).getBytes()),Ze.create(Wt.UNIVERSAL,cr.OCTETSTRING,!1,Ze.toDer(y).getBytes())]),s=Ze.create(Wt.CONTEXT_SPECIFIC,0,!0,[Fn([i(Gt.oids.authorityKeyIdentifier,Fn([Ze.create(Wt.CONTEXT_SPECIFIC,0,!1,sl(e))])),i("2.5.29.20",Ze.create(Wt.UNIVERSAL,cr.INTEGER,!1,"\x01"))])]),a=new Date,o=e.validity.notAfter,l=o>a?o:_i(1),c=Fn([Ze.create(Wt.UNIVERSAL,cr.INTEGER,!1,"\x01"),r(),Gt.distinguishedNameToAsn1(e.subject),Kd(a),Kd(l),s]),u=zd(Ze.toDer(c).getBytes(),t),d=Fn([c,r(),Ze.create(Wt.UNIVERSAL,cr.BITSTRING,!1,"\x00"+u)]);return Buffer.from(Ze.toDer(d).getBytes(),"binary")}var{Class:Wt,Type:cr}=Ze;function Fn(e){return Ze.create(Wt.UNIVERSAL,cr.SEQUENCE,!0,e)}function Kd(e){return e.getUTCFullYear()<2050?Ze.create(Wt.UNIVERSAL,cr.UTCTIME,!1,Ze.dateToUtcTime(e)):Ze.create(Wt.UNIVERSAL,cr.GENERALIZEDTIME,!1,Ze.dateToGeneralizedTime(e))}function rv(e,t,n){let r=qd(e,"CERTIFICATE","tlsTerminate.caCertPath"),i=qd(t,"PRIVATE KEY","tlsTerminate.caKeyPath"),s=ki(r,i);if(!s.ok)throw Error(`tlsTerminate: CA at ${e}: ${s.reason}`);return C(`[mitm-ca] loaded CA from ${e}`),ll(r,i,s.cert,s.key,{certPath:e,keyPath:t,extraCaCertPaths:n})}function ll(e,t,n,r,i){let s=tl(Mn(il(),"srt-ca-"));return{certPath:i.certPath,keyPath:i.keyPath,trustBundlePath:ev(s,e,i.extraCaCertPaths),certPem:e,keyPem:t,cert:n,key:r,leafCerts:new Map,secureContexts:new Map,crlDer:tv(n,t),ephemeral:i.ephemeral??!1}}function Js(e={}){let t=Gt.rsa.generateKeyPair(2048),n=Gt.createCertificate();n.publicKey=t.publicKey,n.serialNumber=cl(),n.validity.notBefore=_i(-1),n.validity.notAfter=_i(e.validityDays??825);let r=[{name:"commonName",value:e.cn??"sandbox-runtime ephemeral CA"},{name:"organizationName",value:"sandbox-runtime"}];n.setSubject(r),n.setIssuer(r),n.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",critical:!0,keyCertSign:!0,cRLSign:!0,digitalSignature:!0},{name:"subjectKeyIdentifier"}]);let i=Gt.privateKeyToPem(t.privateKey);return al(n,i),{certPem:Gt.certificateToPem(n),keyPem:i,cert:n,key:t.privateKey}}function Wn(e){return new jy(e).fingerprint.replace(/:/g,"").toUpperCase()}function ki(e,t){let n,r;try{n=Gt.certificateFromPem(e),r=Gt.privateKeyFromPem(t)}catch(a){return{ok:!1,reason:`parse: ${a.message}`}}if(!("n"in r)||!("d"in r))return{ok:!1,reason:"key is not RSA"};if(n.validity.notBefore.getTime()>Date.now())return{ok:!1,reason:`notBefore ${n.validity.notBefore.toISOString()} is in the future (clock skew?)`};let i=n.publicKey;if(!("n"in i)||i.n.compareTo(r.n))return{ok:!1,reason:"key does not match certificate public key"};let s;try{s=Wn(e)}catch(a){return{ok:!1,reason:`thumbprint: ${a.message}`}}return{ok:!0,thumbprint:s,notAfter:n.validity.notAfter,cert:n,key:r}}function nv(e){let{certPem:t,keyPem:n,cert:r,key:i}=Js(),s=tl(Mn(il(),"srt-ca-")),a=Mn(s,"ca.crt"),o=Mn(tl(Mn(il(),"srt-ca-key-")),"ca.key");return nl(a,t,{mode:420}),nl(o,n,{mode:384}),C(`[mitm-ca] generated ephemeral CA at ${a}`),ll(t,n,r,i,{certPath:a,keyPath:o,extraCaCertPaths:e,ephemeral:!0})}function qd(e,t,n){let r;try{r=rl(e,"utf8")}catch(i){let s=i.code??String(i);throw Error(`${n}: cannot read ${e} (${s})`)}if(!new RegExp(`-----BEGIN [A-Z ]*${t}-----`).test(r))throw Error(`${n}: ${e} is not a PEM ${t}`);return r}function cl(){let e=Yy.getBytesSync(16),t=jd.bytesToHex(e);return(parseInt(t[0],16)&7).toString(16)+t.slice(1)}function _i(e){let t=new Date;return t.setDate(t.getDate()+e),t}import{PassThrough as iv,Readable as Xd}from"stream";var ul=new Set(["GET","HEAD","OPTIONS"]),Zd="denied by sandbox policy";function Yd(e,t){if(t.writableFinished||t.destroyed){e.destroy();return}t.once("finish",()=>e.destroy()),t.once("close",()=>e.destroy())}async function Zs(e,t,n,r,i,s){let a=t.method??"GET",o,l=t,c=Boolean(t.headers["content-length"]||t.headers["transfer-encoding"]),u=ul.has(a);if(!u||c){let y=new iv;y.on("error",()=>{}),t.pipe(y);let p=Xd.toWeb(y),[v,x]=p.tee();o=v,l=Xd.fromWeb(x);let b=l;b.on("error",()=>{}),t.on("error",(A)=>{y.end(),b.destroy(A)})}let d;try{if(o&&!(o instanceof ReadableStream))throw TypeError("Unexpected request body stream");let y=o&&!u?{body:o,duplex:"half"}:{};d=new Request(r,{method:a,headers:sv(t),signal:i,...y})}catch(y){let p=`malformed request: ${y.message}`;if(s?.(a,r,p),Jd(n,{action:"deny",reason:p}),o?.cancel().catch(()=>{}),l.destroy(),l!==t)Yd(t,n);return null}let f;try{f=await e(d)}catch(y){f={action:"deny",reason:`sandbox policy check failed: ${y.message}`}}if(o&&!d.bodyUsed)o.cancel().catch(()=>{});if(f.action==="allow")return C(`[request-filter] allow ${a} ${r}`),l;if(s?.(a,r,f.reason??Zd),Jd(n,f),l.destroy(),l!==t)Yd(t,n);return null}function Jd(e,t){Ii(e,t.reason??Zd)}function Ii(e,t){if(C(`[request-filter] deny: ${t}`),e.headersSent){e.destroy();return}e.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-sandbox-runtime"}),e.end(t+`
26
- `)}function sv(e){let t=new Headers;for(let[n,r]of Object.entries(e.headers)){if(r===void 0)continue;if(Array.isArray(r))for(let i of r)t.append(n,i);else t.append(n,r)}return t}import{createServer as _v,request as kv}from"https";import{connect as Iv,isIP as Sl}from"net";import{unlink as Rv}from"fs";import{tmpdir as Bv}from"os";import{join as Pv}from"path";import{Transform as av}from"stream";function ov(e){return e.every((t)=>t.sentinel.length===t.realValue.length)}function ea(e,t,n,r){if(e===void 0)return;let i=t.headers["content-length"]!==void 0||t.headers["transfer-encoding"]!==void 0;if(ul.has(t.method??"GET")&&!i)return;let s=e(r);if(!s?.length)return;if(t.headers["content-encoding"]!==void 0){C(`[body-substitution] ${r}: request body has Content-Encoding "${String(t.headers["content-encoding"])}"; masked-credential `+"substitution skipped \u2014 a sentinel in this body reaches the "+"upstream as the fake value",{level:"warn"});return}if(!ov(s))delete n["content-length"];return lv(s)}function lv(e){let t=Math.max(...e.map((r)=>r.sentinel.length)),n;return new av({transform(r,i,s){let a=Buffer.isBuffer(r)?r:Buffer.from(r,i),o=n?.length?Buffer.concat([n,a]):a,{out:l,tail:c}=cv(o,e,t);n=c,s(null,l)},flush(r){r(null,n?.length?n:void 0)}})}function cv(e,t,n){let r=[],i=0;for(;;){let a=-1,o;for(let l of t){let c=e.indexOf(l.sentinel,i);if(c!==-1&&(a===-1||c<a))a=c,o=l}if(o===void 0)break;r.push(e.subarray(i,a),o.realValue),i=a+o.sentinel.length}let s=Math.max(i,e.length-(n-1));return r.push(e.subarray(i,s)),{out:Buffer.concat(r),tail:Buffer.from(e.subarray(s))}}var ef=Ga(Zo(),1);import{isIP as uv}from"net";import{createSecureContext as dv}from"tls";var{pki:ta}=ef.default;function dl(e,t){let n=e.leafCerts.get(t);if(n)return n;let r=ta.rsa.generateKeyPair(2048),i=ta.createCertificate();i.publicKey=r.publicKey,i.serialNumber=cl();let s=_i(-1);i.validity.notBefore=s,i.validity.notAfter=pv(e.cert,s),i.setSubject([{name:"commonName",value:t}]),i.setIssuer(e.cert.subject.attributes),i.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",critical:!0,digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[fv(t)]},{name:"subjectKeyIdentifier"},{name:"authorityKeyIdentifier",keyIdentifier:sl(e.cert)},...e.crlUrl?[{name:"cRLDistributionPoints",altNames:[{type:6,value:e.crlUrl}]}]:[]]),al(i,e.keyPem);let a={certPem:ta.certificateToPem(i)+e.certPem,keyPem:ta.privateKeyToPem(r.privateKey)};return e.leafCerts.set(t,a),C(`[mitm-leaf] minted RSA leaf for ${t}`),a}function tf(e,t){let n=e.secureContexts.get(t);if(n)return n;let{certPem:r,keyPem:i}=dl(e,t),s=dv({cert:r,key:i});return e.secureContexts.set(t,s),s}function fv(e){return uv(e)!==0?{type:7,ip:e}:{type:2,value:e}}function pv(e,t){let n=e.validity.notAfter,r=new Date(t);return r.setDate(r.getDate()+99),n<r?new Date(n):r}import{BlockList as rf,connect as nf,isIP as pn}from"net";import{connect as hv}from"tls";import{URL as fl}from"url";var sf=30000,gv=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);function pl(e){let t=e?.http??process.env.HTTP_PROXY??process.env.http_proxy??void 0,n=e?.https??process.env.HTTPS_PROXY??process.env.https_proxy??t,r=e?.noProxy??process.env.NO_PROXY??process.env.no_proxy??"";if(!t&&!n)return;let i=(o)=>{if(!o)return;let c=/^[a-z][a-z0-9+.-]*:\/\//i.test(o)?o:`http://${o}`;try{let u=new fl(c);if(u.protocol!=="http:"&&u.protocol!=="https:"||!u.hostname)throw Error("unsupported scheme or empty host");return u}catch{C(`Invalid parent proxy URL, ignoring: ${vv(o)}`,{level:"error"});return}},s=i(t),a=i(n);if(!s&&!a)return;return{httpUrl:s,httpsUrl:a,noProxy:mv(r)}}function mv(e){let t={all:!1,suffixes:[],cidr:new rf};for(let n of e.split(",")){if(n=n.trim(),!n)continue;if(n==="*"){t.all=!0;continue}let r=n.indexOf("/");if(r!==-1){let o=n.slice(0,r),l=n.slice(r+1),c=pn(o);if(c&&l!==""&&/^\d+$/.test(l)){let u=Number(l),d=c===6?128:32;if(u>=0&&u<=d){try{t.cidr.addSubnet(o,u,c===6?"ipv6":"ipv4")}catch{}continue}}continue}let i=n.toLowerCase(),s=/^\[([^\]]+)\](?::\d+)?$/.exec(i);if(s)i=s[1];if(i.startsWith("*."))i=i.slice(1);let a=pn(i);if(!a){let o=i.lastIndexOf(":");if(o!==-1&&/^\d+$/.test(i.slice(o+1)))i=i.slice(0,o)}else try{t.cidr.addAddress(i,a===6?"ipv6":"ipv4");continue}catch{}t.suffixes.push(i)}return t}function Ri(e,t){let n=jt(t.toLowerCase().replace(/\.$/,""));if(n==="localhost")return!0;let r=pn(n);if(r){if(yv.check(n,r===6?"ipv6":"ipv4"))return!0}if(e.noProxy.all)return!0;if(r){if(e.noProxy.cidr.check(n,r===6?"ipv6":"ipv4"))return!0}for(let i of e.noProxy.suffixes)if(i.startsWith(".")){if(n===i.slice(1)||n.endsWith(i))return!0}else if(n===i||n.endsWith("."+i))return!0;return!1}var yv=(()=>{let e=new rf;return e.addSubnet("127.0.0.0",8,"ipv4"),e.addAddress("::1","ipv6"),e.addSubnet("::ffff:127.0.0.0",104,"ipv6"),e})();function Bi(e,t){if(t.isHttps)return e.httpsUrl??e.httpUrl;return e.httpUrl}function hl(e){let{destHost:t,destPort:n}=e,r=jt(t);if(!$n(r))return Promise.reject(Error(`Invalid destination host for CONNECT: ${JSON.stringify(t)}`));if(!Number.isInteger(n)||n<1||n>65535)return Promise.reject(Error(`Invalid destination port: ${n}`));let i=pn(r)===6?`[${r}]:${n}`:`${r}:${n}`;return new Promise((s,a)=>{let o=e.dial(),l=!1,c=(d)=>{if(l)return;l=!0,o.destroy(),a(d)},u=()=>c(Error("Proxy closed during CONNECT handshake"));o.setTimeout(e.timeoutMs??sf,()=>c(Error("CONNECT handshake timed out"))),o.once("error",c),o.once("close",u),o.once(e.readyEvent,()=>{o.write(`CONNECT ${i} HTTP/1.1\r
25
+ `,{mode:420}),s}function nv(e,t){let n=Gt.oids.sha256WithRSAEncryption,r=()=>Fn([Ze.create(Wt.UNIVERSAL,cr.OID,!1,Ze.oidToDer(n).getBytes()),Ze.create(Wt.UNIVERSAL,cr.NULL,!1,"")]),i=(f,y)=>Fn([Ze.create(Wt.UNIVERSAL,cr.OID,!1,Ze.oidToDer(f).getBytes()),Ze.create(Wt.UNIVERSAL,cr.OCTETSTRING,!1,Ze.toDer(y).getBytes())]),s=Ze.create(Wt.CONTEXT_SPECIFIC,0,!0,[Fn([i(Gt.oids.authorityKeyIdentifier,Fn([Ze.create(Wt.CONTEXT_SPECIFIC,0,!1,al(e))])),i("2.5.29.20",Ze.create(Wt.UNIVERSAL,cr.INTEGER,!1,"\x01"))])]),a=new Date,o=e.validity.notAfter,l=o>a?o:ki(1),c=Fn([Ze.create(Wt.UNIVERSAL,cr.INTEGER,!1,"\x01"),r(),Gt.distinguishedNameToAsn1(e.subject),qd(a),qd(l),s]),u=Qd(Ze.toDer(c).getBytes(),t),d=Fn([c,r(),Ze.create(Wt.UNIVERSAL,cr.BITSTRING,!1,"\x00"+u)]);return Buffer.from(Ze.toDer(d).getBytes(),"binary")}var{Class:Wt,Type:cr}=Ze;function Fn(e){return Ze.create(Wt.UNIVERSAL,cr.SEQUENCE,!0,e)}function qd(e){return e.getUTCFullYear()<2050?Ze.create(Wt.UNIVERSAL,cr.UTCTIME,!1,Ze.dateToUtcTime(e)):Ze.create(Wt.UNIVERSAL,cr.GENERALIZEDTIME,!1,Ze.dateToGeneralizedTime(e))}function iv(e,t,n){let r=Gd(e,"CERTIFICATE","tlsTerminate.caCertPath"),i=Gd(t,"PRIVATE KEY","tlsTerminate.caKeyPath"),s=Ii(r,i);if(!s.ok)throw Error(`tlsTerminate: CA at ${e}: ${s.reason}`);return C(`[mitm-ca] loaded CA from ${e}`),cl(r,i,s.cert,s.key,{certPath:e,keyPath:t,extraCaCertPaths:n})}function cl(e,t,n,r,i){let s=rl(Mn(sl(),"srt-ca-"));return{certPath:i.certPath,keyPath:i.keyPath,trustBundlePath:rv(s,e,i.extraCaCertPaths),certPem:e,keyPem:t,cert:n,key:r,leafCerts:new Map,secureContexts:new Map,crlDer:nv(n,t),ephemeral:i.ephemeral??!1}}function Zs(e={}){let t=Gt.rsa.generateKeyPair(2048),n=Gt.createCertificate();n.publicKey=t.publicKey,n.serialNumber=ul(),n.validity.notBefore=ki(-1),n.validity.notAfter=ki(e.validityDays??825);let r=[{name:"commonName",value:e.cn??"sandbox-runtime ephemeral CA"},{name:"organizationName",value:"sandbox-runtime"}];n.setSubject(r),n.setIssuer(r),n.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",critical:!0,keyCertSign:!0,cRLSign:!0,digitalSignature:!0},{name:"subjectKeyIdentifier"}]);let i=Gt.privateKeyToPem(t.privateKey);return ol(n,i),{certPem:Gt.certificateToPem(n),keyPem:i,cert:n,key:t.privateKey}}function Wn(e){return new Qy(e).fingerprint.replace(/:/g,"").toUpperCase()}function Ii(e,t){let n,r;try{n=Gt.certificateFromPem(e),r=Gt.privateKeyFromPem(t)}catch(a){return{ok:!1,reason:`parse: ${a.message}`}}if(!("n"in r)||!("d"in r))return{ok:!1,reason:"key is not RSA"};if(n.validity.notBefore.getTime()>Date.now())return{ok:!1,reason:`notBefore ${n.validity.notBefore.toISOString()} is in the future (clock skew?)`};let i=n.publicKey;if(!("n"in i)||i.n.compareTo(r.n))return{ok:!1,reason:"key does not match certificate public key"};let s;try{s=Wn(e)}catch(a){return{ok:!1,reason:`thumbprint: ${a.message}`}}return{ok:!0,thumbprint:s,notAfter:n.validity.notAfter,cert:n,key:r}}function sv(e){let{certPem:t,keyPem:n,cert:r,key:i}=Zs(),s=rl(Mn(sl(),"srt-ca-")),a=Mn(s,"ca.crt"),o=Mn(rl(Mn(sl(),"srt-ca-key-")),"ca.key");return il(a,t,{mode:420}),il(o,n,{mode:384}),C(`[mitm-ca] generated ephemeral CA at ${a}`),cl(t,n,r,i,{certPath:a,keyPath:o,extraCaCertPaths:e,ephemeral:!0})}function Gd(e,t,n){let r;try{r=nl(e,"utf8")}catch(i){let s=i.code??String(i);throw Error(`${n}: cannot read ${e} (${s})`)}if(!new RegExp(`-----BEGIN [A-Z ]*${t}-----`).test(r))throw Error(`${n}: ${e} is not a PEM ${t}`);return r}function ul(){let e=Zy.getBytesSync(16),t=zd.bytesToHex(e);return(parseInt(t[0],16)&7).toString(16)+t.slice(1)}function ki(e){let t=new Date;return t.setDate(t.getDate()+e),t}import{PassThrough as av,Readable as Yd}from"stream";var dl=new Set(["GET","HEAD","OPTIONS"]),ef="denied by sandbox policy";function Jd(e,t){if(t.writableFinished||t.destroyed){e.destroy();return}t.once("finish",()=>e.destroy()),t.once("close",()=>e.destroy())}async function ea(e,t,n,r,i,s){let a=t.method??"GET",o,l=t,c=Boolean(t.headers["content-length"]||t.headers["transfer-encoding"]),u=dl.has(a);if(!u||c){let y=new av;y.on("error",()=>{}),t.pipe(y);let p=Yd.toWeb(y),[v,x]=p.tee();o=v,l=Yd.fromWeb(x);let b=l;b.on("error",()=>{}),t.on("error",(A)=>{y.end(),b.destroy(A)})}let d;try{if(o&&!(o instanceof ReadableStream))throw TypeError("Unexpected request body stream");let y=o&&!u?{body:o,duplex:"half"}:{};d=new Request(r,{method:a,headers:ov(t),signal:i,...y})}catch(y){let p=`malformed request: ${y.message}`;if(s?.(a,r,p),Zd(n,{action:"deny",reason:p}),o?.cancel().catch(()=>{}),l.destroy(),l!==t)Jd(t,n);return null}let f;try{f=await e(d)}catch(y){f={action:"deny",reason:`sandbox policy check failed: ${y.message}`}}if(o&&!d.bodyUsed)o.cancel().catch(()=>{});if(f.action==="allow")return C(`[request-filter] allow ${a} ${r}`),l;if(s?.(a,r,f.reason??ef),Zd(n,f),l.destroy(),l!==t)Jd(t,n);return null}function Zd(e,t){Ri(e,t.reason??ef)}function Ri(e,t){if(C(`[request-filter] deny: ${t}`),e.headersSent){e.destroy();return}e.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-sandbox-runtime"}),e.end(t+`
26
+ `)}function ov(e){let t=new Headers;for(let[n,r]of Object.entries(e.headers)){if(r===void 0)continue;if(Array.isArray(r))for(let i of r)t.append(n,i);else t.append(n,r)}return t}import{createServer as Iv,request as Rv}from"https";import{connect as Bv,isIP as bl}from"net";import{unlink as Pv}from"fs";import{tmpdir as Nv}from"os";import{join as Dv}from"path";import{Transform as lv}from"stream";function cv(e){return e.every((t)=>t.sentinel.length===t.realValue.length)}function ta(e,t,n,r){if(e===void 0)return;let i=t.headers["content-length"]!==void 0||t.headers["transfer-encoding"]!==void 0;if(dl.has(t.method??"GET")&&!i)return;let s=e(r);if(!s?.length)return;if(t.headers["content-encoding"]!==void 0){C(`[body-substitution] ${r}: request body has Content-Encoding "${String(t.headers["content-encoding"])}"; masked-credential `+"substitution skipped \u2014 a sentinel in this body reaches the "+"upstream as the fake value",{level:"warn"});return}if(!cv(s))delete n["content-length"];return uv(s)}function uv(e){let t=Math.max(...e.map((r)=>r.sentinel.length)),n;return new lv({transform(r,i,s){let a=Buffer.isBuffer(r)?r:Buffer.from(r,i),o=n?.length?Buffer.concat([n,a]):a,{out:l,tail:c}=dv(o,e,t);n=c,s(null,l)},flush(r){r(null,n?.length?n:void 0)}})}function dv(e,t,n){let r=[],i=0;for(;;){let a=-1,o;for(let l of t){let c=e.indexOf(l.sentinel,i);if(c!==-1&&(a===-1||c<a))a=c,o=l}if(o===void 0)break;r.push(e.subarray(i,a),o.realValue),i=a+o.sentinel.length}let s=Math.max(i,e.length-(n-1));return r.push(e.subarray(i,s)),{out:Buffer.concat(r),tail:Buffer.from(e.subarray(s))}}var tf=ja(el(),1);import{isIP as fv}from"net";import{createSecureContext as pv}from"tls";var{pki:ra}=tf.default;function fl(e,t){let n=e.leafCerts.get(t);if(n)return n;let r=ra.rsa.generateKeyPair(2048),i=ra.createCertificate();i.publicKey=r.publicKey,i.serialNumber=ul();let s=ki(-1);i.validity.notBefore=s,i.validity.notAfter=gv(e.cert,s),i.setSubject([{name:"commonName",value:t}]),i.setIssuer(e.cert.subject.attributes),i.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",critical:!0,digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[hv(t)]},{name:"subjectKeyIdentifier"},{name:"authorityKeyIdentifier",keyIdentifier:al(e.cert)},...e.crlUrl?[{name:"cRLDistributionPoints",altNames:[{type:6,value:e.crlUrl}]}]:[]]),ol(i,e.keyPem);let a={certPem:ra.certificateToPem(i)+e.certPem,keyPem:ra.privateKeyToPem(r.privateKey)};return e.leafCerts.set(t,a),C(`[mitm-leaf] minted RSA leaf for ${t}`),a}function rf(e,t){let n=e.secureContexts.get(t);if(n)return n;let{certPem:r,keyPem:i}=fl(e,t),s=pv({cert:r,key:i});return e.secureContexts.set(t,s),s}function hv(e){return fv(e)!==0?{type:7,ip:e}:{type:2,value:e}}function gv(e,t){let n=e.validity.notAfter,r=new Date(t);return r.setDate(r.getDate()+99),n<r?new Date(n):r}import{BlockList as nf,connect as sf,isIP as pn}from"net";import{connect as mv}from"tls";import{URL as pl}from"url";var af=30000,yv=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);function hl(e){let t=e?.http??process.env.HTTP_PROXY??process.env.http_proxy??void 0,n=e?.https??process.env.HTTPS_PROXY??process.env.https_proxy??t,r=e?.noProxy??process.env.NO_PROXY??process.env.no_proxy??"";if(!t&&!n)return;let i=(o)=>{if(!o)return;let c=/^[a-z][a-z0-9+.-]*:\/\//i.test(o)?o:`http://${o}`;try{let u=new pl(c);if(u.protocol!=="http:"&&u.protocol!=="https:"||!u.hostname)throw Error("unsupported scheme or empty host");return u}catch{C(`Invalid parent proxy URL, ignoring: ${Sv(o)}`,{level:"error"});return}},s=i(t),a=i(n);if(!s&&!a)return;return{httpUrl:s,httpsUrl:a,noProxy:vv(r)}}function vv(e){let t={all:!1,suffixes:[],cidr:new nf};for(let n of e.split(",")){if(n=n.trim(),!n)continue;if(n==="*"){t.all=!0;continue}let r=n.indexOf("/");if(r!==-1){let o=n.slice(0,r),l=n.slice(r+1),c=pn(o);if(c&&l!==""&&/^\d+$/.test(l)){let u=Number(l),d=c===6?128:32;if(u>=0&&u<=d){try{t.cidr.addSubnet(o,u,c===6?"ipv6":"ipv4")}catch{}continue}}continue}let i=n.toLowerCase(),s=/^\[([^\]]+)\](?::\d+)?$/.exec(i);if(s)i=s[1];if(i.startsWith("*."))i=i.slice(1);let a=pn(i);if(!a){let o=i.lastIndexOf(":");if(o!==-1&&/^\d+$/.test(i.slice(o+1)))i=i.slice(0,o)}else try{t.cidr.addAddress(i,a===6?"ipv6":"ipv4");continue}catch{}t.suffixes.push(i)}return t}function Bi(e,t){let n=jt(t.toLowerCase().replace(/\.$/,""));if(n==="localhost")return!0;let r=pn(n);if(r){if(xv.check(n,r===6?"ipv6":"ipv4"))return!0}if(e.noProxy.all)return!0;if(r){if(e.noProxy.cidr.check(n,r===6?"ipv6":"ipv4"))return!0}for(let i of e.noProxy.suffixes)if(i.startsWith(".")){if(n===i.slice(1)||n.endsWith(i))return!0}else if(n===i||n.endsWith("."+i))return!0;return!1}var xv=(()=>{let e=new nf;return e.addSubnet("127.0.0.0",8,"ipv4"),e.addAddress("::1","ipv6"),e.addSubnet("::ffff:127.0.0.0",104,"ipv6"),e})();function Pi(e,t){if(t.isHttps)return e.httpsUrl??e.httpUrl;return e.httpUrl}function gl(e){let{destHost:t,destPort:n}=e,r=jt(t);if(!$n(r))return Promise.reject(Error(`Invalid destination host for CONNECT: ${JSON.stringify(t)}`));if(!Number.isInteger(n)||n<1||n>65535)return Promise.reject(Error(`Invalid destination port: ${n}`));let i=pn(r)===6?`[${r}]:${n}`:`${r}:${n}`;return new Promise((s,a)=>{let o=e.dial(),l=!1,c=(d)=>{if(l)return;l=!0,o.destroy(),a(d)},u=()=>c(Error("Proxy closed during CONNECT handshake"));o.setTimeout(e.timeoutMs??af,()=>c(Error("CONNECT handshake timed out"))),o.once("error",c),o.once("close",u),o.once(e.readyEvent,()=>{o.write(`CONNECT ${i} HTTP/1.1\r
27
27
  Host: ${i}\r
28
28
  `+(e.authHeader?`Proxy-Authorization: ${e.authHeader}\r
29
29
  `:"")+`\r
30
30
  `);let d="",f=(y)=>{d+=y.toString("latin1");let p=d.indexOf(`\r
31
31
  \r
32
32
  `);if(p===-1){if(d.length>16384)c(Error("CONNECT response header too large"));return}o.pause(),o.removeListener("data",f);let v=d.slice(0,d.indexOf(`\r
33
- `));if(!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(v))return c(Error(`Proxy refused CONNECT: ${v.trim()}`));let x=d.slice(p+4);if(x.length)o.unshift(Buffer.from(x,"latin1"));l=!0,o.setTimeout(0),o.removeListener("error",c),o.removeListener("close",u),s(o)};o.on("data",f)})})}function ra(e,t,n){let r=jt(e.hostname),i=Number(e.port)||(e.protocol==="https:"?443:80),s=e.protocol==="https:";return hl({destHost:t,destPort:n,authHeader:gl(e),readyEvent:s?"secureConnect":"connect",dial:()=>s?hv({host:r,port:i,...pn(r)?{}:{servername:r}}):nf(i,r)})}function gl(e){if(!e.username&&!e.password)return;try{let t=`${decodeURIComponent(e.username)}:${decodeURIComponent(e.password)}`;return`Basic ${Buffer.from(t).toString("base64")}`}catch{let t=`${e.username}:${e.password}`;return`Basic ${Buffer.from(t).toString("base64")}`}}function $r(e){let t=new Set,n=e.connection;if(n)for(let i of String(n).split(","))t.add(i.trim().toLowerCase());let r={};for(let[i,s]of Object.entries(e)){let a=i.toLowerCase();if(!gv.has(a)&&!t.has(a))r[i]=s}return r}function jt(e){return e.startsWith("[")&&e.endsWith("]")?e.slice(1,-1):e}function ml(e){if(!e)return"-";if(!e.username&&!e.password)return e.href;let t=new fl(e.href);return t.username="***",t.password="***",t.href}function vv(e){return e.replace(/\/\/[^@/]*@/,"//***:***@")}function $n(e){if(!e||e.length>255)return!1;let t=jt(e);if(t.includes("%"))return!1;if(pn(t))return!0;return/^[A-Za-z0-9._-]+$/.test(t)}function _t(e){try{let t=jt(e),n=pn(t)===6?`[${t}]`:t,r=new fl(`http://${n}/`).hostname;return jt(r).replace(/\.$/,"")}catch{return}}function na(e,t,n=sf){return new Promise((r,i)=>{let s=nf(t,e),a=!1,o=(l)=>{if(a)return;if(a=!0,s.setTimeout(0),l)s.destroy(),i(l);else r(s)};s.setTimeout(n,()=>o(Error("connect timed out"))),s.once("connect",()=>o()),s.once("error",o),s.once("close",()=>o(Error("socket closed before connect")))})}import{createHash as xv,createHmac as cf}from"crypto";var Pi="AWS4-HMAC-SHA256",Sv="AWS4-ECDSA-P256-SHA256",sa="UNSIGNED-PAYLOAD";function uf(e,t){let n=Hn(e.authorization);if(n!==void 0&&n.startsWith(Sv)){let o=af(n);if(o!==void 0)return{kind:"sigv4a",accessKeyId:o}}else if(n!==void 0&&n.startsWith(Pi)){let o=af(n);if(o!==void 0)return{kind:Hn(e["x-amz-content-sha256"])?.startsWith("STREAMING-")?"streaming":"header-sigv4",accessKeyId:o}}let r=t.indexOf("?");if(r===-1)return null;let i=new URLSearchParams(t.slice(r+1));if(i.get("X-Amz-Algorithm")!==Pi)return null;if(!i.has("X-Amz-Signature"))return null;let s=i.get("X-Amz-Credential");if(!s)return null;let a=s.split("/")[0];return a?{kind:"presigned",accessKeyId:a}:null}function af(e){return/Credential=([^/,\s]+)\//.exec(e)?.[1]}function df(e){if(!e.startsWith(Pi))return null;let t=/Credential=([^,\s]+)/.exec(e)?.[1],n=/SignedHeaders=([^,\s]+)/.exec(e)?.[1],r=/Signature=([0-9a-fA-F]+)/.exec(e)?.[1];if(!t||!n||!r)return null;let i=t.split("/");if(i.length!==5||i[4]!=="aws4_request")return null;let[s,a,o,l]=i;if(!s||!a||!o||!l)return null;return{accessKeyId:s,date:a,region:o,service:l,signedHeaders:n.split(";").map((c)=>c.toLowerCase()),signature:r}}function yl(e){return encodeURIComponent(e).replace(/[!'()*]/g,(t)=>"%"+t.charCodeAt(0).toString(16).toUpperCase())}function bv(e,t){if(e==="")return"/";if(t==="s3")return e;let n=[];for(let s of e.split("/")){if(s===""||s===".")continue;if(s==="..")n.pop();else n.push(s)}let r=n.length>0&&e.endsWith("/")?"/":"",i=`/${n.join("/")}${r}`;return yl(i).replace(/%2F/gi,"/")}function Cv(e){if(e==="")return"";let t=[];for(let n of e.split("&")){if(n==="")continue;let r=n.indexOf("="),i=r===-1?n:n.slice(0,r),s=r===-1?"":n.slice(r+1);t.push([yl(of(i)),yl(of(s))])}return t.sort(([n,r],[i,s])=>n<i?-1:n>i?1:r<s?-1:r>s?1:0),t.map(([n,r])=>`${n}=${r}`).join("&")}function of(e){try{return decodeURIComponent(e)}catch{return e}}function lf(e){return e.trim().replace(/[ \t]+/g," ")}function Ev(e){let t=e.requestTarget.indexOf("?"),n=t===-1?e.requestTarget:e.requestTarget.slice(0,t),r=t===-1?"":e.requestTarget.slice(t+1),i=[...e.signedHeaders].map((a)=>a.toLowerCase()).sort(),s=[];for(let a of i){let o=a==="host"?e.hostHeader:e.headers[a];if(o===void 0)throw Error(`signed header "${a}" is missing from the request`);let l=Array.isArray(o)?o.map(lf).join(","):lf(String(o));s.push(`${a}:${l}`)}return[e.method.toUpperCase(),bv(n,e.scope.service),Cv(r),s.join(`
33
+ `));if(!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(v))return c(Error(`Proxy refused CONNECT: ${v.trim()}`));let x=d.slice(p+4);if(x.length)o.unshift(Buffer.from(x,"latin1"));l=!0,o.setTimeout(0),o.removeListener("error",c),o.removeListener("close",u),s(o)};o.on("data",f)})})}function na(e,t,n){let r=jt(e.hostname),i=Number(e.port)||(e.protocol==="https:"?443:80),s=e.protocol==="https:";return gl({destHost:t,destPort:n,authHeader:ml(e),readyEvent:s?"secureConnect":"connect",dial:()=>s?mv({host:r,port:i,...pn(r)?{}:{servername:r}}):sf(i,r)})}function ml(e){if(!e.username&&!e.password)return;try{let t=`${decodeURIComponent(e.username)}:${decodeURIComponent(e.password)}`;return`Basic ${Buffer.from(t).toString("base64")}`}catch{let t=`${e.username}:${e.password}`;return`Basic ${Buffer.from(t).toString("base64")}`}}function $r(e){let t=new Set,n=e.connection;if(n)for(let i of String(n).split(","))t.add(i.trim().toLowerCase());let r={};for(let[i,s]of Object.entries(e)){let a=i.toLowerCase();if(!yv.has(a)&&!t.has(a))r[i]=s}return r}function jt(e){return e.startsWith("[")&&e.endsWith("]")?e.slice(1,-1):e}function yl(e){if(!e)return"-";if(!e.username&&!e.password)return e.href;let t=new pl(e.href);return t.username="***",t.password="***",t.href}function Sv(e){return e.replace(/\/\/[^@/]*@/,"//***:***@")}function $n(e){if(!e||e.length>255)return!1;let t=jt(e);if(t.includes("%"))return!1;if(pn(t))return!0;return/^[A-Za-z0-9._-]+$/.test(t)}function _t(e){try{let t=jt(e),n=pn(t)===6?`[${t}]`:t,r=new pl(`http://${n}/`).hostname;return jt(r).replace(/\.$/,"")}catch{return}}function ia(e,t,n=af){return new Promise((r,i)=>{let s=sf(t,e),a=!1,o=(l)=>{if(a)return;if(a=!0,s.setTimeout(0),l)s.destroy(),i(l);else r(s)};s.setTimeout(n,()=>o(Error("connect timed out"))),s.once("connect",()=>o()),s.once("error",o),s.once("close",()=>o(Error("socket closed before connect")))})}import{createHash as bv,createHmac as uf}from"crypto";var Ni="AWS4-HMAC-SHA256",Cv="AWS4-ECDSA-P256-SHA256",aa="UNSIGNED-PAYLOAD";function df(e,t){let n=Hn(e.authorization);if(n!==void 0&&n.startsWith(Cv)){let o=of(n);if(o!==void 0)return{kind:"sigv4a",accessKeyId:o}}else if(n!==void 0&&n.startsWith(Ni)){let o=of(n);if(o!==void 0)return{kind:Hn(e["x-amz-content-sha256"])?.startsWith("STREAMING-")?"streaming":"header-sigv4",accessKeyId:o}}let r=t.indexOf("?");if(r===-1)return null;let i=new URLSearchParams(t.slice(r+1));if(i.get("X-Amz-Algorithm")!==Ni)return null;if(!i.has("X-Amz-Signature"))return null;let s=i.get("X-Amz-Credential");if(!s)return null;let a=s.split("/")[0];return a?{kind:"presigned",accessKeyId:a}:null}function of(e){return/Credential=([^/,\s]+)\//.exec(e)?.[1]}function ff(e){if(!e.startsWith(Ni))return null;let t=/Credential=([^,\s]+)/.exec(e)?.[1],n=/SignedHeaders=([^,\s]+)/.exec(e)?.[1],r=/Signature=([0-9a-fA-F]+)/.exec(e)?.[1];if(!t||!n||!r)return null;let i=t.split("/");if(i.length!==5||i[4]!=="aws4_request")return null;let[s,a,o,l]=i;if(!s||!a||!o||!l)return null;return{accessKeyId:s,date:a,region:o,service:l,signedHeaders:n.split(";").map((c)=>c.toLowerCase()),signature:r}}function vl(e){return encodeURIComponent(e).replace(/[!'()*]/g,(t)=>"%"+t.charCodeAt(0).toString(16).toUpperCase())}function Ev(e,t){if(e==="")return"/";if(t==="s3")return e;let n=[];for(let s of e.split("/")){if(s===""||s===".")continue;if(s==="..")n.pop();else n.push(s)}let r=n.length>0&&e.endsWith("/")?"/":"",i=`/${n.join("/")}${r}`;return vl(i).replace(/%2F/gi,"/")}function wv(e){if(e==="")return"";let t=[];for(let n of e.split("&")){if(n==="")continue;let r=n.indexOf("="),i=r===-1?n:n.slice(0,r),s=r===-1?"":n.slice(r+1);t.push([vl(lf(i)),vl(lf(s))])}return t.sort(([n,r],[i,s])=>n<i?-1:n>i?1:r<s?-1:r>s?1:0),t.map(([n,r])=>`${n}=${r}`).join("&")}function lf(e){try{return decodeURIComponent(e)}catch{return e}}function cf(e){return e.trim().replace(/[ \t]+/g," ")}function Tv(e){let t=e.requestTarget.indexOf("?"),n=t===-1?e.requestTarget:e.requestTarget.slice(0,t),r=t===-1?"":e.requestTarget.slice(t+1),i=[...e.signedHeaders].map((a)=>a.toLowerCase()).sort(),s=[];for(let a of i){let o=a==="host"?e.hostHeader:e.headers[a];if(o===void 0)throw Error(`signed header "${a}" is missing from the request`);let l=Array.isArray(o)?o.map(cf).join(","):cf(String(o));s.push(`${a}:${l}`)}return[e.method.toUpperCase(),Ev(n,e.scope.service),wv(r),s.join(`
34
34
  `)+`
35
35
  `,i.join(";"),e.payloadHash].join(`
36
- `)}function wv(e,t,n){return[Pi,t,`${n.date}/${n.region}/${n.service}/aws4_request`,vl(e)].join(`
37
- `)}function Tv(e,t){let n=ia(`AWS4${e}`,t.date),r=ia(n,t.region),i=ia(r,t.service);return ia(i,"aws4_request")}function ff(e){let t=Ev(e),n=wv(t,e.amzDate,e.scope),r=cf("sha256",Tv(e.secretAccessKey,e.scope)).update(n,"utf8").digest("hex"),i=[...e.signedHeaders].map((a)=>a.toLowerCase()).sort(),s=`${e.scope.date}/${e.scope.region}/${e.scope.service}/aws4_request`;return{authorization:`${Pi} Credential=${e.accessKeyId}/${s}, SignedHeaders=${i.join(";")}, Signature=${r}`,signature:r,canonicalRequest:t,stringToSign:n}}function vl(e){return xv("sha256").update(e).digest("hex")}function ia(e,t){return cf("sha256",e).update(t,"utf8").digest()}function Hn(e){return Array.isArray(e)?e[0]:e}var pf="reason-egress-target",hf="reason-egress-token";class xl{entries=new Map;refs=new Map;lease=null;register(e,t,n,r){if(!e||!t||n.length===0)return;if(this.entries.set(e,{placeholder:e,token:t,hosts:[...n],url:r}),this.lease&&!this.lease.has(e))this.lease.add(e),this.refs.set(e,(this.refs.get(e)??0)+1)}beginLease(){this.lease=new Set}endLease(){let e=[...this.lease??[]];return this.lease=null,e}release(e){for(let t of e){let n=(this.refs.get(t)??1)-1;if(n>0){this.refs.set(t,n);continue}this.refs.delete(t),this.entries.delete(t)}e.length=0}clear(){this.entries.clear(),this.refs.clear()}forwardFor(e,t){for(let n of this.entries.values()){if(!n.hosts.includes(t))continue;for(let r of Object.values(e))if((Array.isArray(r)?r:r===void 0?[]:[r]).some((s)=>s.includes(n.placeholder)||Av(s,n.placeholder)))return{url:new URL(n.url),token:n.token}}return}}function Av(e,t){let n=/^\s*basic\s+([A-Za-z0-9+/=_-]+)\s*$/i.exec(e);return n?Buffer.from(n[1],"base64").toString("utf8").includes(t):!1}var yf=67108864;class bl extends Error{}function gf(e){return e.length>=3&&e[0]===22&&e[1]===3&&e[2]<=3}function vf(e,t){if(t.length>=3)return Promise.resolve({isTLS:gf(t),head:t});return new Promise((n)=>{let r=t,i=()=>{e.removeListener("data",s),e.removeListener("close",i),n({isTLS:gf(r),head:r})},s=(a)=>{if(e.pause(),r=r.length?Buffer.concat([r,a]):a,r.length>=3)return i();e.resume()};e.on("data",s),e.once("close",i)})}function Nv(e,t){let n=()=>{let r;while((r=e.read())!==null)if(!t.write(r)){t.once("drain",n);return}e.once("readable",n)};n(),e.once("end",()=>t.end())}function xf(e,t,n,r,i,s,a,o,l=yf,c){let u=dl(e,a.hostname),d=_v({ALPNProtocols:["http/1.1"],cert:u.certPem,key:u.keyPem,SNICallback:(p,v)=>{try{v(null,tf(e,p||a.hostname))}catch(x){v(x)}}});d.on("request",(p,v)=>{p.on("error",(x)=>{C(`[tls-terminate] client request error: ${x.message}`,{level:"error"})}),v.on("error",(x)=>{C(`[tls-terminate] client response error: ${x.message}`,{level:"error"})}),Dv(t,n,r,p,v,a,o,l,c)}),d.on("clientError",(p,v)=>{C(`[tls-terminate] client connection error for ${a.hostname}: ${p.message}`,{level:"error"}),v.destroy()}),d.on("tlsClientError",(p,v)=>{C(`[tls-terminate] client TLS error for ${a.hostname}: ${p.message}`,{level:"error"}),v.destroy()}),d.on("upgrade",(p,v)=>{C("[tls-terminate] upgrade request refused",{level:"warn"}),v.destroy()});let f=Fv(),y=()=>{d.close(),Rv(f,()=>{})};d.on("error",(p)=>{C(`[tls-terminate] inner server listen failed: ${p.message}`,{level:"error"}),i.destroy(),y()}),d.listen(f,()=>{let p=Iv({path:f});p.on("error",(v)=>{C(`[tls-terminate] inner loopback failed: ${v.message}`,{level:"error"}),i.destroy(),y()}),p.once("connect",()=>{if(s.length)p.write(s);Nv(i,p),p.pipe(i)}),i.on("error",()=>p.destroy()),i.once("close",()=>{p.destroy(),y()}),p.once("close",()=>i.destroy())}),d.unref()}function mf(e,t){if(t.writableFinished||t.destroyed){e.destroy();return}t.once("finish",()=>e.destroy()),t.once("close",()=>e.destroy())}function Dv(...e){Lv(...e).catch((t)=>{C(`[tls-terminate] forwardUpstream failed: ${t.message}`,{level:"error"})})}async function Lv(e,t,n,r,i,s,a,o=yf,l){let c=Uv(r.url),u=r;if(e){let E=new AbortController;i.once("close",()=>E.abort());let k=s.port===443?s.hostname:`${s.hostname}:${s.port}`,I=await Zs(e,r,i,`https://${k}${c}`,E.signal,s.onFilterRequestDeny);if(I===null)return;if(u=I,r.destroyed&&!r.readableEnded||i.destroyed||r.socket.destroyed||u.destroyed){u.destroy();return}}let d=$r(r.headers);delete d.host;let f=l?.(d,s.hostname),y=a?.(r.method??"GET",c,d,s.hostname);t?.(d,s.hostname);let p=ea(n,r,d,s.hostname),v;if(y?.action==="deny"){if(Ii(i,y.reason),u.destroy(),u!==r)mf(r,i);return}if(y?.action==="resign"){let E=y.payloadHash;if(E===void 0){let R=p?u.pipe(p):u;if(p)u.on("error",(M)=>p.destroy(M));try{v=await Ov(R,o)}catch(M){if(M instanceof bl){Ii(i,`AWS SigV4 request uses a masked credential and signs a literal body hash, so the proxy must buffer the body to re-sign it, but the body exceeds the ${o}-byte buffering limit; denied. Sign the payload as UNSIGNED-PAYLOAD to stream it without buffering, or use an unmasked credential to have the request forwarded untouched.`),R.resume();return}C(`[tls-terminate] failed to buffer body for SigV4 re-sign: ${M.message}`,{level:"error"}),i.destroy();return}E=vl(v),d["content-length"]=String(v.length)}let k=Sl(s.hostname)===6?`[${s.hostname}]`:s.hostname,I=s.port===443?k:`${k}:${s.port}`;try{y.apply(d,I,E)}catch(R){if(Ii(i,`AWS SigV4 re-signing failed: ${R.message}`),u.destroy(),u!==r)mf(r,i);return}}if(Boolean(r.headers["content-length"]||r.headers["transfer-encoding"])&&v===void 0&&d["content-length"]===void 0&&d["transfer-encoding"]===void 0)d["transfer-encoding"]="chunked";if(f){let E=Sl(s.hostname)===6?`[${s.hostname}]`:s.hostname;d[pf]=`https://${s.port===443?E:`${E}:${s.port}`}${c}`,d[hf]=f.token}let b=f?f.url.hostname:s.hostname,A=kv({host:b,port:f?Number(f.url.port||443):s.port,path:f?`${f.url.pathname}${f.url.search}`:c,method:r.method,headers:d,...Sl(b)?{}:{servername:b},...s.upstreamCA?{ca:s.upstreamCA}:{},agent:!1},(E)=>{E.on("error",(k)=>{C(`[tls-terminate] upstream response error: ${k.message}`,{level:"error"}),i.destroy()}),i.writeHead(E.statusCode??502,$r(E.headers)),E.pipe(i)});if(A.on("error",(E)=>{if(C(`[tls-terminate] upstream ${s.hostname}:${s.port} failed: ${E.message}`,{level:"error"}),!i.headersSent)i.writeHead(502,{"Content-Type":"text/plain"}),i.end("Bad Gateway");else i.destroy()}),i.on("close",()=>A.destroy()),v!==void 0)A.end(v);else if(p)p.on("error",(E)=>A.destroy(E)),u.on("error",(E)=>p.destroy(E)),i.on("close",()=>p.destroy()),u.pipe(p).pipe(A);else u.on("error",(E)=>A.destroy(E)),u.pipe(A)}function Ov(e,t){return new Promise((n,r)=>{let i=[],s=0,a=(o)=>{if(s+=o.length,s>t){i.length=0,e.removeListener("data",a),r(new bl(`request body exceeds ${t} bytes`));return}i.push(o)};e.on("data",a),e.once("end",()=>n(Buffer.concat(i))),e.once("error",r)})}function Uv(e){let t=e??"/";if(t.startsWith("/"))return t;try{let n=new URL(t);return`${n.pathname}${n.search}`||"/"}catch{return t}}var Vv=0;function Fv(){return Pv(Bv(),`srt-tt-${process.pid}-${(Vv++).toString(36)}.sock`)}function Kv(e,t){if(!t)return{ok:!0};let n=/^basic\s+([a-z0-9+/=]+)\s*$/i.exec(e??"");if(!n)return{ok:!1};let r=Buffer.from(n[1],"base64").toString("utf8"),i=r.indexOf(":");if(i<=0||!fs(r.slice(i+1),t))return{ok:!1};return{ok:!0,encodedCommand:ys(r.slice(0,i))}}function Cf(e){let t=Wv();t.on("clientError",(r,i)=>{if(C(`Client connection error: ${r.message}`,{level:"error"}),i.on("error",()=>{}),r.code!=="ECONNRESET"&&i.writable){let s=r.code==="HPE_HEADER_OVERFLOW"?"431 Request Header Fields Too Large":"400 Bad Request";i.end(`HTTP/1.1 ${s}\r
36
+ `)}function Av(e,t,n){return[Ni,t,`${n.date}/${n.region}/${n.service}/aws4_request`,xl(e)].join(`
37
+ `)}function _v(e,t){let n=sa(`AWS4${e}`,t.date),r=sa(n,t.region),i=sa(r,t.service);return sa(i,"aws4_request")}function pf(e){let t=Tv(e),n=Av(t,e.amzDate,e.scope),r=uf("sha256",_v(e.secretAccessKey,e.scope)).update(n,"utf8").digest("hex"),i=[...e.signedHeaders].map((a)=>a.toLowerCase()).sort(),s=`${e.scope.date}/${e.scope.region}/${e.scope.service}/aws4_request`;return{authorization:`${Ni} Credential=${e.accessKeyId}/${s}, SignedHeaders=${i.join(";")}, Signature=${r}`,signature:r,canonicalRequest:t,stringToSign:n}}function xl(e){return bv("sha256").update(e).digest("hex")}function sa(e,t){return uf("sha256",e).update(t,"utf8").digest()}function Hn(e){return Array.isArray(e)?e[0]:e}var hf="reason-egress-target",gf="reason-egress-token";class Sl{entries=new Map;refs=new Map;lease=null;register(e,t,n,r){if(!e||!t||n.length===0)return;if(this.entries.set(e,{placeholder:e,token:t,hosts:[...n],url:r}),this.lease&&!this.lease.has(e))this.lease.add(e),this.refs.set(e,(this.refs.get(e)??0)+1)}beginLease(){this.lease=new Set}endLease(){let e=[...this.lease??[]];return this.lease=null,e}release(e){for(let t of e){let n=(this.refs.get(t)??1)-1;if(n>0){this.refs.set(t,n);continue}this.refs.delete(t),this.entries.delete(t)}e.length=0}clear(){this.entries.clear(),this.refs.clear()}forwardFor(e,t){for(let n of this.entries.values()){if(!n.hosts.includes(t))continue;for(let r of Object.values(e))if((Array.isArray(r)?r:r===void 0?[]:[r]).some((s)=>s.includes(n.placeholder)||kv(s,n.placeholder)))return{url:new URL(n.url),token:n.token}}return}}function kv(e,t){let n=/^\s*basic\s+([A-Za-z0-9+/=_-]+)\s*$/i.exec(e);return n?Buffer.from(n[1],"base64").toString("utf8").includes(t):!1}var vf=67108864;class Cl extends Error{}function mf(e){return e.length>=3&&e[0]===22&&e[1]===3&&e[2]<=3}function xf(e,t){if(t.length>=3)return Promise.resolve({isTLS:mf(t),head:t});return new Promise((n)=>{let r=t,i=()=>{e.removeListener("data",s),e.removeListener("close",i),n({isTLS:mf(r),head:r})},s=(a)=>{if(e.pause(),r=r.length?Buffer.concat([r,a]):a,r.length>=3)return i();e.resume()};e.on("data",s),e.once("close",i)})}function Lv(e,t){let n=()=>{let r;while((r=e.read())!==null)if(!t.write(r)){t.once("drain",n);return}e.once("readable",n)};n(),e.once("end",()=>t.end())}function Sf(e,t,n,r,i,s,a,o,l=vf,c){let u=fl(e,a.hostname),d=Iv({ALPNProtocols:["http/1.1"],cert:u.certPem,key:u.keyPem,SNICallback:(p,v)=>{try{v(null,rf(e,p||a.hostname))}catch(x){v(x)}}});d.on("request",(p,v)=>{p.on("error",(x)=>{C(`[tls-terminate] client request error: ${x.message}`,{level:"error"})}),v.on("error",(x)=>{C(`[tls-terminate] client response error: ${x.message}`,{level:"error"})}),Ov(t,n,r,p,v,a,o,l,c)}),d.on("clientError",(p,v)=>{C(`[tls-terminate] client connection error for ${a.hostname}: ${p.message}`,{level:"error"}),v.destroy()}),d.on("tlsClientError",(p,v)=>{C(`[tls-terminate] client TLS error for ${a.hostname}: ${p.message}`,{level:"error"}),v.destroy()}),d.on("upgrade",(p,v)=>{C("[tls-terminate] upgrade request refused",{level:"warn"}),v.destroy()});let f=Wv(),y=()=>{d.close(),Pv(f,()=>{})};d.on("error",(p)=>{C(`[tls-terminate] inner server listen failed: ${p.message}`,{level:"error"}),i.destroy(),y()}),d.listen(f,()=>{let p=Bv({path:f});p.on("error",(v)=>{C(`[tls-terminate] inner loopback failed: ${v.message}`,{level:"error"}),i.destroy(),y()}),p.once("connect",()=>{if(s.length)p.write(s);Lv(i,p),p.pipe(i)}),i.on("error",()=>p.destroy()),i.once("close",()=>{p.destroy(),y()}),p.once("close",()=>i.destroy())}),d.unref()}function yf(e,t){if(t.writableFinished||t.destroyed){e.destroy();return}t.once("finish",()=>e.destroy()),t.once("close",()=>e.destroy())}function Ov(...e){Uv(...e).catch((t)=>{C(`[tls-terminate] forwardUpstream failed: ${t.message}`,{level:"error"})})}async function Uv(e,t,n,r,i,s,a,o=vf,l){let c=Fv(r.url),u=r;if(e){let E=new AbortController;i.once("close",()=>E.abort());let k=s.port===443?s.hostname:`${s.hostname}:${s.port}`,I=await ea(e,r,i,`https://${k}${c}`,E.signal,s.onFilterRequestDeny);if(I===null)return;if(u=I,r.destroyed&&!r.readableEnded||i.destroyed||r.socket.destroyed||u.destroyed){u.destroy();return}}let d=$r(r.headers);delete d.host;let f=l?.(d,s.hostname),y=a?.(r.method??"GET",c,d,s.hostname);t?.(d,s.hostname);let p=ta(n,r,d,s.hostname),v;if(y?.action==="deny"){if(Ri(i,y.reason),u.destroy(),u!==r)yf(r,i);return}if(y?.action==="resign"){let E=y.payloadHash;if(E===void 0){let R=p?u.pipe(p):u;if(p)u.on("error",(M)=>p.destroy(M));try{v=await Vv(R,o)}catch(M){if(M instanceof Cl){Ri(i,`AWS SigV4 request uses a masked credential and signs a literal body hash, so the proxy must buffer the body to re-sign it, but the body exceeds the ${o}-byte buffering limit; denied. Sign the payload as UNSIGNED-PAYLOAD to stream it without buffering, or use an unmasked credential to have the request forwarded untouched.`),R.resume();return}C(`[tls-terminate] failed to buffer body for SigV4 re-sign: ${M.message}`,{level:"error"}),i.destroy();return}E=xl(v),d["content-length"]=String(v.length)}let k=bl(s.hostname)===6?`[${s.hostname}]`:s.hostname,I=s.port===443?k:`${k}:${s.port}`;try{y.apply(d,I,E)}catch(R){if(Ri(i,`AWS SigV4 re-signing failed: ${R.message}`),u.destroy(),u!==r)yf(r,i);return}}if(Boolean(r.headers["content-length"]||r.headers["transfer-encoding"])&&v===void 0&&d["content-length"]===void 0&&d["transfer-encoding"]===void 0)d["transfer-encoding"]="chunked";if(f){let E=bl(s.hostname)===6?`[${s.hostname}]`:s.hostname;d[hf]=`https://${s.port===443?E:`${E}:${s.port}`}${c}`,d[gf]=f.token}let b=f?f.url.hostname:s.hostname,A=Rv({host:b,port:f?Number(f.url.port||443):s.port,path:f?`${f.url.pathname}${f.url.search}`:c,method:r.method,headers:d,...bl(b)?{}:{servername:b},...s.upstreamCA?{ca:s.upstreamCA}:{},agent:!1},(E)=>{E.on("error",(k)=>{C(`[tls-terminate] upstream response error: ${k.message}`,{level:"error"}),i.destroy()}),i.writeHead(E.statusCode??502,$r(E.headers)),E.pipe(i)});if(A.on("error",(E)=>{if(C(`[tls-terminate] upstream ${s.hostname}:${s.port} failed: ${E.message}`,{level:"error"}),!i.headersSent)i.writeHead(502,{"Content-Type":"text/plain"}),i.end("Bad Gateway");else i.destroy()}),i.on("close",()=>A.destroy()),v!==void 0)A.end(v);else if(p)p.on("error",(E)=>A.destroy(E)),u.on("error",(E)=>p.destroy(E)),i.on("close",()=>p.destroy()),u.pipe(p).pipe(A);else u.on("error",(E)=>A.destroy(E)),u.pipe(A)}function Vv(e,t){return new Promise((n,r)=>{let i=[],s=0,a=(o)=>{if(s+=o.length,s>t){i.length=0,e.removeListener("data",a),r(new Cl(`request body exceeds ${t} bytes`));return}i.push(o)};e.on("data",a),e.once("end",()=>n(Buffer.concat(i))),e.once("error",r)})}function Fv(e){let t=e??"/";if(t.startsWith("/"))return t;try{let n=new URL(t);return`${n.pathname}${n.search}`||"/"}catch{return t}}var Mv=0;function Wv(){return Dv(Nv(),`srt-tt-${process.pid}-${(Mv++).toString(36)}.sock`)}function Gv(e,t){if(!t)return{ok:!0};let n=/^basic\s+([a-z0-9+/=]+)\s*$/i.exec(e??"");if(!n)return{ok:!1};let r=Buffer.from(n[1],"base64").toString("utf8"),i=r.indexOf(":");if(i<=0||!ps(r.slice(i+1),t))return{ok:!1};return{ok:!0,encodedCommand:vs(r.slice(0,i))}}function Ef(e){let t=Hv();t.on("clientError",(r,i)=>{if(C(`Client connection error: ${r.message}`,{level:"error"}),i.on("error",()=>{}),r.code!=="ECONNRESET"&&i.writable){let s=r.code==="HPE_HEADER_OVERFLOW"?"431 Request Header Fields Too Large":"400 Bad Request";i.end(`HTTP/1.1 ${s}\r
38
38
  \r
39
- `,()=>i.destroy()),setTimeout(()=>i.destroy(),1000).unref?.();return}i.destroy()});let n=(r)=>Kv(r,e.proxyAuthToken);return t.on("connect",async(r,i,s)=>{i.on("error",(b)=>{C(`Client socket error: ${b.message}`,{level:"error"}),i.destroy()});let a=!1;i.once("close",()=>{a=!0});let o=()=>{a=!0,i.destroy()},l=65536,c=0,u=!1,d=[],f=(b)=>{if(!u)return;if(c+=b.length,c>l){C("CONNECT client exceeded pre-establishment capture cap; destroying",{level:"error"}),o();return}d.push(b)};if(!e.mitmCA)u=!0,i.on("data",f);if(i.readableEnded)o();else i.once("end",o);let y=()=>{if(u=!1,d.length)s=Buffer.concat([s,...d]),d.length=0},p=()=>{i.removeListener("end",o),y()},v=(b)=>{if(a||i.destroyed||i.readableEnded||!i.writable){C("CONNECT client gone before status write; dropping verdict and destroying socket"),i.destroy();return}p(),i.end(b)};if(a||i.destroyed)return;let x=!1;try{let b=n(r.headers["proxy-authorization"]);if(!b.ok){v(`HTTP/1.1 407 Proxy Authentication Required\r
39
+ `,()=>i.destroy()),setTimeout(()=>i.destroy(),1000).unref?.();return}i.destroy()});let n=(r)=>Gv(r,e.proxyAuthToken);return t.on("connect",async(r,i,s)=>{i.on("error",(b)=>{C(`Client socket error: ${b.message}`,{level:"error"}),i.destroy()});let a=!1;i.once("close",()=>{a=!0});let o=()=>{a=!0,i.destroy()},l=65536,c=0,u=!1,d=[],f=(b)=>{if(!u)return;if(c+=b.length,c>l){C("CONNECT client exceeded pre-establishment capture cap; destroying",{level:"error"}),o();return}d.push(b)};if(!e.mitmCA)u=!0,i.on("data",f);if(i.readableEnded)o();else i.once("end",o);let y=()=>{if(u=!1,d.length)s=Buffer.concat([s,...d]),d.length=0},p=()=>{i.removeListener("end",o),y()},v=(b)=>{if(a||i.destroyed||i.readableEnded||!i.writable){C("CONNECT client gone before status write; dropping verdict and destroying socket"),i.destroy();return}p(),i.end(b)};if(a||i.destroyed)return;let x=!1;try{let b=n(r.headers["proxy-authorization"]);if(!b.ok){v(`HTTP/1.1 407 Proxy Authentication Required\r
40
40
  Proxy-Authenticate: Basic realm="srt"\r
41
41
  \r
42
- `);return}let A=qv(r.url);if(!A){C(`Invalid CONNECT request: ${r.url}`,{level:"error"}),v(`HTTP/1.1 400 Bad Request\r
42
+ `);return}let A=jv(r.url);if(!A){C(`Invalid CONNECT request: ${r.url}`,{level:"error"}),v(`HTTP/1.1 400 Bad Request\r
43
43
  \r
44
44
  `);return}let{hostname:E,port:k}=A;if(!await e.filter(k,E,i,b.encodedCommand)){C(`Connection blocked to ${E}:${k}`,{level:"error"}),v(`HTTP/1.1 403 Forbidden\r
45
45
  Content-Type: text/plain\r
@@ -47,25 +47,25 @@ X-Proxy-Error: blocked-by-allowlist\r
47
47
  \r
48
48
  Connection blocked by network allowlist`);return}if(a||i.destroyed){i.destroy();return}let R=_t(E)??E;if(e.mitmCA&&(e.shouldTerminateTLS?.(R,k)??!0)){i.write(`HTTP/1.1 200 Connection Established\r
49
49
  \r
50
- `),x=!0;let K=await vf(i,s);if(a||i.destroyed){i.destroy();return}if(K.isTLS){p(),xf(e.mitmCA,e.filterRequest,e.mutateHeaders,e.getBodySubstitutions,i,K.head,{hostname:R,port:k,upstreamCA:e.tlsTerminateUpstreamCA,onFilterRequestDeny:e.onFilterRequestDenied?(ie,ve,we)=>e.onFilterRequestDenied({method:ie,url:ve,reason:we,encodedCommand:b.encodedCommand}):void 0},e.planSigv4,e.maxSigv4ResignBodyBytes,e.getBrokerForward);return}C(`[tls-terminate] non-TLS bytes on CONNECT ${R}:${k}; opaque-tunnelling`),s=K.head}else if(e.mitmCA)C(`[tls-terminate] policy exempts ${R}:${k}; opaque-tunnelling`);let M=e.getMitmSocketPath?.(R),ee=!M&&e.parentProxy&&!Ri(e.parentProxy,R)?Bi(e.parentProxy,{isHttps:!0}):void 0,O;try{if(M)C(`Routing CONNECT ${R}:${k} through MITM proxy at ${M}`),O=await hl({dial:()=>$v({path:M}),readyEvent:"connect",destHost:R,destPort:k});else if(ee)O=await ra(ee,R,k);else O=await na(R,k)}catch(K){if(C(`CONNECT tunnel failed: ${K.message}`,{level:"error"}),x)i.destroy();else v(`HTTP/1.1 502 Bad Gateway\r
50
+ `),x=!0;let K=await xf(i,s);if(a||i.destroyed){i.destroy();return}if(K.isTLS){p(),Sf(e.mitmCA,e.filterRequest,e.mutateHeaders,e.getBodySubstitutions,i,K.head,{hostname:R,port:k,upstreamCA:e.tlsTerminateUpstreamCA,onFilterRequestDeny:e.onFilterRequestDenied?(ie,ve,we)=>e.onFilterRequestDenied({method:ie,url:ve,reason:we,encodedCommand:b.encodedCommand}):void 0},e.planSigv4,e.maxSigv4ResignBodyBytes,e.getBrokerForward);return}C(`[tls-terminate] non-TLS bytes on CONNECT ${R}:${k}; opaque-tunnelling`),s=K.head}else if(e.mitmCA)C(`[tls-terminate] policy exempts ${R}:${k}; opaque-tunnelling`);let M=e.getMitmSocketPath?.(R),ee=!M&&e.parentProxy&&!Bi(e.parentProxy,R)?Pi(e.parentProxy,{isHttps:!0}):void 0,O;try{if(M)C(`Routing CONNECT ${R}:${k} through MITM proxy at ${M}`),O=await gl({dial:()=>Kv({path:M}),readyEvent:"connect",destHost:R,destPort:k});else if(ee)O=await na(ee,R,k);else O=await ia(R,k)}catch(K){if(C(`CONNECT tunnel failed: ${K.message}`,{level:"error"}),x)i.destroy();else v(`HTTP/1.1 502 Bad Gateway\r
51
51
  \r
52
52
  `);return}if(a||i.destroyed){O.on("error",()=>{}),O.destroy(),i.destroy();return}if(!x)i.write(`HTTP/1.1 200 Connection Established\r
53
53
  \r
54
54
  `);if(p(),i.allowHalfOpen=!0,s.length)O.write(s);O.pipe(i),i.pipe(O),O.on("error",(K)=>{C(`CONNECT tunnel failed: ${K.message}`,{level:"error"}),i.destroy()}),i.on("close",()=>O.destroy()),O.on("close",()=>i.destroy())}catch(b){if(C(`Error handling CONNECT: ${b}`,{level:"error"}),x)i.destroy();else v(`HTTP/1.1 500 Internal Server Error\r
55
55
  \r
56
- `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"error"}),i.socket?.destroy()});try{if(e.mitmCA&&r.method==="GET"&&new bf(r.url??"","http://x").pathname===Ys){i.writeHead(200,{"Content-Type":"application/pkix-crl","Content-Length":e.mitmCA.crlDer.length}),i.end(e.mitmCA.crlDer);return}let s=n(r.headers["proxy-authorization"]);if(!s.ok){i.writeHead(407,{"Proxy-Authenticate":'Basic realm="srt"'}),i.end();return}let a=new bf(r.url),o=jt(a.hostname),l=a.port?parseInt(a.port,10):a.protocol==="https:"?443:80;if(!await e.filter(l,o,r.socket,s.encodedCommand)){if(C(`HTTP request blocked to ${o}:${l}`,{level:"error"}),r.socket.destroyed||i.destroyed){i.destroy();return}i.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-allowlist"}),i.end("Connection blocked by network allowlist");return}if(r.socket.destroyed)return;let u=_t(o)??o,d=(Hv(u)===6?`[${u}]`:u)+(a.port?`:${a.port}`:""),f={...$r(r.headers),host:d};e.mutateHeadersPlaintext?.(f,u);let y=ea(e.getBodySubstitutionsPlaintext,r,f,u),p=e.getMitmSocketPath?.(u),v=!p&&e.parentProxy&&!Ri(e.parentProxy,u)?Bi(e.parentProxy,{isHttps:a.protocol==="https:"}):void 0,x=`${a.protocol}//${d}${a.pathname}${a.search}`,b=r;if(e.filterRequest){let k=new AbortController;i.once("close",()=>k.abort());let I=await Zs(e.filterRequest,r,i,x,k.signal,e.onFilterRequestDenied?(R,M,ee)=>e.onFilterRequestDenied({method:R,url:M,reason:ee,encodedCommand:s.encodedCommand}):void 0);if(I===null)return;if(b=I,r.destroyed&&!r.readableEnded||i.destroyed||r.socket.destroyed||b.destroyed){b.destroy();return}}if(Boolean(r.headers["content-length"]||r.headers["transfer-encoding"])&&f["content-length"]===void 0&&f["transfer-encoding"]===void 0)f["transfer-encoding"]="chunked";let E;if(p){C(`Routing HTTP ${r.method} ${u}:${l} through MITM proxy at ${p}`);let k=new Mv({socketPath:p});E=Cl({agent:k,path:x,method:r.method,headers:f},(I)=>{I.on("error",(R)=>{C(`Upstream response error: ${R.message}`,{level:"error"}),i.destroy()}),i.writeHead(I.statusCode,$r(I.headers)),I.pipe(i)})}else if(v){let k=jt(v.hostname),I=Number(v.port)||(v.protocol==="https:"?443:80),R=gl(v);E=(v.protocol==="https:"?Sf:Cl)({hostname:k,port:I,path:x,method:r.method,headers:R?{...f,"proxy-authorization":R}:f},(ee)=>{ee.on("error",(O)=>{C(`Upstream response error: ${O.message}`,{level:"error"}),i.destroy()}),i.writeHead(ee.statusCode,$r(ee.headers)),ee.pipe(i)})}else E=(a.protocol==="https:"?Sf:Cl)({hostname:u,port:l,path:a.pathname+a.search,method:r.method,headers:f},(I)=>{I.on("error",(R)=>{C(`Upstream response error: ${R.message}`,{level:"error"}),i.destroy()}),i.writeHead(I.statusCode,$r(I.headers)),I.pipe(i)});if(E.on("error",(k)=>{if(C(`Proxy request failed: ${k.message}`,{level:"error"}),!i.headersSent)i.writeHead(502,{"Content-Type":"text/plain"}),i.end("Bad Gateway");else i.destroy()}),i.on("close",()=>E.destroy()),y)y.on("error",(k)=>E.destroy(k)),b.on("error",(k)=>y.destroy(k)),i.on("close",()=>y.destroy()),b.pipe(y).pipe(E);else b.on("error",(k)=>E.destroy(k)),b.pipe(E)}catch(s){if(C(`Error handling HTTP request: ${s}`,{level:"error"}),!i.headersSent)i.writeHead(500,{"Content-Type":"text/plain"}),i.end("Internal Server Error");else i.destroy()}}),t}function qv(e){let t=/^\[([^\]]+)\]:(\d+)$/.exec(e)??/^([^:]+):(\d+)$/.exec(e);if(!t)return;let n=Number(t[2]);if(!Number.isInteger(n)||n<1||n>65535)return;return{hostname:t[1],port:n}}var Rf=Ga(If(),1);function nx(e,t,n){if(!n||t===void 0)return!1;return e!==void 0&&(e===gr||e.startsWith(`${gr}.`))&&fs(t,n)}function Bf(e){let t=Rf.createServer();if(e.proxyAuthToken)t.setAuthHandler((r,i,s)=>{if(nx(r.username,r.password,e.proxyAuthToken))i();else C("SOCKS auth rejected",{level:"error"}),s()});t.setRulesetValidator(async(r)=>{try{let{destAddress:i,destPort:s}=r;if(!$n(i))return C(`Rejecting malformed SOCKS host: ${JSON.stringify(i)}`,{level:"error"}),!1;if(C(`Connection request to ${i}:${s}`),!await e.filter(s,i,ys(r.username)))return C(`Connection blocked to ${i}:${s}`,{level:"error"}),!1;return C(`Connection allowed to ${i}:${s}`),!0}catch(i){return C(`Error validating connection: ${i}`,{level:"error"}),!1}}),t.setConnectionHandler((r,i)=>{let s=_t(r.destAddress)??r.destAddress,a=r.destPort,o=!1,l;r.socket.once("close",()=>{o=!0,l?.destroy()}),r.socket.on("error",()=>l?.destroy());let c=e.parentProxy&&!Ri(e.parentProxy,s)?Bi(e.parentProxy,{isHttps:!0}):void 0;(c?ra(c,s,a):na(s,a)).then((d)=>{if(l=d,d.on("error",()=>r.socket.destroy()),o){d.destroy();return}i("REQUEST_GRANTED"),d.pipe(r.socket),r.socket.pipe(d),d.on("close",()=>r.socket.destroy())}).catch((d)=>{if(C(`SOCKS connect to ${s}:${a} failed: ${d.message}`,{level:"error"}),!o)try{i("HOST_UNREACHABLE")}catch{}})});let n=new Set;return{handleConnection(r){if(r.setNoDelay(),n.add(r),r.once("close",()=>n.delete(r)),!e.proxyAuthToken){t._handleConnection(r);return}ax(r,(i)=>{if(i){t._handleConnection(r);return}ox(r,e).catch(()=>r.destroy())})},async close(){for(let r of n)r.destroy();n.clear()}}}var ix=0,sx=2;function ax(e,t){let n=Buffer.alloc(0),r=(i)=>{if(n=Buffer.concat([n,i]),n.length<2)return;if(n[0]!==5){e.off("data",r),e.destroy();return}let s=n[1];if(n.length<2+s)return;e.off("data",r),e.pause();let o=n.subarray(2,2+s).includes(sx),l=o?n:n.subarray(2+s);if(l.length>0)e.unshift(l);t(o)};e.on("data",r),e.once("error",()=>e.off("data",r))}async function ox(e,t){e.write(Buffer.from([5,ix]));let n=await lx(e);if(n===void 0){e.destroy();return}let{host:r,port:i}=n;if(!$n(r)){e.end(Tl(2));return}let s=t.probeUnauthenticated?await t.probeUnauthenticated(i,r):{};if(C(`SOCKS unauthenticated client refused for ${r}:${i}`+(s.deniedReason!==void 0?" (denied by policy)":"")),i!==22){e.end(Tl(2));return}let a=s.deniedReason??"This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.";e.write(Tl(0)),e.write(Buffer.from(`SSH-2.0-policy_refusal\r
57
- `)),e.end(cx(a))}function Tl(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function lx(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)},i=setTimeout(()=>r(void 0),5000),s=(a)=>{if(n=Buffer.concat([n,a]),n.length<4)return;if(n[0]!==5||n[1]!==1){r(void 0);return}let o=n[3];if(o===1){if(n.length<10)return;let l=Array.from(n.subarray(4,8)).join(".");r({host:l,port:n.readUInt16BE(8)})}else if(o===3){if(n.length<5)return;let l=n[4];if(n.length<5+l+2)return;r({host:n.subarray(5,5+l).toString("utf8"),port:n.readUInt16BE(5+l)})}else if(o===4){if(n.length<22)return;let l=[];for(let c=0;c<16;c+=2)l.push(n.readUInt16BE(4+c).toString(16));r({host:l.join(":"),port:n.readUInt16BE(20)})}else r(void 0)};e.on("data",s),e.resume(),e.once("error",()=>r(void 0)),e.once("close",()=>r(void 0))})}function cx(e){let t=e.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").slice(0,1000),n=Buffer.from(t,"utf8"),r=Buffer.alloc(0),i=Buffer.concat([Buffer.from([1]),oa(1),oa(n.length),n,oa(r.length),r]),s=8-(5+i.length)%8;if(s<4)s+=8;return Buffer.concat([oa(1+i.length+s),Buffer.from([s]),i,Buffer.alloc(s)])}function oa(e){let t=Buffer.alloc(4);return t.writeUInt32BE(e,0),t}import{createServer as ux,connect as Pf}from"net";import{join as dx}from"path";import{tmpdir as fx}from"os";import{unlink as Nf}from"fs/promises";function la(e,t,n,r){return new Promise((i,s)=>{let[a,o]=n??[0,0],l=a,c=()=>{while(r.has(l)&&l<=o)l++;if(l>o){s(Error(`No free port in range ${a}-${o} (excluding ${[...r].join(",")})`));return}let u=()=>{e.removeListener("error",d),i()},d=(f)=>{if(e.removeListener("listening",u),n&&f?.code==="EADDRINUSE"&&l<o){l++,c();return}s(f??Error("listen error"))};e.once("error",d),e.once("listening",u),t(n?l:0)};c()})}var px=new Set([4,5]),hx=1e4,gx=0;function mx(){return dx(fx(),`srt-mux-${process.pid}-${(gx++).toString(36)}.sock`)}function Df(e){let t=e.firstByteTimeoutMs??hx,n=Ne()==="windows",r,i,s=new Set;function a(l){if(r===void 0&&i===void 0){C("mux: HTTP dispatch before backend bound; dropping",{level:"error"}),l.destroy();return}let c=r?Pf(r):Pf(i,"127.0.0.1");c.on("error",(u)=>{let d=u.code??"ERR";if(C(`mux: HTTP backend dial failed: ${u.message}`,{level:"error"}),!l.destroyed)l.end(`HTTP/1.1 502 Bad Gateway\r
56
+ `)}}),t.on("request",async(r,i)=>{r.on("error",(s)=>{C(`Client request error: ${s.message}`,{level:"error"})}),i.on("error",(s)=>{C(`Client response error: ${s.message}`,{level:"error"}),i.socket?.destroy()});try{if(e.mitmCA&&r.method==="GET"&&new Cf(r.url??"","http://x").pathname===Js){i.writeHead(200,{"Content-Type":"application/pkix-crl","Content-Length":e.mitmCA.crlDer.length}),i.end(e.mitmCA.crlDer);return}let s=n(r.headers["proxy-authorization"]);if(!s.ok){i.writeHead(407,{"Proxy-Authenticate":'Basic realm="srt"'}),i.end();return}let a=new Cf(r.url),o=jt(a.hostname),l=a.port?parseInt(a.port,10):a.protocol==="https:"?443:80;if(!await e.filter(l,o,r.socket,s.encodedCommand)){if(C(`HTTP request blocked to ${o}:${l}`,{level:"error"}),r.socket.destroyed||i.destroyed){i.destroy();return}i.writeHead(403,{"Content-Type":"text/plain","X-Proxy-Error":"blocked-by-allowlist"}),i.end("Connection blocked by network allowlist");return}if(r.socket.destroyed)return;let u=_t(o)??o,d=(qv(u)===6?`[${u}]`:u)+(a.port?`:${a.port}`:""),f={...$r(r.headers),host:d};e.mutateHeadersPlaintext?.(f,u);let y=ta(e.getBodySubstitutionsPlaintext,r,f,u),p=e.getMitmSocketPath?.(u),v=!p&&e.parentProxy&&!Bi(e.parentProxy,u)?Pi(e.parentProxy,{isHttps:a.protocol==="https:"}):void 0,x=`${a.protocol}//${d}${a.pathname}${a.search}`,b=r;if(e.filterRequest){let k=new AbortController;i.once("close",()=>k.abort());let I=await ea(e.filterRequest,r,i,x,k.signal,e.onFilterRequestDenied?(R,M,ee)=>e.onFilterRequestDenied({method:R,url:M,reason:ee,encodedCommand:s.encodedCommand}):void 0);if(I===null)return;if(b=I,r.destroyed&&!r.readableEnded||i.destroyed||r.socket.destroyed||b.destroyed){b.destroy();return}}if(Boolean(r.headers["content-length"]||r.headers["transfer-encoding"])&&f["content-length"]===void 0&&f["transfer-encoding"]===void 0)f["transfer-encoding"]="chunked";let E;if(p){C(`Routing HTTP ${r.method} ${u}:${l} through MITM proxy at ${p}`);let k=new $v({socketPath:p});E=El({agent:k,path:x,method:r.method,headers:f},(I)=>{I.on("error",(R)=>{C(`Upstream response error: ${R.message}`,{level:"error"}),i.destroy()}),i.writeHead(I.statusCode,$r(I.headers)),I.pipe(i)})}else if(v){let k=jt(v.hostname),I=Number(v.port)||(v.protocol==="https:"?443:80),R=ml(v);E=(v.protocol==="https:"?bf:El)({hostname:k,port:I,path:x,method:r.method,headers:R?{...f,"proxy-authorization":R}:f},(ee)=>{ee.on("error",(O)=>{C(`Upstream response error: ${O.message}`,{level:"error"}),i.destroy()}),i.writeHead(ee.statusCode,$r(ee.headers)),ee.pipe(i)})}else E=(a.protocol==="https:"?bf:El)({hostname:u,port:l,path:a.pathname+a.search,method:r.method,headers:f},(I)=>{I.on("error",(R)=>{C(`Upstream response error: ${R.message}`,{level:"error"}),i.destroy()}),i.writeHead(I.statusCode,$r(I.headers)),I.pipe(i)});if(E.on("error",(k)=>{if(C(`Proxy request failed: ${k.message}`,{level:"error"}),!i.headersSent)i.writeHead(502,{"Content-Type":"text/plain"}),i.end("Bad Gateway");else i.destroy()}),i.on("close",()=>E.destroy()),y)y.on("error",(k)=>E.destroy(k)),b.on("error",(k)=>y.destroy(k)),i.on("close",()=>y.destroy()),b.pipe(y).pipe(E);else b.on("error",(k)=>E.destroy(k)),b.pipe(E)}catch(s){if(C(`Error handling HTTP request: ${s}`,{level:"error"}),!i.headersSent)i.writeHead(500,{"Content-Type":"text/plain"}),i.end("Internal Server Error");else i.destroy()}}),t}function jv(e){let t=/^\[([^\]]+)\]:(\d+)$/.exec(e)??/^([^:]+):(\d+)$/.exec(e);if(!t)return;let n=Number(t[2]);if(!Number.isInteger(n)||n<1||n>65535)return;return{hostname:t[1],port:n}}var Bf=ja(Rf(),1);function sx(e,t,n){if(!n||t===void 0)return!1;return e!==void 0&&(e===gr||e.startsWith(`${gr}.`))&&ps(t,n)}function Pf(e){let t=Bf.createServer();if(e.proxyAuthToken)t.setAuthHandler((r,i,s)=>{if(sx(r.username,r.password,e.proxyAuthToken))i();else C("SOCKS auth rejected",{level:"error"}),s()});t.setRulesetValidator(async(r)=>{try{let{destAddress:i,destPort:s}=r;if(!$n(i))return C(`Rejecting malformed SOCKS host: ${JSON.stringify(i)}`,{level:"error"}),!1;if(C(`Connection request to ${i}:${s}`),!await e.filter(s,i,vs(r.username)))return C(`Connection blocked to ${i}:${s}`,{level:"error"}),!1;return C(`Connection allowed to ${i}:${s}`),!0}catch(i){return C(`Error validating connection: ${i}`,{level:"error"}),!1}}),t.setConnectionHandler((r,i)=>{let s=_t(r.destAddress)??r.destAddress,a=r.destPort,o=!1,l;r.socket.once("close",()=>{o=!0,l?.destroy()}),r.socket.on("error",()=>l?.destroy());let c=e.parentProxy&&!Bi(e.parentProxy,s)?Pi(e.parentProxy,{isHttps:!0}):void 0;(c?na(c,s,a):ia(s,a)).then((d)=>{if(l=d,d.on("error",()=>r.socket.destroy()),o){d.destroy();return}i("REQUEST_GRANTED"),d.pipe(r.socket),r.socket.pipe(d),d.on("close",()=>r.socket.destroy())}).catch((d)=>{if(C(`SOCKS connect to ${s}:${a} failed: ${d.message}`,{level:"error"}),!o)try{i("HOST_UNREACHABLE")}catch{}})});let n=new Set;return{handleConnection(r){if(r.setNoDelay(),n.add(r),r.once("close",()=>n.delete(r)),!e.proxyAuthToken){t._handleConnection(r);return}lx(r,(i)=>{if(i){t._handleConnection(r);return}cx(r,e).catch(()=>r.destroy())})},async close(){for(let r of n)r.destroy();n.clear()}}}var ax=0,ox=2;function lx(e,t){let n=Buffer.alloc(0),r=(i)=>{if(n=Buffer.concat([n,i]),n.length<2)return;if(n[0]!==5){e.off("data",r),e.destroy();return}let s=n[1];if(n.length<2+s)return;e.off("data",r),e.pause();let o=n.subarray(2,2+s).includes(ox),l=o?n:n.subarray(2+s);if(l.length>0)e.unshift(l);t(o)};e.on("data",r),e.once("error",()=>e.off("data",r))}async function cx(e,t){e.write(Buffer.from([5,ax]));let n=await ux(e);if(n===void 0){e.destroy();return}let{host:r,port:i}=n;if(!$n(r)){e.end(Al(2));return}let s=t.probeUnauthenticated?await t.probeUnauthenticated(i,r):{};if(C(`SOCKS unauthenticated client refused for ${r}:${i}`+(s.deniedReason!==void 0?" (denied by policy)":"")),i!==22){e.end(Al(2));return}let a=s.deniedReason??"This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.";e.write(Al(0)),e.write(Buffer.from(`SSH-2.0-policy_refusal\r
57
+ `)),e.end(dx(a))}function Al(e){return Buffer.from([5,e,0,1,0,0,0,0,0,0])}function ux(e){return new Promise((t)=>{let n=Buffer.alloc(0),r=(a)=>{e.off("data",s),clearTimeout(i),t(a)},i=setTimeout(()=>r(void 0),5000),s=(a)=>{if(n=Buffer.concat([n,a]),n.length<4)return;if(n[0]!==5||n[1]!==1){r(void 0);return}let o=n[3];if(o===1){if(n.length<10)return;let l=Array.from(n.subarray(4,8)).join(".");r({host:l,port:n.readUInt16BE(8)})}else if(o===3){if(n.length<5)return;let l=n[4];if(n.length<5+l+2)return;r({host:n.subarray(5,5+l).toString("utf8"),port:n.readUInt16BE(5+l)})}else if(o===4){if(n.length<22)return;let l=[];for(let c=0;c<16;c+=2)l.push(n.readUInt16BE(4+c).toString(16));r({host:l.join(":"),port:n.readUInt16BE(20)})}else r(void 0)};e.on("data",s),e.resume(),e.once("error",()=>r(void 0)),e.once("close",()=>r(void 0))})}function dx(e){let t=e.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").slice(0,1000),n=Buffer.from(t,"utf8"),r=Buffer.alloc(0),i=Buffer.concat([Buffer.from([1]),la(1),la(n.length),n,la(r.length),r]),s=8-(5+i.length)%8;if(s<4)s+=8;return Buffer.concat([la(1+i.length+s),Buffer.from([s]),i,Buffer.alloc(s)])}function la(e){let t=Buffer.alloc(4);return t.writeUInt32BE(e,0),t}import{createServer as fx,connect as Nf}from"net";import{join as px}from"path";import{tmpdir as hx}from"os";import{unlink as Df}from"fs/promises";function ca(e,t,n,r){return new Promise((i,s)=>{let[a,o]=n??[0,0],l=a,c=()=>{while(r.has(l)&&l<=o)l++;if(l>o){s(Error(`No free port in range ${a}-${o} (excluding ${[...r].join(",")})`));return}let u=()=>{e.removeListener("error",d),i()},d=(f)=>{if(e.removeListener("listening",u),n&&f?.code==="EADDRINUSE"&&l<o){l++,c();return}s(f??Error("listen error"))};e.once("error",d),e.once("listening",u),t(n?l:0)};c()})}var gx=new Set([4,5]),mx=1e4,yx=0;function vx(){return px(hx(),`srt-mux-${process.pid}-${(yx++).toString(36)}.sock`)}function Lf(e){let t=e.firstByteTimeoutMs??mx,n=Ne()==="windows",r,i,s=new Set;function a(l){if(r===void 0&&i===void 0){C("mux: HTTP dispatch before backend bound; dropping",{level:"error"}),l.destroy();return}let c=r?Nf(r):Nf(i,"127.0.0.1");c.on("error",(u)=>{let d=u.code??"ERR";if(C(`mux: HTTP backend dial failed: ${u.message}`,{level:"error"}),!l.destroyed)l.end(`HTTP/1.1 502 Bad Gateway\r
58
58
  Connection: close\r
59
59
  \r
60
60
  mux backend dial failed (${d})
61
- `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=ux((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on("error",(u)=>C(`mux: client socket error: ${u.message}`));let c=setTimeout(()=>{C("mux: first-byte timeout; destroying connection"),l.destroy()},t);if(typeof c.unref==="function")c.unref();l.once("readable",()=>{clearTimeout(c);let u=l.read(1);if(!u||u.length===0){l.destroy();return}if(l.unshift(u),px.has(u[0]))e.handleSocksConnection(l);else a(l)})});return{server:o,getPort(){let l=o.address();return l&&typeof l==="object"?l.port:void 0},async listenHttpBackend(){if(!n){let c=mx();await Nf(c).catch(()=>{}),await new Promise((u,d)=>{e.httpServer.once("error",d),e.httpServer.listen(c,()=>{e.httpServer.removeListener("error",d),u()})}),r=c,C(`mux: HTTP backend listening on ${c}`);return}await la(e.httpServer,(c)=>e.httpServer.listen(c,"127.0.0.1"),e.httpBackendPortRange,new Set);let l=e.httpServer.address();return i=l&&typeof l==="object"?l.port:void 0,C(`mux: HTTP backend listening on 127.0.0.1:${i}`),i},async close(){for(let l of s)l.destroy();if(s.clear(),await new Promise((l)=>o.close(()=>l())),await new Promise((l)=>e.httpServer.close(()=>l())),r)await Nf(r).catch(()=>{}),r=void 0;i=void 0},unref(){o.unref(),e.httpServer.unref()}}}import{randomBytes as yx,randomUUID as vx}from"crypto";var Kn="fake_value_",Lf="abcdefghijklmnopqrstuvwxyz0123456789_-";function xx(e){let t=Kn+vx(),n=Buffer.byteLength(e)-t.length;if(n<=0)return t;let r=t;for(let i of yx(n))r+=Lf[i%Lf.length];return r}class Al{byName=new Map;bySentinel=new Map;allSentinelsPrefixed=!0;refs=new Map;lease=null;register(e,t,n,r){return this.registerWithSentinel(e,xx(t),t,n,r)}registerWithSentinel(e,t,n,r,i){let s=this.byName.get(e);if(s!==void 0&&s.realValue===n)return s.injectHosts=r,s.injectHeaders=i,this.lease?.add(s),s.sentinel;if(this.bySentinel.has(t))throw Error("credential sentinel collision");if(!t.startsWith(Kn))this.allSentinelsPrefixed=!1;let a={name:e,sentinel:t,realValue:n,injectHosts:r,injectHeaders:i};return this.byName.set(e,a),this.bySentinel.set(t,a),this.lease?.add(a),t}beginLease(){this.lease=new Set}endLease(){let e=[...this.lease??[]];this.lease=null;for(let t of e)this.refs.set(t,(this.refs.get(t)??0)+1);return{entries:e}}release(e){let t=[];for(let n of e.entries){let r=(this.refs.get(n)??1)-1;if(r>0){this.refs.set(n,r);continue}if(this.refs.delete(n),this.bySentinel.get(n.sentinel)===n)this.bySentinel.delete(n.sentinel);if(this.byName.get(n.name)===n)this.byName.delete(n.name);t.push(n.sentinel)}if(e.entries.length=0,t.length>0&&!this.allSentinelsPrefixed)this.allSentinelsPrefixed=[...this.bySentinel.keys()].every((n)=>n.startsWith(Kn));return t}lookupReal(e){return this.bySentinel.get(e)?.realValue}namesInjectableAt(e,t){let n=[];for(let r of this.byName.values())if(r.injectHosts.some((i)=>t(e,i)))n.push(r.name);return n}sentinelsForHost(e,t){let n=[];for(let r of this.bySentinel.values()){if(!r.injectHosts.some((i)=>t(e,i)))continue;if(r.injectHeaders!==void 0)continue;n.push({sentinel:Buffer.from(r.sentinel),realValue:Buffer.from(r.realValue)})}return n}*entries(){for(let e of this.bySentinel.values())yield[e.sentinel,e.realValue]}get size(){return this.bySentinel.size}clear(){this.byName.clear(),this.bySentinel.clear(),this.refs.clear(),this.lease=null,this.allSentinelsPrefixed=!0}substituteInHeaders(e,t,n){if(this.bySentinel.size===0)return;for(let[r,i]of Object.entries(e)){if(i===void 0)continue;if(Array.isArray(i))for(let s=0;s<i.length;s++)i[s]=this.substituteInHeaderValue(r,i[s],t,n);else e[r]=this.substituteInHeaderValue(r,i,t,n)}}substituteInHeaderValue(e,t,n,r){let i=e.toLowerCase(),s=this.substituteInString(t,n,r,i);if(i!=="authorization")return s;let a=/^(\s*basic\s+)([a-z0-9+/]+={0,2})(\s*)$/i.exec(s);if(a===null)return s;let o=a[2],l=Buffer.from(o,"base64");if(o.length%4!==0||l.toString("base64")!==o)return s;let c=l.toString("utf8");if(!Buffer.from(c,"utf8").equals(l))return s;let u=this.substituteInString(c,n,r,i);if(u===c)return s;return`${a[1]}${Buffer.from(u,"utf8").toString("base64")}${a[3]}`}substituteInString(e,t,n,r){if(this.allSentinelsPrefixed&&!e.includes(Kn))return e;let i=e;for(let s of this.bySentinel.values()){if(!i.includes(s.sentinel))continue;if(!s.injectHosts.some((a)=>n(t,a)))continue;if(s.injectHeaders!==void 0&&!s.injectHeaders.includes(r))continue;i=i.split(s.sentinel).join(s.realValue)}return i}}import{randomUUID as _x}from"crypto";import*as zt from"fs";import{tmpdir as kx}from"os";import{join as Ff}from"path";function Sx(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let i=e[r];if(n){n=!1;continue}if(i==="\\")n=!0;else if(i==="]")return r+1}return e.length}function bx(e){switch(e){case"s":return{kind:"whitespace"};case"S":return{kind:"non-whitespace"};case"d":return{kind:"digit"};case"D":return{kind:"non-digit"};case"w":return{kind:"word"};case"W":return{kind:"non-word"};default:return{kind:"unknown"}}}function Of(e,t){if(e===null||t===null)return!0;if(e.kind==="literal"&&t.kind==="literal")return e.value===t.value;if(e.kind==="whitespace"&&t.kind==="non-whitespace"||e.kind==="non-whitespace"&&t.kind==="whitespace"||e.kind==="digit"&&t.kind==="non-digit"||e.kind==="non-digit"&&t.kind==="digit"||e.kind==="word"&&t.kind==="non-word"||e.kind==="non-word"&&t.kind==="word")return!1;return!0}function Cx(e,t){if(e[t+1]!=="?")return{next:t+1,capturing:!0};if(e[t+2]==="<"){let r=e[t+3];if(r==="="||r==="!")return{next:t+4,capturing:!1};let i=e.indexOf(">",t+3);return{next:i===-1?t+3:i+1,capturing:!0}}return{next:t+3,capturing:!1}}function Ex(e,t){let n=e[t];if(n==="*"||n==="+")return{next:e[t+1]==="?"?t+2:t+1,unbounded:!0};if(n==="?")return{next:e[t+1]==="?"?t+2:t+1,unbounded:!1};if(n!=="{")return null;let r=t+1,i=r;while(/[0-9]/.test(e[r]??""))r++;if(r===i)return null;let s=Number(e.slice(i,r)),a=s,o=!1;if(e[r]===","){r++;let l=r;while(/[0-9]/.test(e[r]??""))r++;if(r===l)o=!0,a=void 0;else a=Number(e.slice(l,r))}if(e[r]!=="}")return null;if(!Number.isFinite(s)||s>4096||a!==void 0&&(!Number.isFinite(a)||a>4096))return{next:r+1,unbounded:o,error:"finite repetitions must be at most 4096"};if(r++,e[r]==="?")r++;return{next:r,unbounded:o}}function wx(e){let t=[{previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}],n=0,r=()=>t[t.length-1],i=(s)=>{let a=r();if(a.lastAtom?.hasUnboundedQuantifier&&s.hasUnboundedQuantifier&&a.lastAtom.repeatClass!==null&&s.repeatClass!==null&&Of(a.lastAtom.repeatClass,s.repeatClass))a.error="adjacent unbounded repetition with overlapping input is not supported";if(a.previousAtom=a.lastAtom,a.lastAtom=s,a.atomCount===0)a.simpleClass=s.repeatClass;else a.simpleClass=null;if(a.atomCount++,s.kind==="group")a.containsQuantifier||=s.containsQuantifier,a.containsAlternation||=s.containsAlternation;a.hasUnboundedQuantifier||=s.hasUnboundedQuantifier};for(let s=0;s<e.length;){if(r().error!==void 0)return{groupCount:n,error:r().error};let a=e[s];if(a==="\\"){let l=e[s+1];if(l!==void 0&&/[1-9]/.test(l)||l==="k"&&e[s+2]==="<")return{groupCount:n,error:"backreferences are not supported by the safe extractor"};let c=l==="b"||l==="B";if(i({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:bx(l)}),s+=l===void 0?1:2,c)r().previousAtom=null,r().lastAtom=null;continue}if(a==="["){i({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:{kind:"unknown"}}),s=Sx(e,s);continue}if(a==="("){let l=Cx(e,s);if(l.capturing)n++;t.push({previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}),s=l.next;continue}if(a===")"){if(t.length>1){let l=t.pop();if(l.error!==void 0)return{groupCount:n,error:l.error};i({kind:"group",containsQuantifier:l.containsQuantifier,containsAlternation:l.containsAlternation,hasUnboundedQuantifier:l.hasUnboundedQuantifier,repeatClass:l.atomCount===1&&!l.containsAlternation?l.simpleClass:null})}s++;continue}if(a==="|"){r().containsAlternation=!0,r().previousAtom=null,r().lastAtom=null,s++;continue}let o=Ex(e,s);if(o!==null){if(o.error)return{groupCount:n,error:o.error};let l=r(),c=l.lastAtom;if(o.unbounded&&c?.kind==="group"&&(c.containsQuantifier||c.containsAlternation))return{groupCount:n,error:"nested unbounded repetition or unbounded alternation is not supported"};if(o.unbounded&&l.previousAtom?.hasUnboundedQuantifier&&c!==null&&l.previousAtom.repeatClass!==null&&c.repeatClass!==null&&Of(l.previousAtom.repeatClass,c.repeatClass))return{groupCount:n,error:"adjacent unbounded repetition with overlapping input is not supported"};if(l.containsQuantifier=!0,c!==null)l.lastAtom={...c,containsQuantifier:!0,hasUnboundedQuantifier:c.hasUnboundedQuantifier||o.unbounded};l.hasUnboundedQuantifier||=o.unbounded,s=o.next;continue}if(a!=="^"&&a!=="$")i({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:a==="."?{kind:"any"}:{kind:"literal",value:a}});else r().previousAtom=null,r().lastAtom=null;s++}return{groupCount:n,error:r().error}}function _l(e){if(e.length>2048)throw Error("Credential extract pattern exceeds the 2048-character limit");let t;try{t=new RegExp(e)}catch{throw Error("Credential extract pattern is not a valid regular expression")}let n=wx(e);if(n.error!==void 0)throw Error(`Credential extract pattern rejected: ${n.error}`);return{regex:t,groupCount:n.groupCount}}function Tx(e,t=""){_l(e);try{return new RegExp(e,t)}catch{throw Error("Credential extract pattern is not supported by this runtime")}}function ca(e,t,n,r={}){if(e.length>1048576)throw Error("Credential extraction input exceeds the 1048576-character limit");let i=Tx(t,"gd"),s=new Map,a=new Map,o=[],l=0;for(let d of e.matchAll(i)){if(l++,l>4096)throw Error("Credential extraction exceeds the 4096-match limit");let f=d[1];if(f===void 0)throw Error(`Credential extraction matched at offset ${d.index} without a group-1 capture; group 1 must capture the credential value on every match.`);if(f.length===0)continue;let y=s.get(f);if(y===void 0)s.set(f,y=s.size);let[p,v]=d.indices[1],x=n(f,y);if(!a.has(f))a.set(f,x);o.push({start:p,end:v,sentinel:x})}if(s.size===0)return null;if(r.maskDuplicates){let d=[...s.keys()].sort((f,y)=>y.length-f.length);for(let f of d){let y=a.get(f);if(y===f)continue;for(let p=e.indexOf(f);p!==-1;p=e.indexOf(f,p+1)){let v=p+f.length;if(o.some((x)=>p<x.end&&x.start<v))continue;o.push({start:p,end:v,sentinel:y})}}o.sort((f,y)=>f.start-y.start)}let c="",u=0;for(let d of o)c+=e.slice(u,d.start)+d.sentinel,u=d.end;return{fakeContent:c+e.slice(u),captures:[...s.keys()]}}var Uf="(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";function kl(e){try{return JSON.parse(Buffer.from(e,"base64url").toString("utf8"))}catch{return}}function ua(e){let t=e.split(".");if(t.length!==3)return!1;let n=kl(t[0]);if(typeof n!=="object"||n===null||!("alg"in n))return!1;return kl(t[1])!==void 0}var Ax=9999999999,Vf="c3J0LWZha2U";function Il(e){return Buffer.from(e,"utf8").toString("base64url")}function da(e){let t=Il(JSON.stringify({alg:"HS256",typ:"JWT"})),n=Il(JSON.stringify({sub:Kn+e,exp:Ax}));return`${t}.${n}.${Vf}`}function fa(e,t,n){let[r,i]=e.split("."),s=kl(i??"");if(typeof s!=="object"||s===null||Array.isArray(s))return null;let a=s,o=[];for(let c of t){let u=a[c];if(typeof u==="string")o.push([c,u])}if(o.length===0)return null;let l=new Map;for(let[c,u]of o){let d=n(c,u);a[c]=d,l.set(c,d)}return{fakeToken:`${r}.${Il(JSON.stringify(a))}.${Vf}`,claimSentinels:l}}var Ix="file:";class Rl{dir;byKey=new Map;write(e,t){if(this.dir===void 0)this.dir=zt.mkdtempSync(Ff(kx(),"srt-credmask-"));let n=this.byKey.get(e);if(n===void 0)n=Ff(this.dir,`${this.byKey.size}.fake`),this.byKey.set(e,n);return zt.rmSync(n,{force:!0}),zt.writeFileSync(n,t,{mode:384}),n}dispose(){if(this.dir!==void 0)try{zt.rmSync(this.dir,{recursive:!0,force:!0})}catch(e){C(`MaskedFileStore cleanup failed: ${e}`,{level:"error"})}this.dir=void 0,this.byKey.clear()}get dirPath(){return this.dir}}function Mf(e,t,n,r){let i=[],s=[];for(let a of e){if(a.mode!=="mask")continue;let o=it(a.path),l;try{if(zt.statSync(o).isDirectory()){C(`[credential-mask] Skipping masked file entry that resolves to a directory: ${a.path} \u2014 use mode "deny" for directories.`,{level:"warn"});continue}let p=zt.readFileSync(o);if(l=p.toString("utf8"),Buffer.byteLength(l,"utf8")!==p.length){C(`[credential-mask] Skipping masked file with non-UTF-8 content (binary credential files are not supported in mask mode): ${a.path}`,{level:"warn"});continue}}catch(y){C(`[credential-mask] Skipping masked file (unreadable on host): ${a.path} \u2014 ${y.message}`);continue}let c=a.injectHosts??t,u=Ix+o,d;if(a.extract===void 0&&a.decode===void 0)d=n.register(u,l,c);else{let y=a.extract??Uf,p=0,v=ca(l,y,(x,b)=>{if(a.decode==="jwt"&&!ua(x))return x;let A=`${u}#${b}`;if(a.decode==="jwt"&&a.maskClaims?.length){let E=fa(x,a.maskClaims,(I,R)=>n.register(`${u}#jwt${b}.${I}`,R,c));if(E===null)return C(`[credential-mask] ${a.path}: verified JWT candidate has none of maskClaims ${JSON.stringify(a.maskClaims)} as `+"string claims \u2014 left unmasked."),x;let k=a.maskClaims.filter((I)=>!E.claimSentinels.has(I));if(k.length>0)C(`[credential-mask] ${a.path}: maskClaims ${JSON.stringify(k)} absent or non-string in a `+"verified JWT \u2014 skipped.");return p++,n.registerWithSentinel(A,E.fakeToken,x,c)}return p++,a.decode==="jwt"?n.registerWithSentinel(A,da(_x()),x,c):n.register(A,x,c)},{maskDuplicates:a.maskDuplicates??!1});if(v===null||p===0){let x=a.decode==="jwt"?a.maskClaims?.length?`decode "jwt" with pattern "${y}" that matched no verified JWT with maskable claims (maskClaims: ${JSON.stringify(a.maskClaims)})`:`decode "jwt" with pattern "${y}" that matched no verified JWT`:`extract pattern "${y}" that matched nothing`,b=a.onExtractNoMatch??"warn";if(b==="error")throw Error(`credentials.files entry "${a.path}": ${x} (onExtractNoMatch: "error"). Fix the config, change to "warn"/"deny", or remove the entry.`);if(b==="deny"){C(`[credential-mask] ${a.path} has ${x} \u2014 degrading to `+'mode "deny".',{level:"warn"}),s.push(o);continue}let A=`[sandbox-runtime] WARNING: credentials.files entry "${a.path}" has ${x} in the file. The file is left UNPROTECTED (readable as-is inside the sandbox). Fix the config, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(A),C(A,{level:"warn"});continue}d=v.fakeContent}let f=r.write(u,d);i.push({realPath:o,fakePath:f})}return{binds:i,degradeToDenyPaths:s}}import{randomUUID as Rx}from"crypto";var pa="env:";function Wf(e,t,n,r=process.env){let i={},s=[];for(let a of e){if(a.mode!=="mask")continue;let o=r[a.name];if(o===void 0)continue;let l=a.injectHosts??t;if(a.decode==="jwt"){if(!ua(o)){let u=`[sandbox-runtime] WARNING: credentials.envVars entry "${a.name}" has decode "jwt" but its value did not verify as a JWT. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(u),C(u,{level:"warn"});continue}if(a.maskClaims?.length){let u=fa(o,a.maskClaims,(f,y)=>n.register(`${pa}${a.name}#${f}`,y,l,a.injectHeaders));if(u===null){let f=`[sandbox-runtime] WARNING: credentials.envVars entry "${a.name}" has maskClaims ${JSON.stringify(a.maskClaims)} but none is present as a string claim in its JWT value. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(f),C(f,{level:"warn"});continue}let d=a.maskClaims.filter((f)=>!u.claimSentinels.has(f));if(d.length>0)C(`[credential-mask] env var "${a.name}": maskClaims ${JSON.stringify(d)} absent or non-string in the `+"JWT \u2014 skipped.");i[a.name]=n.registerWithSentinel(`${pa}${a.name}`,u.fakeToken,o,l,a.injectHeaders);continue}i[a.name]=n.registerWithSentinel(`${pa}${a.name}`,da(Rx()),o,l,a.injectHeaders);continue}if(a.extract===void 0){i[a.name]=n.register(a.name,o,l,a.injectHeaders);continue}let c=ca(o,a.extract,(u,d)=>n.register(`${pa}${a.name}#${d}`,u,l,a.injectHeaders));if(c===null){let u=a.onExtractNoMatch??"warn";if(u==="error")throw Error(`credentials.envVars entry "${a.name}": extract pattern "${a.extract}" matched nothing (onExtractNoMatch: "error"). Fix the regex, change to "warn"/"deny", or remove the entry.`);if(u==="deny"){C(`[credential-mask] extract pattern /${a.extract}/ matched nothing in the value of ${a.name} \u2014 unsetting the variable.`,{level:"warn"}),s.push(a.name);continue}let d=`[sandbox-runtime] WARNING: credentials.envVars entry "${a.name}" has extract pattern "${a.extract}" that matched nothing in the variable's value. The variable is left UNPROTECTED (visible as-is inside the sandbox). Fix the regex, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(d),C(d,{level:"warn"});continue}i[a.name]=c.fakeContent}return{setEnvVars:i,degradeToUnsetNames:s}}var $f="AWS_ACCESS_KEY_ID",Hf="AWS_SECRET_ACCESS_KEY",Kf="AWS_SESSION_TOKEN";class Bl{bySentinel=new Map;register(e){this.bySentinel.set(e.accessKeyIdSentinel,e)}lookup(e){return this.bySentinel.get(e)}get size(){return this.bySentinel.size}forget(e){for(let t of e)this.bySentinel.delete(t)}clear(){this.bySentinel.clear()}}function qf(e,t,n,r,i,s=process.env){let a=[...t??[]],o=new Set(a.flatMap((d)=>[d.accessKeyIdVar,d.secretAccessKeyVar,...d.sessionTokenVar?[d.sessionTokenVar]:[]]));if(![$f,Hf,Kf].some((d)=>o.has(d)))a.push({accessKeyIdVar:$f,secretAccessKeyVar:Hf,sessionTokenVar:Kf});let c=(d)=>e.find((f)=>f.name===d&&f.mode==="mask"&&f.extract===void 0&&f.decode===void 0),u=(d)=>c(d)!==void 0?r[d]:void 0;for(let d of a){let f=u(d.accessKeyIdVar),y=u(d.secretAccessKeyVar)!==void 0,p=s[d.accessKeyIdVar],v=s[d.secretAccessKeyVar];if(f===void 0||!y||p===void 0||v===void 0){if(y&&f===void 0){let E=`[sandbox-runtime] WARNING: "${d.secretAccessKeyVar}" is masked but "${d.accessKeyIdVar}" is not, so no AWS credential pair was registered. SigV4 requests will be signed with the masked placeholder secret and the proxy cannot `+"detect or re-sign them \u2014 they will fail upstream. Mask both "+"variables (whole-value) to enable re-signing.";console.warn(E),C(E,{level:"warn"})}continue}let x=c(d.accessKeyIdVar),A=(d.sessionTokenVar!==void 0?u(d.sessionTokenVar):void 0)!==void 0&&d.sessionTokenVar!==void 0?s[d.sessionTokenVar]:void 0;i.register({accessKeyIdSentinel:f,realAccessKeyId:p,realSecretAccessKey:v,...A!==void 0?{realSessionToken:A}:{},injectHosts:x.injectHosts??n}),C(`[credential-aws] registered SigV4 pair for ${d.accessKeyIdVar}/${d.secretAccessKeyVar}`+(A!==void 0?" (+session token)":""))}}function Bx(e){return{streaming:e?.streaming??"deny",presigned:e?.presigned??"deny",sigv4a:e?.sigv4a??"deny"}}function Gf(e,t,n){let r=Bx(t);return(i,s,a,o)=>{if(e.size===0)return;let l=uf(a,s);if(l===null)return;let c=e.lookup(l.accessKeyId);if(c===void 0)return;if(!c.injectHosts.some((p)=>n(o,p)))return;if(l.kind!=="header-sigv4"){if(r[l.kind]==="passthrough"){C(`[credential-aws] ${l.kind} request with masked credential passed through un-resigned per credentials.sigv4.${l.kind} (its signature covers the placeholder secret and will fail upstream)`);return}return{action:"deny",reason:`AWS SigV4 ${l.kind} request uses a masked credential but cannot be re-signed by the sandbox proxy; denied by policy. Set credentials.sigv4.${l.kind} to "passthrough" to forward it unmodified (it will fail upstream: the signature covers the masked placeholder).`}}let u=df(Hn(a.authorization));if(u===null)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but its Authorization header is malformed; the proxy cannot re-sign it."};let d=Hn(a["x-amz-date"]);if(d===void 0)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it."};let f=[...u.signedHeaders];for(let p of f){if(p==="host")continue;if(p==="x-amz-security-token"&&c.realSessionToken!==void 0)continue;if(a[p]===void 0)return{action:"deny",reason:`AWS SigV4 request uses a masked credential but signed header "${p}" is missing; the proxy cannot re-sign it.`}}if(c.realSessionToken!==void 0&&!f.includes("x-amz-security-token"))f.push("x-amz-security-token");let y=Hn(a["x-amz-content-sha256"]);return{action:"resign",payloadHash:y===sa?sa:void 0,apply(p,v,x){if(c.realSessionToken!==void 0)p["x-amz-security-token"]=c.realSessionToken;if(p["x-amz-content-sha256"]!==void 0&&y!==sa)p["x-amz-content-sha256"]=x;let{authorization:b}=ff({method:i,requestTarget:s,headers:p,hostHeader:v,signedHeaders:f,payloadHash:x,amzDate:d,scope:{date:u.date,region:u.region,service:u.service},accessKeyId:c.realAccessKeyId,secretAccessKey:c.realSecretAccessKey});p.authorization=b}}}}import{spawnSync as Px}from"child_process";function br(e){if(typeof globalThis.Bun<"u")return globalThis.Bun.which(e);let t=Px("which",[e],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000});if(t.status===0&&t.stdout)return t.stdout.trim();return null}import*as jr from"fs";import{randomBytes as jS}from"crypto";function kt(e){return e.map((t)=>{if(t==="")return"''";if(/^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/.test(t))return t;return"'"+t.replace(/'/g,`'"'"'`)+"'"}).join(" ")}import{randomBytes as nS}from"crypto";import*as Y from"fs";import{spawn as dp}from"child_process";import{tmpdir as xa}from"os";import Le,{join as fp}from"path";import{spawn as Nx}from"child_process";import{text as jf}from"stream/consumers";var Dx={ms:1e4};class ha extends Error{constructor(e){super(`ripgrep timed out after ${e} ms`);this.name="RipgrepTimeoutError"}}async function Pl(e,t,n,r={command:"rg"}){let{command:i,args:s=[],argv0:a}=r,o=Nx(i,[...s,...e,t],{argv0:a,env:{PATH:process.env.PATH??"/usr/bin:/bin"},signal:n,windowsHide:!0}),l=Dx.ms,c=!1,u=setTimeout(()=>{c=!0,o.kill("SIGKILL")},l),d,f,y;try{[d,f,y]=await Promise.all([jf(o.stdout),jf(o.stderr),new Promise((p,v)=>{o.on("close",p),o.on("error",v)})])}finally{clearTimeout(u)}if(c)throw new ha(l);if(y===0)return d.trim().split(`
62
- `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Lx}from"path";import{fileURLToPath as Ox}from"url";import*as ga from"fs";import{homedir as Ux}from"os";var Nl=new Map,Dl=null;function Vx(){if(Dl)return Dl;let e=[],t=Ux();return e.push(ur("/usr","lib","node_modules","@anthropic-ai","sandbox-runtime"),ur("/usr","local","lib","node_modules","@anthropic-ai","sandbox-runtime"),ur("/opt","homebrew","lib","node_modules","@anthropic-ai","sandbox-runtime"),ur(t,".npm","lib","node_modules","@anthropic-ai","sandbox-runtime"),ur(t,".npm-global","lib","node_modules","@anthropic-ai","sandbox-runtime")),Dl=e,e}function zf(){let e=process.arch;switch(e){case"x64":case"x86_64":return"x64";case"arm64":case"aarch64":return"arm64";case"ia32":case"x86":return C("[SeccompFilter] 32-bit x86 (ia32) is not currently supported due to missing socketcall() syscall blocking. The current seccomp filter only blocks socket(AF_UNIX, ...), but on 32-bit x86, socketcall() can be used to bypass this.",{level:"error"}),null;default:return C(`[SeccompFilter] Unsupported architecture: ${e}. Only x64 and arm64 are supported.`),null}}function Fx(e){let t=zf();if(!t)return[];let n=Lx(Ox(import.meta.url)),r=ur("vendor","seccomp",t,e);return[ur(n,r),ur(n,"..","..",r),ur(n,"..",r)]}function Ll(e){let t=e??"";if(Nl.has(t))return Nl.get(t);let n=Mx(e);return Nl.set(t,n),n}function Mx(e){if(e){if(ga.existsSync(e))return C(`[SeccompFilter] Using apply-seccomp binary from explicit path: ${e}`),e;C(`[SeccompFilter] Explicit path provided but file not found: ${e}`)}let t=zf();if(!t)return C(`[SeccompFilter] Cannot find apply-seccomp binary: unsupported architecture ${process.arch}`),null;C(`[SeccompFilter] Looking for apply-seccomp binary for architecture: ${t}`);for(let n of Fx("apply-seccomp"))if(ga.existsSync(n))return C(`[SeccompFilter] Found apply-seccomp binary: ${n} (${t})`),n;for(let n of Vx()){let r=ur(n,"vendor","seccomp",t,"apply-seccomp");if(ga.existsSync(r))return C(`[SeccompFilter] Found apply-seccomp binary in global install: ${r} (${t})`),r}return C(`[SeccompFilter] apply-seccomp binary not found in any expected location (${t})`),null}import{spawnSync as Wx}from"child_process";import{createHash as $x}from"crypto";import*as X from"fs";import Qt from"path";class Di extends Error{}var Hx={dir:"/run/srt-stubs",uid:0,lockWaitMs:2000,flockPath:"/usr/bin/flock"},qn=Hx,Kx,Yf;var ma=X.constants.O_CLOEXEC??524288,Ol={kind:"masked"},Qf={kind:"real"},Ni={kind:"unregistered"},qx=new Set(["ENOENT","EACCES"]),Gx=new Set(["ENOENT","ENOTDIR","EROFS"]),dr=null,hn=null,jx=0;function Li(e){return e?.code}function Vl(e){return $x("sha256").update(e).digest("hex")}function Fl(){if(process.platform!=="linux")return"off";let{dir:e,uid:t,flockPath:n}=qn;if(process.geteuid?.()!==t)return"off";try{X.accessSync(n,X.constants.X_OK)}catch(i){return qx.has(Li(i)??"")?"off":"error"}try{X.mkdirSync(e,{mode:448}),X.chmodSync(e,448)}catch(i){let s=Li(i)??"";if(s!=="EEXIST")return Gx.has(s)?"off":"error"}let r;try{r=X.lstatSync(e)}catch{return"error"}if(!r.isDirectory()||r.uid!==t||(r.mode&511)!==448)return C(`[Sandbox Linux] ${e} is not a 0700 directory owned by uid ${t}; mask stubs are not shared`,{level:"warn"}),"off";return e}function Jf(e,t){try{return X.openSync(Qt.join(e,t),X.constants.O_RDONLY|X.constants.O_CREAT|X.constants.O_NOFOLLOW|ma,384)}catch{return null}}function Zf(e,t){try{return Wx(qn.flockPath,[...t,"3"],{stdio:["ignore","ignore","ignore",e],timeout:qn.lockWaitMs+5000}).status===0}catch{return!1}}function Xf(e,t,n){let r=Jf(e,t);if(r===null)return null;let i=(qn.lockWaitMs/1000).toFixed(3);if(Zf(r,[n,"-w",i]))return r;return X.closeSync(r),null}function ep(e){try{X.closeSync(e)}catch{}}function tp(){let e=Fl();if(e==="off")return!1;if(e==="error")throw new Di(`srt: cannot read the mask stub registry ${qn.dir}; refusing to start the sandbox`);if(dr===null)dr=Xf(e,"lock","-s");if(dr!==null&&hn===null)hn=Xf(e,"claims","-x");if(dr===null||hn===null)throw new Di(`srt: mask stub registry ${e} is busy (no ${dr===null?"shared":"claims"} lock within ${qn.lockWaitMs} ms); refusing to start the sandbox rather than risk a mask another call removes`);return!0}function ya(){if(hn===null)return;ep(hn),hn=null}function zx(){if(dr===null)return;ep(dr),dr=null}function rp(){let e=Fl();if(e==="off")return null;if(e==="error"||dr===null||hn===null)throw new Di("srt: mask stub claimed without holding the registry; refusing to start the sandbox");return e}function Oi(e){try{return X.lstatSync(e,{bigint:!0})}catch(t){return Li(t)==="ENOENT"?"absent":"unknown"}}function np(e){try{let t=JSON.parse(X.readFileSync(e,"utf8")),{v:n,type:r,uid:i,dev:s,ino:a,ctimeNs:o,path:l}=t,c=(u)=>typeof u==="string"&&/^\d+$/.test(u);if(n!==1||r!=="f"&&r!=="d"||typeof i!=="number"||!c(s)||!c(a)||!c(o)||typeof l!=="string"||!l.startsWith("/"))return null;return{type:r,uid:i,dev:BigInt(s),ino:BigInt(a),ctimeNs:BigInt(o),dest:l}}catch{return null}}function ip(e,t){return Qt.join(e,`${Vl(t)}.stub`)}function Qx(e,t){let n=Vl(t.dest),r=Qt.join(e,`${n}.stub.${process.pid}-${++jx}`),i=JSON.stringify({v:1,type:t.type,uid:t.uid,dev:String(t.dev),ino:String(t.ino),ctimeNs:String(t.ctimeNs),path:t.dest});X.writeFileSync(r,i+`
63
- `,{flag:"wx",mode:384}),X.renameSync(r,Qt.join(e,`${n}.stub`))}function sp(e,t){return(t.type==="f"?e.isFile()&&e.size===BigInt(0):e.isDirectory())&&e.uid===BigInt(t.uid)&&e.dev===t.dev&&e.ino===t.ino&&e.ctimeNs===t.ctimeNs}function Ml(e){let t=Qt.dirname(e),n;try{n=X.openSync(t,X.constants.O_RDONLY|X.constants.O_DIRECTORY|X.constants.O_NOFOLLOW|ma)}catch{return null}try{if(X.readlinkSync(`/proc/self/fd/${n}`)===t)return n}catch{}return X.closeSync(n),null}function ap(e,t,n){return{type:e,uid:Number(t.uid),dev:t.dev,ino:t.ino,ctimeNs:t.ctimeNs,dest:n}}function Xx(e){let t=Ml(e);if(t===null)return null;try{let n;try{n=X.openSync(`/proc/self/fd/${t}/${Qt.basename(e)}`,X.constants.O_RDONLY|X.constants.O_CREAT|X.constants.O_EXCL|X.constants.O_NOFOLLOW|ma,292)}catch(r){return Li(r)==="EEXIST"?"exists":null}try{return Yf?.(e),ap("f",X.fstatSync(n,{bigint:!0}),e)}finally{X.closeSync(n)}}finally{X.closeSync(t)}}function Yx(e,t){let n=Ml(e);if(n===null)return null;try{let r=`/proc/self/fd/${n}/${Qt.basename(e)}`;try{X.mkdirSync(r,{mode:493})}catch(s){return Li(s)==="EEXIST"?"exists":null}Yf?.(e);let i;try{i=X.openSync(r,X.constants.O_RDONLY|X.constants.O_DIRECTORY|X.constants.O_NOFOLLOW|ma)}catch{return null}try{let s=X.fstatSync(i,{bigint:!0});if(!s.isDirectory()||s.uid!==BigInt(process.geteuid?.()??-1)||s.nlink>BigInt(2)||X.readdirSync(`/proc/self/fd/${i}`).length!==0)return null;if(t)X.fchownSync(i,t.uid,t.gid);return ap("d",X.fstatSync(i,{bigint:!0}),e)}catch{return null}finally{X.closeSync(i)}}finally{X.closeSync(n)}}function Jx(e){let t=Ml(e.dest);if(t===null)return;try{let n=`/proc/self/fd/${t}/${Qt.basename(e.dest)}`,r=Oi(n);if(typeof r==="object"&&sp(r,e)){if(e.type==="d")X.rmdirSync(n);else X.unlinkSync(n);C(`[Sandbox Linux] Removed shared mask stub: ${e.dest}`)}}catch{}finally{X.closeSync(t)}}function Zx(e){try{X.unlinkSync(e)}catch{}}function Ul(e,t,n,r){let i=np(ip(e,t));return i!==null&&i.type===r&&i.dest===t&&sp(n,i)}function op(e,t,n){let r=rp();if(r===null)return Ni;if(Kx?.(e)==="unregistered")return Ni;let i=Oi(e);if(i==="unknown")return Ni;if(i!=="absent")return Ul(r,e,i,t)?Ol:Qf;let s=n();if(s==="exists"){let a=Oi(e);return typeof a==="object"&&Ul(r,e,a,t)?Ol:Qf}if(s===null)return Ni;try{Qx(r,s)}catch(a){C(`[Sandbox Linux] mask stub marker not written for ${e}: ${a}`,{level:"warn"})}return Ol}function eS(e){return op(e,"f",()=>Xx(e))}function tS(e,t){return op(e,"d",()=>Yx(e,t))}function lp(e,t){let n=rp();if(n===null)return null;let r=(s)=>t.some((a)=>s.startsWith(a+"/")),i=[];for(let s=Qt.dirname(e);r(s);s=Qt.dirname(s))i.unshift(s);for(let s of i){let a=Oi(s);if(typeof a==="object"&&Ul(n,s,a,"d"))return s}return null}function cp(e,t){try{return e()}catch(n){if(n instanceof Di)throw n;return C(`[Sandbox Linux] mask stub not recorded for ${t}: ${n}`,{level:"warn"}),Ni}}function Wl(e){return cp(()=>eS(e),e)}function up(e,t){return cp(()=>tS(e,t),e)}function rS(e){let t;try{t=X.readdirSync(e)}catch{return}let n=[],r=[];for(let s of t){let a=/^([0-9a-f]{64})\.stub(\..*)?$/.exec(s);if(a===null)continue;let o=Qt.join(e,s);if(r.push(o),a[2]===void 0){let l=np(o);if(l!==null&&Vl(l.dest)===a[1])n.push(l)}}let i=(s)=>s.dest.split("/").length;n.sort((s,a)=>s.type===a.type?i(a)-i(s):s.type==="f"?-1:1);for(let s of n)Jx(s);for(let s of r)Zx(s)}function $l(e,t){let n=Fl(),r=dr!==null;if(ya(),zx(),n==="off"){for(let s of e)t(s);return[]}if(n==="error")return[...e];if(!r&&e.length===0)return[];let i=Jf(n,"lock");if(i===null)return[...e];try{if(!Zf(i,["-x","-n"]))return[...e];for(let s of e)if(Oi(ip(n,s))==="absent")t(s);return rS(n),[]}catch(s){return C(`[Sandbox Linux] mask stub sweep failed: ${s}`,{level:"warn"}),[...e]}finally{X.closeSync(i)}}var Gl=3;function iS(e){let t=e.uid===void 0?e.bwrapCommand:[e.setprivPath??"/usr/bin/setpriv",`--reuid=${e.uid}`,`--regid=${e.gid??e.uid}`,"--clear-groups","--inh-caps=-all","--ambient-caps=-all","--bounding-set=-all",...e.bwrapCommand],n=e.unsetEnvVars??[],r=Object.entries(e.setEnvVars??{});if(n.length===0&&r.length===0)return t;return["/usr/bin/env",...n.flatMap((i)=>["-u",i]),...r.map(([i,s])=>`${i}=${s}`),...t]}function Hl(e,t){let n=e.split(Le.sep),r="";for(let i of n){if(!i)continue;let s=r+Le.sep+i;try{if(Y.lstatSync(s).isSymbolicLink()){if(t.some((l)=>s.startsWith(l+"/")||s===l))return s}}catch{break}r=s}return null}var sS=40;function pp(e){let t=e;for(let n=0;n<sS;n++){try{return Y.realpathSync(t)}catch{}let r=t,i=[],s=null;while(s===null){let l=Le.dirname(r);if(l===r)return null;i.unshift(Le.basename(r)),r=l;try{s=Y.realpathSync(r)}catch{}}let a=Le.join(s,i[0]),o=null;try{o=Y.readlinkSync(a)}catch{}if(o===null)return Le.join(s,...i);t=Le.join(Le.resolve(Le.dirname(a),o),...i.slice(1))}return null}function aS(e){let t=e.split(Le.sep),n="";for(let r of t){if(!r)continue;let i=n+Le.sep+r;try{let s=Y.statSync(i);if(s.isFile()||s.isSymbolicLink())return!0}catch{break}n=i}return!1}function oS(e){let t=e.split(Le.sep),n="";for(let r of t){if(!r)continue;let i=n+Le.sep+r;if(!Y.existsSync(i))return i;n=i}return e}async function lS(e={command:"rg"},t=Gl,n=!1,r){let i=process.cwd(),s=new AbortController,a=r??s.signal,o=gs(),l=[...oi.map((p)=>Le.resolve(i,p)),...o.map((p)=>Le.resolve(i,p))],c=Le.resolve(i,".git"),u=!1;try{u=Y.statSync(c).isDirectory()}catch{}if(u){if(l.push(Le.resolve(i,".git/hooks")),!n)l.push(Le.resolve(i,".git/config"))}let d=[];for(let p of oi)d.push("--iglob",p);for(let p of o)d.push("--iglob",`**/${p}/**`);if(d.push("--iglob","**/.git/hooks/**"),!n)d.push("--iglob","**/.git/config");let f=["--files","--hidden","--no-ignore","--max-depth",String(t),...d,"-g","!**/node_modules/**"],y;try{y=await Pl(f,i,a,e)}catch(p){if(p instanceof ha)throw Error(`mandatory deny scan failed: ${p}`);C(`[Sandbox] ripgrep scan failed, retrying once: ${p}`);try{y=await Pl(f,i,a,e)}catch(v){throw Error(`mandatory deny scan failed: ${v}`)}}for(let p of y){let v=Le.resolve(i,p),x=!1;for(let b of[...o,".git"]){let A=za(b),E=v.split(Le.sep),k=E.findIndex((I)=>za(I)===A);if(k!==-1){if(b===".git"){let I=E.slice(0,k+1).join(Le.sep);if(p.includes(".git/hooks"))l.push(Le.join(I,"hooks"));else if(p.includes(".git/config"))l.push(Le.join(I,"config"))}else l.push(E.slice(0,k+1).join(Le.sep));x=!0;break}}if(!x)l.push(v)}return[...new Set(l)]}var Ui;function cS(){if(process.getuid?.()!==0||process.env.ARA_SRT_FILE_MASK!=="empty")return"/dev/null";if(Ui)try{let n=Y.lstatSync(Ui);if(n.isFile()&&n.size===0&&n.uid===0&&(n.mode&146)===0)return Ui}catch{}let e=Y.mkdtempSync(Le.join(xa(),"claude-empty-file-"));Sa.add(e),Y.chmodSync(e,493);let t=Le.join(e,"empty");return Y.writeFileSync(t,"",{flag:"wx",mode:292}),Y.chmodSync(t,292),Ui=t,t}var Vi=new Set,Sa=new Set;function hp(e,t){return e===t?cS():"/dev/null"}var uS="ARA_SRT_MASKED_PATHS",dS=16384;function fS(e,t,n=dS){let r=[],i=0;for(let s of new Set(e)){if(s.includes(`
61
+ `)}),l.on("error",()=>c.destroy()),l.once("close",()=>c.destroy()),c.once("close",()=>l.destroy()),l.pipe(c),c.pipe(l)}let o=fx((l)=>{s.add(l),l.once("close",()=>s.delete(l)),l.on("error",(u)=>C(`mux: client socket error: ${u.message}`));let c=setTimeout(()=>{C("mux: first-byte timeout; destroying connection"),l.destroy()},t);if(typeof c.unref==="function")c.unref();l.once("readable",()=>{clearTimeout(c);let u=l.read(1);if(!u||u.length===0){l.destroy();return}if(l.unshift(u),gx.has(u[0]))e.handleSocksConnection(l);else a(l)})});return{server:o,getPort(){let l=o.address();return l&&typeof l==="object"?l.port:void 0},async listenHttpBackend(){if(!n){let c=vx();await Df(c).catch(()=>{}),await new Promise((u,d)=>{e.httpServer.once("error",d),e.httpServer.listen(c,()=>{e.httpServer.removeListener("error",d),u()})}),r=c,C(`mux: HTTP backend listening on ${c}`);return}await ca(e.httpServer,(c)=>e.httpServer.listen(c,"127.0.0.1"),e.httpBackendPortRange,new Set);let l=e.httpServer.address();return i=l&&typeof l==="object"?l.port:void 0,C(`mux: HTTP backend listening on 127.0.0.1:${i}`),i},async close(){for(let l of s)l.destroy();if(s.clear(),await new Promise((l)=>o.close(()=>l())),await new Promise((l)=>e.httpServer.close(()=>l())),r)await Df(r).catch(()=>{}),r=void 0;i=void 0},unref(){o.unref(),e.httpServer.unref()}}}import{randomBytes as xx,randomUUID as Sx}from"crypto";var Kn="fake_value_",Of="abcdefghijklmnopqrstuvwxyz0123456789_-";function bx(e){let t=Kn+Sx(),n=Buffer.byteLength(e)-t.length;if(n<=0)return t;let r=t;for(let i of xx(n))r+=Of[i%Of.length];return r}class _l{byName=new Map;bySentinel=new Map;allSentinelsPrefixed=!0;refs=new Map;lease=null;register(e,t,n,r){return this.registerWithSentinel(e,bx(t),t,n,r)}registerWithSentinel(e,t,n,r,i){let s=this.byName.get(e);if(s!==void 0&&s.realValue===n)return s.injectHosts=r,s.injectHeaders=i,this.lease?.add(s),s.sentinel;if(this.bySentinel.has(t))throw Error("credential sentinel collision");if(!t.startsWith(Kn))this.allSentinelsPrefixed=!1;let a={name:e,sentinel:t,realValue:n,injectHosts:r,injectHeaders:i};return this.byName.set(e,a),this.bySentinel.set(t,a),this.lease?.add(a),t}beginLease(){this.lease=new Set}endLease(){let e=[...this.lease??[]];this.lease=null;for(let t of e)this.refs.set(t,(this.refs.get(t)??0)+1);return{entries:e}}release(e){let t=[];for(let n of e.entries){let r=(this.refs.get(n)??1)-1;if(r>0){this.refs.set(n,r);continue}if(this.refs.delete(n),this.bySentinel.get(n.sentinel)===n)this.bySentinel.delete(n.sentinel);if(this.byName.get(n.name)===n)this.byName.delete(n.name);t.push(n.sentinel)}if(e.entries.length=0,t.length>0&&!this.allSentinelsPrefixed)this.allSentinelsPrefixed=[...this.bySentinel.keys()].every((n)=>n.startsWith(Kn));return t}lookupReal(e){return this.bySentinel.get(e)?.realValue}namesInjectableAt(e,t){let n=[];for(let r of this.byName.values())if(r.injectHosts.some((i)=>t(e,i)))n.push(r.name);return n}sentinelsForHost(e,t){let n=[];for(let r of this.bySentinel.values()){if(!r.injectHosts.some((i)=>t(e,i)))continue;if(r.injectHeaders!==void 0)continue;n.push({sentinel:Buffer.from(r.sentinel),realValue:Buffer.from(r.realValue)})}return n}*entries(){for(let e of this.bySentinel.values())yield[e.sentinel,e.realValue]}get size(){return this.bySentinel.size}clear(){this.byName.clear(),this.bySentinel.clear(),this.refs.clear(),this.lease=null,this.allSentinelsPrefixed=!0}substituteInHeaders(e,t,n){if(this.bySentinel.size===0)return;for(let[r,i]of Object.entries(e)){if(i===void 0)continue;if(Array.isArray(i))for(let s=0;s<i.length;s++)i[s]=this.substituteInHeaderValue(r,i[s],t,n);else e[r]=this.substituteInHeaderValue(r,i,t,n)}}substituteInHeaderValue(e,t,n,r){let i=e.toLowerCase(),s=this.substituteInString(t,n,r,i);if(i!=="authorization")return s;let a=/^(\s*basic\s+)([a-z0-9+/]+={0,2})(\s*)$/i.exec(s);if(a===null)return s;let o=a[2],l=Buffer.from(o,"base64");if(o.length%4!==0||l.toString("base64")!==o)return s;let c=l.toString("utf8");if(!Buffer.from(c,"utf8").equals(l))return s;let u=this.substituteInString(c,n,r,i);if(u===c)return s;return`${a[1]}${Buffer.from(u,"utf8").toString("base64")}${a[3]}`}substituteInString(e,t,n,r){if(this.allSentinelsPrefixed&&!e.includes(Kn))return e;let i=e;for(let s of this.bySentinel.values()){if(!i.includes(s.sentinel))continue;if(!s.injectHosts.some((a)=>n(t,a)))continue;if(s.injectHeaders!==void 0&&!s.injectHeaders.includes(r))continue;i=i.split(s.sentinel).join(s.realValue)}return i}}import{randomUUID as Ix}from"crypto";import*as zt from"fs";import{tmpdir as Rx}from"os";import{join as Mf}from"path";function Cx(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let i=e[r];if(n){n=!1;continue}if(i==="\\")n=!0;else if(i==="]")return r+1}return e.length}function Ex(e){switch(e){case"s":return{kind:"whitespace"};case"S":return{kind:"non-whitespace"};case"d":return{kind:"digit"};case"D":return{kind:"non-digit"};case"w":return{kind:"word"};case"W":return{kind:"non-word"};default:return{kind:"unknown"}}}function Uf(e,t){if(e===null||t===null)return!0;if(e.kind==="literal"&&t.kind==="literal")return e.value===t.value;if(e.kind==="whitespace"&&t.kind==="non-whitespace"||e.kind==="non-whitespace"&&t.kind==="whitespace"||e.kind==="digit"&&t.kind==="non-digit"||e.kind==="non-digit"&&t.kind==="digit"||e.kind==="word"&&t.kind==="non-word"||e.kind==="non-word"&&t.kind==="word")return!1;return!0}function wx(e,t){if(e[t+1]!=="?")return{next:t+1,capturing:!0};if(e[t+2]==="<"){let r=e[t+3];if(r==="="||r==="!")return{next:t+4,capturing:!1};let i=e.indexOf(">",t+3);return{next:i===-1?t+3:i+1,capturing:!0}}return{next:t+3,capturing:!1}}function Tx(e,t){let n=e[t];if(n==="*"||n==="+")return{next:e[t+1]==="?"?t+2:t+1,unbounded:!0};if(n==="?")return{next:e[t+1]==="?"?t+2:t+1,unbounded:!1};if(n!=="{")return null;let r=t+1,i=r;while(/[0-9]/.test(e[r]??""))r++;if(r===i)return null;let s=Number(e.slice(i,r)),a=s,o=!1;if(e[r]===","){r++;let l=r;while(/[0-9]/.test(e[r]??""))r++;if(r===l)o=!0,a=void 0;else a=Number(e.slice(l,r))}if(e[r]!=="}")return null;if(!Number.isFinite(s)||s>4096||a!==void 0&&(!Number.isFinite(a)||a>4096))return{next:r+1,unbounded:o,error:"finite repetitions must be at most 4096"};if(r++,e[r]==="?")r++;return{next:r,unbounded:o}}function Ax(e){let t=[{previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}],n=0,r=()=>t[t.length-1],i=(s)=>{let a=r();if(a.lastAtom?.hasUnboundedQuantifier&&s.hasUnboundedQuantifier&&a.lastAtom.repeatClass!==null&&s.repeatClass!==null&&Uf(a.lastAtom.repeatClass,s.repeatClass))a.error="adjacent unbounded repetition with overlapping input is not supported";if(a.previousAtom=a.lastAtom,a.lastAtom=s,a.atomCount===0)a.simpleClass=s.repeatClass;else a.simpleClass=null;if(a.atomCount++,s.kind==="group")a.containsQuantifier||=s.containsQuantifier,a.containsAlternation||=s.containsAlternation;a.hasUnboundedQuantifier||=s.hasUnboundedQuantifier};for(let s=0;s<e.length;){if(r().error!==void 0)return{groupCount:n,error:r().error};let a=e[s];if(a==="\\"){let l=e[s+1];if(l!==void 0&&/[1-9]/.test(l)||l==="k"&&e[s+2]==="<")return{groupCount:n,error:"backreferences are not supported by the safe extractor"};let c=l==="b"||l==="B";if(i({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:Ex(l)}),s+=l===void 0?1:2,c)r().previousAtom=null,r().lastAtom=null;continue}if(a==="["){i({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:{kind:"unknown"}}),s=Cx(e,s);continue}if(a==="("){let l=wx(e,s);if(l.capturing)n++;t.push({previousAtom:null,lastAtom:null,atomCount:0,simpleClass:null,containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1}),s=l.next;continue}if(a===")"){if(t.length>1){let l=t.pop();if(l.error!==void 0)return{groupCount:n,error:l.error};i({kind:"group",containsQuantifier:l.containsQuantifier,containsAlternation:l.containsAlternation,hasUnboundedQuantifier:l.hasUnboundedQuantifier,repeatClass:l.atomCount===1&&!l.containsAlternation?l.simpleClass:null})}s++;continue}if(a==="|"){r().containsAlternation=!0,r().previousAtom=null,r().lastAtom=null,s++;continue}let o=Tx(e,s);if(o!==null){if(o.error)return{groupCount:n,error:o.error};let l=r(),c=l.lastAtom;if(o.unbounded&&c?.kind==="group"&&(c.containsQuantifier||c.containsAlternation))return{groupCount:n,error:"nested unbounded repetition or unbounded alternation is not supported"};if(o.unbounded&&l.previousAtom?.hasUnboundedQuantifier&&c!==null&&l.previousAtom.repeatClass!==null&&c.repeatClass!==null&&Uf(l.previousAtom.repeatClass,c.repeatClass))return{groupCount:n,error:"adjacent unbounded repetition with overlapping input is not supported"};if(l.containsQuantifier=!0,c!==null)l.lastAtom={...c,containsQuantifier:!0,hasUnboundedQuantifier:c.hasUnboundedQuantifier||o.unbounded};l.hasUnboundedQuantifier||=o.unbounded,s=o.next;continue}if(a!=="^"&&a!=="$")i({kind:"token",containsQuantifier:!1,containsAlternation:!1,hasUnboundedQuantifier:!1,repeatClass:a==="."?{kind:"any"}:{kind:"literal",value:a}});else r().previousAtom=null,r().lastAtom=null;s++}return{groupCount:n,error:r().error}}function kl(e){if(e.length>2048)throw Error("Credential extract pattern exceeds the 2048-character limit");let t;try{t=new RegExp(e)}catch{throw Error("Credential extract pattern is not a valid regular expression")}let n=Ax(e);if(n.error!==void 0)throw Error(`Credential extract pattern rejected: ${n.error}`);return{regex:t,groupCount:n.groupCount}}function _x(e,t=""){kl(e);try{return new RegExp(e,t)}catch{throw Error("Credential extract pattern is not supported by this runtime")}}function ua(e,t,n,r={}){if(e.length>1048576)throw Error("Credential extraction input exceeds the 1048576-character limit");let i=_x(t,"gd"),s=new Map,a=new Map,o=[],l=0;for(let d of e.matchAll(i)){if(l++,l>4096)throw Error("Credential extraction exceeds the 4096-match limit");let f=d[1];if(f===void 0)throw Error(`Credential extraction matched at offset ${d.index} without a group-1 capture; group 1 must capture the credential value on every match.`);if(f.length===0)continue;let y=s.get(f);if(y===void 0)s.set(f,y=s.size);let[p,v]=d.indices[1],x=n(f,y);if(!a.has(f))a.set(f,x);o.push({start:p,end:v,sentinel:x})}if(s.size===0)return null;if(r.maskDuplicates){let d=[...s.keys()].sort((f,y)=>y.length-f.length);for(let f of d){let y=a.get(f);if(y===f)continue;for(let p=e.indexOf(f);p!==-1;p=e.indexOf(f,p+1)){let v=p+f.length;if(o.some((x)=>p<x.end&&x.start<v))continue;o.push({start:p,end:v,sentinel:y})}}o.sort((f,y)=>f.start-y.start)}let c="",u=0;for(let d of o)c+=e.slice(u,d.start)+d.sentinel,u=d.end;return{fakeContent:c+e.slice(u),captures:[...s.keys()]}}var Vf="(eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)";function Il(e){try{return JSON.parse(Buffer.from(e,"base64url").toString("utf8"))}catch{return}}function da(e){let t=e.split(".");if(t.length!==3)return!1;let n=Il(t[0]);if(typeof n!=="object"||n===null||!("alg"in n))return!1;return Il(t[1])!==void 0}var kx=9999999999,Ff="c3J0LWZha2U";function Rl(e){return Buffer.from(e,"utf8").toString("base64url")}function fa(e){let t=Rl(JSON.stringify({alg:"HS256",typ:"JWT"})),n=Rl(JSON.stringify({sub:Kn+e,exp:kx}));return`${t}.${n}.${Ff}`}function pa(e,t,n){let[r,i]=e.split("."),s=Il(i??"");if(typeof s!=="object"||s===null||Array.isArray(s))return null;let a=s,o=[];for(let c of t){let u=a[c];if(typeof u==="string")o.push([c,u])}if(o.length===0)return null;let l=new Map;for(let[c,u]of o){let d=n(c,u);a[c]=d,l.set(c,d)}return{fakeToken:`${r}.${Rl(JSON.stringify(a))}.${Ff}`,claimSentinels:l}}var Bx="file:";class Bl{dir;byKey=new Map;write(e,t){if(this.dir===void 0)this.dir=zt.mkdtempSync(Mf(Rx(),"srt-credmask-"));let n=this.byKey.get(e);if(n===void 0)n=Mf(this.dir,`${this.byKey.size}.fake`),this.byKey.set(e,n);return zt.rmSync(n,{force:!0}),zt.writeFileSync(n,t,{mode:384}),n}dispose(){if(this.dir!==void 0)try{zt.rmSync(this.dir,{recursive:!0,force:!0})}catch(e){C(`MaskedFileStore cleanup failed: ${e}`,{level:"error"})}this.dir=void 0,this.byKey.clear()}get dirPath(){return this.dir}}function Wf(e,t,n,r){let i=[],s=[];for(let a of e){if(a.mode!=="mask")continue;let o=it(a.path),l;try{if(zt.statSync(o).isDirectory()){C(`[credential-mask] Skipping masked file entry that resolves to a directory: ${a.path} \u2014 use mode "deny" for directories.`,{level:"warn"});continue}let p=zt.readFileSync(o);if(l=p.toString("utf8"),Buffer.byteLength(l,"utf8")!==p.length){C(`[credential-mask] Skipping masked file with non-UTF-8 content (binary credential files are not supported in mask mode): ${a.path}`,{level:"warn"});continue}}catch(y){C(`[credential-mask] Skipping masked file (unreadable on host): ${a.path} \u2014 ${y.message}`);continue}let c=a.injectHosts??t,u=Bx+o,d;if(a.extract===void 0&&a.decode===void 0)d=n.register(u,l,c);else{let y=a.extract??Vf,p=0,v=ua(l,y,(x,b)=>{if(a.decode==="jwt"&&!da(x))return x;let A=`${u}#${b}`;if(a.decode==="jwt"&&a.maskClaims?.length){let E=pa(x,a.maskClaims,(I,R)=>n.register(`${u}#jwt${b}.${I}`,R,c));if(E===null)return C(`[credential-mask] ${a.path}: verified JWT candidate has none of maskClaims ${JSON.stringify(a.maskClaims)} as `+"string claims \u2014 left unmasked."),x;let k=a.maskClaims.filter((I)=>!E.claimSentinels.has(I));if(k.length>0)C(`[credential-mask] ${a.path}: maskClaims ${JSON.stringify(k)} absent or non-string in a `+"verified JWT \u2014 skipped.");return p++,n.registerWithSentinel(A,E.fakeToken,x,c)}return p++,a.decode==="jwt"?n.registerWithSentinel(A,fa(Ix()),x,c):n.register(A,x,c)},{maskDuplicates:a.maskDuplicates??!1});if(v===null||p===0){let x=a.decode==="jwt"?a.maskClaims?.length?`decode "jwt" with pattern "${y}" that matched no verified JWT with maskable claims (maskClaims: ${JSON.stringify(a.maskClaims)})`:`decode "jwt" with pattern "${y}" that matched no verified JWT`:`extract pattern "${y}" that matched nothing`,b=a.onExtractNoMatch??"warn";if(b==="error")throw Error(`credentials.files entry "${a.path}": ${x} (onExtractNoMatch: "error"). Fix the config, change to "warn"/"deny", or remove the entry.`);if(b==="deny"){C(`[credential-mask] ${a.path} has ${x} \u2014 degrading to `+'mode "deny".',{level:"warn"}),s.push(o);continue}let A=`[sandbox-runtime] WARNING: credentials.files entry "${a.path}" has ${x} in the file. The file is left UNPROTECTED (readable as-is inside the sandbox). Fix the config, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(A),C(A,{level:"warn"});continue}d=v.fakeContent}let f=r.write(u,d);i.push({realPath:o,fakePath:f})}return{binds:i,degradeToDenyPaths:s}}import{randomUUID as Px}from"crypto";var ha="env:";function $f(e,t,n,r=process.env){let i={},s=[];for(let a of e){if(a.mode!=="mask")continue;let o=r[a.name];if(o===void 0)continue;let l=a.injectHosts??t;if(a.decode==="jwt"){if(!da(o)){let u=`[sandbox-runtime] WARNING: credentials.envVars entry "${a.name}" has decode "jwt" but its value did not verify as a JWT. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(u),C(u,{level:"warn"});continue}if(a.maskClaims?.length){let u=pa(o,a.maskClaims,(f,y)=>n.register(`${ha}${a.name}#${f}`,y,l,a.injectHeaders));if(u===null){let f=`[sandbox-runtime] WARNING: credentials.envVars entry "${a.name}" has maskClaims ${JSON.stringify(a.maskClaims)} but none is present as a string claim in its JWT value. The variable is left UNPROTECTED (real value visible as-is inside the sandbox). Fix the config or remove the entry.`;console.warn(f),C(f,{level:"warn"});continue}let d=a.maskClaims.filter((f)=>!u.claimSentinels.has(f));if(d.length>0)C(`[credential-mask] env var "${a.name}": maskClaims ${JSON.stringify(d)} absent or non-string in the `+"JWT \u2014 skipped.");i[a.name]=n.registerWithSentinel(`${ha}${a.name}`,u.fakeToken,o,l,a.injectHeaders);continue}i[a.name]=n.registerWithSentinel(`${ha}${a.name}`,fa(Px()),o,l,a.injectHeaders);continue}if(a.extract===void 0){i[a.name]=n.register(a.name,o,l,a.injectHeaders);continue}let c=ua(o,a.extract,(u,d)=>n.register(`${ha}${a.name}#${d}`,u,l,a.injectHeaders));if(c===null){let u=a.onExtractNoMatch??"warn";if(u==="error")throw Error(`credentials.envVars entry "${a.name}": extract pattern "${a.extract}" matched nothing (onExtractNoMatch: "error"). Fix the regex, change to "warn"/"deny", or remove the entry.`);if(u==="deny"){C(`[credential-mask] extract pattern /${a.extract}/ matched nothing in the value of ${a.name} \u2014 unsetting the variable.`,{level:"warn"}),s.push(a.name);continue}let d=`[sandbox-runtime] WARNING: credentials.envVars entry "${a.name}" has extract pattern "${a.extract}" that matched nothing in the variable's value. The variable is left UNPROTECTED (visible as-is inside the sandbox). Fix the regex, set onExtractNoMatch to "deny" or "error", or remove the entry.`;console.warn(d),C(d,{level:"warn"});continue}i[a.name]=c.fakeContent}return{setEnvVars:i,degradeToUnsetNames:s}}var Hf="AWS_ACCESS_KEY_ID",Kf="AWS_SECRET_ACCESS_KEY",qf="AWS_SESSION_TOKEN";class Pl{bySentinel=new Map;register(e){this.bySentinel.set(e.accessKeyIdSentinel,e)}lookup(e){return this.bySentinel.get(e)}get size(){return this.bySentinel.size}forget(e){for(let t of e)this.bySentinel.delete(t)}clear(){this.bySentinel.clear()}}function Gf(e,t,n,r,i,s=process.env){let a=[...t??[]],o=new Set(a.flatMap((d)=>[d.accessKeyIdVar,d.secretAccessKeyVar,...d.sessionTokenVar?[d.sessionTokenVar]:[]]));if(![Hf,Kf,qf].some((d)=>o.has(d)))a.push({accessKeyIdVar:Hf,secretAccessKeyVar:Kf,sessionTokenVar:qf});let c=(d)=>e.find((f)=>f.name===d&&f.mode==="mask"&&f.extract===void 0&&f.decode===void 0),u=(d)=>c(d)!==void 0?r[d]:void 0;for(let d of a){let f=u(d.accessKeyIdVar),y=u(d.secretAccessKeyVar)!==void 0,p=s[d.accessKeyIdVar],v=s[d.secretAccessKeyVar];if(f===void 0||!y||p===void 0||v===void 0){if(y&&f===void 0){let E=`[sandbox-runtime] WARNING: "${d.secretAccessKeyVar}" is masked but "${d.accessKeyIdVar}" is not, so no AWS credential pair was registered. SigV4 requests will be signed with the masked placeholder secret and the proxy cannot `+"detect or re-sign them \u2014 they will fail upstream. Mask both "+"variables (whole-value) to enable re-signing.";console.warn(E),C(E,{level:"warn"})}continue}let x=c(d.accessKeyIdVar),A=(d.sessionTokenVar!==void 0?u(d.sessionTokenVar):void 0)!==void 0&&d.sessionTokenVar!==void 0?s[d.sessionTokenVar]:void 0;i.register({accessKeyIdSentinel:f,realAccessKeyId:p,realSecretAccessKey:v,...A!==void 0?{realSessionToken:A}:{},injectHosts:x.injectHosts??n}),C(`[credential-aws] registered SigV4 pair for ${d.accessKeyIdVar}/${d.secretAccessKeyVar}`+(A!==void 0?" (+session token)":""))}}function Nx(e){return{streaming:e?.streaming??"deny",presigned:e?.presigned??"deny",sigv4a:e?.sigv4a??"deny"}}function jf(e,t,n){let r=Nx(t);return(i,s,a,o)=>{if(e.size===0)return;let l=df(a,s);if(l===null)return;let c=e.lookup(l.accessKeyId);if(c===void 0)return;if(!c.injectHosts.some((p)=>n(o,p)))return;if(l.kind!=="header-sigv4"){if(r[l.kind]==="passthrough"){C(`[credential-aws] ${l.kind} request with masked credential passed through un-resigned per credentials.sigv4.${l.kind} (its signature covers the placeholder secret and will fail upstream)`);return}return{action:"deny",reason:`AWS SigV4 ${l.kind} request uses a masked credential but cannot be re-signed by the sandbox proxy; denied by policy. Set credentials.sigv4.${l.kind} to "passthrough" to forward it unmodified (it will fail upstream: the signature covers the masked placeholder).`}}let u=ff(Hn(a.authorization));if(u===null)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but its Authorization header is malformed; the proxy cannot re-sign it."};let d=Hn(a["x-amz-date"]);if(d===void 0)return{action:"deny",reason:"AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it."};let f=[...u.signedHeaders];for(let p of f){if(p==="host")continue;if(p==="x-amz-security-token"&&c.realSessionToken!==void 0)continue;if(a[p]===void 0)return{action:"deny",reason:`AWS SigV4 request uses a masked credential but signed header "${p}" is missing; the proxy cannot re-sign it.`}}if(c.realSessionToken!==void 0&&!f.includes("x-amz-security-token"))f.push("x-amz-security-token");let y=Hn(a["x-amz-content-sha256"]);return{action:"resign",payloadHash:y===aa?aa:void 0,apply(p,v,x){if(c.realSessionToken!==void 0)p["x-amz-security-token"]=c.realSessionToken;if(p["x-amz-content-sha256"]!==void 0&&y!==aa)p["x-amz-content-sha256"]=x;let{authorization:b}=pf({method:i,requestTarget:s,headers:p,hostHeader:v,signedHeaders:f,payloadHash:x,amzDate:d,scope:{date:u.date,region:u.region,service:u.service},accessKeyId:c.realAccessKeyId,secretAccessKey:c.realSecretAccessKey});p.authorization=b}}}}import{spawnSync as Dx}from"child_process";import*as qn from"fs";function br(e){if(typeof globalThis.Bun<"u")return globalThis.Bun.which(e);let t=process.env.PATH;if(process.platform==="linux"&&t){let r=(i)=>{try{if(!qn.statSync(i).isFile())return!1;return qn.accessSync(i,qn.constants.X_OK),!0}catch{return!1}};if(e.includes("/"))return r(e)?e.trim():null;for(let i of t.split(":")){let s=`${i||"."}/${e}`;if(r(s))return s.trim()}return null}let n=Dx("which",[e],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:1000});if(n.status===0&&n.stdout)return n.stdout.trim();return null}import*as jr from"fs";import{randomBytes as QS}from"crypto";function kt(e){return e.map((t)=>{if(t==="")return"''";if(/^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/.test(t))return t;return"'"+t.replace(/'/g,`'"'"'`)+"'"}).join(" ")}import{randomBytes as sS}from"crypto";import*as Y from"fs";import{spawn as fp}from"child_process";import{tmpdir as Sa}from"os";import Le,{join as pp}from"path";import{spawn as Lx}from"child_process";import{text as zf}from"stream/consumers";var Ox={ms:1e4};class ga extends Error{constructor(e){super(`ripgrep timed out after ${e} ms`);this.name="RipgrepTimeoutError"}}async function Nl(e,t,n,r={command:"rg"}){let{command:i,args:s=[],argv0:a}=r,o=Lx(i,[...s,...e,t],{argv0:a,env:{PATH:process.env.PATH??"/usr/bin:/bin"},signal:n,windowsHide:!0}),l=Ox.ms,c=!1,u=setTimeout(()=>{c=!0,o.kill("SIGKILL")},l),d,f,y;try{[d,f,y]=await Promise.all([zf(o.stdout),zf(o.stderr),new Promise((p,v)=>{o.on("close",p),o.on("error",v)})])}finally{clearTimeout(u)}if(c)throw new ga(l);if(y===0)return d.trim().split(`
62
+ `).filter(Boolean);if(y===1)return[];throw Error(`ripgrep failed with exit code ${y}: ${f}`)}import{join as ur,dirname as Ux}from"path";import{fileURLToPath as Vx}from"url";import*as ma from"fs";import{homedir as Fx}from"os";var Dl=new Map,Ll=null;function Mx(){if(Ll)return Ll;let e=[],t=Fx();return e.push(ur("/usr","lib","node_modules","@anthropic-ai","sandbox-runtime"),ur("/usr","local","lib","node_modules","@anthropic-ai","sandbox-runtime"),ur("/opt","homebrew","lib","node_modules","@anthropic-ai","sandbox-runtime"),ur(t,".npm","lib","node_modules","@anthropic-ai","sandbox-runtime"),ur(t,".npm-global","lib","node_modules","@anthropic-ai","sandbox-runtime")),Ll=e,e}function Qf(){let e=process.arch;switch(e){case"x64":case"x86_64":return"x64";case"arm64":case"aarch64":return"arm64";case"ia32":case"x86":return C("[SeccompFilter] 32-bit x86 (ia32) is not currently supported due to missing socketcall() syscall blocking. The current seccomp filter only blocks socket(AF_UNIX, ...), but on 32-bit x86, socketcall() can be used to bypass this.",{level:"error"}),null;default:return C(`[SeccompFilter] Unsupported architecture: ${e}. Only x64 and arm64 are supported.`),null}}function Wx(e){let t=Qf();if(!t)return[];let n=Ux(Vx(import.meta.url)),r=ur("vendor","seccomp",t,e);return[ur(n,r),ur(n,"..","..",r),ur(n,"..",r)]}function Ol(e){let t=e??"";if(Dl.has(t))return Dl.get(t);let n=$x(e);return Dl.set(t,n),n}function $x(e){if(e){if(ma.existsSync(e))return C(`[SeccompFilter] Using apply-seccomp binary from explicit path: ${e}`),e;C(`[SeccompFilter] Explicit path provided but file not found: ${e}`)}let t=Qf();if(!t)return C(`[SeccompFilter] Cannot find apply-seccomp binary: unsupported architecture ${process.arch}`),null;C(`[SeccompFilter] Looking for apply-seccomp binary for architecture: ${t}`);for(let n of Wx("apply-seccomp"))if(ma.existsSync(n))return C(`[SeccompFilter] Found apply-seccomp binary: ${n} (${t})`),n;for(let n of Mx()){let r=ur(n,"vendor","seccomp",t,"apply-seccomp");if(ma.existsSync(r))return C(`[SeccompFilter] Found apply-seccomp binary in global install: ${r} (${t})`),r}return C(`[SeccompFilter] apply-seccomp binary not found in any expected location (${t})`),null}import{spawnSync as Hx}from"child_process";import{createHash as Kx}from"crypto";import*as X from"fs";import Qt from"path";class Li extends Error{}var qx={dir:"/run/srt-stubs",uid:0,lockWaitMs:2000,flockPath:"/usr/bin/flock"},Gn=qx,Gx,Jf;var ya=X.constants.O_CLOEXEC??524288,Ul={kind:"masked"},Xf={kind:"real"},Di={kind:"unregistered"},jx=new Set(["ENOENT","EACCES"]),zx=new Set(["ENOENT","ENOTDIR","EROFS"]),dr=null,hn=null,Qx=0;function Oi(e){return e?.code}function Fl(e){return Kx("sha256").update(e).digest("hex")}function Ml(){if(process.platform!=="linux")return"off";let{dir:e,uid:t,flockPath:n}=Gn;if(process.geteuid?.()!==t)return"off";try{X.accessSync(n,X.constants.X_OK)}catch(i){return jx.has(Oi(i)??"")?"off":"error"}try{X.mkdirSync(e,{mode:448}),X.chmodSync(e,448)}catch(i){let s=Oi(i)??"";if(s!=="EEXIST")return zx.has(s)?"off":"error"}let r;try{r=X.lstatSync(e)}catch{return"error"}if(!r.isDirectory()||r.uid!==t||(r.mode&511)!==448)return C(`[Sandbox Linux] ${e} is not a 0700 directory owned by uid ${t}; mask stubs are not shared`,{level:"warn"}),"off";return e}function Zf(e,t){try{return X.openSync(Qt.join(e,t),X.constants.O_RDONLY|X.constants.O_CREAT|X.constants.O_NOFOLLOW|ya,384)}catch{return null}}function ep(e,t){try{return Hx(Gn.flockPath,[...t,"3"],{stdio:["ignore","ignore","ignore",e],timeout:Gn.lockWaitMs+5000}).status===0}catch{return!1}}function Yf(e,t,n){let r=Zf(e,t);if(r===null)return null;let i=(Gn.lockWaitMs/1000).toFixed(3);if(ep(r,[n,"-w",i]))return r;return X.closeSync(r),null}function tp(e){try{X.closeSync(e)}catch{}}function rp(){let e=Ml();if(e==="off")return!1;if(e==="error")throw new Li(`srt: cannot read the mask stub registry ${Gn.dir}; refusing to start the sandbox`);if(dr===null)dr=Yf(e,"lock","-s");if(dr!==null&&hn===null)hn=Yf(e,"claims","-x");if(dr===null||hn===null)throw new Li(`srt: mask stub registry ${e} is busy (no ${dr===null?"shared":"claims"} lock within ${Gn.lockWaitMs} ms); refusing to start the sandbox rather than risk a mask another call removes`);return!0}function va(){if(hn===null)return;tp(hn),hn=null}function Xx(){if(dr===null)return;tp(dr),dr=null}function np(){let e=Ml();if(e==="off")return null;if(e==="error"||dr===null||hn===null)throw new Li("srt: mask stub claimed without holding the registry; refusing to start the sandbox");return e}function Ui(e){try{return X.lstatSync(e,{bigint:!0})}catch(t){return Oi(t)==="ENOENT"?"absent":"unknown"}}function ip(e){try{let t=JSON.parse(X.readFileSync(e,"utf8")),{v:n,type:r,uid:i,dev:s,ino:a,ctimeNs:o,path:l}=t,c=(u)=>typeof u==="string"&&/^\d+$/.test(u);if(n!==1||r!=="f"&&r!=="d"||typeof i!=="number"||!c(s)||!c(a)||!c(o)||typeof l!=="string"||!l.startsWith("/"))return null;return{type:r,uid:i,dev:BigInt(s),ino:BigInt(a),ctimeNs:BigInt(o),dest:l}}catch{return null}}function sp(e,t){return Qt.join(e,`${Fl(t)}.stub`)}function Yx(e,t){let n=Fl(t.dest),r=Qt.join(e,`${n}.stub.${process.pid}-${++Qx}`),i=JSON.stringify({v:1,type:t.type,uid:t.uid,dev:String(t.dev),ino:String(t.ino),ctimeNs:String(t.ctimeNs),path:t.dest});X.writeFileSync(r,i+`
63
+ `,{flag:"wx",mode:384}),X.renameSync(r,Qt.join(e,`${n}.stub`))}function ap(e,t){return(t.type==="f"?e.isFile()&&e.size===BigInt(0):e.isDirectory())&&e.uid===BigInt(t.uid)&&e.dev===t.dev&&e.ino===t.ino&&e.ctimeNs===t.ctimeNs}function Wl(e){let t=Qt.dirname(e),n;try{n=X.openSync(t,X.constants.O_RDONLY|X.constants.O_DIRECTORY|X.constants.O_NOFOLLOW|ya)}catch{return null}try{if(X.readlinkSync(`/proc/self/fd/${n}`)===t)return n}catch{}return X.closeSync(n),null}function op(e,t,n){return{type:e,uid:Number(t.uid),dev:t.dev,ino:t.ino,ctimeNs:t.ctimeNs,dest:n}}function Jx(e){let t=Wl(e);if(t===null)return null;try{let n;try{n=X.openSync(`/proc/self/fd/${t}/${Qt.basename(e)}`,X.constants.O_RDONLY|X.constants.O_CREAT|X.constants.O_EXCL|X.constants.O_NOFOLLOW|ya,292)}catch(r){return Oi(r)==="EEXIST"?"exists":null}try{return Jf?.(e),op("f",X.fstatSync(n,{bigint:!0}),e)}finally{X.closeSync(n)}}finally{X.closeSync(t)}}function Zx(e,t){let n=Wl(e);if(n===null)return null;try{let r=`/proc/self/fd/${n}/${Qt.basename(e)}`;try{X.mkdirSync(r,{mode:493})}catch(s){return Oi(s)==="EEXIST"?"exists":null}Jf?.(e);let i;try{i=X.openSync(r,X.constants.O_RDONLY|X.constants.O_DIRECTORY|X.constants.O_NOFOLLOW|ya)}catch{return null}try{let s=X.fstatSync(i,{bigint:!0});if(!s.isDirectory()||s.uid!==BigInt(process.geteuid?.()??-1)||s.nlink>BigInt(2)||X.readdirSync(`/proc/self/fd/${i}`).length!==0)return null;if(t)X.fchownSync(i,t.uid,t.gid);return op("d",X.fstatSync(i,{bigint:!0}),e)}catch{return null}finally{X.closeSync(i)}}finally{X.closeSync(n)}}function eS(e){let t=Wl(e.dest);if(t===null)return;try{let n=`/proc/self/fd/${t}/${Qt.basename(e.dest)}`,r=Ui(n);if(typeof r==="object"&&ap(r,e)){if(e.type==="d")X.rmdirSync(n);else X.unlinkSync(n);C(`[Sandbox Linux] Removed shared mask stub: ${e.dest}`)}}catch{}finally{X.closeSync(t)}}function tS(e){try{X.unlinkSync(e)}catch{}}function Vl(e,t,n,r){let i=ip(sp(e,t));return i!==null&&i.type===r&&i.dest===t&&ap(n,i)}function lp(e,t,n){let r=np();if(r===null)return Di;if(Gx?.(e)==="unregistered")return Di;let i=Ui(e);if(i==="unknown")return Di;if(i!=="absent")return Vl(r,e,i,t)?Ul:Xf;let s=n();if(s==="exists"){let a=Ui(e);return typeof a==="object"&&Vl(r,e,a,t)?Ul:Xf}if(s===null)return Di;try{Yx(r,s)}catch(a){C(`[Sandbox Linux] mask stub marker not written for ${e}: ${a}`,{level:"warn"})}return Ul}function rS(e){return lp(e,"f",()=>Jx(e))}function nS(e,t){return lp(e,"d",()=>Zx(e,t))}function cp(e,t){let n=np();if(n===null)return null;let r=(s)=>t.some((a)=>s.startsWith(a+"/")),i=[];for(let s=Qt.dirname(e);r(s);s=Qt.dirname(s))i.unshift(s);for(let s of i){let a=Ui(s);if(typeof a==="object"&&Vl(n,s,a,"d"))return s}return null}function up(e,t){try{return e()}catch(n){if(n instanceof Li)throw n;return C(`[Sandbox Linux] mask stub not recorded for ${t}: ${n}`,{level:"warn"}),Di}}function $l(e){return up(()=>rS(e),e)}function dp(e,t){return up(()=>nS(e,t),e)}function iS(e){let t;try{t=X.readdirSync(e)}catch{return}let n=[],r=[];for(let s of t){let a=/^([0-9a-f]{64})\.stub(\..*)?$/.exec(s);if(a===null)continue;let o=Qt.join(e,s);if(r.push(o),a[2]===void 0){let l=ip(o);if(l!==null&&Fl(l.dest)===a[1])n.push(l)}}let i=(s)=>s.dest.split("/").length;n.sort((s,a)=>s.type===a.type?i(a)-i(s):s.type==="f"?-1:1);for(let s of n)eS(s);for(let s of r)tS(s)}function Hl(e,t){let n=Ml(),r=dr!==null;if(va(),Xx(),n==="off"){for(let s of e)t(s);return[]}if(n==="error")return[...e];if(!r&&e.length===0)return[];let i=Zf(n,"lock");if(i===null)return[...e];try{if(!ep(i,["-x","-n"]))return[...e];for(let s of e)if(Ui(sp(n,s))==="absent")t(s);return iS(n),[]}catch(s){return C(`[Sandbox Linux] mask stub sweep failed: ${s}`,{level:"warn"}),[...e]}finally{X.closeSync(i)}}var jl=3;function aS(e){let t=e.uid===void 0?e.bwrapCommand:[e.setprivPath??"/usr/bin/setpriv",`--reuid=${e.uid}`,`--regid=${e.gid??e.uid}`,"--clear-groups","--inh-caps=-all","--ambient-caps=-all","--bounding-set=-all",...e.bwrapCommand],n=e.unsetEnvVars??[],r=Object.entries(e.setEnvVars??{});if(n.length===0&&r.length===0)return t;return["/usr/bin/env",...n.flatMap((i)=>["-u",i]),...r.map(([i,s])=>`${i}=${s}`),...t]}function Kl(e,t){let n=e.split(Le.sep),r="";for(let i of n){if(!i)continue;let s=r+Le.sep+i;try{if(Y.lstatSync(s).isSymbolicLink()){if(t.some((l)=>s.startsWith(l+"/")||s===l))return s}}catch{break}r=s}return null}var oS=40;function hp(e){let t=e;for(let n=0;n<oS;n++){try{return Y.realpathSync(t)}catch{}let r=t,i=[],s=null;while(s===null){let l=Le.dirname(r);if(l===r)return null;i.unshift(Le.basename(r)),r=l;try{s=Y.realpathSync(r)}catch{}}let a=Le.join(s,i[0]),o=null;try{o=Y.readlinkSync(a)}catch{}if(o===null)return Le.join(s,...i);t=Le.join(Le.resolve(Le.dirname(a),o),...i.slice(1))}return null}function lS(e){let t=e.split(Le.sep),n="";for(let r of t){if(!r)continue;let i=n+Le.sep+r;try{let s=Y.statSync(i);if(s.isFile()||s.isSymbolicLink())return!0}catch{break}n=i}return!1}function cS(e){let t=e.split(Le.sep),n="";for(let r of t){if(!r)continue;let i=n+Le.sep+r;if(!Y.existsSync(i))return i;n=i}return e}async function uS(e={command:"rg"},t=jl,n=!1,r){let i=process.cwd(),s=new AbortController,a=r??s.signal,o=ms(),l=[...li.map((p)=>Le.resolve(i,p)),...o.map((p)=>Le.resolve(i,p))],c=Le.resolve(i,".git"),u=!1;try{u=Y.statSync(c).isDirectory()}catch{}if(u){if(l.push(Le.resolve(i,".git/hooks")),!n)l.push(Le.resolve(i,".git/config"))}let d=[];for(let p of li)d.push("--iglob",p);for(let p of o)d.push("--iglob",`**/${p}/**`);if(d.push("--iglob","**/.git/hooks/**"),!n)d.push("--iglob","**/.git/config");let f=["--files","--hidden","--no-ignore","--max-depth",String(t),...d,"-g","!**/node_modules/**"],y;try{y=await Nl(f,i,a,e)}catch(p){if(p instanceof ga)throw Error(`mandatory deny scan failed: ${p}`);C(`[Sandbox] ripgrep scan failed, retrying once: ${p}`);try{y=await Nl(f,i,a,e)}catch(v){throw Error(`mandatory deny scan failed: ${v}`)}}for(let p of y){let v=Le.resolve(i,p),x=!1;for(let b of[...o,".git"]){let A=Qa(b),E=v.split(Le.sep),k=E.findIndex((I)=>Qa(I)===A);if(k!==-1){if(b===".git"){let I=E.slice(0,k+1).join(Le.sep);if(p.includes(".git/hooks"))l.push(Le.join(I,"hooks"));else if(p.includes(".git/config"))l.push(Le.join(I,"config"))}else l.push(E.slice(0,k+1).join(Le.sep));x=!0;break}}if(!x)l.push(v)}return[...new Set(l)]}var Vi;function dS(){if(process.getuid?.()!==0||process.env.ARA_SRT_FILE_MASK!=="empty")return"/dev/null";if(Vi)try{let n=Y.lstatSync(Vi);if(n.isFile()&&n.size===0&&n.uid===0&&(n.mode&146)===0)return Vi}catch{}let e=Y.mkdtempSync(Le.join(Sa(),"claude-empty-file-"));ba.add(e),Y.chmodSync(e,493);let t=Le.join(e,"empty");return Y.writeFileSync(t,"",{flag:"wx",mode:292}),Y.chmodSync(t,292),Vi=t,t}var Fi=new Set,ba=new Set;function gp(e,t){return e===t?dS():"/dev/null"}var fS="ARA_SRT_MASKED_PATHS",pS=16384;function hS(e,t,n=pS){let r=[],i=0;for(let s of new Set(e)){if(s.includes(`
64
64
  `))continue;if(s!==t&&!s.startsWith(t==="/"?"/":t+"/"))continue;let a=s.split("'").length-1,o=Buffer.byteLength(s)+4*a+(r.length>0?1:0);if(i+o>n)break;r.push(s),i+=o}return r.length>0?r.join(`
65
- `):void 0}function pS(e){try{let t=Y.lstatSync(e);return t.isFile()&&t.size===0}catch{return!1}}var Cr=0,gp=!1;function va(){if(gp)return;process.on("exit",()=>{ba({force:!0})}),gp=!0}function ba(e){if(!e?.force){if(Cr>0)Cr--;if(Cr>0){C(`[Sandbox Linux] Deferring mount point cleanup \u2014 ${Cr} sandbox(es) still active`);return}}else Cr=0;let t=[],n=[];for(let s of Vi)try{let a=Y.statSync(s);if(a.isFile()&&a.size===0)t.push(s);else if(a.isDirectory())n.push(s)}catch{}let r=(s)=>s.split("/").length;n.sort((s,a)=>r(a)-r(s));let i=$l([...t,...n],(s)=>{try{let a=Y.statSync(s);if(a.isFile()&&a.size===0)Y.unlinkSync(s),C(`[Sandbox Linux] Cleaned up bwrap mount point (file): ${s}`);else if(a.isDirectory()){if(Y.readdirSync(s).length!==0)return;Y.rmdirSync(s),C(`[Sandbox Linux] Cleaned up bwrap mount point (dir): ${s}`)}}catch{}});Vi.clear();for(let s of i)Vi.add(s);for(let s of Sa)try{Y.rmSync(s,{recursive:!0,force:!0})}catch{}Sa.clear(),Ui=void 0}function mp(e){try{return Y.accessSync(e,Y.constants.X_OK),!0}catch{return!1}}function vp(e){let{seccompConfig:t,bwrapPath:n,socatPath:r}=e??{},i=[],s=[];if(n){if(!mp(n))i.push(`bubblewrap (bwrap) not executable at ${n}`)}else if(br("bwrap")===null)i.push("bubblewrap (bwrap) not installed");if(r){if(!mp(r))i.push(`socat not executable at ${r}`)}else if(br("socat")===null)i.push("socat not installed");if(!t?.argv0&&Ll(t?.applyPath)===null)s.push("seccomp not available - unix socket access not restricted");return{warnings:s,errors:i}}async function xp(e,t,n,r,i){let s=n??"socat",a=nS(8).toString("hex"),o=fp(xa(),`claude-http-${a}.sock`),l=fp(xa(),`claude-socks-${a}.sock`),c=[`UNIX-LISTEN:${o},fork,reuseaddr`,`TCP:localhost:${e},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];C(`Starting HTTP bridge: ${s} ${c.join(" ")}`);let u=dp(s,c,{stdio:"ignore"});if(u.on("error",(p)=>{C(`HTTP bridge process error: ${p}`,{level:"error"})}),u.on("exit",(p,v)=>{C(`HTTP bridge process exited with code ${p}, signal ${v}`,{level:p===0?"info":"error"})}),!u.pid)throw Error("Failed to start HTTP bridge process");let d,f;if(t===e)d=u,f=o;else{f=l;let p=[`UNIX-LISTEN:${l},fork,reuseaddr`,`TCP:localhost:${t},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];if(C(`Starting SOCKS bridge: ${s} ${p.join(" ")}`),d=dp(s,p,{stdio:"ignore"}),d.on("error",(v)=>{C(`SOCKS bridge process error: ${v}`,{level:"error"})}),d.on("exit",(v,x)=>{C(`SOCKS bridge process exited with code ${v}, signal ${x}`,{level:v===0?"info":"error"})}),!d.pid){if(u.pid)try{process.kill(u.pid,"SIGTERM")}catch{}throw Error("Failed to start SOCKS bridge process")}}let y=200;for(let p=0;p<y;p++){if(!u.pid||u.killed||!d.pid||d.killed)throw Error("Linux bridge process died unexpectedly");try{if(Y.existsSync(o)&&Y.existsSync(f)){if(r!==void 0){let v=i??r;for(let x of new Set([o,f]))Y.chownSync(x,r,v),Y.chmodSync(x,384)}C(`Linux bridges ready after ${p+1} attempts`);break}}catch(v){C(`Error checking sockets (attempt ${p+1}): ${v}`,{level:"error"})}if(p===y-1){if(u.pid)try{process.kill(u.pid,"SIGTERM")}catch{}if(d.pid)try{process.kill(d.pid,"SIGTERM")}catch{}throw Error(`Failed to create bridge sockets after ${y} attempts`)}await new Promise((v)=>setTimeout(v,5))}return{httpSocketPath:o,socksSocketPath:f,httpBridgeProcess:u,socksBridgeProcess:d,httpProxyPort:e,socksProxyPort:t}}function hS(e,t){if(t){if(!e)throw Error("seccompConfig.argv0 requires seccompConfig.applyPath");return`ARGV0=${kt([t])} ${kt([e])} `}let n=Ll(e);return n?`${kt([n])} `:void 0}function ql(e,t,n){if(n===void 0)return[e,"-c",t];if(!Number.isSafeInteger(n)||n<3||n>9)throw Error("bad_start_fd");return[e,"-c",`printf . >&${n}; exec ${n}>&-; exec "$0" "$@"`,e,"-c",t]}function gS(e,t,n,r,i,s,a){let o=i||"bash",l=kt([s??"socat"]),c=a===void 0?"":` ${a}>&-`,u=["srt_payload_pid=",`${l} TCP4-LISTEN:3128,bind=127.0.0.1,fork,reuseaddr ${kt([`UNIX-CONNECT:${e}`])} >/dev/null 2>&1${c} &`,"srt_http_proxy_pid=$!",`${l} TCP4-LISTEN:1080,bind=127.0.0.1,fork,reuseaddr ${kt([`UNIX-CONNECT:${t}`])} >/dev/null 2>&1${c} &`,"srt_socks_proxy_pid=$!","srt_cleanup_command() {"," srt_status=$?"," trap - EXIT INT TERM",' if [ -n "$srt_payload_pid" ]; then',' kill -KILL "$srt_payload_pid" 2>/dev/null',' wait "$srt_payload_pid" 2>/dev/null'," fi",' kill -KILL "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null',' wait "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null',' exit "$srt_status"',"}","trap srt_cleanup_command EXIT","trap 'exit 143' TERM","trap 'exit 130' INT",...[3128,1080].map((y)=>`${l} -u OPEN:/dev/null TCP4:127.0.0.1:${y},connect-timeout=0.1,retry=480,interval=0.005 >/dev/null 2>&1${c} || { printf '%s\\n' 'Sandbox proxy listener readiness failed' >&2; exit 1; }`),`kill -0 "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null || { printf '%s\\n' 'Sandbox proxy listener exited before command' >&2; exit 1; }`],d=(r??"")+kt(ql(o,n,a)),f=[...u,`${d} <&0 &`,"srt_payload_pid=$!",'wait "$srt_payload_pid"',"srt_payload_status=$?","srt_payload_pid=",'exit "$srt_payload_status"'].join(`
66
- `);return`${o} -c ${kt([f])}`}function Kl(e){try{if(Y.lstatSync(e).isSymbolicLink())return Y.realpathSync(e)}catch{}return e}function yp(e,t,n,r){let i=t==="/"?"/":t+"/";e.push("--tmpfs",t);for(let s of n)if(s.startsWith(i)||s===t)e.push("--bind",s,s),C(`[Sandbox Linux] Re-bound write path wiped by denyRead tmpfs: ${s}`);for(let s of r)if(s.startsWith(i)||s===t){if(!Y.existsSync(s)){C(`[Sandbox Linux] Skipping non-existent read allow path: ${s}`);continue}if(n.some((a)=>(a.startsWith(i)||a===t)&&(s===a||s.startsWith(a+"/"))))continue;e.push("--ro-bind",s,s),C(`[Sandbox Linux] Re-allowed read access within denied region: ${s}`)}}async function mS(e,t,n,r,i={command:"rg"},s=Gl,a=!1,o,l,c=[]){let u=[],d=[],f=[],y=new Set,p=new Map,v=new Map;if(t){u.push("--ro-bind","/","/");for(let V of t.allowOnly||[]){let te=it(V).replace(/\/+$/,"")||"/";if(C(`[Sandbox Linux] Processing write path: ${V} -> ${te}`),te.startsWith("/dev/")){C(`[Sandbox Linux] Skipping /dev path: ${te}`);continue}if(!Y.existsSync(te)){C(`[Sandbox Linux] Skipping non-existent write path: ${te}`);continue}try{let Q=Y.realpathSync(te),ue=te.replace(/\/+$/,"");if(Q!==ue&&hs(te,Q)){C(`[Sandbox Linux] Skipping symlink write path pointing outside expected location: ${V} -> ${Q}`);continue}}catch{C(`[Sandbox Linux] Skipping write path that could not be resolved: ${te}`);continue}u.push("--bind",te,te),d.push(te)}let O,K=()=>{if(O!==void 0)return O;let V=[];for(let Q of d){V.push(Q);try{let ue=Y.realpathSync(Q);if(ue!==Q)V.push(ue)}catch{}}let te=[];if(e){let Q=[],ue=new Set(["proc","dev","sys"]);for(let ce of e.denyOnly||[])if(it(ce)==="/")try{for(let Z of Y.readdirSync("/"))if(!ue.has(Z))Q.push("/"+Z)}catch{}else Q.push(ce);if(Y.existsSync("/etc/ssh/ssh_config.d"))Q.push("/etc/ssh/ssh_config.d");for(let ce of Q){let Z=it(ce),Pe=!1;try{Pe=Y.statSync(Z).isDirectory()}catch{continue}if(!Pe)continue;te.push(Z);try{let Fe=Y.realpathSync(Z);if(Fe!==Z)te.push(Fe)}catch{}}}return O={allowedWritePathsBothForms:V,prospectiveReadDenyTmpfsDirsBothForms:te},O},ie=(V)=>d.some((te)=>V.startsWith(te+"/")||V===te),ve=[...t.denyWithinAllow||[],...await lS(i,s,a,o)];tp();let we=new Set;for(let V of ve){let te=it(V);if(te.startsWith("/dev/"))continue;let Q=pp(te);if(Q===null||Q.startsWith("/dev/"))continue;if(Hl(Q,d))continue;let ue=!1;try{ue=Y.statSync(Q).isDirectory()}catch{continue}if(!ue)continue;if(ie(Q)){let ce=p.get(Q);if(ce===void 0)ce=new Set,p.set(Q,ce);ce.add(te)}}let nt=new Map,_e=(V)=>{let te=nt.get(V);if(te!==void 0)return te;let{allowedWritePathsBothForms:Q,prospectiveReadDenyTmpfsDirsBothForms:ue}=K(),ce=Q.some((Z)=>Z.startsWith(V+"/"))||ue.some((Z)=>Z===V||Z.startsWith(V+"/"))||ue.some((Z)=>[V,...p.get(V)??[]].some((Pe)=>Pe===Z||Pe.startsWith(Z+"/")));return nt.set(V,ce),ce},Ve=[...p.keys()];for(let V of ve){let te=it(V);if(te.startsWith("/dev/"))continue;let Q=pp(te);if(Q===null){let Z=Hl(te,d);if(Z&&!we.has(Z))we.add(Z),f.push("--ro-bind","/dev/null",Z),v.set(Z,te);C(`[Sandbox Linux] Deny path could not be resolved through symlinks, failing closed: ${te}`);continue}if(Q!==te)C(`[Sandbox Linux] Resolved symlinked deny path: ${te} -> ${Q}`);if(Q.startsWith("/dev/"))continue;if(we.has(Q))continue;we.add(Q);let ue=Hl(Q,d);if(ue){if(!we.has(ue))we.add(ue),f.push("--ro-bind","/dev/null",ue),v.set(ue,te);C(`[Sandbox Linux] Mounted /dev/null at symlink ${ue} to prevent symlink replacement attack`);continue}if(!Y.existsSync(Q)){if(aS(Q)){C(`[Sandbox Linux] Skipping deny path with file ancestor (cannot create paths under a file): ${Q}`);continue}let Z=Le.dirname(Q);while(Z!=="/"&&!Y.existsSync(Z))Z=Le.dirname(Z);let Pe=ie(Z)||ie(Q),Fe=Ve.filter((Me)=>Z===Me||Z.startsWith(Me+"/")),le=Fe.length>0&&!Fe.some(_e);if(Pe&&!le){let Me=oS(Q),de=lp(Me,d)??Me;if(de!==Q){if(!y.has(de)){let qe=up(de,l),Oe=Y.mkdtempSync(Le.join(xa(),"claude-empty-"));if(Y.chmodSync(Oe,365),Sa.add(Oe),f.push("--ro-bind",Oe,de),v.set(de,te),y.add(de),qe.kind==="unregistered")Vi.add(de);va(),C(`[Sandbox Linux] Mounted empty dir at ${de} to block creation of ${Q}`)}}else{let qe=Wl(de),Oe=hp(Q,te);if(qe.kind==="masked")f.push("--ro-bind",Oe,de),v.set(de,te),va(),C(`[Sandbox Linux] Masked shared stub at ${de} with ${Oe} to block creation of ${Q}`);else if(qe.kind==="real")f.push("--ro-bind",de,de),v.set(de,te);else f.push("--ro-bind",Oe,de),v.set(de,te),Vi.add(de),va(),C(`[Sandbox Linux] Mounted ${Oe} at ${de} to block creation of ${Q}`)}}else if(le)C(`[Sandbox Linux] Skipping non-existent deny path inside a read-only denied directory (already uncreatable): ${Q}`);else C(`[Sandbox Linux] Skipping non-existent deny path not within allowed paths: ${Q}`);continue}if(ie(Q)){if((pS(Q)?Wl(Q):void 0)?.kind==="masked")f.push("--ro-bind",hp(Q,te),Q),va();else f.push("--ro-bind",Q,Q);v.set(Q,te)}else C(`[Sandbox Linux] Skipping deny path not within allowed paths: ${Q}`)}}else u.push("--bind","/","/");let x=[],b=(e?.allowWithinDeny||[]).map((O)=>it(O)),A=new Map,E=[],k=new Set(["proc","dev","sys"]);for(let O of e?.denyOnly||[])if(it(O)==="/"){for(let K of Y.readdirSync("/"))if(!k.has(K))x.push("/"+K)}else x.push(O);if(e&&Y.existsSync("/etc/ssh/ssh_config.d"))x.push("/etc/ssh/ssh_config.d");let I=x.map((O)=>it(O)).sort((O,K)=>O.split("/").length-K.split("/").length);for(let O of I){if(!Y.existsSync(O)){C(`[Sandbox Linux] Skipping non-existent read deny path: ${O}`);continue}if(Y.statSync(O).isDirectory())E.push(O),yp(u,O,d,b);else{if(b.includes(O)){C(`[Sandbox Linux] Skipping read deny for re-allowed path: ${O}`);continue}let ie=Kl(O);u.push("--ro-bind","/dev/null",ie),A.set(ie,"/dev/null"),A.set(O,"/dev/null")}}for(let{realPath:O,fakePath:K}of n??[]){let ie=Kl(O);u.push("--ro-bind",K,ie),A.set(ie,K),A.set(O,K)}let R=(O)=>E.some((K)=>{if(!(O===K||O.startsWith(K+"/")))return!1;return!d.some((we)=>(we===K||we.startsWith(K+"/"))&&(O===we||O.startsWith(we+"/")))}),M=[...y].filter((O)=>{let K=v.get(O)??O;return!A.has(O)&&!R(O)&&!R(K)&&!d.some((ie)=>ie===O||ie.startsWith(O+"/"))}),ee=[];for(let O=0;O<f.length;O+=3){let K=f[O+2],ie=v.get(K)??K;if(A.has(K))continue;if(R(K)||R(ie)){C(`[Sandbox Linux] Skipping denyWrite bind already hidden by denyRead tmpfs: ${K}`);continue}if(M.some((ve)=>K.startsWith(ve+"/"))){C(`[Sandbox Linux] Skipping denyWrite bind under an empty-directory mask: ${K}`);continue}if(u.push(f[O],f[O+1],K),ee.push(K),f[O+1]!==K)c.push(K);if(ie!==K)ee.push(ie)}for(let O of E)if(ee.some((K)=>O.startsWith(K+"/")))C(`[Sandbox Linux] Re-applying denyRead tmpfs re-exposed by denyWrite bind: ${O}`),yp(u,O,d,b);for(let[O,K]of A)if(ee.some((ie)=>O.startsWith(ie+"/"))){if(Kl(O)!==O)continue;C(`[Sandbox Linux] Re-applying file mask re-exposed by denyWrite bind: ${O}`),u.push("--ro-bind",K,O)}if(r!==void 0)u.push("--ro-bind",r,r);return u}async function Sp(e){let{command:t,commandId:n,needsNetworkRestriction:r,httpSocketPath:i,socksSocketPath:s,httpProxyPort:a,socksProxyPort:o,proxyAuthToken:l,caCertPath:c,readConfig:u,writeConfig:d,unsetEnvVars:f,setEnvVars:y,maskedFileBinds:p,maskedFileStoreDir:v,enableWeakerNestedSandbox:x,runAsUid:b,runAsGid:A,runAsHostUid:E,runAsHostGid:k,runAsHostHome:I,runAsHostUser:R,setprivPath:M,allowAllUnixSockets:ee,binShell:O,ripgrepConfig:K={command:"rg"},mandatoryDenySearchDepth:ie=Gl,allowGitConfig:ve=!1,gitSafeDirectories:we,seccompConfig:nt,bwrapPath:_e,socatPath:Ve,observeSocketPath:V,startFd:te,abortSignal:Q}=e,ue=u&&u.denyOnly.length>0||p!==void 0&&p.length>0,ce=d!==void 0,Z=f!==void 0&&f.length>0||y!==void 0&&Object.keys(y).length>0,Pe=(we?.length??0)>0;if(!r&&!ue&&!ce&&!Z&&!Pe)return t;Cr++;let Fe=[],le=["--new-session","--die-with-parent"],Me=[],de;try{if(!ee)if(de=hS(nt?.applyPath,nt?.argv0),!de)throw Error("seccomp_unavailable: the policy requires the unix-socket filter (allowAllUnixSockets is false) but apply-seccomp is not installed beside srt (vendor/seccomp/<arch>/apply-seccomp; build it with `bun run build:seccomp` in packages/sandbox-runtime)");else C("[Sandbox Linux] Applying seccomp filter for Unix socket blocking");else C("[Sandbox Linux] Skipping seccomp filter - allowAllUnixSockets is enabled");if(V&&de)if(Y.existsSync(V))Me.push("--bind",V,V),le.push("--setenv","SRT_OBSERVE_SOCK",V),le.push("--setenv","SRT_ENCODED_CMD",Nt(n??t));else C("[Sandbox Linux] observe socket missing \u2014 supervisor not running; "+"continuing without violation monitoring");if(Z){for(let Ue of f??[])le.push("--unsetenv",Ue);for(let[Ue,Jr]of Object.entries(y??{}))le.push("--setenv",Ue,Jr)}if(we&&we.length>0){let Ue=ms({safeDirs:we,unsetEnvVars:f,setEnvVars:y});for(let[Jr,ds]of Object.entries(Ue))le.push("--setenv",Jr,ds)}if(r){if(le.push("--unshare-net"),i&&s){if(!Y.existsSync(i))throw Error(`Linux HTTP bridge socket does not exist: ${i}. The bridge process may have died. Try reinitializing the sandbox.`);if(!Y.existsSync(s))throw Error(`Linux SOCKS bridge socket does not exist: ${s}. The bridge process may have died. Try reinitializing the sandbox.`);if(Me.push("--bind",i,i),s!==i)Me.push("--bind",s,s);let Ue=Cn(3128,1080,c,l,d===void 0,Nt(n??t));if(le.push(...Ue.flatMap((Jr)=>{let ds=Jr.indexOf("="),Kh=Jr.slice(0,ds),qh=Jr.slice(ds+1);return["--setenv",Kh,qh]})),a!==void 0)le.push("--setenv","CLAUDE_CODE_HOST_HTTP_PROXY_PORT",String(a));if(o!==void 0)le.push("--setenv","CLAUDE_CODE_HOST_SOCKS_PROXY_PORT",String(o))}}let qe=await mS(u,d,p,v,K,ie,ve,Q,E===void 0?void 0:{uid:E,gid:k??E},Fe);ya(),le.push(...qe);let Oe=fS(Fe,process.cwd());if(Oe!==void 0)le.push("--setenv",uS,Oe);if(le.push(...Me),le.push("--dev","/dev"),le.push("--unshare-pid"),!x){if(le.push("--unshare-user","--cap-drop","ALL","--proc","/proc"),!de)le.push("--ro-bind","/dev/null","/proc/sysrq-trigger")}else le.push("--unshare-user","--bind","/proc","/proc");if(b!==void 0)le.push("--uid",String(b)),le.push("--gid",String(A??b));if(E!==void 0){if(I)le.push("--setenv","HOME",I);if(R)le.push("--setenv","USER",R),le.push("--setenv","LOGNAME",R)}let at=O||"bash",Xe=br(at);if(!Xe)throw Error(`Shell '${at}' not found in PATH`);if(le.push("--",Xe,"-c"),r&&i&&s){let Ue=gS(i,s,t,de,Xe,Ve,te);le.push(Ue)}else if(de){let Ue=de+kt(ql(Xe,t,te));le.push(Ue)}else le.push(te===void 0?t:`exec ${kt(ql(Xe,t,te))}`);let ot=[_e??"bwrap",...le],lt=kt(iS({bwrapCommand:ot,uid:E,gid:k,setprivPath:M,unsetEnvVars:f,setEnvVars:y})),Ye=[];if(r)Ye.push("network");if(ue||ce)Ye.push("filesystem");if(Z)Ye.push("env");if(de)Ye.push("seccomp(unix-block)");return C(`[Sandbox Linux] Wrapped command with bwrap (${Ye.join(", ")} restrictions)`),lt}catch(qe){if(Cr>0)Cr--;if(ya(),Cr===0)$l([],()=>{});throw qe}}import{spawn as yS}from"child_process";import*as Er from"path";class Ca{violations=[];totalCount=0;maxSize=100;listeners=new Set;addViolation(e){if(this.violations.push({...e,line:jl(e.line).replace(/[<>]/g,"")}),this.totalCount++,this.violations.length>this.maxSize)this.violations=this.violations.slice(-this.maxSize);this.notifyListeners()}getViolations(e){if(e===void 0)return[...this.violations];return this.violations.slice(-e)}getCount(){return this.violations.length}getTotalCount(){return this.totalCount}getViolationsForCommand(e){let t=Nt(e);return this.violations.filter((n)=>n.encodedCommand===t)}clear(){this.violations=[],this.notifyListeners()}subscribe(e){return this.listeners.add(e),e(this.getViolations()),()=>{this.listeners.delete(e)}}notifyListeners(){let e=this.getViolations();this.listeners.forEach((t)=>t(e))}}function Gn(e,t,n){if(!n)return!1;if((n["*"]??[]).some((i)=>e.includes(i)))return!0;if(t===void 0)return!1;for(let[i,s]of Object.entries(n))if(i!=="*"&&t.includes(i)&&s.some((a)=>e.includes(a)))return!0;return!1}function jl(e){return e.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").trim()}function vS(e=!1){let t=process.cwd(),n=[];for(let r of oi)n.push(Er.resolve(t,r)),n.push(`**/${r}`);for(let r of gs())n.push(Er.resolve(t,r)),n.push(`**/${r}/**`);if(n.push(Er.resolve(t,".git/hooks")),n.push("**/.git/hooks/**"),!e)n.push(Er.resolve(t,".git/config")),n.push("**/.git/config");return[...new Set(n)]}var bp=`_${Math.random().toString(36).slice(2,11)}_SBX`;function xS(e){return`CMD64_${Nt(e)}_END_${bp}`}function jn(e){return xt(e)?`(regex ${Xt(di(e))})`:`(subpath ${Xt(e)})`}function Yl(e){return di(e).slice(0,-1)+"(/.*)?$"}function gn(e){return xt(e)?`(regex ${Xt(Yl(e))})`:`(subpath ${Xt(e)})`}function Cp(e){return e.replace(/\[[^\]]*\]|[*?]+/g,"x")}function Ql(e,t){let n=[...new Set(t)];if(n.length===0)return e;let r=n.map((i)=>`(require-not ${i})`).join(" ");return`(require-all ${e} ${r})`}function zl(e){let t=it(e);return{path:t,glob:xt(t)}}function Ep(e,t){return e.test(t.glob?Cp(t.path):t.path)}function Ea(e,t){let n=e.glob?Cp(e.path):e.path;return n.startsWith(t==="/"?"/":t+"/")&&n!==t}function SS(e,t){return{denies:(e.denyOnly||[]).map(zl),allows:(e.allowWithinDeny||[]).map(zl),writeRoots:(t||[]).map(zl)}}function bS(e){let t=[],n=!1,r=e.allows.filter((i)=>!i.glob).map((i)=>i.path);for(let i of e.denies){if(!i.glob){if(r.some((o)=>i.path.startsWith(o+"/")))t.push(gn(i.path));continue}let s=new RegExp(Yl(i.path));if(s.test("/"))n=!0;let a=e.allows.filter((o)=>Ep(s,o)).map((o)=>jn(o.path));t.push(Ql(gn(i.path),a))}return{filters:t,coversRoot:n}}function wp(e){let t=e.split(/[*?[\]]/)[0];if(!t||t==="/")return"/";return t.endsWith("/")?t.slice(0,-1):Er.dirname(t)}function CS(e,t){let{denies:n,allows:r,writeRoots:i}=e;if(i.length===0)return[];let s=i.filter((d)=>d.glob).map((d)=>new RegExp(di(d.path))),a=i.filter((d)=>!d.glob).map((d)=>d.path),o=(d)=>a.some((f)=>Ea({path:d,glob:!1},f))||s.some((f)=>f.test(d)),l=(d)=>[...r,...i].filter((f)=>Ea(f,d)).map((f)=>jn(f.path)),c=new Set,u=(d)=>{for(let f of d)if(o(f))c.add(`(literal ${Xt(f)})`)};for(let d of n)if(d.glob){let f=wp(d.path);if(!(s.length>0||a.some((x)=>f===x||Ea({path:f,glob:!1},x)||Ea({path:x,glob:!1},f))))continue;let p=new RegExp(Yl(d.path)),v=[...r,...i].filter((x)=>Ep(p,x)).map((x)=>jn(x.path));if(c.add(Ql(gn(d.path),v)),f!=="/")u([f,...Xl(f)])}else{if(!o(d.path))continue;c.add(Ql(gn(d.path),l(d.path))),u(Xl(d.path))}return Hr("deny",["file-write-unlink"],c,t)}function Hr(e,t,n,r){if(n.size===0)return[];return[`(${e} ${t.join(" ")}`,...[...n].map((i)=>` ${i}`),` (with message "${r}"))`]}function Xl(e){let t=[],n=Er.dirname(e);while(n!=="/"&&n!=="."){t.push(n);let r=Er.dirname(n);if(r===n)break;n=r}return t}function Tp(e,t){let n=new Set;for(let r of e){let i=it(r);n.add(gn(i));let s;if(xt(i)){if(s=wp(i),s==="/")continue;n.add(`(literal ${Xt(s)})`)}else s=i;for(let a of Xl(s))n.add(`(literal ${Xt(a)})`)}return Hr("deny",["file-write-unlink","file-write-create"],n,t)}function ES(e,t){if(!e)return["(allow file-read*)"];let n=[];n.push("(allow file-read*)");let r=e.denies.some((l)=>l.path==="/"),i=new Set(e.denies.map((l)=>gn(l.path)));n.push(...Hr("deny",["file-read*"],i,t));let s=new Set(e.allows.map((l)=>jn(l.path)));n.push(...Hr("allow",["file-read*"],s,t));let a=bS(e);if(n.push(...Hr("deny",["file-read*"],new Set(a.filters),t)),r||a.coversRoot)n.push('(allow file-read* (literal "/"))');if(e.denies.length>0)n.push("(allow file-read-metadata"," (vnode-type DIRECTORY))");n.push(...Tp(e.denies.map((l)=>l.path),t));let o=new Set(e.writeRoots.map((l)=>jn(l.path)));return n.push(...Hr("allow",["file-write-unlink","file-write-create"],o,t)),n}function wS(e,t,n=!1){if(!e)return["(allow file-write*)"];let r=[],i=new Set;for(let o of e.allowOnly||[])i.add(jn(it(o)));r.push(...Hr("allow",["file-write*"],i,t));let s=[...e.denyWithinAllow||[],...vS(n)],a=new Set;for(let o of s)a.add(gn(it(o)));return r.push(...Hr("deny",["file-write*"],a,t)),r.push(...Tp(s,t)),r}function TS({readConfig:e,writeConfig:t,httpProxyPort:n,socksProxyPort:r,needsNetworkRestriction:i,allowUnixSockets:s,allowAllUnixSockets:a,allowLocalBinding:o,allowMachLookup:l,allowPty:c,allowGitConfig:u=!1,enableWeakerNetworkIsolation:d=!1,allowAppleEvents:f=!1,logTag:y}){let p=["(version 1)",`(deny default (with message "${y}"))`,"",`; LogTag: ${y}`,"","; Essential permissions - based on Chrome sandbox policy","; Process permissions","(allow process-exec)","(allow process-fork)","(allow process-info* (target same-sandbox))","(allow signal (target same-sandbox))","(allow mach-priv-task-port (target same-sandbox))","","; User preferences","(allow user-preference-read)","","; Mach IPC - specific services only (no wildcard)","(allow mach-lookup",' (global-name "com.apple.audio.systemsoundserver")',' (global-name "com.apple.distributed_notifications@Uv3")',' (global-name "com.apple.FontObjectsServer")',' (global-name "com.apple.fonts")',' (global-name "com.apple.logd")',' (global-name "com.apple.lsd.mapdb")',' (global-name "com.apple.PowerManagement.control")',' (global-name "com.apple.system.logger")',' (global-name "com.apple.system.notification_center")',' (global-name "com.apple.system.opendirectoryd.libinfo")',' (global-name "com.apple.system.opendirectoryd.membership")',' (global-name "com.apple.bsd.dirhelper")',' (global-name "com.apple.securityd.xpc")',' (global-name "com.apple.coreservices.launchservicesd")',")","",...d?["; trustd.agent - needed for Go TLS certificate verification (weaker network isolation)",'(allow mach-lookup (global-name "com.apple.trustd.agent"))']:[],...f?["; Apple Events - opt-in; needed for open/osascript to talk to other apps (appleeventsd)","(allow appleevent-send)",'(allow mach-lookup (global-name "com.apple.coreservices.appleevents"))',"; Launch Services open requests need the lsopen operation plus, on","; macOS 14/15, coreservicesd and the quarantine resolver - without","; these open fails with -10822 kLSServerCommunicationErr or -54","(allow lsopen)",'(allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))','(allow mach-lookup (global-name "com.apple.coreservices.quarantine-resolver"))']:[],...l&&l.length>0?["; User-specified XPC/Mach services",...l.map((x)=>x.endsWith("*")?`(allow mach-lookup (global-name-prefix ${Xt(x.slice(0,-1))}))`:`(allow mach-lookup (global-name ${Xt(x)}))`)]:[],"","; POSIX IPC - shared memory","(allow ipc-posix-shm)","","; POSIX IPC - semaphores for Python multiprocessing","(allow ipc-posix-sem)","","; IOKit - specific operations only","(allow iokit-open",' (iokit-registry-entry-class "IOSurfaceRootUserClient")',' (iokit-registry-entry-class "RootDomainUserClient")',' (iokit-user-client-class "IOSurfaceSendRight")',")","","; IOKit properties","(allow iokit-get-properties)","","; Specific safe system-sockets, doesn't allow network access","(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))","","; sysctl - specific sysctls only","(allow sysctl-read",' (sysctl-name "hw.activecpu")',' (sysctl-name "hw.busfrequency_compat")',' (sysctl-name "hw.byteorder")',' (sysctl-name "hw.cacheconfig")',' (sysctl-name "hw.cachelinesize_compat")',' (sysctl-name "hw.cpufamily")',' (sysctl-name "hw.cpufrequency")',' (sysctl-name "hw.cpufrequency_compat")',' (sysctl-name "hw.cputype")',' (sysctl-name "hw.l1dcachesize_compat")',' (sysctl-name "hw.l1icachesize_compat")',' (sysctl-name "hw.l2cachesize_compat")',' (sysctl-name "hw.l3cachesize_compat")',' (sysctl-name "hw.logicalcpu")',' (sysctl-name "hw.logicalcpu_max")',' (sysctl-name "hw.machine")',' (sysctl-name "hw.memsize")',' (sysctl-name "hw.ncpu")',' (sysctl-name "hw.nperflevels")',' (sysctl-name "hw.packages")',' (sysctl-name "hw.pagesize_compat")',' (sysctl-name "hw.pagesize")',' (sysctl-name "hw.physicalcpu")',' (sysctl-name "hw.physicalcpu_max")',' (sysctl-name "hw.tbfrequency_compat")',' (sysctl-name "hw.vectorunit")',' (sysctl-name "kern.argmax")',' (sysctl-name "kern.bootargs")',' (sysctl-name "kern.hostname")',' (sysctl-name "kern.maxfiles")',' (sysctl-name "kern.maxfilesperproc")',' (sysctl-name "kern.maxproc")',' (sysctl-name "kern.ngroups")',' (sysctl-name "kern.osproductversion")',' (sysctl-name "kern.osrelease")',' (sysctl-name "kern.ostype")',' (sysctl-name "kern.osvariant_status")',' (sysctl-name "kern.osversion")',' (sysctl-name "kern.secure_kernel")',' (sysctl-name "kern.tcsm_available")',' (sysctl-name "kern.tcsm_enable")',' (sysctl-name "kern.usrstack64")',' (sysctl-name "kern.version")',' (sysctl-name "kern.willshutdown")',' (sysctl-name "machdep.cpu.brand_string")',' (sysctl-name "machdep.ptrauth_enabled")',' (sysctl-name "security.mac.lockdown_mode_state")',' (sysctl-name "sysctl.proc_cputype")',' (sysctl-name "vm.loadavg")',' (sysctl-name-prefix "hw.optional.arm")',' (sysctl-name-prefix "hw.optional.arm.")',' (sysctl-name-prefix "hw.optional.armv8_")',' (sysctl-name-prefix "hw.perflevel")',' (sysctl-name-prefix "kern.proc.all")',' (sysctl-name-prefix "kern.proc.pgrp.")',' (sysctl-name-prefix "kern.proc.pid.")',' (sysctl-name-prefix "machdep.cpu.")',' (sysctl-name-prefix "net.routetable.")',")","","; V8 thread calculations","(allow sysctl-write",' (sysctl-name "kern.tcsm_enable")',")","","; Distributed notifications","(allow distributed-notification-post)","","; Specific mach-lookup permissions for security operations",'(allow mach-lookup (global-name "com.apple.SecurityServer"))',"","; File I/O on device files",'(allow file-ioctl (literal "/dev/null"))','(allow file-ioctl (literal "/dev/zero"))','(allow file-ioctl (literal "/dev/random"))','(allow file-ioctl (literal "/dev/urandom"))','(allow file-ioctl (literal "/dev/dtracehelper"))','(allow file-ioctl (literal "/dev/tty"))',"","(allow file-ioctl file-read-data file-write-data"," (require-all",' (literal "/dev/null")'," (vnode-type CHARACTER-DEVICE)"," )",")",""];if(p.push("; Network"),!i)p.push("(allow network*)");else{if(o)p.push('(allow network-bind (local ip "*:*"))'),p.push('(allow network-inbound (local ip "*:*"))'),p.push('(allow network-outbound (remote ip "localhost:*"))');if(a)p.push("(allow system-socket (socket-domain AF_UNIX))"),p.push('(allow network-bind (local unix-socket (path-regex #"^/")))'),p.push('(allow network-outbound (remote unix-socket (path-regex #"^/")))');else if(s&&s.length>0){p.push("(allow system-socket (socket-domain AF_UNIX))");for(let x of s){let b=it(x);p.push(`(allow network-bind (local unix-socket (subpath ${Xt(b)})))`),p.push(`(allow network-outbound (remote unix-socket (subpath ${Xt(b)})))`)}}if(n!==void 0)p.push(`(allow network-bind (local ip "localhost:${n}"))`),p.push(`(allow network-inbound (local ip "localhost:${n}"))`),p.push(`(allow network-outbound (remote ip "localhost:${n}"))`);if(r!==void 0&&r!==n)p.push(`(allow network-bind (local ip "localhost:${r}"))`),p.push(`(allow network-inbound (local ip "localhost:${r}"))`),p.push(`(allow network-outbound (remote ip "localhost:${r}"))`)}p.push("");let v=e?SS(e,t?.allowOnly):void 0;if(p.push("; File read"),p.push(...ES(v,y)),p.push(""),p.push("; File write"),p.push(...wS(t,y,u)),v){let x=CS(v,y);if(x.length>0)p.push(""),p.push("; File read: keep read-denied paths inside write roots in place"),p.push(...x)}if(c)p.push(""),p.push("; Pseudo-terminal (pty) support"),p.push("(allow pseudo-tty)"),p.push("(allow file-ioctl"),p.push(' (literal "/dev/ptmx")'),p.push(' (regex #"^/dev/ttys")'),p.push(")"),p.push("(allow file-read* file-write*"),p.push(' (literal "/dev/ptmx")'),p.push(' (regex #"^/dev/ttys")'),p.push(")");return p.join(`
67
- `)}function Xt(e){return JSON.stringify(e)}function Ap(e){let{command:t,commandId:n,needsNetworkRestriction:r,httpProxyPort:i,socksProxyPort:s,proxyAuthToken:a,caCertPath:o,allowUnixSockets:l,allowAllUnixSockets:c,allowLocalBinding:u,allowMachLookup:d,readConfig:f,writeConfig:y,unsetEnvVars:p,setEnvVars:v,maskedFileBinds:x,allowPty:b,allowGitConfig:A=!1,gitSafeDirectories:E,enableWeakerNetworkIsolation:k=!1,allowAppleEvents:I=!1,binShell:R}=e,M=f;if(x&&x.length>0)C("[Sandbox macOS] file mask degrades to deny on macOS until the interposer lands"),M={denyOnly:[...f?.denyOnly??[],...x.map((ce)=>ce.realPath)],allowWithinDeny:f?.allowWithinDeny};let ee=M&&M.denyOnly.length>0,O=y!==void 0,K=p!==void 0&&p.length>0||v!==void 0&&Object.keys(v).length>0,ie=(E?.length??0)>0;if(!r&&!ee&&!O&&!K&&!ie)return t;let ve=n??t,we=xS(ve),nt=TS({readConfig:M,writeConfig:y,httpProxyPort:i,socksProxyPort:s,needsNetworkRestriction:r,allowUnixSockets:l,allowAllUnixSockets:c,allowLocalBinding:u,allowMachLookup:d,allowPty:b,allowGitConfig:A,enableWeakerNetworkIsolation:k,allowAppleEvents:I,logTag:we}),_e=Cn(i,s,o,a,y===void 0,Nt(ve));if(u&&r){let Pe=(p??[]).includes("JAVA_TOOL_OPTIONS")?"":process.env.JAVA_TOOL_OPTIONS??"",Fe=Pe.includes("-Djava.net.preferIPv4Stack=true")?Pe:[Pe,"-Djava.net.preferIPv4Stack=true"].filter(Boolean).join(" ");_e.push(`JAVA_TOOL_OPTIONS=${Fe}`)}if(E&&E.length>0){let ce=ms({safeDirs:E,unsetEnvVars:p,setEnvVars:v});for(let[Z,Pe]of Object.entries(ce))_e.push(`${Z}=${Pe}`)}let Ve=R||"bash",V=br(Ve);if(!V)throw Error(`Shell '${Ve}' not found in PATH`);let te=(p??[]).flatMap((ce)=>["-u",ce]),Q=Object.entries(v??{}).map(([ce,Z])=>`${ce}=${Z}`),ue=kt(["env",...te,...Q,..._e,"/usr/bin/sandbox-exec","-p",nt,V,"-c",t]);return C(`[Sandbox macOS] Applied restrictions - network: ${!!(i||s)}, read: ${M?"allowAllExcept"in M?"allowAllExcept":"denyAllExcept":"none"}, write: ${y?"allowAllExcept"in y?"allowAllExcept":"denyAllExcept":"none"}`),ue}function _p(e,t,n=(r)=>r){let r=/CMD64_(.+?)_END/,i=/Sandbox:\s+(.+)$/,s=yS("log",["stream","--predicate",`(eventMessage ENDSWITH "${bp}")`,"--style","compact"]);return s.stdout?.on("data",(a)=>{let o=a.toString().split(`
68
- `),l=o.find((p)=>p.includes("Sandbox:")&&p.includes("deny")),c=o.find((p)=>p.startsWith("CMD64_"));if(!l)return;let u=l.match(i);if(!u?.[1])return;let d=u[1],f,y;if(c){if(y=c.match(r)?.[1],y)try{f=n(en(y))}catch{}}if(d.includes("mDNSResponder")||d.includes("mach-lookup com.apple.diagnosticd")||d.includes("mach-lookup com.apple.analyticsd"))return;if(Gn(d,f,t))return;e({line:d,command:f,encodedCommand:y,timestamp:new Date})}),s.stderr?.on("data",(a)=>{C(`[Sandbox Monitor] Log stream stderr: ${a.toString()}`)}),s.on("error",(a)=>{C(`[Sandbox Monitor] Failed to start log stream: ${a.message}`)}),s.on("exit",(a)=>{C(`[Sandbox Monitor] Log stream exited with code: ${a}`)}),()=>{C("[Sandbox Monitor] Stopping log monitor"),s.kill("SIGTERM")}}import{randomBytes as AS}from"crypto";import{chmodSync as kp,chownSync as _S,mkdtempSync as kS,rmSync as IS}from"fs";import{createServer as RS}from"net";import{tmpdir as BS}from"os";import{join as Ip,posix as PS}from"path";import{createInterface as NS}from"readline";function Rp(e,t){let{allowWritePaths:n,denyWritePaths:r,ignoreViolations:i,resolveCommandText:s=(E)=>E,consumerUid:a,consumerGid:o}=t,l=kS(Ip(BS(),"srt-obs-")),c=Ip(l,`s${AS(4).toString("hex")}.sock`),u=(E,k)=>E===k||E.startsWith(k.endsWith("/")?k:k+"/"),d=(E)=>{let k=PS.normalize(E);if(r.some((I)=>u(k,I)))return!0;return!n.some((I)=>u(k,I))},f=(E,k)=>{if(E.observe_init_error){C(`[Sandbox Linux Monitor] observe filter not installed: ${E.observe_init_error}`);return}if(typeof E.path!=="string")return;if(!E.path.startsWith("/"))return;if(!d(E.path))return;let I;if(k)try{I=s(en(k))}catch{}if(Gn(E.path,I,i))return;let R={line:`deny ${E.syscall??"syscall"} ${E.path}`,command:I,encodedCommand:k,timestamp:new Date};e(R)},y,p=new Promise((E)=>{y=E}),v=c,x=RS((E)=>{let k,I=NS({input:E});I.on("line",(R)=>{if(!R)return;let M;try{M=JSON.parse(R)}catch{return}if(M.encodedCommand&&k===void 0)k=M.encodedCommand;f(M,k??M.encodedCommand)}),E.on("error",()=>I.close()),E.on("close",()=>I.close())});x.on("error",(E)=>{C(`[Sandbox Linux Monitor] listen failed: ${E.message} - violation monitoring disabled`,{level:"warn"}),v=void 0,y()}),x.listen(c,()=>{if(a!==void 0)kp(l,457),_S(c,a,o??a),kp(c,384);y()});let b=new Set;return x.on("connection",(E)=>{b.add(E),E.on("close",()=>b.delete(E))}),{get observeSocketPath(){return v},ready:p,stop:()=>{C("[Sandbox Linux Monitor] stopping");for(let E of b)E.destroy();x.close();try{IS(l,{recursive:!0,force:!0})}catch{}}}}import*as rt from"fs";import*as Np from"net";import*as tt from"path";import{spawn as DS,spawnSync as LS}from"child_process";import{once as OS}from"events";import{fileURLToPath as US}from"url";class xe extends Error{code;subcommand;constructor(e,t,n){super(t);this.name="WindowsSandboxError",this.code=e,this.subcommand=n}}var wa=[60080,60089],Bp=["-NoProfile","-Command"];function Ta(e){let t=process.env.SystemRoot??"C:\\Windows",n={exe:tt.win32.join(t,"System32","cmd.exe"),args:["/d","/s","/c"]};if(e===void 0||e===null)return n;if(typeof e==="object"){if(!tt.win32.isAbsolute(e.exe))throw new xe("bin_shell_invalid",`binShell.exe must be an absolute path (got ${JSON.stringify(e.exe)})`);if(!Array.isArray(e.args))throw new xe("bin_shell_invalid",`binShell.args must be an array (got ${JSON.stringify(e.args)})`);return e}let r=tt.win32.basename(e),i=r.toLowerCase(),s=tt.win32.isAbsolute(e);if(!s&&e!==r)throw new xe("bin_shell_invalid",`binShell string must be a bare token or an absolute path (got ${JSON.stringify(e)})`);switch(i){case"bash":case"bash.exe":case"sh":case"sh.exe":if(!s)throw new xe("bin_shell_invalid",`binShell bash path must be absolute (got ${JSON.stringify(e)}); pass the resolved Git Bash install path`);return{exe:e,args:["-c"]};case"pwsh":case"pwsh.exe":return{exe:s?e:"pwsh.exe",args:Bp};case"powershell":case"powershell.exe":return{exe:s?e:tt.win32.join(t,"System32","WindowsPowerShell","v1.0","powershell.exe"),args:Bp};case"cmd":case"cmd.exe":return s?{exe:e,args:n.args}:n;default:throw new xe("bin_shell_invalid",`unrecognised binShell ${JSON.stringify(e)}: expected 'cmd' | 'powershell' | 'pwsh' or an absolute path to bash.exe/sh.exe/pwsh.exe/powershell.exe`)}}function Dp(){let e=tt.dirname(US(import.meta.url));return tt.resolve(e,"..","..")}var Lp={x64:"x64",arm64:"arm64"},VS=tt.join(Dp(),"vendor","srt-win",Lp[process.arch]??process.arch,"srt-win.exe");function FS(){let e=Dp(),t=Lp[process.arch],n=[];if(t)n.push(tt.join(e,"vendor","srt-win",t,"srt-win.exe"));n.push(tt.join(e,"vendor","srt-win-src","target","release","srt-win.exe"));for(let r of n)if(rt.existsSync(r))return r;throw new xe("srt_win_not_found",`srt-win.exe not found. Set windows.srtWin.path or build with \`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. Looked in: ${n.join(", ")}`)}var Op="--srt-win";function Bt(e){if(e?.path===void 0)throw new xe("srt_win_not_found","no srt-win path configured; set windows.srtWin.path (e.g. to the exported VENDORED_SRT_WIN_EXE constant for the packaged binary)");if(!rt.existsSync(e.path))throw new xe("srt_win_not_found",`windows.srtWin.path is set to '${e.path}' but the file does not exist`);return{exe:e.path,prependArgs:[Op]}}function Kr(e,t={}){let{exe:n,prependArgs:r}=t.srtWin??Bt(),i=LS(n,[...r,...e],{encoding:"utf8",windowsHide:!0,timeout:t.timeoutMs??15000,...t.stdin!==void 0?{input:t.stdin}:{}});if(i.error){if(i.error.code==="ETIMEDOUT")throw new xe("srt_win_timeout",`srt-win ${e.join(" ")} timed out after ${t.timeoutMs??15000}ms`+(i.signal?` (killed by ${i.signal})`:""),e[0]);throw new xe("spawn_failed",`srt-win ${e[0]}: spawn failed: ${i.error.message}`,e[0])}return{status:i.status,signal:i.signal,stdout:(i.stdout??"").trim(),stderr:(i.stderr??"").trim()}}function Zl(e,t={}){let{exe:n,prependArgs:r}=t.srtWin??Bt(),i=t.timeoutMs??15000;return new Promise((s,a)=>{let o=DS(n,[...r,...e],{windowsHide:!0}),l=!1,c=i>0?setTimeout(()=>{l=!0,o.kill()},i):void 0,u="",d="";o.stdout?.setEncoding("utf8").on("data",(f)=>u+=f),o.stderr?.setEncoding("utf8").on("data",(f)=>d+=f),o.stdin?.on("error",()=>{}).end(t.stdin),o.once("error",(f)=>{clearTimeout(c),a(new xe("spawn_failed",`srt-win ${e[0]}: spawn failed: ${f.message}`,e[0]))}),o.once("close",(f,y)=>{if(clearTimeout(c),l){a(new xe("srt_win_timeout",`srt-win ${e.join(" ")} timed out after ${i}ms`+(y?` (killed by ${y})`:""),e[0]));return}s({status:f,signal:y,stdout:u.trim(),stderr:d.trim()})})})}function Up(e,t){if(t.status!==0)throw new xe("srt_win_nonzero",`srt-win ${e.join(" ")} exited ${t.status}: ${t.stderr||t.stdout}`,e[0]);try{return JSON.parse(t.stdout)}catch(n){throw new xe("srt_win_bad_json",`srt-win ${e.join(" ")}: unparseable JSON output ${JSON.stringify(t.stdout)}: ${n.message}`,e[0])}}function ec(e,t){return Up(e,Kr(e,t))}async function tc(e,t){return Up(e,await Zl(e,t))}function Vp(e,t){let n=Kr(e,t),r;try{r=JSON.parse(n.stdout)}catch(i){throw new xe("srt_win_bad_json",`srt-win ${e.join(" ")}: unparseable JSON output ${JSON.stringify(n.stdout)}: ${i.message}`,e[0])}return{ok:n.status===0,json:r,stderr:n.stderr}}function Fp(e){let t=["wfp","status"];if(e)t.push("--sublayer-guid",e);return t}function Aa(e){return{state:e.state,filters:e.filters,...e.port_range&&{portRange:e.port_range},...e.user_sid&&{userSid:e.user_sid},...e.hint&&{hint:e.hint}}}function _a(e){return{provisioned:e.user.exists,...e.user.sid&&{sid:e.user.sid},groupExists:e.user.group_exists,...e.user.group_sid&&{groupSid:e.user.group_sid},inBuiltinUsers:e.user.in_builtin_users,inSandboxGroup:e.user.in_sandbox_group,hiddenFromLogon:e.user.hidden_from_logon,credPresent:e.cred_present,...typeof e.marker_version==="number"&&{markerVersion:e.marker_version},realUserSid:e.real_user_sid,...e.ca_cert_thumb&&{caCertThumb:e.ca_cert_thumb},...e.ca_cert_pem&&{caCertPem:e.ca_cert_pem}}}function Mp(e={}){let t=["status"];if(e.sublayerGuid)t.push("--sublayer-guid",e.sublayerGuid);let n=ec(t,{srtWin:e.srtWin});return{user:_a(n.user),wfp:Aa(n.wfp)}}async function Wp(e={}){let t=["status"];if(e.sublayerGuid)t.push("--sublayer-guid",e.sublayerGuid);let n=await tc(t,{srtWin:e.srtWin});return{user:_a(n.user),wfp:Aa(n.wfp)}}function $p(e={}){return Aa(ec(Fp(e.sublayerGuid),{srtWin:e.srtWin}))}async function Hp(e={}){return Aa(await tc(Fp(e.sublayerGuid),{srtWin:e.srtWin}))}async function rc(e={}){let t=e.target,n;if(!t){let[r,i]=e.proxyPortRange??wa;for(let s=0;s<5;s++){let a=Np.createServer();a.listen(0,"127.0.0.1"),await OS(a,"listening");let o=a.address().port;if(o<r||o>i){n=a,t=`127.0.0.1:${o}`;break}a.close()}if(!t)throw new xe("wfp_verify_bind_failed",`verifyWindowsWfpEgress: could not bind a loopback listener outside the WFP permit range [${r},${i}] in 5 attempts`)}try{let r=Kr(["wfp","verify","--target",t],{timeoutMs:30000,srtWin:e.srtWin});C(`[Sandbox Windows] wfp verify exit=${r.status}: ${r.stderr||r.stdout}`);let i;try{i=JSON.parse(r.stdout)}catch{throw new xe("wfp_verify_unparseable","WFP egress fence could not be verified \u2014 `srt-win wfp "+`verify\` exited ${r.status}`+(r.signal?` (signal ${r.signal})`:"")+` with unparseable output ${JSON.stringify(r.stdout)} (stderr: ${JSON.stringify(r.stderr)})`)}if(r.status===3)throw new xe("wfp_fence_inactive","WFP egress fence is not active \u2014 direct outbound from the "+`sandbox user to ${i.target} succeeded. Re-run \`srt-win install\` (one UAC prompt). (${r.stderr})`);if(r.status!==0)throw new xe("wfp_verify_inconclusive","WFP egress fence could not be verified \u2014 probe to "+`${i.target} was '${i.egress_probe}' (exit ${r.status}). The fence may be absent. Re-run \`srt-win install\`. (${r.stderr})`);return{target:i.target,stderr:r.stderr}}finally{n?.close()}}function nc(e={}){return _a(ec(["user","status"],{srtWin:e.srtWin}))}async function Fi(e={}){return _a(await tc(["user","status"],{srtWin:e.srtWin}))}function ic(e,t={}){let n=e??nc(t);if(!n.caCertThumb||!n.caCertPem)return null;return{pem:n.caCertPem,thumb:n.caCertThumb}}function MS(e,t={}){let n=Kr(["user","trust-ca",e],{timeoutMs:60000,srtWin:t.srtWin});qp(e,n)}async function Kp(e,t={}){let n=await Zl(["user","trust-ca",e],{timeoutMs:60000,srtWin:t.srtWin});qp(e,n)}function qp(e,t){if(C(`[Sandbox Windows] user trust-ca exit=${t.status}: ${t.stderr||t.stdout}`),t.status!==0)throw new xe("trust_ca_failed",`srt-win user trust-ca '${e}' failed (exit ${t.status}): ${t.stderr||t.stdout}`)}function Gp(){let e=process.env.ProgramData;if(!e)throw Error("ProgramData is not set");return tt.win32.join(e,"sandbox-runtime")}async function sc(e={}){let t=e.status??await Fi({srtWin:e.srtWin});if(!t.provisioned||!t.credPresent)throw Error(`ensurePersistentWindowsCa: sandbox user is not provisioned (user=${t.provisioned}, cred=${t.credPresent}). Run \`npx sandbox-runtime windows-install\` first.`);let n=e.dir?void 0:Gp();if(n&&!rt.existsSync(n))throw Error(`ensurePersistentWindowsCa: state directory ${n} does not exist. Run \`npx sandbox-runtime windows-install\` first.`);let r=e.dir??tt.win32.join(n,"ca"),i=tt.join(r,"ca.json"),s=tt.join(r,"cert.pem"),a=tt.join(r,"key.pem"),o=(e.regenerateWithinDays??30)*24*60*60*1000,l=(x,b)=>{let A=`${x}.tmp.${process.pid}`;rt.writeFileSync(A,b),rt.renameSync(A,x)},c=async(x,b,A,E)=>{l(s,x),l(a,b);let k=E||t.caCertThumb!==A;if(k){let I=tt.join(r,`.trust.${process.pid}.${Date.now()}.pem`);rt.writeFileSync(I,x);try{await Kp(I,{srtWin:e.srtWin})}finally{rt.rmSync(I,{force:!0})}}return C(`[Sandbox Windows] persistent CA ${E?"generated":"reused"} (thumb=${A}${k&&!E?", trust reconciled":""})`),{certPem:x,keyPem:b,certPath:s,keyPath:a,thumbprint:A,generated:E,trusted:k}},u=()=>{let x;try{x=JSON.parse(rt.readFileSync(i,"utf8"))}catch(A){C(`[Sandbox Windows] persistent CA ca.json unreadable (${A.message})`,{level:"warn"});return}if(typeof x.certPem!=="string"||typeof x.keyPem!=="string")return;let b=ki(x.certPem,x.keyPem);if(!b.ok){C(`[Sandbox Windows] persistent CA invalid (${b.reason})`,{level:"warn"});return}return{certPem:x.certPem,keyPem:x.keyPem,thumbprint:b.thumbprint,notAfter:b.notAfter}};if(!e.force){let x=u();if(x&&x.notAfter.getTime()-Date.now()>o)return await c(x.certPem,x.keyPem,x.thumbprint,!1);if(x)C(`[Sandbox Windows] persistent CA expiring ${x.notAfter.toISOString()}; regenerating`,{level:"warn"})}rt.mkdirSync(r,{recursive:!0});try{let x=Date.now()-300000;for(let b of rt.readdirSync(r)){if(!b.includes(".tmp.")&&!b.startsWith(".trust."))continue;let A=tt.join(r,b);if(rt.statSync(A).mtimeMs<x)rt.rmSync(A,{force:!0})}}catch{}let d=Js({cn:"sandbox-runtime persistent CA"});l(i,JSON.stringify({certPem:d.certPem,keyPem:d.keyPem}));let f=u(),{certPem:y,keyPem:p,thumbprint:v}=f??{certPem:d.certPem,keyPem:d.keyPem,thumbprint:Wn(d.certPem)};return await c(y,p,v,!0)}function ac(e){return e.timeoutMs??120000}function jp(e){let t=["install"];if(e.sublayerGuid)t.push("--sublayer-guid",e.sublayerGuid);if(e.proxyPortRange)t.push("--proxy-port-range",`${e.proxyPortRange[0]}-${e.proxyPortRange[1]}`);if(e.sandboxUser)t.push("--sandbox-user",e.sandboxUser);if(e.force)t.push("--force");return t}function zp(e){if(e instanceof xe&&e.code==="srt_win_timeout")throw new xe("install_timeout","srt-win install timed out \u2014 the UAC prompt may still be open. "+`Re-run when ready to grant elevation. (${e.message})`);throw e}function Qp(e){if(C(`[Sandbox Windows] install exit=${e.status}: ${e.stderr||e.stdout}`),e.status===0||e.status===10)return;let t=e.stderr||e.stdout;switch(e.status){case 12:throw new xe("install_wfp_failed",`srt-win install: WFP filter install failed: ${t}`);case 14:throw new xe("install_user_failed",`srt-win install: sandbox user provisioning failed: ${t}`);case 13:throw new xe("install_config_conflict",`srt-win install: filters already exist under this sublayer with a different port range or sandbox-user name. Pass {force: true} to replace, or pick a different sublayerGuid. Output: ${t}`);case 17:throw new xe("install_ambient_failed",`srt-win install: ambient write-deny stamping failed (stock world-writable system dirs could not be deny-stamped for the sandbox user): ${t}`);default:throw new xe("install_failed",`srt-win install failed (exit ${e.status}): ${t}`)}}function WS(e={}){let t=e.srtWin??Bt(),n;try{n=Kr(jp(e),{timeoutMs:ac(e),srtWin:t})}catch(i){zp(i)}Qp(n);let r=Mp({sublayerGuid:e.sublayerGuid,srtWin:t});return n.status===10?{...r,cancelled:!0}:r}async function $S(e={}){let t=e.srtWin??Bt(),n;try{n=await Zl(jp(e),{timeoutMs:ac(e),srtWin:t})}catch(i){zp(i)}Qp(n);let r=await Wp({sublayerGuid:e.sublayerGuid,srtWin:t});return n.status===10?{...r,cancelled:!0}:r}function HS(e={}){let t=["uninstall"];if(e.sublayerGuid)t.push("--sublayer-guid",e.sublayerGuid);if(e.keepUser)t.push("--keep-user");let n=Kr(t,{timeoutMs:ac(e),srtWin:e.srtWin});if(C(`[Sandbox Windows] uninstall exit=${n.status}: ${n.stderr||n.stdout}`),n.status===10)return{cancelled:!0};if(n.status!==0)throw new xe("uninstall_failed",`srt-win uninstall failed (exit ${n.status}): ${n.stderr||n.stdout}`);return{}}function ka(e,t){let n=new Set;for(let r of e){let i=it(r),s=li(i);if(ci(i)&&!s){n.add(i);continue}let a=s?tn(i,{caseInsensitive:!0}):[i];for(let o of a){if(!rt.statSync(o,{throwIfNoEntry:!1})){if(t?.mode==="deny"&&!s)n.add(/[\\/]$/.test(r)&&!/[\\/]$/.test(o)?o+"\\":o);continue}n.add(o)}}return[...n]}function KS(e){for(let t of e.split(/\r?\n/)){let n=t.trim();if(!n.startsWith("{")||!n.includes('"code"'))continue;try{let r=JSON.parse(n);if(r.code==="mapped_drive_cwd")return Object.assign(new xe("mapped_drive_cwd",r.message??"mapped/network-drive working directory","exec"),{drive:r.drive})}catch{}}return}function oc(e){let t=e.holderPid??process.pid,n=JSON.stringify({denyRead:e.denyRead,denyWrite:e.denyWrite}),r=Kr(["acl","stamp","--holder-pid",`${t}`,"--sandbox-user-sid",e.sandboxUserSid],{timeoutMs:60000,stdin:n,srtWin:e.srtWin});if(C(`[Sandbox Windows] acl stamp exit=${r.status}: ${r.stderr||r.stdout}`),r.status!==0)throw new xe("acl_stamp_failed",`srt-win acl stamp exited ${r.status} `+(r.status===2?"(partial \u2014 some inputs skipped)":"(failed)")+`: ${r.stderr||r.stdout}`)}function Ia(e){let t=e.holderPid??process.pid;try{let n=Vp(["acl","restore","--holder-pid",`${t}`,"--sandbox-user-sid",e.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:e.srtWin});if(!n.ok)C(`[Sandbox Windows] acl restore exited non-zero (per-path outcomes preserved): ${n.stderr}`,{level:"error"});return Array.isArray(n.json)?n.json:[...n.json.paths??[],...n.json.parents??[]]}catch(n){C(`[Sandbox Windows] acl restore: ${n.message}`,{level:"error"});return}}function lc(e){let t=e.holderPid??process.pid,n=JSON.stringify({read:e.read,write:e.write}),r=Kr(["acl","grant","--holder-pid",`${t}`,"--sandbox-user-sid",e.sandboxUserSid],{timeoutMs:60000,stdin:n,srtWin:e.srtWin});if(C(`[Sandbox Windows] acl grant exit=${r.status}: ${r.stderr||r.stdout}`),r.status!==0)throw new xe("acl_grant_failed",`srt-win acl grant exited ${r.status}: ${r.stderr||r.stdout}`)}function Ra(e){let t=e.holderPid??process.pid;try{let n=Vp(["acl","revoke","--holder-pid",`${t}`,"--sandbox-user-sid",e.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:e.srtWin});if(!n.ok)C(`[Sandbox Windows] acl revoke exited non-zero: ${n.stderr}`,{level:"error"});return n.json}catch(n){C(`[Sandbox Windows] acl revoke: ${n.message}`,{level:"error"});return}}function Xp(e){let{exe:t,prependArgs:n}=e.srtWin??Bt(),r=qS(Cn(e.httpProxyPort,e.socksProxyPort,e.caCertPath?.replace(/\\/g,"/"),e.proxyAuthToken,void 0,Nt(e.commandId??e.command)));delete r.TMPDIR,delete r.NO_PROXY,delete r.no_proxy;let i=ui({safeDirs:[e.cwd??process.cwd(),...e.allowWrite??[],...e.gitSafeDirectories??[]],schannelCa:e.caCertPath!==void 0,baseEnv:e.setEnvVars}),s=[t,...n,"exec"];if(e.quiet!==!1)s.push("--quiet");for(let u of e.denyRead??[])s.push("--deny-read",u);for(let u of e.denyWrite??[])s.push("--deny-write",u);let a={PATH:process.env.PATH,PATHEXT:process.env.PATHEXT,...e.setEnvVars??{},...r,...i};for(let[u,d]of Object.entries(a))if(d!==void 0)s.push("--env",`${u}=${d}`);s.push("--");let o=e.binShell??Ta(void 0);s.push(o.exe,...o.args,e.command);let l=s.reduce((u,d)=>u+d.length+3,0);if(l>30000)throw new xe("argv_too_long",`Windows sandbox argv is ~${l} chars (CreateProcessW limit is 32 767).`);let c={...process.env,...r};return{argv:s,env:c}}function qS(e){let t={};for(let n of e){let r=n.indexOf("=");if(r===-1)continue;t[n.slice(0,r)]=n.slice(r+1)}return t}function Jl(e){let t=e?` --sublayer-guid ${e}`:"";return`Windows sandbox needs a one-time install (one UAC prompt):
65
+ `):void 0}function gS(e){try{let t=Y.lstatSync(e);return t.isFile()&&t.size===0}catch{return!1}}var Cr=0,mp=!1;function xa(){if(mp)return;process.on("exit",()=>{Ca({force:!0})}),mp=!0}function Ca(e){if(!e?.force){if(Cr>0)Cr--;if(Cr>0){C(`[Sandbox Linux] Deferring mount point cleanup \u2014 ${Cr} sandbox(es) still active`);return}}else Cr=0;let t=[],n=[];for(let s of Fi)try{let a=Y.statSync(s);if(a.isFile()&&a.size===0)t.push(s);else if(a.isDirectory())n.push(s)}catch{}let r=(s)=>s.split("/").length;n.sort((s,a)=>r(a)-r(s));let i=Hl([...t,...n],(s)=>{try{let a=Y.statSync(s);if(a.isFile()&&a.size===0)Y.unlinkSync(s),C(`[Sandbox Linux] Cleaned up bwrap mount point (file): ${s}`);else if(a.isDirectory()){if(Y.readdirSync(s).length!==0)return;Y.rmdirSync(s),C(`[Sandbox Linux] Cleaned up bwrap mount point (dir): ${s}`)}}catch{}});Fi.clear();for(let s of i)Fi.add(s);for(let s of ba)try{Y.rmSync(s,{recursive:!0,force:!0})}catch{}ba.clear(),Vi=void 0}function yp(e){try{return Y.accessSync(e,Y.constants.X_OK),!0}catch{return!1}}function xp(e){let{seccompConfig:t,bwrapPath:n,socatPath:r}=e??{},i=[],s=[];if(n){if(!yp(n))i.push(`bubblewrap (bwrap) not executable at ${n}`)}else if(br("bwrap")===null)i.push("bubblewrap (bwrap) not installed");if(r){if(!yp(r))i.push(`socat not executable at ${r}`)}else if(br("socat")===null)i.push("socat not installed");if(!t?.argv0&&Ol(t?.applyPath)===null)s.push("seccomp not available - unix socket access not restricted");return{warnings:s,errors:i}}async function Sp(e,t,n,r,i){let s=n??"socat",a=sS(8).toString("hex"),o=pp(Sa(),`claude-http-${a}.sock`),l=pp(Sa(),`claude-socks-${a}.sock`),c=[`UNIX-LISTEN:${o},fork,reuseaddr`,`TCP:localhost:${e},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];C(`Starting HTTP bridge: ${s} ${c.join(" ")}`);let u=fp(s,c,{stdio:"ignore"});if(u.on("error",(p)=>{C(`HTTP bridge process error: ${p}`,{level:"error"})}),u.on("exit",(p,v)=>{C(`HTTP bridge process exited with code ${p}, signal ${v}`,{level:p===0?"info":"error"})}),!u.pid)throw Error("Failed to start HTTP bridge process");let d,f;if(t===e)d=u,f=o;else{f=l;let p=[`UNIX-LISTEN:${l},fork,reuseaddr`,`TCP:localhost:${t},keepalive,keepidle=10,keepintvl=5,keepcnt=3`];if(C(`Starting SOCKS bridge: ${s} ${p.join(" ")}`),d=fp(s,p,{stdio:"ignore"}),d.on("error",(v)=>{C(`SOCKS bridge process error: ${v}`,{level:"error"})}),d.on("exit",(v,x)=>{C(`SOCKS bridge process exited with code ${v}, signal ${x}`,{level:v===0?"info":"error"})}),!d.pid){if(u.pid)try{process.kill(u.pid,"SIGTERM")}catch{}throw Error("Failed to start SOCKS bridge process")}}let y=200;for(let p=0;p<y;p++){if(!u.pid||u.killed||!d.pid||d.killed)throw Error("Linux bridge process died unexpectedly");try{if(Y.existsSync(o)&&Y.existsSync(f)){if(r!==void 0){let v=i??r;for(let x of new Set([o,f]))Y.chownSync(x,r,v),Y.chmodSync(x,384)}C(`Linux bridges ready after ${p+1} attempts`);break}}catch(v){C(`Error checking sockets (attempt ${p+1}): ${v}`,{level:"error"})}if(p===y-1){if(u.pid)try{process.kill(u.pid,"SIGTERM")}catch{}if(d.pid)try{process.kill(d.pid,"SIGTERM")}catch{}throw Error(`Failed to create bridge sockets after ${y} attempts`)}await new Promise((v)=>setTimeout(v,5))}return{httpSocketPath:o,socksSocketPath:f,httpBridgeProcess:u,socksBridgeProcess:d,httpProxyPort:e,socksProxyPort:t}}function mS(e,t){if(t){if(!e)throw Error("seccompConfig.argv0 requires seccompConfig.applyPath");return`ARGV0=${kt([t])} ${kt([e])} `}let n=Ol(e);return n?`${kt([n])} `:void 0}function Gl(e,t,n){if(n===void 0)return[e,"-c",t];return[e,"-c",`${bp(n)}; exec "$0" "$@"`,e,"-c",t]}function bp(e){if(!Number.isSafeInteger(e)||e<3||e>9)throw Error("bad_start_fd");return`printf . >&${e}; exec ${e}>&-`}function yS(e,t,n,r,i,s,a){let o=i||"bash",l=kt([s??"socat"]),c=a===void 0?"":` ${a}>&-`,u=["srt_payload_pid=",`${l} TCP4-LISTEN:3128,bind=127.0.0.1,fork,reuseaddr ${kt([`UNIX-CONNECT:${e}`])} >/dev/null 2>&1${c} &`,"srt_http_proxy_pid=$!",`${l} TCP4-LISTEN:1080,bind=127.0.0.1,fork,reuseaddr ${kt([`UNIX-CONNECT:${t}`])} >/dev/null 2>&1${c} &`,"srt_socks_proxy_pid=$!","srt_cleanup_command() {"," srt_status=$?"," trap - EXIT INT TERM",' if [ -n "$srt_payload_pid" ]; then',' kill -KILL "$srt_payload_pid" 2>/dev/null',' wait "$srt_payload_pid" 2>/dev/null'," fi",' kill -KILL "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null',' wait "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null',' exit "$srt_status"',"}","trap srt_cleanup_command EXIT","trap 'exit 143' TERM","trap 'exit 130' INT",...[3128,1080].flatMap((y)=>[`${l} -u OPEN:/dev/null TCP4:127.0.0.1:${y},connect-timeout=0.1,retry=480,interval=0.005 >/dev/null 2>&1${c} &`,`srt_ready_${y}_pid=$!`]),`wait "$srt_ready_3128_pid" && wait "$srt_ready_1080_pid" || { printf '%s\\n' 'Sandbox proxy listener readiness failed' >&2; exit 1; }`,`kill -0 "$srt_http_proxy_pid" "$srt_socks_proxy_pid" 2>/dev/null || { printf '%s\\n' 'Sandbox proxy listener exited before command' >&2; exit 1; }`],d=r===void 0&&a!==void 0?`{ ${bp(a)}; trap '' INT QUIT; exec ${kt([o,"-c",n])}; }`:(r??"")+kt(Gl(o,n,a));return[...u,`${d} <&0 &`,"srt_payload_pid=$!",'wait "$srt_payload_pid"',"srt_payload_status=$?","srt_payload_pid=",'exit "$srt_payload_status"'].join(`
66
+ `)}function ql(e){try{if(Y.lstatSync(e).isSymbolicLink())return Y.realpathSync(e)}catch{}return e}function vp(e,t,n,r){let i=t==="/"?"/":t+"/";e.push("--tmpfs",t);for(let s of n)if(s.startsWith(i)||s===t)e.push("--bind",s,s),C(`[Sandbox Linux] Re-bound write path wiped by denyRead tmpfs: ${s}`);for(let s of r)if(s.startsWith(i)||s===t){if(!Y.existsSync(s)){C(`[Sandbox Linux] Skipping non-existent read allow path: ${s}`);continue}if(n.some((a)=>(a.startsWith(i)||a===t)&&(s===a||s.startsWith(a+"/"))))continue;e.push("--ro-bind",s,s),C(`[Sandbox Linux] Re-allowed read access within denied region: ${s}`)}}async function vS(e,t,n,r,i={command:"rg"},s=jl,a=!1,o,l,c=[]){let u=[],d=[],f=[],y=new Set,p=new Map,v=new Map;if(t){u.push("--ro-bind","/","/");for(let V of t.allowOnly||[]){let te=it(V).replace(/\/+$/,"")||"/";if(C(`[Sandbox Linux] Processing write path: ${V} -> ${te}`),te.startsWith("/dev/")){C(`[Sandbox Linux] Skipping /dev path: ${te}`);continue}if(!Y.existsSync(te)){C(`[Sandbox Linux] Skipping non-existent write path: ${te}`);continue}try{let Q=Y.realpathSync(te),ue=te.replace(/\/+$/,"");if(Q!==ue&&gs(te,Q)){C(`[Sandbox Linux] Skipping symlink write path pointing outside expected location: ${V} -> ${Q}`);continue}}catch{C(`[Sandbox Linux] Skipping write path that could not be resolved: ${te}`);continue}u.push("--bind",te,te),d.push(te)}let O,K=()=>{if(O!==void 0)return O;let V=[];for(let Q of d){V.push(Q);try{let ue=Y.realpathSync(Q);if(ue!==Q)V.push(ue)}catch{}}let te=[];if(e){let Q=[],ue=new Set(["proc","dev","sys"]);for(let ce of e.denyOnly||[])if(it(ce)==="/")try{for(let Z of Y.readdirSync("/"))if(!ue.has(Z))Q.push("/"+Z)}catch{}else Q.push(ce);if(Y.existsSync("/etc/ssh/ssh_config.d"))Q.push("/etc/ssh/ssh_config.d");for(let ce of Q){let Z=it(ce),Pe=!1;try{Pe=Y.statSync(Z).isDirectory()}catch{continue}if(!Pe)continue;te.push(Z);try{let Fe=Y.realpathSync(Z);if(Fe!==Z)te.push(Fe)}catch{}}}return O={allowedWritePathsBothForms:V,prospectiveReadDenyTmpfsDirsBothForms:te},O},ie=(V)=>d.some((te)=>V.startsWith(te+"/")||V===te),ve=[...t.denyWithinAllow||[],...await uS(i,s,a,o)];rp();let we=new Set;for(let V of ve){let te=it(V);if(te.startsWith("/dev/"))continue;let Q=hp(te);if(Q===null||Q.startsWith("/dev/"))continue;if(Kl(Q,d))continue;let ue=!1;try{ue=Y.statSync(Q).isDirectory()}catch{continue}if(!ue)continue;if(ie(Q)){let ce=p.get(Q);if(ce===void 0)ce=new Set,p.set(Q,ce);ce.add(te)}}let nt=new Map,_e=(V)=>{let te=nt.get(V);if(te!==void 0)return te;let{allowedWritePathsBothForms:Q,prospectiveReadDenyTmpfsDirsBothForms:ue}=K(),ce=Q.some((Z)=>Z.startsWith(V+"/"))||ue.some((Z)=>Z===V||Z.startsWith(V+"/"))||ue.some((Z)=>[V,...p.get(V)??[]].some((Pe)=>Pe===Z||Pe.startsWith(Z+"/")));return nt.set(V,ce),ce},Ve=[...p.keys()];for(let V of ve){let te=it(V);if(te.startsWith("/dev/"))continue;let Q=hp(te);if(Q===null){let Z=Kl(te,d);if(Z&&!we.has(Z))we.add(Z),f.push("--ro-bind","/dev/null",Z),v.set(Z,te);C(`[Sandbox Linux] Deny path could not be resolved through symlinks, failing closed: ${te}`);continue}if(Q!==te)C(`[Sandbox Linux] Resolved symlinked deny path: ${te} -> ${Q}`);if(Q.startsWith("/dev/"))continue;if(we.has(Q))continue;we.add(Q);let ue=Kl(Q,d);if(ue){if(!we.has(ue))we.add(ue),f.push("--ro-bind","/dev/null",ue),v.set(ue,te);C(`[Sandbox Linux] Mounted /dev/null at symlink ${ue} to prevent symlink replacement attack`);continue}if(!Y.existsSync(Q)){if(lS(Q)){C(`[Sandbox Linux] Skipping deny path with file ancestor (cannot create paths under a file): ${Q}`);continue}let Z=Le.dirname(Q);while(Z!=="/"&&!Y.existsSync(Z))Z=Le.dirname(Z);let Pe=ie(Z)||ie(Q),Fe=Ve.filter((Me)=>Z===Me||Z.startsWith(Me+"/")),le=Fe.length>0&&!Fe.some(_e);if(Pe&&!le){let Me=cS(Q),de=cp(Me,d)??Me;if(de!==Q){if(!y.has(de)){let qe=dp(de,l),Oe=Y.mkdtempSync(Le.join(Sa(),"claude-empty-"));if(Y.chmodSync(Oe,365),ba.add(Oe),f.push("--ro-bind",Oe,de),v.set(de,te),y.add(de),qe.kind==="unregistered")Fi.add(de);xa(),C(`[Sandbox Linux] Mounted empty dir at ${de} to block creation of ${Q}`)}}else{let qe=$l(de),Oe=gp(Q,te);if(qe.kind==="masked")f.push("--ro-bind",Oe,de),v.set(de,te),xa(),C(`[Sandbox Linux] Masked shared stub at ${de} with ${Oe} to block creation of ${Q}`);else if(qe.kind==="real")f.push("--ro-bind",de,de),v.set(de,te);else f.push("--ro-bind",Oe,de),v.set(de,te),Fi.add(de),xa(),C(`[Sandbox Linux] Mounted ${Oe} at ${de} to block creation of ${Q}`)}}else if(le)C(`[Sandbox Linux] Skipping non-existent deny path inside a read-only denied directory (already uncreatable): ${Q}`);else C(`[Sandbox Linux] Skipping non-existent deny path not within allowed paths: ${Q}`);continue}if(ie(Q)){if((gS(Q)?$l(Q):void 0)?.kind==="masked")f.push("--ro-bind",gp(Q,te),Q),xa();else f.push("--ro-bind",Q,Q);v.set(Q,te)}else C(`[Sandbox Linux] Skipping deny path not within allowed paths: ${Q}`)}}else u.push("--bind","/","/");let x=[],b=(e?.allowWithinDeny||[]).map((O)=>it(O)),A=new Map,E=[],k=new Set(["proc","dev","sys"]);for(let O of e?.denyOnly||[])if(it(O)==="/"){for(let K of Y.readdirSync("/"))if(!k.has(K))x.push("/"+K)}else x.push(O);if(e&&Y.existsSync("/etc/ssh/ssh_config.d"))x.push("/etc/ssh/ssh_config.d");let I=x.map((O)=>it(O)).sort((O,K)=>O.split("/").length-K.split("/").length);for(let O of I){if(!Y.existsSync(O)){C(`[Sandbox Linux] Skipping non-existent read deny path: ${O}`);continue}if(Y.statSync(O).isDirectory())E.push(O),vp(u,O,d,b);else{if(b.includes(O)){C(`[Sandbox Linux] Skipping read deny for re-allowed path: ${O}`);continue}let ie=ql(O);u.push("--ro-bind","/dev/null",ie),A.set(ie,"/dev/null"),A.set(O,"/dev/null")}}for(let{realPath:O,fakePath:K}of n??[]){let ie=ql(O);u.push("--ro-bind",K,ie),A.set(ie,K),A.set(O,K)}let R=(O)=>E.some((K)=>{if(!(O===K||O.startsWith(K+"/")))return!1;return!d.some((we)=>(we===K||we.startsWith(K+"/"))&&(O===we||O.startsWith(we+"/")))}),M=[...y].filter((O)=>{let K=v.get(O)??O;return!A.has(O)&&!R(O)&&!R(K)&&!d.some((ie)=>ie===O||ie.startsWith(O+"/"))}),ee=[];for(let O=0;O<f.length;O+=3){let K=f[O+2],ie=v.get(K)??K;if(A.has(K))continue;if(R(K)||R(ie)){C(`[Sandbox Linux] Skipping denyWrite bind already hidden by denyRead tmpfs: ${K}`);continue}if(M.some((ve)=>K.startsWith(ve+"/"))){C(`[Sandbox Linux] Skipping denyWrite bind under an empty-directory mask: ${K}`);continue}if(u.push(f[O],f[O+1],K),ee.push(K),f[O+1]!==K)c.push(K);if(ie!==K)ee.push(ie)}for(let O of E)if(ee.some((K)=>O.startsWith(K+"/")))C(`[Sandbox Linux] Re-applying denyRead tmpfs re-exposed by denyWrite bind: ${O}`),vp(u,O,d,b);for(let[O,K]of A)if(ee.some((ie)=>O.startsWith(ie+"/"))){if(ql(O)!==O)continue;C(`[Sandbox Linux] Re-applying file mask re-exposed by denyWrite bind: ${O}`),u.push("--ro-bind",K,O)}if(r!==void 0)u.push("--ro-bind",r,r);return u}async function Cp(e){let{command:t,commandId:n,needsNetworkRestriction:r,httpSocketPath:i,socksSocketPath:s,httpProxyPort:a,socksProxyPort:o,proxyAuthToken:l,caCertPath:c,readConfig:u,writeConfig:d,unsetEnvVars:f,setEnvVars:y,maskedFileBinds:p,maskedFileStoreDir:v,enableWeakerNestedSandbox:x,runAsUid:b,runAsGid:A,runAsHostUid:E,runAsHostGid:k,runAsHostHome:I,runAsHostUser:R,setprivPath:M,allowAllUnixSockets:ee,binShell:O,ripgrepConfig:K={command:"rg"},mandatoryDenySearchDepth:ie=jl,allowGitConfig:ve=!1,gitSafeDirectories:we,seccompConfig:nt,bwrapPath:_e,socatPath:Ve,observeSocketPath:V,startFd:te,abortSignal:Q}=e,ue=u&&u.denyOnly.length>0||p!==void 0&&p.length>0,ce=d!==void 0,Z=f!==void 0&&f.length>0||y!==void 0&&Object.keys(y).length>0,Pe=(we?.length??0)>0;if(!r&&!ue&&!ce&&!Z&&!Pe)return t;Cr++;let Fe=[],le=["--new-session","--die-with-parent"],Me=[],de;try{if(!ee)if(de=mS(nt?.applyPath,nt?.argv0),!de)throw Error("seccomp_unavailable: the policy requires the unix-socket filter (allowAllUnixSockets is false) but apply-seccomp is not installed beside srt (vendor/seccomp/<arch>/apply-seccomp; build it with `bun run build:seccomp` in packages/sandbox-runtime)");else C("[Sandbox Linux] Applying seccomp filter for Unix socket blocking");else C("[Sandbox Linux] Skipping seccomp filter - allowAllUnixSockets is enabled");if(V&&de)if(Y.existsSync(V))Me.push("--bind",V,V),le.push("--setenv","SRT_OBSERVE_SOCK",V),le.push("--setenv","SRT_ENCODED_CMD",Nt(n??t));else C("[Sandbox Linux] observe socket missing \u2014 supervisor not running; "+"continuing without violation monitoring");if(Z){for(let Ue of f??[])le.push("--unsetenv",Ue);for(let[Ue,Jr]of Object.entries(y??{}))le.push("--setenv",Ue,Jr)}if(we&&we.length>0){let Ue=ys({safeDirs:we,unsetEnvVars:f,setEnvVars:y});for(let[Jr,fs]of Object.entries(Ue))le.push("--setenv",Jr,fs)}if(r){if(le.push("--unshare-net"),i&&s){if(!Y.existsSync(i))throw Error(`Linux HTTP bridge socket does not exist: ${i}. The bridge process may have died. Try reinitializing the sandbox.`);if(!Y.existsSync(s))throw Error(`Linux SOCKS bridge socket does not exist: ${s}. The bridge process may have died. Try reinitializing the sandbox.`);if(Me.push("--bind",i,i),s!==i)Me.push("--bind",s,s);let Ue=Cn(3128,1080,c,l,d===void 0,Nt(n??t));if(le.push(...Ue.flatMap((Jr)=>{let fs=Jr.indexOf("="),Gh=Jr.slice(0,fs),jh=Jr.slice(fs+1);return["--setenv",Gh,jh]})),a!==void 0)le.push("--setenv","CLAUDE_CODE_HOST_HTTP_PROXY_PORT",String(a));if(o!==void 0)le.push("--setenv","CLAUDE_CODE_HOST_SOCKS_PROXY_PORT",String(o))}}let qe=await vS(u,d,p,v,K,ie,ve,Q,E===void 0?void 0:{uid:E,gid:k??E},Fe);va(),le.push(...qe);let Oe=hS(Fe,process.cwd());if(Oe!==void 0)le.push("--setenv",fS,Oe);if(le.push(...Me),le.push("--dev","/dev"),le.push("--unshare-pid"),!x){if(le.push("--unshare-user","--cap-drop","ALL","--proc","/proc"),!de)le.push("--ro-bind","/dev/null","/proc/sysrq-trigger")}else le.push("--unshare-user","--bind","/proc","/proc");if(b!==void 0)le.push("--uid",String(b)),le.push("--gid",String(A??b));if(E!==void 0){if(I)le.push("--setenv","HOME",I);if(R)le.push("--setenv","USER",R),le.push("--setenv","LOGNAME",R)}let at=O||"bash",Xe=br(at);if(!Xe)throw Error(`Shell '${at}' not found in PATH`);if(le.push("--",Xe,"-c"),r&&i&&s){let Ue=yS(i,s,t,de,Xe,Ve,te);le.push(Ue)}else if(de){let Ue=de+kt(Gl(Xe,t,te));le.push(Ue)}else le.push(te===void 0?t:`exec ${kt(Gl(Xe,t,te))}`);let ot=[_e??"bwrap",...le],lt=kt(aS({bwrapCommand:ot,uid:E,gid:k,setprivPath:M,unsetEnvVars:f,setEnvVars:y})),Ye=[];if(r)Ye.push("network");if(ue||ce)Ye.push("filesystem");if(Z)Ye.push("env");if(de)Ye.push("seccomp(unix-block)");return C(`[Sandbox Linux] Wrapped command with bwrap (${Ye.join(", ")} restrictions)`),lt}catch(qe){if(Cr>0)Cr--;if(va(),Cr===0)Hl([],()=>{});throw qe}}import{spawn as xS}from"child_process";import*as Er from"path";class Ea{violations=[];totalCount=0;maxSize=100;listeners=new Set;addViolation(e){if(this.violations.push({...e,line:zl(e.line).replace(/[<>]/g,"")}),this.totalCount++,this.violations.length>this.maxSize)this.violations=this.violations.slice(-this.maxSize);this.notifyListeners()}getViolations(e){if(e===void 0)return[...this.violations];return this.violations.slice(-e)}getCount(){return this.violations.length}getTotalCount(){return this.totalCount}getViolationsForCommand(e){let t=Nt(e);return this.violations.filter((n)=>n.encodedCommand===t)}clear(){this.violations=[],this.notifyListeners()}subscribe(e){return this.listeners.add(e),e(this.getViolations()),()=>{this.listeners.delete(e)}}notifyListeners(){let e=this.getViolations();this.listeners.forEach((t)=>t(e))}}function jn(e,t,n){if(!n)return!1;if((n["*"]??[]).some((i)=>e.includes(i)))return!0;if(t===void 0)return!1;for(let[i,s]of Object.entries(n))if(i!=="*"&&t.includes(i)&&s.some((a)=>e.includes(a)))return!0;return!1}function zl(e){return e.replace(/[\x00-\x1f\x7f-\x9f]+/g," ").trim()}function SS(e=!1){let t=process.cwd(),n=[];for(let r of li)n.push(Er.resolve(t,r)),n.push(`**/${r}`);for(let r of ms())n.push(Er.resolve(t,r)),n.push(`**/${r}/**`);if(n.push(Er.resolve(t,".git/hooks")),n.push("**/.git/hooks/**"),!e)n.push(Er.resolve(t,".git/config")),n.push("**/.git/config");return[...new Set(n)]}var Ep=`_${Math.random().toString(36).slice(2,11)}_SBX`;function bS(e){return`CMD64_${Nt(e)}_END_${Ep}`}function zn(e){return xt(e)?`(regex ${Xt(fi(e))})`:`(subpath ${Xt(e)})`}function Jl(e){return fi(e).slice(0,-1)+"(/.*)?$"}function gn(e){return xt(e)?`(regex ${Xt(Jl(e))})`:`(subpath ${Xt(e)})`}function wp(e){return e.replace(/\[[^\]]*\]|[*?]+/g,"x")}function Xl(e,t){let n=[...new Set(t)];if(n.length===0)return e;let r=n.map((i)=>`(require-not ${i})`).join(" ");return`(require-all ${e} ${r})`}function Ql(e){let t=it(e);return{path:t,glob:xt(t)}}function Tp(e,t){return e.test(t.glob?wp(t.path):t.path)}function wa(e,t){let n=e.glob?wp(e.path):e.path;return n.startsWith(t==="/"?"/":t+"/")&&n!==t}function CS(e,t){return{denies:(e.denyOnly||[]).map(Ql),allows:(e.allowWithinDeny||[]).map(Ql),writeRoots:(t||[]).map(Ql)}}function ES(e){let t=[],n=!1,r=e.allows.filter((i)=>!i.glob).map((i)=>i.path);for(let i of e.denies){if(!i.glob){if(r.some((o)=>i.path.startsWith(o+"/")))t.push(gn(i.path));continue}let s=new RegExp(Jl(i.path));if(s.test("/"))n=!0;let a=e.allows.filter((o)=>Tp(s,o)).map((o)=>zn(o.path));t.push(Xl(gn(i.path),a))}return{filters:t,coversRoot:n}}function Ap(e){let t=e.split(/[*?[\]]/)[0];if(!t||t==="/")return"/";return t.endsWith("/")?t.slice(0,-1):Er.dirname(t)}function wS(e,t){let{denies:n,allows:r,writeRoots:i}=e;if(i.length===0)return[];let s=i.filter((d)=>d.glob).map((d)=>new RegExp(fi(d.path))),a=i.filter((d)=>!d.glob).map((d)=>d.path),o=(d)=>a.some((f)=>wa({path:d,glob:!1},f))||s.some((f)=>f.test(d)),l=(d)=>[...r,...i].filter((f)=>wa(f,d)).map((f)=>zn(f.path)),c=new Set,u=(d)=>{for(let f of d)if(o(f))c.add(`(literal ${Xt(f)})`)};for(let d of n)if(d.glob){let f=Ap(d.path);if(!(s.length>0||a.some((x)=>f===x||wa({path:f,glob:!1},x)||wa({path:x,glob:!1},f))))continue;let p=new RegExp(Jl(d.path)),v=[...r,...i].filter((x)=>Tp(p,x)).map((x)=>zn(x.path));if(c.add(Xl(gn(d.path),v)),f!=="/")u([f,...Yl(f)])}else{if(!o(d.path))continue;c.add(Xl(gn(d.path),l(d.path))),u(Yl(d.path))}return Hr("deny",["file-write-unlink"],c,t)}function Hr(e,t,n,r){if(n.size===0)return[];return[`(${e} ${t.join(" ")}`,...[...n].map((i)=>` ${i}`),` (with message "${r}"))`]}function Yl(e){let t=[],n=Er.dirname(e);while(n!=="/"&&n!=="."){t.push(n);let r=Er.dirname(n);if(r===n)break;n=r}return t}function _p(e,t){let n=new Set;for(let r of e){let i=it(r);n.add(gn(i));let s;if(xt(i)){if(s=Ap(i),s==="/")continue;n.add(`(literal ${Xt(s)})`)}else s=i;for(let a of Yl(s))n.add(`(literal ${Xt(a)})`)}return Hr("deny",["file-write-unlink","file-write-create"],n,t)}function TS(e,t){if(!e)return["(allow file-read*)"];let n=[];n.push("(allow file-read*)");let r=e.denies.some((l)=>l.path==="/"),i=new Set(e.denies.map((l)=>gn(l.path)));n.push(...Hr("deny",["file-read*"],i,t));let s=new Set(e.allows.map((l)=>zn(l.path)));n.push(...Hr("allow",["file-read*"],s,t));let a=ES(e);if(n.push(...Hr("deny",["file-read*"],new Set(a.filters),t)),r||a.coversRoot)n.push('(allow file-read* (literal "/"))');if(e.denies.length>0)n.push("(allow file-read-metadata"," (vnode-type DIRECTORY))");n.push(..._p(e.denies.map((l)=>l.path),t));let o=new Set(e.writeRoots.map((l)=>zn(l.path)));return n.push(...Hr("allow",["file-write-unlink","file-write-create"],o,t)),n}function AS(e,t,n=!1){if(!e)return["(allow file-write*)"];let r=[],i=new Set;for(let o of e.allowOnly||[])i.add(zn(it(o)));r.push(...Hr("allow",["file-write*"],i,t));let s=[...e.denyWithinAllow||[],...SS(n)],a=new Set;for(let o of s)a.add(gn(it(o)));return r.push(...Hr("deny",["file-write*"],a,t)),r.push(..._p(s,t)),r}function _S({readConfig:e,writeConfig:t,httpProxyPort:n,socksProxyPort:r,needsNetworkRestriction:i,allowUnixSockets:s,allowAllUnixSockets:a,allowLocalBinding:o,allowMachLookup:l,allowPty:c,allowGitConfig:u=!1,enableWeakerNetworkIsolation:d=!1,allowAppleEvents:f=!1,logTag:y}){let p=["(version 1)",`(deny default (with message "${y}"))`,"",`; LogTag: ${y}`,"","; Essential permissions - based on Chrome sandbox policy","; Process permissions","(allow process-exec)","(allow process-fork)","(allow process-info* (target same-sandbox))","(allow signal (target same-sandbox))","(allow mach-priv-task-port (target same-sandbox))","","; User preferences","(allow user-preference-read)","","; Mach IPC - specific services only (no wildcard)","(allow mach-lookup",' (global-name "com.apple.audio.systemsoundserver")',' (global-name "com.apple.distributed_notifications@Uv3")',' (global-name "com.apple.FontObjectsServer")',' (global-name "com.apple.fonts")',' (global-name "com.apple.logd")',' (global-name "com.apple.lsd.mapdb")',' (global-name "com.apple.PowerManagement.control")',' (global-name "com.apple.system.logger")',' (global-name "com.apple.system.notification_center")',' (global-name "com.apple.system.opendirectoryd.libinfo")',' (global-name "com.apple.system.opendirectoryd.membership")',' (global-name "com.apple.bsd.dirhelper")',' (global-name "com.apple.securityd.xpc")',' (global-name "com.apple.coreservices.launchservicesd")',")","",...d?["; trustd.agent - needed for Go TLS certificate verification (weaker network isolation)",'(allow mach-lookup (global-name "com.apple.trustd.agent"))']:[],...f?["; Apple Events - opt-in; needed for open/osascript to talk to other apps (appleeventsd)","(allow appleevent-send)",'(allow mach-lookup (global-name "com.apple.coreservices.appleevents"))',"; Launch Services open requests need the lsopen operation plus, on","; macOS 14/15, coreservicesd and the quarantine resolver - without","; these open fails with -10822 kLSServerCommunicationErr or -54","(allow lsopen)",'(allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))','(allow mach-lookup (global-name "com.apple.coreservices.quarantine-resolver"))']:[],...l&&l.length>0?["; User-specified XPC/Mach services",...l.map((x)=>x.endsWith("*")?`(allow mach-lookup (global-name-prefix ${Xt(x.slice(0,-1))}))`:`(allow mach-lookup (global-name ${Xt(x)}))`)]:[],"","; POSIX IPC - shared memory","(allow ipc-posix-shm)","","; POSIX IPC - semaphores for Python multiprocessing","(allow ipc-posix-sem)","","; IOKit - specific operations only","(allow iokit-open",' (iokit-registry-entry-class "IOSurfaceRootUserClient")',' (iokit-registry-entry-class "RootDomainUserClient")',' (iokit-user-client-class "IOSurfaceSendRight")',")","","; IOKit properties","(allow iokit-get-properties)","","; Specific safe system-sockets, doesn't allow network access","(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))","","; sysctl - specific sysctls only","(allow sysctl-read",' (sysctl-name "hw.activecpu")',' (sysctl-name "hw.busfrequency_compat")',' (sysctl-name "hw.byteorder")',' (sysctl-name "hw.cacheconfig")',' (sysctl-name "hw.cachelinesize_compat")',' (sysctl-name "hw.cpufamily")',' (sysctl-name "hw.cpufrequency")',' (sysctl-name "hw.cpufrequency_compat")',' (sysctl-name "hw.cputype")',' (sysctl-name "hw.l1dcachesize_compat")',' (sysctl-name "hw.l1icachesize_compat")',' (sysctl-name "hw.l2cachesize_compat")',' (sysctl-name "hw.l3cachesize_compat")',' (sysctl-name "hw.logicalcpu")',' (sysctl-name "hw.logicalcpu_max")',' (sysctl-name "hw.machine")',' (sysctl-name "hw.memsize")',' (sysctl-name "hw.ncpu")',' (sysctl-name "hw.nperflevels")',' (sysctl-name "hw.packages")',' (sysctl-name "hw.pagesize_compat")',' (sysctl-name "hw.pagesize")',' (sysctl-name "hw.physicalcpu")',' (sysctl-name "hw.physicalcpu_max")',' (sysctl-name "hw.tbfrequency_compat")',' (sysctl-name "hw.vectorunit")',' (sysctl-name "kern.argmax")',' (sysctl-name "kern.bootargs")',' (sysctl-name "kern.hostname")',' (sysctl-name "kern.maxfiles")',' (sysctl-name "kern.maxfilesperproc")',' (sysctl-name "kern.maxproc")',' (sysctl-name "kern.ngroups")',' (sysctl-name "kern.osproductversion")',' (sysctl-name "kern.osrelease")',' (sysctl-name "kern.ostype")',' (sysctl-name "kern.osvariant_status")',' (sysctl-name "kern.osversion")',' (sysctl-name "kern.secure_kernel")',' (sysctl-name "kern.tcsm_available")',' (sysctl-name "kern.tcsm_enable")',' (sysctl-name "kern.usrstack64")',' (sysctl-name "kern.version")',' (sysctl-name "kern.willshutdown")',' (sysctl-name "machdep.cpu.brand_string")',' (sysctl-name "machdep.ptrauth_enabled")',' (sysctl-name "security.mac.lockdown_mode_state")',' (sysctl-name "sysctl.proc_cputype")',' (sysctl-name "vm.loadavg")',' (sysctl-name-prefix "hw.optional.arm")',' (sysctl-name-prefix "hw.optional.arm.")',' (sysctl-name-prefix "hw.optional.armv8_")',' (sysctl-name-prefix "hw.perflevel")',' (sysctl-name-prefix "kern.proc.all")',' (sysctl-name-prefix "kern.proc.pgrp.")',' (sysctl-name-prefix "kern.proc.pid.")',' (sysctl-name-prefix "machdep.cpu.")',' (sysctl-name-prefix "net.routetable.")',")","","; V8 thread calculations","(allow sysctl-write",' (sysctl-name "kern.tcsm_enable")',")","","; Distributed notifications","(allow distributed-notification-post)","","; Specific mach-lookup permissions for security operations",'(allow mach-lookup (global-name "com.apple.SecurityServer"))',"","; File I/O on device files",'(allow file-ioctl (literal "/dev/null"))','(allow file-ioctl (literal "/dev/zero"))','(allow file-ioctl (literal "/dev/random"))','(allow file-ioctl (literal "/dev/urandom"))','(allow file-ioctl (literal "/dev/dtracehelper"))','(allow file-ioctl (literal "/dev/tty"))',"","(allow file-ioctl file-read-data file-write-data"," (require-all",' (literal "/dev/null")'," (vnode-type CHARACTER-DEVICE)"," )",")",""];if(p.push("; Network"),!i)p.push("(allow network*)");else{if(o)p.push('(allow network-bind (local ip "*:*"))'),p.push('(allow network-inbound (local ip "*:*"))'),p.push('(allow network-outbound (remote ip "localhost:*"))');if(a)p.push("(allow system-socket (socket-domain AF_UNIX))"),p.push('(allow network-bind (local unix-socket (path-regex #"^/")))'),p.push('(allow network-outbound (remote unix-socket (path-regex #"^/")))');else if(s&&s.length>0){p.push("(allow system-socket (socket-domain AF_UNIX))");for(let x of s){let b=it(x);p.push(`(allow network-bind (local unix-socket (subpath ${Xt(b)})))`),p.push(`(allow network-outbound (remote unix-socket (subpath ${Xt(b)})))`)}}if(n!==void 0)p.push(`(allow network-bind (local ip "localhost:${n}"))`),p.push(`(allow network-inbound (local ip "localhost:${n}"))`),p.push(`(allow network-outbound (remote ip "localhost:${n}"))`);if(r!==void 0&&r!==n)p.push(`(allow network-bind (local ip "localhost:${r}"))`),p.push(`(allow network-inbound (local ip "localhost:${r}"))`),p.push(`(allow network-outbound (remote ip "localhost:${r}"))`)}p.push("");let v=e?CS(e,t?.allowOnly):void 0;if(p.push("; File read"),p.push(...TS(v,y)),p.push(""),p.push("; File write"),p.push(...AS(t,y,u)),v){let x=wS(v,y);if(x.length>0)p.push(""),p.push("; File read: keep read-denied paths inside write roots in place"),p.push(...x)}if(c)p.push(""),p.push("; Pseudo-terminal (pty) support"),p.push("(allow pseudo-tty)"),p.push("(allow file-ioctl"),p.push(' (literal "/dev/ptmx")'),p.push(' (regex #"^/dev/ttys")'),p.push(")"),p.push("(allow file-read* file-write*"),p.push(' (literal "/dev/ptmx")'),p.push(' (regex #"^/dev/ttys")'),p.push(")");return p.join(`
67
+ `)}function Xt(e){return JSON.stringify(e)}function kp(e){let{command:t,commandId:n,needsNetworkRestriction:r,httpProxyPort:i,socksProxyPort:s,proxyAuthToken:a,caCertPath:o,allowUnixSockets:l,allowAllUnixSockets:c,allowLocalBinding:u,allowMachLookup:d,readConfig:f,writeConfig:y,unsetEnvVars:p,setEnvVars:v,maskedFileBinds:x,allowPty:b,allowGitConfig:A=!1,gitSafeDirectories:E,enableWeakerNetworkIsolation:k=!1,allowAppleEvents:I=!1,binShell:R}=e,M=f;if(x&&x.length>0)C("[Sandbox macOS] file mask degrades to deny on macOS until the interposer lands"),M={denyOnly:[...f?.denyOnly??[],...x.map((ce)=>ce.realPath)],allowWithinDeny:f?.allowWithinDeny};let ee=M&&M.denyOnly.length>0,O=y!==void 0,K=p!==void 0&&p.length>0||v!==void 0&&Object.keys(v).length>0,ie=(E?.length??0)>0;if(!r&&!ee&&!O&&!K&&!ie)return t;let ve=n??t,we=bS(ve),nt=_S({readConfig:M,writeConfig:y,httpProxyPort:i,socksProxyPort:s,needsNetworkRestriction:r,allowUnixSockets:l,allowAllUnixSockets:c,allowLocalBinding:u,allowMachLookup:d,allowPty:b,allowGitConfig:A,enableWeakerNetworkIsolation:k,allowAppleEvents:I,logTag:we}),_e=Cn(i,s,o,a,y===void 0,Nt(ve));if(u&&r){let Pe=(p??[]).includes("JAVA_TOOL_OPTIONS")?"":process.env.JAVA_TOOL_OPTIONS??"",Fe=Pe.includes("-Djava.net.preferIPv4Stack=true")?Pe:[Pe,"-Djava.net.preferIPv4Stack=true"].filter(Boolean).join(" ");_e.push(`JAVA_TOOL_OPTIONS=${Fe}`)}if(E&&E.length>0){let ce=ys({safeDirs:E,unsetEnvVars:p,setEnvVars:v});for(let[Z,Pe]of Object.entries(ce))_e.push(`${Z}=${Pe}`)}let Ve=R||"bash",V=br(Ve);if(!V)throw Error(`Shell '${Ve}' not found in PATH`);let te=(p??[]).flatMap((ce)=>["-u",ce]),Q=Object.entries(v??{}).map(([ce,Z])=>`${ce}=${Z}`),ue=kt(["env",...te,...Q,..._e,"/usr/bin/sandbox-exec","-p",nt,V,"-c",t]);return C(`[Sandbox macOS] Applied restrictions - network: ${!!(i||s)}, read: ${M?"allowAllExcept"in M?"allowAllExcept":"denyAllExcept":"none"}, write: ${y?"allowAllExcept"in y?"allowAllExcept":"denyAllExcept":"none"}`),ue}function Ip(e,t,n=(r)=>r){let r=/CMD64_(.+?)_END/,i=/Sandbox:\s+(.+)$/,s=xS("log",["stream","--predicate",`(eventMessage ENDSWITH "${Ep}")`,"--style","compact"]);return s.stdout?.on("data",(a)=>{let o=a.toString().split(`
68
+ `),l=o.find((p)=>p.includes("Sandbox:")&&p.includes("deny")),c=o.find((p)=>p.startsWith("CMD64_"));if(!l)return;let u=l.match(i);if(!u?.[1])return;let d=u[1],f,y;if(c){if(y=c.match(r)?.[1],y)try{f=n(en(y))}catch{}}if(d.includes("mDNSResponder")||d.includes("mach-lookup com.apple.diagnosticd")||d.includes("mach-lookup com.apple.analyticsd"))return;if(jn(d,f,t))return;e({line:d,command:f,encodedCommand:y,timestamp:new Date})}),s.stderr?.on("data",(a)=>{C(`[Sandbox Monitor] Log stream stderr: ${a.toString()}`)}),s.on("error",(a)=>{C(`[Sandbox Monitor] Failed to start log stream: ${a.message}`)}),s.on("exit",(a)=>{C(`[Sandbox Monitor] Log stream exited with code: ${a}`)}),()=>{C("[Sandbox Monitor] Stopping log monitor"),s.kill("SIGTERM")}}import{randomBytes as kS}from"crypto";import{chmodSync as Rp,chownSync as IS,mkdtempSync as RS,rmSync as BS}from"fs";import{createServer as PS}from"net";import{tmpdir as NS}from"os";import{join as Bp,posix as DS}from"path";import{createInterface as LS}from"readline";function Pp(e,t){let{allowWritePaths:n,denyWritePaths:r,ignoreViolations:i,resolveCommandText:s=(E)=>E,consumerUid:a,consumerGid:o}=t,l=RS(Bp(NS(),"srt-obs-")),c=Bp(l,`s${kS(4).toString("hex")}.sock`),u=(E,k)=>E===k||E.startsWith(k.endsWith("/")?k:k+"/"),d=(E)=>{let k=DS.normalize(E);if(r.some((I)=>u(k,I)))return!0;return!n.some((I)=>u(k,I))},f=(E,k)=>{if(E.observe_init_error){C(`[Sandbox Linux Monitor] observe filter not installed: ${E.observe_init_error}`);return}if(typeof E.path!=="string")return;if(!E.path.startsWith("/"))return;if(!d(E.path))return;let I;if(k)try{I=s(en(k))}catch{}if(jn(E.path,I,i))return;let R={line:`deny ${E.syscall??"syscall"} ${E.path}`,command:I,encodedCommand:k,timestamp:new Date};e(R)},y,p=new Promise((E)=>{y=E}),v=c,x=PS((E)=>{let k,I=LS({input:E});I.on("line",(R)=>{if(!R)return;let M;try{M=JSON.parse(R)}catch{return}if(M.encodedCommand&&k===void 0)k=M.encodedCommand;f(M,k??M.encodedCommand)}),E.on("error",()=>I.close()),E.on("close",()=>I.close())});x.on("error",(E)=>{C(`[Sandbox Linux Monitor] listen failed: ${E.message} - violation monitoring disabled`,{level:"warn"}),v=void 0,y()}),x.listen(c,()=>{if(a!==void 0)Rp(l,457),IS(c,a,o??a),Rp(c,384);y()});let b=new Set;return x.on("connection",(E)=>{b.add(E),E.on("close",()=>b.delete(E))}),{get observeSocketPath(){return v},ready:p,stop:()=>{C("[Sandbox Linux Monitor] stopping");for(let E of b)E.destroy();x.close();try{BS(l,{recursive:!0,force:!0})}catch{}}}}import*as rt from"fs";import*as Lp from"net";import*as tt from"path";import{spawn as OS,spawnSync as US}from"child_process";import{once as VS}from"events";import{fileURLToPath as FS}from"url";class xe extends Error{code;subcommand;constructor(e,t,n){super(t);this.name="WindowsSandboxError",this.code=e,this.subcommand=n}}var Ta=[60080,60089],Np=["-NoProfile","-Command"];function Aa(e){let t=process.env.SystemRoot??"C:\\Windows",n={exe:tt.win32.join(t,"System32","cmd.exe"),args:["/d","/s","/c"]};if(e===void 0||e===null)return n;if(typeof e==="object"){if(!tt.win32.isAbsolute(e.exe))throw new xe("bin_shell_invalid",`binShell.exe must be an absolute path (got ${JSON.stringify(e.exe)})`);if(!Array.isArray(e.args))throw new xe("bin_shell_invalid",`binShell.args must be an array (got ${JSON.stringify(e.args)})`);return e}let r=tt.win32.basename(e),i=r.toLowerCase(),s=tt.win32.isAbsolute(e);if(!s&&e!==r)throw new xe("bin_shell_invalid",`binShell string must be a bare token or an absolute path (got ${JSON.stringify(e)})`);switch(i){case"bash":case"bash.exe":case"sh":case"sh.exe":if(!s)throw new xe("bin_shell_invalid",`binShell bash path must be absolute (got ${JSON.stringify(e)}); pass the resolved Git Bash install path`);return{exe:e,args:["-c"]};case"pwsh":case"pwsh.exe":return{exe:s?e:"pwsh.exe",args:Np};case"powershell":case"powershell.exe":return{exe:s?e:tt.win32.join(t,"System32","WindowsPowerShell","v1.0","powershell.exe"),args:Np};case"cmd":case"cmd.exe":return s?{exe:e,args:n.args}:n;default:throw new xe("bin_shell_invalid",`unrecognised binShell ${JSON.stringify(e)}: expected 'cmd' | 'powershell' | 'pwsh' or an absolute path to bash.exe/sh.exe/pwsh.exe/powershell.exe`)}}function Op(){let e=tt.dirname(FS(import.meta.url));return tt.resolve(e,"..","..")}var Up={x64:"x64",arm64:"arm64"},MS=tt.join(Op(),"vendor","srt-win",Up[process.arch]??process.arch,"srt-win.exe");function WS(){let e=Op(),t=Up[process.arch],n=[];if(t)n.push(tt.join(e,"vendor","srt-win",t,"srt-win.exe"));n.push(tt.join(e,"vendor","srt-win-src","target","release","srt-win.exe"));for(let r of n)if(rt.existsSync(r))return r;throw new xe("srt_win_not_found",`srt-win.exe not found. Set windows.srtWin.path or build with \`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. Looked in: ${n.join(", ")}`)}var Vp="--srt-win";function Bt(e){if(e?.path===void 0)throw new xe("srt_win_not_found","no srt-win path configured; set windows.srtWin.path (e.g. to the exported VENDORED_SRT_WIN_EXE constant for the packaged binary)");if(!rt.existsSync(e.path))throw new xe("srt_win_not_found",`windows.srtWin.path is set to '${e.path}' but the file does not exist`);return{exe:e.path,prependArgs:[Vp]}}function Kr(e,t={}){let{exe:n,prependArgs:r}=t.srtWin??Bt(),i=US(n,[...r,...e],{encoding:"utf8",windowsHide:!0,timeout:t.timeoutMs??15000,...t.stdin!==void 0?{input:t.stdin}:{}});if(i.error){if(i.error.code==="ETIMEDOUT")throw new xe("srt_win_timeout",`srt-win ${e.join(" ")} timed out after ${t.timeoutMs??15000}ms`+(i.signal?` (killed by ${i.signal})`:""),e[0]);throw new xe("spawn_failed",`srt-win ${e[0]}: spawn failed: ${i.error.message}`,e[0])}return{status:i.status,signal:i.signal,stdout:(i.stdout??"").trim(),stderr:(i.stderr??"").trim()}}function ec(e,t={}){let{exe:n,prependArgs:r}=t.srtWin??Bt(),i=t.timeoutMs??15000;return new Promise((s,a)=>{let o=OS(n,[...r,...e],{windowsHide:!0}),l=!1,c=i>0?setTimeout(()=>{l=!0,o.kill()},i):void 0,u="",d="";o.stdout?.setEncoding("utf8").on("data",(f)=>u+=f),o.stderr?.setEncoding("utf8").on("data",(f)=>d+=f),o.stdin?.on("error",()=>{}).end(t.stdin),o.once("error",(f)=>{clearTimeout(c),a(new xe("spawn_failed",`srt-win ${e[0]}: spawn failed: ${f.message}`,e[0]))}),o.once("close",(f,y)=>{if(clearTimeout(c),l){a(new xe("srt_win_timeout",`srt-win ${e.join(" ")} timed out after ${i}ms`+(y?` (killed by ${y})`:""),e[0]));return}s({status:f,signal:y,stdout:u.trim(),stderr:d.trim()})})})}function Fp(e,t){if(t.status!==0)throw new xe("srt_win_nonzero",`srt-win ${e.join(" ")} exited ${t.status}: ${t.stderr||t.stdout}`,e[0]);try{return JSON.parse(t.stdout)}catch(n){throw new xe("srt_win_bad_json",`srt-win ${e.join(" ")}: unparseable JSON output ${JSON.stringify(t.stdout)}: ${n.message}`,e[0])}}function tc(e,t){return Fp(e,Kr(e,t))}async function rc(e,t){return Fp(e,await ec(e,t))}function Mp(e,t){let n=Kr(e,t),r;try{r=JSON.parse(n.stdout)}catch(i){throw new xe("srt_win_bad_json",`srt-win ${e.join(" ")}: unparseable JSON output ${JSON.stringify(n.stdout)}: ${i.message}`,e[0])}return{ok:n.status===0,json:r,stderr:n.stderr}}function Wp(e){let t=["wfp","status"];if(e)t.push("--sublayer-guid",e);return t}function _a(e){return{state:e.state,filters:e.filters,...e.port_range&&{portRange:e.port_range},...e.user_sid&&{userSid:e.user_sid},...e.hint&&{hint:e.hint}}}function ka(e){return{provisioned:e.user.exists,...e.user.sid&&{sid:e.user.sid},groupExists:e.user.group_exists,...e.user.group_sid&&{groupSid:e.user.group_sid},inBuiltinUsers:e.user.in_builtin_users,inSandboxGroup:e.user.in_sandbox_group,hiddenFromLogon:e.user.hidden_from_logon,credPresent:e.cred_present,...typeof e.marker_version==="number"&&{markerVersion:e.marker_version},realUserSid:e.real_user_sid,...e.ca_cert_thumb&&{caCertThumb:e.ca_cert_thumb},...e.ca_cert_pem&&{caCertPem:e.ca_cert_pem}}}function $p(e={}){let t=["status"];if(e.sublayerGuid)t.push("--sublayer-guid",e.sublayerGuid);let n=tc(t,{srtWin:e.srtWin});return{user:ka(n.user),wfp:_a(n.wfp)}}async function Hp(e={}){let t=["status"];if(e.sublayerGuid)t.push("--sublayer-guid",e.sublayerGuid);let n=await rc(t,{srtWin:e.srtWin});return{user:ka(n.user),wfp:_a(n.wfp)}}function Kp(e={}){return _a(tc(Wp(e.sublayerGuid),{srtWin:e.srtWin}))}async function qp(e={}){return _a(await rc(Wp(e.sublayerGuid),{srtWin:e.srtWin}))}async function nc(e={}){let t=e.target,n;if(!t){let[r,i]=e.proxyPortRange??Ta;for(let s=0;s<5;s++){let a=Lp.createServer();a.listen(0,"127.0.0.1"),await VS(a,"listening");let o=a.address().port;if(o<r||o>i){n=a,t=`127.0.0.1:${o}`;break}a.close()}if(!t)throw new xe("wfp_verify_bind_failed",`verifyWindowsWfpEgress: could not bind a loopback listener outside the WFP permit range [${r},${i}] in 5 attempts`)}try{let r=Kr(["wfp","verify","--target",t],{timeoutMs:30000,srtWin:e.srtWin});C(`[Sandbox Windows] wfp verify exit=${r.status}: ${r.stderr||r.stdout}`);let i;try{i=JSON.parse(r.stdout)}catch{throw new xe("wfp_verify_unparseable","WFP egress fence could not be verified \u2014 `srt-win wfp "+`verify\` exited ${r.status}`+(r.signal?` (signal ${r.signal})`:"")+` with unparseable output ${JSON.stringify(r.stdout)} (stderr: ${JSON.stringify(r.stderr)})`)}if(r.status===3)throw new xe("wfp_fence_inactive","WFP egress fence is not active \u2014 direct outbound from the "+`sandbox user to ${i.target} succeeded. Re-run \`srt-win install\` (one UAC prompt). (${r.stderr})`);if(r.status!==0)throw new xe("wfp_verify_inconclusive","WFP egress fence could not be verified \u2014 probe to "+`${i.target} was '${i.egress_probe}' (exit ${r.status}). The fence may be absent. Re-run \`srt-win install\`. (${r.stderr})`);return{target:i.target,stderr:r.stderr}}finally{n?.close()}}function ic(e={}){return ka(tc(["user","status"],{srtWin:e.srtWin}))}async function Mi(e={}){return ka(await rc(["user","status"],{srtWin:e.srtWin}))}function sc(e,t={}){let n=e??ic(t);if(!n.caCertThumb||!n.caCertPem)return null;return{pem:n.caCertPem,thumb:n.caCertThumb}}function $S(e,t={}){let n=Kr(["user","trust-ca",e],{timeoutMs:60000,srtWin:t.srtWin});jp(e,n)}async function Gp(e,t={}){let n=await ec(["user","trust-ca",e],{timeoutMs:60000,srtWin:t.srtWin});jp(e,n)}function jp(e,t){if(C(`[Sandbox Windows] user trust-ca exit=${t.status}: ${t.stderr||t.stdout}`),t.status!==0)throw new xe("trust_ca_failed",`srt-win user trust-ca '${e}' failed (exit ${t.status}): ${t.stderr||t.stdout}`)}function zp(){let e=process.env.ProgramData;if(!e)throw Error("ProgramData is not set");return tt.win32.join(e,"sandbox-runtime")}async function ac(e={}){let t=e.status??await Mi({srtWin:e.srtWin});if(!t.provisioned||!t.credPresent)throw Error(`ensurePersistentWindowsCa: sandbox user is not provisioned (user=${t.provisioned}, cred=${t.credPresent}). Run \`npx sandbox-runtime windows-install\` first.`);let n=e.dir?void 0:zp();if(n&&!rt.existsSync(n))throw Error(`ensurePersistentWindowsCa: state directory ${n} does not exist. Run \`npx sandbox-runtime windows-install\` first.`);let r=e.dir??tt.win32.join(n,"ca"),i=tt.join(r,"ca.json"),s=tt.join(r,"cert.pem"),a=tt.join(r,"key.pem"),o=(e.regenerateWithinDays??30)*24*60*60*1000,l=(x,b)=>{let A=`${x}.tmp.${process.pid}`;rt.writeFileSync(A,b),rt.renameSync(A,x)},c=async(x,b,A,E)=>{l(s,x),l(a,b);let k=E||t.caCertThumb!==A;if(k){let I=tt.join(r,`.trust.${process.pid}.${Date.now()}.pem`);rt.writeFileSync(I,x);try{await Gp(I,{srtWin:e.srtWin})}finally{rt.rmSync(I,{force:!0})}}return C(`[Sandbox Windows] persistent CA ${E?"generated":"reused"} (thumb=${A}${k&&!E?", trust reconciled":""})`),{certPem:x,keyPem:b,certPath:s,keyPath:a,thumbprint:A,generated:E,trusted:k}},u=()=>{let x;try{x=JSON.parse(rt.readFileSync(i,"utf8"))}catch(A){C(`[Sandbox Windows] persistent CA ca.json unreadable (${A.message})`,{level:"warn"});return}if(typeof x.certPem!=="string"||typeof x.keyPem!=="string")return;let b=Ii(x.certPem,x.keyPem);if(!b.ok){C(`[Sandbox Windows] persistent CA invalid (${b.reason})`,{level:"warn"});return}return{certPem:x.certPem,keyPem:x.keyPem,thumbprint:b.thumbprint,notAfter:b.notAfter}};if(!e.force){let x=u();if(x&&x.notAfter.getTime()-Date.now()>o)return await c(x.certPem,x.keyPem,x.thumbprint,!1);if(x)C(`[Sandbox Windows] persistent CA expiring ${x.notAfter.toISOString()}; regenerating`,{level:"warn"})}rt.mkdirSync(r,{recursive:!0});try{let x=Date.now()-300000;for(let b of rt.readdirSync(r)){if(!b.includes(".tmp.")&&!b.startsWith(".trust."))continue;let A=tt.join(r,b);if(rt.statSync(A).mtimeMs<x)rt.rmSync(A,{force:!0})}}catch{}let d=Zs({cn:"sandbox-runtime persistent CA"});l(i,JSON.stringify({certPem:d.certPem,keyPem:d.keyPem}));let f=u(),{certPem:y,keyPem:p,thumbprint:v}=f??{certPem:d.certPem,keyPem:d.keyPem,thumbprint:Wn(d.certPem)};return await c(y,p,v,!0)}function oc(e){return e.timeoutMs??120000}function Qp(e){let t=["install"];if(e.sublayerGuid)t.push("--sublayer-guid",e.sublayerGuid);if(e.proxyPortRange)t.push("--proxy-port-range",`${e.proxyPortRange[0]}-${e.proxyPortRange[1]}`);if(e.sandboxUser)t.push("--sandbox-user",e.sandboxUser);if(e.force)t.push("--force");return t}function Xp(e){if(e instanceof xe&&e.code==="srt_win_timeout")throw new xe("install_timeout","srt-win install timed out \u2014 the UAC prompt may still be open. "+`Re-run when ready to grant elevation. (${e.message})`);throw e}function Yp(e){if(C(`[Sandbox Windows] install exit=${e.status}: ${e.stderr||e.stdout}`),e.status===0||e.status===10)return;let t=e.stderr||e.stdout;switch(e.status){case 12:throw new xe("install_wfp_failed",`srt-win install: WFP filter install failed: ${t}`);case 14:throw new xe("install_user_failed",`srt-win install: sandbox user provisioning failed: ${t}`);case 13:throw new xe("install_config_conflict",`srt-win install: filters already exist under this sublayer with a different port range or sandbox-user name. Pass {force: true} to replace, or pick a different sublayerGuid. Output: ${t}`);case 17:throw new xe("install_ambient_failed",`srt-win install: ambient write-deny stamping failed (stock world-writable system dirs could not be deny-stamped for the sandbox user): ${t}`);default:throw new xe("install_failed",`srt-win install failed (exit ${e.status}): ${t}`)}}function HS(e={}){let t=e.srtWin??Bt(),n;try{n=Kr(Qp(e),{timeoutMs:oc(e),srtWin:t})}catch(i){Xp(i)}Yp(n);let r=$p({sublayerGuid:e.sublayerGuid,srtWin:t});return n.status===10?{...r,cancelled:!0}:r}async function KS(e={}){let t=e.srtWin??Bt(),n;try{n=await ec(Qp(e),{timeoutMs:oc(e),srtWin:t})}catch(i){Xp(i)}Yp(n);let r=await Hp({sublayerGuid:e.sublayerGuid,srtWin:t});return n.status===10?{...r,cancelled:!0}:r}function qS(e={}){let t=["uninstall"];if(e.sublayerGuid)t.push("--sublayer-guid",e.sublayerGuid);if(e.keepUser)t.push("--keep-user");let n=Kr(t,{timeoutMs:oc(e),srtWin:e.srtWin});if(C(`[Sandbox Windows] uninstall exit=${n.status}: ${n.stderr||n.stdout}`),n.status===10)return{cancelled:!0};if(n.status!==0)throw new xe("uninstall_failed",`srt-win uninstall failed (exit ${n.status}): ${n.stderr||n.stdout}`);return{}}function Ia(e,t){let n=new Set;for(let r of e){let i=it(r),s=ci(i);if(ui(i)&&!s){n.add(i);continue}let a=s?tn(i,{caseInsensitive:!0}):[i];for(let o of a){if(!rt.statSync(o,{throwIfNoEntry:!1})){if(t?.mode==="deny"&&!s)n.add(/[\\/]$/.test(r)&&!/[\\/]$/.test(o)?o+"\\":o);continue}n.add(o)}}return[...n]}function GS(e){for(let t of e.split(/\r?\n/)){let n=t.trim();if(!n.startsWith("{")||!n.includes('"code"'))continue;try{let r=JSON.parse(n);if(r.code==="mapped_drive_cwd")return Object.assign(new xe("mapped_drive_cwd",r.message??"mapped/network-drive working directory","exec"),{drive:r.drive})}catch{}}return}function lc(e){let t=e.holderPid??process.pid,n=JSON.stringify({denyRead:e.denyRead,denyWrite:e.denyWrite}),r=Kr(["acl","stamp","--holder-pid",`${t}`,"--sandbox-user-sid",e.sandboxUserSid],{timeoutMs:60000,stdin:n,srtWin:e.srtWin});if(C(`[Sandbox Windows] acl stamp exit=${r.status}: ${r.stderr||r.stdout}`),r.status!==0)throw new xe("acl_stamp_failed",`srt-win acl stamp exited ${r.status} `+(r.status===2?"(partial \u2014 some inputs skipped)":"(failed)")+`: ${r.stderr||r.stdout}`)}function Ra(e){let t=e.holderPid??process.pid;try{let n=Mp(["acl","restore","--holder-pid",`${t}`,"--sandbox-user-sid",e.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:e.srtWin});if(!n.ok)C(`[Sandbox Windows] acl restore exited non-zero (per-path outcomes preserved): ${n.stderr}`,{level:"error"});return Array.isArray(n.json)?n.json:[...n.json.paths??[],...n.json.parents??[]]}catch(n){C(`[Sandbox Windows] acl restore: ${n.message}`,{level:"error"});return}}function cc(e){let t=e.holderPid??process.pid,n=JSON.stringify({read:e.read,write:e.write}),r=Kr(["acl","grant","--holder-pid",`${t}`,"--sandbox-user-sid",e.sandboxUserSid],{timeoutMs:60000,stdin:n,srtWin:e.srtWin});if(C(`[Sandbox Windows] acl grant exit=${r.status}: ${r.stderr||r.stdout}`),r.status!==0)throw new xe("acl_grant_failed",`srt-win acl grant exited ${r.status}: ${r.stderr||r.stdout}`)}function Ba(e){let t=e.holderPid??process.pid;try{let n=Mp(["acl","revoke","--holder-pid",`${t}`,"--sandbox-user-sid",e.sandboxUserSid,"--json"],{timeoutMs:60000,srtWin:e.srtWin});if(!n.ok)C(`[Sandbox Windows] acl revoke exited non-zero: ${n.stderr}`,{level:"error"});return n.json}catch(n){C(`[Sandbox Windows] acl revoke: ${n.message}`,{level:"error"});return}}function Jp(e){let{exe:t,prependArgs:n}=e.srtWin??Bt(),r=jS(Cn(e.httpProxyPort,e.socksProxyPort,e.caCertPath?.replace(/\\/g,"/"),e.proxyAuthToken,void 0,Nt(e.commandId??e.command)));delete r.TMPDIR,delete r.NO_PROXY,delete r.no_proxy;let i=di({safeDirs:[e.cwd??process.cwd(),...e.allowWrite??[],...e.gitSafeDirectories??[]],schannelCa:e.caCertPath!==void 0,baseEnv:e.setEnvVars}),s=[t,...n,"exec"];if(e.quiet!==!1)s.push("--quiet");for(let u of e.denyRead??[])s.push("--deny-read",u);for(let u of e.denyWrite??[])s.push("--deny-write",u);let a={PATH:process.env.PATH,PATHEXT:process.env.PATHEXT,...e.setEnvVars??{},...r,...i};for(let[u,d]of Object.entries(a))if(d!==void 0)s.push("--env",`${u}=${d}`);s.push("--");let o=e.binShell??Aa(void 0);s.push(o.exe,...o.args,e.command);let l=s.reduce((u,d)=>u+d.length+3,0);if(l>30000)throw new xe("argv_too_long",`Windows sandbox argv is ~${l} chars (CreateProcessW limit is 32 767).`);let c={...process.env,...r};return{argv:s,env:c}}function jS(e){let t={};for(let n of e){let r=n.indexOf("=");if(r===-1)continue;t[n.slice(0,r)]=n.slice(r+1)}return t}function Zl(e){let t=e?` --sublayer-guid ${e}`:"";return`Windows sandbox needs a one-time install (one UAC prompt):
69
69
  npx sandbox-runtime windows-install
70
70
  `+" \u2014 or call installWindowsSandbox(), or run "+`\`srt-win.exe install${t}\` directly.
71
- No logout is needed: the WFP filter keys on the dedicated \`srt-sandbox\` user's SID, so your network is unaffected.`}function Pp(e){try{return{status:"fulfilled",value:e()}}catch(t){return{status:"rejected",reason:t}}}function Yp(e,t,n){let r=[],i=[];if(t.status==="rejected")return r.push(`srt-win user status failed: ${t.reason.message}`),{errors:r,warnings:i};let s=t.value;if(!s.provisioned||!s.credPresent)r.push(`Sandbox user is not provisioned (user=${s.provisioned}, cred=${s.credPresent}). `+Jl(e));let a=n();if(a.status==="rejected")return r.push(`srt-win wfp status failed: ${a.reason.message}`),{errors:r,warnings:i};let o=a.value;if(o.state==="cannot-read")C(`[Sandbox Windows] wfp status cannot-read (non-elevated): ${o.hint}`);else if(o.state!=="installed"){if(s.provisioned&&s.credPresent)r.push(`WFP filters not installed under sublayer ${e??"(default)"}. `+Jl(e))}else if(o.portRange)C(`[Sandbox Windows] WFP installed: ${o.filters} filters, proxy port range ${o.portRange[0]}-${o.portRange[1]}`);return{errors:r,warnings:i}}function Jp(e={}){let t;try{t=e.srtWin??Bt()}catch(n){return{errors:[n.message],warnings:[]}}return C(`[Sandbox Windows] using srt-win at ${t.exe}`),Yp(e.sublayerGuid,Pp(()=>nc({srtWin:t})),()=>Pp(()=>$p({sublayerGuid:e.sublayerGuid,srtWin:t})))}async function cc(e={}){let t;try{t=e.srtWin??Bt()}catch(i){return{errors:[i.message],warnings:[]}}C(`[Sandbox Windows] using srt-win at ${t.exe}`);let[n,r]=await Promise.allSettled([Fi({srtWin:t}),Hp({sublayerGuid:e.sublayerGuid,srtWin:t})]);return Yp(e.sublayerGuid,n,()=>r)}import{isIP as GS}from"net";function Mi(e){if(e.startsWith("[")){let r=e.indexOf("]");if(r===-1)return{hostPattern:e,port:void 0};let i=e.slice(1,r),s=_t(i)??i,a=e.slice(r+1);if(a==="")return{hostPattern:s,port:void 0};let o=Zp(a.startsWith(":")?a.slice(1):"");return o===void 0?{hostPattern:e,port:void 0}:{hostPattern:s,port:o}}let t=e.lastIndexOf(":");if(t===-1)return{hostPattern:e,port:void 0};if(e.indexOf(":")!==t)return{hostPattern:_t(e)??e,port:void 0};let n=Zp(e.slice(t+1));if(n===void 0)return{hostPattern:e,port:void 0};return{hostPattern:e.slice(0,t),port:n}}function Zp(e){if(!/^[1-9][0-9]{0,4}$/.test(e))return;let t=Number(e);return t>65535?void 0:t}function Wi(e){return Mi(e).hostPattern}function wr(e,t){let n=e.toLowerCase();if(t==="*")return!0;if(t.startsWith("*.")){if(GS(jt(n)))return!1;let r=t.substring(2).toLowerCase();return n.endsWith("."+r)}return n===t.toLowerCase()}function $i(e,t,n){let{hostPattern:r,port:i}=Mi(n);if(i!==void 0&&i!==t)return!1;return wr(e,r)}function Ba(e,t){let n=t.map(Wi);if(!e.startsWith("*."))return n.some((i)=>wr(e,i));let r=e.slice(2).toLowerCase();return n.some((i)=>{if(!i.startsWith("*."))return!1;let s=i.slice(2).toLowerCase();return r===s||r.endsWith("."+s)})}function eh(e,t,n,r){if(!$n(t))return{verdict:"deny",reason:"malformed host"};let i=_t(t)??t;for(let s of e.deniedDomains)if($i(i,n,s))return{verdict:"deny",reason:e.deniedDomainReasons?.[s]??"host is on the deny list",rule:s};for(let s of e.allowedDomains)if($i(i,n,s))return{verdict:"allow",rule:s};if(!r||e.strictAllowlist)return{verdict:"deny",reason:"host is not on the allow list"};return{verdict:"ask"}}import{EOL as uc}from"os";import{dirname as dc}from"path";var N,qi,Gi,ji,$t,qr,Hi,th=!1,Pa,zn,zr,$e,Qr,Qn,Gr,Na,rh=!1,zi,yn=new Ca,Yt=new Al,Yn=new Bl,Xn=new xl;function lh(){let e=N?.network.brokerForward;if(!e)return[];let t=process.env[e.tokenEnvVar];if(t)for(let n of e.rules){let r=process.env[n.envVar];if(r)Xn.register(r,t,n.hosts,e.url)}return[e.tokenEnvVar]}function zS(e){return N?.network.brokerForward?.rules.some((t)=>t.hosts.includes(e))??!1}var Qi=new Rl;function QS(){if(th)return;let e=()=>vc().catch((t)=>{C(`Cleanup failed in registerCleanup ${t}`,{level:"error"})});process.once("exit",e),process.once("SIGINT",e),process.once("SIGTERM",e),th=!0}var XS=1024,mn=new Map;function ch(e,t){let n=t?.commandId,r=t?.commandText??e;if(n===void 0||n===r)return;let i=en(Nt(n));mn.delete(i),mn.set(i,r);while(mn.size>XS){let s=mn.keys().next().value;if(s===void 0)break;mn.delete(s)}}function nh(e){return mn.get(e)??e}function fc(e,t){let n=t?(()=>{let r=en(t);return mn.get(r)??jl(r)})():void 0;if(Gn(e,n,N?.ignoreViolations))return;yn.addViolation({line:e,encodedCommand:t,command:n,timestamp:new Date})}function YS(e){try{let t=new URL(e);return`${t.origin}${t.pathname}${t.search?"?\u2026":""}`}catch{let t=e.indexOf("?");return t===-1?e:`${e.slice(0,t)}?\u2026`}}async function ih(e,t,n,r){let i=(a)=>(fc(`deny network-outbound ${t}:${e} (${a})`,r),!1);if(!N)return C("No config available, denying network request"),i("sandbox policy unavailable");let s=eh(N.network,t,e,n!==void 0);if(s.verdict==="allow")return C(`Allowed by config rule: ${t}:${e}`),!0;if(s.verdict==="deny"){if(s.reason==="malformed host")C(`Denying malformed host: ${JSON.stringify(t)}:${e}`,{level:"error"});else if(s.rule!==void 0)C(`Denied by config rule: ${t}:${e}`);else C(`No matching config rule, denying: ${t}:${e}`);return i(s.reason)}C(`No matching config rule, asking user: ${t}:${e}`);try{if(await n({host:t,port:e}))return C(`User allowed: ${t}:${e}`),!0;return C(`User denied: ${t}:${e}`),i("user denied")}catch(a){return C(`Error in permission callback: ${a}`,{level:"error"}),i("permission prompt failed")}}var Da=!1;function JS(e){Da=e}function ZS(){if(!Da&&!N?.credentials)return;return(e,t)=>{if(!N?.credentials)return;Yt.substituteInHeaders(e,t,wr)}}function eb(){if(!Da&&!N?.credentials)return;return(e)=>N?.credentials?Yt.sentinelsForHost(e,wr):void 0}function tb(){if(!Da&&!N?.credentials)return;return(e,t,n,r)=>!N?.credentials?void 0:Gf(Yn,N?.credentials?.sigv4,wr)(e,t,n,r)}function rb(e){if(!N?.network.mitmProxy)return;let{socketPath:t,domains:n}=N.network.mitmProxy,r=_t(e)??e;for(let i of n)if(wr(r,i))return C(`Host ${e} matches MITM pattern ${i}`),t;return}function nb(e){let t=N?.network.tlsTerminate?.excludeDomains;if(!t?.length)return!0;let n=_t(e)??e;if(zS(n))return!0;for(let r of t){if(!wr(n,r))continue;C(`Host ${e} matches tlsTerminate.excludeDomains pattern ${r}; skipping TLS termination`);let i=Yt.namesInjectableAt(n,wr);if(i.length>0)C(`tlsTerminate.excludeDomains: masked credential(s) ${i.join(", ")} are configured for injection at ${e}, but its connections are not terminated, so the upstream will receive the placeholder`,{level:"error"});return!1}return!0}async function ib(e,t){let n=ZS(),r=eb();qi=Cf({filter:(o,l,c,u)=>ih(o,l,e,u),getMitmSocketPath:rb,mitmCA:$e,shouldTerminateTLS:nb,filterRequest:N?.network.filterRequest,onFilterRequestDenied:({method:o,url:l,reason:c,encodedCommand:u})=>{fc(`deny http-request ${o} ${YS(l)} (${c})`,u)},mutateHeaders:n,mutateHeadersPlaintext:N?.credentials?.allowPlaintextInject?n:void 0,getBrokerForward:(o,l)=>N?.network.brokerForward?Xn.forwardFor(o,l):void 0,getBodySubstitutions:r,getBodySubstitutionsPlaintext:N?.credentials?.allowPlaintextInject?r:void 0,planSigv4:tb(),parentProxy:zr,proxyAuthToken:Qr}),Gi=Bf({filter:(o,l,c)=>ih(o,l,e,c),parentProxy:zr,proxyAuthToken:Qr,probeUnauthenticated:async(o,l)=>{if(!N)return{};let c=_t(l)??l;for(let u of N.network.deniedDomains)if($i(c,o,u)){let d=N.network.deniedDomainReasons?.[u]??"host is on the deny list";return fc(`deny network-outbound ${l}:${o} (${d})`,void 0),{deniedReason:d}}return{}}}),ji=Df({httpServer:qi,handleSocksConnection:(o)=>Gi.handleConnection(o),httpBackendPortRange:t});let i=ji,s=await i.listenHttpBackend();await la(i.server,(o)=>i.server.listen(o,"127.0.0.1"),t,s!==void 0?new Set([s]):new Set);let a=i.getPort();if(a===void 0)throw Error("Failed to get mux proxy server port");return i.unref(),C(`Mux proxy (HTTP+SOCKS) listening on localhost:${a}`),a}async function sb(e,t,n=!1){if(qr){await qr;return}if(N=e,zr=pl(e.network.parentProxy),zr)C(`Parent proxy configured: http=${ml(zr.httpUrl)} https=${ml(zr.httpsUrl)}`);if(e.network.tlsTerminate&&e.network.mitmProxy)throw Error("network.tlsTerminate and network.mitmProxy are mutually exclusive");let r=e.network.tlsTerminate,i=Ne()==="windows"&&r!==void 0&&!r.caCertPath&&!r.caKeyPath;if($e=r&&!i?ol(r):void 0,$e&&e.runAsHostUid!==void 0&&Ne()==="linux"){if(jr.chmodSync(dc($e.trustBundlePath),457),jr.chmodSync($e.trustBundlePath,420),$e.ephemeral)jr.chmodSync(dc($e.certPath),457),jr.chmodSync($e.certPath,420)}let s=await fh();if(s.errors.length>0)throw Error(`Sandbox dependencies not available: ${s.errors.join(", ")}`);if(n&&Ne()==="macos")Pa=_p(yn.addViolation.bind(yn),N.ignoreViolations,nh),C("Started macOS sandbox log monitor");if(n&&Ne()==="linux")zn=Rp(yn.addViolation.bind(yn),{allowWritePaths:[...bn(e.runAsHostHome),...N.filesystem.allowWrite],denyWritePaths:N.filesystem.denyWrite,ignoreViolations:N.ignoreViolations,resolveCommandText:nh,consumerUid:e.runAsHostUid,consumerGid:e.runAsHostGid}),zn.ready,C("Started Linux seccomp violation monitor");if(QS(),Ne()==="windows"){zi=Bt(e.windows?.srtWin);let a=zi,o=await Fi({srtWin:a});if(!o.provisioned||!o.credPresent)throw N=void 0,new xe("not_provisioned",`Windows sandbox user is not provisioned (user=${o.provisioned}, cred=${o.credPresent}). Run \`npx sandbox-runtime windows-install\` (one UAC prompt) to provision it.`);if(!rh){try{await rc({proxyPortRange:e.windows?.proxyPortRange,srtWin:a})}catch(l){throw N=void 0,l}rh=!0}if(i&&r)try{let l=await sc({status:o,srtWin:a});$e=ol({caCertPem:l.certPem,caKeyPem:l.keyPem,caCertPath:l.certPath,caKeyPath:l.keyPath,extraCaCertPaths:r.extraCaCertPaths})}catch(l){throw N=void 0,l}if(r&&$e&&!i){let l=ic(o),c=Wn($e.certPem);if(!l)throw N=void 0,new xe("trust_ca_not_installed",`tlsTerminate on Windows requires the sandbox to be installed with this CA (thumb=${c}): run \`srt-win user trust-ca ${$e.certPath}\`. Per-exec installs into the sandbox user's Root store are not supported.`);if(l.thumb!==c)throw N=void 0,new xe("trust_ca_thumbprint_mismatch",`tlsTerminate on Windows: the sandbox's installed CA (thumb=${l.thumb}) doesn't match this session's CA (thumb=${c}). Run \`srt-win user trust-ca ${$e.certPath}\` to update it.`)}try{let l=ub(e);if($e)l.grantRead.push(dc($e.trustBundlePath));if(!o.sid)throw Error("sandbox user SID missing from `srt-win user status` (provisioned but in an inconsistent state)");let c=o.sid;if(Gr=c,l.grantRead.length>0||l.grantWrite.length>0)lc({sandboxUserSid:c,read:l.grantRead,write:l.grantWrite,srtWin:a});if(l.denyRead.length>0||l.denyWrite.length>0)oc({sandboxUserSid:c,denyRead:l.denyRead,denyWrite:l.denyWrite,srtWin:a});if(l.grantRead.length>0||l.grantWrite.length>0||l.denyRead.length>0||l.denyWrite.length>0)Qn=l,C(`[Sandbox Windows] fs applied: ${l.grantWrite.length} grantWrite, ${l.grantRead.length} grantRead, ${l.denyRead.length} denyRead, ${l.denyWrite.length} denyWrite`);Na=hh(e)}catch(l){if(Gr)Ra({sandboxUserSid:Gr,srtWin:a}),Ia({sandboxUserSid:Gr,srtWin:a});throw Gr=void 0,N=void 0,l}}qr=(async()=>{try{let a=Ne()==="windows"?N.windows?.proxyPortRange??wa:void 0;Qr=N.network.httpProxyPort!==void 0?void 0:jS(16).toString("hex");let l=N.network.httpProxyPort===void 0||N.network.socksProxyPort===void 0?await ib(t,a):void 0,c=N.network.httpProxyPort??l,u=N.network.socksProxyPort??l;if($e&&l!==void 0&&Ne()==="windows")$e.crlUrl=`http://127.0.0.1:${l}${Ys}`;if(N.network.httpProxyPort!==void 0)C(`Using external HTTP proxy on port ${c}`);if(N.network.socksProxyPort!==void 0)C(`Using external SOCKS proxy on port ${u}`);let d;if(Ne()==="linux")d=await xp(c,u,N.socatPath,N.runAsHostUid,N.runAsHostGid);let f={httpProxyPort:c,socksProxyPort:u,linuxBridge:d};return $t=f,C("Network infrastructure initialized"),f}catch(a){throw qr=void 0,$t=void 0,vc().catch((o)=>{C(`Cleanup failed in initializationPromise ${o}`,{level:"error"})}),a}})(),await qr}function uh(){let e=Ne();if(e==="linux")return ja()!=="1";return e==="macos"||e==="windows"}function ab(){return N!==void 0}function dh(e){if(!uh())return{done:{errors:["Unsupported platform"],warnings:[]}};let t=[],n=[],r=Ne();if(r==="linux"){let i=e??N?.ripgrep??{command:"rg"};if(br(i.command)===null)t.push(`ripgrep (${i.command}) not found`);let s=vp({seccompConfig:N?.seccomp,bwrapPath:N?.bwrapPath,socatPath:N?.socatPath});t.push(...s.errors),n.push(...s.warnings)}else if(r==="windows"){let i;try{i=Bt(N?.windows?.srtWin)}catch(s){return t.push(s.message),{done:{errors:t,warnings:n}}}return{windows:{sublayerGuid:N?.windows?.sublayerGuid??N?.windows?.wfpSublayerGuid,srtWin:i}}}return{done:{errors:t,warnings:n}}}function ob(e){let t=dh(e);if("done"in t)return t.done;return Jp(t.windows)}async function fh(e){let t=dh(e);if("done"in t)return t.done;return cc(t.windows)}function hc(e,t){if(!e)return{denyReadPaths:[],unsetEnvVars:[],setEnvVars:{},maskedFileBinds:[],maskedFileStoreDir:void 0};let n=La(e),r=[...new Set((t??[]).map(Wi))],i=[];for(let u of e.envVars??[])if(u.mode==="deny")i.push(u.name);let{setEnvVars:s,degradeToUnsetNames:a}=Wf(e.envVars??[],r,Yt);i.push(...a),qf(e.envVars??[],e.awsPairs,r,s,Yn);let o=e.files??[],{binds:l,degradeToDenyPaths:c}=Mf(o,r,Yt,Qi);return{denyReadPaths:[...new Set([...n,...c])],unsetEnvVars:[...new Set(i)],setEnvVars:s,maskedFileBinds:l,maskedFileStoreDir:Qi.dirPath}}function La(e){let t=e?.files??[];return[...new Set(t.filter((n)=>n.mode==="deny").map((n)=>n.path))]}function ph(e,t){return[...new Set([...e,...t.denyReadPaths])]}function lb(){if(!N||N.filesystem.disabled)return{denyOnly:[],allowWithinDeny:[]};let e=ph(N.filesystem.denyRead,hc(N.credentials,N.network.allowedDomains)),t=[];for(let r of e){let i=mr(r);if(Ne()==="linux"&&xt(i)){let s=tn(r);C(`[Sandbox] Expanded glob pattern "${r}" to ${s.length} paths on Linux`),t.push(...s)}else t.push(i)}let n=[];for(let r of N.filesystem.allowRead??[]){let i=mr(r);if(Ne()==="linux"&&xt(i)){let s=tn(r);C(`[Sandbox] Expanded allowRead glob pattern "${r}" to ${s.length} paths on Linux`),n.push(...s)}else n.push(i)}return{denyOnly:t,allowWithinDeny:n}}function cb(){if(!N)return{allowOnly:bn(),denyWithinAllow:[]};if(N.filesystem.disabled)return{allowOnly:["/"],denyWithinAllow:[]};let e=N.filesystem.allowWrite.map((r)=>mr(r)).filter((r)=>{if(Ne()==="linux"&&xt(r))return C(`Skipping glob pattern on Linux/WSL: ${r}`),!1;return!0}),t=N.filesystem.denyWrite.map((r)=>mr(r)).filter((r)=>{if(Ne()==="linux"&&xt(r))return C(`Skipping glob pattern on Linux/WSL: ${r}`),!1;return!0});return{allowOnly:[...bn(pc()),...e],denyWithinAllow:t}}function ub(e){let t=e.filesystem;if(t?.disabled)return{grantRead:[],grantWrite:[],denyRead:[],denyWrite:[]};let n=ka,r=n([...new Set([...t?.denyRead??[],...La(e.credentials)])],{mode:"deny"}),i=n(t?.denyWrite??[],{mode:"deny"});return{grantRead:n(t?.allowRead??[],{mode:"grant"}),grantWrite:n(t?.allowWrite??[],{mode:"grant"}),denyRead:r,denyWrite:i}}function hh(e){return{disabled:e.filesystem.disabled??!1,denyRead:[...e.filesystem.denyRead],denyWrite:[...e.filesystem.denyWrite],allowRead:[...e.filesystem.allowRead??[]],allowWrite:[...e.filesystem.allowWrite],credFiles:La(e.credentials)}}function Ki(e,t){if(e.length!==t.length)return!1;let n=new Set(e);return t.every((r)=>n.has(r))}function db(e,t){return e.disabled===t.disabled&&Ki(e.denyRead,t.denyRead)&&Ki(e.denyWrite,t.denyWrite)&&Ki(e.allowRead,t.allowRead)&&Ki(e.allowWrite,t.allowWrite)&&Ki(e.credFiles,t.credFiles)}function fb(e){return Na!==void 0&&db(Na,hh(e))}function pb(){if(!N)return{};let e=N.network.allowedDomains,t=N.network.deniedDomains;return{allowedHosts:e,...t.length>0&&{deniedHosts:t}}}function gh(){return N?.network?.allowUnixSockets}function sh(){return N?.network?.allowAllUnixSockets}function mh(){return N?.network?.allowLocalBinding}function yh(){return N?.network?.allowMachLookup}function vh(){return N?.ignoreViolations}function xh(){return N?.enableWeakerNestedSandbox}function hb(){return N?.runAsUid}function gb(){return N?.runAsGid}function mb(){return N?.runAsHostUid}function yb(){return N?.runAsHostGid}function pc(){return N?.runAsHostHome}function vb(){return N?.runAsHostUser}function xb(){return N?.enableWeakerNetworkIsolation}function Sb(){return N?.allowAppleEvents}function bb(){return N?.ripgrep??{command:"rg"}}function Cb(){return N?.mandatoryDenySearchDepth??3}function ah(){return N?.filesystem?.allowGitConfig??!1}function Sh(e){return[...N?.git?.safeDirectories??[],...e?.git?.safeDirectories??[]]}function Eb(){return N?.seccomp}function wb(){return Qr}function gc(){return $t?.httpProxyPort}function mc(){return $t?.socksProxyPort}function bh(){return $t?.linuxBridge?.httpSocketPath}function Ch(){return $t?.linuxBridge?.socksSocketPath}async function yc(){if(!N)return!1;if(qr)try{return await qr,!0}catch{return!1}return $t!==void 0}async function Eh(e,t,n,r,i){let s=Ne(),a=i?.commandId;ch(e,i);let o=n?.filesystem!==void 0?n.filesystem.disabled??!1:N?.filesystem.disabled??!1,l=hc(n?.credentials??N?.credentials,n?.network?.allowedDomains??N?.network?.allowedDomains);l.unsetEnvVars.push(...lh());let c,u;if(!o){let x=(R)=>R.map((M)=>mr(M)).filter((M)=>{if(Ne()==="linux"&&xt(M))return C(`[Sandbox] Skipping glob write pattern on Linux: ${M}`),!1;return!0}),b=x(n?.filesystem?.allowWrite??N?.filesystem.allowWrite??[]);c={allowOnly:[...bn(n?.runAsHostHome??pc()),...b],denyWithinAllow:x(n?.filesystem?.denyWrite??N?.filesystem.denyWrite??[])};let A=ph(n?.filesystem?.denyRead??N?.filesystem.denyRead??[],l),E=[];for(let R of A){let M=mr(R);if(Ne()==="linux"&&xt(M))E.push(...tn(R));else E.push(M)}let k=n?.filesystem?.allowRead??N?.filesystem.allowRead??[],I=[];for(let R of k){let M=mr(R);if(Ne()==="linux"&&xt(M))I.push(...tn(R));else I.push(M)}if($e)I.push($e.certPath,$e.trustBundlePath);u={denyOnly:E,allowWithinDeny:I}}let d=n?.network?.allowedDomains!==void 0||N?.network?.allowedDomains!==void 0,f=d,y=d;if(y)await yc();let p=n?.allowPty??N?.allowPty,v=Sh(n);switch(s){case"macos":return Ap({command:e,commandId:a,needsNetworkRestriction:f,httpProxyPort:y?gc():void 0,socksProxyPort:y?mc():void 0,proxyAuthToken:y?Qr:void 0,caCertPath:$e?.trustBundlePath,readConfig:u,writeConfig:c,unsetEnvVars:l.unsetEnvVars,setEnvVars:l.setEnvVars,maskedFileBinds:l.maskedFileBinds,allowUnixSockets:gh(),allowAllUnixSockets:sh(),allowLocalBinding:mh(),allowMachLookup:yh(),ignoreViolations:vh(),allowPty:p,allowGitConfig:ah(),gitSafeDirectories:v,enableWeakerNetworkIsolation:xb(),allowAppleEvents:Sb(),binShell:t});case"linux":return Sp({command:e,commandId:a,needsNetworkRestriction:f,httpSocketPath:y?bh():void 0,socksSocketPath:y?Ch():void 0,httpProxyPort:y?$t?.httpProxyPort:void 0,socksProxyPort:y?$t?.socksProxyPort:void 0,proxyAuthToken:y?Qr:void 0,caCertPath:$e?.trustBundlePath,readConfig:u,writeConfig:c,unsetEnvVars:l.unsetEnvVars,setEnvVars:l.setEnvVars,maskedFileBinds:l.maskedFileBinds,maskedFileStoreDir:l.maskedFileStoreDir,enableWeakerNestedSandbox:xh(),runAsUid:hb(),runAsGid:gb(),runAsHostUid:mb(),runAsHostGid:yb(),runAsHostHome:pc(),runAsHostUser:vb(),setprivPath:"/usr/bin/setpriv",allowAllUnixSockets:sh(),binShell:t,ripgrepConfig:bb(),mandatoryDenySearchDepth:Cb(),allowGitConfig:ah(),gitSafeDirectories:v,seccompConfig:Eb(),bwrapPath:N?.bwrapPath,socatPath:N?.socatPath,observeSocketPath:zn?.observeSocketPath,startFd:i?.startFd,abortSignal:r});case"windows":throw Error("wrapWithSandbox() returns a shell string and is not supported on Windows. Use SandboxManager.wrapWithSandboxArgv() and spawn the result with {shell: false}.");default:throw Error(`Sandbox configuration is not supported on platform: ${s}`)}}async function Tb(e,t,n,r,i,s){if(Ne()==="windows"){let c=n?.network?.allowedDomains!==void 0||N?.network?.allowedDomains!==void 0;if(c)await yc();let u=hc(n?.credentials??N?.credentials,n?.network?.allowedDomains??N?.network?.allowedDomains);u.unsetEnvVars.push(...lh());let d=n?.filesystem,f=[],y=[];if(!d?.disabled){if(d?.allowRead?.length||d?.allowWrite?.length)throw Error("Per-exec filesystem.allowRead/allowWrite is not supported "+"on Windows \u2014 `srt-win exec` only exposes per-exec "+"denies. Set them at the session level (initialize()).");let p=[...d?.denyRead??[],...La(n?.credentials)],v=d?.denyWrite??[];if(p.length>0||v.length>0){let x=new Set(Qn?.denyRead??[]),b=new Set(Qn?.denyWrite??[]),A=ka;f=A(p,{mode:"deny"}).filter((E)=>!x.has(E)),y=A(v,{mode:"deny"}).filter((E)=>!x.has(E)&&!b.has(E))}}return ch(e,s),Xp({command:e,commandId:s?.commandId,httpProxyPort:c?gc():void 0,socksProxyPort:c?mc():void 0,proxyAuthToken:c?Qr:void 0,setEnvVars:u.setEnvVars,denyRead:f,denyWrite:y,cwd:i,allowWrite:Qn?.grantWrite,gitSafeDirectories:Sh(n),caCertPath:$e?.trustBundlePath,binShell:Ta(t),srtWin:n?.windows?.srtWin?Bt(n.windows.srtWin):zi??Bt(N?.windows?.srtWin)})}if(typeof t==="object")throw Error("binShell object form is Windows-only; pass a shell path string on macOS/Linux");let o=await Eh(e,t,n,r,s);return{argv:[t??"/bin/bash","-c",o],env:process.env}}function Ab(){return N}function _b(){Yt.clear(),Yn.clear(),Xn.clear(),Qi.dispose()}function kb(e){if(Ne()==="windows"&&N&&!fb(e))C("[Sandbox Windows] updateConfig: the resolved file-access set "+"(filesystem.* \u222A credentials.files) changed but the ACL "+"stamp/grant is session-wide \u2014 call reset() then initialize() "+"to apply. The previously-applied set stays in effect.",{level:"warn"});let{filterRequest:t,...n}=e.network;N=structuredClone({...e,network:n}),N.network.filterRequest=t,zr=pl(e.network.parentProxy),C("Sandbox configuration updated")}function Ib(){ba()}var Rb=1500;function oh(e,t){if(!e.pid||e.exitCode!==null||e.signalCode!==null)return Promise.resolve();try{process.kill(e.pid,"SIGTERM"),C(`Sent SIGTERM to ${t} bridge process`)}catch(n){if(n.code!=="ESRCH")C(`Error killing ${t} bridge: ${n}`,{level:"error"});return Promise.resolve()}return new Promise((n)=>{let r=!1,i=()=>{if(r)return;r=!0,clearTimeout(s),n()};e.once("exit",()=>{C(`${t} bridge process exited`),i()});let s=setTimeout(()=>{if(e.exitCode===null&&e.signalCode===null){C(`${t} bridge did not exit, forcing SIGKILL`,{level:"warn"});try{if(e.pid)process.kill(e.pid,"SIGKILL")}catch{}}i()},Rb);s.unref?.()})}function Bb(e){return new Promise((t)=>{if(typeof e.closeAllConnections==="function")e.closeAllConnections();e.close((n)=>{if(n&&n.message!=="Server is not running.")C(`Error closing HTTP proxy server: ${n.message}`,{level:"error"});t()})})}async function Pb(){if(Qn&&Gr){let t=Gr,n=zi,r=new Set(["revoked","stillHeld","restored","alreadyOriginal"]),i=(s,a)=>{if(!r.has(a.status))C(`[Sandbox Windows] ${s}: '${a.path}' ${a.status} \u2014 `+"ACE may be left in place; resolve and run `srt-win acl recover` to clear",{level:"warn"})};for(let s of Ra({sandboxUserSid:t,srtWin:n})??[])i("grant revoke",s);for(let s of Ia({sandboxUserSid:t,srtWin:n})??[])i("deny restore",s)}if(Qn=void 0,Gr=void 0,Na=void 0,zi=void 0,ba({force:!0}),Pa)Pa(),Pa=void 0;if(zn)zn.stop(),zn=void 0;if($t?.linuxBridge){let{httpSocketPath:t,socksSocketPath:n,httpBridgeProcess:r,socksBridgeProcess:i}=$t.linuxBridge;if(await Promise.all([oh(r,"HTTP"),oh(i,"SOCKS")]),t)try{jr.rmSync(t,{force:!0}),C("Cleaned up HTTP socket")}catch(s){C(`HTTP socket cleanup error: ${s}`,{level:"error"})}if(n)try{jr.rmSync(n,{force:!0}),C("Cleaned up SOCKS socket")}catch(s){C(`SOCKS socket cleanup error: ${s}`,{level:"error"})}}let e=[];if($e)e.push(Qd($e));if(ji)e.push(ji.close().catch((t)=>{C(`Error closing mux proxy server: ${t.message}`,{level:"error"})}));if(qi)e.push(Bb(qi));if(Gi){let t=Gi.close().catch((n)=>{C(`Error closing SOCKS proxy server: ${n.message}`,{level:"error"})});e.push(t)}await Promise.all(e),ji=void 0,qi=void 0,Qr=void 0,Gi=void 0,$t=void 0,qr=void 0,zr=void 0,$e=void 0,Yt.clear(),Yn.clear(),Qi.dispose()}async function vc(){if(Hi)return Hi;Hi=Pb();try{await Hi}finally{Hi=void 0}}function Nb(){return yn}function Db(e,t){if(!N)return t;let n=yn.getViolationsForCommand(e);if(n.length===0)return t;let r=t;r+=uc+"<sandbox_violations>"+uc;for(let i of n)r+=i.line+uc;return r+="</sandbox_violations>",r}function Lb(){if(Ne()!=="linux"||!N||N.filesystem.disabled)return[];let e=[],t=[...N.filesystem.allowWrite,...N.filesystem.denyWrite];for(let n of t){let r=mr(n);if(xt(r))e.push(n)}return e}var Ob={initialize:sb,isSupportedPlatform:uh,isSandboxingEnabled:ab,checkDependencies:ob,checkDependenciesAsync:fh,getFsReadConfig:lb,getFsWriteConfig:cb,getNetworkRestrictionConfig:pb,getAllowUnixSockets:gh,getAllowLocalBinding:mh,getAllowMachLookup:yh,getIgnoreViolations:vh,getEnableWeakerNestedSandbox:xh,getProxyPort:gc,getProxyAuthToken:wb,getSocksProxyPort:mc,getLinuxHttpSocketPath:bh,getLinuxSocksSocketPath:Ch,waitForNetworkInitialization:yc,wrapWithSandbox:Eh,wrapWithSandboxArgv:Tb,cleanupAfterCommand:Ib,beginCredentialLease:()=>{Yt.beginLease(),Xn.beginLease()},endCredentialLease:()=>Object.assign(Yt.endLease(),{brokerForward:Xn.endLease()}),releaseCredentialLease:(e)=>{Xn.release(e.brokerForward??[]),Yn.forget(Yt.release(e))},reset:vc,getMitmCA:()=>$e,getSentinelRegistry:()=>Yt,getAwsPairRegistry:()=>Yn,getMaskedFileStore:()=>Qi,getSandboxViolationStore:Nb,annotateStderrWithSandboxFailures:Db,getLinuxGlobPatternWarnings:Lb,getConfig:Ab,updateConfig:kb,clearMaskedCredentials:_b,setLiveCredentialInjectors:JS};import{isIP as uC}from"net";import{isAbsolute as dC}from"path";var Ae;(function(e){e.assertEqual=(i)=>{};function t(i){}e.assertIs=t;function n(i){throw Error()}e.assertNever=n,e.arrayToEnum=(i)=>{let s={};for(let a of i)s[a]=a;return s},e.getValidEnumValues=(i)=>{let s=e.objectKeys(i).filter((o)=>typeof i[i[o]]!=="number"),a={};for(let o of s)a[o]=i[o];return e.objectValues(a)},e.objectValues=(i)=>e.objectKeys(i).map(function(s){return i[s]}),e.objectKeys=typeof Object.keys==="function"?(i)=>Object.keys(i):(i)=>{let s=[];for(let a in i)if(Object.prototype.hasOwnProperty.call(i,a))s.push(a);return s},e.find=(i,s)=>{for(let a of i)if(s(a))return a;return},e.isInteger=typeof Number.isInteger==="function"?(i)=>Number.isInteger(i):(i)=>typeof i==="number"&&Number.isFinite(i)&&Math.floor(i)===i;function r(i,s=" | "){return i.map((a)=>typeof a==="string"?`'${a}'`:a).join(s)}e.joinValues=r,e.jsonStringifyReplacer=(i,s)=>{if(typeof s==="bigint")return s.toString();return s}})(Ae||(Ae={}));var wh;(function(e){e.mergeShapes=(t,n)=>({...t,...n})})(wh||(wh={}));var z=Ae.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),Tr=(e)=>{switch(typeof e){case"undefined":return z.undefined;case"string":return z.string;case"number":return Number.isNaN(e)?z.nan:z.number;case"boolean":return z.boolean;case"function":return z.function;case"bigint":return z.bigint;case"symbol":return z.symbol;case"object":if(Array.isArray(e))return z.array;if(e===null)return z.null;if(e.then&&typeof e.then==="function"&&e.catch&&typeof e.catch==="function")return z.promise;if(typeof Map<"u"&&e instanceof Map)return z.map;if(typeof Set<"u"&&e instanceof Set)return z.set;if(typeof Date<"u"&&e instanceof Date)return z.date;return z.object;default:return z.unknown}};var P=Ae.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]);class Pt extends Error{get errors(){return this.issues}constructor(e){super();this.issues=[],this.addIssue=(n)=>{this.issues=[...this.issues,n]},this.addIssues=(n=[])=>{this.issues=[...this.issues,...n]};let t=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,t);else this.__proto__=t;this.name="ZodError",this.issues=e}format(e){let t=e||function(i){return i.message},n={_errors:[]},r=(i)=>{for(let s of i.issues)if(s.code==="invalid_union")s.unionErrors.map(r);else if(s.code==="invalid_return_type")r(s.returnTypeError);else if(s.code==="invalid_arguments")r(s.argumentsError);else if(s.path.length===0)n._errors.push(t(s));else{let a=n,o=0;while(o<s.path.length){let l=s.path[o];if(o!==s.path.length-1)a[l]=a[l]||{_errors:[]};else a[l]=a[l]||{_errors:[]},a[l]._errors.push(t(s));a=a[l],o++}}};return r(this),n}static assert(e){if(!(e instanceof Pt))throw Error(`Not a ZodError: ${e}`)}toString(){return this.message}get message(){return JSON.stringify(this.issues,Ae.jsonStringifyReplacer,2)}get isEmpty(){return this.issues.length===0}flatten(e=(t)=>t.message){let t={},n=[];for(let r of this.issues)if(r.path.length>0){let i=r.path[0];t[i]=t[i]||[],t[i].push(e(r))}else n.push(e(r));return{formErrors:n,fieldErrors:t}}get formErrors(){return this.flatten()}}Pt.create=(e)=>new Pt(e);var Ub=(e,t)=>{let n;switch(e.code){case P.invalid_type:if(e.received===z.undefined)n="Required";else n=`Expected ${e.expected}, received ${e.received}`;break;case P.invalid_literal:n=`Invalid literal value, expected ${JSON.stringify(e.expected,Ae.jsonStringifyReplacer)}`;break;case P.unrecognized_keys:n=`Unrecognized key(s) in object: ${Ae.joinValues(e.keys,", ")}`;break;case P.invalid_union:n="Invalid input";break;case P.invalid_union_discriminator:n=`Invalid discriminator value. Expected ${Ae.joinValues(e.options)}`;break;case P.invalid_enum_value:n=`Invalid enum value. Expected ${Ae.joinValues(e.options)}, received '${e.received}'`;break;case P.invalid_arguments:n="Invalid function arguments";break;case P.invalid_return_type:n="Invalid function return type";break;case P.invalid_date:n="Invalid date";break;case P.invalid_string:if(typeof e.validation==="object")if("includes"in e.validation){if(n=`Invalid input: must include "${e.validation.includes}"`,typeof e.validation.position==="number")n=`${n} at one or more positions greater than or equal to ${e.validation.position}`}else if("startsWith"in e.validation)n=`Invalid input: must start with "${e.validation.startsWith}"`;else if("endsWith"in e.validation)n=`Invalid input: must end with "${e.validation.endsWith}"`;else Ae.assertNever(e.validation);else if(e.validation!=="regex")n=`Invalid ${e.validation}`;else n="Invalid";break;case P.too_small:if(e.type==="array")n=`Array must contain ${e.exact?"exactly":e.inclusive?"at least":"more than"} ${e.minimum} element(s)`;else if(e.type==="string")n=`String must contain ${e.exact?"exactly":e.inclusive?"at least":"over"} ${e.minimum} character(s)`;else if(e.type==="number")n=`Number must be ${e.exact?"exactly equal to ":e.inclusive?"greater than or equal to ":"greater than "}${e.minimum}`;else if(e.type==="bigint")n=`Number must be ${e.exact?"exactly equal to ":e.inclusive?"greater than or equal to ":"greater than "}${e.minimum}`;else if(e.type==="date")n=`Date must be ${e.exact?"exactly equal to ":e.inclusive?"greater than or equal to ":"greater than "}${new Date(Number(e.minimum))}`;else n="Invalid input";break;case P.too_big:if(e.type==="array")n=`Array must contain ${e.exact?"exactly":e.inclusive?"at most":"less than"} ${e.maximum} element(s)`;else if(e.type==="string")n=`String must contain ${e.exact?"exactly":e.inclusive?"at most":"under"} ${e.maximum} character(s)`;else if(e.type==="number")n=`Number must be ${e.exact?"exactly":e.inclusive?"less than or equal to":"less than"} ${e.maximum}`;else if(e.type==="bigint")n=`BigInt must be ${e.exact?"exactly":e.inclusive?"less than or equal to":"less than"} ${e.maximum}`;else if(e.type==="date")n=`Date must be ${e.exact?"exactly":e.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number(e.maximum))}`;else n="Invalid input";break;case P.custom:n="Invalid input";break;case P.invalid_intersection_types:n="Intersection results could not be merged";break;case P.not_multiple_of:n=`Number must be a multiple of ${e.multipleOf}`;break;case P.not_finite:n="Number must be finite";break;default:n=t.defaultError,Ae.assertNever(e)}return{message:n}},Xr=Ub;var Vb=Xr;function Xi(){return Vb}var Oa=(e)=>{let{data:t,path:n,errorMaps:r,issueData:i}=e,s=[...n,...i.path||[]],a={...i,path:s};if(i.message!==void 0)return{...i,path:s,message:i.message};let o="",l=r.filter((c)=>!!c).slice().reverse();for(let c of l)o=c(a,{data:t,defaultError:o}).message;return{...i,path:s,message:o}};function q(e,t){let n=Xi(),r=Oa({issueData:t,data:e.data,path:e.path,errorMaps:[e.common.contextualErrorMap,e.schemaErrorMap,n,n===Xr?void 0:Xr].filter((i)=>!!i)});e.common.issues.push(r)}class vt{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray(e,t){let n=[];for(let r of t){if(r.status==="aborted")return ae;if(r.status==="dirty")e.dirty();n.push(r.value)}return{status:e.value,value:n}}static async mergeObjectAsync(e,t){let n=[];for(let r of t){let i=await r.key,s=await r.value;n.push({key:i,value:s})}return vt.mergeObjectSync(e,n)}static mergeObjectSync(e,t){let n={};for(let r of t){let{key:i,value:s}=r;if(i.status==="aborted")return ae;if(s.status==="aborted")return ae;if(i.status==="dirty")e.dirty();if(s.status==="dirty")e.dirty();if(i.value!=="__proto__"&&(typeof s.value<"u"||r.alwaysSet))n[i.value]=s.value}return{status:e.value,value:n}}}var ae=Object.freeze({status:"aborted"}),Jn=(e)=>({status:"dirty",value:e}),wt=(e)=>({status:"valid",value:e}),xc=(e)=>e.status==="aborted",Sc=(e)=>e.status==="dirty",vn=(e)=>e.status==="valid",Yi=(e)=>typeof Promise<"u"&&e instanceof Promise;var J;(function(e){e.errToObj=(t)=>typeof t==="string"?{message:t}:t||{},e.toString=(t)=>typeof t==="string"?t:t?.message})(J||(J={}));class Jt{constructor(e,t,n,r){this._cachedPath=[],this.parent=e,this.data=t,this._path=n,this._key=r}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var Th=(e,t)=>{if(vn(t))return{success:!0,data:t.value};else{if(!e.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let n=new Pt(e.common.issues);return this._error=n,this._error}}}};function he(e){if(!e)return{};let{errorMap:t,invalid_type_error:n,required_error:r,description:i}=e;if(t&&(n||r))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if(t)return{errorMap:t,description:i};return{errorMap:(a,o)=>{let{message:l}=e;if(a.code==="invalid_enum_value")return{message:l??o.defaultError};if(typeof o.data>"u")return{message:l??r??o.defaultError};if(a.code!=="invalid_type")return{message:o.defaultError};return{message:l??n??o.defaultError}},description:i}}class Se{get description(){return this._def.description}_getType(e){return Tr(e.data)}_getOrReturnCtx(e,t){return t||{common:e.parent.common,data:e.data,parsedType:Tr(e.data),schemaErrorMap:this._def.errorMap,path:e.path,parent:e.parent}}_processInputParams(e){return{status:new vt,ctx:{common:e.parent.common,data:e.data,parsedType:Tr(e.data),schemaErrorMap:this._def.errorMap,path:e.path,parent:e.parent}}}_parseSync(e){let t=this._parse(e);if(Yi(t))throw Error("Synchronous parse encountered promise.");return t}_parseAsync(e){let t=this._parse(e);return Promise.resolve(t)}parse(e,t){let n=this.safeParse(e,t);if(n.success)return n.data;throw n.error}safeParse(e,t){let n={common:{issues:[],async:t?.async??!1,contextualErrorMap:t?.errorMap},path:t?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:Tr(e)},r=this._parseSync({data:e,path:n.path,parent:n});return Th(n,r)}"~validate"(e){let t={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:Tr(e)};if(!this["~standard"].async)try{let n=this._parseSync({data:e,path:[],parent:t});return vn(n)?{value:n.value}:{issues:t.common.issues}}catch(n){if(n?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;t.common={issues:[],async:!0}}return this._parseAsync({data:e,path:[],parent:t}).then((n)=>vn(n)?{value:n.value}:{issues:t.common.issues})}async parseAsync(e,t){let n=await this.safeParseAsync(e,t);if(n.success)return n.data;throw n.error}async safeParseAsync(e,t){let n={common:{issues:[],contextualErrorMap:t?.errorMap,async:!0},path:t?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:Tr(e)},r=this._parse({data:e,path:n.path,parent:n}),i=await(Yi(r)?r:Promise.resolve(r));return Th(n,i)}refine(e,t){let n=(r)=>{if(typeof t==="string"||typeof t>"u")return{message:t};else if(typeof t==="function")return t(r);else return t};return this._refinement((r,i)=>{let s=e(r),a=()=>i.addIssue({code:P.custom,...n(r)});if(typeof Promise<"u"&&s instanceof Promise)return s.then((o)=>{if(!o)return a(),!1;else return!0});if(!s)return a(),!1;else return!0})}refinement(e,t){return this._refinement((n,r)=>{if(!e(n))return r.addIssue(typeof t==="function"?t(n,r):t),!1;else return!0})}_refinement(e){return new hr({schema:this,typeName:oe.ZodEffects,effect:{type:"refinement",refinement:e}})}superRefine(e){return this._refinement(e)}constructor(e){this.spa=this.safeParseAsync,this._def=e,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:(t)=>this["~validate"](t)}}optional(){return pr.create(this,this._def)}nullable(){return Yr.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return fr.create(this)}promise(){return ii.create(this,this._def)}or(e){return rs.create([this,e],this._def)}and(e){return ns.create(this,e,this._def)}transform(e){return new hr({...he(this._def),schema:this,typeName:oe.ZodEffects,effect:{type:"transform",transform:e}})}default(e){let t=typeof e==="function"?e:()=>e;return new os({...he(this._def),innerType:this,defaultValue:t,typeName:oe.ZodDefault})}brand(){return new wc({typeName:oe.ZodBranded,type:this,...he(this._def)})}catch(e){let t=typeof e==="function"?e:()=>e;return new ls({...he(this._def),innerType:this,catchValue:t,typeName:oe.ZodCatch})}describe(e){return new this.constructor({...this._def,description:e})}pipe(e){return Ha.create(this,e)}readonly(){return cs.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var Fb=/^c[^\s-]{8,}$/i,Mb=/^[0-9a-z]+$/,Wb=/^[0-9A-HJKMNP-TV-Z]{26}$/i,$b=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,Hb=/^[a-z0-9_-]{21}$/i,Kb=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,qb=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,Gb=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,jb="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",bc,zb=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,Qb=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,Xb=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,Yb=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,Jb=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,Zb=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,_h="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",eC=new RegExp(`^${_h}$`);function kh(e){let t="[0-5]\\d";if(e.precision)t=`${t}\\.\\d{${e.precision}}`;else if(e.precision==null)t=`${t}(\\.\\d+)?`;let n=e.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${t})${n}`}function tC(e){return new RegExp(`^${kh(e)}$`)}function rC(e){let t=`${_h}T${kh(e)}`,n=[];if(n.push(e.local?"Z?":"Z"),e.offset)n.push("([+-]\\d{2}:?\\d{2})");return t=`${t}(${n.join("|")})`,new RegExp(`^${t}$`)}function nC(e,t){if((t==="v4"||!t)&&zb.test(e))return!0;if((t==="v6"||!t)&&Xb.test(e))return!0;return!1}function iC(e,t){if(!Kb.test(e))return!1;try{let[n]=e.split(".");if(!n)return!1;let r=n.replace(/-/g,"+").replace(/_/g,"/").padEnd(n.length+(4-n.length%4)%4,"="),i=JSON.parse(atob(r));if(typeof i!=="object"||i===null)return!1;if("typ"in i&&i?.typ!=="JWT")return!1;if(!i.alg)return!1;if(t&&i.alg!==t)return!1;return!0}catch{return!1}}function sC(e,t){if((t==="v4"||!t)&&Qb.test(e))return!0;if((t==="v6"||!t)&&Yb.test(e))return!0;return!1}class _r extends Se{_parse(e){if(this._def.coerce)e.data=String(e.data);if(this._getType(e)!==z.string){let i=this._getOrReturnCtx(e);return q(i,{code:P.invalid_type,expected:z.string,received:i.parsedType}),ae}let n=new vt,r=void 0;for(let i of this._def.checks)if(i.kind==="min"){if(e.data.length<i.value)r=this._getOrReturnCtx(e,r),q(r,{code:P.too_small,minimum:i.value,type:"string",inclusive:!0,exact:!1,message:i.message}),n.dirty()}else if(i.kind==="max"){if(e.data.length>i.value)r=this._getOrReturnCtx(e,r),q(r,{code:P.too_big,maximum:i.value,type:"string",inclusive:!0,exact:!1,message:i.message}),n.dirty()}else if(i.kind==="length"){let s=e.data.length>i.value,a=e.data.length<i.value;if(s||a){if(r=this._getOrReturnCtx(e,r),s)q(r,{code:P.too_big,maximum:i.value,type:"string",inclusive:!0,exact:!0,message:i.message});else if(a)q(r,{code:P.too_small,minimum:i.value,type:"string",inclusive:!0,exact:!0,message:i.message});n.dirty()}}else if(i.kind==="email"){if(!Gb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"email",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="emoji"){if(!bc)bc=new RegExp(jb,"u");if(!bc.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"emoji",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="uuid"){if(!$b.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"uuid",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="nanoid"){if(!Hb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"nanoid",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="cuid"){if(!Fb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"cuid",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="cuid2"){if(!Mb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"cuid2",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="ulid"){if(!Wb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"ulid",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="url")try{new URL(e.data)}catch{r=this._getOrReturnCtx(e,r),q(r,{validation:"url",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="regex"){if(i.regex.lastIndex=0,!i.regex.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"regex",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="trim")e.data=e.data.trim();else if(i.kind==="includes"){if(!e.data.includes(i.value,i.position))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:{includes:i.value,position:i.position},message:i.message}),n.dirty()}else if(i.kind==="toLowerCase")e.data=e.data.toLowerCase();else if(i.kind==="toUpperCase")e.data=e.data.toUpperCase();else if(i.kind==="startsWith"){if(!e.data.startsWith(i.value))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:{startsWith:i.value},message:i.message}),n.dirty()}else if(i.kind==="endsWith"){if(!e.data.endsWith(i.value))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:{endsWith:i.value},message:i.message}),n.dirty()}else if(i.kind==="datetime"){if(!rC(i).test(e.data))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:"datetime",message:i.message}),n.dirty()}else if(i.kind==="date"){if(!eC.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:"date",message:i.message}),n.dirty()}else if(i.kind==="time"){if(!tC(i).test(e.data))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:"time",message:i.message}),n.dirty()}else if(i.kind==="duration"){if(!qb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"duration",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="ip"){if(!nC(e.data,i.version))r=this._getOrReturnCtx(e,r),q(r,{validation:"ip",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="jwt"){if(!iC(e.data,i.alg))r=this._getOrReturnCtx(e,r),q(r,{validation:"jwt",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="cidr"){if(!sC(e.data,i.version))r=this._getOrReturnCtx(e,r),q(r,{validation:"cidr",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="base64"){if(!Jb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"base64",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="base64url"){if(!Zb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"base64url",code:P.invalid_string,message:i.message}),n.dirty()}else Ae.assertNever(i);return{status:n.value,value:e.data}}_regex(e,t,n){return this.refinement((r)=>e.test(r),{validation:t,code:P.invalid_string,...J.errToObj(n)})}_addCheck(e){return new _r({...this._def,checks:[...this._def.checks,e]})}email(e){return this._addCheck({kind:"email",...J.errToObj(e)})}url(e){return this._addCheck({kind:"url",...J.errToObj(e)})}emoji(e){return this._addCheck({kind:"emoji",...J.errToObj(e)})}uuid(e){return this._addCheck({kind:"uuid",...J.errToObj(e)})}nanoid(e){return this._addCheck({kind:"nanoid",...J.errToObj(e)})}cuid(e){return this._addCheck({kind:"cuid",...J.errToObj(e)})}cuid2(e){return this._addCheck({kind:"cuid2",...J.errToObj(e)})}ulid(e){return this._addCheck({kind:"ulid",...J.errToObj(e)})}base64(e){return this._addCheck({kind:"base64",...J.errToObj(e)})}base64url(e){return this._addCheck({kind:"base64url",...J.errToObj(e)})}jwt(e){return this._addCheck({kind:"jwt",...J.errToObj(e)})}ip(e){return this._addCheck({kind:"ip",...J.errToObj(e)})}cidr(e){return this._addCheck({kind:"cidr",...J.errToObj(e)})}datetime(e){if(typeof e==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:e});return this._addCheck({kind:"datetime",precision:typeof e?.precision>"u"?null:e?.precision,offset:e?.offset??!1,local:e?.local??!1,...J.errToObj(e?.message)})}date(e){return this._addCheck({kind:"date",message:e})}time(e){if(typeof e==="string")return this._addCheck({kind:"time",precision:null,message:e});return this._addCheck({kind:"time",precision:typeof e?.precision>"u"?null:e?.precision,...J.errToObj(e?.message)})}duration(e){return this._addCheck({kind:"duration",...J.errToObj(e)})}regex(e,t){return this._addCheck({kind:"regex",regex:e,...J.errToObj(t)})}includes(e,t){return this._addCheck({kind:"includes",value:e,position:t?.position,...J.errToObj(t?.message)})}startsWith(e,t){return this._addCheck({kind:"startsWith",value:e,...J.errToObj(t)})}endsWith(e,t){return this._addCheck({kind:"endsWith",value:e,...J.errToObj(t)})}min(e,t){return this._addCheck({kind:"min",value:e,...J.errToObj(t)})}max(e,t){return this._addCheck({kind:"max",value:e,...J.errToObj(t)})}length(e,t){return this._addCheck({kind:"length",value:e,...J.errToObj(t)})}nonempty(e){return this.min(1,J.errToObj(e))}trim(){return new _r({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new _r({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new _r({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find((e)=>e.kind==="datetime")}get isDate(){return!!this._def.checks.find((e)=>e.kind==="date")}get isTime(){return!!this._def.checks.find((e)=>e.kind==="time")}get isDuration(){return!!this._def.checks.find((e)=>e.kind==="duration")}get isEmail(){return!!this._def.checks.find((e)=>e.kind==="email")}get isURL(){return!!this._def.checks.find((e)=>e.kind==="url")}get isEmoji(){return!!this._def.checks.find((e)=>e.kind==="emoji")}get isUUID(){return!!this._def.checks.find((e)=>e.kind==="uuid")}get isNANOID(){return!!this._def.checks.find((e)=>e.kind==="nanoid")}get isCUID(){return!!this._def.checks.find((e)=>e.kind==="cuid")}get isCUID2(){return!!this._def.checks.find((e)=>e.kind==="cuid2")}get isULID(){return!!this._def.checks.find((e)=>e.kind==="ulid")}get isIP(){return!!this._def.checks.find((e)=>e.kind==="ip")}get isCIDR(){return!!this._def.checks.find((e)=>e.kind==="cidr")}get isBase64(){return!!this._def.checks.find((e)=>e.kind==="base64")}get isBase64url(){return!!this._def.checks.find((e)=>e.kind==="base64url")}get minLength(){let e=null;for(let t of this._def.checks)if(t.kind==="min"){if(e===null||t.value>e)e=t.value}return e}get maxLength(){let e=null;for(let t of this._def.checks)if(t.kind==="max"){if(e===null||t.value<e)e=t.value}return e}}_r.create=(e)=>new _r({checks:[],typeName:oe.ZodString,coerce:e?.coerce??!1,...he(e)});function aC(e,t){let n=(e.toString().split(".")[1]||"").length,r=(t.toString().split(".")[1]||"").length,i=n>r?n:r,s=Number.parseInt(e.toFixed(i).replace(".","")),a=Number.parseInt(t.toFixed(i).replace(".",""));return s%a/10**i}class ei extends Se{constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse(e){if(this._def.coerce)e.data=Number(e.data);if(this._getType(e)!==z.number){let i=this._getOrReturnCtx(e);return q(i,{code:P.invalid_type,expected:z.number,received:i.parsedType}),ae}let n=void 0,r=new vt;for(let i of this._def.checks)if(i.kind==="int"){if(!Ae.isInteger(e.data))n=this._getOrReturnCtx(e,n),q(n,{code:P.invalid_type,expected:"integer",received:"float",message:i.message}),r.dirty()}else if(i.kind==="min"){if(i.inclusive?e.data<i.value:e.data<=i.value)n=this._getOrReturnCtx(e,n),q(n,{code:P.too_small,minimum:i.value,type:"number",inclusive:i.inclusive,exact:!1,message:i.message}),r.dirty()}else if(i.kind==="max"){if(i.inclusive?e.data>i.value:e.data>=i.value)n=this._getOrReturnCtx(e,n),q(n,{code:P.too_big,maximum:i.value,type:"number",inclusive:i.inclusive,exact:!1,message:i.message}),r.dirty()}else if(i.kind==="multipleOf"){if(aC(e.data,i.value)!==0)n=this._getOrReturnCtx(e,n),q(n,{code:P.not_multiple_of,multipleOf:i.value,message:i.message}),r.dirty()}else if(i.kind==="finite"){if(!Number.isFinite(e.data))n=this._getOrReturnCtx(e,n),q(n,{code:P.not_finite,message:i.message}),r.dirty()}else Ae.assertNever(i);return{status:r.value,value:e.data}}gte(e,t){return this.setLimit("min",e,!0,J.toString(t))}gt(e,t){return this.setLimit("min",e,!1,J.toString(t))}lte(e,t){return this.setLimit("max",e,!0,J.toString(t))}lt(e,t){return this.setLimit("max",e,!1,J.toString(t))}setLimit(e,t,n,r){return new ei({...this._def,checks:[...this._def.checks,{kind:e,value:t,inclusive:n,message:J.toString(r)}]})}_addCheck(e){return new ei({...this._def,checks:[...this._def.checks,e]})}int(e){return this._addCheck({kind:"int",message:J.toString(e)})}positive(e){return this._addCheck({kind:"min",value:0,inclusive:!1,message:J.toString(e)})}negative(e){return this._addCheck({kind:"max",value:0,inclusive:!1,message:J.toString(e)})}nonpositive(e){return this._addCheck({kind:"max",value:0,inclusive:!0,message:J.toString(e)})}nonnegative(e){return this._addCheck({kind:"min",value:0,inclusive:!0,message:J.toString(e)})}multipleOf(e,t){return this._addCheck({kind:"multipleOf",value:e,message:J.toString(t)})}finite(e){return this._addCheck({kind:"finite",message:J.toString(e)})}safe(e){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:J.toString(e)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:J.toString(e)})}get minValue(){let e=null;for(let t of this._def.checks)if(t.kind==="min"){if(e===null||t.value>e)e=t.value}return e}get maxValue(){let e=null;for(let t of this._def.checks)if(t.kind==="max"){if(e===null||t.value<e)e=t.value}return e}get isInt(){return!!this._def.checks.find((e)=>e.kind==="int"||e.kind==="multipleOf"&&Ae.isInteger(e.value))}get isFinite(){let e=null,t=null;for(let n of this._def.checks)if(n.kind==="finite"||n.kind==="int"||n.kind==="multipleOf")return!0;else if(n.kind==="min"){if(t===null||n.value>t)t=n.value}else if(n.kind==="max"){if(e===null||n.value<e)e=n.value}return Number.isFinite(t)&&Number.isFinite(e)}}ei.create=(e)=>new ei({checks:[],typeName:oe.ZodNumber,coerce:e?.coerce||!1,...he(e)});class ti extends Se{constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse(e){if(this._def.coerce)try{e.data=BigInt(e.data)}catch{return this._getInvalidInput(e)}if(this._getType(e)!==z.bigint)return this._getInvalidInput(e);let n=void 0,r=new vt;for(let i of this._def.checks)if(i.kind==="min"){if(i.inclusive?e.data<i.value:e.data<=i.value)n=this._getOrReturnCtx(e,n),q(n,{code:P.too_small,type:"bigint",minimum:i.value,inclusive:i.inclusive,message:i.message}),r.dirty()}else if(i.kind==="max"){if(i.inclusive?e.data>i.value:e.data>=i.value)n=this._getOrReturnCtx(e,n),q(n,{code:P.too_big,type:"bigint",maximum:i.value,inclusive:i.inclusive,message:i.message}),r.dirty()}else if(i.kind==="multipleOf"){if(e.data%i.value!==BigInt(0))n=this._getOrReturnCtx(e,n),q(n,{code:P.not_multiple_of,multipleOf:i.value,message:i.message}),r.dirty()}else Ae.assertNever(i);return{status:r.value,value:e.data}}_getInvalidInput(e){let t=this._getOrReturnCtx(e);return q(t,{code:P.invalid_type,expected:z.bigint,received:t.parsedType}),ae}gte(e,t){return this.setLimit("min",e,!0,J.toString(t))}gt(e,t){return this.setLimit("min",e,!1,J.toString(t))}lte(e,t){return this.setLimit("max",e,!0,J.toString(t))}lt(e,t){return this.setLimit("max",e,!1,J.toString(t))}setLimit(e,t,n,r){return new ti({...this._def,checks:[...this._def.checks,{kind:e,value:t,inclusive:n,message:J.toString(r)}]})}_addCheck(e){return new ti({...this._def,checks:[...this._def.checks,e]})}positive(e){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:J.toString(e)})}negative(e){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:J.toString(e)})}nonpositive(e){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:J.toString(e)})}nonnegative(e){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:J.toString(e)})}multipleOf(e,t){return this._addCheck({kind:"multipleOf",value:e,message:J.toString(t)})}get minValue(){let e=null;for(let t of this._def.checks)if(t.kind==="min"){if(e===null||t.value>e)e=t.value}return e}get maxValue(){let e=null;for(let t of this._def.checks)if(t.kind==="max"){if(e===null||t.value<e)e=t.value}return e}}ti.create=(e)=>new ti({checks:[],typeName:oe.ZodBigInt,coerce:e?.coerce??!1,...he(e)});class Ua extends Se{_parse(e){if(this._def.coerce)e.data=Boolean(e.data);if(this._getType(e)!==z.boolean){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.boolean,received:n.parsedType}),ae}return wt(e.data)}}Ua.create=(e)=>new Ua({typeName:oe.ZodBoolean,coerce:e?.coerce||!1,...he(e)});class Zi extends Se{_parse(e){if(this._def.coerce)e.data=new Date(e.data);if(this._getType(e)!==z.date){let i=this._getOrReturnCtx(e);return q(i,{code:P.invalid_type,expected:z.date,received:i.parsedType}),ae}if(Number.isNaN(e.data.getTime())){let i=this._getOrReturnCtx(e);return q(i,{code:P.invalid_date}),ae}let n=new vt,r=void 0;for(let i of this._def.checks)if(i.kind==="min"){if(e.data.getTime()<i.value)r=this._getOrReturnCtx(e,r),q(r,{code:P.too_small,message:i.message,inclusive:!0,exact:!1,minimum:i.value,type:"date"}),n.dirty()}else if(i.kind==="max"){if(e.data.getTime()>i.value)r=this._getOrReturnCtx(e,r),q(r,{code:P.too_big,message:i.message,inclusive:!0,exact:!1,maximum:i.value,type:"date"}),n.dirty()}else Ae.assertNever(i);return{status:n.value,value:new Date(e.data.getTime())}}_addCheck(e){return new Zi({...this._def,checks:[...this._def.checks,e]})}min(e,t){return this._addCheck({kind:"min",value:e.getTime(),message:J.toString(t)})}max(e,t){return this._addCheck({kind:"max",value:e.getTime(),message:J.toString(t)})}get minDate(){let e=null;for(let t of this._def.checks)if(t.kind==="min"){if(e===null||t.value>e)e=t.value}return e!=null?new Date(e):null}get maxDate(){let e=null;for(let t of this._def.checks)if(t.kind==="max"){if(e===null||t.value<e)e=t.value}return e!=null?new Date(e):null}}Zi.create=(e)=>new Zi({checks:[],coerce:e?.coerce||!1,typeName:oe.ZodDate,...he(e)});class Va extends Se{_parse(e){if(this._getType(e)!==z.symbol){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.symbol,received:n.parsedType}),ae}return wt(e.data)}}Va.create=(e)=>new Va({typeName:oe.ZodSymbol,...he(e)});class es extends Se{_parse(e){if(this._getType(e)!==z.undefined){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.undefined,received:n.parsedType}),ae}return wt(e.data)}}es.create=(e)=>new es({typeName:oe.ZodUndefined,...he(e)});class ts extends Se{_parse(e){if(this._getType(e)!==z.null){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.null,received:n.parsedType}),ae}return wt(e.data)}}ts.create=(e)=>new ts({typeName:oe.ZodNull,...he(e)});class ri extends Se{constructor(){super(...arguments);this._any=!0}_parse(e){return wt(e.data)}}ri.create=(e)=>new ri({typeName:oe.ZodAny,...he(e)});class xn extends Se{constructor(){super(...arguments);this._unknown=!0}_parse(e){return wt(e.data)}}xn.create=(e)=>new xn({typeName:oe.ZodUnknown,...he(e)});class kr extends Se{_parse(e){let t=this._getOrReturnCtx(e);return q(t,{code:P.invalid_type,expected:z.never,received:t.parsedType}),ae}}kr.create=(e)=>new kr({typeName:oe.ZodNever,...he(e)});class Fa extends Se{_parse(e){if(this._getType(e)!==z.undefined){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.void,received:n.parsedType}),ae}return wt(e.data)}}Fa.create=(e)=>new Fa({typeName:oe.ZodVoid,...he(e)});class fr extends Se{_parse(e){let{ctx:t,status:n}=this._processInputParams(e),r=this._def;if(t.parsedType!==z.array)return q(t,{code:P.invalid_type,expected:z.array,received:t.parsedType}),ae;if(r.exactLength!==null){let s=t.data.length>r.exactLength.value,a=t.data.length<r.exactLength.value;if(s||a)q(t,{code:s?P.too_big:P.too_small,minimum:a?r.exactLength.value:void 0,maximum:s?r.exactLength.value:void 0,type:"array",inclusive:!0,exact:!0,message:r.exactLength.message}),n.dirty()}if(r.minLength!==null){if(t.data.length<r.minLength.value)q(t,{code:P.too_small,minimum:r.minLength.value,type:"array",inclusive:!0,exact:!1,message:r.minLength.message}),n.dirty()}if(r.maxLength!==null){if(t.data.length>r.maxLength.value)q(t,{code:P.too_big,maximum:r.maxLength.value,type:"array",inclusive:!0,exact:!1,message:r.maxLength.message}),n.dirty()}if(t.common.async)return Promise.all([...t.data].map((s,a)=>r.type._parseAsync(new Jt(t,s,t.path,a)))).then((s)=>vt.mergeArray(n,s));let i=[...t.data].map((s,a)=>r.type._parseSync(new Jt(t,s,t.path,a)));return vt.mergeArray(n,i)}get element(){return this._def.type}min(e,t){return new fr({...this._def,minLength:{value:e,message:J.toString(t)}})}max(e,t){return new fr({...this._def,maxLength:{value:e,message:J.toString(t)}})}length(e,t){return new fr({...this._def,exactLength:{value:e,message:J.toString(t)}})}nonempty(e){return this.min(1,e)}}fr.create=(e,t)=>new fr({type:e,minLength:null,maxLength:null,exactLength:null,typeName:oe.ZodArray,...he(t)});function Zn(e){if(e instanceof et){let t={};for(let n in e.shape){let r=e.shape[n];t[n]=pr.create(Zn(r))}return new et({...e._def,shape:()=>t})}else if(e instanceof fr)return new fr({...e._def,type:Zn(e.element)});else if(e instanceof pr)return pr.create(Zn(e.unwrap()));else if(e instanceof Yr)return Yr.create(Zn(e.unwrap()));else if(e instanceof Ir)return Ir.create(e.items.map((t)=>Zn(t)));else return e}class et extends Se{constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let e=this._def.shape(),t=Ae.objectKeys(e);return this._cached={shape:e,keys:t},this._cached}_parse(e){if(this._getType(e)!==z.object){let l=this._getOrReturnCtx(e);return q(l,{code:P.invalid_type,expected:z.object,received:l.parsedType}),ae}let{status:n,ctx:r}=this._processInputParams(e),{shape:i,keys:s}=this._getCached(),a=[];if(!(this._def.catchall instanceof kr&&this._def.unknownKeys==="strip")){for(let l in r.data)if(!s.includes(l))a.push(l)}let o=[];for(let l of s){let c=i[l],u=r.data[l];o.push({key:{status:"valid",value:l},value:c._parse(new Jt(r,u,r.path,l)),alwaysSet:l in r.data})}if(this._def.catchall instanceof kr){let l=this._def.unknownKeys;if(l==="passthrough")for(let c of a)o.push({key:{status:"valid",value:c},value:{status:"valid",value:r.data[c]}});else if(l==="strict"){if(a.length>0)q(r,{code:P.unrecognized_keys,keys:a}),n.dirty()}else if(l==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let l=this._def.catchall;for(let c of a){let u=r.data[c];o.push({key:{status:"valid",value:c},value:l._parse(new Jt(r,u,r.path,c)),alwaysSet:c in r.data})}}if(r.common.async)return Promise.resolve().then(async()=>{let l=[];for(let c of o){let u=await c.key,d=await c.value;l.push({key:u,value:d,alwaysSet:c.alwaysSet})}return l}).then((l)=>vt.mergeObjectSync(n,l));else return vt.mergeObjectSync(n,o)}get shape(){return this._def.shape()}strict(e){return J.errToObj,new et({...this._def,unknownKeys:"strict",...e!==void 0?{errorMap:(t,n)=>{let r=this._def.errorMap?.(t,n).message??n.defaultError;if(t.code==="unrecognized_keys")return{message:J.errToObj(e).message??r};return{message:r}}}:{}})}strip(){return new et({...this._def,unknownKeys:"strip"})}passthrough(){return new et({...this._def,unknownKeys:"passthrough"})}extend(e){return new et({...this._def,shape:()=>({...this._def.shape(),...e})})}merge(e){return new et({unknownKeys:e._def.unknownKeys,catchall:e._def.catchall,shape:()=>({...this._def.shape(),...e._def.shape()}),typeName:oe.ZodObject})}setKey(e,t){return this.augment({[e]:t})}catchall(e){return new et({...this._def,catchall:e})}pick(e){let t={};for(let n of Ae.objectKeys(e))if(e[n]&&this.shape[n])t[n]=this.shape[n];return new et({...this._def,shape:()=>t})}omit(e){let t={};for(let n of Ae.objectKeys(this.shape))if(!e[n])t[n]=this.shape[n];return new et({...this._def,shape:()=>t})}deepPartial(){return Zn(this)}partial(e){let t={};for(let n of Ae.objectKeys(this.shape)){let r=this.shape[n];if(e&&!e[n])t[n]=r;else t[n]=r.optional()}return new et({...this._def,shape:()=>t})}required(e){let t={};for(let n of Ae.objectKeys(this.shape))if(e&&!e[n])t[n]=this.shape[n];else{let i=this.shape[n];while(i instanceof pr)i=i._def.innerType;t[n]=i}return new et({...this._def,shape:()=>t})}keyof(){return Ih(Ae.objectKeys(this.shape))}}et.create=(e,t)=>new et({shape:()=>e,unknownKeys:"strip",catchall:kr.create(),typeName:oe.ZodObject,...he(t)});et.strictCreate=(e,t)=>new et({shape:()=>e,unknownKeys:"strict",catchall:kr.create(),typeName:oe.ZodObject,...he(t)});et.lazycreate=(e,t)=>new et({shape:e,unknownKeys:"strip",catchall:kr.create(),typeName:oe.ZodObject,...he(t)});class rs extends Se{_parse(e){let{ctx:t}=this._processInputParams(e),n=this._def.options;function r(i){for(let a of i)if(a.result.status==="valid")return a.result;for(let a of i)if(a.result.status==="dirty")return t.common.issues.push(...a.ctx.common.issues),a.result;let s=i.map((a)=>new Pt(a.ctx.common.issues));return q(t,{code:P.invalid_union,unionErrors:s}),ae}if(t.common.async)return Promise.all(n.map(async(i)=>{let s={...t,common:{...t.common,issues:[]},parent:null};return{result:await i._parseAsync({data:t.data,path:t.path,parent:s}),ctx:s}})).then(r);else{let i=void 0,s=[];for(let o of n){let l={...t,common:{...t.common,issues:[]},parent:null},c=o._parseSync({data:t.data,path:t.path,parent:l});if(c.status==="valid")return c;else if(c.status==="dirty"&&!i)i={result:c,ctx:l};if(l.common.issues.length)s.push(l.common.issues)}if(i)return t.common.issues.push(...i.ctx.common.issues),i.result;let a=s.map((o)=>new Pt(o));return q(t,{code:P.invalid_union,unionErrors:a}),ae}}get options(){return this._def.options}}rs.create=(e,t)=>new rs({options:e,typeName:oe.ZodUnion,...he(t)});var Ar=(e)=>{if(e instanceof is)return Ar(e.schema);else if(e instanceof hr)return Ar(e.innerType());else if(e instanceof ss)return[e.value];else if(e instanceof Sn)return e.options;else if(e instanceof as)return Ae.objectValues(e.enum);else if(e instanceof os)return Ar(e._def.innerType);else if(e instanceof es)return[void 0];else if(e instanceof ts)return[null];else if(e instanceof pr)return[void 0,...Ar(e.unwrap())];else if(e instanceof Yr)return[null,...Ar(e.unwrap())];else if(e instanceof wc)return Ar(e.unwrap());else if(e instanceof cs)return Ar(e.unwrap());else if(e instanceof ls)return Ar(e._def.innerType);else return[]};class Ec extends Se{_parse(e){let{ctx:t}=this._processInputParams(e);if(t.parsedType!==z.object)return q(t,{code:P.invalid_type,expected:z.object,received:t.parsedType}),ae;let n=this.discriminator,r=t.data[n],i=this.optionsMap.get(r);if(!i)return q(t,{code:P.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[n]}),ae;if(t.common.async)return i._parseAsync({data:t.data,path:t.path,parent:t});else return i._parseSync({data:t.data,path:t.path,parent:t})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create(e,t,n){let r=new Map;for(let i of t){let s=Ar(i.shape[e]);if(!s.length)throw Error(`A discriminator value for key \`${e}\` could not be extracted from all schema options`);for(let a of s){if(r.has(a))throw Error(`Discriminator property ${String(e)} has duplicate value ${String(a)}`);r.set(a,i)}}return new Ec({typeName:oe.ZodDiscriminatedUnion,discriminator:e,options:t,optionsMap:r,...he(n)})}}function Cc(e,t){let n=Tr(e),r=Tr(t);if(e===t)return{valid:!0,data:e};else if(n===z.object&&r===z.object){let i=Ae.objectKeys(t),s=Ae.objectKeys(e).filter((o)=>i.indexOf(o)!==-1),a={...e,...t};for(let o of s){let l=Cc(e[o],t[o]);if(!l.valid)return{valid:!1};a[o]=l.data}return{valid:!0,data:a}}else if(n===z.array&&r===z.array){if(e.length!==t.length)return{valid:!1};let i=[];for(let s=0;s<e.length;s++){let a=e[s],o=t[s],l=Cc(a,o);if(!l.valid)return{valid:!1};i.push(l.data)}return{valid:!0,data:i}}else if(n===z.date&&r===z.date&&+e===+t)return{valid:!0,data:e};else return{valid:!1}}class ns extends Se{_parse(e){let{status:t,ctx:n}=this._processInputParams(e),r=(i,s)=>{if(xc(i)||xc(s))return ae;let a=Cc(i.value,s.value);if(!a.valid)return q(n,{code:P.invalid_intersection_types}),ae;if(Sc(i)||Sc(s))t.dirty();return{status:t.value,value:a.data}};if(n.common.async)return Promise.all([this._def.left._parseAsync({data:n.data,path:n.path,parent:n}),this._def.right._parseAsync({data:n.data,path:n.path,parent:n})]).then(([i,s])=>r(i,s));else return r(this._def.left._parseSync({data:n.data,path:n.path,parent:n}),this._def.right._parseSync({data:n.data,path:n.path,parent:n}))}}ns.create=(e,t,n)=>new ns({left:e,right:t,typeName:oe.ZodIntersection,...he(n)});class Ir extends Se{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==z.array)return q(n,{code:P.invalid_type,expected:z.array,received:n.parsedType}),ae;if(n.data.length<this._def.items.length)return q(n,{code:P.too_small,minimum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),ae;if(!this._def.rest&&n.data.length>this._def.items.length)q(n,{code:P.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),t.dirty();let i=[...n.data].map((s,a)=>{let o=this._def.items[a]||this._def.rest;if(!o)return null;return o._parse(new Jt(n,s,n.path,a))}).filter((s)=>!!s);if(n.common.async)return Promise.all(i).then((s)=>vt.mergeArray(t,s));else return vt.mergeArray(t,i)}get items(){return this._def.items}rest(e){return new Ir({...this._def,rest:e})}}Ir.create=(e,t)=>{if(!Array.isArray(e))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new Ir({items:e,typeName:oe.ZodTuple,rest:null,...he(t)})};class Ma extends Se{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==z.object)return q(n,{code:P.invalid_type,expected:z.object,received:n.parsedType}),ae;let r=[],i=this._def.keyType,s=this._def.valueType;for(let a in n.data)r.push({key:i._parse(new Jt(n,a,n.path,a)),value:s._parse(new Jt(n,n.data[a],n.path,a)),alwaysSet:a in n.data});if(n.common.async)return vt.mergeObjectAsync(t,r);else return vt.mergeObjectSync(t,r)}get element(){return this._def.valueType}static create(e,t,n){if(t instanceof Se)return new Ma({keyType:e,valueType:t,typeName:oe.ZodRecord,...he(n)});return new Ma({keyType:_r.create(),valueType:e,typeName:oe.ZodRecord,...he(t)})}}class Wa extends Se{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==z.map)return q(n,{code:P.invalid_type,expected:z.map,received:n.parsedType}),ae;let r=this._def.keyType,i=this._def.valueType,s=[...n.data.entries()].map(([a,o],l)=>({key:r._parse(new Jt(n,a,n.path,[l,"key"])),value:i._parse(new Jt(n,o,n.path,[l,"value"]))}));if(n.common.async){let a=new Map;return Promise.resolve().then(async()=>{for(let o of s){let l=await o.key,c=await o.value;if(l.status==="aborted"||c.status==="aborted")return ae;if(l.status==="dirty"||c.status==="dirty")t.dirty();a.set(l.value,c.value)}return{status:t.value,value:a}})}else{let a=new Map;for(let o of s){let{key:l,value:c}=o;if(l.status==="aborted"||c.status==="aborted")return ae;if(l.status==="dirty"||c.status==="dirty")t.dirty();a.set(l.value,c.value)}return{status:t.value,value:a}}}}Wa.create=(e,t,n)=>new Wa({valueType:t,keyType:e,typeName:oe.ZodMap,...he(n)});class ni extends Se{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==z.set)return q(n,{code:P.invalid_type,expected:z.set,received:n.parsedType}),ae;let r=this._def;if(r.minSize!==null){if(n.data.size<r.minSize.value)q(n,{code:P.too_small,minimum:r.minSize.value,type:"set",inclusive:!0,exact:!1,message:r.minSize.message}),t.dirty()}if(r.maxSize!==null){if(n.data.size>r.maxSize.value)q(n,{code:P.too_big,maximum:r.maxSize.value,type:"set",inclusive:!0,exact:!1,message:r.maxSize.message}),t.dirty()}let i=this._def.valueType;function s(o){let l=new Set;for(let c of o){if(c.status==="aborted")return ae;if(c.status==="dirty")t.dirty();l.add(c.value)}return{status:t.value,value:l}}let a=[...n.data.values()].map((o,l)=>i._parse(new Jt(n,o,n.path,l)));if(n.common.async)return Promise.all(a).then((o)=>s(o));else return s(a)}min(e,t){return new ni({...this._def,minSize:{value:e,message:J.toString(t)}})}max(e,t){return new ni({...this._def,maxSize:{value:e,message:J.toString(t)}})}size(e,t){return this.min(e,t).max(e,t)}nonempty(e){return this.min(1,e)}}ni.create=(e,t)=>new ni({valueType:e,minSize:null,maxSize:null,typeName:oe.ZodSet,...he(t)});class Ji extends Se{constructor(){super(...arguments);this.validate=this.implement}_parse(e){let{ctx:t}=this._processInputParams(e);if(t.parsedType!==z.function)return q(t,{code:P.invalid_type,expected:z.function,received:t.parsedType}),ae;function n(a,o){return Oa({data:a,path:t.path,errorMaps:[t.common.contextualErrorMap,t.schemaErrorMap,Xi(),Xr].filter((l)=>!!l),issueData:{code:P.invalid_arguments,argumentsError:o}})}function r(a,o){return Oa({data:a,path:t.path,errorMaps:[t.common.contextualErrorMap,t.schemaErrorMap,Xi(),Xr].filter((l)=>!!l),issueData:{code:P.invalid_return_type,returnTypeError:o}})}let i={errorMap:t.common.contextualErrorMap},s=t.data;if(this._def.returns instanceof ii){let a=this;return wt(async function(...o){let l=new Pt([]),c=await a._def.args.parseAsync(o,i).catch((f)=>{throw l.addIssue(n(o,f)),l}),u=await Reflect.apply(s,this,c);return await a._def.returns._def.type.parseAsync(u,i).catch((f)=>{throw l.addIssue(r(u,f)),l})})}else{let a=this;return wt(function(...o){let l=a._def.args.safeParse(o,i);if(!l.success)throw new Pt([n(o,l.error)]);let c=Reflect.apply(s,this,l.data),u=a._def.returns.safeParse(c,i);if(!u.success)throw new Pt([r(c,u.error)]);return u.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(...e){return new Ji({...this._def,args:Ir.create(e).rest(xn.create())})}returns(e){return new Ji({...this._def,returns:e})}implement(e){return this.parse(e)}strictImplement(e){return this.parse(e)}static create(e,t,n){return new Ji({args:e?e:Ir.create([]).rest(xn.create()),returns:t||xn.create(),typeName:oe.ZodFunction,...he(n)})}}class is extends Se{get schema(){return this._def.getter()}_parse(e){let{ctx:t}=this._processInputParams(e);return this._def.getter()._parse({data:t.data,path:t.path,parent:t})}}is.create=(e,t)=>new is({getter:e,typeName:oe.ZodLazy,...he(t)});class ss extends Se{_parse(e){if(e.data!==this._def.value){let t=this._getOrReturnCtx(e);return q(t,{received:t.data,code:P.invalid_literal,expected:this._def.value}),ae}return{status:"valid",value:e.data}}get value(){return this._def.value}}ss.create=(e,t)=>new ss({value:e,typeName:oe.ZodLiteral,...he(t)});function Ih(e,t){return new Sn({values:e,typeName:oe.ZodEnum,...he(t)})}class Sn extends Se{_parse(e){if(typeof e.data!=="string"){let t=this._getOrReturnCtx(e),n=this._def.values;return q(t,{expected:Ae.joinValues(n),received:t.parsedType,code:P.invalid_type}),ae}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has(e.data)){let t=this._getOrReturnCtx(e),n=this._def.values;return q(t,{received:t.data,code:P.invalid_enum_value,options:n}),ae}return wt(e.data)}get options(){return this._def.values}get enum(){let e={};for(let t of this._def.values)e[t]=t;return e}get Values(){let e={};for(let t of this._def.values)e[t]=t;return e}get Enum(){let e={};for(let t of this._def.values)e[t]=t;return e}extract(e,t=this._def){return Sn.create(e,{...this._def,...t})}exclude(e,t=this._def){return Sn.create(this.options.filter((n)=>!e.includes(n)),{...this._def,...t})}}Sn.create=Ih;class as extends Se{_parse(e){let t=Ae.getValidEnumValues(this._def.values),n=this._getOrReturnCtx(e);if(n.parsedType!==z.string&&n.parsedType!==z.number){let r=Ae.objectValues(t);return q(n,{expected:Ae.joinValues(r),received:n.parsedType,code:P.invalid_type}),ae}if(!this._cache)this._cache=new Set(Ae.getValidEnumValues(this._def.values));if(!this._cache.has(e.data)){let r=Ae.objectValues(t);return q(n,{received:n.data,code:P.invalid_enum_value,options:r}),ae}return wt(e.data)}get enum(){return this._def.values}}as.create=(e,t)=>new as({values:e,typeName:oe.ZodNativeEnum,...he(t)});class ii extends Se{unwrap(){return this._def.type}_parse(e){let{ctx:t}=this._processInputParams(e);if(t.parsedType!==z.promise&&t.common.async===!1)return q(t,{code:P.invalid_type,expected:z.promise,received:t.parsedType}),ae;let n=t.parsedType===z.promise?t.data:Promise.resolve(t.data);return wt(n.then((r)=>this._def.type.parseAsync(r,{path:t.path,errorMap:t.common.contextualErrorMap})))}}ii.create=(e,t)=>new ii({type:e,typeName:oe.ZodPromise,...he(t)});class hr extends Se{innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===oe.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse(e){let{status:t,ctx:n}=this._processInputParams(e),r=this._def.effect||null,i={addIssue:(s)=>{if(q(n,s),s.fatal)t.abort();else t.dirty()},get path(){return n.path}};if(i.addIssue=i.addIssue.bind(i),r.type==="preprocess"){let s=r.transform(n.data,i);if(n.common.async)return Promise.resolve(s).then(async(a)=>{if(t.value==="aborted")return ae;let o=await this._def.schema._parseAsync({data:a,path:n.path,parent:n});if(o.status==="aborted")return ae;if(o.status==="dirty")return Jn(o.value);if(t.value==="dirty")return Jn(o.value);return o});else{if(t.value==="aborted")return ae;let a=this._def.schema._parseSync({data:s,path:n.path,parent:n});if(a.status==="aborted")return ae;if(a.status==="dirty")return Jn(a.value);if(t.value==="dirty")return Jn(a.value);return a}}if(r.type==="refinement"){let s=(a)=>{let o=r.refinement(a,i);if(n.common.async)return Promise.resolve(o);if(o instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return a};if(n.common.async===!1){let a=this._def.schema._parseSync({data:n.data,path:n.path,parent:n});if(a.status==="aborted")return ae;if(a.status==="dirty")t.dirty();return s(a.value),{status:t.value,value:a.value}}else return this._def.schema._parseAsync({data:n.data,path:n.path,parent:n}).then((a)=>{if(a.status==="aborted")return ae;if(a.status==="dirty")t.dirty();return s(a.value).then(()=>({status:t.value,value:a.value}))})}if(r.type==="transform")if(n.common.async===!1){let s=this._def.schema._parseSync({data:n.data,path:n.path,parent:n});if(!vn(s))return ae;let a=r.transform(s.value,i);if(a instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:t.value,value:a}}else return this._def.schema._parseAsync({data:n.data,path:n.path,parent:n}).then((s)=>{if(!vn(s))return ae;return Promise.resolve(r.transform(s.value,i)).then((a)=>({status:t.value,value:a}))});Ae.assertNever(r)}}hr.create=(e,t,n)=>new hr({schema:e,typeName:oe.ZodEffects,effect:t,...he(n)});hr.createWithPreprocess=(e,t,n)=>new hr({schema:t,effect:{type:"preprocess",transform:e},typeName:oe.ZodEffects,...he(n)});class pr extends Se{_parse(e){if(this._getType(e)===z.undefined)return wt(void 0);return this._def.innerType._parse(e)}unwrap(){return this._def.innerType}}pr.create=(e,t)=>new pr({innerType:e,typeName:oe.ZodOptional,...he(t)});class Yr extends Se{_parse(e){if(this._getType(e)===z.null)return wt(null);return this._def.innerType._parse(e)}unwrap(){return this._def.innerType}}Yr.create=(e,t)=>new Yr({innerType:e,typeName:oe.ZodNullable,...he(t)});class os extends Se{_parse(e){let{ctx:t}=this._processInputParams(e),n=t.data;if(t.parsedType===z.undefined)n=this._def.defaultValue();return this._def.innerType._parse({data:n,path:t.path,parent:t})}removeDefault(){return this._def.innerType}}os.create=(e,t)=>new os({innerType:e,typeName:oe.ZodDefault,defaultValue:typeof t.default==="function"?t.default:()=>t.default,...he(t)});class ls extends Se{_parse(e){let{ctx:t}=this._processInputParams(e),n={...t,common:{...t.common,issues:[]}},r=this._def.innerType._parse({data:n.data,path:n.path,parent:{...n}});if(Yi(r))return r.then((i)=>({status:"valid",value:i.status==="valid"?i.value:this._def.catchValue({get error(){return new Pt(n.common.issues)},input:n.data})}));else return{status:"valid",value:r.status==="valid"?r.value:this._def.catchValue({get error(){return new Pt(n.common.issues)},input:n.data})}}removeCatch(){return this._def.innerType}}ls.create=(e,t)=>new ls({innerType:e,typeName:oe.ZodCatch,catchValue:typeof t.catch==="function"?t.catch:()=>t.catch,...he(t)});class $a extends Se{_parse(e){if(this._getType(e)!==z.nan){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.nan,received:n.parsedType}),ae}return{status:"valid",value:e.data}}}$a.create=(e)=>new $a({typeName:oe.ZodNaN,...he(e)});var nA=Symbol("zod_brand");class wc extends Se{_parse(e){let{ctx:t}=this._processInputParams(e),n=t.data;return this._def.type._parse({data:n,path:t.path,parent:t})}unwrap(){return this._def.type}}class Ha extends Se{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.common.async)return(async()=>{let i=await this._def.in._parseAsync({data:n.data,path:n.path,parent:n});if(i.status==="aborted")return ae;if(i.status==="dirty")return t.dirty(),Jn(i.value);else return this._def.out._parseAsync({data:i.value,path:n.path,parent:n})})();else{let r=this._def.in._parseSync({data:n.data,path:n.path,parent:n});if(r.status==="aborted")return ae;if(r.status==="dirty")return t.dirty(),{status:"dirty",value:r.value};else return this._def.out._parseSync({data:r.value,path:n.path,parent:n})}}static create(e,t){return new Ha({in:e,out:t,typeName:oe.ZodPipeline})}}class cs extends Se{_parse(e){let t=this._def.innerType._parse(e),n=(r)=>{if(vn(r))r.value=Object.freeze(r.value);return r};return Yi(t)?t.then((r)=>n(r)):n(t)}unwrap(){return this._def.innerType}}cs.create=(e,t)=>new cs({innerType:e,typeName:oe.ZodReadonly,...he(t)});function Ah(e,t){let n=typeof e==="function"?e(t):typeof e==="string"?{message:e}:e;return typeof n==="string"?{message:n}:n}function oC(e,t={},n){if(e)return ri.create().superRefine((r,i)=>{let s=e(r);if(s instanceof Promise)return s.then((a)=>{if(!a){let o=Ah(t,r),l=o.fatal??n??!0;i.addIssue({code:"custom",...o,fatal:l})}});if(!s){let a=Ah(t,r),o=a.fatal??n??!0;i.addIssue({code:"custom",...a,fatal:o})}return});return ri.create()}var iA={object:et.lazycreate},oe;(function(e){e.ZodString="ZodString",e.ZodNumber="ZodNumber",e.ZodNaN="ZodNaN",e.ZodBigInt="ZodBigInt",e.ZodBoolean="ZodBoolean",e.ZodDate="ZodDate",e.ZodSymbol="ZodSymbol",e.ZodUndefined="ZodUndefined",e.ZodNull="ZodNull",e.ZodAny="ZodAny",e.ZodUnknown="ZodUnknown",e.ZodNever="ZodNever",e.ZodVoid="ZodVoid",e.ZodArray="ZodArray",e.ZodObject="ZodObject",e.ZodUnion="ZodUnion",e.ZodDiscriminatedUnion="ZodDiscriminatedUnion",e.ZodIntersection="ZodIntersection",e.ZodTuple="ZodTuple",e.ZodRecord="ZodRecord",e.ZodMap="ZodMap",e.ZodSet="ZodSet",e.ZodFunction="ZodFunction",e.ZodLazy="ZodLazy",e.ZodLiteral="ZodLiteral",e.ZodEnum="ZodEnum",e.ZodEffects="ZodEffects",e.ZodNativeEnum="ZodNativeEnum",e.ZodOptional="ZodOptional",e.ZodNullable="ZodNullable",e.ZodDefault="ZodDefault",e.ZodCatch="ZodCatch",e.ZodPromise="ZodPromise",e.ZodBranded="ZodBranded",e.ZodPipeline="ZodPipeline",e.ZodReadonly="ZodReadonly"})(oe||(oe={}));var ye=_r.create,Rr=ei.create,sA=$a.create,aA=ti.create,Zt=Ua.create,oA=Zi.create,lA=Va.create,cA=es.create,uA=ts.create,dA=ri.create,fA=xn.create,pA=kr.create,hA=Fa.create,Qe=fr.create,{create:ht,strictCreate:gA}=et,mA=rs.create,yA=Ec.create,vA=ns.create,lC=Ir.create,Rh=Ma.create,xA=Wa.create,SA=ni.create,bA=Ji.create,CA=is.create,EA=ss.create,si=Sn.create,wA=as.create,TA=ii.create,AA=hr.create,_A=pr.create,kA=Yr.create,IA=hr.createWithPreprocess,RA=Ha.create;function Ac(e){if(uC(e)===6)return!0;if(e.includes("://")||e.includes("/")||e.includes(":"))return!1;if(e==="localhost")return!0;if(e.startsWith("*.")){let t=e.slice(2);if(!t.includes(".")||t.startsWith(".")||t.endsWith("."))return!1;let n=t.split(".");return n.length>=2&&n.every((r)=>r.length>0)}if(e.includes("*"))return!1;return e.includes(".")&&!e.startsWith(".")&&!e.endsWith(".")}var _c='Invalid domain pattern. Must be a valid domain (e.g., "example.com"), a wildcard (e.g., "*.example.com"), or a bracketed IPv6 literal (e.g., "[::1]", "[2001:db8::1]:443"). Overly broad patterns like "*.com" or "*" are not allowed for security reasons.',qa=ye().refine(Ac,{message:_c});function Nh(e){let t=e.indexOf(":");return!(t!==-1&&e.indexOf(":",t+1)!==-1)||e.startsWith("[")}var fC=ye().refine((e)=>Nh(e)&&Ac(Mi(e).hostPattern),{message:_c+' An optional ":port" suffix (1-65535) restricts the entry to that port.'}),pC=ye().refine((e)=>{if(!Nh(e))return!1;let{hostPattern:t}=Mi(e);return t==="*"||Ac(t)},{message:_c+' In deniedDomains a bare "*" (deny-all) is also accepted, and an optional ":port" suffix (1-65535) restricts the entry to that port.'}),us=ye().min(1,"Path cannot be empty"),Bh=ye().min(1,"Path cannot be empty").refine((e)=>dC(e),{message:"Binary path must be absolute"}),hC=ht({socketPath:ye().min(1).describe("Unix socket path to the MITM proxy"),domains:Qe(qa).min(1).describe('Domains to route through the MITM proxy (e.g., ["api.example.com", "*.internal.org"])')}),gC=ht({http:ye().url().optional().describe("Upstream proxy URL for plain HTTP traffic"),https:ye().url().optional().describe("Upstream proxy URL for HTTPS/CONNECT traffic (falls back to http if unset)"),noProxy:ye().optional().describe("Comma-separated NO_PROXY list (hostname suffixes and CIDR ranges). Matching destinations connect directly instead of via the parent proxy.")}),Dh=si(["deny","mask"]),Ka=ye().regex(/^[A-Za-z_][A-Za-z0-9_]*$/,"Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores"),Lh=ye().superRefine((e,t)=>{try{let{groupCount:n}=_l(e);if(n<1)t.addIssue({code:P.custom,message:"extract must contain at least one capturing group \u2014 group 1 is "+'the credential value to mask (e.g. "token:\\s*(\\S+)").'})}catch(n){t.addIssue({code:P.custom,message:n instanceof Error?n.message:"Credential extract pattern is invalid"})}}),mC=ht({path:us.describe("Path to a credential file or directory. Supports the same path forms as filesystem.denyRead (absolute paths and ~ expansion)."),mode:Dh.describe("Access mode for this path"),extract:Lh.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the file is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:si(["warn","deny","error"]).optional().describe("What to do when extract matches nothing (or, with decode, no "+'candidate verifies): "warn" (default \u2014 stderr warning, file left '+'readable), "deny" (degrade to mode "deny" \u2014 file unreadable), or '+'"error" (throw at wrap time). Only meaningful with mode "mask" and extract or decode set.'),decode:si(["jwt"]).optional().describe('Optional encoded-credential format. "jwt": decodes recognized JWTs so masking can target fields inside them (see maskClaims). Candidates are located with a built-in JWT regex (or the explicit extract pattern, if set) and verified to actually be JWTs before masking. Without maskClaims, the whole decoded value is treated as the credential and replaced with a structurally valid fake JWT, so client-side token parsing keeps working. If no candidate verifies, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskClaims:Qe(ye().min(1)).optional().describe('Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches in any verified token, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskDuplicates:Zt().optional().describe("If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the "+"corresponding sentinel \u2014 for a secret repeated where the regex "+`does not reach (e.g. in a comment). Matches raw substrings: short or common credential values may corrupt unrelated content, so this is intended for long, high-entropy secrets. With decode, only values that passed verification are scanned; duplicates reuse the verified value's fake without re-verification. Defaults to false. Only meaningful with mode "mask" and extract or decode set; accepted but ignored otherwise.`),injectHosts:Qe(qa).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),yC=ht({name:Ka.describe("Environment variable name"),mode:Dh.describe("Access mode for this environment variable"),extract:Lh.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the value is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:si(["warn","deny","error"]).optional().describe('What to do when extract matches nothing: "warn" (default \u2014 stderr '+'warning, variable passes through unmasked), "deny" (variable unset inside the sandbox), or "error" (throw at wrap time). Only meaningful with mode "mask" and extract set.'),decode:si(["jwt"]).optional().describe(`Optional encoded-credential format. "jwt": the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".`),maskClaims:Qe(ye().min(1)).optional().describe('Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHosts:Qe(qa).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHeaders:Qe(ye().regex(/^[a-z0-9-]{1,64}$/)).min(1).optional().describe('Optional narrowing of where in a request the proxy substitutes this credential: only in these headers (lower-case names), never in other headers or the body. If unset, every header and the body. Only meaningful when mode is "mask".')}),vC=ht({accessKeyIdVar:Ka.describe("Name of the masked env var holding the AWS access key id."),secretAccessKeyVar:Ka.describe("Name of the masked env var holding the AWS secret access key."),sessionTokenVar:Ka.optional().describe("Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.")}).strict(),Tc=si(["deny","passthrough"]),xC=ht({streaming:Tc.optional().describe('Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. Default "deny".'),presigned:Tc.optional().describe('Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. Default "deny".'),sigv4a:Tc.optional().describe('Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. Default "deny".')}).strict(),Oh=ht({files:Qe(mC).optional().describe("Credential files or directories to protect"),envVars:Qe(yC).optional().describe("Environment variables to protect"),allowPlaintextInject:Zt().optional().describe("Allow sentinel\u2192real substitution on the plain-HTTP proxy path. "+"Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures."),awsPairs:Qe(vC).optional().describe("Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked."),sigv4:xC.optional().describe('Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: "deny" (default) or "passthrough".')}).strict(),Ph=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/,SC=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/,bC=ht({url:ye().url().refine((e)=>new URL(e).protocol==="https:",{message:"brokerForward.url must be https"}),tokenEnvVar:ye().regex(Ph),rules:Qe(ht({envVar:ye().regex(Ph),hosts:Qe(ye().regex(SC)).min(1).max(16)}).strict()).min(1).max(32)}).strict(),Uh=ht({allowedDomains:Qe(fC).describe('List of allowed domains (e.g., ["github.com", "*.npmjs.org", "api.example.com:443"]). An optional ":port" suffix restricts the entry to that destination port.'),deniedDomains:Qe(pC).describe('List of denied domains. Unlike allowedDomains, a bare "*" is accepted here (deny-all). An optional ":port" suffix (e.g., "*:22") restricts the entry to that destination port.'),deniedDomainReasons:Rh(ye(),ye().min(1)).optional().describe('Optional model-facing reason keyed by the exact deniedDomains entry it explains (e.g., {"github.com:22": "SSH pushes to GitHub are blocked; use an https remote"}). Reported in the <sandbox_violations> line when that entry denies a connection; entries without one use a generic reason. Keys are matched by exact entry string, so a key with no matching deniedDomains entry never fires.'),strictAllowlist:Zt().optional().describe("If true, hosts not in allowedDomains are denied without consulting the ask callback. Set this when allowedDomains is policy enforcement, not a prompt-suppression hint."),allowUnixSockets:Qe(ye()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),allowAllUnixSockets:Zt().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),allowLocalBinding:Zt().optional().describe("Whether to allow binding to local ports (default: false)"),allowMachLookup:Qe(ye().refine((e)=>!(e.endsWith("*")?e.slice(0,-1):e).includes("*"),{message:'Wildcards are only allowed as a single trailing "*" (e.g., "com.example.*" or "*" for all services).'})).optional().describe('macOS only: Additional XPC/Mach service names to allow looking up. Supports trailing-wildcard prefix matching (e.g., "2BUA8C4S2C.com.1password.*"). Needed for tools like 1Password CLI, Playwright, or the iOS Simulator that communicate via XPC.'),httpProxyPort:Rr().int().min(1).max(65535).optional().describe("Port of an external HTTP proxy to use instead of starting a local one. When provided, the library will skip starting its own HTTP proxy and use this port. The external proxy must handle domain filtering."),socksProxyPort:Rr().int().min(1).max(65535).optional().describe("Port of an external SOCKS proxy to use instead of starting a local one. When provided, the library will skip starting its own SOCKS proxy and use this port. The external proxy must handle domain filtering."),mitmProxy:hC.optional().describe("Optional MITM proxy configuration. Routes matching domains through an upstream proxy via Unix socket while SRT still handles allow/deny filtering."),filterRequest:oC((e)=>typeof e==="function",{message:"filterRequest must be a function"}).optional().describe("Per-request filter callback. Receives the parsed HTTP request (web-standard Request) and returns {action, reason?}. Denied requests get a 403 with the reason. If the callback throws, the request is denied. Applies to plain HTTP through the proxy and, when tlsTerminate is configured, to terminated HTTPS. SRT does not provide a policy language; library consumers own matching."),tlsTerminate:ht({caCertPath:ye().min(1).optional().describe("Path to a PEM-encoded CA certificate. The sandboxed child is configured to trust this CA, and the TLS-terminating proxy uses it to sign per-host certificates. If omitted, on Windows SRT generates-if-absent a persistent CA under %ProgramData%\\sandbox-runtime\\ca\\ and trusts it in the sandbox user's Root store; on other platforms SRT generates an ephemeral CA into a temp directory for the lifetime of the session."),caKeyPath:ye().min(1).optional().describe("Path to the PEM-encoded private key for caCertPath."),excludeDomains:Qe(qa).optional().describe("Domain patterns (same syntax as allowedDomains) whose HTTPS connections are NOT terminated. Matching CONNECTs are opaque byte tunnels: still subject to the allow/deny domain lists, but the sandboxed client completes its own TLS handshake with the upstream, so filterRequest and credential injection do not apply to their HTTPS traffic (plain-HTTP requests to the same hosts keep the normal request pipeline). Use for hosts the proxy must not re-originate: mTLS upstreams (only the client holds the client certificate) and clients that pin the upstream certificate and would reject the MITM CA. Hosts still need to be reachable via allowedDomains; this list only changes how they are tunnelled."),extraCaCertPaths:Qe(ye().min(1)).optional().describe("Paths to PEM CA certificate files appended to the trust bundle the sandboxed child is pointed at, after the MITM CA and the host's regular roots. Use for site-local roots (e.g. an internal mTLS CA) presented by excluded/passthrough hosts, so the child can verify them itself. Only the CERTIFICATE blocks of each file are copied; files that are missing, unreadable, or contain no PEM CERTIFICATE block are skipped (with a debug log), so paths that exist on only some hosts are safe to list.")}).refine((e)=>!e.caCertPath===!e.caKeyPath,{message:"caCertPath and caKeyPath must be provided together"}).optional().describe("[EXPERIMENTAL] Enable in-process TLS termination so HTTPS request/response bodies are visible to SRT. Provide a CA cert+key, or omit both to have SRT generate an ephemeral one."),parentProxy:gC.optional().describe("Upstream HTTP proxy for outbound connections. When set, SRT's proxy tunnels non-mitmProxy traffic through this parent instead of connecting directly. Falls back to HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars if unset."),brokerForward:bC.optional().describe("Credential placeholders a remote broker swaps (see broker-forward.ts).")}),Vh=ht({disabled:Zt().optional().describe("Disable all filesystem policy enforcement. When true, no read or write rules are emitted: denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, .claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process is trusted with full host filesystem access. Network and credential-env restrictions still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs."),denyRead:Qe(us).describe("Paths denied for reading"),allowRead:Qe(us).optional().describe("Paths to re-allow reading within denied regions (takes precedence over denyRead). Use with denyRead to deny a broad region then allow back specific subdirectories."),allowWrite:Qe(us).describe("Paths allowed for writing"),denyWrite:Qe(us).describe("Paths denied for writing (takes precedence over allowWrite)"),allowGitConfig:Zt().optional().describe("Allow writes to .git/config files (default: false). Enables git remote URL updates while keeping .git/hooks protected.")}),Fh=Rh(ye(),Qe(ye())).describe('Map of command patterns to filesystem paths to ignore violations for. Use "*" to match all commands'),Mh=ht({command:ye().describe("The ripgrep command to execute"),args:Qe(ye()).optional().describe("Additional arguments to pass before ripgrep args"),argv0:ye().optional().describe("Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])")}),Wh=ht({safeDirectories:Qe(ye()).default([]).describe("Directories git should treat as safe (`safe.directory`) even though they're owned by a different user inside the sandbox. Use for the repo top-level when launching from a subdirectory. Does NOT grant write.")}),$h=ht({path:ye().min(1).describe("Path to the srt-win binary. Pass the exported VENDORED_SRT_WIN_EXE constant to use the packaged vendor/srt-win/<arch>/srt-win.exe (see its WARNING: in a dev checkout that file may sit inside your sandbox write grant). The binary is spawned with the `--srt-win` argv[1] sentinel so a multicall dispatcher can route to srt-win's CLI.")}),Hh=ht({sandboxUser:ye().min(1).max(20,"Windows local usernames are limited to 20 characters").optional().describe("Name for the dedicated sandbox user account that `srt-win install` creates and the sandboxed child runs as. Default: `srt-sandbox`. Install refuses if an account by this name already exists and srt-win did not create it (it will not rotate the password of an account it does not own). Must match what `srt-win install --sandbox-user` was run with."),sublayerGuid:ye().uuid().optional().describe("WFP sublayer GUID under which the filters were installed. Omit to use the srt-win compile-time default. Set this when filters were installed by enterprise tooling under a custom sublayer."),wfpSublayerGuid:ye().uuid().optional().describe("Deprecated alias for sublayerGuid."),proxyPortRange:lC([Rr().int().min(1),Rr().int().max(65535)]).refine(([e,t])=>e<=t&&t-e<=64,{message:"low must be \u2264 high and range width \u2264 64"}).optional().describe("Inclusive [low, high] port range the JS mux proxy listeners bind inside. MUST match the range passed to `srt-win install "+"--proxy-port-range` (default 60080\u201360089) \u2014 the WFP loopback "+"permit only covers ports in that range."),srtWin:$h.optional().describe("How to locate/invoke the srt-win helper binary. `srtWin.path` is "+"required to use the Windows sandbox \u2014 your own (multicall) binary, "+"or the exported VENDORED_SRT_WIN_EXE constant for the packaged exe.")}),CC=ht({applyPath:ye().optional().describe("Path to the apply-seccomp binary"),argv0:ye().optional().describe("Invoke apply-seccomp as a multicall binary that dispatches on the ARGV0 environment variable. When set, applyPath is used verbatim (no existence check) and the invocation inside bwrap is prefixed with ARGV0=<this value>. The caller is responsible for ensuring applyPath resolves inside the bwrap namespace and that the target binary implements the apply-seccomp interface when ARGV0 matches.")}),EC=ht({network:Uh.describe("Network restrictions configuration"),filesystem:Vh.describe("Filesystem restrictions configuration"),credentials:Oh.optional().describe("Credential handling configuration. Only the explicitly declared files and environment variables are restricted."),ignoreViolations:Fh.optional().describe("Optional configuration for ignoring specific violations"),enableWeakerNestedSandbox:Zt().optional().describe("Enable weaker nested sandbox mode (for Docker environments)"),runAsUid:Rr().int().nonnegative().optional().describe("ARA: uid to drop the sandboxed command to (bwrap --uid)"),runAsGid:Rr().int().nonnegative().optional().describe("ARA: gid to drop the sandboxed command to (bwrap --gid)"),runAsHostUid:Rr().int().positive().optional().describe("ARA: real host uid used to launch the sandboxed bwrap child"),runAsHostGid:Rr().int().positive().optional().describe("ARA: real host gid used to launch the sandboxed bwrap child"),runAsHostHome:ye().min(1).optional().describe("ARA: HOME set inside a real-host-uid sandbox child"),runAsHostUser:ye().min(1).optional().describe("ARA: USER and LOGNAME set inside a real-host-uid sandbox child"),enableWeakerNetworkIsolation:Zt().optional().describe("Enable weaker network isolation to allow access to com.apple.trustd.agent (macOS only). This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data exfiltration vector through the trustd service. Only enable if you need Go TLS verification."),allowAppleEvents:Zt().optional().describe("Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or network restrictions), and can script running apps subject to TCC automation consent. Default: false."),ripgrep:Mh.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),mandatoryDenySearchDepth:Rr().int().min(1).max(10).optional().describe("Maximum directory depth to search for dangerous files on Linux (default: 3). Higher values provide more protection but slower performance."),allowPty:Zt().optional().describe("Allow pseudo-terminal (pty) operations (macOS only)"),seccomp:CC.optional().describe("Custom seccomp binary paths (Linux only)."),bwrapPath:Bh.optional().describe('Linux only: absolute path to the bwrap (bubblewrap) binary. When set, this path is used directly instead of resolving "bwrap" via PATH.'),socatPath:Bh.optional().describe('Linux only: absolute path to the socat binary. When set, this path is used directly instead of resolving "socat" via PATH.'),windows:Hh.optional().describe("Windows-specific settings (WFP sublayer, proxy port range)."),git:Wh.optional().describe("Git configuration to inject via GIT_CONFIG_* env vars (cross-platform). `safeDirectories` marks paths as `safe.directory` without adding them to `filesystem.allowWrite`.")}).superRefine((e,t)=>{let n=e.credentials;if(!n)return;let r=e.network.allowedDomains.map(Wi),i=(l,c)=>{for(let[u,d]of l.entries())if(!Ba(d,r))t.addIssue({code:P.custom,path:[...c,u],message:`injectHosts entry "${d}" is not reachable via `+`network.allowedDomains \u2014 add "${d}" (or a covering wildcard) to allowedDomains, or remove it from injectHosts.`})},s=!1,a=(l,c)=>{if(l.injectHosts)i(l.injectHosts,[...c,"injectHosts"]);if(l.mode!=="mask")return;s=!0;let u=e.network.tlsTerminate?.excludeDomains;if(u?.length){if(l.injectHosts){for(let[d,f]of l.injectHosts.entries())if(Ba(f,u))t.addIssue({code:P.custom,path:[...c,"injectHosts",d],message:`injectHosts entry "${f}" is entirely covered by network.tlsTerminate.excludeDomains. Credential injection only runs on TLS-terminated connections, so this host would receive the placeholder instead of the credential. Remove it from one of the two lists.`})}else if(r.length>0&&r.every((d)=>Ba(d,u)))t.addIssue({code:P.custom,path:c,message:"This masked credential has no injectHosts, so it defaults "+"to network.allowedDomains \u2014 but "+"network.tlsTerminate.excludeDomains covers every allowed domain, so it could never be injected anywhere. Credential injection only runs on TLS-terminated connections."})}if(l.injectHosts!==void 0&&l.injectHosts.length===0)t.addIssue({code:P.custom,path:c,message:"injectHosts is explicitly empty \u2014 the credential would be "+"masked but never injected. Omit injectHosts to default to network.allowedDomains, or list the intended hosts."})};for(let[l,c]of(n.envVars??[]).entries()){if(a(c,["credentials","envVars",l]),c.maskClaims!==void 0&&c.decode===void 0)t.addIssue({code:P.custom,path:["credentials","envVars",l,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the whole value.'});if(c.maskClaims!==void 0&&c.maskClaims.length===0)t.addIssue({code:P.custom,path:["credentials","envVars",l,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."})}for(let[l,c]of(n.files??[]).entries()){if(a(c,["credentials","files",l]),c.maskClaims!==void 0&&c.decode===void 0)t.addIssue({code:P.custom,path:["credentials","files",l,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the extracted value whole.'});if(c.maskClaims!==void 0&&c.maskClaims.length===0)t.addIssue({code:P.custom,path:["credentials","files",l,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."});if(c.mode==="mask"&&c.path.endsWith("/"))t.addIssue({code:P.custom,path:["credentials","files",l,"path"],message:`Credential mode "mask" applies to a single file, not a directory. Use mode "deny" for "${c.path}", or point at the credential file inside it.`})}let o=new Set;for(let[l,c]of(n.awsPairs??[]).entries()){let u=[["accessKeyIdVar",c.accessKeyIdVar],["secretAccessKeyVar",c.secretAccessKeyVar]];if(c.sessionTokenVar!==void 0)u.push(["sessionTokenVar",c.sessionTokenVar]);for(let[d,f]of u){let y=["credentials","awsPairs",l,d];if(o.has(f)){t.addIssue({code:P.custom,path:y,message:`"${f}" appears in more than one awsPairs slot (within `+"or across pairs) \u2014 each variable can fill exactly one slot."});continue}o.add(f);let p=(n.envVars??[]).find((v)=>v.name===f);if(p===void 0||p.mode!=="mask")t.addIssue({code:P.custom,path:y,message:`"${f}" does not reference a credentials.envVars entry `+'with mode "mask" \u2014 an AWS pair links already-masked '+"variables; add the entry (masking is the opt-in for SigV4 re-signing)."});else if(p.extract!==void 0||p.decode!==void 0)t.addIssue({code:P.custom,path:y,message:`"${f}" uses extract/decode, but an AWS pair member must be masked whole-value: the SigV4 trigger is an exact match of the fake access key id, and the signer needs the entire real value.`})}}if(s&&e.network.tlsTerminate===void 0&&!n.allowPlaintextInject)t.addIssue({code:P.custom,path:["credentials"],message:"Credential masking requires network.tlsTerminate so substitution runs only over a verified TLS connection. Enable tlsTerminate, or set credentials.allowPlaintextInject to opt out (not recommended)."})});export{Oh as CredentialsConfigSchema,wa as DEFAULT_WINDOWS_PROXY_PORT_RANGE,Vh as FilesystemConfigSchema,Wh as GitConfigSchema,Fh as IgnoreViolationsConfigSchema,Uh as NetworkConfigSchema,Mh as RipgrepConfigSchema,Op as SRT_WIN_DISPATCH_ARG1,Ob as SandboxManager,EC as SandboxRuntimeConfigSchema,Ca as SandboxViolationStore,$h as SrtWinConfigSchema,VS as VENDORED_SRT_WIN_EXE,Hh as WindowsConfigSchema,xe as WindowsSandboxError,ui as buildGitConfigEnv,Wn as certThumbprint,cc as checkWindowsDependenciesAsync,Mp as checkWindowsSandboxStatus,Wp as checkWindowsSandboxStatusAsync,sc as ensurePersistentWindowsCa,ka as expandWindowsFsPaths,Js as generateCa,bn as getDefaultWritePaths,FS as getSrtWinPath,ic as getWindowsSandboxCaCert,nc as getWindowsSandboxUserStatus,Fi as getWindowsSandboxUserStatusAsync,$p as getWindowsWfpStatus,Hp as getWindowsWfpStatusAsync,ja as getWslVersion,lc as grantWindowsAcl,WS as installWindowsSandbox,$S as installWindowsSandboxAsync,ci as isUncPath,Ta as parseWindowsBinShell,KS as parseWindowsSandboxError,Bt as resolveSrtWin,Ia as restoreWindowsAcl,Ra as revokeWindowsAcl,oc as stampWindowsAcl,HS as uninstallWindowsSandbox,ki as validateCaPair,rc as verifyWindowsWfpEgress,Jl as windowsInstallInstructions,Gp as windowsStateDir,MS as windowsTrustCa,Kp as windowsTrustCaAsync};
71
+ No logout is needed: the WFP filter keys on the dedicated \`srt-sandbox\` user's SID, so your network is unaffected.`}function Dp(e){try{return{status:"fulfilled",value:e()}}catch(t){return{status:"rejected",reason:t}}}function Zp(e,t,n){let r=[],i=[];if(t.status==="rejected")return r.push(`srt-win user status failed: ${t.reason.message}`),{errors:r,warnings:i};let s=t.value;if(!s.provisioned||!s.credPresent)r.push(`Sandbox user is not provisioned (user=${s.provisioned}, cred=${s.credPresent}). `+Zl(e));let a=n();if(a.status==="rejected")return r.push(`srt-win wfp status failed: ${a.reason.message}`),{errors:r,warnings:i};let o=a.value;if(o.state==="cannot-read")C(`[Sandbox Windows] wfp status cannot-read (non-elevated): ${o.hint}`);else if(o.state!=="installed"){if(s.provisioned&&s.credPresent)r.push(`WFP filters not installed under sublayer ${e??"(default)"}. `+Zl(e))}else if(o.portRange)C(`[Sandbox Windows] WFP installed: ${o.filters} filters, proxy port range ${o.portRange[0]}-${o.portRange[1]}`);return{errors:r,warnings:i}}function eh(e={}){let t;try{t=e.srtWin??Bt()}catch(n){return{errors:[n.message],warnings:[]}}return C(`[Sandbox Windows] using srt-win at ${t.exe}`),Zp(e.sublayerGuid,Dp(()=>ic({srtWin:t})),()=>Dp(()=>Kp({sublayerGuid:e.sublayerGuid,srtWin:t})))}async function uc(e={}){let t;try{t=e.srtWin??Bt()}catch(i){return{errors:[i.message],warnings:[]}}C(`[Sandbox Windows] using srt-win at ${t.exe}`);let[n,r]=await Promise.allSettled([Mi({srtWin:t}),qp({sublayerGuid:e.sublayerGuid,srtWin:t})]);return Zp(e.sublayerGuid,n,()=>r)}import{isIP as zS}from"net";function Wi(e){if(e.startsWith("[")){let r=e.indexOf("]");if(r===-1)return{hostPattern:e,port:void 0};let i=e.slice(1,r),s=_t(i)??i,a=e.slice(r+1);if(a==="")return{hostPattern:s,port:void 0};let o=th(a.startsWith(":")?a.slice(1):"");return o===void 0?{hostPattern:e,port:void 0}:{hostPattern:s,port:o}}let t=e.lastIndexOf(":");if(t===-1)return{hostPattern:e,port:void 0};if(e.indexOf(":")!==t)return{hostPattern:_t(e)??e,port:void 0};let n=th(e.slice(t+1));if(n===void 0)return{hostPattern:e,port:void 0};return{hostPattern:e.slice(0,t),port:n}}function th(e){if(!/^[1-9][0-9]{0,4}$/.test(e))return;let t=Number(e);return t>65535?void 0:t}function $i(e){return Wi(e).hostPattern}function wr(e,t){let n=e.toLowerCase();if(t==="*")return!0;if(t.startsWith("*.")){if(zS(jt(n)))return!1;let r=t.substring(2).toLowerCase();return n.endsWith("."+r)}return n===t.toLowerCase()}function Hi(e,t,n){let{hostPattern:r,port:i}=Wi(n);if(i!==void 0&&i!==t)return!1;return wr(e,r)}function Pa(e,t){let n=t.map($i);if(!e.startsWith("*."))return n.some((i)=>wr(e,i));let r=e.slice(2).toLowerCase();return n.some((i)=>{if(!i.startsWith("*."))return!1;let s=i.slice(2).toLowerCase();return r===s||r.endsWith("."+s)})}function rh(e,t,n,r){if(!$n(t))return{verdict:"deny",reason:"malformed host"};let i=_t(t)??t;for(let s of e.deniedDomains)if(Hi(i,n,s))return{verdict:"deny",reason:e.deniedDomainReasons?.[s]??"host is on the deny list",rule:s};for(let s of e.allowedDomains)if(Hi(i,n,s))return{verdict:"allow",rule:s};if(!r||e.strictAllowlist)return{verdict:"deny",reason:"host is not on the allow list"};return{verdict:"ask"}}import{EOL as dc}from"os";import{dirname as fc}from"path";var N,Gi,ji,zi,$t,qr,Ki,nh=!1,Na,Qn,zr,$e,Qr,Xn,Gr,Da,ih=!1,Qi,yn=new Ea,Yt=new _l,Jn=new Pl,Yn=new Sl;function uh(){let e=N?.network.brokerForward;if(!e)return[];let t=process.env[e.tokenEnvVar];if(t)for(let n of e.rules){let r=process.env[n.envVar];if(r)Yn.register(r,t,n.hosts,e.url)}return[e.tokenEnvVar]}function XS(e){return N?.network.brokerForward?.rules.some((t)=>t.hosts.includes(e))??!1}var Xi=new Bl;function YS(){if(nh)return;let e=()=>xc().catch((t)=>{C(`Cleanup failed in registerCleanup ${t}`,{level:"error"})});process.once("exit",e),process.once("SIGINT",e),process.once("SIGTERM",e),nh=!0}var JS=1024,mn=new Map;function dh(e,t){let n=t?.commandId,r=t?.commandText??e;if(n===void 0||n===r)return;let i=en(Nt(n));mn.delete(i),mn.set(i,r);while(mn.size>JS){let s=mn.keys().next().value;if(s===void 0)break;mn.delete(s)}}function sh(e){return mn.get(e)??e}function pc(e,t){let n=t?(()=>{let r=en(t);return mn.get(r)??zl(r)})():void 0;if(jn(e,n,N?.ignoreViolations))return;yn.addViolation({line:e,encodedCommand:t,command:n,timestamp:new Date})}function ZS(e){try{let t=new URL(e);return`${t.origin}${t.pathname}${t.search?"?\u2026":""}`}catch{let t=e.indexOf("?");return t===-1?e:`${e.slice(0,t)}?\u2026`}}async function ah(e,t,n,r){let i=(a)=>(pc(`deny network-outbound ${t}:${e} (${a})`,r),!1);if(!N)return C("No config available, denying network request"),i("sandbox policy unavailable");let s=rh(N.network,t,e,n!==void 0);if(s.verdict==="allow")return C(`Allowed by config rule: ${t}:${e}`),!0;if(s.verdict==="deny"){if(s.reason==="malformed host")C(`Denying malformed host: ${JSON.stringify(t)}:${e}`,{level:"error"});else if(s.rule!==void 0)C(`Denied by config rule: ${t}:${e}`);else C(`No matching config rule, denying: ${t}:${e}`);return i(s.reason)}C(`No matching config rule, asking user: ${t}:${e}`);try{if(await n({host:t,port:e}))return C(`User allowed: ${t}:${e}`),!0;return C(`User denied: ${t}:${e}`),i("user denied")}catch(a){return C(`Error in permission callback: ${a}`,{level:"error"}),i("permission prompt failed")}}var La=!1;function eb(e){La=e}function tb(){if(!La&&!N?.credentials)return;return(e,t)=>{if(!N?.credentials)return;Yt.substituteInHeaders(e,t,wr)}}function rb(){if(!La&&!N?.credentials)return;return(e)=>N?.credentials?Yt.sentinelsForHost(e,wr):void 0}function nb(){if(!La&&!N?.credentials)return;return(e,t,n,r)=>!N?.credentials?void 0:jf(Jn,N?.credentials?.sigv4,wr)(e,t,n,r)}function ib(e){if(!N?.network.mitmProxy)return;let{socketPath:t,domains:n}=N.network.mitmProxy,r=_t(e)??e;for(let i of n)if(wr(r,i))return C(`Host ${e} matches MITM pattern ${i}`),t;return}function sb(e){let t=N?.network.tlsTerminate?.excludeDomains;if(!t?.length)return!0;let n=_t(e)??e;if(XS(n))return!0;for(let r of t){if(!wr(n,r))continue;C(`Host ${e} matches tlsTerminate.excludeDomains pattern ${r}; skipping TLS termination`);let i=Yt.namesInjectableAt(n,wr);if(i.length>0)C(`tlsTerminate.excludeDomains: masked credential(s) ${i.join(", ")} are configured for injection at ${e}, but its connections are not terminated, so the upstream will receive the placeholder`,{level:"error"});return!1}return!0}async function ab(e,t){let n=tb(),r=rb();Gi=Ef({filter:(o,l,c,u)=>ah(o,l,e,u),getMitmSocketPath:ib,mitmCA:$e,shouldTerminateTLS:sb,filterRequest:N?.network.filterRequest,onFilterRequestDenied:({method:o,url:l,reason:c,encodedCommand:u})=>{pc(`deny http-request ${o} ${ZS(l)} (${c})`,u)},mutateHeaders:n,mutateHeadersPlaintext:N?.credentials?.allowPlaintextInject?n:void 0,getBrokerForward:(o,l)=>N?.network.brokerForward?Yn.forwardFor(o,l):void 0,getBodySubstitutions:r,getBodySubstitutionsPlaintext:N?.credentials?.allowPlaintextInject?r:void 0,planSigv4:nb(),parentProxy:zr,proxyAuthToken:Qr}),ji=Pf({filter:(o,l,c)=>ah(o,l,e,c),parentProxy:zr,proxyAuthToken:Qr,probeUnauthenticated:async(o,l)=>{if(!N)return{};let c=_t(l)??l;for(let u of N.network.deniedDomains)if(Hi(c,o,u)){let d=N.network.deniedDomainReasons?.[u]??"host is on the deny list";return pc(`deny network-outbound ${l}:${o} (${d})`,void 0),{deniedReason:d}}return{}}}),zi=Lf({httpServer:Gi,handleSocksConnection:(o)=>ji.handleConnection(o),httpBackendPortRange:t});let i=zi,s=await i.listenHttpBackend();await ca(i.server,(o)=>i.server.listen(o,"127.0.0.1"),t,s!==void 0?new Set([s]):new Set);let a=i.getPort();if(a===void 0)throw Error("Failed to get mux proxy server port");return i.unref(),C(`Mux proxy (HTTP+SOCKS) listening on localhost:${a}`),a}async function ob(e,t,n=!1){if(qr){await qr;return}if(N=e,zr=hl(e.network.parentProxy),zr)C(`Parent proxy configured: http=${yl(zr.httpUrl)} https=${yl(zr.httpsUrl)}`);if(e.network.tlsTerminate&&e.network.mitmProxy)throw Error("network.tlsTerminate and network.mitmProxy are mutually exclusive");let r=e.network.tlsTerminate,i=Ne()==="windows"&&r!==void 0&&!r.caCertPath&&!r.caKeyPath;if($e=r&&!i?ll(r):void 0,$e&&e.runAsHostUid!==void 0&&Ne()==="linux"){if(jr.chmodSync(fc($e.trustBundlePath),457),jr.chmodSync($e.trustBundlePath,420),$e.ephemeral)jr.chmodSync(fc($e.certPath),457),jr.chmodSync($e.certPath,420)}let s=await hh();if(s.errors.length>0)throw Error(`Sandbox dependencies not available: ${s.errors.join(", ")}`);if(n&&Ne()==="macos")Na=Ip(yn.addViolation.bind(yn),N.ignoreViolations,sh),C("Started macOS sandbox log monitor");if(n&&Ne()==="linux")Qn=Pp(yn.addViolation.bind(yn),{allowWritePaths:[...bn(e.runAsHostHome),...N.filesystem.allowWrite],denyWritePaths:N.filesystem.denyWrite,ignoreViolations:N.ignoreViolations,resolveCommandText:sh,consumerUid:e.runAsHostUid,consumerGid:e.runAsHostGid}),Qn.ready,C("Started Linux seccomp violation monitor");if(YS(),Ne()==="windows"){Qi=Bt(e.windows?.srtWin);let a=Qi,o=await Mi({srtWin:a});if(!o.provisioned||!o.credPresent)throw N=void 0,new xe("not_provisioned",`Windows sandbox user is not provisioned (user=${o.provisioned}, cred=${o.credPresent}). Run \`npx sandbox-runtime windows-install\` (one UAC prompt) to provision it.`);if(!ih){try{await nc({proxyPortRange:e.windows?.proxyPortRange,srtWin:a})}catch(l){throw N=void 0,l}ih=!0}if(i&&r)try{let l=await ac({status:o,srtWin:a});$e=ll({caCertPem:l.certPem,caKeyPem:l.keyPem,caCertPath:l.certPath,caKeyPath:l.keyPath,extraCaCertPaths:r.extraCaCertPaths})}catch(l){throw N=void 0,l}if(r&&$e&&!i){let l=sc(o),c=Wn($e.certPem);if(!l)throw N=void 0,new xe("trust_ca_not_installed",`tlsTerminate on Windows requires the sandbox to be installed with this CA (thumb=${c}): run \`srt-win user trust-ca ${$e.certPath}\`. Per-exec installs into the sandbox user's Root store are not supported.`);if(l.thumb!==c)throw N=void 0,new xe("trust_ca_thumbprint_mismatch",`tlsTerminate on Windows: the sandbox's installed CA (thumb=${l.thumb}) doesn't match this session's CA (thumb=${c}). Run \`srt-win user trust-ca ${$e.certPath}\` to update it.`)}try{let l=fb(e);if($e)l.grantRead.push(fc($e.trustBundlePath));if(!o.sid)throw Error("sandbox user SID missing from `srt-win user status` (provisioned but in an inconsistent state)");let c=o.sid;if(Gr=c,l.grantRead.length>0||l.grantWrite.length>0)cc({sandboxUserSid:c,read:l.grantRead,write:l.grantWrite,srtWin:a});if(l.denyRead.length>0||l.denyWrite.length>0)lc({sandboxUserSid:c,denyRead:l.denyRead,denyWrite:l.denyWrite,srtWin:a});if(l.grantRead.length>0||l.grantWrite.length>0||l.denyRead.length>0||l.denyWrite.length>0)Xn=l,C(`[Sandbox Windows] fs applied: ${l.grantWrite.length} grantWrite, ${l.grantRead.length} grantRead, ${l.denyRead.length} denyRead, ${l.denyWrite.length} denyWrite`);Da=mh(e)}catch(l){if(Gr)Ba({sandboxUserSid:Gr,srtWin:a}),Ra({sandboxUserSid:Gr,srtWin:a});throw Gr=void 0,N=void 0,l}}qr=(async()=>{try{let a=Ne()==="windows"?N.windows?.proxyPortRange??Ta:void 0;Qr=N.network.httpProxyPort!==void 0?void 0:QS(16).toString("hex");let l=N.network.httpProxyPort===void 0||N.network.socksProxyPort===void 0?await ab(t,a):void 0,c=N.network.httpProxyPort??l,u=N.network.socksProxyPort??l;if($e&&l!==void 0&&Ne()==="windows")$e.crlUrl=`http://127.0.0.1:${l}${Js}`;if(N.network.httpProxyPort!==void 0)C(`Using external HTTP proxy on port ${c}`);if(N.network.socksProxyPort!==void 0)C(`Using external SOCKS proxy on port ${u}`);let d;if(Ne()==="linux")d=await Sp(c,u,N.socatPath,N.runAsHostUid,N.runAsHostGid);let f={httpProxyPort:c,socksProxyPort:u,linuxBridge:d};return $t=f,C("Network infrastructure initialized"),f}catch(a){throw qr=void 0,$t=void 0,xc().catch((o)=>{C(`Cleanup failed in initializationPromise ${o}`,{level:"error"})}),a}})(),await qr}function fh(){let e=Ne();if(e==="linux")return za()!=="1";return e==="macos"||e==="windows"}function lb(){return N!==void 0}function ph(e){if(!fh())return{done:{errors:["Unsupported platform"],warnings:[]}};let t=[],n=[],r=Ne();if(r==="linux"){let i=e??N?.ripgrep??{command:"rg"};if(br(i.command)===null)t.push(`ripgrep (${i.command}) not found`);let s=xp({seccompConfig:N?.seccomp,bwrapPath:N?.bwrapPath,socatPath:N?.socatPath});t.push(...s.errors),n.push(...s.warnings)}else if(r==="windows"){let i;try{i=Bt(N?.windows?.srtWin)}catch(s){return t.push(s.message),{done:{errors:t,warnings:n}}}return{windows:{sublayerGuid:N?.windows?.sublayerGuid??N?.windows?.wfpSublayerGuid,srtWin:i}}}return{done:{errors:t,warnings:n}}}function cb(e){let t=ph(e);if("done"in t)return t.done;return eh(t.windows)}async function hh(e){let t=ph(e);if("done"in t)return t.done;return uc(t.windows)}function gc(e,t){if(!e)return{denyReadPaths:[],unsetEnvVars:[],setEnvVars:{},maskedFileBinds:[],maskedFileStoreDir:void 0};let n=Oa(e),r=[...new Set((t??[]).map($i))],i=[];for(let u of e.envVars??[])if(u.mode==="deny")i.push(u.name);let{setEnvVars:s,degradeToUnsetNames:a}=$f(e.envVars??[],r,Yt);i.push(...a),Gf(e.envVars??[],e.awsPairs,r,s,Jn);let o=e.files??[],{binds:l,degradeToDenyPaths:c}=Wf(o,r,Yt,Xi);return{denyReadPaths:[...new Set([...n,...c])],unsetEnvVars:[...new Set(i)],setEnvVars:s,maskedFileBinds:l,maskedFileStoreDir:Xi.dirPath}}function Oa(e){let t=e?.files??[];return[...new Set(t.filter((n)=>n.mode==="deny").map((n)=>n.path))]}function gh(e,t){return[...new Set([...e,...t.denyReadPaths])]}function ub(){if(!N||N.filesystem.disabled)return{denyOnly:[],allowWithinDeny:[]};let e=gh(N.filesystem.denyRead,gc(N.credentials,N.network.allowedDomains)),t=[];for(let r of e){let i=mr(r);if(Ne()==="linux"&&xt(i)){let s=tn(r);C(`[Sandbox] Expanded glob pattern "${r}" to ${s.length} paths on Linux`),t.push(...s)}else t.push(i)}let n=[];for(let r of N.filesystem.allowRead??[]){let i=mr(r);if(Ne()==="linux"&&xt(i)){let s=tn(r);C(`[Sandbox] Expanded allowRead glob pattern "${r}" to ${s.length} paths on Linux`),n.push(...s)}else n.push(i)}return{denyOnly:t,allowWithinDeny:n}}function db(){if(!N)return{allowOnly:bn(),denyWithinAllow:[]};if(N.filesystem.disabled)return{allowOnly:["/"],denyWithinAllow:[]};let e=N.filesystem.allowWrite.map((r)=>mr(r)).filter((r)=>{if(Ne()==="linux"&&xt(r))return C(`Skipping glob pattern on Linux/WSL: ${r}`),!1;return!0}),t=N.filesystem.denyWrite.map((r)=>mr(r)).filter((r)=>{if(Ne()==="linux"&&xt(r))return C(`Skipping glob pattern on Linux/WSL: ${r}`),!1;return!0});return{allowOnly:[...bn(hc()),...e],denyWithinAllow:t}}function fb(e){let t=e.filesystem;if(t?.disabled)return{grantRead:[],grantWrite:[],denyRead:[],denyWrite:[]};let n=Ia,r=n([...new Set([...t?.denyRead??[],...Oa(e.credentials)])],{mode:"deny"}),i=n(t?.denyWrite??[],{mode:"deny"});return{grantRead:n(t?.allowRead??[],{mode:"grant"}),grantWrite:n(t?.allowWrite??[],{mode:"grant"}),denyRead:r,denyWrite:i}}function mh(e){return{disabled:e.filesystem.disabled??!1,denyRead:[...e.filesystem.denyRead],denyWrite:[...e.filesystem.denyWrite],allowRead:[...e.filesystem.allowRead??[]],allowWrite:[...e.filesystem.allowWrite],credFiles:Oa(e.credentials)}}function qi(e,t){if(e.length!==t.length)return!1;let n=new Set(e);return t.every((r)=>n.has(r))}function pb(e,t){return e.disabled===t.disabled&&qi(e.denyRead,t.denyRead)&&qi(e.denyWrite,t.denyWrite)&&qi(e.allowRead,t.allowRead)&&qi(e.allowWrite,t.allowWrite)&&qi(e.credFiles,t.credFiles)}function hb(e){return Da!==void 0&&pb(Da,mh(e))}function gb(){if(!N)return{};let e=N.network.allowedDomains,t=N.network.deniedDomains;return{allowedHosts:e,...t.length>0&&{deniedHosts:t}}}function yh(){return N?.network?.allowUnixSockets}function oh(){return N?.network?.allowAllUnixSockets}function vh(){return N?.network?.allowLocalBinding}function xh(){return N?.network?.allowMachLookup}function Sh(){return N?.ignoreViolations}function bh(){return N?.enableWeakerNestedSandbox}function mb(){return N?.runAsUid}function yb(){return N?.runAsGid}function vb(){return N?.runAsHostUid}function xb(){return N?.runAsHostGid}function hc(){return N?.runAsHostHome}function Sb(){return N?.runAsHostUser}function bb(){return N?.enableWeakerNetworkIsolation}function Cb(){return N?.allowAppleEvents}function Eb(){return N?.ripgrep??{command:"rg"}}function wb(){return N?.mandatoryDenySearchDepth??3}function lh(){return N?.filesystem?.allowGitConfig??!1}function Ch(e){return[...N?.git?.safeDirectories??[],...e?.git?.safeDirectories??[]]}function Tb(){return N?.seccomp}function Ab(){return Qr}function mc(){return $t?.httpProxyPort}function yc(){return $t?.socksProxyPort}function Eh(){return $t?.linuxBridge?.httpSocketPath}function wh(){return $t?.linuxBridge?.socksSocketPath}async function vc(){if(!N)return!1;if(qr)try{return await qr,!0}catch{return!1}return $t!==void 0}async function Th(e,t,n,r,i){let s=Ne(),a=i?.commandId;dh(e,i);let o=n?.filesystem!==void 0?n.filesystem.disabled??!1:N?.filesystem.disabled??!1,l=gc(n?.credentials??N?.credentials,n?.network?.allowedDomains??N?.network?.allowedDomains);l.unsetEnvVars.push(...uh());let c,u;if(!o){let x=(R)=>R.map((M)=>mr(M)).filter((M)=>{if(Ne()==="linux"&&xt(M))return C(`[Sandbox] Skipping glob write pattern on Linux: ${M}`),!1;return!0}),b=x(n?.filesystem?.allowWrite??N?.filesystem.allowWrite??[]);c={allowOnly:[...bn(n?.runAsHostHome??hc()),...b],denyWithinAllow:x(n?.filesystem?.denyWrite??N?.filesystem.denyWrite??[])};let A=gh(n?.filesystem?.denyRead??N?.filesystem.denyRead??[],l),E=[];for(let R of A){let M=mr(R);if(Ne()==="linux"&&xt(M))E.push(...tn(R));else E.push(M)}let k=n?.filesystem?.allowRead??N?.filesystem.allowRead??[],I=[];for(let R of k){let M=mr(R);if(Ne()==="linux"&&xt(M))I.push(...tn(R));else I.push(M)}if($e)I.push($e.certPath,$e.trustBundlePath);u={denyOnly:E,allowWithinDeny:I}}let d=n?.network?.allowedDomains!==void 0||N?.network?.allowedDomains!==void 0,f=d,y=d;if(y)await vc();let p=n?.allowPty??N?.allowPty,v=Ch(n);switch(s){case"macos":return kp({command:e,commandId:a,needsNetworkRestriction:f,httpProxyPort:y?mc():void 0,socksProxyPort:y?yc():void 0,proxyAuthToken:y?Qr:void 0,caCertPath:$e?.trustBundlePath,readConfig:u,writeConfig:c,unsetEnvVars:l.unsetEnvVars,setEnvVars:l.setEnvVars,maskedFileBinds:l.maskedFileBinds,allowUnixSockets:yh(),allowAllUnixSockets:oh(),allowLocalBinding:vh(),allowMachLookup:xh(),ignoreViolations:Sh(),allowPty:p,allowGitConfig:lh(),gitSafeDirectories:v,enableWeakerNetworkIsolation:bb(),allowAppleEvents:Cb(),binShell:t});case"linux":return Cp({command:e,commandId:a,needsNetworkRestriction:f,httpSocketPath:y?Eh():void 0,socksSocketPath:y?wh():void 0,httpProxyPort:y?$t?.httpProxyPort:void 0,socksProxyPort:y?$t?.socksProxyPort:void 0,proxyAuthToken:y?Qr:void 0,caCertPath:$e?.trustBundlePath,readConfig:u,writeConfig:c,unsetEnvVars:l.unsetEnvVars,setEnvVars:l.setEnvVars,maskedFileBinds:l.maskedFileBinds,maskedFileStoreDir:l.maskedFileStoreDir,enableWeakerNestedSandbox:bh(),runAsUid:mb(),runAsGid:yb(),runAsHostUid:vb(),runAsHostGid:xb(),runAsHostHome:hc(),runAsHostUser:Sb(),setprivPath:"/usr/bin/setpriv",allowAllUnixSockets:oh(),binShell:t,ripgrepConfig:Eb(),mandatoryDenySearchDepth:wb(),allowGitConfig:lh(),gitSafeDirectories:v,seccompConfig:Tb(),bwrapPath:N?.bwrapPath,socatPath:N?.socatPath,observeSocketPath:Qn?.observeSocketPath,startFd:i?.startFd,abortSignal:r});case"windows":throw Error("wrapWithSandbox() returns a shell string and is not supported on Windows. Use SandboxManager.wrapWithSandboxArgv() and spawn the result with {shell: false}.");default:throw Error(`Sandbox configuration is not supported on platform: ${s}`)}}async function _b(e,t,n,r,i,s){if(Ne()==="windows"){let c=n?.network?.allowedDomains!==void 0||N?.network?.allowedDomains!==void 0;if(c)await vc();let u=gc(n?.credentials??N?.credentials,n?.network?.allowedDomains??N?.network?.allowedDomains);u.unsetEnvVars.push(...uh());let d=n?.filesystem,f=[],y=[];if(!d?.disabled){if(d?.allowRead?.length||d?.allowWrite?.length)throw Error("Per-exec filesystem.allowRead/allowWrite is not supported "+"on Windows \u2014 `srt-win exec` only exposes per-exec "+"denies. Set them at the session level (initialize()).");let p=[...d?.denyRead??[],...Oa(n?.credentials)],v=d?.denyWrite??[];if(p.length>0||v.length>0){let x=new Set(Xn?.denyRead??[]),b=new Set(Xn?.denyWrite??[]),A=Ia;f=A(p,{mode:"deny"}).filter((E)=>!x.has(E)),y=A(v,{mode:"deny"}).filter((E)=>!x.has(E)&&!b.has(E))}}return dh(e,s),Jp({command:e,commandId:s?.commandId,httpProxyPort:c?mc():void 0,socksProxyPort:c?yc():void 0,proxyAuthToken:c?Qr:void 0,setEnvVars:u.setEnvVars,denyRead:f,denyWrite:y,cwd:i,allowWrite:Xn?.grantWrite,gitSafeDirectories:Ch(n),caCertPath:$e?.trustBundlePath,binShell:Aa(t),srtWin:n?.windows?.srtWin?Bt(n.windows.srtWin):Qi??Bt(N?.windows?.srtWin)})}if(typeof t==="object")throw Error("binShell object form is Windows-only; pass a shell path string on macOS/Linux");let o=await Th(e,t,n,r,s);return{argv:[t??"/bin/bash","-c",o],env:process.env}}function kb(){return N}function Ib(){Yt.clear(),Jn.clear(),Yn.clear(),Xi.dispose()}function Rb(e){if(Ne()==="windows"&&N&&!hb(e))C("[Sandbox Windows] updateConfig: the resolved file-access set "+"(filesystem.* \u222A credentials.files) changed but the ACL "+"stamp/grant is session-wide \u2014 call reset() then initialize() "+"to apply. The previously-applied set stays in effect.",{level:"warn"});let{filterRequest:t,...n}=e.network;N=structuredClone({...e,network:n}),N.network.filterRequest=t,zr=hl(e.network.parentProxy),C("Sandbox configuration updated")}function Bb(){Ca()}var Pb=1500;function ch(e,t){if(!e.pid||e.exitCode!==null||e.signalCode!==null)return Promise.resolve();try{process.kill(e.pid,"SIGTERM"),C(`Sent SIGTERM to ${t} bridge process`)}catch(n){if(n.code!=="ESRCH")C(`Error killing ${t} bridge: ${n}`,{level:"error"});return Promise.resolve()}return new Promise((n)=>{let r=!1,i=()=>{if(r)return;r=!0,clearTimeout(s),n()};e.once("exit",()=>{C(`${t} bridge process exited`),i()});let s=setTimeout(()=>{if(e.exitCode===null&&e.signalCode===null){C(`${t} bridge did not exit, forcing SIGKILL`,{level:"warn"});try{if(e.pid)process.kill(e.pid,"SIGKILL")}catch{}}i()},Pb);s.unref?.()})}function Nb(e){return new Promise((t)=>{if(typeof e.closeAllConnections==="function")e.closeAllConnections();e.close((n)=>{if(n&&n.message!=="Server is not running.")C(`Error closing HTTP proxy server: ${n.message}`,{level:"error"});t()})})}async function Db(){if(Xn&&Gr){let t=Gr,n=Qi,r=new Set(["revoked","stillHeld","restored","alreadyOriginal"]),i=(s,a)=>{if(!r.has(a.status))C(`[Sandbox Windows] ${s}: '${a.path}' ${a.status} \u2014 `+"ACE may be left in place; resolve and run `srt-win acl recover` to clear",{level:"warn"})};for(let s of Ba({sandboxUserSid:t,srtWin:n})??[])i("grant revoke",s);for(let s of Ra({sandboxUserSid:t,srtWin:n})??[])i("deny restore",s)}if(Xn=void 0,Gr=void 0,Da=void 0,Qi=void 0,Ca({force:!0}),Na)Na(),Na=void 0;if(Qn)Qn.stop(),Qn=void 0;if($t?.linuxBridge){let{httpSocketPath:t,socksSocketPath:n,httpBridgeProcess:r,socksBridgeProcess:i}=$t.linuxBridge;if(await Promise.all([ch(r,"HTTP"),ch(i,"SOCKS")]),t)try{jr.rmSync(t,{force:!0}),C("Cleaned up HTTP socket")}catch(s){C(`HTTP socket cleanup error: ${s}`,{level:"error"})}if(n)try{jr.rmSync(n,{force:!0}),C("Cleaned up SOCKS socket")}catch(s){C(`SOCKS socket cleanup error: ${s}`,{level:"error"})}}let e=[];if($e)e.push(Xd($e));if(zi)e.push(zi.close().catch((t)=>{C(`Error closing mux proxy server: ${t.message}`,{level:"error"})}));if(Gi)e.push(Nb(Gi));if(ji){let t=ji.close().catch((n)=>{C(`Error closing SOCKS proxy server: ${n.message}`,{level:"error"})});e.push(t)}await Promise.all(e),zi=void 0,Gi=void 0,Qr=void 0,ji=void 0,$t=void 0,qr=void 0,zr=void 0,$e=void 0,Yt.clear(),Jn.clear(),Xi.dispose()}async function xc(){if(Ki)return Ki;Ki=Db();try{await Ki}finally{Ki=void 0}}function Lb(){return yn}function Ob(e,t){if(!N)return t;let n=yn.getViolationsForCommand(e);if(n.length===0)return t;let r=t;r+=dc+"<sandbox_violations>"+dc;for(let i of n)r+=i.line+dc;return r+="</sandbox_violations>",r}function Ub(){if(Ne()!=="linux"||!N||N.filesystem.disabled)return[];let e=[],t=[...N.filesystem.allowWrite,...N.filesystem.denyWrite];for(let n of t){let r=mr(n);if(xt(r))e.push(n)}return e}var Vb={initialize:ob,isSupportedPlatform:fh,isSandboxingEnabled:lb,checkDependencies:cb,checkDependenciesAsync:hh,getFsReadConfig:ub,getFsWriteConfig:db,getNetworkRestrictionConfig:gb,getAllowUnixSockets:yh,getAllowLocalBinding:vh,getAllowMachLookup:xh,getIgnoreViolations:Sh,getEnableWeakerNestedSandbox:bh,getProxyPort:mc,getProxyAuthToken:Ab,getSocksProxyPort:yc,getLinuxHttpSocketPath:Eh,getLinuxSocksSocketPath:wh,waitForNetworkInitialization:vc,wrapWithSandbox:Th,wrapWithSandboxArgv:_b,cleanupAfterCommand:Bb,beginCredentialLease:()=>{Yt.beginLease(),Yn.beginLease()},endCredentialLease:()=>Object.assign(Yt.endLease(),{brokerForward:Yn.endLease()}),releaseCredentialLease:(e)=>{Yn.release(e.brokerForward??[]),Jn.forget(Yt.release(e))},reset:xc,getMitmCA:()=>$e,getSentinelRegistry:()=>Yt,getAwsPairRegistry:()=>Jn,getMaskedFileStore:()=>Xi,getSandboxViolationStore:Lb,annotateStderrWithSandboxFailures:Ob,getLinuxGlobPatternWarnings:Ub,getConfig:kb,updateConfig:Rb,clearMaskedCredentials:Ib,setLiveCredentialInjectors:eb};import{isIP as fC}from"net";import{isAbsolute as pC}from"path";var Ae;(function(e){e.assertEqual=(i)=>{};function t(i){}e.assertIs=t;function n(i){throw Error()}e.assertNever=n,e.arrayToEnum=(i)=>{let s={};for(let a of i)s[a]=a;return s},e.getValidEnumValues=(i)=>{let s=e.objectKeys(i).filter((o)=>typeof i[i[o]]!=="number"),a={};for(let o of s)a[o]=i[o];return e.objectValues(a)},e.objectValues=(i)=>e.objectKeys(i).map(function(s){return i[s]}),e.objectKeys=typeof Object.keys==="function"?(i)=>Object.keys(i):(i)=>{let s=[];for(let a in i)if(Object.prototype.hasOwnProperty.call(i,a))s.push(a);return s},e.find=(i,s)=>{for(let a of i)if(s(a))return a;return},e.isInteger=typeof Number.isInteger==="function"?(i)=>Number.isInteger(i):(i)=>typeof i==="number"&&Number.isFinite(i)&&Math.floor(i)===i;function r(i,s=" | "){return i.map((a)=>typeof a==="string"?`'${a}'`:a).join(s)}e.joinValues=r,e.jsonStringifyReplacer=(i,s)=>{if(typeof s==="bigint")return s.toString();return s}})(Ae||(Ae={}));var Ah;(function(e){e.mergeShapes=(t,n)=>({...t,...n})})(Ah||(Ah={}));var z=Ae.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),Tr=(e)=>{switch(typeof e){case"undefined":return z.undefined;case"string":return z.string;case"number":return Number.isNaN(e)?z.nan:z.number;case"boolean":return z.boolean;case"function":return z.function;case"bigint":return z.bigint;case"symbol":return z.symbol;case"object":if(Array.isArray(e))return z.array;if(e===null)return z.null;if(e.then&&typeof e.then==="function"&&e.catch&&typeof e.catch==="function")return z.promise;if(typeof Map<"u"&&e instanceof Map)return z.map;if(typeof Set<"u"&&e instanceof Set)return z.set;if(typeof Date<"u"&&e instanceof Date)return z.date;return z.object;default:return z.unknown}};var P=Ae.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]);class Pt extends Error{get errors(){return this.issues}constructor(e){super();this.issues=[],this.addIssue=(n)=>{this.issues=[...this.issues,n]},this.addIssues=(n=[])=>{this.issues=[...this.issues,...n]};let t=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,t);else this.__proto__=t;this.name="ZodError",this.issues=e}format(e){let t=e||function(i){return i.message},n={_errors:[]},r=(i)=>{for(let s of i.issues)if(s.code==="invalid_union")s.unionErrors.map(r);else if(s.code==="invalid_return_type")r(s.returnTypeError);else if(s.code==="invalid_arguments")r(s.argumentsError);else if(s.path.length===0)n._errors.push(t(s));else{let a=n,o=0;while(o<s.path.length){let l=s.path[o];if(o!==s.path.length-1)a[l]=a[l]||{_errors:[]};else a[l]=a[l]||{_errors:[]},a[l]._errors.push(t(s));a=a[l],o++}}};return r(this),n}static assert(e){if(!(e instanceof Pt))throw Error(`Not a ZodError: ${e}`)}toString(){return this.message}get message(){return JSON.stringify(this.issues,Ae.jsonStringifyReplacer,2)}get isEmpty(){return this.issues.length===0}flatten(e=(t)=>t.message){let t={},n=[];for(let r of this.issues)if(r.path.length>0){let i=r.path[0];t[i]=t[i]||[],t[i].push(e(r))}else n.push(e(r));return{formErrors:n,fieldErrors:t}}get formErrors(){return this.flatten()}}Pt.create=(e)=>new Pt(e);var Fb=(e,t)=>{let n;switch(e.code){case P.invalid_type:if(e.received===z.undefined)n="Required";else n=`Expected ${e.expected}, received ${e.received}`;break;case P.invalid_literal:n=`Invalid literal value, expected ${JSON.stringify(e.expected,Ae.jsonStringifyReplacer)}`;break;case P.unrecognized_keys:n=`Unrecognized key(s) in object: ${Ae.joinValues(e.keys,", ")}`;break;case P.invalid_union:n="Invalid input";break;case P.invalid_union_discriminator:n=`Invalid discriminator value. Expected ${Ae.joinValues(e.options)}`;break;case P.invalid_enum_value:n=`Invalid enum value. Expected ${Ae.joinValues(e.options)}, received '${e.received}'`;break;case P.invalid_arguments:n="Invalid function arguments";break;case P.invalid_return_type:n="Invalid function return type";break;case P.invalid_date:n="Invalid date";break;case P.invalid_string:if(typeof e.validation==="object")if("includes"in e.validation){if(n=`Invalid input: must include "${e.validation.includes}"`,typeof e.validation.position==="number")n=`${n} at one or more positions greater than or equal to ${e.validation.position}`}else if("startsWith"in e.validation)n=`Invalid input: must start with "${e.validation.startsWith}"`;else if("endsWith"in e.validation)n=`Invalid input: must end with "${e.validation.endsWith}"`;else Ae.assertNever(e.validation);else if(e.validation!=="regex")n=`Invalid ${e.validation}`;else n="Invalid";break;case P.too_small:if(e.type==="array")n=`Array must contain ${e.exact?"exactly":e.inclusive?"at least":"more than"} ${e.minimum} element(s)`;else if(e.type==="string")n=`String must contain ${e.exact?"exactly":e.inclusive?"at least":"over"} ${e.minimum} character(s)`;else if(e.type==="number")n=`Number must be ${e.exact?"exactly equal to ":e.inclusive?"greater than or equal to ":"greater than "}${e.minimum}`;else if(e.type==="bigint")n=`Number must be ${e.exact?"exactly equal to ":e.inclusive?"greater than or equal to ":"greater than "}${e.minimum}`;else if(e.type==="date")n=`Date must be ${e.exact?"exactly equal to ":e.inclusive?"greater than or equal to ":"greater than "}${new Date(Number(e.minimum))}`;else n="Invalid input";break;case P.too_big:if(e.type==="array")n=`Array must contain ${e.exact?"exactly":e.inclusive?"at most":"less than"} ${e.maximum} element(s)`;else if(e.type==="string")n=`String must contain ${e.exact?"exactly":e.inclusive?"at most":"under"} ${e.maximum} character(s)`;else if(e.type==="number")n=`Number must be ${e.exact?"exactly":e.inclusive?"less than or equal to":"less than"} ${e.maximum}`;else if(e.type==="bigint")n=`BigInt must be ${e.exact?"exactly":e.inclusive?"less than or equal to":"less than"} ${e.maximum}`;else if(e.type==="date")n=`Date must be ${e.exact?"exactly":e.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number(e.maximum))}`;else n="Invalid input";break;case P.custom:n="Invalid input";break;case P.invalid_intersection_types:n="Intersection results could not be merged";break;case P.not_multiple_of:n=`Number must be a multiple of ${e.multipleOf}`;break;case P.not_finite:n="Number must be finite";break;default:n=t.defaultError,Ae.assertNever(e)}return{message:n}},Xr=Fb;var Mb=Xr;function Yi(){return Mb}var Ua=(e)=>{let{data:t,path:n,errorMaps:r,issueData:i}=e,s=[...n,...i.path||[]],a={...i,path:s};if(i.message!==void 0)return{...i,path:s,message:i.message};let o="",l=r.filter((c)=>!!c).slice().reverse();for(let c of l)o=c(a,{data:t,defaultError:o}).message;return{...i,path:s,message:o}};function q(e,t){let n=Yi(),r=Ua({issueData:t,data:e.data,path:e.path,errorMaps:[e.common.contextualErrorMap,e.schemaErrorMap,n,n===Xr?void 0:Xr].filter((i)=>!!i)});e.common.issues.push(r)}class vt{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray(e,t){let n=[];for(let r of t){if(r.status==="aborted")return ae;if(r.status==="dirty")e.dirty();n.push(r.value)}return{status:e.value,value:n}}static async mergeObjectAsync(e,t){let n=[];for(let r of t){let i=await r.key,s=await r.value;n.push({key:i,value:s})}return vt.mergeObjectSync(e,n)}static mergeObjectSync(e,t){let n={};for(let r of t){let{key:i,value:s}=r;if(i.status==="aborted")return ae;if(s.status==="aborted")return ae;if(i.status==="dirty")e.dirty();if(s.status==="dirty")e.dirty();if(i.value!=="__proto__"&&(typeof s.value<"u"||r.alwaysSet))n[i.value]=s.value}return{status:e.value,value:n}}}var ae=Object.freeze({status:"aborted"}),Zn=(e)=>({status:"dirty",value:e}),wt=(e)=>({status:"valid",value:e}),Sc=(e)=>e.status==="aborted",bc=(e)=>e.status==="dirty",vn=(e)=>e.status==="valid",Ji=(e)=>typeof Promise<"u"&&e instanceof Promise;var J;(function(e){e.errToObj=(t)=>typeof t==="string"?{message:t}:t||{},e.toString=(t)=>typeof t==="string"?t:t?.message})(J||(J={}));class Jt{constructor(e,t,n,r){this._cachedPath=[],this.parent=e,this.data=t,this._path=n,this._key=r}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var _h=(e,t)=>{if(vn(t))return{success:!0,data:t.value};else{if(!e.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let n=new Pt(e.common.issues);return this._error=n,this._error}}}};function he(e){if(!e)return{};let{errorMap:t,invalid_type_error:n,required_error:r,description:i}=e;if(t&&(n||r))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if(t)return{errorMap:t,description:i};return{errorMap:(a,o)=>{let{message:l}=e;if(a.code==="invalid_enum_value")return{message:l??o.defaultError};if(typeof o.data>"u")return{message:l??r??o.defaultError};if(a.code!=="invalid_type")return{message:o.defaultError};return{message:l??n??o.defaultError}},description:i}}class Se{get description(){return this._def.description}_getType(e){return Tr(e.data)}_getOrReturnCtx(e,t){return t||{common:e.parent.common,data:e.data,parsedType:Tr(e.data),schemaErrorMap:this._def.errorMap,path:e.path,parent:e.parent}}_processInputParams(e){return{status:new vt,ctx:{common:e.parent.common,data:e.data,parsedType:Tr(e.data),schemaErrorMap:this._def.errorMap,path:e.path,parent:e.parent}}}_parseSync(e){let t=this._parse(e);if(Ji(t))throw Error("Synchronous parse encountered promise.");return t}_parseAsync(e){let t=this._parse(e);return Promise.resolve(t)}parse(e,t){let n=this.safeParse(e,t);if(n.success)return n.data;throw n.error}safeParse(e,t){let n={common:{issues:[],async:t?.async??!1,contextualErrorMap:t?.errorMap},path:t?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:Tr(e)},r=this._parseSync({data:e,path:n.path,parent:n});return _h(n,r)}"~validate"(e){let t={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:Tr(e)};if(!this["~standard"].async)try{let n=this._parseSync({data:e,path:[],parent:t});return vn(n)?{value:n.value}:{issues:t.common.issues}}catch(n){if(n?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;t.common={issues:[],async:!0}}return this._parseAsync({data:e,path:[],parent:t}).then((n)=>vn(n)?{value:n.value}:{issues:t.common.issues})}async parseAsync(e,t){let n=await this.safeParseAsync(e,t);if(n.success)return n.data;throw n.error}async safeParseAsync(e,t){let n={common:{issues:[],contextualErrorMap:t?.errorMap,async:!0},path:t?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:e,parsedType:Tr(e)},r=this._parse({data:e,path:n.path,parent:n}),i=await(Ji(r)?r:Promise.resolve(r));return _h(n,i)}refine(e,t){let n=(r)=>{if(typeof t==="string"||typeof t>"u")return{message:t};else if(typeof t==="function")return t(r);else return t};return this._refinement((r,i)=>{let s=e(r),a=()=>i.addIssue({code:P.custom,...n(r)});if(typeof Promise<"u"&&s instanceof Promise)return s.then((o)=>{if(!o)return a(),!1;else return!0});if(!s)return a(),!1;else return!0})}refinement(e,t){return this._refinement((n,r)=>{if(!e(n))return r.addIssue(typeof t==="function"?t(n,r):t),!1;else return!0})}_refinement(e){return new hr({schema:this,typeName:oe.ZodEffects,effect:{type:"refinement",refinement:e}})}superRefine(e){return this._refinement(e)}constructor(e){this.spa=this.safeParseAsync,this._def=e,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:(t)=>this["~validate"](t)}}optional(){return pr.create(this,this._def)}nullable(){return Yr.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return fr.create(this)}promise(){return si.create(this,this._def)}or(e){return ns.create([this,e],this._def)}and(e){return is.create(this,e,this._def)}transform(e){return new hr({...he(this._def),schema:this,typeName:oe.ZodEffects,effect:{type:"transform",transform:e}})}default(e){let t=typeof e==="function"?e:()=>e;return new ls({...he(this._def),innerType:this,defaultValue:t,typeName:oe.ZodDefault})}brand(){return new Tc({typeName:oe.ZodBranded,type:this,...he(this._def)})}catch(e){let t=typeof e==="function"?e:()=>e;return new cs({...he(this._def),innerType:this,catchValue:t,typeName:oe.ZodCatch})}describe(e){return new this.constructor({...this._def,description:e})}pipe(e){return Ka.create(this,e)}readonly(){return us.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var Wb=/^c[^\s-]{8,}$/i,$b=/^[0-9a-z]+$/,Hb=/^[0-9A-HJKMNP-TV-Z]{26}$/i,Kb=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,qb=/^[a-z0-9_-]{21}$/i,Gb=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,jb=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,zb=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,Qb="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",Cc,Xb=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,Yb=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,Jb=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,Zb=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,eC=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,tC=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,Ih="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",rC=new RegExp(`^${Ih}$`);function Rh(e){let t="[0-5]\\d";if(e.precision)t=`${t}\\.\\d{${e.precision}}`;else if(e.precision==null)t=`${t}(\\.\\d+)?`;let n=e.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${t})${n}`}function nC(e){return new RegExp(`^${Rh(e)}$`)}function iC(e){let t=`${Ih}T${Rh(e)}`,n=[];if(n.push(e.local?"Z?":"Z"),e.offset)n.push("([+-]\\d{2}:?\\d{2})");return t=`${t}(${n.join("|")})`,new RegExp(`^${t}$`)}function sC(e,t){if((t==="v4"||!t)&&Xb.test(e))return!0;if((t==="v6"||!t)&&Jb.test(e))return!0;return!1}function aC(e,t){if(!Gb.test(e))return!1;try{let[n]=e.split(".");if(!n)return!1;let r=n.replace(/-/g,"+").replace(/_/g,"/").padEnd(n.length+(4-n.length%4)%4,"="),i=JSON.parse(atob(r));if(typeof i!=="object"||i===null)return!1;if("typ"in i&&i?.typ!=="JWT")return!1;if(!i.alg)return!1;if(t&&i.alg!==t)return!1;return!0}catch{return!1}}function oC(e,t){if((t==="v4"||!t)&&Yb.test(e))return!0;if((t==="v6"||!t)&&Zb.test(e))return!0;return!1}class _r extends Se{_parse(e){if(this._def.coerce)e.data=String(e.data);if(this._getType(e)!==z.string){let i=this._getOrReturnCtx(e);return q(i,{code:P.invalid_type,expected:z.string,received:i.parsedType}),ae}let n=new vt,r=void 0;for(let i of this._def.checks)if(i.kind==="min"){if(e.data.length<i.value)r=this._getOrReturnCtx(e,r),q(r,{code:P.too_small,minimum:i.value,type:"string",inclusive:!0,exact:!1,message:i.message}),n.dirty()}else if(i.kind==="max"){if(e.data.length>i.value)r=this._getOrReturnCtx(e,r),q(r,{code:P.too_big,maximum:i.value,type:"string",inclusive:!0,exact:!1,message:i.message}),n.dirty()}else if(i.kind==="length"){let s=e.data.length>i.value,a=e.data.length<i.value;if(s||a){if(r=this._getOrReturnCtx(e,r),s)q(r,{code:P.too_big,maximum:i.value,type:"string",inclusive:!0,exact:!0,message:i.message});else if(a)q(r,{code:P.too_small,minimum:i.value,type:"string",inclusive:!0,exact:!0,message:i.message});n.dirty()}}else if(i.kind==="email"){if(!zb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"email",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="emoji"){if(!Cc)Cc=new RegExp(Qb,"u");if(!Cc.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"emoji",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="uuid"){if(!Kb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"uuid",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="nanoid"){if(!qb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"nanoid",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="cuid"){if(!Wb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"cuid",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="cuid2"){if(!$b.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"cuid2",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="ulid"){if(!Hb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"ulid",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="url")try{new URL(e.data)}catch{r=this._getOrReturnCtx(e,r),q(r,{validation:"url",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="regex"){if(i.regex.lastIndex=0,!i.regex.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"regex",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="trim")e.data=e.data.trim();else if(i.kind==="includes"){if(!e.data.includes(i.value,i.position))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:{includes:i.value,position:i.position},message:i.message}),n.dirty()}else if(i.kind==="toLowerCase")e.data=e.data.toLowerCase();else if(i.kind==="toUpperCase")e.data=e.data.toUpperCase();else if(i.kind==="startsWith"){if(!e.data.startsWith(i.value))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:{startsWith:i.value},message:i.message}),n.dirty()}else if(i.kind==="endsWith"){if(!e.data.endsWith(i.value))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:{endsWith:i.value},message:i.message}),n.dirty()}else if(i.kind==="datetime"){if(!iC(i).test(e.data))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:"datetime",message:i.message}),n.dirty()}else if(i.kind==="date"){if(!rC.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:"date",message:i.message}),n.dirty()}else if(i.kind==="time"){if(!nC(i).test(e.data))r=this._getOrReturnCtx(e,r),q(r,{code:P.invalid_string,validation:"time",message:i.message}),n.dirty()}else if(i.kind==="duration"){if(!jb.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"duration",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="ip"){if(!sC(e.data,i.version))r=this._getOrReturnCtx(e,r),q(r,{validation:"ip",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="jwt"){if(!aC(e.data,i.alg))r=this._getOrReturnCtx(e,r),q(r,{validation:"jwt",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="cidr"){if(!oC(e.data,i.version))r=this._getOrReturnCtx(e,r),q(r,{validation:"cidr",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="base64"){if(!eC.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"base64",code:P.invalid_string,message:i.message}),n.dirty()}else if(i.kind==="base64url"){if(!tC.test(e.data))r=this._getOrReturnCtx(e,r),q(r,{validation:"base64url",code:P.invalid_string,message:i.message}),n.dirty()}else Ae.assertNever(i);return{status:n.value,value:e.data}}_regex(e,t,n){return this.refinement((r)=>e.test(r),{validation:t,code:P.invalid_string,...J.errToObj(n)})}_addCheck(e){return new _r({...this._def,checks:[...this._def.checks,e]})}email(e){return this._addCheck({kind:"email",...J.errToObj(e)})}url(e){return this._addCheck({kind:"url",...J.errToObj(e)})}emoji(e){return this._addCheck({kind:"emoji",...J.errToObj(e)})}uuid(e){return this._addCheck({kind:"uuid",...J.errToObj(e)})}nanoid(e){return this._addCheck({kind:"nanoid",...J.errToObj(e)})}cuid(e){return this._addCheck({kind:"cuid",...J.errToObj(e)})}cuid2(e){return this._addCheck({kind:"cuid2",...J.errToObj(e)})}ulid(e){return this._addCheck({kind:"ulid",...J.errToObj(e)})}base64(e){return this._addCheck({kind:"base64",...J.errToObj(e)})}base64url(e){return this._addCheck({kind:"base64url",...J.errToObj(e)})}jwt(e){return this._addCheck({kind:"jwt",...J.errToObj(e)})}ip(e){return this._addCheck({kind:"ip",...J.errToObj(e)})}cidr(e){return this._addCheck({kind:"cidr",...J.errToObj(e)})}datetime(e){if(typeof e==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:e});return this._addCheck({kind:"datetime",precision:typeof e?.precision>"u"?null:e?.precision,offset:e?.offset??!1,local:e?.local??!1,...J.errToObj(e?.message)})}date(e){return this._addCheck({kind:"date",message:e})}time(e){if(typeof e==="string")return this._addCheck({kind:"time",precision:null,message:e});return this._addCheck({kind:"time",precision:typeof e?.precision>"u"?null:e?.precision,...J.errToObj(e?.message)})}duration(e){return this._addCheck({kind:"duration",...J.errToObj(e)})}regex(e,t){return this._addCheck({kind:"regex",regex:e,...J.errToObj(t)})}includes(e,t){return this._addCheck({kind:"includes",value:e,position:t?.position,...J.errToObj(t?.message)})}startsWith(e,t){return this._addCheck({kind:"startsWith",value:e,...J.errToObj(t)})}endsWith(e,t){return this._addCheck({kind:"endsWith",value:e,...J.errToObj(t)})}min(e,t){return this._addCheck({kind:"min",value:e,...J.errToObj(t)})}max(e,t){return this._addCheck({kind:"max",value:e,...J.errToObj(t)})}length(e,t){return this._addCheck({kind:"length",value:e,...J.errToObj(t)})}nonempty(e){return this.min(1,J.errToObj(e))}trim(){return new _r({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new _r({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new _r({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find((e)=>e.kind==="datetime")}get isDate(){return!!this._def.checks.find((e)=>e.kind==="date")}get isTime(){return!!this._def.checks.find((e)=>e.kind==="time")}get isDuration(){return!!this._def.checks.find((e)=>e.kind==="duration")}get isEmail(){return!!this._def.checks.find((e)=>e.kind==="email")}get isURL(){return!!this._def.checks.find((e)=>e.kind==="url")}get isEmoji(){return!!this._def.checks.find((e)=>e.kind==="emoji")}get isUUID(){return!!this._def.checks.find((e)=>e.kind==="uuid")}get isNANOID(){return!!this._def.checks.find((e)=>e.kind==="nanoid")}get isCUID(){return!!this._def.checks.find((e)=>e.kind==="cuid")}get isCUID2(){return!!this._def.checks.find((e)=>e.kind==="cuid2")}get isULID(){return!!this._def.checks.find((e)=>e.kind==="ulid")}get isIP(){return!!this._def.checks.find((e)=>e.kind==="ip")}get isCIDR(){return!!this._def.checks.find((e)=>e.kind==="cidr")}get isBase64(){return!!this._def.checks.find((e)=>e.kind==="base64")}get isBase64url(){return!!this._def.checks.find((e)=>e.kind==="base64url")}get minLength(){let e=null;for(let t of this._def.checks)if(t.kind==="min"){if(e===null||t.value>e)e=t.value}return e}get maxLength(){let e=null;for(let t of this._def.checks)if(t.kind==="max"){if(e===null||t.value<e)e=t.value}return e}}_r.create=(e)=>new _r({checks:[],typeName:oe.ZodString,coerce:e?.coerce??!1,...he(e)});function lC(e,t){let n=(e.toString().split(".")[1]||"").length,r=(t.toString().split(".")[1]||"").length,i=n>r?n:r,s=Number.parseInt(e.toFixed(i).replace(".","")),a=Number.parseInt(t.toFixed(i).replace(".",""));return s%a/10**i}class ti extends Se{constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse(e){if(this._def.coerce)e.data=Number(e.data);if(this._getType(e)!==z.number){let i=this._getOrReturnCtx(e);return q(i,{code:P.invalid_type,expected:z.number,received:i.parsedType}),ae}let n=void 0,r=new vt;for(let i of this._def.checks)if(i.kind==="int"){if(!Ae.isInteger(e.data))n=this._getOrReturnCtx(e,n),q(n,{code:P.invalid_type,expected:"integer",received:"float",message:i.message}),r.dirty()}else if(i.kind==="min"){if(i.inclusive?e.data<i.value:e.data<=i.value)n=this._getOrReturnCtx(e,n),q(n,{code:P.too_small,minimum:i.value,type:"number",inclusive:i.inclusive,exact:!1,message:i.message}),r.dirty()}else if(i.kind==="max"){if(i.inclusive?e.data>i.value:e.data>=i.value)n=this._getOrReturnCtx(e,n),q(n,{code:P.too_big,maximum:i.value,type:"number",inclusive:i.inclusive,exact:!1,message:i.message}),r.dirty()}else if(i.kind==="multipleOf"){if(lC(e.data,i.value)!==0)n=this._getOrReturnCtx(e,n),q(n,{code:P.not_multiple_of,multipleOf:i.value,message:i.message}),r.dirty()}else if(i.kind==="finite"){if(!Number.isFinite(e.data))n=this._getOrReturnCtx(e,n),q(n,{code:P.not_finite,message:i.message}),r.dirty()}else Ae.assertNever(i);return{status:r.value,value:e.data}}gte(e,t){return this.setLimit("min",e,!0,J.toString(t))}gt(e,t){return this.setLimit("min",e,!1,J.toString(t))}lte(e,t){return this.setLimit("max",e,!0,J.toString(t))}lt(e,t){return this.setLimit("max",e,!1,J.toString(t))}setLimit(e,t,n,r){return new ti({...this._def,checks:[...this._def.checks,{kind:e,value:t,inclusive:n,message:J.toString(r)}]})}_addCheck(e){return new ti({...this._def,checks:[...this._def.checks,e]})}int(e){return this._addCheck({kind:"int",message:J.toString(e)})}positive(e){return this._addCheck({kind:"min",value:0,inclusive:!1,message:J.toString(e)})}negative(e){return this._addCheck({kind:"max",value:0,inclusive:!1,message:J.toString(e)})}nonpositive(e){return this._addCheck({kind:"max",value:0,inclusive:!0,message:J.toString(e)})}nonnegative(e){return this._addCheck({kind:"min",value:0,inclusive:!0,message:J.toString(e)})}multipleOf(e,t){return this._addCheck({kind:"multipleOf",value:e,message:J.toString(t)})}finite(e){return this._addCheck({kind:"finite",message:J.toString(e)})}safe(e){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:J.toString(e)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:J.toString(e)})}get minValue(){let e=null;for(let t of this._def.checks)if(t.kind==="min"){if(e===null||t.value>e)e=t.value}return e}get maxValue(){let e=null;for(let t of this._def.checks)if(t.kind==="max"){if(e===null||t.value<e)e=t.value}return e}get isInt(){return!!this._def.checks.find((e)=>e.kind==="int"||e.kind==="multipleOf"&&Ae.isInteger(e.value))}get isFinite(){let e=null,t=null;for(let n of this._def.checks)if(n.kind==="finite"||n.kind==="int"||n.kind==="multipleOf")return!0;else if(n.kind==="min"){if(t===null||n.value>t)t=n.value}else if(n.kind==="max"){if(e===null||n.value<e)e=n.value}return Number.isFinite(t)&&Number.isFinite(e)}}ti.create=(e)=>new ti({checks:[],typeName:oe.ZodNumber,coerce:e?.coerce||!1,...he(e)});class ri extends Se{constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse(e){if(this._def.coerce)try{e.data=BigInt(e.data)}catch{return this._getInvalidInput(e)}if(this._getType(e)!==z.bigint)return this._getInvalidInput(e);let n=void 0,r=new vt;for(let i of this._def.checks)if(i.kind==="min"){if(i.inclusive?e.data<i.value:e.data<=i.value)n=this._getOrReturnCtx(e,n),q(n,{code:P.too_small,type:"bigint",minimum:i.value,inclusive:i.inclusive,message:i.message}),r.dirty()}else if(i.kind==="max"){if(i.inclusive?e.data>i.value:e.data>=i.value)n=this._getOrReturnCtx(e,n),q(n,{code:P.too_big,type:"bigint",maximum:i.value,inclusive:i.inclusive,message:i.message}),r.dirty()}else if(i.kind==="multipleOf"){if(e.data%i.value!==BigInt(0))n=this._getOrReturnCtx(e,n),q(n,{code:P.not_multiple_of,multipleOf:i.value,message:i.message}),r.dirty()}else Ae.assertNever(i);return{status:r.value,value:e.data}}_getInvalidInput(e){let t=this._getOrReturnCtx(e);return q(t,{code:P.invalid_type,expected:z.bigint,received:t.parsedType}),ae}gte(e,t){return this.setLimit("min",e,!0,J.toString(t))}gt(e,t){return this.setLimit("min",e,!1,J.toString(t))}lte(e,t){return this.setLimit("max",e,!0,J.toString(t))}lt(e,t){return this.setLimit("max",e,!1,J.toString(t))}setLimit(e,t,n,r){return new ri({...this._def,checks:[...this._def.checks,{kind:e,value:t,inclusive:n,message:J.toString(r)}]})}_addCheck(e){return new ri({...this._def,checks:[...this._def.checks,e]})}positive(e){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:J.toString(e)})}negative(e){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:J.toString(e)})}nonpositive(e){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:J.toString(e)})}nonnegative(e){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:J.toString(e)})}multipleOf(e,t){return this._addCheck({kind:"multipleOf",value:e,message:J.toString(t)})}get minValue(){let e=null;for(let t of this._def.checks)if(t.kind==="min"){if(e===null||t.value>e)e=t.value}return e}get maxValue(){let e=null;for(let t of this._def.checks)if(t.kind==="max"){if(e===null||t.value<e)e=t.value}return e}}ri.create=(e)=>new ri({checks:[],typeName:oe.ZodBigInt,coerce:e?.coerce??!1,...he(e)});class Va extends Se{_parse(e){if(this._def.coerce)e.data=Boolean(e.data);if(this._getType(e)!==z.boolean){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.boolean,received:n.parsedType}),ae}return wt(e.data)}}Va.create=(e)=>new Va({typeName:oe.ZodBoolean,coerce:e?.coerce||!1,...he(e)});class es extends Se{_parse(e){if(this._def.coerce)e.data=new Date(e.data);if(this._getType(e)!==z.date){let i=this._getOrReturnCtx(e);return q(i,{code:P.invalid_type,expected:z.date,received:i.parsedType}),ae}if(Number.isNaN(e.data.getTime())){let i=this._getOrReturnCtx(e);return q(i,{code:P.invalid_date}),ae}let n=new vt,r=void 0;for(let i of this._def.checks)if(i.kind==="min"){if(e.data.getTime()<i.value)r=this._getOrReturnCtx(e,r),q(r,{code:P.too_small,message:i.message,inclusive:!0,exact:!1,minimum:i.value,type:"date"}),n.dirty()}else if(i.kind==="max"){if(e.data.getTime()>i.value)r=this._getOrReturnCtx(e,r),q(r,{code:P.too_big,message:i.message,inclusive:!0,exact:!1,maximum:i.value,type:"date"}),n.dirty()}else Ae.assertNever(i);return{status:n.value,value:new Date(e.data.getTime())}}_addCheck(e){return new es({...this._def,checks:[...this._def.checks,e]})}min(e,t){return this._addCheck({kind:"min",value:e.getTime(),message:J.toString(t)})}max(e,t){return this._addCheck({kind:"max",value:e.getTime(),message:J.toString(t)})}get minDate(){let e=null;for(let t of this._def.checks)if(t.kind==="min"){if(e===null||t.value>e)e=t.value}return e!=null?new Date(e):null}get maxDate(){let e=null;for(let t of this._def.checks)if(t.kind==="max"){if(e===null||t.value<e)e=t.value}return e!=null?new Date(e):null}}es.create=(e)=>new es({checks:[],coerce:e?.coerce||!1,typeName:oe.ZodDate,...he(e)});class Fa extends Se{_parse(e){if(this._getType(e)!==z.symbol){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.symbol,received:n.parsedType}),ae}return wt(e.data)}}Fa.create=(e)=>new Fa({typeName:oe.ZodSymbol,...he(e)});class ts extends Se{_parse(e){if(this._getType(e)!==z.undefined){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.undefined,received:n.parsedType}),ae}return wt(e.data)}}ts.create=(e)=>new ts({typeName:oe.ZodUndefined,...he(e)});class rs extends Se{_parse(e){if(this._getType(e)!==z.null){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.null,received:n.parsedType}),ae}return wt(e.data)}}rs.create=(e)=>new rs({typeName:oe.ZodNull,...he(e)});class ni extends Se{constructor(){super(...arguments);this._any=!0}_parse(e){return wt(e.data)}}ni.create=(e)=>new ni({typeName:oe.ZodAny,...he(e)});class xn extends Se{constructor(){super(...arguments);this._unknown=!0}_parse(e){return wt(e.data)}}xn.create=(e)=>new xn({typeName:oe.ZodUnknown,...he(e)});class kr extends Se{_parse(e){let t=this._getOrReturnCtx(e);return q(t,{code:P.invalid_type,expected:z.never,received:t.parsedType}),ae}}kr.create=(e)=>new kr({typeName:oe.ZodNever,...he(e)});class Ma extends Se{_parse(e){if(this._getType(e)!==z.undefined){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.void,received:n.parsedType}),ae}return wt(e.data)}}Ma.create=(e)=>new Ma({typeName:oe.ZodVoid,...he(e)});class fr extends Se{_parse(e){let{ctx:t,status:n}=this._processInputParams(e),r=this._def;if(t.parsedType!==z.array)return q(t,{code:P.invalid_type,expected:z.array,received:t.parsedType}),ae;if(r.exactLength!==null){let s=t.data.length>r.exactLength.value,a=t.data.length<r.exactLength.value;if(s||a)q(t,{code:s?P.too_big:P.too_small,minimum:a?r.exactLength.value:void 0,maximum:s?r.exactLength.value:void 0,type:"array",inclusive:!0,exact:!0,message:r.exactLength.message}),n.dirty()}if(r.minLength!==null){if(t.data.length<r.minLength.value)q(t,{code:P.too_small,minimum:r.minLength.value,type:"array",inclusive:!0,exact:!1,message:r.minLength.message}),n.dirty()}if(r.maxLength!==null){if(t.data.length>r.maxLength.value)q(t,{code:P.too_big,maximum:r.maxLength.value,type:"array",inclusive:!0,exact:!1,message:r.maxLength.message}),n.dirty()}if(t.common.async)return Promise.all([...t.data].map((s,a)=>r.type._parseAsync(new Jt(t,s,t.path,a)))).then((s)=>vt.mergeArray(n,s));let i=[...t.data].map((s,a)=>r.type._parseSync(new Jt(t,s,t.path,a)));return vt.mergeArray(n,i)}get element(){return this._def.type}min(e,t){return new fr({...this._def,minLength:{value:e,message:J.toString(t)}})}max(e,t){return new fr({...this._def,maxLength:{value:e,message:J.toString(t)}})}length(e,t){return new fr({...this._def,exactLength:{value:e,message:J.toString(t)}})}nonempty(e){return this.min(1,e)}}fr.create=(e,t)=>new fr({type:e,minLength:null,maxLength:null,exactLength:null,typeName:oe.ZodArray,...he(t)});function ei(e){if(e instanceof et){let t={};for(let n in e.shape){let r=e.shape[n];t[n]=pr.create(ei(r))}return new et({...e._def,shape:()=>t})}else if(e instanceof fr)return new fr({...e._def,type:ei(e.element)});else if(e instanceof pr)return pr.create(ei(e.unwrap()));else if(e instanceof Yr)return Yr.create(ei(e.unwrap()));else if(e instanceof Ir)return Ir.create(e.items.map((t)=>ei(t)));else return e}class et extends Se{constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let e=this._def.shape(),t=Ae.objectKeys(e);return this._cached={shape:e,keys:t},this._cached}_parse(e){if(this._getType(e)!==z.object){let l=this._getOrReturnCtx(e);return q(l,{code:P.invalid_type,expected:z.object,received:l.parsedType}),ae}let{status:n,ctx:r}=this._processInputParams(e),{shape:i,keys:s}=this._getCached(),a=[];if(!(this._def.catchall instanceof kr&&this._def.unknownKeys==="strip")){for(let l in r.data)if(!s.includes(l))a.push(l)}let o=[];for(let l of s){let c=i[l],u=r.data[l];o.push({key:{status:"valid",value:l},value:c._parse(new Jt(r,u,r.path,l)),alwaysSet:l in r.data})}if(this._def.catchall instanceof kr){let l=this._def.unknownKeys;if(l==="passthrough")for(let c of a)o.push({key:{status:"valid",value:c},value:{status:"valid",value:r.data[c]}});else if(l==="strict"){if(a.length>0)q(r,{code:P.unrecognized_keys,keys:a}),n.dirty()}else if(l==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let l=this._def.catchall;for(let c of a){let u=r.data[c];o.push({key:{status:"valid",value:c},value:l._parse(new Jt(r,u,r.path,c)),alwaysSet:c in r.data})}}if(r.common.async)return Promise.resolve().then(async()=>{let l=[];for(let c of o){let u=await c.key,d=await c.value;l.push({key:u,value:d,alwaysSet:c.alwaysSet})}return l}).then((l)=>vt.mergeObjectSync(n,l));else return vt.mergeObjectSync(n,o)}get shape(){return this._def.shape()}strict(e){return J.errToObj,new et({...this._def,unknownKeys:"strict",...e!==void 0?{errorMap:(t,n)=>{let r=this._def.errorMap?.(t,n).message??n.defaultError;if(t.code==="unrecognized_keys")return{message:J.errToObj(e).message??r};return{message:r}}}:{}})}strip(){return new et({...this._def,unknownKeys:"strip"})}passthrough(){return new et({...this._def,unknownKeys:"passthrough"})}extend(e){return new et({...this._def,shape:()=>({...this._def.shape(),...e})})}merge(e){return new et({unknownKeys:e._def.unknownKeys,catchall:e._def.catchall,shape:()=>({...this._def.shape(),...e._def.shape()}),typeName:oe.ZodObject})}setKey(e,t){return this.augment({[e]:t})}catchall(e){return new et({...this._def,catchall:e})}pick(e){let t={};for(let n of Ae.objectKeys(e))if(e[n]&&this.shape[n])t[n]=this.shape[n];return new et({...this._def,shape:()=>t})}omit(e){let t={};for(let n of Ae.objectKeys(this.shape))if(!e[n])t[n]=this.shape[n];return new et({...this._def,shape:()=>t})}deepPartial(){return ei(this)}partial(e){let t={};for(let n of Ae.objectKeys(this.shape)){let r=this.shape[n];if(e&&!e[n])t[n]=r;else t[n]=r.optional()}return new et({...this._def,shape:()=>t})}required(e){let t={};for(let n of Ae.objectKeys(this.shape))if(e&&!e[n])t[n]=this.shape[n];else{let i=this.shape[n];while(i instanceof pr)i=i._def.innerType;t[n]=i}return new et({...this._def,shape:()=>t})}keyof(){return Bh(Ae.objectKeys(this.shape))}}et.create=(e,t)=>new et({shape:()=>e,unknownKeys:"strip",catchall:kr.create(),typeName:oe.ZodObject,...he(t)});et.strictCreate=(e,t)=>new et({shape:()=>e,unknownKeys:"strict",catchall:kr.create(),typeName:oe.ZodObject,...he(t)});et.lazycreate=(e,t)=>new et({shape:e,unknownKeys:"strip",catchall:kr.create(),typeName:oe.ZodObject,...he(t)});class ns extends Se{_parse(e){let{ctx:t}=this._processInputParams(e),n=this._def.options;function r(i){for(let a of i)if(a.result.status==="valid")return a.result;for(let a of i)if(a.result.status==="dirty")return t.common.issues.push(...a.ctx.common.issues),a.result;let s=i.map((a)=>new Pt(a.ctx.common.issues));return q(t,{code:P.invalid_union,unionErrors:s}),ae}if(t.common.async)return Promise.all(n.map(async(i)=>{let s={...t,common:{...t.common,issues:[]},parent:null};return{result:await i._parseAsync({data:t.data,path:t.path,parent:s}),ctx:s}})).then(r);else{let i=void 0,s=[];for(let o of n){let l={...t,common:{...t.common,issues:[]},parent:null},c=o._parseSync({data:t.data,path:t.path,parent:l});if(c.status==="valid")return c;else if(c.status==="dirty"&&!i)i={result:c,ctx:l};if(l.common.issues.length)s.push(l.common.issues)}if(i)return t.common.issues.push(...i.ctx.common.issues),i.result;let a=s.map((o)=>new Pt(o));return q(t,{code:P.invalid_union,unionErrors:a}),ae}}get options(){return this._def.options}}ns.create=(e,t)=>new ns({options:e,typeName:oe.ZodUnion,...he(t)});var Ar=(e)=>{if(e instanceof ss)return Ar(e.schema);else if(e instanceof hr)return Ar(e.innerType());else if(e instanceof as)return[e.value];else if(e instanceof Sn)return e.options;else if(e instanceof os)return Ae.objectValues(e.enum);else if(e instanceof ls)return Ar(e._def.innerType);else if(e instanceof ts)return[void 0];else if(e instanceof rs)return[null];else if(e instanceof pr)return[void 0,...Ar(e.unwrap())];else if(e instanceof Yr)return[null,...Ar(e.unwrap())];else if(e instanceof Tc)return Ar(e.unwrap());else if(e instanceof us)return Ar(e.unwrap());else if(e instanceof cs)return Ar(e._def.innerType);else return[]};class wc extends Se{_parse(e){let{ctx:t}=this._processInputParams(e);if(t.parsedType!==z.object)return q(t,{code:P.invalid_type,expected:z.object,received:t.parsedType}),ae;let n=this.discriminator,r=t.data[n],i=this.optionsMap.get(r);if(!i)return q(t,{code:P.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[n]}),ae;if(t.common.async)return i._parseAsync({data:t.data,path:t.path,parent:t});else return i._parseSync({data:t.data,path:t.path,parent:t})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create(e,t,n){let r=new Map;for(let i of t){let s=Ar(i.shape[e]);if(!s.length)throw Error(`A discriminator value for key \`${e}\` could not be extracted from all schema options`);for(let a of s){if(r.has(a))throw Error(`Discriminator property ${String(e)} has duplicate value ${String(a)}`);r.set(a,i)}}return new wc({typeName:oe.ZodDiscriminatedUnion,discriminator:e,options:t,optionsMap:r,...he(n)})}}function Ec(e,t){let n=Tr(e),r=Tr(t);if(e===t)return{valid:!0,data:e};else if(n===z.object&&r===z.object){let i=Ae.objectKeys(t),s=Ae.objectKeys(e).filter((o)=>i.indexOf(o)!==-1),a={...e,...t};for(let o of s){let l=Ec(e[o],t[o]);if(!l.valid)return{valid:!1};a[o]=l.data}return{valid:!0,data:a}}else if(n===z.array&&r===z.array){if(e.length!==t.length)return{valid:!1};let i=[];for(let s=0;s<e.length;s++){let a=e[s],o=t[s],l=Ec(a,o);if(!l.valid)return{valid:!1};i.push(l.data)}return{valid:!0,data:i}}else if(n===z.date&&r===z.date&&+e===+t)return{valid:!0,data:e};else return{valid:!1}}class is extends Se{_parse(e){let{status:t,ctx:n}=this._processInputParams(e),r=(i,s)=>{if(Sc(i)||Sc(s))return ae;let a=Ec(i.value,s.value);if(!a.valid)return q(n,{code:P.invalid_intersection_types}),ae;if(bc(i)||bc(s))t.dirty();return{status:t.value,value:a.data}};if(n.common.async)return Promise.all([this._def.left._parseAsync({data:n.data,path:n.path,parent:n}),this._def.right._parseAsync({data:n.data,path:n.path,parent:n})]).then(([i,s])=>r(i,s));else return r(this._def.left._parseSync({data:n.data,path:n.path,parent:n}),this._def.right._parseSync({data:n.data,path:n.path,parent:n}))}}is.create=(e,t,n)=>new is({left:e,right:t,typeName:oe.ZodIntersection,...he(n)});class Ir extends Se{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==z.array)return q(n,{code:P.invalid_type,expected:z.array,received:n.parsedType}),ae;if(n.data.length<this._def.items.length)return q(n,{code:P.too_small,minimum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),ae;if(!this._def.rest&&n.data.length>this._def.items.length)q(n,{code:P.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),t.dirty();let i=[...n.data].map((s,a)=>{let o=this._def.items[a]||this._def.rest;if(!o)return null;return o._parse(new Jt(n,s,n.path,a))}).filter((s)=>!!s);if(n.common.async)return Promise.all(i).then((s)=>vt.mergeArray(t,s));else return vt.mergeArray(t,i)}get items(){return this._def.items}rest(e){return new Ir({...this._def,rest:e})}}Ir.create=(e,t)=>{if(!Array.isArray(e))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new Ir({items:e,typeName:oe.ZodTuple,rest:null,...he(t)})};class Wa extends Se{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==z.object)return q(n,{code:P.invalid_type,expected:z.object,received:n.parsedType}),ae;let r=[],i=this._def.keyType,s=this._def.valueType;for(let a in n.data)r.push({key:i._parse(new Jt(n,a,n.path,a)),value:s._parse(new Jt(n,n.data[a],n.path,a)),alwaysSet:a in n.data});if(n.common.async)return vt.mergeObjectAsync(t,r);else return vt.mergeObjectSync(t,r)}get element(){return this._def.valueType}static create(e,t,n){if(t instanceof Se)return new Wa({keyType:e,valueType:t,typeName:oe.ZodRecord,...he(n)});return new Wa({keyType:_r.create(),valueType:e,typeName:oe.ZodRecord,...he(t)})}}class $a extends Se{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==z.map)return q(n,{code:P.invalid_type,expected:z.map,received:n.parsedType}),ae;let r=this._def.keyType,i=this._def.valueType,s=[...n.data.entries()].map(([a,o],l)=>({key:r._parse(new Jt(n,a,n.path,[l,"key"])),value:i._parse(new Jt(n,o,n.path,[l,"value"]))}));if(n.common.async){let a=new Map;return Promise.resolve().then(async()=>{for(let o of s){let l=await o.key,c=await o.value;if(l.status==="aborted"||c.status==="aborted")return ae;if(l.status==="dirty"||c.status==="dirty")t.dirty();a.set(l.value,c.value)}return{status:t.value,value:a}})}else{let a=new Map;for(let o of s){let{key:l,value:c}=o;if(l.status==="aborted"||c.status==="aborted")return ae;if(l.status==="dirty"||c.status==="dirty")t.dirty();a.set(l.value,c.value)}return{status:t.value,value:a}}}}$a.create=(e,t,n)=>new $a({valueType:t,keyType:e,typeName:oe.ZodMap,...he(n)});class ii extends Se{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.parsedType!==z.set)return q(n,{code:P.invalid_type,expected:z.set,received:n.parsedType}),ae;let r=this._def;if(r.minSize!==null){if(n.data.size<r.minSize.value)q(n,{code:P.too_small,minimum:r.minSize.value,type:"set",inclusive:!0,exact:!1,message:r.minSize.message}),t.dirty()}if(r.maxSize!==null){if(n.data.size>r.maxSize.value)q(n,{code:P.too_big,maximum:r.maxSize.value,type:"set",inclusive:!0,exact:!1,message:r.maxSize.message}),t.dirty()}let i=this._def.valueType;function s(o){let l=new Set;for(let c of o){if(c.status==="aborted")return ae;if(c.status==="dirty")t.dirty();l.add(c.value)}return{status:t.value,value:l}}let a=[...n.data.values()].map((o,l)=>i._parse(new Jt(n,o,n.path,l)));if(n.common.async)return Promise.all(a).then((o)=>s(o));else return s(a)}min(e,t){return new ii({...this._def,minSize:{value:e,message:J.toString(t)}})}max(e,t){return new ii({...this._def,maxSize:{value:e,message:J.toString(t)}})}size(e,t){return this.min(e,t).max(e,t)}nonempty(e){return this.min(1,e)}}ii.create=(e,t)=>new ii({valueType:e,minSize:null,maxSize:null,typeName:oe.ZodSet,...he(t)});class Zi extends Se{constructor(){super(...arguments);this.validate=this.implement}_parse(e){let{ctx:t}=this._processInputParams(e);if(t.parsedType!==z.function)return q(t,{code:P.invalid_type,expected:z.function,received:t.parsedType}),ae;function n(a,o){return Ua({data:a,path:t.path,errorMaps:[t.common.contextualErrorMap,t.schemaErrorMap,Yi(),Xr].filter((l)=>!!l),issueData:{code:P.invalid_arguments,argumentsError:o}})}function r(a,o){return Ua({data:a,path:t.path,errorMaps:[t.common.contextualErrorMap,t.schemaErrorMap,Yi(),Xr].filter((l)=>!!l),issueData:{code:P.invalid_return_type,returnTypeError:o}})}let i={errorMap:t.common.contextualErrorMap},s=t.data;if(this._def.returns instanceof si){let a=this;return wt(async function(...o){let l=new Pt([]),c=await a._def.args.parseAsync(o,i).catch((f)=>{throw l.addIssue(n(o,f)),l}),u=await Reflect.apply(s,this,c);return await a._def.returns._def.type.parseAsync(u,i).catch((f)=>{throw l.addIssue(r(u,f)),l})})}else{let a=this;return wt(function(...o){let l=a._def.args.safeParse(o,i);if(!l.success)throw new Pt([n(o,l.error)]);let c=Reflect.apply(s,this,l.data),u=a._def.returns.safeParse(c,i);if(!u.success)throw new Pt([r(c,u.error)]);return u.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(...e){return new Zi({...this._def,args:Ir.create(e).rest(xn.create())})}returns(e){return new Zi({...this._def,returns:e})}implement(e){return this.parse(e)}strictImplement(e){return this.parse(e)}static create(e,t,n){return new Zi({args:e?e:Ir.create([]).rest(xn.create()),returns:t||xn.create(),typeName:oe.ZodFunction,...he(n)})}}class ss extends Se{get schema(){return this._def.getter()}_parse(e){let{ctx:t}=this._processInputParams(e);return this._def.getter()._parse({data:t.data,path:t.path,parent:t})}}ss.create=(e,t)=>new ss({getter:e,typeName:oe.ZodLazy,...he(t)});class as extends Se{_parse(e){if(e.data!==this._def.value){let t=this._getOrReturnCtx(e);return q(t,{received:t.data,code:P.invalid_literal,expected:this._def.value}),ae}return{status:"valid",value:e.data}}get value(){return this._def.value}}as.create=(e,t)=>new as({value:e,typeName:oe.ZodLiteral,...he(t)});function Bh(e,t){return new Sn({values:e,typeName:oe.ZodEnum,...he(t)})}class Sn extends Se{_parse(e){if(typeof e.data!=="string"){let t=this._getOrReturnCtx(e),n=this._def.values;return q(t,{expected:Ae.joinValues(n),received:t.parsedType,code:P.invalid_type}),ae}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has(e.data)){let t=this._getOrReturnCtx(e),n=this._def.values;return q(t,{received:t.data,code:P.invalid_enum_value,options:n}),ae}return wt(e.data)}get options(){return this._def.values}get enum(){let e={};for(let t of this._def.values)e[t]=t;return e}get Values(){let e={};for(let t of this._def.values)e[t]=t;return e}get Enum(){let e={};for(let t of this._def.values)e[t]=t;return e}extract(e,t=this._def){return Sn.create(e,{...this._def,...t})}exclude(e,t=this._def){return Sn.create(this.options.filter((n)=>!e.includes(n)),{...this._def,...t})}}Sn.create=Bh;class os extends Se{_parse(e){let t=Ae.getValidEnumValues(this._def.values),n=this._getOrReturnCtx(e);if(n.parsedType!==z.string&&n.parsedType!==z.number){let r=Ae.objectValues(t);return q(n,{expected:Ae.joinValues(r),received:n.parsedType,code:P.invalid_type}),ae}if(!this._cache)this._cache=new Set(Ae.getValidEnumValues(this._def.values));if(!this._cache.has(e.data)){let r=Ae.objectValues(t);return q(n,{received:n.data,code:P.invalid_enum_value,options:r}),ae}return wt(e.data)}get enum(){return this._def.values}}os.create=(e,t)=>new os({values:e,typeName:oe.ZodNativeEnum,...he(t)});class si extends Se{unwrap(){return this._def.type}_parse(e){let{ctx:t}=this._processInputParams(e);if(t.parsedType!==z.promise&&t.common.async===!1)return q(t,{code:P.invalid_type,expected:z.promise,received:t.parsedType}),ae;let n=t.parsedType===z.promise?t.data:Promise.resolve(t.data);return wt(n.then((r)=>this._def.type.parseAsync(r,{path:t.path,errorMap:t.common.contextualErrorMap})))}}si.create=(e,t)=>new si({type:e,typeName:oe.ZodPromise,...he(t)});class hr extends Se{innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===oe.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse(e){let{status:t,ctx:n}=this._processInputParams(e),r=this._def.effect||null,i={addIssue:(s)=>{if(q(n,s),s.fatal)t.abort();else t.dirty()},get path(){return n.path}};if(i.addIssue=i.addIssue.bind(i),r.type==="preprocess"){let s=r.transform(n.data,i);if(n.common.async)return Promise.resolve(s).then(async(a)=>{if(t.value==="aborted")return ae;let o=await this._def.schema._parseAsync({data:a,path:n.path,parent:n});if(o.status==="aborted")return ae;if(o.status==="dirty")return Zn(o.value);if(t.value==="dirty")return Zn(o.value);return o});else{if(t.value==="aborted")return ae;let a=this._def.schema._parseSync({data:s,path:n.path,parent:n});if(a.status==="aborted")return ae;if(a.status==="dirty")return Zn(a.value);if(t.value==="dirty")return Zn(a.value);return a}}if(r.type==="refinement"){let s=(a)=>{let o=r.refinement(a,i);if(n.common.async)return Promise.resolve(o);if(o instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return a};if(n.common.async===!1){let a=this._def.schema._parseSync({data:n.data,path:n.path,parent:n});if(a.status==="aborted")return ae;if(a.status==="dirty")t.dirty();return s(a.value),{status:t.value,value:a.value}}else return this._def.schema._parseAsync({data:n.data,path:n.path,parent:n}).then((a)=>{if(a.status==="aborted")return ae;if(a.status==="dirty")t.dirty();return s(a.value).then(()=>({status:t.value,value:a.value}))})}if(r.type==="transform")if(n.common.async===!1){let s=this._def.schema._parseSync({data:n.data,path:n.path,parent:n});if(!vn(s))return ae;let a=r.transform(s.value,i);if(a instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:t.value,value:a}}else return this._def.schema._parseAsync({data:n.data,path:n.path,parent:n}).then((s)=>{if(!vn(s))return ae;return Promise.resolve(r.transform(s.value,i)).then((a)=>({status:t.value,value:a}))});Ae.assertNever(r)}}hr.create=(e,t,n)=>new hr({schema:e,typeName:oe.ZodEffects,effect:t,...he(n)});hr.createWithPreprocess=(e,t,n)=>new hr({schema:t,effect:{type:"preprocess",transform:e},typeName:oe.ZodEffects,...he(n)});class pr extends Se{_parse(e){if(this._getType(e)===z.undefined)return wt(void 0);return this._def.innerType._parse(e)}unwrap(){return this._def.innerType}}pr.create=(e,t)=>new pr({innerType:e,typeName:oe.ZodOptional,...he(t)});class Yr extends Se{_parse(e){if(this._getType(e)===z.null)return wt(null);return this._def.innerType._parse(e)}unwrap(){return this._def.innerType}}Yr.create=(e,t)=>new Yr({innerType:e,typeName:oe.ZodNullable,...he(t)});class ls extends Se{_parse(e){let{ctx:t}=this._processInputParams(e),n=t.data;if(t.parsedType===z.undefined)n=this._def.defaultValue();return this._def.innerType._parse({data:n,path:t.path,parent:t})}removeDefault(){return this._def.innerType}}ls.create=(e,t)=>new ls({innerType:e,typeName:oe.ZodDefault,defaultValue:typeof t.default==="function"?t.default:()=>t.default,...he(t)});class cs extends Se{_parse(e){let{ctx:t}=this._processInputParams(e),n={...t,common:{...t.common,issues:[]}},r=this._def.innerType._parse({data:n.data,path:n.path,parent:{...n}});if(Ji(r))return r.then((i)=>({status:"valid",value:i.status==="valid"?i.value:this._def.catchValue({get error(){return new Pt(n.common.issues)},input:n.data})}));else return{status:"valid",value:r.status==="valid"?r.value:this._def.catchValue({get error(){return new Pt(n.common.issues)},input:n.data})}}removeCatch(){return this._def.innerType}}cs.create=(e,t)=>new cs({innerType:e,typeName:oe.ZodCatch,catchValue:typeof t.catch==="function"?t.catch:()=>t.catch,...he(t)});class Ha extends Se{_parse(e){if(this._getType(e)!==z.nan){let n=this._getOrReturnCtx(e);return q(n,{code:P.invalid_type,expected:z.nan,received:n.parsedType}),ae}return{status:"valid",value:e.data}}}Ha.create=(e)=>new Ha({typeName:oe.ZodNaN,...he(e)});var sA=Symbol("zod_brand");class Tc extends Se{_parse(e){let{ctx:t}=this._processInputParams(e),n=t.data;return this._def.type._parse({data:n,path:t.path,parent:t})}unwrap(){return this._def.type}}class Ka extends Se{_parse(e){let{status:t,ctx:n}=this._processInputParams(e);if(n.common.async)return(async()=>{let i=await this._def.in._parseAsync({data:n.data,path:n.path,parent:n});if(i.status==="aborted")return ae;if(i.status==="dirty")return t.dirty(),Zn(i.value);else return this._def.out._parseAsync({data:i.value,path:n.path,parent:n})})();else{let r=this._def.in._parseSync({data:n.data,path:n.path,parent:n});if(r.status==="aborted")return ae;if(r.status==="dirty")return t.dirty(),{status:"dirty",value:r.value};else return this._def.out._parseSync({data:r.value,path:n.path,parent:n})}}static create(e,t){return new Ka({in:e,out:t,typeName:oe.ZodPipeline})}}class us extends Se{_parse(e){let t=this._def.innerType._parse(e),n=(r)=>{if(vn(r))r.value=Object.freeze(r.value);return r};return Ji(t)?t.then((r)=>n(r)):n(t)}unwrap(){return this._def.innerType}}us.create=(e,t)=>new us({innerType:e,typeName:oe.ZodReadonly,...he(t)});function kh(e,t){let n=typeof e==="function"?e(t):typeof e==="string"?{message:e}:e;return typeof n==="string"?{message:n}:n}function cC(e,t={},n){if(e)return ni.create().superRefine((r,i)=>{let s=e(r);if(s instanceof Promise)return s.then((a)=>{if(!a){let o=kh(t,r),l=o.fatal??n??!0;i.addIssue({code:"custom",...o,fatal:l})}});if(!s){let a=kh(t,r),o=a.fatal??n??!0;i.addIssue({code:"custom",...a,fatal:o})}return});return ni.create()}var aA={object:et.lazycreate},oe;(function(e){e.ZodString="ZodString",e.ZodNumber="ZodNumber",e.ZodNaN="ZodNaN",e.ZodBigInt="ZodBigInt",e.ZodBoolean="ZodBoolean",e.ZodDate="ZodDate",e.ZodSymbol="ZodSymbol",e.ZodUndefined="ZodUndefined",e.ZodNull="ZodNull",e.ZodAny="ZodAny",e.ZodUnknown="ZodUnknown",e.ZodNever="ZodNever",e.ZodVoid="ZodVoid",e.ZodArray="ZodArray",e.ZodObject="ZodObject",e.ZodUnion="ZodUnion",e.ZodDiscriminatedUnion="ZodDiscriminatedUnion",e.ZodIntersection="ZodIntersection",e.ZodTuple="ZodTuple",e.ZodRecord="ZodRecord",e.ZodMap="ZodMap",e.ZodSet="ZodSet",e.ZodFunction="ZodFunction",e.ZodLazy="ZodLazy",e.ZodLiteral="ZodLiteral",e.ZodEnum="ZodEnum",e.ZodEffects="ZodEffects",e.ZodNativeEnum="ZodNativeEnum",e.ZodOptional="ZodOptional",e.ZodNullable="ZodNullable",e.ZodDefault="ZodDefault",e.ZodCatch="ZodCatch",e.ZodPromise="ZodPromise",e.ZodBranded="ZodBranded",e.ZodPipeline="ZodPipeline",e.ZodReadonly="ZodReadonly"})(oe||(oe={}));var ye=_r.create,Rr=ti.create,oA=Ha.create,lA=ri.create,Zt=Va.create,cA=es.create,uA=Fa.create,dA=ts.create,fA=rs.create,pA=ni.create,hA=xn.create,gA=kr.create,mA=Ma.create,Qe=fr.create,{create:ht,strictCreate:yA}=et,vA=ns.create,xA=wc.create,SA=is.create,uC=Ir.create,Ph=Wa.create,bA=$a.create,CA=ii.create,EA=Zi.create,wA=ss.create,TA=as.create,ai=Sn.create,AA=os.create,_A=si.create,kA=hr.create,IA=pr.create,RA=Yr.create,BA=hr.createWithPreprocess,PA=Ka.create;function _c(e){if(fC(e)===6)return!0;if(e.includes("://")||e.includes("/")||e.includes(":"))return!1;if(e==="localhost")return!0;if(e.startsWith("*.")){let t=e.slice(2);if(!t.includes(".")||t.startsWith(".")||t.endsWith("."))return!1;let n=t.split(".");return n.length>=2&&n.every((r)=>r.length>0)}if(e.includes("*"))return!1;return e.includes(".")&&!e.startsWith(".")&&!e.endsWith(".")}var kc='Invalid domain pattern. Must be a valid domain (e.g., "example.com"), a wildcard (e.g., "*.example.com"), or a bracketed IPv6 literal (e.g., "[::1]", "[2001:db8::1]:443"). Overly broad patterns like "*.com" or "*" are not allowed for security reasons.',Ga=ye().refine(_c,{message:kc});function Lh(e){let t=e.indexOf(":");return!(t!==-1&&e.indexOf(":",t+1)!==-1)||e.startsWith("[")}var hC=ye().refine((e)=>Lh(e)&&_c(Wi(e).hostPattern),{message:kc+' An optional ":port" suffix (1-65535) restricts the entry to that port.'}),gC=ye().refine((e)=>{if(!Lh(e))return!1;let{hostPattern:t}=Wi(e);return t==="*"||_c(t)},{message:kc+' In deniedDomains a bare "*" (deny-all) is also accepted, and an optional ":port" suffix (1-65535) restricts the entry to that port.'}),ds=ye().min(1,"Path cannot be empty"),Nh=ye().min(1,"Path cannot be empty").refine((e)=>pC(e),{message:"Binary path must be absolute"}),mC=ht({socketPath:ye().min(1).describe("Unix socket path to the MITM proxy"),domains:Qe(Ga).min(1).describe('Domains to route through the MITM proxy (e.g., ["api.example.com", "*.internal.org"])')}),yC=ht({http:ye().url().optional().describe("Upstream proxy URL for plain HTTP traffic"),https:ye().url().optional().describe("Upstream proxy URL for HTTPS/CONNECT traffic (falls back to http if unset)"),noProxy:ye().optional().describe("Comma-separated NO_PROXY list (hostname suffixes and CIDR ranges). Matching destinations connect directly instead of via the parent proxy.")}),Oh=ai(["deny","mask"]),qa=ye().regex(/^[A-Za-z_][A-Za-z0-9_]*$/,"Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores"),Uh=ye().superRefine((e,t)=>{try{let{groupCount:n}=kl(e);if(n<1)t.addIssue({code:P.custom,message:"extract must contain at least one capturing group \u2014 group 1 is "+'the credential value to mask (e.g. "token:\\s*(\\S+)").'})}catch(n){t.addIssue({code:P.custom,message:n instanceof Error?n.message:"Credential extract pattern is invalid"})}}),vC=ht({path:ds.describe("Path to a credential file or directory. Supports the same path forms as filesystem.denyRead (absolute paths and ~ expansion)."),mode:Oh.describe("Access mode for this path"),extract:Uh.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the file is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:ai(["warn","deny","error"]).optional().describe("What to do when extract matches nothing (or, with decode, no "+'candidate verifies): "warn" (default \u2014 stderr warning, file left '+'readable), "deny" (degrade to mode "deny" \u2014 file unreadable), or '+'"error" (throw at wrap time). Only meaningful with mode "mask" and extract or decode set.'),decode:ai(["jwt"]).optional().describe('Optional encoded-credential format. "jwt": decodes recognized JWTs so masking can target fields inside them (see maskClaims). Candidates are located with a built-in JWT regex (or the explicit extract pattern, if set) and verified to actually be JWTs before masking. Without maskClaims, the whole decoded value is treated as the credential and replaced with a structurally valid fake JWT, so client-side token parsing keeps working. If no candidate verifies, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskClaims:Qe(ye().min(1)).optional().describe('Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches in any verified token, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),maskDuplicates:Zt().optional().describe("If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the "+"corresponding sentinel \u2014 for a secret repeated where the regex "+`does not reach (e.g. in a comment). Matches raw substrings: short or common credential values may corrupt unrelated content, so this is intended for long, high-entropy secrets. With decode, only values that passed verification are scanned; duplicates reuse the verified value's fake without re-verification. Defaults to false. Only meaningful with mode "mask" and extract or decode set; accepted but ignored otherwise.`),injectHosts:Qe(Ga).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".')}),xC=ht({name:qa.describe("Environment variable name"),mode:Oh.describe("Access mode for this environment variable"),extract:Uh.optional().describe('Optional regex for structured masking. Applied globally; capture group 1 of each match is masked, the rest of the value is preserved. If the pattern matches nothing, behaviour is governed by onExtractNoMatch (default "warn"). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),onExtractNoMatch:ai(["warn","deny","error"]).optional().describe('What to do when extract matches nothing: "warn" (default \u2014 stderr '+'warning, variable passes through unmasked), "deny" (variable unset inside the sandbox), or "error" (throw at wrap time). Only meaningful with mode "mask" and extract set.'),decode:ai(["jwt"]).optional().describe(`Optional encoded-credential format. "jwt": the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".`),maskClaims:Qe(ye().min(1)).optional().describe('Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel; all other claims are preserved so claim-reading clients keep working. Requires decode. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHosts:Qe(Ga).optional().describe("Optional narrowing of where the proxy substitutes this credential. "+"If unset, defaults to network.allowedDomains \u2014 the credential is "+'injected at every reachable host. Only meaningful when mode is "mask"; accepted but ignored for "deny".'),injectHeaders:Qe(ye().regex(/^[a-z0-9-]{1,64}$/)).min(1).optional().describe('Optional narrowing of where in a request the proxy substitutes this credential: only in these headers (lower-case names), never in other headers or the body. If unset, every header and the body. Only meaningful when mode is "mask".')}),SC=ht({accessKeyIdVar:qa.describe("Name of the masked env var holding the AWS access key id."),secretAccessKeyVar:qa.describe("Name of the masked env var holding the AWS secret access key."),sessionTokenVar:qa.optional().describe("Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.")}).strict(),Ac=ai(["deny","passthrough"]),bC=ht({streaming:Ac.optional().describe('Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. Default "deny".'),presigned:Ac.optional().describe('Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. Default "deny".'),sigv4a:Ac.optional().describe('Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. Default "deny".')}).strict(),Vh=ht({files:Qe(vC).optional().describe("Credential files or directories to protect"),envVars:Qe(xC).optional().describe("Environment variables to protect"),allowPlaintextInject:Zt().optional().describe("Allow sentinel\u2192real substitution on the plain-HTTP proxy path. "+"Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures."),awsPairs:Qe(SC).optional().describe("Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked."),sigv4:bC.optional().describe('Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: "deny" (default) or "passthrough".')}).strict(),Dh=/^[A-Za-z_][A-Za-z0-9_]{0,127}$/,CC=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/,EC=ht({url:ye().url().refine((e)=>new URL(e).protocol==="https:",{message:"brokerForward.url must be https"}),tokenEnvVar:ye().regex(Dh),rules:Qe(ht({envVar:ye().regex(Dh),hosts:Qe(ye().regex(CC)).min(1).max(16)}).strict()).min(1).max(32)}).strict(),Fh=ht({allowedDomains:Qe(hC).describe('List of allowed domains (e.g., ["github.com", "*.npmjs.org", "api.example.com:443"]). An optional ":port" suffix restricts the entry to that destination port.'),deniedDomains:Qe(gC).describe('List of denied domains. Unlike allowedDomains, a bare "*" is accepted here (deny-all). An optional ":port" suffix (e.g., "*:22") restricts the entry to that destination port.'),deniedDomainReasons:Ph(ye(),ye().min(1)).optional().describe('Optional model-facing reason keyed by the exact deniedDomains entry it explains (e.g., {"github.com:22": "SSH pushes to GitHub are blocked; use an https remote"}). Reported in the <sandbox_violations> line when that entry denies a connection; entries without one use a generic reason. Keys are matched by exact entry string, so a key with no matching deniedDomains entry never fires.'),strictAllowlist:Zt().optional().describe("If true, hosts not in allowedDomains are denied without consulting the ask callback. Set this when allowedDomains is policy enforcement, not a prompt-suppression hint."),allowUnixSockets:Qe(ye()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),allowAllUnixSockets:Zt().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),allowLocalBinding:Zt().optional().describe("Whether to allow binding to local ports (default: false)"),allowMachLookup:Qe(ye().refine((e)=>!(e.endsWith("*")?e.slice(0,-1):e).includes("*"),{message:'Wildcards are only allowed as a single trailing "*" (e.g., "com.example.*" or "*" for all services).'})).optional().describe('macOS only: Additional XPC/Mach service names to allow looking up. Supports trailing-wildcard prefix matching (e.g., "2BUA8C4S2C.com.1password.*"). Needed for tools like 1Password CLI, Playwright, or the iOS Simulator that communicate via XPC.'),httpProxyPort:Rr().int().min(1).max(65535).optional().describe("Port of an external HTTP proxy to use instead of starting a local one. When provided, the library will skip starting its own HTTP proxy and use this port. The external proxy must handle domain filtering."),socksProxyPort:Rr().int().min(1).max(65535).optional().describe("Port of an external SOCKS proxy to use instead of starting a local one. When provided, the library will skip starting its own SOCKS proxy and use this port. The external proxy must handle domain filtering."),mitmProxy:mC.optional().describe("Optional MITM proxy configuration. Routes matching domains through an upstream proxy via Unix socket while SRT still handles allow/deny filtering."),filterRequest:cC((e)=>typeof e==="function",{message:"filterRequest must be a function"}).optional().describe("Per-request filter callback. Receives the parsed HTTP request (web-standard Request) and returns {action, reason?}. Denied requests get a 403 with the reason. If the callback throws, the request is denied. Applies to plain HTTP through the proxy and, when tlsTerminate is configured, to terminated HTTPS. SRT does not provide a policy language; library consumers own matching."),tlsTerminate:ht({caCertPath:ye().min(1).optional().describe("Path to a PEM-encoded CA certificate. The sandboxed child is configured to trust this CA, and the TLS-terminating proxy uses it to sign per-host certificates. If omitted, on Windows SRT generates-if-absent a persistent CA under %ProgramData%\\sandbox-runtime\\ca\\ and trusts it in the sandbox user's Root store; on other platforms SRT generates an ephemeral CA into a temp directory for the lifetime of the session."),caKeyPath:ye().min(1).optional().describe("Path to the PEM-encoded private key for caCertPath."),excludeDomains:Qe(Ga).optional().describe("Domain patterns (same syntax as allowedDomains) whose HTTPS connections are NOT terminated. Matching CONNECTs are opaque byte tunnels: still subject to the allow/deny domain lists, but the sandboxed client completes its own TLS handshake with the upstream, so filterRequest and credential injection do not apply to their HTTPS traffic (plain-HTTP requests to the same hosts keep the normal request pipeline). Use for hosts the proxy must not re-originate: mTLS upstreams (only the client holds the client certificate) and clients that pin the upstream certificate and would reject the MITM CA. Hosts still need to be reachable via allowedDomains; this list only changes how they are tunnelled."),extraCaCertPaths:Qe(ye().min(1)).optional().describe("Paths to PEM CA certificate files appended to the trust bundle the sandboxed child is pointed at, after the MITM CA and the host's regular roots. Use for site-local roots (e.g. an internal mTLS CA) presented by excluded/passthrough hosts, so the child can verify them itself. Only the CERTIFICATE blocks of each file are copied; files that are missing, unreadable, or contain no PEM CERTIFICATE block are skipped (with a debug log), so paths that exist on only some hosts are safe to list.")}).refine((e)=>!e.caCertPath===!e.caKeyPath,{message:"caCertPath and caKeyPath must be provided together"}).optional().describe("[EXPERIMENTAL] Enable in-process TLS termination so HTTPS request/response bodies are visible to SRT. Provide a CA cert+key, or omit both to have SRT generate an ephemeral one."),parentProxy:yC.optional().describe("Upstream HTTP proxy for outbound connections. When set, SRT's proxy tunnels non-mitmProxy traffic through this parent instead of connecting directly. Falls back to HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars if unset."),brokerForward:EC.optional().describe("Credential placeholders a remote broker swaps (see broker-forward.ts).")}),Mh=ht({disabled:Zt().optional().describe("Disable all filesystem policy enforcement. When true, no read or write rules are emitted: denyRead/allowRead/allowWrite/denyWrite are ignored, and the built-in mandatory write protections (.git/hooks, .git/config, shell rc files, .mcp.json, .vscode/.idea, .claude/commands, .claude/agents) are NOT applied. Use only when the sandboxed process is trusted with full host filesystem access. Network and credential-env restrictions still apply. On Linux, /dev is still replaced by the bwrap minimal devtmpfs."),denyRead:Qe(ds).describe("Paths denied for reading"),allowRead:Qe(ds).optional().describe("Paths to re-allow reading within denied regions (takes precedence over denyRead). Use with denyRead to deny a broad region then allow back specific subdirectories."),allowWrite:Qe(ds).describe("Paths allowed for writing"),denyWrite:Qe(ds).describe("Paths denied for writing (takes precedence over allowWrite)"),allowGitConfig:Zt().optional().describe("Allow writes to .git/config files (default: false). Enables git remote URL updates while keeping .git/hooks protected.")}),Wh=Ph(ye(),Qe(ye())).describe('Map of command patterns to filesystem paths to ignore violations for. Use "*" to match all commands'),$h=ht({command:ye().describe("The ripgrep command to execute"),args:Qe(ye()).optional().describe("Additional arguments to pass before ripgrep args"),argv0:ye().optional().describe("Override argv[0] when spawning (for multicall binaries that dispatch on argv[0])")}),Hh=ht({safeDirectories:Qe(ye()).default([]).describe("Directories git should treat as safe (`safe.directory`) even though they're owned by a different user inside the sandbox. Use for the repo top-level when launching from a subdirectory. Does NOT grant write.")}),Kh=ht({path:ye().min(1).describe("Path to the srt-win binary. Pass the exported VENDORED_SRT_WIN_EXE constant to use the packaged vendor/srt-win/<arch>/srt-win.exe (see its WARNING: in a dev checkout that file may sit inside your sandbox write grant). The binary is spawned with the `--srt-win` argv[1] sentinel so a multicall dispatcher can route to srt-win's CLI.")}),qh=ht({sandboxUser:ye().min(1).max(20,"Windows local usernames are limited to 20 characters").optional().describe("Name for the dedicated sandbox user account that `srt-win install` creates and the sandboxed child runs as. Default: `srt-sandbox`. Install refuses if an account by this name already exists and srt-win did not create it (it will not rotate the password of an account it does not own). Must match what `srt-win install --sandbox-user` was run with."),sublayerGuid:ye().uuid().optional().describe("WFP sublayer GUID under which the filters were installed. Omit to use the srt-win compile-time default. Set this when filters were installed by enterprise tooling under a custom sublayer."),wfpSublayerGuid:ye().uuid().optional().describe("Deprecated alias for sublayerGuid."),proxyPortRange:uC([Rr().int().min(1),Rr().int().max(65535)]).refine(([e,t])=>e<=t&&t-e<=64,{message:"low must be \u2264 high and range width \u2264 64"}).optional().describe("Inclusive [low, high] port range the JS mux proxy listeners bind inside. MUST match the range passed to `srt-win install "+"--proxy-port-range` (default 60080\u201360089) \u2014 the WFP loopback "+"permit only covers ports in that range."),srtWin:Kh.optional().describe("How to locate/invoke the srt-win helper binary. `srtWin.path` is "+"required to use the Windows sandbox \u2014 your own (multicall) binary, "+"or the exported VENDORED_SRT_WIN_EXE constant for the packaged exe.")}),wC=ht({applyPath:ye().optional().describe("Path to the apply-seccomp binary"),argv0:ye().optional().describe("Invoke apply-seccomp as a multicall binary that dispatches on the ARGV0 environment variable. When set, applyPath is used verbatim (no existence check) and the invocation inside bwrap is prefixed with ARGV0=<this value>. The caller is responsible for ensuring applyPath resolves inside the bwrap namespace and that the target binary implements the apply-seccomp interface when ARGV0 matches.")}),TC=ht({network:Fh.describe("Network restrictions configuration"),filesystem:Mh.describe("Filesystem restrictions configuration"),credentials:Vh.optional().describe("Credential handling configuration. Only the explicitly declared files and environment variables are restricted."),ignoreViolations:Wh.optional().describe("Optional configuration for ignoring specific violations"),enableWeakerNestedSandbox:Zt().optional().describe("Enable weaker nested sandbox mode (for Docker environments)"),runAsUid:Rr().int().nonnegative().optional().describe("ARA: uid to drop the sandboxed command to (bwrap --uid)"),runAsGid:Rr().int().nonnegative().optional().describe("ARA: gid to drop the sandboxed command to (bwrap --gid)"),runAsHostUid:Rr().int().positive().optional().describe("ARA: real host uid used to launch the sandboxed bwrap child"),runAsHostGid:Rr().int().positive().optional().describe("ARA: real host gid used to launch the sandboxed bwrap child"),runAsHostHome:ye().min(1).optional().describe("ARA: HOME set inside a real-host-uid sandbox child"),runAsHostUser:ye().min(1).optional().describe("ARA: USER and LOGNAME set inside a real-host-uid sandbox child"),enableWeakerNetworkIsolation:Zt().optional().describe("Enable weaker network isolation to allow access to com.apple.trustd.agent (macOS only). This is needed for Go programs (gh, gcloud, terraform, kubectl, etc.) to verify TLS certificates when using httpProxyPort with a MITM proxy and custom CA. Enabling this opens a potential data exfiltration vector through the trustd service. Only enable if you need Go TLS verification."),allowAppleEvents:Zt().optional().describe("Allow sending Apple Events and Launch Services open requests from the sandbox (macOS only). Needed for open, osascript, and anything that opens URLs or scripts other apps via AppleScript. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt (launched apps are not subject to the sandbox filesystem or network restrictions), and can script running apps subject to TCC automation consent. Default: false."),ripgrep:$h.optional().describe('Custom ripgrep configuration (default: { command: "rg" })'),mandatoryDenySearchDepth:Rr().int().min(1).max(10).optional().describe("Maximum directory depth to search for dangerous files on Linux (default: 3). Higher values provide more protection but slower performance."),allowPty:Zt().optional().describe("Allow pseudo-terminal (pty) operations (macOS only)"),seccomp:wC.optional().describe("Custom seccomp binary paths (Linux only)."),bwrapPath:Nh.optional().describe('Linux only: absolute path to the bwrap (bubblewrap) binary. When set, this path is used directly instead of resolving "bwrap" via PATH.'),socatPath:Nh.optional().describe('Linux only: absolute path to the socat binary. When set, this path is used directly instead of resolving "socat" via PATH.'),windows:qh.optional().describe("Windows-specific settings (WFP sublayer, proxy port range)."),git:Hh.optional().describe("Git configuration to inject via GIT_CONFIG_* env vars (cross-platform). `safeDirectories` marks paths as `safe.directory` without adding them to `filesystem.allowWrite`.")}).superRefine((e,t)=>{let n=e.credentials;if(!n)return;let r=e.network.allowedDomains.map($i),i=(l,c)=>{for(let[u,d]of l.entries())if(!Pa(d,r))t.addIssue({code:P.custom,path:[...c,u],message:`injectHosts entry "${d}" is not reachable via `+`network.allowedDomains \u2014 add "${d}" (or a covering wildcard) to allowedDomains, or remove it from injectHosts.`})},s=!1,a=(l,c)=>{if(l.injectHosts)i(l.injectHosts,[...c,"injectHosts"]);if(l.mode!=="mask")return;s=!0;let u=e.network.tlsTerminate?.excludeDomains;if(u?.length){if(l.injectHosts){for(let[d,f]of l.injectHosts.entries())if(Pa(f,u))t.addIssue({code:P.custom,path:[...c,"injectHosts",d],message:`injectHosts entry "${f}" is entirely covered by network.tlsTerminate.excludeDomains. Credential injection only runs on TLS-terminated connections, so this host would receive the placeholder instead of the credential. Remove it from one of the two lists.`})}else if(r.length>0&&r.every((d)=>Pa(d,u)))t.addIssue({code:P.custom,path:c,message:"This masked credential has no injectHosts, so it defaults "+"to network.allowedDomains \u2014 but "+"network.tlsTerminate.excludeDomains covers every allowed domain, so it could never be injected anywhere. Credential injection only runs on TLS-terminated connections."})}if(l.injectHosts!==void 0&&l.injectHosts.length===0)t.addIssue({code:P.custom,path:c,message:"injectHosts is explicitly empty \u2014 the credential would be "+"masked but never injected. Omit injectHosts to default to network.allowedDomains, or list the intended hosts."})};for(let[l,c]of(n.envVars??[]).entries()){if(a(c,["credentials","envVars",l]),c.maskClaims!==void 0&&c.decode===void 0)t.addIssue({code:P.custom,path:["credentials","envVars",l,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the whole value.'});if(c.maskClaims!==void 0&&c.maskClaims.length===0)t.addIssue({code:P.custom,path:["credentials","envVars",l,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."})}for(let[l,c]of(n.files??[]).entries()){if(a(c,["credentials","files",l]),c.maskClaims!==void 0&&c.decode===void 0)t.addIssue({code:P.custom,path:["credentials","files",l,"maskClaims"],message:"maskClaims requires decode \u2014 it names claims inside the "+'decoded payload. Set decode (e.g. "jwt"), or remove maskClaims to mask the extracted value whole.'});if(c.maskClaims!==void 0&&c.maskClaims.length===0)t.addIssue({code:P.custom,path:["credentials","files",l,"maskClaims"],message:"maskClaims is explicitly empty \u2014 no claim would ever be "+"masked. Omit maskClaims to mask the whole token, or list the claims to protect."});if(c.mode==="mask"&&c.path.endsWith("/"))t.addIssue({code:P.custom,path:["credentials","files",l,"path"],message:`Credential mode "mask" applies to a single file, not a directory. Use mode "deny" for "${c.path}", or point at the credential file inside it.`})}let o=new Set;for(let[l,c]of(n.awsPairs??[]).entries()){let u=[["accessKeyIdVar",c.accessKeyIdVar],["secretAccessKeyVar",c.secretAccessKeyVar]];if(c.sessionTokenVar!==void 0)u.push(["sessionTokenVar",c.sessionTokenVar]);for(let[d,f]of u){let y=["credentials","awsPairs",l,d];if(o.has(f)){t.addIssue({code:P.custom,path:y,message:`"${f}" appears in more than one awsPairs slot (within `+"or across pairs) \u2014 each variable can fill exactly one slot."});continue}o.add(f);let p=(n.envVars??[]).find((v)=>v.name===f);if(p===void 0||p.mode!=="mask")t.addIssue({code:P.custom,path:y,message:`"${f}" does not reference a credentials.envVars entry `+'with mode "mask" \u2014 an AWS pair links already-masked '+"variables; add the entry (masking is the opt-in for SigV4 re-signing)."});else if(p.extract!==void 0||p.decode!==void 0)t.addIssue({code:P.custom,path:y,message:`"${f}" uses extract/decode, but an AWS pair member must be masked whole-value: the SigV4 trigger is an exact match of the fake access key id, and the signer needs the entire real value.`})}}if(s&&e.network.tlsTerminate===void 0&&!n.allowPlaintextInject)t.addIssue({code:P.custom,path:["credentials"],message:"Credential masking requires network.tlsTerminate so substitution runs only over a verified TLS connection. Enable tlsTerminate, or set credentials.allowPlaintextInject to opt out (not recommended)."})});export{Vh as CredentialsConfigSchema,Ta as DEFAULT_WINDOWS_PROXY_PORT_RANGE,Mh as FilesystemConfigSchema,Hh as GitConfigSchema,Wh as IgnoreViolationsConfigSchema,Fh as NetworkConfigSchema,$h as RipgrepConfigSchema,Vp as SRT_WIN_DISPATCH_ARG1,Vb as SandboxManager,TC as SandboxRuntimeConfigSchema,Ea as SandboxViolationStore,Kh as SrtWinConfigSchema,MS as VENDORED_SRT_WIN_EXE,qh as WindowsConfigSchema,xe as WindowsSandboxError,di as buildGitConfigEnv,Wn as certThumbprint,uc as checkWindowsDependenciesAsync,$p as checkWindowsSandboxStatus,Hp as checkWindowsSandboxStatusAsync,ac as ensurePersistentWindowsCa,Ia as expandWindowsFsPaths,Zs as generateCa,bn as getDefaultWritePaths,WS as getSrtWinPath,sc as getWindowsSandboxCaCert,ic as getWindowsSandboxUserStatus,Mi as getWindowsSandboxUserStatusAsync,Kp as getWindowsWfpStatus,qp as getWindowsWfpStatusAsync,za as getWslVersion,cc as grantWindowsAcl,HS as installWindowsSandbox,KS as installWindowsSandboxAsync,ui as isUncPath,Aa as parseWindowsBinShell,GS as parseWindowsSandboxError,Bt as resolveSrtWin,Ra as restoreWindowsAcl,Ba as revokeWindowsAcl,lc as stampWindowsAcl,qS as uninstallWindowsSandbox,Ii as validateCaPair,nc as verifyWindowsWfpEgress,Zl as windowsInstallInstructions,zp as windowsStateDir,$S as windowsTrustCa,Gp as windowsTrustCaAsync};