@redaktyn/cli 1.6.1 → 1.6.2

package/redaktyn-shared.cjs

@@ -1,15 +1,17 @@
-"use strict";var Ms=Object.create;var mt=Object.defineProperty;var Cs=Object.getOwnPropertyDescriptor;var Os=Object.getOwnPropertyNames;var Ds=Object.getPrototypeOf,Ps=Object.prototype.hasOwnProperty;var Us=(e,t)=>{for(var n in t)mt(e,n,{get:t[n],enumerable:!0})},br=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Os(t))!Ps.call(e,o)&&o!==n&&mt(e,o,{get:()=>t[o],enumerable:!(r=Cs(t,o))||r.enumerable});return e};var Ls=(e,t,n)=>(n=e!=null?Ms(Ds(e)):{},br(t||!e||!e.__esModule?mt(n,"default",{value:e,enumerable:!0}):n,e)),Bs=e=>br(mt({},"__esModule",{value:!0}),e);var dl={};Us(dl,{AIToolCategory:()=>rn,AI_REGISTRY:()=>yt,ANNUAL_MONTHS_FREE:()=>Ys,ASSIGNED_SECRET_SLUG:()=>Sc,AlertChannel:()=>kr,AlertTrigger:()=>Ar,CATEGORISED_SLUGS:()=>Vc,COVERAGE_SLUGS:()=>bs,CUSTOM_PASSPHRASE_MIN_LENGTH:()=>vt,CUSTOM_PASSPHRASE_WARNING:()=>Ga,DETECTION_CATEGORIES:()=>pr,DETECTION_FAMILY_BLURBS:()=>Lc,DETECTION_FAMILY_NAMES:()=>As,DETECTION_PROOF_NAMES:()=>Bc,DETECTION_UNIVERSAL_IGNORES:()=>Nc,DIGEST_VERSION_HMAC_V1:()=>Ia,EDITOR_DEVICE_EMAIL:()=>_s,EDITOR_EMAIL_PREFIX:()=>sl,EMAIL_MAX:()=>Ru,ENTERPRISE_FEATURES:()=>ln,EventAction:()=>Er,EventType:()=>Ir,FOUNDING_PERCENT_OFF:()=>Rr,FOUNDING_TEAMS:()=>Ks,FREE_FEATURES:()=>an,FREE_SEATS:()=>$e,GENERATED_PASSPHRASE_BITS_APPROX:()=>Yo,GENERATED_PASSPHRASE_ENTROPY_BITS:()=>ja,GENERATED_PASSPHRASE_REQUIRED_MESSAGE:()=>oo,INVISIBLE_CHARS_CLASS:()=>Xr,ISSUE_LABEL:()=>Jc,KDF_ITERATIONS:()=>Qe,KDF_VERSION_V2:()=>Ra,KeyShareUnavailableError:()=>$t,LEGACY_PRO_BANDS:()=>Vs,LIST_HOLD_MS:()=>au,MATRIX_TIERS:()=>ea,MAX_ACTIVITY_SESSIONS_PER_BATCH:()=>yu,MAX_SCAN_WINDOWS:()=>en,MAX_TOTAL_SCAN_CHARS:()=>ft,MIN_SECRET_LENGTH:()=>Aa,NAME_MAX:()=>vu,NORMALIZATION_VERSION_V1:()=>Sa,NORMALIZATION_VERSION_V2:()=>va,OFFICIAL_OPRF_PINS:()=>Qn,OFFICIAL_SERVER_HOSTS:()=>Wo,OPRF_ELEMENT_BYTES:()=>ze,OPRF_OUTPUT_BYTES:()=>qi,OPRF_PROOF_BYTES:()=>qt,ORG_KEY_LOCK_SCHEME:()=>lc,OprfProofError:()=>Z,OrgPlan:()=>wr,PASSPHRASE_CREDENTIAL_NAME:()=>Rt,PASSPHRASE_CREDENTIAL_URL:()=>In,PASSPHRASE_VERIFY_LABEL:()=>Qr,PASTE_CEILING_ALARM_CHARS:()=>ms,PASTE_CEILING_WARN_CHARS:()=>hs,PLAN_DESCRIPTORS:()=>na,PLAN_FEATURE_MATRIX:()=>ta,PLAN_FEATURE_TIERS:()=>Qs,PLAN_LIMITS:()=>vr,PLAN_PRICING:()=>qs,PLATFORM_SURFACES:()=>Js,PRIVACY_EMAIL:()=>sa,PROJECT_KDF_LABEL:()=>Jr,PRO_BANDS:()=>X,PRO_ENTRY_BAND:()=>ne,PRO_FEATURES:()=>cn,PRO_TOP_BAND:()=>zs,ROSTER_FILE_MAX_BYTES:()=>Tu,ROSTER_MAX_ROWS:()=>Su,ROSTER_TEMPLATE_CSV:()=>Wc,ROTATION_GUIDE_SLUGS:()=>Pc,ROTATION_LINK_HOSTS:()=>Dc,RiskLevel:()=>on,SAFE_BLOCK_EVENT_FIELDS:()=>Ns,SALES_EMAIL:()=>ra,SCAN_PREFILTER_LABEL:()=>os,SCAN_PREFILTER_PATTERN:()=>is,SCAN_PREFILTER_SPACE:()=>ir,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE:()=>ps,SECRET_PROVIDER_NAMES:()=>pt,SECRET_PROVIDER_SLUGS:()=>gs,SECURITY_EMAIL:()=>oa,SERVER_EMAIL_RE:()=>vs,SecretKeyNeededError:()=>lt,TRIAL_DAYS:()=>Zs,TRUST_POINTS:()=>cc,UNRECOGNISED_PROVIDER_SLUG:()=>Oe,UserRole:()=>xr,VSCODE_AWAY_AFTER_MS:()=>cl,VSCODE_PLACES:()=>Ts,VSCODE_PLACE_LABELS:()=>nl,annualBilledNote:()=>Tr,appendPasskeyEnvelope:()=>ui,behaviorExplanation:()=>Gs,canonicalSecretPlaintextForHmac:()=>At,categoryOfSlug:()=>Hc,checkOprfAnswer:()=>er,checkRosterFile:()=>Qc,checkShareAnswer:()=>tr,clientBehindProxies:()=>sc,computePassphraseVerifyHmac:()=>xn,createLockedOrgKey:()=>hc,createShareHandler:()=>ac,customPolicyDomains:()=>Kc,decodeScanPrefilter:()=>cr,deriveBehaviorRisk:()=>Hs,deriveHmacKeyFromPassphrase:()=>Oa,deriveProjectKey:()=>Pa,deriveScanPrefilterSeed:()=>ls,encodeScanPrefilter:()=>fs,eventFor:()=>ll,extractAddedLinesFromUnifiedDiff:()=>gc,familyDisplayName:()=>Fc,familyOfSlug:()=>Is,findBand:()=>js,findPasskeyEnvelope:()=>pi,foldUuidHexCase:()=>et,foundingMonthlyUsd:()=>Ws,generateHmacKey:()=>La,generateLockSecretKey:()=>dc,generateOrgKey:()=>es,generateOrgPassphrase:()=>Za,generatePrfSalt:()=>ii,getInjectionHostnames:()=>Cr,getLimitsForPlan:()=>Fs,getPrfSaltBytes:()=>di,guardListShrink:()=>mc,hexToKey:()=>Na,hmacDigestHex:()=>St,inviteLinksCsv:()=>tl,isAIToolDomain:()=>ia,isEditorDevice:()=>ol,isEditorExtensionId:()=>al,isEditorUserAgent:()=>il,isGeneratedPassphraseFormat:()=>Sn,isInjectionScopedHostname:()=>un,isKeyShare:()=>ns,isKnownProviderSlug:()=>vc,isOrgKeyLock:()=>rs,isProtectableSlug:()=>Gc,isStrictScope:()=>zo,isV1PassphraseEnvelope:()=>ao,isV2Envelope:()=>so,isValidOprfSecretKey:()=>Yn,isVscodePlace:()=>rl,joinLockCredential:()=>uc,keyToHex:()=>Ba,lockOrgKey:()=>ts,lockSecretKeyBytes:()=>Xt,matchDomain:()=>Mr,matchPatternsForHostname:()=>da,maxScannablePasteChars:()=>Ac,maxScannablePasteCharsFor:()=>Qt,memoryPinStore:()=>Qi,nameFromEmail:()=>Rs,normalizeAndHmacHex:()=>Ca,normalizeAndHmacHexCollapsed:()=>_a,normalizeAndHmacHexLower:()=>Ma,normalizeDomainInput:()=>fn,normalizeSecretPlaintextCollapsed:()=>tt,normalizeSecretPlaintextForMatch:()=>En,normalizeSecretPlaintextLower:()=>It,oprfBlind:()=>Wt,oprfBlindEvaluate:()=>$i,oprfBlindEvaluateWithProof:()=>Xn,oprfDeriveSecretKey:()=>Yi,oprfFinalize:()=>zt,oprfGenerateSecretKey:()=>Zi,oprfPublicKey:()=>Zn,oprfVerifyEvaluation:()=>ct,parseRoster:()=>Xc,passphraseCsvText:()=>Qa,passphraseSheetText:()=>Xa,perMonthOnAnnual:()=>Xs,policyNamedDomains:()=>Ss,projectedScanCost:()=>dr,providerDisplayName:()=>ur,publicKeyHex:()=>ec,removePasskeyEnvelope:()=>fi,rotationGuideFor:()=>Uc,scanBudgetFor:()=>Ic,scanPrefilterFingerprint:()=>Jt,scanPrefilterForRawSecret:()=>wc,scanPrefilterParams:()=>cs,scanPrefilterRoller:()=>xc,scanPrefilterUnits:()=>ds,scanSweeps:()=>lr,scanWindowLengths:()=>kc,scopeOf:()=>Ji,smallestBandFor:()=>$s,splitLockCredential:()=>or,unlockOrgKey:()=>pc,unwrapHmacKeyWithPrf:()=>li,upgradeEnvelopeToV2:()=>oi,usd:()=>Ae,validateAnchorPassphrase:()=>ri,validateCustomPassphrase:()=>kn,validateGeneratedPassphrase:()=>ni,validateNewPassphrase:()=>nt,validatePassphraseStrength:()=>wn,wrapHmacKeyWithPrf:()=>ci});module.exports=Bs(dl);var rn=(c=>(c.CODE_GEN="CODE_GEN",c.IMAGE_GEN="IMAGE_GEN",c.WRITING="WRITING",c.DATA_ANALYSIS="DATA_ANALYSIS",c.CHATBOT="CHATBOT",c.SEARCH="SEARCH",c.OTHER="OTHER",c))(rn||{}),on=(o=>(o.LOW="LOW",o.MEDIUM="MEDIUM",o.HIGH="HIGH",o.CRITICAL="CRITICAL",o))(on||{}),Er=(n=>(n.BLOCKED="BLOCKED",n.LOGGED="LOGGED",n))(Er||{}),xr=(o=>(o.OWNER="OWNER",o.ADMIN="ADMIN",o.USER="USER",o.VIEWER="VIEWER",o))(xr||{}),wr=(r=>(r.FREE="FREE",r.PRO="PRO",r.ENTERPRISE="ENTERPRISE",r))(wr||{}),kr=(n=>(n.EMAIL="EMAIL",n.WEBHOOK="WEBHOOK",n))(kr||{}),Ar=(r=>(r.CRITICAL_BLOCK="CRITICAL_BLOCK",r.DAILY_SUMMARY="DAILY_SUMMARY",r.WEEKLY_REPORT="WEEKLY_REPORT",r))(Ar||{}),Ir=(s=>(s.PASTE="PASTE",s.FILE_UPLOAD="FILE_UPLOAD",s.SELECTION="SELECTION",s.PASTE_REDACTED="PASTE_REDACTED",s.DETECTED="DETECTED",s))(Ir||{}),Ns=["event","type","secretLabel","secretLabels","attemptCount","risk","toolDomain","sourceUrl","timestamp","eventType","scanMethod","scanMs","hmacBatches","secretIds","matchReason","matchReasonSource","bypassVariant","incidentId","detectedAt","policyAction"];function Hs(e){return e<=1?"low":e===2?"medium":"high"}function Gs(e){return e<=1?"User likely made an accidental paste.":e===2?"User may not be aware this is sensitive.":"Repeated attempts detected \u2014 potential risk."}var De={maxUsers:5,maxInviteCodes:5,alerts:["EMAIL"],customDetection:!1,advancedReports:!1,exportReports:!1,siem:!1,sso:!1,customerKeyShare:!1},sn={maxUsers:200,maxInviteCodes:200,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!1,siem:!1,sso:!1,customerKeyShare:!1},Sr={maxUsers:9999,maxInviteCodes:9999,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!0,siem:!0,sso:!0,customerKeyShare:!0},vr={FREE:De,PRO:sn,ENTERPRISE:Sr};function Fs(e){return vr[e]??De}var $e=De.maxUsers,X=[{id:"team25c",name:"Team",maxUsers:25,monthlyUsd:99,annualUsd:990},{id:"growth50c",name:"Growth",maxUsers:50,monthlyUsd:179,annualUsd:1790},{id:"business100c",name:"Business",maxUsers:100,monthlyUsd:329,annualUsd:3290},{id:"scale200c",name:"Scale",maxUsers:200,monthlyUsd:599,annualUsd:5990}],Vs=[{id:"team25",name:"Team",maxUsers:25,monthlyUsd:49,annualUsd:490},{id:"growth50",name:"Growth",maxUsers:50,monthlyUsd:99,annualUsd:990},{id:"business100",name:"Business",maxUsers:100,monthlyUsd:179,annualUsd:1790},{id:"scale200b",name:"Scale",maxUsers:200,monthlyUsd:329,annualUsd:3290},{id:"team15",name:"Team",maxUsers:15,monthlyUsd:59,annualUsd:590},{id:"growth30",name:"Growth",maxUsers:30,monthlyUsd:119,annualUsd:1190},{id:"business75",name:"Business",maxUsers:75,monthlyUsd:279,annualUsd:2790},{id:"scale200",name:"Scale",maxUsers:200,monthlyUsd:649,annualUsd:6490}],Ks=100,Rr=45;function Ws(e){return Math.round(e.monthlyUsd*(100-Rr))/100}var hl=X[X.length-1].maxUsers,ne=X[0],zs=X[X.length-1],qs={PRO:{monthlyUsd:ne.monthlyUsd,annualUsd:ne.annualUsd}};function js(e){return X.find(t=>t.id===e)}function $s(e){return X.find(t=>t.maxUsers>=e)}var Ys=2,Zs=14;function Ae(e){return`$${Number.isInteger(e)?e.toLocaleString("en-US"):e.toFixed(2)}`}function Xs(e){return Ae(e/12)}function Tr(e,t){return`${Ae(t)} billed yearly \xB7 save ${Ae(e*12-t)}`}var an=["The full detection engine \u2014 paste, send, typed input, drag and file upload","Chrome, Edge and Safari","Bypass detection \u2014 whitespace injection and case folding","Unregistered-secret suggestions \u2014 spots keys nobody registered, admin opt-in, never a block","VS Code extension \u2014 pastes into the terminal and the chat box are checked, and files are flagged on exactly the secret","Claude Code, Codex and Cursor \u2014 each prompt, attached or read file, command and tool call is checked before it is sent","Command line \u2014 redaktyn-scan as a git pre-commit hook, and on any file or folder","Block, or let people paste a redacted copy \u2014 your admin's choice, in the browser and in VS Code alike","Every stop in your Event Log as the secret's label and the place, never the text","Zero-knowledge by construction: only HMAC digests leave the device",`Up to ${$e} people, plus ${$e} editor machines running VS Code or the command line`,`${De.maxInviteCodes} invite codes`,"Email alerts","30-day compliance history","Community support"],cn=[`Pick your team's size \u2014 each covers that many people and the same number of editor machines: ${X.map(e=>`${e.name} ${e.maxUsers} + ${e.maxUsers}, ${Ae(e.monthlyUsd)}/mo`).join("; ")}`,"Everyone inside your size is covered; no per-seat metering or proration between invites","As many unused invite links as your size has seats","Webhook alerts alongside email","Executive PDF report, emailed every Monday and downloadable any time","Domain policies \u2014 add any site, beyond the built-in AI tools, to the places Redaktyn blocks","365-day compliance history","Priority support"],ln=["Custom seat limits, agreed rather than published","Customer-held key share \u2014 a key server you run must also answer before your workspace key opens, so Redaktyn cannot open it alone or test passphrase guesses, whatever passphrase you choose. We never receive your passphrase either way","CSV export of the full event log","SIEM webhook delivery","SSO \u2014 SAML and OIDC","Dedicated support"],Js=[{id:"browser",name:"Browser extension",where:"Chrome, Edge and Safari",points:["Paste, send, typed input, drag and file upload are checked on the AI tools you use, and on any site you add (Pro)","A secret with its spaces changed or its case folded is still caught","Spots up to 50 categories of key nobody registered, and only ever suggests: it never blocks on a guess","Your admin can let people paste a redacted copy instead of being stopped"]},{id:"vscode",name:"VS Code extension",where:"Visual Studio Marketplace",points:["A paste into the terminal, where Claude Code and Codex run, is checked before it goes in","A secret typed or pasted into the VS Code chat box is taken back out before it can be submitted","Files are flagged on exactly the secret when they open and when they are saved","Connects with an invite link from your admin, made the same way as a browser's"]},{id:"agents",name:"Claude Code, Codex and Cursor",where:"Through each tool's own hooks",points:["Each prompt, each file attached or read, each command and tool call is checked before it is sent","Blocked, or the agent is handed a redacted copy and your real file is never changed","One command to install and one to remove, for each tool; your other hooks are left exactly as they were","The details, and what it cannot cover, are on the VS Code extension page"]},{id:"cli",name:"Command line and git",where:"redaktyn-scan",points:["Checks what git is about to commit and refuses the commit if it holds a registered secret","Installs as a pre-commit hook with one command, or scans any file or folder","Machine-readable output, so it can run in CI","Connects with an invite link from your admin, made the same way as the browser's and VS Code's"]},{id:"admin",name:"Dashboard and Event Log",where:"For the people who run it",points:["Every stop reaches your Event Log as the secret's label and the place, never the text, a prompt or a file name","See which developer machines are connected, their versions, and whether their Claude Code, Codex and Cursor hooks are installed","Device approval: a new device waits for an admin before it is connected","Pro adds the Monday executive report, webhook alerts and a year of history"]}],Qs=[{key:"FREE",name:"Free",features:an},{key:"PRO",name:"Pro",features:cn},{key:"ENTERPRISE",name:"Enterprise",features:ln}],ea=[{key:"FREE",name:"Free",price:"$0"},{key:"PRO",name:"Pro",price:`From ${Ae(ne.monthlyUsd)}/mo`},{key:"ENTERPRISE",name:"Enterprise",price:"Contact us"}],ta=[{section:"Limits",rows:[{label:"People covered",note:`Dashboard logins and browsers. Pro is bought in ${X.length} sizes, up to ${X.map(e=>e.maxUsers).join(", ")} people \u2014 the figure here is the largest; a workspace's own limit is the size it bought.`,gate:"maxUsers",values:{FREE:String($e),PRO:"200",ENTERPRISE:"Custom"}},{label:"Editor machines covered",note:"Machines running VS Code, Claude Code, Codex or the command line, counted apart from the people: every size covers as many of them as it does people, so a developer on Chrome and VS Code uses one of each.",gate:"maxUsers",values:{FREE:String($e),PRO:"200",ENTERPRISE:"Custom"}},{label:"Invite codes",note:"Unused links held at once. A link is spent when a browser connects and takes a seat, so on Pro this is the size you bought.",gate:"maxInviteCodes",values:{FREE:String(De.maxInviteCodes),PRO:String(sn.maxInviteCodes),ENTERPRISE:"Unlimited"}},{label:"Compliance history",note:"How far back a compliance report may be run. Event data itself is not deleted on any plan.",gate:"advancedReports",values:{FREE:"30 days",PRO:"365 days",ENTERPRISE:"365 days"}}]},{section:"Detection and blocking",rows:[{label:"Paste, send, typed input, drag and file upload",note:"All six enforcement paths, on every plan. Detection has never been plan-gated and is the last thing that should be.",ungated:"No plan check exists on any enforcement path in the extension.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Chrome, Edge and Safari",ungated:"The extension reports its browser; no route reads a plan before accepting the heartbeat.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Bypass detection \u2014 whitespace injection, case folding",ungated:"Runs inside the same scan as the direct match; there is no flag to turn it off.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Detection engine \u2014 50 categories nobody registered",note:"Credentials, infrastructure files and personal data, each proven by a checksum, a decoded structure or the provider's format. On by default; suggests, never blocks.",ungated:"The org switch is an admin setting with no plan check, and the extension's resolver reads only that switch.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Personal-data detection \u2014 cards, Aadhaar, PAN, SSN, IBAN",note:"Checksum-verified and labelled, offered for removal only. Its own switch, on by default.",ungated:"The personal-data switch is an admin setting with no plan check; the resolver passes it straight to the engine.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Unprotected-secret counts by category",note:"A daily count per category on the dashboard \u2014 never a value, a fingerprint or a name.",ungated:"The coverage route checks the org's reporting switch and the enrolment, never the plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Custom domain policies",note:"Add a site that is not one of the built-in AI tools to the places Redaktyn blocks. Older warn and log policies keep working.",gate:"customDetection",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}}]},{section:"Where it runs",rows:[{label:"VS Code extension",note:"A paste into the terminal and into the chat box is checked; files are flagged on exactly the secret. It connects with an invite link, like the browser.",ungated:"The /api/vscode routes and the secrets list read no plan; a connected machine takes a seat like a browser does.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Claude Code, Codex and Cursor",note:"Each prompt, attached or read file, command and tool call is checked through the tool's own hooks, installed and removed with one command each.",ungated:"The hooks read only the secrets list and the redaction policy, and neither route reads a plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Command line and git pre-commit hook",note:"redaktyn-scan checks what git is about to commit, or any file or folder, and can run in CI.",ungated:"The CLI's routes read no plan; it uses the same secrets list and connects with an invite link like the other surfaces.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Redacted copy instead of a block",note:"One admin switch for the browser and VS Code. Off until the admin turns it on.",ungated:"The overlay-policy route is an admin setting with no plan check.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Device approval",note:"A new device waits for an admin before it is connected.",ungated:"The device-approval routes and service read no plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Who is connected, and what they have protected",note:"The VS Code page lists each developer's extension and VS Code versions, and whether their Claude Code, Codex and Cursor hooks are installed.",ungated:"The VS Code devices route reads no plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}}]},{section:"Alerting and reporting",rows:[{label:"Email alerts",ungated:"EMAIL is in every plan's channel list, so the row is true by construction.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Webhook alerts",gate:"alerts",channel:"WEBHOOK",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"Executive PDF report",note:"Emailed every Monday, and downloadable at any time from Reports.",gate:"advancedReports",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"CSV export of the event log",gate:"exportReports",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"SIEM webhook delivery",gate:"siem",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Customer-held key share",note:"A key server you run must also answer before your workspace key opens, so Redaktyn cannot open it alone or test passphrase guesses, whatever passphrase you choose. Cut it off and nobody, including Redaktyn, can unlock the workspace. If its key is lost, the way back is a reset that registers every secret again.",gate:"customerKeyShare",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}}]},{section:"Access and support",rows:[{label:"SSO \u2014 SAML and OIDC",gate:"sso",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Support",note:"A commitment from people, not a switch in the code \u2014 which is why no flag backs this row.",ungated:"Support tiering is contractual; no route reads a plan to answer a support request.",values:{FREE:"Community",PRO:"Priority",ENTERPRISE:"Dedicated"}}]}],na=[{id:"FREE",name:"Free",tagline:"The whole detection engine, for a team that is still proving it works",priceMonthly:0,priceLabel:"$0",priceNote:"Forever free \xB7 no card",limits:De,features:an,featuresHeading:"What's included",highlighted:!1,cta:"Get started"},{id:"PRO",name:"Pro",tagline:"For a team that has to answer questions about its own exposure",priceMonthly:ne.monthlyUsd,priceLabel:Ae(ne.monthlyUsd),priceNote:`per month \xB7 up to ${ne.maxUsers} people + ${ne.maxUsers} editor machines`,annualNote:Tr(ne.monthlyUsd,ne.annualUsd),limits:sn,features:cn,featuresHeading:"Everything in Free, plus",highlighted:!0,cta:"Start free, then upgrade"},{id:"ENTERPRISE",name:"Enterprise",tagline:"For satisfying somebody else's auditor or IT department",priceMonthly:null,priceLabel:"Custom",priceNote:"Contact sales",limits:Sr,features:ln,featuresHeading:"Everything in Pro, plus",highlighted:!1,cta:"Contact sales"}],_r="ak8340651733@gmail.com",ra=_r,oa=_r,sa="support@redaktyn.com";function l(e,t,n,r="MEDIUM",o={}){return{domain:e,name:t,category:n,riskLevel:r,isEnterprise:o.isEnterprise??!1,...o.personalVersionDomain?{personalVersionDomain:o.personalVersionDomain}:{}}}var yt=[l("chat.openai.com","ChatGPT","CODE_GEN","HIGH"),l("chatgpt.com","ChatGPT","CODE_GEN","HIGH"),l("platform.openai.com","OpenAI Platform","CODE_GEN","HIGH"),l("claude.ai","Claude","CODE_GEN","HIGH"),l("gemini.google.com","Gemini","CODE_GEN","MEDIUM"),l("aistudio.google.com","Google AI Studio","CODE_GEN","MEDIUM"),l("copilot.github.com","GitHub Copilot","CODE_GEN","MEDIUM"),l("github.com/copilot","GitHub Copilot Chat","CODE_GEN","MEDIUM"),l("cursor.sh","Cursor","CODE_GEN","MEDIUM"),l("cursor.com","Cursor","CODE_GEN","MEDIUM"),l("replit.com","Replit","CODE_GEN","HIGH"),l("codeium.com","Codeium","CODE_GEN","MEDIUM"),l("tabnine.com","Tabnine","CODE_GEN","MEDIUM"),l("codewhisperer.aws","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),l("aws.amazon.com/codewhisperer","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),l("phind.com","Phind","CODE_GEN","MEDIUM"),l("continue.dev","Continue","CODE_GEN","MEDIUM"),l("askcodi.com","AskCodi","CODE_GEN","MEDIUM"),l("sourcegraph.com","Sourcegraph Cody","CODE_GEN","MEDIUM"),l("windsurf.ai","Windsurf","CODE_GEN","MEDIUM"),l("v0.dev","Vercel v0","CODE_GEN","MEDIUM"),l("bolt.new","Bolt","CODE_GEN","HIGH"),l("lovable.dev","Lovable","CODE_GEN","HIGH"),l("aider.chat","Aider","CODE_GEN","MEDIUM"),l("cody.dev","Cody","CODE_GEN","MEDIUM"),l("blackbox.ai","Blackbox AI","CODE_GEN","HIGH"),l("deepcode.ai","DeepCode","CODE_GEN","MEDIUM"),l("codiga.io","Codiga","CODE_GEN","MEDIUM"),l("mutable.ai","Mutable AI","CODE_GEN","MEDIUM"),l("pieces.app","Pieces","CODE_GEN","MEDIUM"),l("codium.ai","CodiumAI","CODE_GEN","MEDIUM"),l("coderabbit.ai","CodeRabbit","CODE_GEN","MEDIUM"),l("devin.ai","Devin","CODE_GEN","HIGH"),l("idx.dev","Project IDX","CODE_GEN","MEDIUM"),l("stackblitz.com","StackBlitz","CODE_GEN","MEDIUM"),l("codepen.io","CodePen AI","CODE_GEN","MEDIUM"),l("codesandbox.io","CodeSandbox AI","CODE_GEN","MEDIUM"),l("gitpod.io","Gitpod","CODE_GEN","MEDIUM"),l("poe.com","Poe","CHATBOT","MEDIUM"),l("character.ai","Character.AI","CHATBOT","MEDIUM"),l("beta.character.ai","Character.AI Beta","CHATBOT","MEDIUM"),l("huggingface.co/chat","HuggingChat","CHATBOT","MEDIUM"),l("pi.ai","Pi","CHATBOT","LOW"),l("chat.mistral.ai","Mistral Chat","CHATBOT","MEDIUM"),l("chat.deepseek.com","DeepSeek Chat","CHATBOT","HIGH"),l("deepseek.com","DeepSeek","CHATBOT","HIGH"),l("groq.com","Groq","CHATBOT","MEDIUM"),l("console.groq.com","Groq Console","CHATBOT","MEDIUM"),l("cohere.com","Cohere","CHATBOT","MEDIUM"),l("coral.cohere.com","Cohere Coral","CHATBOT","MEDIUM"),l("inflection.ai","Inflection","CHATBOT","MEDIUM"),l("chat.lmsys.org","LMSYS Chatbot Arena","CHATBOT","HIGH"),l("open-assistant.io","Open Assistant","CHATBOT","MEDIUM"),l("bard.google.com","Google Bard","CHATBOT","MEDIUM"),l("copilot.microsoft.com","Microsoft Copilot","CHATBOT","LOW",{isEnterprise:!0}),l("bing.com/chat","Bing Chat","CHATBOT","MEDIUM"),l("meta.ai","Meta AI","CHATBOT","MEDIUM"),l("labs.perplexity.ai","Perplexity Labs","CHATBOT","MEDIUM"),l("together.ai","Together AI","CHATBOT","MEDIUM"),l("api.together.xyz","Together API","CHATBOT","MEDIUM"),l("fireworks.ai","Fireworks AI","CHATBOT","MEDIUM"),l("anyscale.com","Anyscale","CHATBOT","MEDIUM"),l("replicate.com","Replicate","CHATBOT","MEDIUM"),l("lepton.ai","Lepton AI","CHATBOT","MEDIUM"),l("forefront.ai","Forefront","CHATBOT","MEDIUM"),l("chat.vercel.ai","Vercel AI Chat","CHATBOT","MEDIUM"),l("llama.meta.com","Llama","CHATBOT","MEDIUM"),l("grok.com","Grok","CHATBOT","HIGH"),l("grok.x.ai","Grok","CHATBOT","MEDIUM"),l("x.ai","xAI","CHATBOT","MEDIUM"),l("duckduckgo.com/aichat","DuckDuckGo AI Chat","CHATBOT","LOW"),l("chatglm.cn","ChatGLM","CHATBOT","HIGH"),l("yiyan.baidu.com","Ernie Bot","CHATBOT","HIGH"),l("qianwen.aliyun.com","Qwen","CHATBOT","HIGH"),l("abacus.ai","Abacus AI","CHATBOT","MEDIUM"),l("midjourney.com","Midjourney","IMAGE_GEN","MEDIUM"),l("discord.com/channels/midjourney","Midjourney Discord","IMAGE_GEN","MEDIUM"),l("openai.com/dall-e","DALL-E","IMAGE_GEN","MEDIUM"),l("labs.openai.com","DALL-E Labs","IMAGE_GEN","MEDIUM"),l("stability.ai","Stable Diffusion","IMAGE_GEN","MEDIUM"),l("dreamstudio.ai","DreamStudio","IMAGE_GEN","MEDIUM"),l("leonardo.ai","Leonardo.ai","IMAGE_GEN","MEDIUM"),l("app.leonardo.ai","Leonardo.ai App","IMAGE_GEN","MEDIUM"),l("ideogram.ai","Ideogram","IMAGE_GEN","MEDIUM"),l("firefly.adobe.com","Adobe Firefly","IMAGE_GEN","LOW",{isEnterprise:!0}),l("clipdrop.co","ClipDrop","IMAGE_GEN","MEDIUM"),l("playground.ai","Playground AI","IMAGE_GEN","MEDIUM"),l("nightcafe.studio","NightCafe","IMAGE_GEN","MEDIUM"),l("creator.nightcafe.studio","NightCafe Creator","IMAGE_GEN","MEDIUM"),l("runwayml.com","Runway","IMAGE_GEN","MEDIUM"),l("app.runwayml.com","Runway App","IMAGE_GEN","MEDIUM"),l("canva.com/ai-image-generator","Canva AI","IMAGE_GEN","LOW"),l("imagine.meta.com","Meta Imagine","IMAGE_GEN","MEDIUM"),l("pika.art","Pika","IMAGE_GEN","MEDIUM"),l("kaiber.ai","Kaiber","IMAGE_GEN","MEDIUM"),l("bing.com/images/create","Bing Image Creator","IMAGE_GEN","MEDIUM"),l("designer.microsoft.com","Microsoft Designer","IMAGE_GEN","MEDIUM"),l("craiyon.com","Craiyon","IMAGE_GEN","LOW"),l("starryai.com","StarryAI","IMAGE_GEN","LOW"),l("hotpot.ai","Hotpot AI","IMAGE_GEN","LOW"),l("lexica.art","Lexica","IMAGE_GEN","LOW"),l("jasper.ai","Jasper","WRITING","MEDIUM"),l("app.jasper.ai","Jasper App","WRITING","MEDIUM"),l("copy.ai","Copy.ai","WRITING","MEDIUM"),l("app.copy.ai","Copy.ai App","WRITING","MEDIUM"),l("writesonic.com","Writesonic","WRITING","MEDIUM"),l("app.writesonic.com","Writesonic App","WRITING","MEDIUM"),l("grammarly.com","Grammarly AI","WRITING","MEDIUM"),l("app.grammarly.com","Grammarly App","WRITING","MEDIUM"),l("notion.so","Notion AI","WRITING","MEDIUM"),l("quillbot.com","QuillBot","WRITING","MEDIUM"),l("wordtune.com","Wordtune","WRITING","MEDIUM"),l("rytr.me","Rytr","WRITING","MEDIUM"),l("anyword.com","Anyword","WRITING","MEDIUM"),l("hyperwriteai.com","HyperWrite","WRITING","MEDIUM"),l("writer.com","Writer","WRITING","MEDIUM",{isEnterprise:!0}),l("textcortex.com","TextCortex","WRITING","MEDIUM"),l("app.textcortex.com","TextCortex App","WRITING","MEDIUM"),l("peppertype.ai","Peppertype","WRITING","MEDIUM"),l("simplified.com","Simplified AI","WRITING","MEDIUM"),l("contentbot.ai","ContentBot","WRITING","MEDIUM"),l("ink.co","INK Editor","WRITING","MEDIUM"),l("sudowrite.com","Sudowrite","WRITING","MEDIUM"),l("novelai.net","NovelAI","WRITING","LOW"),l("shortlyai.com","ShortlyAI","WRITING","MEDIUM"),l("lex.page","Lex","WRITING","MEDIUM"),l("julius.ai","Julius","DATA_ANALYSIS","HIGH"),l("hex.tech","Hex","DATA_ANALYSIS","HIGH"),l("app.hex.tech","Hex App","DATA_ANALYSIS","HIGH"),l("obviously.ai","Obviously AI","DATA_ANALYSIS","HIGH"),l("akkio.com","Akkio","DATA_ANALYSIS","HIGH"),l("monkeylearn.com","MonkeyLearn","DATA_ANALYSIS","HIGH"),l("rows.com","Rows","DATA_ANALYSIS","MEDIUM"),l("breadcrumbs.io","Breadcrumbs","DATA_ANALYSIS","MEDIUM"),l("polymer.co","Polymer","DATA_ANALYSIS","HIGH"),l("databricks.com","Databricks AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("datarobot.com","DataRobot","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("h2o.ai","H2O.ai","DATA_ANALYSIS","MEDIUM"),l("rapidminer.com","RapidMiner","DATA_ANALYSIS","MEDIUM"),l("knime.com","KNIME","DATA_ANALYSIS","MEDIUM"),l("alteryx.com","Alteryx","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("tableau.com","Tableau AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("mode.com","Mode Analytics","DATA_ANALYSIS","MEDIUM"),l("deepnote.com","Deepnote","DATA_ANALYSIS","HIGH"),l("observable.com","Observable","DATA_ANALYSIS","MEDIUM"),l("noteable.io","Noteable","DATA_ANALYSIS","HIGH"),l("perplexity.ai","Perplexity Search","SEARCH","MEDIUM"),l("you.com","You.com Search","SEARCH","MEDIUM"),l("andi.ai","Andi","SEARCH","LOW"),l("kagi.com","Kagi","SEARCH","LOW"),l("metaphor.systems","Metaphor","SEARCH","MEDIUM"),l("exa.ai","Exa","SEARCH","MEDIUM"),l("tavily.com","Tavily","SEARCH","MEDIUM"),l("consensus.app","Consensus","SEARCH","LOW"),l("elicit.com","Elicit","SEARCH","MEDIUM"),l("elicit.org","Elicit","SEARCH","MEDIUM"),l("searchgpt.com","SearchGPT","SEARCH","MEDIUM"),l("brave.com/search/ai","Brave AI Search","SEARCH","LOW"),l("neeva.com","Neeva","SEARCH","LOW"),l("socratic.org","Socratic","SEARCH","LOW"),l("devv.ai","Devv AI","SEARCH","MEDIUM"),l("iask.ai","iAsk AI","SEARCH","LOW"),l("chatpdf.com","ChatPDF","SEARCH","MEDIUM"),l("smodin.io","Smodin","WRITING","MEDIUM"),l("ai-writer.com","AI Writer","WRITING","MEDIUM"),l("scalenut.com","Scalenut","WRITING","MEDIUM"),l("closerscopy.com","ClosersCopy","WRITING","MEDIUM"),l("longshot.ai","LongShot AI","WRITING","MEDIUM"),l("fig.io","Fig AI","CODE_GEN","MEDIUM"),l("warp.dev","Warp Terminal AI","CODE_GEN","MEDIUM"),l("raycast.com","Raycast AI","CODE_GEN","MEDIUM"),l("app.codeanywhere.com","Codeanywhere AI","CODE_GEN","MEDIUM"),l("zed.dev","Zed AI","CODE_GEN","MEDIUM"),l("gencraft.com","Gencraft","IMAGE_GEN","LOW"),l("deepai.org","DeepAI","IMAGE_GEN","LOW"),l("artbreeder.com","Artbreeder","IMAGE_GEN","LOW"),l("fotor.com/ai","Fotor AI","IMAGE_GEN","LOW"),l("remove.bg","Remove.bg","IMAGE_GEN","LOW"),l("photoroom.com","PhotoRoom AI","IMAGE_GEN","LOW"),l("app.recraft.ai","Recraft AI","IMAGE_GEN","MEDIUM"),l("pecan.ai","Pecan AI","DATA_ANALYSIS","HIGH"),l("apteo.co","Apteo","DATA_ANALYSIS","HIGH"),l("mindsdb.com","MindsDB","DATA_ANALYSIS","MEDIUM"),l("zapier.com/ai","Zapier AI","OTHER","MEDIUM"),l("make.com","Make (Integromat) AI","OTHER","MEDIUM"),l("otter.ai","Otter.ai","OTHER","HIGH"),l("fireflies.ai","Fireflies.ai","OTHER","HIGH"),l("descript.com","Descript","OTHER","MEDIUM"),l("synthesia.io","Synthesia","OTHER","MEDIUM"),l("elevenlabs.io","ElevenLabs","OTHER","MEDIUM"),l("murf.ai","Murf AI","OTHER","MEDIUM"),l("resemble.ai","Resemble AI","OTHER","MEDIUM"),l("loom.com","Loom AI","OTHER","MEDIUM"),l("beautiful.ai","Beautiful.ai","OTHER","LOW"),l("gamma.app","Gamma","OTHER","MEDIUM"),l("tome.app","Tome","OTHER","MEDIUM"),l("magician.design","Magician","OTHER","MEDIUM"),l("uizard.io","Uizard","OTHER","MEDIUM"),l("huggingface.co/spaces","HuggingFace Spaces","OTHER","MEDIUM"),l("roboflow.com","Roboflow","OTHER","MEDIUM"),l("scale.com","Scale AI","OTHER","MEDIUM"),l("labelbox.com","Labelbox","OTHER","MEDIUM")],bl=new Set(yt.map(e=>e.domain.toLowerCase())),Ye=new Map;for(let e of yt){let t=e.domain.toLowerCase();Ye.has(t)||Ye.set(t,e)}function aa(e){try{return e.includes("://")||(e="https://"+e),new URL(e).hostname.toLowerCase()}catch{return null}}function Mr(e){let t=aa(e);if(!t)return null;let n=Ye.get(t);if(n)return n;try{let o=new URL(e.includes("://")?e:"https://"+e),s=(o.hostname+o.pathname).toLowerCase().replace(/\/+$/,""),a=Ye.get(s);if(a)return a}catch{}let r=t.split(".");for(let o=1;o<r.length-1;o++){let s=r.slice(o).join("."),a=Ye.get(s);if(a)return a}return null}function ia(e){return Mr(e)!==null}var ca=new Set(["replit.com","sourcegraph.com","idx.dev","stackblitz.com","codepen.io","codesandbox.io","gitpod.io","fig.io","warp.dev","raycast.com","app.codeanywhere.com","zed.dev","anyscale.com","grammarly.com","notion.so","hex.tech","app.hex.tech","rows.com","breadcrumbs.io","databricks.com","datarobot.com","h2o.ai","rapidminer.com","knime.com","alteryx.com","tableau.com","mode.com","deepnote.com","observable.com","noteable.io","mindsdb.com","kagi.com","make.com","loom.com","roboflow.com","scale.com","labelbox.com"]),la=["redaktyn.com"];function Cr(){let e=new Set;for(let t of yt){let n=t.domain.toLowerCase();n.includes("/")||ca.has(n)||e.add(n)}for(let t of la)e.add(t.toLowerCase());return Array.from(e).sort()}var dn=null;function un(e){dn||(dn=new Set(Cr()));let t=e.toLowerCase();for(let n of dn)if(t===n||t.endsWith(`.${n}`))return!0;return!1}function da(e){let t=e.toLowerCase();return[`*://${t}/*`,`*://*.${t}/*`]}function fn(e){let t=e.trim().toLowerCase();return!t||(t=t.replace(/^[a-z][a-z0-9+.-]*:\/\//,""),t=t.split(/[/?#]/)[0],t=t.split("@").pop(),t=t.split(":")[0],!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/.test(t))?null:t}var ie=Ls(require("node:crypto"),1),Ie=ie&&typeof ie=="object"&&"webcrypto"in ie?ie.webcrypto:ie&&typeof ie=="object"&&"randomBytes"in ie?ie:void 0;function re(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function j(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function L(e,...t){if(!re(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function Se(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash should be wrapped by utils.createHasher");j(e.outputLen),j(e.blockLen)}function Ue(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function Dr(e,t){L(e);let n=t.outputLen;if(e.length<n)throw new Error("digestInto() expects output buffer of length at least "+n)}function q(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Le(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function J(e,t){return e<<32-t|e>>>t}var Pr=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",ua=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function K(e){if(L(e),Pr)return e.toHex();let t="";for(let n=0;n<e.length;n++)t+=ua[e[n]];return t}var ce={_0:48,_9:57,A:65,F:70,a:97,f:102};function Or(e){if(e>=ce._0&&e<=ce._9)return e-ce._0;if(e>=ce.A&&e<=ce.F)return e-(ce.A-10);if(e>=ce.a&&e<=ce.f)return e-(ce.a-10)}function Q(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(Pr)return Uint8Array.fromHex(e);let t=e.length,n=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let r=new Uint8Array(n);for(let o=0,s=0;o<n;o++,s+=2){let a=Or(e.charCodeAt(s)),c=Or(e.charCodeAt(s+1));if(a===void 0||c===void 0){let i=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+i+'" at index '+s)}r[o]=a*16+c}return r}var fa=async()=>{};async function Ur(e,t,n){let r=Date.now();for(let o=0;o<e;o++){n(o);let s=Date.now()-r;s>=0&&s<t||(await fa(),r+=s)}}function C(e){if(typeof e!="string")throw new Error("string expected");return new Uint8Array(new TextEncoder().encode(e))}function ye(e){return typeof e=="string"&&(e=C(e)),L(e),e}function pn(e){return typeof e=="string"&&(e=C(e)),L(e),e}function B(...e){let t=0;for(let r=0;r<e.length;r++){let o=e[r];L(o),t+=o.length}let n=new Uint8Array(t);for(let r=0,o=0;r<e.length;r++){let s=e[r];n.set(s,o),o+=s.length}return n}function Lr(e,t){if(t!==void 0&&{}.toString.call(t)!=="[object Object]")throw new Error("options should be object or undefined");return Object.assign(e,t)}var Pe=class{};function hn(e){let t=r=>e().update(ye(r)).digest(),n=e();return t.outputLen=n.outputLen,t.blockLen=n.blockLen,t.create=()=>e(),t}function Be(e=32){if(Ie&&typeof Ie.getRandomValues=="function")return Ie.getRandomValues(new Uint8Array(e));if(Ie&&typeof Ie.randomBytes=="function")return Uint8Array.from(Ie.randomBytes(e));throw new Error("crypto.getRandomValues must be defined")}var gt=class extends Pe{constructor(t,n){super(),this.finished=!1,this.destroyed=!1,Se(t);let r=ye(n);if(this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let o=this.blockLen,s=new Uint8Array(o);s.set(r.length>o?t.create().update(r).digest():r);for(let a=0;a<s.length;a++)s[a]^=54;this.iHash.update(s),this.oHash=t.create();for(let a=0;a<s.length;a++)s[a]^=106;this.oHash.update(s),q(s)}update(t){return Ue(this),this.iHash.update(t),this}digestInto(t){Ue(this),L(t,this.outputLen),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:n,iHash:r,finished:o,destroyed:s,blockLen:a,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=a,t.outputLen=c,t.oHash=n._cloneInto(t.oHash),t.iHash=r._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},ee=(e,t,n)=>new gt(e,t).update(n).digest();ee.create=(e,t)=>new gt(e,t);function pa(e,t,n,r){if(typeof e.setBigUint64=="function")return e.setBigUint64(t,n,r);let o=BigInt(32),s=BigInt(4294967295),a=Number(n>>o&s),c=Number(n&s),i=r?4:0,u=r?0:4;e.setUint32(t+i,a,r),e.setUint32(t+u,c,r)}function Br(e,t,n){return e&t^~e&n}function Nr(e,t,n){return e&t^e&n^t&n}var Ze=class extends Pe{constructor(t,n,r,o){super(),this.finished=!1,this.length=0,this.pos=0,this.destroyed=!1,this.blockLen=t,this.outputLen=n,this.padOffset=r,this.isLE=o,this.buffer=new Uint8Array(t),this.view=Le(this.buffer)}update(t){Ue(this),t=ye(t),L(t);let{view:n,buffer:r,blockLen:o}=this,s=t.length;for(let a=0;a<s;){let c=Math.min(o-this.pos,s-a);if(c===o){let i=Le(t);for(;o<=s-a;a+=o)this.process(i,a);continue}r.set(t.subarray(a,a+c),this.pos),this.pos+=c,a+=c,this.pos===o&&(this.process(n,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){Ue(this),Dr(t,this),this.finished=!0;let{buffer:n,view:r,blockLen:o,isLE:s}=this,{pos:a}=this;n[a++]=128,q(this.buffer.subarray(a)),this.padOffset>o-a&&(this.process(r,0),a=0);for(let p=a;p<o;p++)n[p]=0;pa(r,o-8,BigInt(this.length*8),s),this.process(r,0);let c=Le(t),i=this.outputLen;if(i%4)throw new Error("_sha2: outputLen should be aligned to 32bit");let u=i/4,f=this.get();if(u>f.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<u;p++)c.setUint32(4*p,f[p],s)}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let r=t.slice(0,n);return this.destroy(),r}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:n,buffer:r,length:o,finished:s,destroyed:a,pos:c}=this;return t.destroyed=a,t.finished=s,t.length=o,t.pos=c,o%n&&t.buffer.set(r),t}clone(){return this._cloneInto()}},le=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var G=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]);var bt=BigInt(4294967295),Hr=BigInt(32);function ha(e,t=!1){return t?{h:Number(e&bt),l:Number(e>>Hr&bt)}:{h:Number(e>>Hr&bt)|0,l:Number(e&bt)|0}}function Gr(e,t=!1){let n=e.length,r=new Uint32Array(n),o=new Uint32Array(n);for(let s=0;s<n;s++){let{h:a,l:c}=ha(e[s],t);[r[s],o[s]]=[a,c]}return[r,o]}var mn=(e,t,n)=>e>>>n,yn=(e,t,n)=>e<<32-n|t>>>n,ve=(e,t,n)=>e>>>n|t<<32-n,Re=(e,t,n)=>e<<32-n|t>>>n,Xe=(e,t,n)=>e<<64-n|t>>>n-32,Je=(e,t,n)=>e>>>n-32|t<<64-n;function oe(e,t,n,r){let o=(t>>>0)+(r>>>0);return{h:e+n+(o/2**32|0)|0,l:o|0}}var Fr=(e,t,n)=>(e>>>0)+(t>>>0)+(n>>>0),Vr=(e,t,n,r)=>t+n+r+(e/2**32|0)|0,Kr=(e,t,n,r)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0),Wr=(e,t,n,r,o)=>t+n+r+o+(e/2**32|0)|0,zr=(e,t,n,r,o)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0)+(o>>>0),qr=(e,t,n,r,o,s)=>t+n+r+o+s+(e/2**32|0)|0;var ya=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),ge=new Uint32Array(64),Et=class extends Ze{constructor(t=32){super(64,t,8,!1),this.A=le[0]|0,this.B=le[1]|0,this.C=le[2]|0,this.D=le[3]|0,this.E=le[4]|0,this.F=le[5]|0,this.G=le[6]|0,this.H=le[7]|0}get(){let{A:t,B:n,C:r,D:o,E:s,F:a,G:c,H:i}=this;return[t,n,r,o,s,a,c,i]}set(t,n,r,o,s,a,c,i){this.A=t|0,this.B=n|0,this.C=r|0,this.D=o|0,this.E=s|0,this.F=a|0,this.G=c|0,this.H=i|0}process(t,n){for(let p=0;p<16;p++,n+=4)ge[p]=t.getUint32(n,!1);for(let p=16;p<64;p++){let d=ge[p-15],h=ge[p-2],y=J(d,7)^J(d,18)^d>>>3,g=J(h,17)^J(h,19)^h>>>10;ge[p]=g+ge[p-7]+y+ge[p-16]|0}let{A:r,B:o,C:s,D:a,E:c,F:i,G:u,H:f}=this;for(let p=0;p<64;p++){let d=J(c,6)^J(c,11)^J(c,25),h=f+d+Br(c,i,u)+ya[p]+ge[p]|0,g=(J(r,2)^J(r,13)^J(r,22))+Nr(r,o,s)|0;f=u,u=i,i=c,c=a+h|0,a=s,s=o,o=r,r=h+g|0}r=r+this.A|0,o=o+this.B|0,s=s+this.C|0,a=a+this.D|0,c=c+this.E|0,i=i+this.F|0,u=u+this.G|0,f=f+this.H|0,this.set(r,o,s,a,c,i,u,f)}roundClean(){q(ge)}destroy(){this.set(0,0,0,0,0,0,0,0),q(this.buffer)}};var jr=Gr(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(e=>BigInt(e))),ga=jr[0],ba=jr[1],be=new Uint32Array(80),Ee=new Uint32Array(80),xt=class extends Ze{constructor(t=64){super(128,t,16,!1),this.Ah=G[0]|0,this.Al=G[1]|0,this.Bh=G[2]|0,this.Bl=G[3]|0,this.Ch=G[4]|0,this.Cl=G[5]|0,this.Dh=G[6]|0,this.Dl=G[7]|0,this.Eh=G[8]|0,this.El=G[9]|0,this.Fh=G[10]|0,this.Fl=G[11]|0,this.Gh=G[12]|0,this.Gl=G[13]|0,this.Hh=G[14]|0,this.Hl=G[15]|0}get(){let{Ah:t,Al:n,Bh:r,Bl:o,Ch:s,Cl:a,Dh:c,Dl:i,Eh:u,El:f,Fh:p,Fl:d,Gh:h,Gl:y,Hh:g,Hl:E}=this;return[t,n,r,o,s,a,c,i,u,f,p,d,h,y,g,E]}set(t,n,r,o,s,a,c,i,u,f,p,d,h,y,g,E){this.Ah=t|0,this.Al=n|0,this.Bh=r|0,this.Bl=o|0,this.Ch=s|0,this.Cl=a|0,this.Dh=c|0,this.Dl=i|0,this.Eh=u|0,this.El=f|0,this.Fh=p|0,this.Fl=d|0,this.Gh=h|0,this.Gl=y|0,this.Hh=g|0,this.Hl=E|0}process(t,n){for(let b=0;b<16;b++,n+=4)be[b]=t.getUint32(n),Ee[b]=t.getUint32(n+=4);for(let b=16;b<80;b++){let S=be[b-15]|0,R=Ee[b-15]|0,D=ve(S,R,1)^ve(S,R,8)^mn(S,R,7),P=Re(S,R,1)^Re(S,R,8)^yn(S,R,7),v=be[b-2]|0,x=Ee[b-2]|0,k=ve(v,x,19)^Xe(v,x,61)^mn(v,x,6),I=Re(v,x,19)^Je(v,x,61)^yn(v,x,6),T=Kr(P,I,Ee[b-7],Ee[b-16]),M=Wr(T,D,k,be[b-7],be[b-16]);be[b]=M|0,Ee[b]=T|0}let{Ah:r,Al:o,Bh:s,Bl:a,Ch:c,Cl:i,Dh:u,Dl:f,Eh:p,El:d,Fh:h,Fl:y,Gh:g,Gl:E,Hh:m,Hl:w}=this;for(let b=0;b<80;b++){let S=ve(p,d,14)^ve(p,d,18)^Xe(p,d,41),R=Re(p,d,14)^Re(p,d,18)^Je(p,d,41),D=p&h^~p&g,P=d&y^~d&E,v=zr(w,R,P,ba[b],Ee[b]),x=qr(v,m,S,D,ga[b],be[b]),k=v|0,I=ve(r,o,28)^Xe(r,o,34)^Xe(r,o,39),T=Re(r,o,28)^Je(r,o,34)^Je(r,o,39),M=r&s^r&c^s&c,_=o&a^o&i^a&i;m=g|0,w=E|0,g=h|0,E=y|0,h=p|0,y=d|0,{h:p,l:d}=oe(u|0,f|0,x|0,k|0),u=c|0,f=i|0,c=s|0,i=a|0,s=r|0,a=o|0;let U=Fr(k,T,_);r=Vr(U,x,I,M),o=U|0}({h:r,l:o}=oe(this.Ah|0,this.Al|0,r|0,o|0)),{h:s,l:a}=oe(this.Bh|0,this.Bl|0,s|0,a|0),{h:c,l:i}=oe(this.Ch|0,this.Cl|0,c|0,i|0),{h:u,l:f}=oe(this.Dh|0,this.Dl|0,u|0,f|0),{h:p,l:d}=oe(this.Eh|0,this.El|0,p|0,d|0),{h,l:y}=oe(this.Fh|0,this.Fl|0,h|0,y|0),{h:g,l:E}=oe(this.Gh|0,this.Gl|0,g|0,E|0),{h:m,l:w}=oe(this.Hh|0,this.Hl|0,m|0,w|0),this.set(r,o,s,a,c,i,u,f,p,d,h,y,g,E,m,w)}roundClean(){q(be,Ee)}destroy(){q(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}};var $r=hn(()=>new Et);var Ne=hn(()=>new xt);var $=$r;function Ea(e,t,n,r){Se(e);let o=Lr({dkLen:32,asyncTick:10},r),{c:s,dkLen:a,asyncTick:c}=o;if(j(s),j(a),j(c),s<1)throw new Error("iterations (c) should be >= 1");let i=pn(t),u=pn(n),f=new Uint8Array(a),p=ee.create(e,i),d=p._cloneInto().update(u);return{c:s,dkLen:a,asyncTick:c,DK:f,PRF:p,PRFSalt:d}}function xa(e,t,n,r,o){return e.destroy(),t.destroy(),r&&r.destroy(),q(o),n}async function wt(e,t,n,r){let{c:o,dkLen:s,asyncTick:a,DK:c,PRF:i,PRFSalt:u}=Ea(e,t,n,r),f,p=new Uint8Array(4),d=Le(p),h=new Uint8Array(i.outputLen);for(let y=1,g=0;g<s;y++,g+=i.outputLen){let E=c.subarray(g,g+i.outputLen);d.setInt32(0,y,!1),(f=u._cloneInto(f)).update(p).digestInto(h),E.set(h.subarray(0,E.length)),await Ur(o-1,a,()=>{i._cloneInto(f).update(h).digestInto(h);for(let m=0;m<E.length;m++)E[m]^=h[m]})}return xa(i,u,c,f,h)}function wa(e,t,n){return Se(e),n===void 0&&(n=new Uint8Array(e.outputLen)),ee(e,ye(n),ye(t))}var gn=Uint8Array.from([0]),Yr=Uint8Array.of();function ka(e,t,n,r=32){Se(e),j(r);let o=e.outputLen;if(r>255*o)throw new Error("Length should be <= 255*HashLen");let s=Math.ceil(r/o);n===void 0&&(n=Yr);let a=new Uint8Array(s*o),c=ee.create(e,t),i=c._cloneInto(),u=new Uint8Array(c.outputLen);for(let f=0;f<s;f++)gn[0]=f+1,i.update(f===0?Yr:u).update(n).update(gn).digestInto(u),a.set(u,o*f),c._cloneInto(i);return c.destroy(),i.destroy(),q(u,gn),a.slice(0,r)}var kt=(e,t,n,r,o)=>ka(e,wa(e,t,n),r,o);var Aa=8,Ia="hmac-sha256-v1",Sa="normalization-v1",va="normalization-v2",Ra="pbkdf2-sha256-600k-v2",Zr=6e5,Qe=Zr,bn=32,Xr="[\\u00ad\\u200b-\\u200f\\u2060-\\u2064\\ufeff]",Ta=new RegExp(Xr,"g");function En(e){let t=e.normalize("NFC");return t=t.replace(/\r\n/g,`
+"use strict";var Bs=Object.create;var At=Object.defineProperty;var Ns=Object.getOwnPropertyDescriptor;var Hs=Object.getOwnPropertyNames;var Gs=Object.getPrototypeOf,Fs=Object.prototype.hasOwnProperty;var Vs=(e,t)=>{for(var n in t)At(e,n,{get:t[n],enumerable:!0})},kr=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Hs(t))!Fs.call(e,o)&&o!==n&&At(e,o,{get:()=>t[o],enumerable:!(r=Ns(t,o))||r.enumerable});return e};var Ws=(e,t,n)=>(n=e!=null?Bs(Gs(e)):{},kr(t||!e||!e.__esModule?At(n,"default",{value:e,enumerable:!0}):n,e)),Ks=e=>kr(At({},"__esModule",{value:!0}),e);var Tl={};Vs(Tl,{AIToolCategory:()=>ln,AI_REGISTRY:()=>St,ANNUAL_MONTHS_FREE:()=>ni,ANSI_ESCAPE_SOURCE:()=>no,ASSIGNED_SECRET_SLUG:()=>Vc,AlertChannel:()=>vr,AlertTrigger:()=>Rr,CATEGORISED_SLUGS:()=>sl,COMMON_PASSPHRASE_ROOTS:()=>ot,COVERAGE_SLUGS:()=>Ss,CUSTOM_EXTRA_ROOTS:()=>Dt,CUSTOM_PASSPHRASE_MIN_LENGTH:()=>Ot,CUSTOM_PASSPHRASE_WARNING:()=>qi,DETECTION_CATEGORIES:()=>gr,DETECTION_FAMILY_BLURBS:()=>Qc,DETECTION_FAMILY_NAMES:()=>_s,DETECTION_PROOF_NAMES:()=>el,DETECTION_UNIVERSAL_IGNORES:()=>tl,DIGEST_VERSION_HMAC_V1:()=>Ci,EDITOR_DEVICE_EMAIL:()=>Ls,EDITOR_EMAIL_PREFIX:()=>Al,EMAIL_MAX:()=>qd,ENTERPRISE_FEATURES:()=>hn,EventAction:()=>Ar,EventType:()=>Tr,FOUNDING_PERCENT_OFF:()=>Cr,FOUNDING_TEAMS:()=>Zs,FREE_FEATURES:()=>fn,FREE_SEATS:()=>Ye,GENERATED_PASSPHRASE_BITS_APPROX:()=>Qo,GENERATED_PASSPHRASE_ENTROPY_BITS:()=>ua,GENERATED_PASSPHRASE_REQUIRED_MESSAGE:()=>co,GUESSABLE_SECRET_BITS:()=>io,INVISIBLE_CHARS_CLASS:()=>to,ISSUE_LABEL:()=>ml,KDF_ITERATIONS:()=>tt,KDF_VERSION_V2:()=>Pi,KeyShareUnavailableError:()=>tn,LEGACY_PRO_BANDS:()=>Ys,LIST_HOLD_MS:()=>Rd,MATRIX_TIERS:()=>ai,MAX_ACTIVITY_SESSIONS_PER_BATCH:()=>Bd,MAX_SCAN_WINDOWS:()=>sn,MAX_TOTAL_SCAN_CHARS:()=>xt,MIN_SECRET_LENGTH:()=>Mi,NAME_MAX:()=>zd,NORMALIZATION_VERSION_V1:()=>Oi,NORMALIZATION_VERSION_V2:()=>Di,OFFICIAL_OPRF_PINS:()=>or,OFFICIAL_SERVER_HOSTS:()=>qo,OPRF_ELEMENT_BYTES:()=>je,OPRF_OUTPUT_BYTES:()=>lc,OPRF_PROOF_BYTES:()=>Jt,ORG_KEY_LOCK_SCHEME:()=>vc,OprfProofError:()=>Z,OrgPlan:()=>Ir,PASSPHRASE_CREDENTIAL_NAME:()=>Ut,PASSPHRASE_CREDENTIAL_URL:()=>_n,PASSPHRASE_VERIFY_LABEL:()=>oo,PASTE_CEILING_ALARM_CHARS:()=>ws,PASTE_CEILING_WARN_CHARS:()=>xs,PLAN_DESCRIPTORS:()=>li,PLAN_FEATURE_MATRIX:()=>ci,PLAN_FEATURE_TIERS:()=>ii,PLAN_LIMITS:()=>Mr,PLAN_PRICING:()=>Qs,PLATFORM_SURFACES:()=>si,PRIVACY_EMAIL:()=>fi,PROJECT_KDF_LABEL:()=>ro,PRO_BANDS:()=>X,PRO_ENTRY_BAND:()=>ne,PRO_FEATURES:()=>pn,PRO_TOP_BAND:()=>Js,ROSTER_FILE_MAX_BYTES:()=>Yd,ROSTER_MAX_ROWS:()=>jd,ROSTER_TEMPLATE_CSV:()=>al,ROTATION_GUIDE_SLUGS:()=>Xc,ROTATION_LINK_HOSTS:()=>Zc,RiskLevel:()=>un,SAFE_BLOCK_EVENT_FIELDS:()=>$s,SALES_EMAIL:()=>ui,SCAN_PREFILTER_LABEL:()=>us,SCAN_PREFILTER_PATTERN:()=>ps,SCAN_PREFILTER_SPACE:()=>dr,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE:()=>Es,SECRET_PROVIDER_NAMES:()=>wt,SECRET_PROVIDER_SLUGS:()=>As,SECURITY_CODE_WHERE_TO_TYPE:()=>Ps,SECURITY_EMAIL:()=>di,SEQUENCES:()=>Pt,SERVER_EMAIL_RE:()=>Os,SecretKeyNeededError:()=>mt,TRIAL_DAYS:()=>ri,TRUST_POINTS:()=>Ic,UNRECOGNISED_PROVIDER_SLUG:()=>Oe,UserRole:()=>Sr,VSCODE_AWAY_AFTER_MS:()=>vl,VSCODE_PLACES:()=>Us,VSCODE_PLACE_LABELS:()=>xl,annualBilledNote:()=>Or,appendPasskeyEnvelope:()=>Ta,assessSecretGuessability:()=>sa,behaviorExplanation:()=>zs,canonicalSecretPlaintextForHmac:()=>Mt,categoryOfSlug:()=>nl,checkOprfAnswer:()=>en,checkRosterFile:()=>yl,checkShareAnswer:()=>sr,clientBehindProxies:()=>kc,computePassphraseVerifyHmac:()=>In,createLockedOrgKey:()=>Mc,createShareHandler:()=>Ac,customPolicyDomains:()=>il,decodeScanPrefilter:()=>fr,deriveBehaviorRisk:()=>js,deriveHmacKeyFromPassphrase:()=>Gi,deriveProjectKey:()=>Vi,deriveScanPrefilterSeed:()=>ms,deviceEnvelopeCredential:()=>Cc,encodeScanPrefilter:()=>bs,eventFor:()=>Rl,extractAddedLinesFromUnifiedDiff:()=>Pc,familyDisplayName:()=>ol,familyOfSlug:()=>Ms,findBand:()=>ei,findPasskeyEnvelope:()=>Ma,foldLeet:()=>st,foldUuidHexCase:()=>nt,foundingMonthlyUsd:()=>Xs,generateHmacKey:()=>Ki,generateLockSecretKey:()=>Rc,generateOrgKey:()=>is,generateOrgPassphrase:()=>pa,generatePrfSalt:()=>Sa,getInjectionHostnames:()=>Ur,getLimitsForPlan:()=>qs,getPrfSaltBytes:()=>Ra,guardListShrink:()=>Oc,guessableSecretWarning:()=>ia,hexToKey:()=>ji,hmacDigestHex:()=>Ct,inviteLinksCsv:()=>El,inviteShareText:()=>gl,isAIToolDomain:()=>hi,isEditorDevice:()=>kl,isEditorExtensionId:()=>Sl,isEditorUserAgent:()=>Il,isGeneratedPassphraseFormat:()=>Mn,isInjectionScopedHostname:()=>yn,isKeyShare:()=>cs,isKnownProviderSlug:()=>Wc,isOrgKeyLock:()=>ls,isProtectableSlug:()=>rl,isStrictScope:()=>Yo,isV1PassphraseEnvelope:()=>uo,isV2Envelope:()=>lo,isValidOprfSecretKey:()=>er,isVscodePlace:()=>wl,joinLockCredential:()=>Tc,keyToHex:()=>$i,lockOrgKey:()=>as,lockSecretKeyBytes:()=>nn,matchDomain:()=>Pr,matchPatternsForHostname:()=>gi,maxScannablePasteChars:()=>Gc,maxScannablePasteCharsFor:()=>on,memoryPinStore:()=>yc,nameFromEmail:()=>Ds,normalizeAndHmacHex:()=>Hi,normalizeAndHmacHexCollapsed:()=>Bi,normalizeAndHmacHexLower:()=>Ni,normalizeDomainInput:()=>gn,normalizeSecretPlaintextCollapsed:()=>rt,normalizeSecretPlaintextForMatch:()=>Sn,normalizeSecretPlaintextLower:()=>He,oprfBlind:()=>ft,oprfBlindEvaluate:()=>dc,oprfBlindEvaluateWithProof:()=>nr,oprfDeriveSecretKey:()=>fc,oprfFinalize:()=>pt,oprfGenerateSecretKey:()=>pc,oprfPublicKey:()=>tr,oprfVerifyEvaluation:()=>ht,parseRoster:()=>hl,passphraseCsvText:()=>ya,passphraseSheetText:()=>ha,perMonthOnAnnual:()=>oi,policyNamedDomains:()=>Cs,projectedScanCost:()=>hr,providerDisplayName:()=>mr,publicKeyHex:()=>gc,removePasskeyEnvelope:()=>_a,rotationGuideFor:()=>Jc,scanBudgetFor:()=>Fc,scanPrefilterFingerprint:()=>rn,scanPrefilterForRawSecret:()=>Nc,scanPrefilterParams:()=>hs,scanPrefilterRoller:()=>Bc,scanPrefilterUnits:()=>ys,scanSweeps:()=>pr,scanWindowLengths:()=>Hc,scopeOf:()=>mc,smallestBandFor:()=>ti,splitLockCredential:()=>cr,unlockOrgKey:()=>_c,unwrapHmacKeyWithPrf:()=>va,upgradeEnvelopeToV2:()=>wa,usd:()=>Ae,validateAnchorPassphrase:()=>xa,validateCustomPassphrase:()=>Rn,validateGeneratedPassphrase:()=>Ea,validateNewPassphrase:()=>it,validatePassphraseStrength:()=>vn,wrapHmacKeyWithPrf:()=>Ia});module.exports=Ks(Tl);var ln=(c=>(c.CODE_GEN="CODE_GEN",c.IMAGE_GEN="IMAGE_GEN",c.WRITING="WRITING",c.DATA_ANALYSIS="DATA_ANALYSIS",c.CHATBOT="CHATBOT",c.SEARCH="SEARCH",c.OTHER="OTHER",c))(ln||{}),un=(o=>(o.LOW="LOW",o.MEDIUM="MEDIUM",o.HIGH="HIGH",o.CRITICAL="CRITICAL",o))(un||{}),Ar=(n=>(n.BLOCKED="BLOCKED",n.LOGGED="LOGGED",n))(Ar||{}),Sr=(o=>(o.OWNER="OWNER",o.ADMIN="ADMIN",o.USER="USER",o.VIEWER="VIEWER",o))(Sr||{}),Ir=(r=>(r.FREE="FREE",r.PRO="PRO",r.ENTERPRISE="ENTERPRISE",r))(Ir||{}),vr=(n=>(n.EMAIL="EMAIL",n.WEBHOOK="WEBHOOK",n))(vr||{}),Rr=(r=>(r.CRITICAL_BLOCK="CRITICAL_BLOCK",r.DAILY_SUMMARY="DAILY_SUMMARY",r.WEEKLY_REPORT="WEEKLY_REPORT",r))(Rr||{}),Tr=(s=>(s.PASTE="PASTE",s.FILE_UPLOAD="FILE_UPLOAD",s.SELECTION="SELECTION",s.PASTE_REDACTED="PASTE_REDACTED",s.DETECTED="DETECTED",s))(Tr||{}),$s=["event","type","secretLabel","secretLabels","attemptCount","risk","toolDomain","sourceUrl","timestamp","eventType","scanMethod","scanMs","hmacBatches","secretIds","matchReason","matchReasonSource","bypassVariant","incidentId","detectedAt","policyAction"];function js(e){return e<=1?"low":e===2?"medium":"high"}function zs(e){return e<=1?"User likely made an accidental paste.":e===2?"User may not be aware this is sensitive.":"Repeated attempts detected \u2014 potential risk."}var De={maxUsers:5,maxInviteCodes:5,alerts:["EMAIL"],customDetection:!1,advancedReports:!1,exportReports:!1,siem:!1,sso:!1,customerKeyShare:!1},dn={maxUsers:200,maxInviteCodes:200,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!1,siem:!1,sso:!1,customerKeyShare:!1},_r={maxUsers:9999,maxInviteCodes:9999,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!0,siem:!0,sso:!0,customerKeyShare:!0},Mr={FREE:De,PRO:dn,ENTERPRISE:_r};function qs(e){return Mr[e]??De}var Ye=De.maxUsers,X=[{id:"team25c",name:"Team",maxUsers:25,monthlyUsd:99,annualUsd:990},{id:"growth50c",name:"Growth",maxUsers:50,monthlyUsd:179,annualUsd:1790},{id:"business100c",name:"Business",maxUsers:100,monthlyUsd:329,annualUsd:3290},{id:"scale200c",name:"Scale",maxUsers:200,monthlyUsd:599,annualUsd:5990}],Ys=[{id:"team25",name:"Team",maxUsers:25,monthlyUsd:49,annualUsd:490},{id:"growth50",name:"Growth",maxUsers:50,monthlyUsd:99,annualUsd:990},{id:"business100",name:"Business",maxUsers:100,monthlyUsd:179,annualUsd:1790},{id:"scale200b",name:"Scale",maxUsers:200,monthlyUsd:329,annualUsd:3290},{id:"team15",name:"Team",maxUsers:15,monthlyUsd:59,annualUsd:590},{id:"growth30",name:"Growth",maxUsers:30,monthlyUsd:119,annualUsd:1190},{id:"business75",name:"Business",maxUsers:75,monthlyUsd:279,annualUsd:2790},{id:"scale200",name:"Scale",maxUsers:200,monthlyUsd:649,annualUsd:6490}],Zs=100,Cr=45;function Xs(e){return Math.round(e.monthlyUsd*(100-Cr))/100}var Ol=X[X.length-1].maxUsers,ne=X[0],Js=X[X.length-1],Qs={PRO:{monthlyUsd:ne.monthlyUsd,annualUsd:ne.annualUsd}};function ei(e){return X.find(t=>t.id===e)}function ti(e){return X.find(t=>t.maxUsers>=e)}var ni=2,ri=14;function Ae(e){return`$${Number.isInteger(e)?e.toLocaleString("en-US"):e.toFixed(2)}`}function oi(e){return Ae(e/12)}function Or(e,t){return`${Ae(t)} billed yearly \xB7 save ${Ae(e*12-t)}`}var fn=["The full detection engine \u2014 paste, send, typed input, drag and file upload","Chrome, Edge and Safari","Bypass detection \u2014 whitespace injection and case folding","Unregistered-secret suggestions \u2014 spots keys nobody registered, admin opt-in, never a block","VS Code extension \u2014 pastes into the terminal and the chat box are checked, and files are flagged on exactly the secret","Claude Code, Codex and Cursor \u2014 each prompt, attached or read file, command and tool call is checked before it is sent","Command line \u2014 redaktyn-scan as a git pre-commit hook, and on any file or folder","Block, or let people paste a redacted copy \u2014 your admin's choice, in the browser and in VS Code alike","Every stop in your Event Log as the secret's label and the place, never the text","Zero-knowledge by construction: only HMAC digests leave the device",`Up to ${Ye} people, plus ${Ye} editor machines running VS Code or the command line`,`${De.maxInviteCodes} invite codes`,"Email alerts","30-day compliance history","Community support"],pn=[`Pick your team's size \u2014 each covers that many people and the same number of editor machines: ${X.map(e=>`${e.name} ${e.maxUsers} + ${e.maxUsers}, ${Ae(e.monthlyUsd)}/mo`).join("; ")}`,"Everyone inside your size is covered; no per-seat metering or proration between invites","As many unused invite links as your size has seats","Webhook alerts alongside email","Executive PDF report, emailed every Monday and downloadable any time","Domain policies \u2014 add any site, beyond the built-in AI tools, to the places Redaktyn blocks","365-day compliance history","Priority support"],hn=["Custom seat limits, agreed rather than published","Customer-held key share \u2014 a key server you run must also answer before your workspace key opens, so Redaktyn cannot open it alone or test passphrase guesses, whatever passphrase you choose. We never receive your passphrase either way","CSV export of the full event log","SIEM webhook delivery","SSO \u2014 SAML and OIDC","Dedicated support"],si=[{id:"browser",name:"Browser extension",where:"Chrome, Edge and Safari",points:["Paste, send, typed input, drag and file upload are checked on the AI tools you use, and on any site you add (Pro)","A secret with its spaces changed or its case folded is still caught","Spots up to 50 categories of key nobody registered, and only ever suggests: it never blocks on a guess","Your admin can let people paste a redacted copy instead of being stopped"]},{id:"vscode",name:"VS Code extension",where:"Visual Studio Marketplace",points:["A paste into the terminal, where Claude Code and Codex run, is checked before it goes in","A secret typed or pasted into the VS Code chat box is taken back out before it can be submitted","Files are flagged on exactly the secret when they open and when they are saved","Connects with an invite link from your admin, made the same way as a browser's"]},{id:"agents",name:"Claude Code, Codex and Cursor",where:"Through each tool's own hooks",points:["Each prompt, each file attached or read, each command and tool call is checked before it is sent","Blocked, or the agent is handed a redacted copy and your real file is never changed","One command to install and one to remove, for each tool; your other hooks are left exactly as they were","The details, and what it cannot cover, are on the VS Code extension page"]},{id:"cli",name:"Command line and git",where:"redaktyn-scan",points:["Checks what git is about to commit and refuses the commit if it holds a registered secret","Installs as a pre-commit hook with one command, or scans any file or folder","Machine-readable output, so it can run in CI","Connects with an invite link from your admin, made the same way as the browser's and VS Code's"]},{id:"admin",name:"Dashboard and Event Log",where:"For the people who run it",points:["Every stop reaches your Event Log as the secret's label and the place, never the text, a prompt or a file name","See which developer machines are connected, their versions, and whether their Claude Code, Codex and Cursor hooks are installed","Device approval: a new device waits for an admin before it is connected","Pro adds the Monday executive report, webhook alerts and a year of history"]}],ii=[{key:"FREE",name:"Free",features:fn},{key:"PRO",name:"Pro",features:pn},{key:"ENTERPRISE",name:"Enterprise",features:hn}],ai=[{key:"FREE",name:"Free",price:"$0"},{key:"PRO",name:"Pro",price:`From ${Ae(ne.monthlyUsd)}/mo`},{key:"ENTERPRISE",name:"Enterprise",price:"Contact us"}],ci=[{section:"Limits",rows:[{label:"People covered",note:`Dashboard logins and browsers. Pro is bought in ${X.length} sizes, up to ${X.map(e=>e.maxUsers).join(", ")} people \u2014 the figure here is the largest; a workspace's own limit is the size it bought.`,gate:"maxUsers",values:{FREE:String(Ye),PRO:"200",ENTERPRISE:"Custom"}},{label:"Editor machines covered",note:"Machines running VS Code, Claude Code, Codex or the command line, counted apart from the people: every size covers as many of them as it does people, so a developer on Chrome and VS Code uses one of each.",gate:"maxUsers",values:{FREE:String(Ye),PRO:"200",ENTERPRISE:"Custom"}},{label:"Invite codes",note:"Unused links held at once. A link is spent when a browser connects and takes a seat, so on Pro this is the size you bought.",gate:"maxInviteCodes",values:{FREE:String(De.maxInviteCodes),PRO:String(dn.maxInviteCodes),ENTERPRISE:"Unlimited"}},{label:"Compliance history",note:"How far back a compliance report may be run. Event data itself is not deleted on any plan.",gate:"advancedReports",values:{FREE:"30 days",PRO:"365 days",ENTERPRISE:"365 days"}}]},{section:"Detection and blocking",rows:[{label:"Paste, send, typed input, drag and file upload",note:"All six enforcement paths, on every plan. Detection has never been plan-gated and is the last thing that should be.",ungated:"No plan check exists on any enforcement path in the extension.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Chrome, Edge and Safari",ungated:"The extension reports its browser; no route reads a plan before accepting the heartbeat.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Bypass detection \u2014 whitespace injection, case folding",ungated:"Runs inside the same scan as the direct match; there is no flag to turn it off.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Detection engine \u2014 50 categories nobody registered",note:"Credentials, infrastructure files and personal data, each proven by a checksum, a decoded structure or the provider's format. On by default; suggests, never blocks.",ungated:"The org switch is an admin setting with no plan check, and the extension's resolver reads only that switch.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Personal-data detection \u2014 cards, Aadhaar, PAN, SSN, IBAN",note:"Checksum-verified and labelled, offered for removal only. Its own switch, on by default.",ungated:"The personal-data switch is an admin setting with no plan check; the resolver passes it straight to the engine.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Unprotected-secret counts by category",note:"A daily count per category on the dashboard \u2014 never a value, a fingerprint or a name.",ungated:"The coverage route checks the org's reporting switch and the enrolment, never the plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Custom domain policies",note:"Add a site that is not one of the built-in AI tools to the places Redaktyn blocks. Older warn and log policies keep working.",gate:"customDetection",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}}]},{section:"Where it runs",rows:[{label:"VS Code extension",note:"A paste into the terminal and into the chat box is checked; files are flagged on exactly the secret. It connects with an invite link, like the browser.",ungated:"The /api/vscode routes and the secrets list read no plan; a connected machine takes a seat like a browser does.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Claude Code, Codex and Cursor",note:"Each prompt, attached or read file, command and tool call is checked through the tool's own hooks, installed and removed with one command each.",ungated:"The hooks read only the secrets list and the redaction policy, and neither route reads a plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Command line and git pre-commit hook",note:"redaktyn-scan checks what git is about to commit, or any file or folder, and can run in CI.",ungated:"The CLI's routes read no plan; it uses the same secrets list and connects with an invite link like the other surfaces.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Redacted copy instead of a block",note:"One admin switch for the browser and VS Code. Off until the admin turns it on.",ungated:"The overlay-policy route is an admin setting with no plan check.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Device approval",note:"A new device waits for an admin before it is connected.",ungated:"The device-approval routes and service read no plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Who is connected, and what they have protected",note:"The VS Code page lists each developer's extension and VS Code versions, and whether their Claude Code, Codex and Cursor hooks are installed.",ungated:"The VS Code devices route reads no plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}}]},{section:"Alerting and reporting",rows:[{label:"Email alerts",ungated:"EMAIL is in every plan's channel list, so the row is true by construction.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Webhook alerts",gate:"alerts",channel:"WEBHOOK",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"Executive PDF report",note:"Emailed every Monday, and downloadable at any time from Reports.",gate:"advancedReports",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"CSV export of the event log",gate:"exportReports",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"SIEM webhook delivery",gate:"siem",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Customer-held key share",note:"A key server you run must also answer before your workspace key opens, so Redaktyn cannot open it alone or test passphrase guesses, whatever passphrase you choose. Cut it off and nobody, including Redaktyn, can unlock the workspace. If its key is lost, the way back is a reset that registers every secret again.",gate:"customerKeyShare",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}}]},{section:"Access and support",rows:[{label:"SSO \u2014 SAML and OIDC",gate:"sso",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Support",note:"A commitment from people, not a switch in the code \u2014 which is why no flag backs this row.",ungated:"Support tiering is contractual; no route reads a plan to answer a support request.",values:{FREE:"Community",PRO:"Priority",ENTERPRISE:"Dedicated"}}]}],li=[{id:"FREE",name:"Free",tagline:"The whole detection engine, for a team that is still proving it works",priceMonthly:0,priceLabel:"$0",priceNote:"Forever free \xB7 no card",limits:De,features:fn,featuresHeading:"What's included",highlighted:!1,cta:"Get started"},{id:"PRO",name:"Pro",tagline:"For a team that has to answer questions about its own exposure",priceMonthly:ne.monthlyUsd,priceLabel:Ae(ne.monthlyUsd),priceNote:`per month \xB7 up to ${ne.maxUsers} people + ${ne.maxUsers} editor machines`,annualNote:Or(ne.monthlyUsd,ne.annualUsd),limits:dn,features:pn,featuresHeading:"Everything in Free, plus",highlighted:!0,cta:"Start free, then upgrade"},{id:"ENTERPRISE",name:"Enterprise",tagline:"For satisfying somebody else's auditor or IT department",priceMonthly:null,priceLabel:"Custom",priceNote:"Contact sales",limits:_r,features:hn,featuresHeading:"Everything in Pro, plus",highlighted:!1,cta:"Contact sales"}],Dr="ak8340651733@gmail.com",ui=Dr,di=Dr,fi="support@redaktyn.com";function l(e,t,n,r="MEDIUM",o={}){return{domain:e,name:t,category:n,riskLevel:r,isEnterprise:o.isEnterprise??!1,...o.personalVersionDomain?{personalVersionDomain:o.personalVersionDomain}:{}}}var St=[l("chat.openai.com","ChatGPT","CODE_GEN","HIGH"),l("chatgpt.com","ChatGPT","CODE_GEN","HIGH"),l("platform.openai.com","OpenAI Platform","CODE_GEN","HIGH"),l("claude.ai","Claude","CODE_GEN","HIGH"),l("gemini.google.com","Gemini","CODE_GEN","MEDIUM"),l("aistudio.google.com","Google AI Studio","CODE_GEN","MEDIUM"),l("copilot.github.com","GitHub Copilot","CODE_GEN","MEDIUM"),l("github.com/copilot","GitHub Copilot Chat","CODE_GEN","MEDIUM"),l("cursor.sh","Cursor","CODE_GEN","MEDIUM"),l("cursor.com","Cursor","CODE_GEN","MEDIUM"),l("replit.com","Replit","CODE_GEN","HIGH"),l("codeium.com","Codeium","CODE_GEN","MEDIUM"),l("tabnine.com","Tabnine","CODE_GEN","MEDIUM"),l("codewhisperer.aws","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),l("aws.amazon.com/codewhisperer","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),l("phind.com","Phind","CODE_GEN","MEDIUM"),l("continue.dev","Continue","CODE_GEN","MEDIUM"),l("askcodi.com","AskCodi","CODE_GEN","MEDIUM"),l("sourcegraph.com","Sourcegraph Cody","CODE_GEN","MEDIUM"),l("windsurf.ai","Windsurf","CODE_GEN","MEDIUM"),l("v0.dev","Vercel v0","CODE_GEN","MEDIUM"),l("bolt.new","Bolt","CODE_GEN","HIGH"),l("lovable.dev","Lovable","CODE_GEN","HIGH"),l("aider.chat","Aider","CODE_GEN","MEDIUM"),l("cody.dev","Cody","CODE_GEN","MEDIUM"),l("blackbox.ai","Blackbox AI","CODE_GEN","HIGH"),l("deepcode.ai","DeepCode","CODE_GEN","MEDIUM"),l("codiga.io","Codiga","CODE_GEN","MEDIUM"),l("mutable.ai","Mutable AI","CODE_GEN","MEDIUM"),l("pieces.app","Pieces","CODE_GEN","MEDIUM"),l("codium.ai","CodiumAI","CODE_GEN","MEDIUM"),l("coderabbit.ai","CodeRabbit","CODE_GEN","MEDIUM"),l("devin.ai","Devin","CODE_GEN","HIGH"),l("idx.dev","Project IDX","CODE_GEN","MEDIUM"),l("stackblitz.com","StackBlitz","CODE_GEN","MEDIUM"),l("codepen.io","CodePen AI","CODE_GEN","MEDIUM"),l("codesandbox.io","CodeSandbox AI","CODE_GEN","MEDIUM"),l("gitpod.io","Gitpod","CODE_GEN","MEDIUM"),l("poe.com","Poe","CHATBOT","MEDIUM"),l("character.ai","Character.AI","CHATBOT","MEDIUM"),l("beta.character.ai","Character.AI Beta","CHATBOT","MEDIUM"),l("huggingface.co/chat","HuggingChat","CHATBOT","MEDIUM"),l("pi.ai","Pi","CHATBOT","LOW"),l("chat.mistral.ai","Mistral Chat","CHATBOT","MEDIUM"),l("chat.deepseek.com","DeepSeek Chat","CHATBOT","HIGH"),l("deepseek.com","DeepSeek","CHATBOT","HIGH"),l("groq.com","Groq","CHATBOT","MEDIUM"),l("console.groq.com","Groq Console","CHATBOT","MEDIUM"),l("cohere.com","Cohere","CHATBOT","MEDIUM"),l("coral.cohere.com","Cohere Coral","CHATBOT","MEDIUM"),l("inflection.ai","Inflection","CHATBOT","MEDIUM"),l("chat.lmsys.org","LMSYS Chatbot Arena","CHATBOT","HIGH"),l("open-assistant.io","Open Assistant","CHATBOT","MEDIUM"),l("bard.google.com","Google Bard","CHATBOT","MEDIUM"),l("copilot.microsoft.com","Microsoft Copilot","CHATBOT","LOW",{isEnterprise:!0}),l("bing.com/chat","Bing Chat","CHATBOT","MEDIUM"),l("meta.ai","Meta AI","CHATBOT","MEDIUM"),l("labs.perplexity.ai","Perplexity Labs","CHATBOT","MEDIUM"),l("together.ai","Together AI","CHATBOT","MEDIUM"),l("api.together.xyz","Together API","CHATBOT","MEDIUM"),l("fireworks.ai","Fireworks AI","CHATBOT","MEDIUM"),l("anyscale.com","Anyscale","CHATBOT","MEDIUM"),l("replicate.com","Replicate","CHATBOT","MEDIUM"),l("lepton.ai","Lepton AI","CHATBOT","MEDIUM"),l("forefront.ai","Forefront","CHATBOT","MEDIUM"),l("chat.vercel.ai","Vercel AI Chat","CHATBOT","MEDIUM"),l("llama.meta.com","Llama","CHATBOT","MEDIUM"),l("grok.com","Grok","CHATBOT","HIGH"),l("grok.x.ai","Grok","CHATBOT","MEDIUM"),l("x.ai","xAI","CHATBOT","MEDIUM"),l("duckduckgo.com/aichat","DuckDuckGo AI Chat","CHATBOT","LOW"),l("chatglm.cn","ChatGLM","CHATBOT","HIGH"),l("yiyan.baidu.com","Ernie Bot","CHATBOT","HIGH"),l("qianwen.aliyun.com","Qwen","CHATBOT","HIGH"),l("abacus.ai","Abacus AI","CHATBOT","MEDIUM"),l("midjourney.com","Midjourney","IMAGE_GEN","MEDIUM"),l("discord.com/channels/midjourney","Midjourney Discord","IMAGE_GEN","MEDIUM"),l("openai.com/dall-e","DALL-E","IMAGE_GEN","MEDIUM"),l("labs.openai.com","DALL-E Labs","IMAGE_GEN","MEDIUM"),l("stability.ai","Stable Diffusion","IMAGE_GEN","MEDIUM"),l("dreamstudio.ai","DreamStudio","IMAGE_GEN","MEDIUM"),l("leonardo.ai","Leonardo.ai","IMAGE_GEN","MEDIUM"),l("app.leonardo.ai","Leonardo.ai App","IMAGE_GEN","MEDIUM"),l("ideogram.ai","Ideogram","IMAGE_GEN","MEDIUM"),l("firefly.adobe.com","Adobe Firefly","IMAGE_GEN","LOW",{isEnterprise:!0}),l("clipdrop.co","ClipDrop","IMAGE_GEN","MEDIUM"),l("playground.ai","Playground AI","IMAGE_GEN","MEDIUM"),l("nightcafe.studio","NightCafe","IMAGE_GEN","MEDIUM"),l("creator.nightcafe.studio","NightCafe Creator","IMAGE_GEN","MEDIUM"),l("runwayml.com","Runway","IMAGE_GEN","MEDIUM"),l("app.runwayml.com","Runway App","IMAGE_GEN","MEDIUM"),l("canva.com/ai-image-generator","Canva AI","IMAGE_GEN","LOW"),l("imagine.meta.com","Meta Imagine","IMAGE_GEN","MEDIUM"),l("pika.art","Pika","IMAGE_GEN","MEDIUM"),l("kaiber.ai","Kaiber","IMAGE_GEN","MEDIUM"),l("bing.com/images/create","Bing Image Creator","IMAGE_GEN","MEDIUM"),l("designer.microsoft.com","Microsoft Designer","IMAGE_GEN","MEDIUM"),l("craiyon.com","Craiyon","IMAGE_GEN","LOW"),l("starryai.com","StarryAI","IMAGE_GEN","LOW"),l("hotpot.ai","Hotpot AI","IMAGE_GEN","LOW"),l("lexica.art","Lexica","IMAGE_GEN","LOW"),l("jasper.ai","Jasper","WRITING","MEDIUM"),l("app.jasper.ai","Jasper App","WRITING","MEDIUM"),l("copy.ai","Copy.ai","WRITING","MEDIUM"),l("app.copy.ai","Copy.ai App","WRITING","MEDIUM"),l("writesonic.com","Writesonic","WRITING","MEDIUM"),l("app.writesonic.com","Writesonic App","WRITING","MEDIUM"),l("grammarly.com","Grammarly AI","WRITING","MEDIUM"),l("app.grammarly.com","Grammarly App","WRITING","MEDIUM"),l("notion.so","Notion AI","WRITING","MEDIUM"),l("quillbot.com","QuillBot","WRITING","MEDIUM"),l("wordtune.com","Wordtune","WRITING","MEDIUM"),l("rytr.me","Rytr","WRITING","MEDIUM"),l("anyword.com","Anyword","WRITING","MEDIUM"),l("hyperwriteai.com","HyperWrite","WRITING","MEDIUM"),l("writer.com","Writer","WRITING","MEDIUM",{isEnterprise:!0}),l("textcortex.com","TextCortex","WRITING","MEDIUM"),l("app.textcortex.com","TextCortex App","WRITING","MEDIUM"),l("peppertype.ai","Peppertype","WRITING","MEDIUM"),l("simplified.com","Simplified AI","WRITING","MEDIUM"),l("contentbot.ai","ContentBot","WRITING","MEDIUM"),l("ink.co","INK Editor","WRITING","MEDIUM"),l("sudowrite.com","Sudowrite","WRITING","MEDIUM"),l("novelai.net","NovelAI","WRITING","LOW"),l("shortlyai.com","ShortlyAI","WRITING","MEDIUM"),l("lex.page","Lex","WRITING","MEDIUM"),l("julius.ai","Julius","DATA_ANALYSIS","HIGH"),l("hex.tech","Hex","DATA_ANALYSIS","HIGH"),l("app.hex.tech","Hex App","DATA_ANALYSIS","HIGH"),l("obviously.ai","Obviously AI","DATA_ANALYSIS","HIGH"),l("akkio.com","Akkio","DATA_ANALYSIS","HIGH"),l("monkeylearn.com","MonkeyLearn","DATA_ANALYSIS","HIGH"),l("rows.com","Rows","DATA_ANALYSIS","MEDIUM"),l("breadcrumbs.io","Breadcrumbs","DATA_ANALYSIS","MEDIUM"),l("polymer.co","Polymer","DATA_ANALYSIS","HIGH"),l("databricks.com","Databricks AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("datarobot.com","DataRobot","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("h2o.ai","H2O.ai","DATA_ANALYSIS","MEDIUM"),l("rapidminer.com","RapidMiner","DATA_ANALYSIS","MEDIUM"),l("knime.com","KNIME","DATA_ANALYSIS","MEDIUM"),l("alteryx.com","Alteryx","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("tableau.com","Tableau AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("mode.com","Mode Analytics","DATA_ANALYSIS","MEDIUM"),l("deepnote.com","Deepnote","DATA_ANALYSIS","HIGH"),l("observable.com","Observable","DATA_ANALYSIS","MEDIUM"),l("noteable.io","Noteable","DATA_ANALYSIS","HIGH"),l("perplexity.ai","Perplexity Search","SEARCH","MEDIUM"),l("you.com","You.com Search","SEARCH","MEDIUM"),l("andi.ai","Andi","SEARCH","LOW"),l("kagi.com","Kagi","SEARCH","LOW"),l("metaphor.systems","Metaphor","SEARCH","MEDIUM"),l("exa.ai","Exa","SEARCH","MEDIUM"),l("tavily.com","Tavily","SEARCH","MEDIUM"),l("consensus.app","Consensus","SEARCH","LOW"),l("elicit.com","Elicit","SEARCH","MEDIUM"),l("elicit.org","Elicit","SEARCH","MEDIUM"),l("searchgpt.com","SearchGPT","SEARCH","MEDIUM"),l("brave.com/search/ai","Brave AI Search","SEARCH","LOW"),l("neeva.com","Neeva","SEARCH","LOW"),l("socratic.org","Socratic","SEARCH","LOW"),l("devv.ai","Devv AI","SEARCH","MEDIUM"),l("iask.ai","iAsk AI","SEARCH","LOW"),l("chatpdf.com","ChatPDF","SEARCH","MEDIUM"),l("smodin.io","Smodin","WRITING","MEDIUM"),l("ai-writer.com","AI Writer","WRITING","MEDIUM"),l("scalenut.com","Scalenut","WRITING","MEDIUM"),l("closerscopy.com","ClosersCopy","WRITING","MEDIUM"),l("longshot.ai","LongShot AI","WRITING","MEDIUM"),l("fig.io","Fig AI","CODE_GEN","MEDIUM"),l("warp.dev","Warp Terminal AI","CODE_GEN","MEDIUM"),l("raycast.com","Raycast AI","CODE_GEN","MEDIUM"),l("app.codeanywhere.com","Codeanywhere AI","CODE_GEN","MEDIUM"),l("zed.dev","Zed AI","CODE_GEN","MEDIUM"),l("gencraft.com","Gencraft","IMAGE_GEN","LOW"),l("deepai.org","DeepAI","IMAGE_GEN","LOW"),l("artbreeder.com","Artbreeder","IMAGE_GEN","LOW"),l("fotor.com/ai","Fotor AI","IMAGE_GEN","LOW"),l("remove.bg","Remove.bg","IMAGE_GEN","LOW"),l("photoroom.com","PhotoRoom AI","IMAGE_GEN","LOW"),l("app.recraft.ai","Recraft AI","IMAGE_GEN","MEDIUM"),l("pecan.ai","Pecan AI","DATA_ANALYSIS","HIGH"),l("apteo.co","Apteo","DATA_ANALYSIS","HIGH"),l("mindsdb.com","MindsDB","DATA_ANALYSIS","MEDIUM"),l("zapier.com/ai","Zapier AI","OTHER","MEDIUM"),l("make.com","Make (Integromat) AI","OTHER","MEDIUM"),l("otter.ai","Otter.ai","OTHER","HIGH"),l("fireflies.ai","Fireflies.ai","OTHER","HIGH"),l("descript.com","Descript","OTHER","MEDIUM"),l("synthesia.io","Synthesia","OTHER","MEDIUM"),l("elevenlabs.io","ElevenLabs","OTHER","MEDIUM"),l("murf.ai","Murf AI","OTHER","MEDIUM"),l("resemble.ai","Resemble AI","OTHER","MEDIUM"),l("loom.com","Loom AI","OTHER","MEDIUM"),l("beautiful.ai","Beautiful.ai","OTHER","LOW"),l("gamma.app","Gamma","OTHER","MEDIUM"),l("tome.app","Tome","OTHER","MEDIUM"),l("magician.design","Magician","OTHER","MEDIUM"),l("uizard.io","Uizard","OTHER","MEDIUM"),l("huggingface.co/spaces","HuggingFace Spaces","OTHER","MEDIUM"),l("roboflow.com","Roboflow","OTHER","MEDIUM"),l("scale.com","Scale AI","OTHER","MEDIUM"),l("labelbox.com","Labelbox","OTHER","MEDIUM")],Ll=new Set(St.map(e=>e.domain.toLowerCase())),Ze=new Map;for(let e of St){let t=e.domain.toLowerCase();Ze.has(t)||Ze.set(t,e)}function pi(e){try{return e.includes("://")||(e="https://"+e),new URL(e).hostname.toLowerCase()}catch{return null}}function Pr(e){let t=pi(e);if(!t)return null;let n=Ze.get(t);if(n)return n;try{let o=new URL(e.includes("://")?e:"https://"+e),s=(o.hostname+o.pathname).toLowerCase().replace(/\/+$/,""),i=Ze.get(s);if(i)return i}catch{}let r=t.split(".");for(let o=1;o<r.length-1;o++){let s=r.slice(o).join("."),i=Ze.get(s);if(i)return i}return null}function hi(e){return Pr(e)!==null}var mi=new Set(["replit.com","sourcegraph.com","idx.dev","stackblitz.com","codepen.io","codesandbox.io","gitpod.io","fig.io","warp.dev","raycast.com","app.codeanywhere.com","zed.dev","anyscale.com","grammarly.com","notion.so","hex.tech","app.hex.tech","rows.com","breadcrumbs.io","databricks.com","datarobot.com","h2o.ai","rapidminer.com","knime.com","alteryx.com","tableau.com","mode.com","deepnote.com","observable.com","noteable.io","mindsdb.com","kagi.com","make.com","loom.com","roboflow.com","scale.com","labelbox.com"]),yi=["redaktyn.com"];function Ur(){let e=new Set;for(let t of St){let n=t.domain.toLowerCase();n.includes("/")||mi.has(n)||e.add(n)}for(let t of yi)e.add(t.toLowerCase());return Array.from(e).sort()}var mn=null;function yn(e){mn||(mn=new Set(Ur()));let t=e.toLowerCase();for(let n of mn)if(t===n||t.endsWith(`.${n}`))return!0;return!1}function gi(e){let t=e.toLowerCase();return[`*://${t}/*`,`*://*.${t}/*`]}function gn(e){let t=e.trim().toLowerCase();return!t||(t=t.replace(/^[a-z][a-z0-9+.-]*:\/\//,""),t=t.split(/[/?#]/)[0],t=t.split("@").pop(),t=t.split(":")[0],!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/.test(t))?null:t}var ae=Ws(require("node:crypto"),1),Se=ae&&typeof ae=="object"&&"webcrypto"in ae?ae.webcrypto:ae&&typeof ae=="object"&&"randomBytes"in ae?ae:void 0;function re(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function q(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function L(e,...t){if(!re(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function Ie(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash should be wrapped by utils.createHasher");q(e.outputLen),q(e.blockLen)}function Ue(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function Br(e,t){L(e);let n=t.outputLen;if(e.length<n)throw new Error("digestInto() expects output buffer of length at least "+n)}function j(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Le(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function J(e,t){return e<<32-t|e>>>t}var Nr=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",bi=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function W(e){if(L(e),Nr)return e.toHex();let t="";for(let n=0;n<e.length;n++)t+=bi[e[n]];return t}var ce={_0:48,_9:57,A:65,F:70,a:97,f:102};function Lr(e){if(e>=ce._0&&e<=ce._9)return e-ce._0;if(e>=ce.A&&e<=ce.F)return e-(ce.A-10);if(e>=ce.a&&e<=ce.f)return e-(ce.a-10)}function Q(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(Nr)return Uint8Array.fromHex(e);let t=e.length,n=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let r=new Uint8Array(n);for(let o=0,s=0;o<n;o++,s+=2){let i=Lr(e.charCodeAt(s)),c=Lr(e.charCodeAt(s+1));if(i===void 0||c===void 0){let a=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+a+'" at index '+s)}r[o]=i*16+c}return r}var Ei=async()=>{};async function Hr(e,t,n){let r=Date.now();for(let o=0;o<e;o++){n(o);let s=Date.now()-r;s>=0&&s<t||(await Ei(),r+=s)}}function M(e){if(typeof e!="string")throw new Error("string expected");return new Uint8Array(new TextEncoder().encode(e))}function ye(e){return typeof e=="string"&&(e=M(e)),L(e),e}function bn(e){return typeof e=="string"&&(e=M(e)),L(e),e}function B(...e){let t=0;for(let r=0;r<e.length;r++){let o=e[r];L(o),t+=o.length}let n=new Uint8Array(t);for(let r=0,o=0;r<e.length;r++){let s=e[r];n.set(s,o),o+=s.length}return n}function Gr(e,t){if(t!==void 0&&{}.toString.call(t)!=="[object Object]")throw new Error("options should be object or undefined");return Object.assign(e,t)}var Pe=class{};function En(e){let t=r=>e().update(ye(r)).digest(),n=e();return t.outputLen=n.outputLen,t.blockLen=n.blockLen,t.create=()=>e(),t}function Be(e=32){if(Se&&typeof Se.getRandomValues=="function")return Se.getRandomValues(new Uint8Array(e));if(Se&&typeof Se.randomBytes=="function")return Uint8Array.from(Se.randomBytes(e));throw new Error("crypto.getRandomValues must be defined")}var It=class extends Pe{constructor(t,n){super(),this.finished=!1,this.destroyed=!1,Ie(t);let r=ye(n);if(this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let o=this.blockLen,s=new Uint8Array(o);s.set(r.length>o?t.create().update(r).digest():r);for(let i=0;i<s.length;i++)s[i]^=54;this.iHash.update(s),this.oHash=t.create();for(let i=0;i<s.length;i++)s[i]^=106;this.oHash.update(s),j(s)}update(t){return Ue(this),this.iHash.update(t),this}digestInto(t){Ue(this),L(t,this.outputLen),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:n,iHash:r,finished:o,destroyed:s,blockLen:i,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=i,t.outputLen=c,t.oHash=n._cloneInto(t.oHash),t.iHash=r._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},ee=(e,t,n)=>new It(e,t).update(n).digest();ee.create=(e,t)=>new It(e,t);function xi(e,t,n,r){if(typeof e.setBigUint64=="function")return e.setBigUint64(t,n,r);let o=BigInt(32),s=BigInt(4294967295),i=Number(n>>o&s),c=Number(n&s),a=r?4:0,u=r?0:4;e.setUint32(t+a,i,r),e.setUint32(t+u,c,r)}function Fr(e,t,n){return e&t^~e&n}function Vr(e,t,n){return e&t^e&n^t&n}var Xe=class extends Pe{constructor(t,n,r,o){super(),this.finished=!1,this.length=0,this.pos=0,this.destroyed=!1,this.blockLen=t,this.outputLen=n,this.padOffset=r,this.isLE=o,this.buffer=new Uint8Array(t),this.view=Le(this.buffer)}update(t){Ue(this),t=ye(t),L(t);let{view:n,buffer:r,blockLen:o}=this,s=t.length;for(let i=0;i<s;){let c=Math.min(o-this.pos,s-i);if(c===o){let a=Le(t);for(;o<=s-i;i+=o)this.process(a,i);continue}r.set(t.subarray(i,i+c),this.pos),this.pos+=c,i+=c,this.pos===o&&(this.process(n,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){Ue(this),Br(t,this),this.finished=!0;let{buffer:n,view:r,blockLen:o,isLE:s}=this,{pos:i}=this;n[i++]=128,j(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(r,0),i=0);for(let p=i;p<o;p++)n[p]=0;xi(r,o-8,BigInt(this.length*8),s),this.process(r,0);let c=Le(t),a=this.outputLen;if(a%4)throw new Error("_sha2: outputLen should be aligned to 32bit");let u=a/4,f=this.get();if(u>f.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<u;p++)c.setUint32(4*p,f[p],s)}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let r=t.slice(0,n);return this.destroy(),r}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:n,buffer:r,length:o,finished:s,destroyed:i,pos:c}=this;return t.destroyed=i,t.finished=s,t.length=o,t.pos=c,o%n&&t.buffer.set(r),t}clone(){return this._cloneInto()}},le=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var G=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]);var vt=BigInt(4294967295),Wr=BigInt(32);function wi(e,t=!1){return t?{h:Number(e&vt),l:Number(e>>Wr&vt)}:{h:Number(e>>Wr&vt)|0,l:Number(e&vt)|0}}function Kr(e,t=!1){let n=e.length,r=new Uint32Array(n),o=new Uint32Array(n);for(let s=0;s<n;s++){let{h:i,l:c}=wi(e[s],t);[r[s],o[s]]=[i,c]}return[r,o]}var xn=(e,t,n)=>e>>>n,wn=(e,t,n)=>e<<32-n|t>>>n,ve=(e,t,n)=>e>>>n|t<<32-n,Re=(e,t,n)=>e<<32-n|t>>>n,Je=(e,t,n)=>e<<64-n|t>>>n-32,Qe=(e,t,n)=>e>>>n-32|t<<64-n;function oe(e,t,n,r){let o=(t>>>0)+(r>>>0);return{h:e+n+(o/2**32|0)|0,l:o|0}}var $r=(e,t,n)=>(e>>>0)+(t>>>0)+(n>>>0),jr=(e,t,n,r)=>t+n+r+(e/2**32|0)|0,zr=(e,t,n,r)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0),qr=(e,t,n,r,o)=>t+n+r+o+(e/2**32|0)|0,Yr=(e,t,n,r,o)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0)+(o>>>0),Zr=(e,t,n,r,o,s)=>t+n+r+o+s+(e/2**32|0)|0;var Ai=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),ge=new Uint32Array(64),Rt=class extends Xe{constructor(t=32){super(64,t,8,!1),this.A=le[0]|0,this.B=le[1]|0,this.C=le[2]|0,this.D=le[3]|0,this.E=le[4]|0,this.F=le[5]|0,this.G=le[6]|0,this.H=le[7]|0}get(){let{A:t,B:n,C:r,D:o,E:s,F:i,G:c,H:a}=this;return[t,n,r,o,s,i,c,a]}set(t,n,r,o,s,i,c,a){this.A=t|0,this.B=n|0,this.C=r|0,this.D=o|0,this.E=s|0,this.F=i|0,this.G=c|0,this.H=a|0}process(t,n){for(let p=0;p<16;p++,n+=4)ge[p]=t.getUint32(n,!1);for(let p=16;p<64;p++){let d=ge[p-15],h=ge[p-2],y=J(d,7)^J(d,18)^d>>>3,g=J(h,17)^J(h,19)^h>>>10;ge[p]=g+ge[p-7]+y+ge[p-16]|0}let{A:r,B:o,C:s,D:i,E:c,F:a,G:u,H:f}=this;for(let p=0;p<64;p++){let d=J(c,6)^J(c,11)^J(c,25),h=f+d+Fr(c,a,u)+Ai[p]+ge[p]|0,g=(J(r,2)^J(r,13)^J(r,22))+Vr(r,o,s)|0;f=u,u=a,a=c,c=i+h|0,i=s,s=o,o=r,r=h+g|0}r=r+this.A|0,o=o+this.B|0,s=s+this.C|0,i=i+this.D|0,c=c+this.E|0,a=a+this.F|0,u=u+this.G|0,f=f+this.H|0,this.set(r,o,s,i,c,a,u,f)}roundClean(){j(ge)}destroy(){this.set(0,0,0,0,0,0,0,0),j(this.buffer)}};var Xr=Kr(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(e=>BigInt(e))),Si=Xr[0],Ii=Xr[1],be=new Uint32Array(80),Ee=new Uint32Array(80),Tt=class extends Xe{constructor(t=64){super(128,t,16,!1),this.Ah=G[0]|0,this.Al=G[1]|0,this.Bh=G[2]|0,this.Bl=G[3]|0,this.Ch=G[4]|0,this.Cl=G[5]|0,this.Dh=G[6]|0,this.Dl=G[7]|0,this.Eh=G[8]|0,this.El=G[9]|0,this.Fh=G[10]|0,this.Fl=G[11]|0,this.Gh=G[12]|0,this.Gl=G[13]|0,this.Hh=G[14]|0,this.Hl=G[15]|0}get(){let{Ah:t,Al:n,Bh:r,Bl:o,Ch:s,Cl:i,Dh:c,Dl:a,Eh:u,El:f,Fh:p,Fl:d,Gh:h,Gl:y,Hh:g,Hl:E}=this;return[t,n,r,o,s,i,c,a,u,f,p,d,h,y,g,E]}set(t,n,r,o,s,i,c,a,u,f,p,d,h,y,g,E){this.Ah=t|0,this.Al=n|0,this.Bh=r|0,this.Bl=o|0,this.Ch=s|0,this.Cl=i|0,this.Dh=c|0,this.Dl=a|0,this.Eh=u|0,this.El=f|0,this.Fh=p|0,this.Fl=d|0,this.Gh=h|0,this.Gl=y|0,this.Hh=g|0,this.Hl=E|0}process(t,n){for(let b=0;b<16;b++,n+=4)be[b]=t.getUint32(n),Ee[b]=t.getUint32(n+=4);for(let b=16;b<80;b++){let I=be[b-15]|0,R=Ee[b-15]|0,D=ve(I,R,1)^ve(I,R,8)^xn(I,R,7),P=Re(I,R,1)^Re(I,R,8)^wn(I,R,7),v=be[b-2]|0,x=Ee[b-2]|0,k=ve(v,x,19)^Je(v,x,61)^xn(v,x,6),S=Re(v,x,19)^Qe(v,x,61)^wn(v,x,6),T=zr(P,S,Ee[b-7],Ee[b-16]),C=qr(T,D,k,be[b-7],be[b-16]);be[b]=C|0,Ee[b]=T|0}let{Ah:r,Al:o,Bh:s,Bl:i,Ch:c,Cl:a,Dh:u,Dl:f,Eh:p,El:d,Fh:h,Fl:y,Gh:g,Gl:E,Hh:m,Hl:w}=this;for(let b=0;b<80;b++){let I=ve(p,d,14)^ve(p,d,18)^Je(p,d,41),R=Re(p,d,14)^Re(p,d,18)^Qe(p,d,41),D=p&h^~p&g,P=d&y^~d&E,v=Yr(w,R,P,Ii[b],Ee[b]),x=Zr(v,m,I,D,Si[b],be[b]),k=v|0,S=ve(r,o,28)^Je(r,o,34)^Je(r,o,39),T=Re(r,o,28)^Qe(r,o,34)^Qe(r,o,39),C=r&s^r&c^s&c,_=o&i^o&a^i&a;m=g|0,w=E|0,g=h|0,E=y|0,h=p|0,y=d|0,{h:p,l:d}=oe(u|0,f|0,x|0,k|0),u=c|0,f=a|0,c=s|0,a=i|0,s=r|0,i=o|0;let U=$r(k,T,_);r=jr(U,x,S,C),o=U|0}({h:r,l:o}=oe(this.Ah|0,this.Al|0,r|0,o|0)),{h:s,l:i}=oe(this.Bh|0,this.Bl|0,s|0,i|0),{h:c,l:a}=oe(this.Ch|0,this.Cl|0,c|0,a|0),{h:u,l:f}=oe(this.Dh|0,this.Dl|0,u|0,f|0),{h:p,l:d}=oe(this.Eh|0,this.El|0,p|0,d|0),{h,l:y}=oe(this.Fh|0,this.Fl|0,h|0,y|0),{h:g,l:E}=oe(this.Gh|0,this.Gl|0,g|0,E|0),{h:m,l:w}=oe(this.Hh|0,this.Hl|0,m|0,w|0),this.set(r,o,s,i,c,a,u,f,p,d,h,y,g,E,m,w)}roundClean(){j(be,Ee)}destroy(){j(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}};var Jr=En(()=>new Rt);var Ne=En(()=>new Tt);var z=Jr;function vi(e,t,n,r){Ie(e);let o=Gr({dkLen:32,asyncTick:10},r),{c:s,dkLen:i,asyncTick:c}=o;if(q(s),q(i),q(c),s<1)throw new Error("iterations (c) should be >= 1");let a=bn(t),u=bn(n),f=new Uint8Array(i),p=ee.create(e,a),d=p._cloneInto().update(u);return{c:s,dkLen:i,asyncTick:c,DK:f,PRF:p,PRFSalt:d}}function Ri(e,t,n,r,o){return e.destroy(),t.destroy(),r&&r.destroy(),j(o),n}async function _t(e,t,n,r){let{c:o,dkLen:s,asyncTick:i,DK:c,PRF:a,PRFSalt:u}=vi(e,t,n,r),f,p=new Uint8Array(4),d=Le(p),h=new Uint8Array(a.outputLen);for(let y=1,g=0;g<s;y++,g+=a.outputLen){let E=c.subarray(g,g+a.outputLen);d.setInt32(0,y,!1),(f=u._cloneInto(f)).update(p).digestInto(h),E.set(h.subarray(0,E.length)),await Hr(o-1,i,()=>{a._cloneInto(f).update(h).digestInto(h);for(let m=0;m<E.length;m++)E[m]^=h[m]})}return Ri(a,u,c,f,h)}function Ti(e,t,n){return Ie(e),n===void 0&&(n=new Uint8Array(e.outputLen)),ee(e,ye(n),ye(t))}var kn=Uint8Array.from([0]),Qr=Uint8Array.of();function _i(e,t,n,r=32){Ie(e),q(r);let o=e.outputLen;if(r>255*o)throw new Error("Length should be <= 255*HashLen");let s=Math.ceil(r/o);n===void 0&&(n=Qr);let i=new Uint8Array(s*o),c=ee.create(e,t),a=c._cloneInto(),u=new Uint8Array(c.outputLen);for(let f=0;f<s;f++)kn[0]=f+1,a.update(f===0?Qr:u).update(n).update(kn).digestInto(u),i.set(u,o*f),c._cloneInto(a);return c.destroy(),a.destroy(),j(u,kn),i.slice(0,r)}var et=(e,t,n,r,o)=>_i(e,Ti(e,t,n),r,o);var Mi=8,Ci="hmac-sha256-v1",Oi="normalization-v1",Di="normalization-v2",Pi="pbkdf2-sha256-600k-v2",eo=6e5,tt=eo,An=32,to="[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f-\\u0084\\u0086-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180f\\u200b-\\u200f\\u202a-\\u202e\\u2060-\\u2064\\u2066-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]",Ui=new RegExp(to,"g"),no="\\u001b(?:\\[[0-?]*[ -/]*[@-~]|\\][^\\u0007\\u001b]{0,512}(?:\\u0007|\\u001b\\\\))",Li=new RegExp(no,"g");function Sn(e){let t=e.includes("\x1B")?e.replace(Li,""):e;return t=t.normalize("NFC"),t=t.replace(/\r\n/g,`
 `).replace(/[\r\u2028\u2029]/g,`
-`),t=t.replace(Ta,""),t=t.trim(),t}function et(e){if(e.length===36&&e[8]==="-"&&e[13]==="-"&&e[18]==="-"&&e[23]==="-"){let t=e.replace(/-/g,"");if(/^[0-9a-fA-F]{32}$/.test(t))return e.toLowerCase()}return e}function At(e){return et(En(e))}function tt(e){return En(e).replace(/\s/g,"")}function _a(e,t){return St(et(tt(e)),t)}function It(e){return tt(e).toLowerCase()}function Ma(e,t){return St(It(e),t)}function St(e,t){return K(ee($,t,C(e)))}function Ca(e,t){return St(At(e),t)}async function Oa(e,t){let n=C(e),r=$(C(t));return wt($,n,r,{c:Zr,dkLen:bn})}var Jr="redaktyn-project-key-v1",Da=C(Jr);function Pa(e,t){if(e.length!==bn)throw new Error("deriveProjectKey: org key must be 32 bytes");if(!t)throw new Error("deriveProjectKey: projectId is required");return kt($,e,C(t),Da,bn)}var Qr="vaultx-passphrase-verify-v1",Ua=C(Qr);function xn(e){return K(ee($,e,Ua))}function La(){return crypto.getRandomValues(new Uint8Array(32))}function Ba(e){return K(e)}function Na(e){return Q(e)}function wn(e){return e.length<12?{ok:!1,error:"Passphrase must be at least 12 characters."}:/[A-Z]/.test(e)?/[a-z]/.test(e)?/[0-9]/.test(e)?/[^A-Za-z0-9]/.test(e)?{ok:!0}:{ok:!1,error:"Passphrase must include at least one special character (e.g. !@#$%)."}:{ok:!1,error:"Passphrase must include at least one number."}:{ok:!1,error:"Passphrase must include at least one lowercase letter."}:{ok:!1,error:"Passphrase must include at least one uppercase letter."}}var to=["password","passphrase","letmein","welcome","monkey","dragon","qwerty","qwertyuiop","asdfgh","zxcvbn","iloveyou","sunshine","princess","football","baseball","superman","batman","master","shadow","michael","jennifer","trustno","starwars","whatever","freedom","computer","internet","samsung","google","facebook","admin","administrator","root","changeme","secret","default","login","abc","test","temp","demo","company","corporate"];function no(e){return e.toLowerCase().replace(/[@4]/g,"a").replace(/[3]/g,"e").replace(/[1!|]/g,"i").replace(/[0]/g,"o").replace(/[5$]/g,"s").replace(/[7]/g,"t")}function Ha(e){let t=e.toLowerCase();if(/^(.)\1+$/.test(t))return!0;let n=["abcdefghijklmnopqrstuvwxyz","0123456789","qwertyuiopasdfghjklzxcvbnm"],r=t.replace(/[^a-z0-9]/g,"");if(r.length>=6){for(let o of n)if(o.includes(r)||[...o].reverse().join("").includes(r))return!0}return!1}function nt(e){let t=wn(e);if(!t.ok)return t;let r=no(e).replace(/[^a-z]/g,"");for(let o of to)if(r===o||r.startsWith(o)||r.endsWith(o))return{ok:!1,error:"That passphrase is built on a word attackers try first, so it would fall to the first few guesses \u2014 pick something unrelated to a common word."};return Ha(e)?{ok:!1,error:"That passphrase is a repeated character or a keyboard sequence. Pick something without a predictable pattern."}:new Set(e).size<8?{ok:!1,error:"That passphrase reuses too few distinct characters. Use at least eight different ones."}:{ok:!0}}var vt=13,Ga=`You are choosing the passphrase that protects every secret in this workspace. Every guess at it has to go through our server, which allows only a few at a time, but someone who took over our server could guess offline without that limit. Make it very strong: at least ${vt} characters (20 or more is better), never used anywhere else, mixing upper and lower case, numbers and symbols through it rather than at the end. Nobody, including Redaktyn, can reset it.`,Fa=["redaktyn","workspace","summer","winter","spring","autumn","hello","love","money","office","user"],eo=6,Va=["abcdefghijklmnopqrstuvwxyz","1234567890","qwertyuiop","asdfghjkl","zxcvbnm"];function Ka(e,t){let n=e.toLowerCase(),r=Va.flatMap(o=>[o,[...o].reverse().join("")]);for(let o=0;o+t<=n.length;o++){let s=n.slice(o,o+t);if(r.some(a=>a.includes(s)))return!0}return!1}function kn(e){if(e.length<vt)return{ok:!1,error:`Your own passphrase must be at least ${vt} characters. Longer is stronger: 20 or more is better.`};if(e!==e.trim())return{ok:!1,error:"The passphrase cannot start or end with a space. It is too easy to lose when you type it again."};if(/^[=+\-@]/.test(e))return{ok:!1,error:"The passphrase cannot start with =, +, - or @."};let t=wn(e);if(!t.ok)return t;let n=no(e).replace(/[^a-z]/g,"");for(let o of[...to,...Fa])if(n.includes(o))return{ok:!1,error:`That passphrase contains "${o}" (or a look-alike), which attackers try first. Leave common words out entirely.`};if(/(.)\1\1/.test(e.toLowerCase()))return{ok:!1,error:"That passphrase repeats a character three times in a row."};if(Ka(e,4))return{ok:!1,error:"That passphrase contains a sequence like abcd, 1234 or qwer. Leave predictable runs out."};if(/(^|\D)(19|20)\d\d(\D|$)/.test(e))return{ok:!1,error:"That passphrase contains what looks like a year. Dates are among the first things guessed."};let r=/^[A-Za-z]+([^A-Za-z]+)$/.exec(e)??/^([^A-Za-z]+)[A-Za-z]+$/.exec(e);return r&&r[1].length<eo?{ok:!1,error:`That passphrase is letters with only a few numbers or symbols added at one end, the first pattern attackers try. Mix them through it, or add at least ${eo}.`}:new Set(e).size<10?{ok:!1,error:"That passphrase reuses too few characters. Use at least ten different ones."}:{ok:!0}}var Wa="ABCDEFGHJKLMNPQRSTUVWXYZ",za="abcdefghijkmnpqrstuvwxyz",qa="23456789",Tt=Wa+za+qa,ro=5,An=5,ja=128;function $a(e){let t=256-256%e,n=new Uint8Array(1);for(;;){globalThis.crypto.getRandomValues(n);let r=n[0]??255;if(r<t)return r%e}}function Ya(){let e=[];for(let t=0;t<ro;t++){let n="";for(let r=0;r<An;r++)n+=Tt[$a(Tt.length)];e.push(n)}return e.join("-")}function Za(){for(;;){let e=Ya();if(!(!/[A-Z]/.test(e)||!/[a-z]/.test(e)||!/[0-9]/.test(e))&&nt(e).ok)return e}}function Xa(e,t){return["Redaktyn workspace passphrase","",e,"",`Created ${t.toISOString().slice(0,10)}.`,"","This passphrase derives the key your workspace's fingerprints are made with.","Redaktyn never receives it, so nobody can reset it for you.","Move it into a password manager or a safe, then delete this file.",""].join(`
-`)}var Rt="Redaktyn workspace",In="https://passphrase.redaktyn.invalid/";function Ja(e){return`"${e.replace(/"/g,'""')}"`}function Qa(e){let t="Redaktyn workspace passphrase. Nobody can reset it. Delete this file after importing it.";for(let n of[Rt,In,e,t])if(/^[=+\-@\t\r]/.test(n))throw new Error("A password-manager file field cannot start with a formula character");return["name,url,username,password,note",[Rt,In,Rt,e,t].map(Ja).join(","),""].join(`
-`)}var oo='A new workspace needs a generated passphrase here: a generated one cannot be guessed, and one a person makes up often can. Use "Generate" to create one.',ei=new RegExp(`^[${Tt}]{${An}}(?:-[${Tt}]{${An}}){${ro-1}}$`),ti=12;function Sn(e){if(!ei.test(e))return!1;let t=e.replace(/-/g,"");return new Set(t).size>=ti}function ni(e){return Sn(e)?nt(e):{ok:!1,error:oo}}function ri(e){return Sn(e)?nt(e):kn(e)}function so(e){return!e||typeof e!="object"?!1:e.version===2}function ao(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.encryptedKey=="string"&&t.encryptedKey.length>0&&typeof t.iv=="string"&&t.iv.length>0&&typeof t.salt=="string"&&t.salt.length>0}function oi(e){return so(e)?e:ao(e)?{version:2,passphrase:e}:null}function rt(e){let t=new ArrayBuffer(e.byteLength);return new Uint8Array(t).set(e),t}function vn(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function Rn(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function io(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}var _t=32,si=256,ai=12;function ii(){return io(_t)}async function co(e){if(e.byteLength===0)throw new Error("PRF output is empty");let t=await crypto.subtle.digest("SHA-256",rt(e));return crypto.subtle.importKey("raw",t,{name:"AES-GCM",length:si},!1,["encrypt","decrypt"])}async function ci(e,t,n,r,o){if(e.byteLength!==32)throw new Error("HMAC key must be 32 bytes");if(t.byteLength!==_t)throw new Error("PRF output must be 32 bytes");if(n.byteLength!==_t)throw new Error("PRF salt must be 32 bytes");if(!r)throw new Error("credentialId is required");let s=await co(t),a=io(ai),c=await crypto.subtle.encrypt({name:"AES-GCM",iv:rt(a)},s,rt(e)),i={credentialId:r,prfSalt:vn(n),iv:vn(a),ciphertext:vn(new Uint8Array(c)),createdAt:Date.now()};return o&&o.trim().length>0&&(i.label=o.trim().slice(0,64)),i}async function li(e,t){if(t.byteLength!==_t)throw new Error("PRF output must be 32 bytes");let n=await co(t),r=Rn(e.iv),o=Rn(e.ciphertext),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:rt(r)},n,rt(o)),a=new Uint8Array(s);if(a.byteLength!==32)throw a.fill(0),new Error("Invalid HMAC key material");return a}function di(e){return Rn(e.prfSalt)}function ui(e,t){let r=(e?.passkey??[]).filter(o=>o.credentialId!==t.credentialId);return{version:2,passphrase:e?.passphrase,passkey:[...r,t]}}function fi(e,t){let n=e?.passkey??[];return{version:2,passphrase:e?.passphrase,passkey:n.filter(r=>r.credentialId!==t)}}function pi(e,t){return e?.passkey?.find(n=>n.credentialId===t)}var Mn=BigInt(0),_n=BigInt(1);function Mt(e,t=""){if(typeof e!="boolean"){let n=t&&`"${t}"`;throw new Error(n+"expected boolean, got type="+typeof e)}return e}function ot(e,t,n=""){let r=re(e),o=e?.length,s=t!==void 0;if(!r||s&&o!==t){let a=n&&`"${n}" `,c=s?` of length ${t}`:"",i=r?`length=${o}`:`type=${typeof e}`;throw new Error(a+"expected Uint8Array"+c+", got "+i)}return e}function Cn(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?Mn:BigInt("0x"+e)}function st(e){return Cn(K(e))}function Y(e){return L(e),Cn(K(Uint8Array.from(e).reverse()))}function He(e,t){return Q(e.toString(16).padStart(t*2,"0"))}function Ct(e,t){return He(e,t).reverse()}function W(e,t,n){let r;if(typeof t=="string")try{r=Q(t)}catch(s){throw new Error(e+" must be hex string or Uint8Array, cause: "+s)}else if(re(t))r=Uint8Array.from(t);else throw new Error(e+" must be hex string or Uint8Array");let o=r.length;if(typeof n=="number"&&o!==n)throw new Error(e+" of length "+n+" expected, got "+o);return r}function On(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function Ot(e){return Uint8Array.from(e)}var Tn=e=>typeof e=="bigint"&&Mn<=e;function lo(e,t,n){return Tn(e)&&Tn(t)&&Tn(n)&&t<=e&&e<n}function Dt(e,t,n,r){if(!lo(t,n,r))throw new Error("expected valid "+e+": "+n+" <= n < "+r+", got "+t)}function Dn(e){let t;for(t=0;e>Mn;e>>=_n,t+=1);return t}var Ge=e=>(_n<<BigInt(e))-_n;function Fe(e,t,n={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function r(o,s,a){let c=e[o];if(a&&c===void 0)return;let i=typeof c;if(i!==s||c===null)throw new Error(`param "${o}" is invalid: expected ${s}, got ${i}`)}Object.entries(t).forEach(([o,s])=>r(o,s,!1)),Object.entries(n).forEach(([o,s])=>r(o,s,!0))}var Pt=()=>{throw new Error("not implemented")};function Ut(e){let t=new WeakMap;return(n,...r)=>{let o=t.get(n);if(o!==void 0)return o;let s=e(n,...r);return t.set(n,s),s}}var V=BigInt(0),N=BigInt(1),Te=BigInt(2),po=BigInt(3),ho=BigInt(4),mo=BigInt(5),yi=BigInt(7),yo=BigInt(8),gi=BigInt(9),go=BigInt(16);function O(e,t){let n=e%t;return n>=V?n:t+n}function te(e,t,n){let r=e;for(;t-- >V;)r*=r,r%=n;return r}function uo(e,t){if(e===V)throw new Error("invert: expected non-zero number");if(t<=V)throw new Error("invert: expected positive modulus, got "+t);let n=O(e,t),r=t,o=V,s=N,a=N,c=V;for(;n!==V;){let u=r/n,f=r%n,p=o-a*u,d=s-c*u;r=n,n=f,o=a,s=c,a=p,c=d}if(r!==N)throw new Error("invert: does not exist");return O(o,t)}function Pn(e,t,n){if(!e.eql(e.sqr(t),n))throw new Error("Cannot find square root")}function bo(e,t){let n=(e.ORDER+N)/ho,r=e.pow(t,n);return Pn(e,r,t),r}function bi(e,t){let n=(e.ORDER-mo)/yo,r=e.mul(t,Te),o=e.pow(r,n),s=e.mul(t,o),a=e.mul(e.mul(s,Te),o),c=e.mul(s,e.sub(a,e.ONE));return Pn(e,c,t),c}function Ei(e){let t=ue(e),n=Eo(e),r=n(t,t.neg(t.ONE)),o=n(t,r),s=n(t,t.neg(r)),a=(e+yi)/go;return(c,i)=>{let u=c.pow(i,a),f=c.mul(u,r),p=c.mul(u,o),d=c.mul(u,s),h=c.eql(c.sqr(f),i),y=c.eql(c.sqr(p),i);u=c.cmov(u,f,h),f=c.cmov(d,p,y);let g=c.eql(c.sqr(f),i),E=c.cmov(u,f,g);return Pn(c,E,i),E}}function Eo(e){if(e<po)throw new Error("sqrt is not defined for small field");let t=e-N,n=0;for(;t%Te===V;)t/=Te,n++;let r=Te,o=ue(e);for(;fo(o,r)===1;)if(r++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(n===1)return bo;let s=o.pow(r,t),a=(t+N)/Te;return function(i,u){if(i.is0(u))return u;if(fo(i,u)!==1)throw new Error("Cannot find square root");let f=n,p=i.mul(i.ONE,s),d=i.pow(u,t),h=i.pow(u,a);for(;!i.eql(d,i.ONE);){if(i.is0(d))return i.ZERO;let y=1,g=i.sqr(d);for(;!i.eql(g,i.ONE);)if(y++,g=i.sqr(g),y===f)throw new Error("Cannot find square root");let E=N<<BigInt(f-y-1),m=i.pow(p,E);f=y,p=i.sqr(m),d=i.mul(d,p),h=i.mul(h,m)}return h}}function xi(e){return e%ho===po?bo:e%yo===mo?bi:e%go===gi?Ei(e):Eo(e)}var de=(e,t)=>(O(e,t)&N)===N,wi=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function xo(e){let t={ORDER:"bigint",MASK:"bigint",BYTES:"number",BITS:"number"},n=wi.reduce((r,o)=>(r[o]="function",r),t);return Fe(e,n),e}function ki(e,t,n){if(n<V)throw new Error("invalid exponent, negatives unsupported");if(n===V)return e.ONE;if(n===N)return t;let r=e.ONE,o=t;for(;n>V;)n&N&&(r=e.mul(r,o)),o=e.sqr(o),n>>=N;return r}function Lt(e,t,n=!1){let r=new Array(t.length).fill(n?e.ZERO:void 0),o=t.reduce((a,c,i)=>e.is0(c)?a:(r[i]=a,e.mul(a,c)),e.ONE),s=e.inv(o);return t.reduceRight((a,c,i)=>e.is0(c)?a:(r[i]=e.mul(a,r[i]),e.mul(a,c)),s),r}function fo(e,t){let n=(e.ORDER-N)/Te,r=e.pow(t,n),o=e.eql(r,e.ONE),s=e.eql(r,e.ZERO),a=e.eql(r,e.neg(e.ONE));if(!o&&!s&&!a)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function wo(e,t){t!==void 0&&j(t);let n=t!==void 0?t:e.toString(2).length,r=Math.ceil(n/8);return{nBitLength:n,nByteLength:r}}function ue(e,t,n=!1,r={}){if(e<=V)throw new Error("invalid field: expected ORDER > 0, got "+e);let o,s,a=!1,c;if(typeof t=="object"&&t!=null){if(r.sqrt||n)throw new Error("cannot specify opts in two arguments");let d=t;d.BITS&&(o=d.BITS),d.sqrt&&(s=d.sqrt),typeof d.isLE=="boolean"&&(n=d.isLE),typeof d.modFromBytes=="boolean"&&(a=d.modFromBytes),c=d.allowedLengths}else typeof t=="number"&&(o=t),r.sqrt&&(s=r.sqrt);let{nBitLength:i,nByteLength:u}=wo(e,o);if(u>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");let f,p=Object.freeze({ORDER:e,isLE:n,BITS:i,BYTES:u,MASK:Ge(i),ZERO:V,ONE:N,allowedLengths:c,create:d=>O(d,e),isValid:d=>{if(typeof d!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof d);return V<=d&&d<e},is0:d=>d===V,isValidNot0:d=>!p.is0(d)&&p.isValid(d),isOdd:d=>(d&N)===N,neg:d=>O(-d,e),eql:(d,h)=>d===h,sqr:d=>O(d*d,e),add:(d,h)=>O(d+h,e),sub:(d,h)=>O(d-h,e),mul:(d,h)=>O(d*h,e),pow:(d,h)=>ki(p,d,h),div:(d,h)=>O(d*uo(h,e),e),sqrN:d=>d*d,addN:(d,h)=>d+h,subN:(d,h)=>d-h,mulN:(d,h)=>d*h,inv:d=>uo(d,e),sqrt:s||(d=>(f||(f=xi(e)),f(p,d))),toBytes:d=>n?Ct(d,u):He(d,u),fromBytes:(d,h=!0)=>{if(c){if(!c.includes(d.length)||d.length>u)throw new Error("Field.fromBytes: expected "+c+" bytes, got "+d.length);let g=new Uint8Array(u);g.set(d,n?0:g.length-d.length),d=g}if(d.length!==u)throw new Error("Field.fromBytes: expected "+u+" bytes, got "+d.length);let y=n?Y(d):st(d);if(a&&(y=O(y,e)),!h&&!p.isValid(y))throw new Error("invalid field element: outside of range 0..ORDER");return y},invertBatch:d=>Lt(p,d),cmov:(d,h,y)=>y?h:d});return Object.freeze(p)}function ko(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function Un(e){let t=ko(e);return t+Math.ceil(t/2)}function Ao(e,t,n=!1){let r=e.length,o=ko(t),s=Un(t);if(r<16||r<s||r>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+r);let a=n?Y(e):st(e),c=O(a,t-N)+N;return n?Ct(c,o):He(c,o)}var Bt=BigInt(0),Hn=BigInt(1);function Io(e,t){let n=t.negate();return e?n:t}function at(e,t){let n=Lt(e.Fp,t.map(r=>r.Z));return t.map((r,o)=>e.fromAffine(r.toAffine(n[o])))}function To(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function Ln(e,t){To(e,t);let n=Math.ceil(t/e)+1,r=2**(e-1),o=2**e,s=Ge(e),a=BigInt(e);return{windows:n,windowSize:r,mask:s,maxNumber:o,shiftBy:a}}function So(e,t,n){let{windowSize:r,mask:o,maxNumber:s,shiftBy:a}=n,c=Number(e&o),i=e>>a;c>r&&(c-=s,i+=Hn);let u=t*r,f=u+Math.abs(c)-1,p=c===0,d=c<0,h=t%2!==0;return{nextN:i,offset:f,isZero:p,isNeg:d,isNegF:h,offsetF:u}}function Ii(e,t){if(!Array.isArray(e))throw new Error("array expected");e.forEach((n,r)=>{if(!(n instanceof t))throw new Error("invalid point at index "+r)})}function Si(e,t){if(!Array.isArray(e))throw new Error("array of scalars expected");e.forEach((n,r)=>{if(!t.isValid(n))throw new Error("invalid scalar at index "+r)})}var Bn=new WeakMap,_o=new WeakMap;function Nn(e){return _o.get(e)||1}function vo(e){if(e!==Bt)throw new Error("invalid wNAF")}var Nt=class{constructor(t,n){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=n}_unsafeLadder(t,n,r=this.ZERO){let o=t;for(;n>Bt;)n&Hn&&(r=r.add(o)),o=o.double(),n>>=Hn;return r}precomputeWindow(t,n){let{windows:r,windowSize:o}=Ln(n,this.bits),s=[],a=t,c=a;for(let i=0;i<r;i++){c=a,s.push(c);for(let u=1;u<o;u++)c=c.add(a),s.push(c);a=c.double()}return s}wNAF(t,n,r){if(!this.Fn.isValid(r))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,a=Ln(t,this.bits);for(let c=0;c<a.windows;c++){let{nextN:i,offset:u,isZero:f,isNeg:p,isNegF:d,offsetF:h}=So(r,c,a);r=i,f?s=s.add(Io(d,n[h])):o=o.add(Io(p,n[u]))}return vo(r),{p:o,f:s}}wNAFUnsafe(t,n,r,o=this.ZERO){let s=Ln(t,this.bits);for(let a=0;a<s.windows&&r!==Bt;a++){let{nextN:c,offset:i,isZero:u,isNeg:f}=So(r,a,s);if(r=c,!u){let p=n[i];o=o.add(f?p.negate():p)}}return vo(r),o}getPrecomputes(t,n,r){let o=Bn.get(n);return o||(o=this.precomputeWindow(n,t),t!==1&&(typeof r=="function"&&(o=r(o)),Bn.set(n,o))),o}cached(t,n,r){let o=Nn(t);return this.wNAF(o,this.getPrecomputes(o,t,r),n)}unsafe(t,n,r,o){let s=Nn(t);return s===1?this._unsafeLadder(t,n,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,r),n,o)}createCache(t,n){To(n,this.bits),_o.set(t,n),Bn.delete(t)}hasCache(t){return Nn(t)!==1}};function Ht(e,t,n,r){Ii(n,e),Si(r,t);let o=n.length,s=r.length;if(o!==s)throw new Error("arrays of points and scalars must have equal length");let a=e.ZERO,c=Dn(BigInt(o)),i=1;c>12?i=c-3:c>4?i=c-2:c>0&&(i=2);let u=Ge(i),f=new Array(Number(u)+1).fill(a),p=Math.floor((t.BITS-1)/i)*i,d=a;for(let h=p;h>=0;h-=i){f.fill(a);for(let g=0;g<s;g++){let E=r[g],m=Number(E>>BigInt(h)&u);f[m]=f[m].add(n[g])}let y=a;for(let g=f.length-1,E=a;g>0;g--)E=E.add(f[g]),y=y.add(E);if(d=d.add(y),h!==0)for(let g=0;g<i;g++)d=d.double()}return d}function Ro(e,t,n){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return xo(t),t}else return ue(e,{isLE:n})}function Mo(e,t,n={},r){if(r===void 0&&(r=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let i of["p","n","h"]){let u=t[i];if(!(typeof u=="bigint"&&u>Bt))throw new Error(`CURVE.${i} must be positive bigint`)}let o=Ro(t.p,n.Fp,r),s=Ro(t.n,n.Fn,r),c=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let i of c)if(!o.isValid(t[i]))throw new Error(`CURVE.${i} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}var xe=BigInt(0),H=BigInt(1),Gn=BigInt(2),vi=BigInt(8);function Ri(e,t,n,r){let o=e.sqr(n),s=e.sqr(r),a=e.add(e.mul(t.a,o),s),c=e.add(e.ONE,e.mul(t.d,e.mul(o,s)));return e.eql(a,c)}function Ti(e,t={}){let n=Mo("edwards",e,t,t.FpFnLE),{Fp:r,Fn:o}=n,s=n.CURVE,{h:a}=s;Fe(t,{},{uvRatio:"function"});let c=Gn<<BigInt(o.BYTES*8)-H,i=E=>r.create(E),u=t.uvRatio||((E,m)=>{try{return{isValid:!0,value:r.sqrt(r.div(E,m))}}catch{return{isValid:!1,value:xe}}});if(!Ri(r,s,s.Gx,s.Gy))throw new Error("bad curve params: generator point");function f(E,m,w=!1){let b=w?H:xe;return Dt("coordinate "+E,m,b,c),m}function p(E){if(!(E instanceof y))throw new Error("ExtendedPoint expected")}let d=Ut((E,m)=>{let{X:w,Y:b,Z:S}=E,R=E.is0();m==null&&(m=R?vi:r.inv(S));let D=i(w*m),P=i(b*m),v=r.mul(S,m);if(R)return{x:xe,y:H};if(v!==H)throw new Error("invZ was invalid");return{x:D,y:P}}),h=Ut(E=>{let{a:m,d:w}=s;if(E.is0())throw new Error("bad point: ZERO");let{X:b,Y:S,Z:R,T:D}=E,P=i(b*b),v=i(S*S),x=i(R*R),k=i(x*x),I=i(P*m),T=i(x*i(I+v)),M=i(k+i(w*i(P*v)));if(T!==M)throw new Error("bad point: equation left != right (1)");let _=i(b*S),U=i(R*D);if(_!==U)throw new Error("bad point: equation left != right (2)");return!0});class y{constructor(m,w,b,S){this.X=f("x",m),this.Y=f("y",w),this.Z=f("z",b,!0),this.T=f("t",S),Object.freeze(this)}static CURVE(){return s}static fromAffine(m){if(m instanceof y)throw new Error("extended point not allowed");let{x:w,y:b}=m||{};return f("x",w),f("y",b),new y(w,b,H,i(w*b))}static fromBytes(m,w=!1){let b=r.BYTES,{a:S,d:R}=s;m=Ot(ot(m,b,"point")),Mt(w,"zip215");let D=Ot(m),P=m[b-1];D[b-1]=P&-129;let v=Y(D),x=w?c:r.ORDER;Dt("point.y",v,xe,x);let k=i(v*v),I=i(k-H),T=i(R*k-S),{isValid:M,value:_}=u(I,T);if(!M)throw new Error("bad point: invalid y coordinate");let U=(_&H)===H,z=(P&128)!==0;if(!w&&_===xe&&z)throw new Error("bad point: x=0 and x_0=1");return z!==U&&(_=i(-_)),y.fromAffine({x:_,y:v})}static fromHex(m,w=!1){return y.fromBytes(W("point",m),w)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(m=8,w=!0){return g.createCache(this,m),w||this.multiply(Gn),this}assertValidity(){h(this)}equals(m){p(m);let{X:w,Y:b,Z:S}=this,{X:R,Y:D,Z:P}=m,v=i(w*P),x=i(R*S),k=i(b*P),I=i(D*S);return v===x&&k===I}is0(){return this.equals(y.ZERO)}negate(){return new y(i(-this.X),this.Y,this.Z,i(-this.T))}double(){let{a:m}=s,{X:w,Y:b,Z:S}=this,R=i(w*w),D=i(b*b),P=i(Gn*i(S*S)),v=i(m*R),x=w+b,k=i(i(x*x)-R-D),I=v+D,T=I-P,M=v-D,_=i(k*T),U=i(I*M),z=i(k*M),me=i(T*I);return new y(_,U,me,z)}add(m){p(m);let{a:w,d:b}=s,{X:S,Y:R,Z:D,T:P}=this,{X:v,Y:x,Z:k,T:I}=m,T=i(S*v),M=i(R*x),_=i(P*b*I),U=i(D*k),z=i((S+R)*(v+x)-T-M),me=U-_,ke=U+_,ae=i(M-w*T),je=i(z*me),ht=i(ke*ae),nn=i(z*ae),gr=i(me*ke);return new y(je,ht,gr,nn)}subtract(m){return this.add(m.negate())}multiply(m){if(!o.isValidNot0(m))throw new Error("invalid scalar: expected 1 <= sc < curve.n");let{p:w,f:b}=g.cached(this,m,S=>at(y,S));return at(y,[w,b])[0]}multiplyUnsafe(m,w=y.ZERO){if(!o.isValid(m))throw new Error("invalid scalar: expected 0 <= sc < curve.n");return m===xe?y.ZERO:this.is0()||m===H?this:g.unsafe(this,m,b=>at(y,b),w)}isSmallOrder(){return this.multiplyUnsafe(a).is0()}isTorsionFree(){return g.unsafe(this,s.n).is0()}toAffine(m){return d(this,m)}clearCofactor(){return a===H?this:this.multiplyUnsafe(a)}toBytes(){let{x:m,y:w}=this.toAffine(),b=r.toBytes(w);return b[b.length-1]|=m&H?128:0,b}toHex(){return K(this.toBytes())}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}get ex(){return this.X}get ey(){return this.Y}get ez(){return this.Z}get et(){return this.T}static normalizeZ(m){return at(y,m)}static msm(m,w){return Ht(y,o,m,w)}_setWindowSize(m){this.precompute(m)}toRawBytes(){return this.toBytes()}}y.BASE=new y(s.Gx,s.Gy,H,i(s.Gx*s.Gy)),y.ZERO=new y(xe,H,H,xe),y.Fp=r,y.Fn=o;let g=new Nt(y,o.BITS);return y.BASE.precompute(8),y}var Gt=class{constructor(t){this.ep=t}static fromBytes(t){Pt()}static fromHex(t){Pt()}get x(){return this.toAffine().x}get y(){return this.toAffine().y}clearCofactor(){return this}assertValidity(){this.ep.assertValidity()}toAffine(t){return this.ep.toAffine(t)}toHex(){return K(this.toBytes())}toString(){return this.toHex()}isTorsionFree(){return!0}isSmallOrder(){return!1}add(t){return this.assertSame(t),this.init(this.ep.add(t.ep))}subtract(t){return this.assertSame(t),this.init(this.ep.subtract(t.ep))}multiply(t){return this.init(this.ep.multiply(t))}multiplyUnsafe(t){return this.init(this.ep.multiplyUnsafe(t))}double(){return this.init(this.ep.double())}negate(){return this.init(this.ep.negate())}precompute(t,n){return this.init(this.ep.precompute(t,n))}toRawBytes(){return this.toBytes()}};function _i(e,t,n={}){if(typeof t!="function")throw new Error('"hash" function param is required');Fe(n,{},{adjustScalarBytes:"function",randomBytes:"function",domain:"function",prehash:"function",mapToCurve:"function"});let{prehash:r}=n,{BASE:o,Fp:s,Fn:a}=e,c=n.randomBytes||Be,i=n.adjustScalarBytes||(x=>x),u=n.domain||((x,k,I)=>{if(Mt(I,"phflag"),k.length||I)throw new Error("Contexts/pre-hash are not supported");return x});function f(x){return a.create(Y(x))}function p(x){let k=b.secretKey;x=W("private key",x,k);let I=W("hashed private key",t(x),2*k),T=i(I.slice(0,k)),M=I.slice(k,2*k),_=f(T);return{head:T,prefix:M,scalar:_}}function d(x){let{head:k,prefix:I,scalar:T}=p(x),M=o.multiply(T),_=M.toBytes();return{head:k,prefix:I,scalar:T,point:M,pointBytes:_}}function h(x){return d(x).pointBytes}function y(x=Uint8Array.of(),...k){let I=B(...k);return f(t(u(I,W("context",x),!!r)))}function g(x,k,I={}){x=W("message",x),r&&(x=r(x));let{prefix:T,scalar:M,pointBytes:_}=d(k),U=y(I.context,T,x),z=o.multiply(U).toBytes(),me=y(I.context,z,_,x),ke=a.create(U+me*M);if(!a.isValid(ke))throw new Error("sign failed: invalid s");let ae=B(z,a.toBytes(ke));return ot(ae,b.signature,"result")}let E={zip215:!0};function m(x,k,I,T=E){let{context:M,zip215:_}=T,U=b.signature;x=W("signature",x,U),k=W("message",k),I=W("publicKey",I,b.publicKey),_!==void 0&&Mt(_,"zip215"),r&&(k=r(k));let z=U/2,me=x.subarray(0,z),ke=Y(x.subarray(z,U)),ae,je,ht;try{ae=e.fromBytes(I,_),je=e.fromBytes(me,_),ht=o.multiplyUnsafe(ke)}catch{return!1}if(!_&&ae.isSmallOrder())return!1;let nn=y(M,je.toBytes(),ae.toBytes(),k);return je.add(ae.multiplyUnsafe(nn)).subtract(ht).clearCofactor().is0()}let w=s.BYTES,b={secretKey:w,publicKey:w,signature:2*w,seed:w};function S(x=c(b.seed)){return ot(x,b.seed,"seed")}function R(x){let k=v.randomSecretKey(x);return{secretKey:k,publicKey:h(k)}}function D(x){return re(x)&&x.length===a.BYTES}function P(x,k){try{return!!e.fromBytes(x,k)}catch{return!1}}let v={getExtendedPublicKey:d,randomSecretKey:S,isValidSecretKey:D,isValidPublicKey:P,toMontgomery(x){let{y:k}=e.fromBytes(x),I=b.publicKey,T=I===32;if(!T&&I!==57)throw new Error("only defined for 25519 and 448");let M=T?s.div(H+k,H-k):s.div(k-H,k+H);return s.toBytes(M)},toMontgomerySecret(x){let k=b.secretKey;ot(x,k);let I=t(x.subarray(0,k));return i(I).subarray(0,k)},randomPrivateKey:S,precompute(x=8,k=e.BASE){return k.precompute(x,!1)}};return Object.freeze({keygen:R,getPublicKey:h,sign:g,verify:m,utils:v,Point:e,lengths:b})}function Mi(e){let t={a:e.a,d:e.d,p:e.Fp.ORDER,n:e.n,h:e.h,Gx:e.Gx,Gy:e.Gy},n=e.Fp,r=ue(t.n,e.nBitLength,!0),o={Fp:n,Fn:r,uvRatio:e.uvRatio},s={randomBytes:e.randomBytes,adjustScalarBytes:e.adjustScalarBytes,domain:e.domain,prehash:e.prehash,mapToCurve:e.mapToCurve};return{CURVE:t,curveOpts:o,hash:e.hash,eddsaOpts:s}}function Ci(e,t){let n=t.Point;return Object.assign({},t,{ExtendedPoint:n,CURVE:e,nBitLength:n.Fn.BITS,nByteLength:n.Fn.BYTES})}function Co(e){let{CURVE:t,curveOpts:n,hash:r,eddsaOpts:o}=Mi(e),s=Ti(t,n),a=_i(s,r,o);return Ci(e,a)}function Ve(e,t){if(Fn(e),Fn(t),e<0||e>=1<<8*t)throw new Error("invalid I2OSP input: "+e);let n=Array.from({length:t}).fill(0);for(let r=t-1;r>=0;r--)n[r]=e&255,e>>>=8;return new Uint8Array(n)}function Di(e,t){let n=new Uint8Array(e.length);for(let r=0;r<e.length;r++)n[r]=e[r]^t[r];return n}function Fn(e){if(!Number.isSafeInteger(e))throw new Error("number expected")}function Pi(e){if(!re(e)&&typeof e!="string")throw new Error("DST must be Uint8Array or string");return typeof e=="string"?C(e):e}function Vn(e,t,n,r){L(e),Fn(n),t=Pi(t),t.length>255&&(t=r(B(C("H2C-OVERSIZE-DST-"),t)));let{outputLen:o,blockLen:s}=r,a=Math.ceil(n/o);if(n>65535||a>255)throw new Error("expand_message_xmd: invalid lenInBytes");let c=B(t,Ve(t.length,1)),i=Ve(0,s),u=Ve(n,2),f=new Array(a),p=r(B(i,e,u,Ve(0,1),c));f[0]=r(B(p,Ve(1,1),c));for(let h=1;h<=a;h++){let y=[Di(p,f[h-1]),Ve(h+1,1),c];f[h]=r(B(...y))}return B(...f).slice(0,n)}var Oo=C("HashToScalar-");var Ui=BigInt(0),fe=BigInt(1),Do=BigInt(2),wd=BigInt(3),Li=BigInt(5),Bi=BigInt(8),Ke=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),it={p:Ke,n:BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),h:Bi,a:BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),d:BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),Gx:BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),Gy:BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")};function Ni(e){let t=BigInt(10),n=BigInt(20),r=BigInt(40),o=BigInt(80),s=Ke,c=e*e%s*e%s,i=te(c,Do,s)*c%s,u=te(i,fe,s)*e%s,f=te(u,Li,s)*u%s,p=te(f,t,s)*f%s,d=te(p,n,s)*p%s,h=te(d,r,s)*d%s,y=te(h,o,s)*h%s,g=te(y,o,s)*h%s,E=te(g,t,s)*f%s;return{pow_p_5_8:te(E,Do,s)*e%s,b2:c}}function Hi(e){return e[0]&=248,e[31]&=127,e[31]|=64,e}var Kn=BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");function qn(e,t){let n=Ke,r=O(t*t*t,n),o=O(r*r*t,n),s=Ni(e*o).pow_p_5_8,a=O(e*r*s,n),c=O(t*a*a,n),i=a,u=O(a*Kn,n),f=c===e,p=c===O(-e,n),d=c===O(-e*Kn,n);return f&&(a=i),(p||d)&&(a=u),de(a,n)&&(a=O(-a,n)),{isValid:f||p,value:a}}var we=ue(it.p,{isLE:!0}),Lo=ue(it.n,{isLE:!0}),Gi={...it,Fp:we,hash:Ne,adjustScalarBytes:Hi,uvRatio:qn},_e=Co(Gi);var Wn=Kn,Fi=BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235"),Vi=BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578"),Ki=BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838"),Wi=BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952"),Po=e=>qn(fe,e),zi=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),zn=e=>_e.Point.Fp.create(Y(e)&zi);function Uo(e){let{d:t}=it,n=Ke,r=m=>we.create(m),o=r(Wn*e*e),s=r((o+fe)*Ki),a=BigInt(-1),c=r((a-t*o)*r(o+t)),{isValid:i,value:u}=qn(s,c),f=r(u*e);de(f,n)||(f=r(-f)),i||(u=f),i||(a=o);let p=r(a*(o-fe)*Wi-c),d=u*u,h=r((u+u)*c),y=r(p*Fi),g=r(fe-d),E=r(fe+d);return new _e.Point(r(h*E),r(g*y),r(y*E),r(h*g))}function Bo(e){L(e,64);let t=zn(e.subarray(0,32)),n=Uo(t),r=zn(e.subarray(32,64)),o=Uo(r);return new se(n.add(o))}var se=class e extends Gt{constructor(t){super(t)}static fromAffine(t){return new e(_e.Point.fromAffine(t))}assertSame(t){if(!(t instanceof e))throw new Error("RistrettoPoint expected")}init(t){return new e(t)}static hashToCurve(t){return Bo(W("ristrettoHash",t,64))}static fromBytes(t){L(t,32);let{a:n,d:r}=it,o=Ke,s=S=>we.create(S),a=zn(t);if(!On(we.toBytes(a),t)||de(a,o))throw new Error("invalid ristretto255 encoding 1");let c=s(a*a),i=s(fe+n*c),u=s(fe-n*c),f=s(i*i),p=s(u*u),d=s(n*r*f-p),{isValid:h,value:y}=Po(s(d*p)),g=s(y*u),E=s(y*g*d),m=s((a+a)*g);de(m,o)&&(m=s(-m));let w=s(i*E),b=s(m*w);if(!h||de(b,o)||w===Ui)throw new Error("invalid ristretto255 encoding 2");return new e(new _e.Point(m,w,fe,b))}static fromHex(t){return e.fromBytes(W("ristrettoHex",t,32))}static msm(t,n){return Ht(e,_e.Point.Fn,t,n)}toBytes(){let{X:t,Y:n,Z:r,T:o}=this.ep,s=Ke,a=E=>we.create(E),c=a(a(r+n)*a(r-n)),i=a(t*n),u=a(i*i),{value:f}=Po(a(c*u)),p=a(f*c),d=a(f*i),h=a(p*d*o),y;if(de(o*h,s)){let E=a(n*Wn),m=a(t*Wn);t=E,n=m,y=a(p*Vi)}else y=d;de(t*h,s)&&(n=a(-n));let g=a((r-n)*y);return de(g,s)&&(g=a(-g)),we.toBytes(g)}equals(t){this.assertSame(t);let{X:n,Y:r}=this.ep,{X:o,Y:s}=t.ep,a=u=>we.create(u),c=a(n*s)===a(r*o),i=a(r*s)===a(n*o);return c||i}is0(){return this.equals(e.ZERO)}};se.BASE=new se(_e.Point.BASE);se.ZERO=new se(_e.Point.ZERO);se.Fp=we;se.Fn=Lo;var No={Point:se},Ft={hashToCurve(e,t){let n=t?.DST||"ristretto255_XMD:SHA-512_R255MAP_RO_",r=Vn(e,n,64,Ne);return Bo(r)},hashToScalar(e,t={DST:Oo}){let n=Vn(e,t.DST,64,Ne);return Lo.create(Y(n))}};var pe=B;var Vt=Y,Ho=He;var Go=Ne;var he=No.Point,F=he.Fn,Me=e=>new TextEncoder().encode(e),jn=pe(Me("OPRFV1-"),Uint8Array.of(0),Me("-ristretto255-SHA512")),ze=32,qi=64;function Vo(...e){let t=[];for(let n of e)if(typeof n=="string")t.push(Me(n));else{if(n.length>65535)throw new Error("OPRF input longer than 65535 bytes");t.push(Ho(n.length,2),n)}return pe(...t)}function ji(e){let t=Ft.hashToCurve(e,{DST:pe(Me("HashToGroup-"),jn)});if(t.equals(he.ZERO))throw new Error("OPRF input maps to the identity");return t}function We(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} element must be 32 bytes`);let n=he.fromBytes(t);if(n.equals(he.ZERO))throw new Error(`OPRF ${e} element is the identity`);return n}function qe(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} must be 32 bytes`);let n=Vt(t);if(n>=F.ORDER)throw new Error(`OPRF ${e} is not a canonical scalar`);if(F.is0(n))throw new Error(`OPRF ${e} is zero`);return n}function $n(){for(;;){let e=Vt(Ao(Be(Un(F.ORDER)),F.ORDER,!0));if(!F.is0(e))return e}}function Wt(e,t){let n=t?qe("blind",t):$n(),r=ji(e).multiply(n);return{blind:F.toBytes(n),blinded:r.toBytes()}}function $i(e,t){return We("blinded",t).multiply(qe("secret key",e)).toBytes()}function zt(e,t,n){let r=We("evaluated",n).multiply(F.inv(qe("blind",t))).toBytes();return Go(Vo(e,r,"Finalize"))}function Yi(e,t){if(e.length!==32)throw new Error("OPRF key seed must be 32 bytes");let n=pe(e,Vo(t),Uint8Array.of(0)),r=pe(Me("DeriveKeyPair"),jn);for(let o=0;o<=255;o++){n[n.length-1]=o;let s=Ft.hashToScalar(n,{DST:r});if(!F.is0(s))return F.toBytes(s)}throw new Error("Cannot derive OPRF key")}function Zi(){return F.toBytes($n())}function Yn(e){try{return qe("secret key",e),!0}catch{return!1}}var qt=64,Xi=pe(Me("DLEQ-redaktyn-v1-"),jn);function Kt(e,t){return F.is0(t)?he.ZERO:e.multiply(t)}function Fo(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} must be 32 bytes`);let n=Vt(t);if(n>=F.ORDER)throw new Error(`OPRF ${e} is not a canonical scalar`);return n}function Ko(e,t,n,r,o){let s=pe(e.toBytes(),t.toBytes(),n.toBytes(),r.toBytes(),o.toBytes(),Me("Challenge"));return Ft.hashToScalar(s,{DST:Xi})}function Zn(e){return he.BASE.multiply(qe("secret key",e)).toBytes()}function Xn(e,t){let n=qe("secret key",e),r=We("blinded",t),o=r.multiply(n),s=he.BASE.multiply(n),a=$n(),c=Ko(s,r,o,he.BASE.multiply(a),r.multiply(a)),i=F.sub(a,F.mul(c,n));return{evaluated:o.toBytes(),proof:pe(F.toBytes(c),F.toBytes(i))}}function ct(e,t,n,r){try{if(r.length!==qt)return!1;let o=We("public key",e),s=We("blinded",t),a=We("evaluated",n),c=Fo("proof challenge",r.subarray(0,ze)),i=Fo("proof response",r.subarray(ze)),u=Kt(he.BASE,i).add(Kt(o,c)),f=Kt(s,i).add(Kt(a,c));return Ko(o,s,a,u,f)===c}catch{return!1}}var Qn={},Wo=["redaktyn.com","www.redaktyn.com"],Z=class extends Error{constructor(t){super(t),this.name="OprfProofError"}},Jn=/^[0-9a-f]{64}$/;function jt(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function Ji(e){return new URL(e).host.toLowerCase()}function zo(e){let t=e.officialHosts??Wo,n=e.officialPins??Qn;return t.includes(e.scope.toLowerCase())&&Object.keys(n).length>0}function Qi(e={}){let t=new Map(Object.entries(e));return{entries:t,get:(n,r)=>t.get(`${n}|${r}`)??null,set:(n,r,o)=>{t.set(`${n}|${r}`,o)}}}async function er(e,t,n){if(typeof n.proof!="string")throw new Z("This server did not prove which key it answered with. Update the server, or do not trust this connection.");let r,o;try{r=jt(n.proof),o=jt(n.evaluated)}catch{throw new Z("The server's answer was not understood.")}if(r.length!==qt)throw new Z("The server's proof was not understood.");let s=e.officialPins??Qn,a=zo(e),c=a?s[n.keyId]:void 0;if(a&&!c)throw new Z(`The server answered with a key (${n.keyId}) that Redaktyn does not publish.`);if(c||(c=await e.pins.get(e.scope,n.keyId)),c){if(!Jn.test(c)||!ct(Q(c),t,o,r))throw new Z("The server's answer was not made with the key this workspace was set up with. It may have been changed on the way.");return c}if(e.firstUse!=="allow")throw new Z("This server's key is not one this client has been told to trust.");let i=typeof n.publicKey=="string"?n.publicKey.toLowerCase():"";if(!Jn.test(i)||!ct(Q(i),t,o,r))throw new Z("The server's proof did not check out.");return await e.pins.set(e.scope,n.keyId,i),i}function tr(e,t,n){let r,o;try{r=jt(n.evaluated),o=jt(n.proof)}catch{throw new Z("The key share's answer was not understood.")}if(!Jn.test(e)||!ct(Q(e),t,r,o))throw new Z("The key share's answer was not made with the key this workspace was set up with.")}var ec=e=>K(e);var tc=/^[A-Za-z0-9_-]{1,32}$/,nc=/^[A-Za-z0-9+/]{43}=$/,$o={"Access-Control-Allow-Origin":"*","Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"Content-Type, Authorization","Access-Control-Max-Age":"86400"};function Ce(e,t,n={}){return new Response(JSON.stringify(t),{status:e,headers:{"Content-Type":"application/json","Cache-Control":"no-store",...$o,...n}})}function rc(e,t){let n=e.length^t.length,r=Math.max(e.length,t.length);for(let o=0;o<r;o++)n|=(e.charCodeAt(o)||0)^(t.charCodeAt(o)||0);return n===0}function qo(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function oc(){return"shared"}var jo=64;function sc(e,t,n){let r=n.slice(0,jo);if(t<1||!e)return r;let o=e.split(",").map(a=>a.trim()),s=o[o.length-t];return s?s.slice(0,jo):r}function ac(e){if(!Yn(e.secretKey))throw new Error("The share's OPRF key is not a valid key");if(!tc.test(e.kid))throw new Error("The share's key id must be 1-32 letters, digits, - or _");let t=Array.from(Zn(e.secretKey),i=>i.toString(16).padStart(2,"0")).join(""),n=e.limits??{perMinute:20,perHour:200},r=e.now??(()=>Date.now()),o=e.clientOf??oc,s=new Map;function a(i,u){let f=(s.get(i)??[]).filter(d=>u-d<36e5),p=f.filter(d=>u-d<60*1e3).length;if(f.length>=n.perHour||p>=n.perMinute)return s.set(i,f),!0;if(f.push(u),s.set(i,f),s.size>1e4){for(let d of s.keys())if(s.delete(d),s.size<=5e3)break}return!1}let c=(i,u)=>{try{e.onEvaluate?.({at:r(),client:i,outcome:u})}catch{}};return async i=>{let f=new URL(i.url).pathname.replace(/\/+$/,"")||"/";if(i.method==="OPTIONS")return new Response(null,{status:204,headers:$o});if(i.method==="GET"&&(f==="/"||f==="/public-key"))return Ce(200,{kid:e.kid,publicKey:t,scheme:"ristretto255-sha512-oprf-dleq"});if(i.method==="POST"&&f==="/evaluate"){let p=o(i);if(e.token!==void 0){let y=/^Bearer (.+)$/.exec(i.headers.get("authorization")??"")?.[1]??"";if(!rc(y,e.token))return c(p,"refused"),Ce(401,{error:"Unauthorised",code:"UNAUTHORIZED"})}let d=r();if(a(p,d))return c(p,"limited"),Ce(429,{error:"Too many attempts. Wait and try again.",code:"RATE_LIMITED"},{"Retry-After":"60"});let h;try{let y=await i.json();if(typeof y.blinded!="string"||!nc.test(y.blinded))throw new Error("shape");h=Uint8Array.from(atob(y.blinded),g=>g.charCodeAt(0))}catch{return c(p,"invalid"),Ce(400,{error:"blinded must be a base64 32-byte element",code:"VALIDATION"})}try{let{evaluated:y,proof:g}=Xn(e.secretKey,h);return c(p,"ok"),Ce(200,{kid:e.kid,evaluated:qo(y),proof:qo(g)})}catch{return c(p,"invalid"),Ce(400,{error:"blinded is not a valid group element",code:"VALIDATION"})}}return Ce(404,{error:"Not found",code:"NOT_FOUND"})}}var Yo=Math.round(25*Math.log2(56)),ic=Qe.toLocaleString("en-US"),cc=[{id:"never-receive",title:"We never receive your passphrase",body:"It is typed only on a page that belongs to the extension, or in the command line, never in a web page. To open your workspace key, your device sends our server one blinded value that it cannot learn the passphrase from.",plan:"all"},{id:"cannot-work-out",title:"We cannot work it out either",body:`A generated passphrase has about ${Yo} bits of randomness, and every guess costs ${ic} rounds of key derivation. Even holding a copy of our database and our server's key, guessing it is out of reach. One you choose yourself is held to a strength check, but cannot match that.`,plan:"all"},{id:"key-outside-database",title:"Our server's key is not in the database",body:"A copy of the database holds nothing a passphrase guess can be checked against. Every guess has to be a request our server limits, per person and per workspace.",plan:"all"},{id:"answers-are-proved",title:"Our answers are proved, not just trusted",body:"Every answer from the key-lock server carries a proof that it was made with a particular key. The extension and the command line remember the key they first met and refuse a different one, so something sitting in front of our server cannot quietly answer with a key of its own.",plan:"all"},{id:"invite-links-carry-no-passphrase",title:"Invite links never carry your passphrase",body:"A link sits in inboxes and chats for good, so it holds only a one-time key that opens one wrapped copy of the workspace key, once, on the first connection. On its own it opens nothing, and a link in the old format that carried the passphrase is refused.",plan:"all"},{id:"customer-key-server",title:"A key server you run",body:"Add a second server of your own to your workspace's lock. Opening the workspace key then needs its answer as well, so we cannot open it alone or test passphrase guesses, whatever passphrase you choose, and you can end our ability to by switching it off. If its key is ever lost, nothing can open the workspace, so keep two copies.",plan:"enterprise"},{id:"fingerprints-only",title:"We hold fingerprints, not secrets",body:"Registered secrets exist on our servers only as keyed fingerprints we cannot reverse, under a key we never hold unlocked.",plan:"all"},{id:"removed-stays-removed",title:"A person you remove stays removed",body:"A device that was removed cannot enrol itself again by syncing: every request it makes is checked against the removal, so removing someone is not undone by a laptop that is still running.",plan:"all"},{id:"checked-against-code",title:"Our claims are checked against the code",body:"What these pages say about the lock is held to the code by tests that fail when the two disagree, including the figures above.",plan:"all"}];var lc="oprf-lock-v1",rr="redaktyn-org-key-lock-v1",Zo="redaktyn-org-key-lock-v2",Xo="redaktyn-org-key-lock-v3",nr="::RSK-",lt=class extends Error{constructor(){super("This workspace also needs its Secret Key, which was shown when it was set up and is in your recovery codes."),this.name="SecretKeyNeededError"}};function dc(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));return`RSK-${Array.from(e,t=>t.toString(16).padStart(2,"0")).join("")}`}function Xt(e){let t=e.trim().toLowerCase().replace(/^rsk-/,"").replace(/[^0-9a-f]/g,"");if(t.length!==32)return null;let n=new Uint8Array(16);for(let r=0;r<16;r++)n[r]=parseInt(t.slice(r*2,r*2+2),16);return n}function or(e){let t=e.lastIndexOf(nr);if(t<=0)return{passphrase:e,secretKey:null};let n=`RSK-${e.slice(t+nr.length)}`;return Xt(n)?{passphrase:e.slice(0,t),secretKey:n}:{passphrase:e,secretKey:null}}function uc(e,t){return!t||or(e).secretKey?e:`${e}${nr}${t.replace(/^RSK-/i,"")}`}var $t=class extends Error{constructor(t="This workspace's key needs your key-share server, and it could not be reached."){super(t),this.name="KeyShareUnavailableError"}};function Yt(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function Zt(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function sr(){let e=globalThis.crypto?.subtle;if(!e)throw new Error("Web Crypto is not available");return e}function dt(e){let t=new Uint8Array(new ArrayBuffer(e.byteLength));return t.set(e),t}var Jo=(e,t,n,r)=>dt(C(n?`${Zo}|${e}|${t}|${n.url}|${n.kid}|${n.publicKey}`:r?`${Xo}|${e}|${t}`:`${rr}|${e}|${t}`));async function fc(e,t){return wt($,C(e),$(C(`${rr}|${t}`)),{c:Qe,dkLen:32})}async function Qo(e,t,n,r,o,s){if(o&&s)throw new Error("A lock takes a key share or a Secret Key, not both");if(o&&!n.evaluateShare)throw new $t;let a=await fc(e,t),c=[];try{let i=Wt(a),u=o?Wt(a):null,[f,p]=await Promise.all([n.evaluate({blinded:Yt(i.blinded),...r?{keyId:r}:{}}),o&&u?n.evaluateShare({share:o,blinded:Yt(u.blinded)}):Promise.resolve(null)]);if(r&&f.keyId!==r)throw new Error("The server answered with a different key than the lock uses");await er(n.trust,i.blinded,f);let d=zt(a,i.blind,Zt(f.evaluated));c.push(d),i.blind.fill(0);let h=d,y=`${rr}|kek`;if(o&&u&&p){tr(o.publicKey,u.blinded,p);let m=zt(a,u.blind,Zt(p.evaluated));c.push(m),u.blind.fill(0),h=B(d,m),c.push(h),y=`${Zo}|kek`}s&&(h=B(d,s),c.push(h),y=`${Xo}|kek`);let g=kt($,h,C(t),C(y),32),E=await sr().importKey("raw",dt(g),{name:"AES-GCM"},!1,["encrypt","decrypt"]);return g.fill(0),{key:E,keyId:f.keyId}}finally{for(let i of c)i.fill(0);a.fill(0)}}function es(){let e=new Uint8Array(32);return globalThis.crypto.getRandomValues(e),e}async function ts(e,t,n,r,o,s){if(e.byteLength!==32)throw new Error("An org key is 32 bytes");let a=s?Xt(s):void 0;if(s&&!a)throw new Error("That is not a Secret Key");let{key:c,keyId:i}=await Qo(t,n,r,void 0,o,a??void 0),u=globalThis.crypto.getRandomValues(new Uint8Array(12)),f=new Uint8Array(await sr().encrypt({name:"AES-GCM",iv:u,additionalData:Jo(n,i,o,a??void 0)},c,dt(e))),p={keyId:i,iv:Yt(u),ciphertext:Yt(f)};return a?{v:3,...p}:o?{v:2,...p,share:{url:o.url,kid:o.kid,publicKey:o.publicKey}}:{v:1,...p}}async function pc(e,t,n,r){if(!rs(e))throw new Error("Not an org key lock");let o=e.v===2?e.share:void 0,s=t,a;if(e.v===3){let u=or(t);s=u.passphrase;let f=u.secretKey??r.secretKey;if(!f)throw new lt;if(a=Xt(f)??void 0,!a)throw new lt}let{key:c}=await Qo(s,n,r,e.keyId,o,a),i;try{i=new Uint8Array(await sr().decrypt({name:"AES-GCM",iv:dt(Zt(e.iv)),additionalData:Jo(n,e.keyId,o,a)},c,dt(Zt(e.ciphertext))))}catch{return null}if(i.byteLength!==32)throw i.fill(0),new Error("An org key lock did not hold a 32-byte key");return i}async function hc(e,t,n,r,o){let s=es(),a=await ts(s,e,t,n,r,o);return{orgKey:s,lock:a,verifier:xn(s)}}function ns(e){if(!e||typeof e!="object")return!1;let t=e;if(typeof t.url!="string"||t.url.length>200||typeof t.kid!="string"||!/^[A-Za-z0-9_-]{1,32}$/.test(t.kid)||typeof t.publicKey!="string"||!/^[0-9a-f]{64}$/.test(t.publicKey))return!1;let n;try{n=new URL(t.url)}catch{return!1}let r=n.hostname==="localhost"||n.hostname==="127.0.0.1"||n.hostname==="[::1]";return!(n.protocol!=="https:"&&!(n.protocol==="http:"&&r)||n.username||n.password||n.search||n.hash)}function rs(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.keyId=="string"&&/^[A-Za-z0-9_-]{1,32}$/.test(t.keyId)&&typeof t.iv=="string"&&t.iv.length===16&&typeof t.ciphertext=="string"&&t.ciphertext.length===64?t.v===1||t.v===3?t.share===void 0:t.v===2&&ns(t.share):!1}var au=864e5;function mc(e,t,n,r){let o=new Set(t.map(a=>a.id));if(n&&Array.isArray(n.held)&&r-n.since>=0&&r-n.since<864e5){let a=n.held.filter(c=>!o.has(c.id));return a.length===0?{list:[...t],hold:null}:{list:[...t,...a],hold:{held:a,since:n.since}}}if(n)return{list:[...t],hold:null};let s=e.filter(a=>!o.has(a.id));return s.length>=3&&s.length*2>=e.length?{list:[...t,...s],hold:{held:s,since:r}}:{list:[...t],hold:null}}var yc=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/;function gc(e){let t=e.split(/\r?\n/),n=[],r=0,o=0;for(let s of t){if(r>0||o>0){if(s.startsWith("\\"))continue;if(s.startsWith("+")){n.push(s.slice(1)),o--;continue}if(s.startsWith("-")){r--;continue}if(s.startsWith(" ")){r--,o--;continue}r=0,o=0}let a=yc.exec(s);if(a){r=a[1]===void 0?1:Number(a[1]),o=a[2]===void 0?1:Number(a[2]);continue}s.startsWith("+++")||s.startsWith("---")||s.startsWith("+")&&n.push(s.slice(1))}return n.join(`
-`)}var os="redaktyn-scan-prefilter-v1",ss="v1.",as=65535,ut=Math.imul,ir=as+1,is=/^v1\.[0-9a-f]{12}$/;function cs(e){if(e.length<4)throw new Error("scanPrefilterParams: seed too short");return{base:e[0]<<24|e[1]<<16|e[2]<<8|e[3]|1}}function ls(e){return ee($,e,C(os))}function bc(e){return(e>=65&&e<=90?e+32:e)+1}function ds(e){let t=new Int32Array(e.length);for(let n=0;n<e.length;n++)t[n]=bc(e.charCodeAt(n));return t}function Ec(e,t){let n=1,r=e|0,o=t;for(;o>0;)o&1&&(n=ut(n,r)),r=ut(r,r),o>>>=1;return n}function us(e,t,n,r){let o=0;for(let s=n;s<n+r;s++)o=ut(o,e)+t[s]|0;return o}function Jt(e,t){return us(e.base,ds(t),0,t.length)>>>16}function xc(e,t,n){let r=e.base,o=Ec(r,n-1),s=-2,a=0;return c=>(c===s+1?a=ut(a-ut(t[s],o)|0,r)+t[s+n]|0:a=us(r,t,c,n),s=c,a>>>16)}function ar(e){return(e&as).toString(16).padStart(4,"0")}function fs(e,t){return ss+ar(Jt(e,t.exact))+ar(Jt(e,t.collapsed))+ar(Jt(e,t.lower))}function wc(e,t){return fs(cs(ls(t)),{exact:At(e),collapsed:et(tt(e)),lower:It(e)})}function cr(e){if(typeof e!="string"||!is.test(e))return null;let t=e.slice(ss.length);return{exact:parseInt(t.slice(0,4),16),collapsed:parseInt(t.slice(4,8),16),lower:parseInt(t.slice(8,12),16)}}var en=15e5,ft=5*1024*1024,ps=256,hs=5e4,ms=1e4;function ys(e){return cr(e.scanPrefilter)!==null}function lr(e,t=!1){let n=[new Map,new Map,new Map],r=(o,s,a)=>{if(typeof s!="number"||!(s>0))return;let c=n[o].get(s);n[o].set(s,c?{windowLen:s,prefiltered:c.prefiltered&&a,entries:c.entries+1}:{windowLen:s,prefiltered:a,entries:1})};for(let o of e){let s=t||ys(o);r(0,o.length,s),r(1,o.lengthStripped,s),r(2,o.lengthLower,s)}return n.flatMap(o=>[...o.values()])}function dr(e,t){let n=0;for(let r of t){let o=Math.max(0,e-r.windowLen+1);n+=r.prefiltered?Math.ceil(o/ps)+Math.ceil(o*r.entries/ir):o}return n}function Qt(e){if(e.length===0)return 1/0;if(dr(ft,e)<=en)return ft;let t=0,n=ft;for(;t<n;){let r=Math.ceil((t+n)/2);dr(r,e)<=en?t=r:n=r-1}return t}function kc(e){let t=new Set,n=new Set,r=new Set;for(let o of e)o.length>0&&t.add(o.length),typeof o.lengthStripped=="number"&&o.lengthStripped>0&&n.add(o.lengthStripped),typeof o.lengthLower=="number"&&o.lengthLower>0&&r.add(o.lengthLower);return[...t,...n,...r]}function Ac(e){let t=e.length;if(t===0)return 1/0;let n=e.reduce((r,o)=>r+o,0);return Math.max(0,Math.floor((en+n-t)/t))}function Ic(e){let t=lr(e),n=Qt(t),o={windowLen:t.length?Math.round(t.reduce((a,c)=>a+c.windowLen,0)/t.length):40,prefiltered:!0,entries:1},s=Qt([...t,o,o,o]);return{windowLengths:t.length,maxPasteChars:n,severity:n<ms?"alarm":n<hs?"warn":"ok",maxPasteCharsAfterOneMore:s,legacySecrets:e.filter(a=>!ys(a)).length,maxPasteCharsIfReenrolled:Qt(lr(e,!0)),atCharacterCap:n===ft}}var yu=200;var pt={"stripe-live-secret":"Stripe live secret key","stripe-restricted-live":"Stripe restricted live key","stripe-test":"Stripe test key","stripe-publishable":"Stripe publishable key","github-pat":"GitHub personal access token","github-oauth":"GitHub OAuth token","github-app":"GitHub app token","github-fine-grained":"GitHub fine-grained token","npm-token":"npm access token","aws-access-key-id":"AWS access key ID","google-api-key":"Google API key","anthropic-api-key":"Anthropic API key","openai-api-key":"OpenAI API key","gitlab-pat":"GitLab personal access token","slack-token":"Slack token","slack-app-token":"Slack app token","shopify-token":"Shopify access token","digitalocean-token":"DigitalOcean token","huggingface-token":"Hugging Face token","stripe-webhook-secret":"Stripe webhook signing secret","openrouter-api-key":"OpenRouter API key","groq-api-key":"Groq API key","xai-api-key":"xAI API key","perplexity-api-key":"Perplexity API key","replicate-token":"Replicate API token","google-oauth-client-secret":"Google OAuth client secret","azure-ad-client-secret":"Azure AD client secret","gitlab-token":"GitLab token","slack-webhook":"Slack webhook URL","discord-webhook":"Discord webhook URL","discord-bot-token":"Discord bot token","telegram-bot-token":"Telegram bot token","sendgrid-api-key":"SendGrid API key","twilio-api-key":"Twilio API key","mailgun-api-key":"Mailgun API key","mailchimp-api-key":"Mailchimp API key","pypi-token":"PyPI upload token","docker-hub-token":"Docker Hub access token","vault-token":"HashiCorp Vault token","terraform-cloud-token":"Terraform Cloud token","doppler-token":"Doppler token","linear-api-key":"Linear API key","notion-token":"Notion integration token","airtable-token":"Airtable personal access token","atlassian-api-token":"Atlassian API token","square-token":"Square access token","sentry-token":"Sentry auth token","new-relic-key":"New Relic API key","grafana-token":"Grafana token","postman-api-key":"Postman API key","supabase-token":"Supabase secret key","supabase-publishable":"Supabase publishable key","netlify-token":"Netlify access token","age-secret-key":"age secret key","private-key":"Private key","connection-string-password":"Password in a connection string","neon-db-password":"Neon database password","assigned-secret":"Value assigned to a credential name","aws-secret-access-key":"AWS secret access key","aws-session-token":"AWS session token","gcp-service-account-key":"Google Cloud service-account key","azure-storage-key":"Azure storage account key","cloudflare-api-token":"Cloudflare API token","cloud-provider-token":"Cloud platform token","hyperscaler-access-key":"Cloud access key (Alibaba, Tencent, IBM, Oracle)","bitbucket-token":"Bitbucket token","ci-token":"CI/CD token","package-registry-token":"Package registry token","pulumi-token":"Pulumi access token","managed-db-token":"Managed database token","jdbc-ado-password":"Password in a JDBC or ADO.NET connection string","warehouse-credential":"Data warehouse credential","payment-provider-secret":"Payment gateway secret","commerce-token":"Commerce platform token","llm-provider-key":"AI provider API key","email-provider-key":"Email provider key","sms-provider-secret":"SMS or voice provider secret","productivity-saas-token":"Productivity SaaS token","observability-key":"Monitoring or logging key","signing-secret":"Signing or encryption secret","oauth-client-secret":"OAuth client secret","long-lived-jwt":"Long-lived JWT","http-basic-auth":"HTTP basic-auth credentials","session-cookie":"Session cookie","config-password":"Password in configuration","crypto-wallet-secret":"Crypto wallet key or seed phrase","vpn-private-key":"VPN private key","env-file":"Secrets in an .env file","kubeconfig-credential":"Kubernetes config credential","k8s-secret-manifest":"Kubernetes Secret value","terraform-secret":"Secret in Terraform state or variables","credential-file":"Credentials file (.npmrc, .netrc, docker, git)","presigned-url":"Pre-signed URL that is still valid","payment-card-number":"Payment card number","aadhaar-number":"Aadhaar number","india-tax-id":"PAN or personal GSTIN","national-id-number":"SSN or National Insurance number","bank-account-details":"Bank account details","customer-data-dump":"Customer data export"},gs=Object.keys(pt),Oe="unrecognised",Sc="assigned-secret",bs=[...gs,Oe];function vc(e){return bs.includes(e)}function ur(e){return e===Oe?"Unrecognised credential":pt[e]??e}var Rc=new Set(["payment-card-number","aadhaar-number","india-tax-id","national-id-number","bank-account-details","customer-data-dump"]),Tc=new Set(["private-key","vpn-private-key","age-secret-key"]),_c=new Set(["crypto-wallet-secret"]),Mc=["Create a replacement credential at the provider. Leave the old one working for now.","Switch everything that uses it (services, CI settings, teammates' environment files) to the new value, and check that each one still works.","Revoke the old credential at the provider. Until you do, a copy that was shared anywhere else still works.","Register the new value in Redaktyn so it is protected the same way, then remove the old fingerprint here."],Cc=["Generate a new key pair.","Put the new public key everywhere the old one is authorised (servers, services, allow-lists), and check access with the new private key.","Remove the old public key from those places, so the old private key stops working.","Register the new private key in Redaktyn so it is protected the same way, then remove the old fingerprint here."],Oc=["A wallet key or seed phrase cannot be changed, only replaced.","Create a new wallet, ideally on a device you trust.","Move the funds and any approvals to the new wallet.","Stop using the old wallet. Register the new key in Redaktyn if you want it protected."],Es=[{label:"Stripe documentation: API keys",url:"https://docs.stripe.com/keys"},{label:"Stripe Dashboard: API keys",url:"https://dashboard.stripe.com/apikeys"}],xs=[{label:"GitHub documentation: managing your personal access tokens",url:"https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens"}],fr=[{label:"AWS documentation: IAM access keys",url:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"}],ws=[{label:"Slack: your apps",url:"https://api.slack.com/apps"}],ks={"stripe-live-secret":{links:Es,tips:["Stripe lets you roll a key and expire the old one once your services have moved to the new one."]},"stripe-restricted-live":{links:Es,tips:["Stripe lets you roll a key and expire the old one once your services have moved to the new one."]},"github-pat":{links:xs},"github-fine-grained":{links:xs},"gitlab-pat":{links:[{label:"GitLab documentation: personal access tokens",url:"https://docs.gitlab.com/user/profile/personal_access_tokens/"}],tips:["GitLab lets you rotate a personal access token as well as revoke it."]},"npm-token":{links:[{label:"npm documentation: revoking access tokens",url:"https://docs.npmjs.com/revoking-access-tokens/"}]},"aws-access-key-id":{links:fr},"aws-secret-access-key":{links:fr},"aws-session-token":{links:fr},"anthropic-api-key":{links:[{label:"Anthropic console: API keys",url:"https://platform.claude.com/settings/keys"}]},"google-api-key":{links:[{label:"Google Cloud console: credentials",url:"https://console.cloud.google.com/apis/credentials"}]},"slack-token":{links:ws},"slack-app-token":{links:ws},"sendgrid-api-key":{links:[{label:"SendGrid documentation: API keys",url:"https://www.twilio.com/docs/sendgrid/ui/account-and-settings/api-keys"}]},"huggingface-token":{links:[{label:"Hugging Face: access tokens",url:"https://huggingface.co/settings/tokens"}]},"pypi-token":{links:[{label:"PyPI: API tokens",url:"https://pypi.org/manage/account/token/"}]},"digitalocean-token":{links:[{label:"DigitalOcean: API tokens",url:"https://cloud.digitalocean.com/account/api/tokens"}]},"docker-hub-token":{links:[{label:"Docker Hub: security settings",url:"https://hub.docker.com/settings/security"}]}},Dc=["docs.stripe.com","dashboard.stripe.com","docs.github.com","docs.gitlab.com","docs.npmjs.com","docs.aws.amazon.com","platform.claude.com","console.cloud.google.com","api.slack.com","www.twilio.com","huggingface.co","pypi.org","cloud.digitalocean.com","hub.docker.com"],Pc=Object.keys(ks);function Uc(e){if(e&&Rc.has(e))return null;let t=e&&e!==Oe&&Object.prototype.hasOwnProperty.call(pt,e)?e:null,n=t&&_c.has(t)?"wallet":t&&Tc.has(t)?"keypair":"credential",r=n==="wallet"?Oc:n==="keypair"?Cc:Mc,o=t?ks[t]:void 0;return{slug:e??null,provider:t?ur(t):null,kind:n,steps:r,tips:o?.tips??[],links:o?.links??[]}}var As={credential:"Credentials",infra:"Infrastructure",pii:"Personal data"},Lc={credential:"Keys, tokens and passwords that grant access to something. An admin can protect one on the spot, and the next paste of it is blocked.",infra:"Files that carry credentials in bulk \u2014 an .env dump, a kubeconfig, a Terraform state file. One paste can hand over a whole environment.",pii:"Card, identity and bank numbers that belong to people, not to the org. Never protected, only removed from the message."},Bc={checksum:"Checksum verified",structure:"Structure decoded",prefix:"Provider format",context:"Named and random"},A=(e,t,n,r,o)=>({id:e,family:t,name:n,slugs:r,...o}),pr=[A(1,"credential","AWS access keys",["aws-access-key-id","aws-secret-access-key"],{proof:"prefix",catches:"AKIA\u2026 access key IDs, and the 40-character secret access key beside them in a credentials file, an env var or a chat message.",ignores:"AWS's documented example keys (AKIAIOSFODNN7EXAMPLE), ARNs and account IDs."}),A(2,"credential","AWS session tokens",["aws-session-token"],{proof:"prefix",catches:"Temporary STS session tokens (IQoJb3JpZ2lu\u2026, FwoGZXIvYXdz\u2026) copied out of a console or a CLI profile.",ignores:"Tokens cut short with an ellipsis, and placeholders."}),A(3,"credential","Google Cloud credentials",["gcp-service-account-key","google-api-key"],{proof:"structure",catches:"Service-account JSON files whose private key is a real key, and AIza\u2026 API keys.",ignores:"Service-account JSON with a truncated or random-filler private key, and AIza followed by filler."}),A(4,"credential","Azure storage keys",["azure-storage-key"],{proof:"context",catches:"AccountKey= and SharedAccessKey= inside Azure Storage, Service Bus and Event Hubs connection strings.",ignores:"The public Azurite emulator key (devstoreaccount1) and <your-account-key> placeholders."}),A(5,"credential","Azure AD client secrets",["azure-ad-client-secret"],{proof:"prefix",catches:"Entra ID app client secrets \u2014 the 40-character values with Q~ at position four.",ignores:"Tenant and client IDs, which are GUIDs and not secret."}),A(6,"credential","Cloudflare tokens",["cloudflare-api-token"],{proof:"context",catches:"Cloudflare API tokens assigned to a Cloudflare variable, and v1.0- origin CA keys.",ignores:"Zone and account IDs."}),A(7,"credential","Developer cloud tokens",["digitalocean-token","netlify-token","cloud-provider-token"],{proof:"prefix",catches:"DigitalOcean (dop_v1_), Netlify (nfp_), Heroku (HRKU-), Fly.io (fo1_), Render (rnd_) and Vercel tokens.",ignores:"App names and region settings, and tokens made of filler characters."}),A(8,"credential","Other cloud access keys",["hyperscaler-access-key"],{proof:"prefix",catches:"Alibaba Cloud (LTAI\u2026), Tencent Cloud (AKID\u2026) and IBM Cloud API keys.",ignores:"Region names and other configuration that sits next to them."}),A(9,"credential","GitHub tokens",["github-pat","github-oauth","github-app","github-fine-grained"],{proof:"checksum",catches:"Classic and fine-grained personal access tokens, OAuth tokens and app tokens (ghp_, gho_, ghs_, github_pat_) \u2014 each carries a CRC32 checksum, and it has to verify.",ignores:"Strings shaped like a GitHub token whose checksum fails, ${{ secrets.GITHUB_TOKEN }} references, and repository URLs."}),A(10,"credential","GitLab tokens",["gitlab-pat","gitlab-token"],{proof:"prefix",catches:"GitLab personal access tokens (glpat-) and runner tokens (glrt-).",ignores:"GitLab URLs and filler tokens."}),A(11,"credential","Bitbucket and Atlassian tokens",["atlassian-api-token","bitbucket-token"],{proof:"prefix",catches:"Atlassian API tokens (ATATT\u2026), Bitbucket app passwords and access tokens (ATBB\u2026).",ignores:"Jira and Confluence site URLs."}),A(12,"credential","CI/CD tokens",["ci-token"],{proof:"prefix",catches:"CircleCI (CCIPAT_), Buildkite (bkua_) and Jenkins API tokens.",ignores:"Build numbers, job URLs and pipeline names."}),A(13,"credential","Package registry tokens",["npm-token","pypi-token","docker-hub-token","package-registry-token"],{proof:"checksum",catches:"npm tokens (npm_, checksum-verified), PyPI upload tokens, Docker Hub PATs (dckr_pat_), RubyGems and NuGet keys.",ignores:"npm-shaped tokens whose checksum fails, and registry URLs."}),A(14,"credential","Infrastructure-as-code and secret-manager tokens",["vault-token","terraform-cloud-token","doppler-token","pulumi-token"],{proof:"prefix",catches:"HashiCorp Vault tokens (hvs.), Terraform Cloud tokens (.atlasv1.), Doppler (dp.st.) and Pulumi (pul-) tokens.",ignores:"Vault addresses and workspace names."}),A(15,"credential","Database connection strings",["connection-string-password"],{proof:"context",catches:"The password inside a postgres://, mysql://, mongodb+srv://, redis:// or amqp:// URL pointing at a real host.",ignores:"localhost and example.com hosts, user:password, ${DB_PASSWORD} references and <password> placeholders."}),A(16,"credential","Managed database tokens",["neon-db-password","supabase-token","supabase-publishable","managed-db-token"],{proof:"prefix",catches:"Neon passwords (npg_), Supabase service and secret keys (sbp_, sb_secret_), PlanetScale and Upstash tokens.",ignores:"Supabase publishable keys, which are meant to be public, and project IDs."}),A(17,"credential","JDBC and ADO.NET passwords",["jdbc-ado-password"],{proof:"context",catches:"password= and Password= inside JDBC URLs and SQL Server / ADO.NET connection strings.",ignores:"Password=password, ${SA_PASSWORD} and <your_password>."}),A(18,"credential","Data warehouse credentials",["warehouse-credential"],{proof:"prefix",catches:"Databricks tokens (dapi\u2026), and Snowflake and ClickHouse passwords.",ignores:"Account locators and warehouse names."}),A(19,"credential","Stripe keys",["stripe-live-secret","stripe-restricted-live","stripe-webhook-secret","stripe-test","stripe-publishable"],{proof:"prefix",catches:"Live secret keys (sk_live_), restricted live keys (rk_live_) and webhook signing secrets (whsec_).",ignores:"Test-mode keys, publishable keys (pk_), which are public, and keys cut short with an ellipsis."}),A(20,"credential","Payment gateway secrets",["square-token","payment-provider-secret"],{proof:"prefix",catches:"Square access tokens, Braintree production tokens, Plaid production secrets, Razorpay key secrets and PayPal client secrets.",ignores:"Razorpay key IDs on their own, test-mode and sandbox keys."}),A(21,"credential","Commerce platform tokens",["shopify-token","commerce-token"],{proof:"prefix",catches:"Shopify admin tokens (shpat_), WooCommerce consumer keys (ck_) and BigCommerce access tokens.",ignores:"Store domains and all-zero filler tokens."}),A(22,"credential","OpenAI keys",["openai-api-key"],{proof:"prefix",catches:"Project keys (sk-proj-\u2026 with the T3BlbkFJ marker) and legacy sk- keys.",ignores:"Model names, sk-abcdef\u2026 keyboard strings and keys masked as sk-\u2026a1B2."}),A(23,"credential","Anthropic keys",["anthropic-api-key"],{proof:"prefix",catches:"Anthropic API keys (sk-ant-api03-\u2026AA).",ignores:"Model names and sk-ant-\u2026 placeholders."}),A(24,"credential","Other AI provider keys",["groq-api-key","xai-api-key","perplexity-api-key","replicate-token","huggingface-token","openrouter-api-key","llm-provider-key"],{proof:"prefix",catches:"Groq, xAI, Perplexity, Replicate, Hugging Face, OpenRouter, DeepSeek, LangSmith and Mistral keys.",ignores:"Cache paths like HF_HOME and filler tokens."}),A(25,"credential","Slack tokens and webhooks",["slack-token","slack-app-token","slack-webhook"],{proof:"prefix",catches:"Bot, user and app tokens (xoxb-, xoxp-, xapp-) and incoming webhook URLs.",ignores:"xoxb-your-bot-token and channel names."}),A(26,"credential","Discord and Telegram bots",["discord-webhook","discord-bot-token","telegram-bot-token"],{proof:"structure",catches:"Discord webhook URLs and bot tokens, and Telegram bot tokens (a bot ID, a colon, then AA\u2026).",ignores:"Guild and channel IDs."}),A(27,"credential","Email provider keys",["sendgrid-api-key","mailgun-api-key","mailchimp-api-key","email-provider-key"],{proof:"prefix",catches:"SendGrid (SG.), Mailgun (key-), Mailchimp (\u2026-us1), Resend (re_), Brevo (xkeysib-) and Postmark keys.",ignores:"SMTP hosts and sender addresses."}),A(28,"credential","SMS and voice provider secrets",["twilio-api-key","sms-provider-secret"],{proof:"context",catches:"Twilio API keys (SK\u2026) and auth tokens, and MSG91 auth keys.",ignores:"Account SIDs and phone numbers on their own."}),A(29,"credential","Productivity SaaS tokens",["linear-api-key","notion-token","airtable-token","postman-api-key","productivity-saas-token"],{proof:"prefix",catches:"Linear, Notion, Airtable, Postman, HubSpot, Figma, Asana and Zendesk tokens.",ignores:"Database and page IDs, which are not secret."}),A(30,"credential","Monitoring and logging keys",["sentry-token","new-relic-key","grafana-token","observability-key"],{proof:"prefix",catches:"Sentry auth tokens, New Relic (NRAK-), Grafana service accounts (glsa_), Dynatrace, PostHog personal keys and Datadog API keys.",ignores:"Sentry DSNs and PostHog project keys, which are designed to ship in browser code."}),A(31,"credential","Private keys (PEM, OpenSSH, PGP)",["private-key"],{proof:"structure",catches:"RSA, EC, PKCS#8, OpenSSH and PGP private key blocks whose body decodes to a real key.",ignores:"Public keys and certificates, key blocks with ... for a body, and blocks filled with random text."}),A(32,"credential","Signing and encryption secrets",["signing-secret"],{proof:"context",catches:"JWT_SECRET, SECRET_KEY_BASE, NEXTAUTH_SECRET, Django SECRET_KEY and similar, when the value is random.",ignores:"changeme, algorithm names like HS256 and expiry settings."}),A(33,"credential","OAuth client secrets",["google-oauth-client-secret","oauth-client-secret"],{proof:"prefix",catches:"Google client secrets (GOCSPX-) and refresh tokens, and Okta, Auth0 and generic client_secret values.",ignores:"Client IDs, which are public."}),A(34,"credential","Long-lived JWTs",["long-lived-jwt"],{proof:"structure",catches:"Signed JWTs that are still valid for a long time \u2014 service-role keys, service-account tokens, tokens that never expire.",ignores:"Expired tokens, short-lived session tokens, Supabase anon keys and the jwt.io sample token."}),A(35,"credential","Basic auth and session cookies",["http-basic-auth","session-cookie"],{proof:"structure",catches:"Authorization: Basic headers that decode to user:password, curl -u credentials, and login session cookies.",ignores:"Analytics and preference cookies, and user:pass examples."}),A(36,"credential","Passwords in configuration",["config-password","assigned-secret"],{proof:"context",catches:"Values assigned to DB_PASSWORD, API_TOKEN, password: and their kin in env files, YAML and code, when they are random enough to be real.",ignores:"********, length settings, keyboard walks like qwertyuiop123, and placeholders."}),A(37,"credential","Crypto wallet keys and seed phrases",["crypto-wallet-secret"],{proof:"checksum",catches:"BIP39 recovery phrases whose checksum word verifies, WIF and xprv keys (Base58Check) and raw Ethereum private keys.",ignores:"The abandon \u2026 about test phrase, Hardhat's published dev keys, and wallet addresses."}),A(38,"credential","age and WireGuard keys",["age-secret-key","vpn-private-key"],{proof:"structure",catches:"age secret keys (AGE-SECRET-KEY-1\u2026) and the PrivateKey of a WireGuard [Interface].",ignores:"WireGuard peer public keys."}),A(39,"infra",".env files",["env-file"],{proof:"context",catches:"A pasted .env file with real secrets in it, flagged as one file rather than line by line.",ignores:".env files with only settings, ${VAR} references or your_key_here placeholders."}),A(40,"infra","Kubernetes configs",["kubeconfig-credential"],{proof:"structure",catches:"kubeconfig files carrying a client key or a bearer token for a cluster.",ignores:"kubeconfigs that authenticate through an exec plugin, and REDACTED tokens."}),A(41,"infra","Kubernetes Secret manifests",["k8s-secret-manifest"],{proof:"structure",catches:"kind: Secret manifests \u2014 the base64 under data: is decoded and checked, and stringData: is read as is.",ignores:"Secrets that decode to password or admin, and certificates."}),A(42,"infra","Terraform state and variables",["terraform-secret"],{proof:"structure",catches:"Passwords in terraform.tfstate attributes and hard-coded in .tf resources.",ignores:"null attributes and var.db_password references."}),A(43,"infra","Credential files",["credential-file"],{proof:"structure",catches:".netrc logins, Docker config.json auths, .pgpass lines and tokens embedded in git remote URLs.",ignores:"example.com entries, user:password auths and plain clone URLs."}),A(44,"infra","Pre-signed URLs",["presigned-url"],{proof:"structure",catches:"S3 pre-signed and Azure SAS URLs that have not expired yet \u2014 anyone holding one can read the file.",ignores:"Expired links, unsigned URLs and documentation pages."}),A(45,"pii","Payment card numbers",["payment-card-number"],{proof:"checksum",catches:"Visa, Mastercard, Amex, RuPay and other card numbers that pass the Luhn check and sit next to a card label, an expiry or a card network name.",ignores:"Published test cards (4242\u2026, 4111\u2026), order IDs and numbers that fail Luhn."}),A(46,"pii","Aadhaar numbers",["aadhaar-number"],{proof:"checksum",catches:"Aadhaar numbers that pass the Verhoeff check, labelled or in the 4-4-4 grouping.",ignores:"UIDAI's sample numbers, transaction references and numbers that fail Verhoeff."}),A(47,"pii","PAN and GSTIN",["india-tax-id"],{proof:"checksum",catches:"Individual PANs and GSTINs whose check character verifies.",ignores:"Company PANs, unlabelled lookalikes and GSTINs with a wrong check character."}),A(48,"pii","SSN and National Insurance numbers",["national-id-number"],{proof:"structure",catches:"US Social Security numbers and UK National Insurance numbers that follow the issuing rules and are labelled or listed.",ignores:"Numbers never issued (000, 666, 9xx areas), the famous Woolworth card number, and part numbers."}),A(49,"pii","Bank account details",["bank-account-details"],{proof:"checksum",catches:"IBANs that pass mod-97, and account numbers next to a valid ABA routing number or an IFSC code.",ignores:"Published example IBANs, IBANs with a wrong check digit and IFSC codes alone."}),A(50,"pii","Customer data exports",["customer-data-dump"],{proof:"context",catches:"Pasted tables of real people \u2014 rows with names, personal email addresses and phone numbers.",ignores:"example.com addresses, 555 phone numbers, short lists and staff email lists."})],Nc=["Placeholders \u2014 <your-key>, ${VAR}, {{ secret }}, xxxx, changeme, your_key_here","Values cut short or masked \u2014 sk_live_\u2026, ****, REDACTED","Anything marked fake, mock, dummy, stub, fixture or sample \u2014 in a comment beside it or in its variable name","Vendors' published example and test keys","Variable names, file paths, URLs, hashes, UUIDs and regex source","Public keys, publishable keys and IDs that are not secret"],hr=new Map;for(let e of pr)for(let t of e.slugs)hr.set(t,e);function Hc(e){return hr.get(e)}function Is(e){return e===Oe?"credential":hr.get(e)?.family??"credential"}function Gc(e){return Is(e)!=="pii"}function Fc(e){return As[e]}var Vc=pr.flatMap(e=>e.slugs);function Ss(e){let t=new Set;for(let n of e)if(n?.isActive)for(let r of n.rules??[])for(let o of r?.specificDomains??[]){let s=fn(o);s&&t.add(s)}return Array.from(t).sort()}function Kc(e){return Ss(e).filter(t=>!un(t))}var Su=1e3,vu=100,Ru=254,Tu=1048576,vs=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,Wc=`Name,Email
+`),t=t.replace(Ui,""),t=t.trim(),t}function nt(e){if(e.length===36&&e[8]==="-"&&e[13]==="-"&&e[18]==="-"&&e[23]==="-"){let t=e.replace(/-/g,"");if(/^[0-9a-fA-F]{32}$/.test(t))return e.toLowerCase()}return e}function Mt(e){return nt(Sn(e))}function rt(e){return Sn(e).replace(/\s/g,"")}function Bi(e,t){return Ct(nt(rt(e)),t)}function He(e){return rt(e).toLowerCase()}function Ni(e,t){return Ct(He(e),t)}function Ct(e,t){return W(ee(z,t,M(e)))}function Hi(e,t){return Ct(Mt(e),t)}async function Gi(e,t){let n=M(e),r=z(M(t));return _t(z,n,r,{c:eo,dkLen:An})}var ro="redaktyn-project-key-v1",Fi=M(ro);function Vi(e,t){if(e.length!==An)throw new Error("deriveProjectKey: org key must be 32 bytes");if(!t)throw new Error("deriveProjectKey: projectId is required");return et(z,e,M(t),Fi,An)}var oo="vaultx-passphrase-verify-v1",Wi=M(oo);function In(e){return W(ee(z,e,Wi))}function Ki(){return crypto.getRandomValues(new Uint8Array(32))}function $i(e){return W(e)}function ji(e){return Q(e)}function vn(e){return e.length<12?{ok:!1,error:"Passphrase must be at least 12 characters."}:/[A-Z]/.test(e)?/[a-z]/.test(e)?/[0-9]/.test(e)?/[^A-Za-z0-9]/.test(e)?{ok:!0}:{ok:!1,error:"Passphrase must include at least one special character (e.g. !@#$%)."}:{ok:!1,error:"Passphrase must include at least one number."}:{ok:!1,error:"Passphrase must include at least one lowercase letter."}:{ok:!1,error:"Passphrase must include at least one uppercase letter."}}var ot=["password","passphrase","letmein","welcome","monkey","dragon","qwerty","qwertyuiop","asdfgh","zxcvbn","iloveyou","sunshine","princess","football","baseball","superman","batman","master","shadow","michael","jennifer","trustno","starwars","whatever","freedom","computer","internet","samsung","google","facebook","admin","administrator","root","changeme","secret","default","login","abc","test","temp","demo","company","corporate"];function st(e){return e.toLowerCase().replace(/[@4]/g,"a").replace(/[3]/g,"e").replace(/[1!|]/g,"i").replace(/[0]/g,"o").replace(/[5$]/g,"s").replace(/[7]/g,"t")}function zi(e){let t=e.toLowerCase();if(/^(.)\1+$/.test(t))return!0;let n=["abcdefghijklmnopqrstuvwxyz","0123456789","qwertyuiopasdfghjklzxcvbnm"],r=t.replace(/[^a-z0-9]/g,"");if(r.length>=6){for(let o of n)if(o.includes(r)||[...o].reverse().join("").includes(r))return!0}return!1}function it(e){let t=vn(e);if(!t.ok)return t;let r=st(e).replace(/[^a-z]/g,"");for(let o of ot)if(r===o||r.startsWith(o)||r.endsWith(o))return{ok:!1,error:"That passphrase is built on a word attackers try first, so it would fall to the first few guesses \u2014 pick something unrelated to a common word."};return zi(e)?{ok:!1,error:"That passphrase is a repeated character or a keyboard sequence. Pick something without a predictable pattern."}:new Set(e).size<8?{ok:!1,error:"That passphrase reuses too few distinct characters. Use at least eight different ones."}:{ok:!0}}var Ot=13,qi=`You are choosing the passphrase that protects every secret in this workspace. Every guess at it has to go through our server, which allows only a few at a time, but someone who took over our server could guess offline without that limit. Make it very strong: at least ${Ot} characters (20 or more is better), never used anywhere else, mixing upper and lower case, numbers and symbols through it rather than at the end. Nobody, including Redaktyn, can reset it.`,Dt=["redaktyn","workspace","summer","winter","spring","autumn","hello","love","money","office","user"],so=6,Pt=["abcdefghijklmnopqrstuvwxyz","1234567890","qwertyuiop","asdfghjkl","zxcvbnm"];function Yi(e,t){let n=e.toLowerCase(),r=Pt.flatMap(o=>[o,[...o].reverse().join("")]);for(let o=0;o+t<=n.length;o++){let s=n.slice(o,o+t);if(r.some(i=>i.includes(s)))return!0}return!1}function Rn(e){if(e.length<Ot)return{ok:!1,error:`Your own passphrase must be at least ${Ot} characters. Longer is stronger: 20 or more is better.`};if(e!==e.trim())return{ok:!1,error:"The passphrase cannot start or end with a space. It is too easy to lose when you type it again."};if(/^[=+\-@]/.test(e))return{ok:!1,error:"The passphrase cannot start with =, +, - or @."};let t=vn(e);if(!t.ok)return t;let n=st(e).replace(/[^a-z]/g,"");for(let o of[...ot,...Dt])if(n.includes(o))return{ok:!1,error:`That passphrase contains "${o}" (or a look-alike), which attackers try first. Leave common words out entirely.`};if(/(.)\1\1/.test(e.toLowerCase()))return{ok:!1,error:"That passphrase repeats a character three times in a row."};if(Yi(e,4))return{ok:!1,error:"That passphrase contains a sequence like abcd, 1234 or qwer. Leave predictable runs out."};if(/(^|\D)(19|20)\d\d(\D|$)/.test(e))return{ok:!1,error:"That passphrase contains what looks like a year. Dates are among the first things guessed."};let r=/^[A-Za-z]+([^A-Za-z]+)$/.exec(e)??/^([^A-Za-z]+)[A-Za-z]+$/.exec(e);return r&&r[1].length<so?{ok:!1,error:`That passphrase is letters with only a few numbers or symbols added at one end, the first pattern attackers try. Mix them through it, or add at least ${so}.`}:new Set(e).size<10?{ok:!1,error:"That passphrase reuses too few characters. Use at least ten different ones."}:{ok:!0}}var io=64,Zi=16,Xi=7,Ji=8,Qi=4,ea=10,ta=["prod","production","staging","develop","database","postgres","mysql","mongo","redis","oracle","pass","pwd","token","access","server","service","backup","guest","manager","support","system","india","mumbai","delhi","bangalore","london","january","february","march","april","june","july","august","september","october","november","december","monday","friday","sunday","cricket","tiger"],na=[...new Set([...ot,...Dt,...ta])].filter(e=>e.length>=3).sort((e,t)=>t.length-e.length);function ra(e){if(/^[0-9a-f]+$/.test(e))return 16;let t=0;return/[a-z]/.test(e)&&(t+=26),/[0-9]/.test(e)&&(t+=10),/[!-/:-@[-`{-~]/.test(e)&&(t+=33),/[^\x00-\x7f]/.test(e)&&(t+=100),Math.max(t,2)}function oa(e,t){let n=0,r=1;for(;t+r<e.length&&e[t+r]===e[t];)r++;r>=4&&(n=r);for(let o of Pt)for(let s of[o,[...o].reverse().join("")]){let i=0;for(;t+i<e.length&&s.includes(e.slice(t,t+i+1));)i++;i>=4&&i>n&&(n=i)}return n}function sa(e){let t=He(e),n=Math.log2(ra(t)),r=st(t),o=new Array(t.length).fill(!1),s=[],i=0,c=(u,f,p,d)=>{for(let h=u;h<u+f;h++)if(o[h])return!1;for(let h=u;h<u+f;h++)o[h]=!0;return i+=Math.min(p,f*n),s.push(d),!0};for(let u of na)for(let f=r.indexOf(u);f>=0;f=r.indexOf(u,f+1))c(f,u.length,Zi,`the word ${u}`)&&(f+=u.length-1);for(let u of t.matchAll(/(?:19|20)\d\d/g))c(u.index,4,Xi,`the year ${u[0]}`);for(let u=0;u<t.length;u++){let f=o[u]?0:oa(t,u);f>=4&&c(u,f,Ji,`the run ${t.slice(u,u+f)}`)&&(u+=f-1)}let a=s.some(u=>u.startsWith("the word "));for(let u=0;u<t.length;){if(o[u]){u++;continue}let f=u;for(;f<t.length&&!o[f];)f++;let p=f-u;i+=a&&p<=Qi?Math.min(ea,p*n):p*n,u=f}return{guessable:i<io,bits:Math.floor(i),patterns:s}}function ia(e){return`This value could be found by guessing.${e.patterns.length>0?` It is built from ${e.patterns.slice(0,3).join(", ")}.`:" It is short."} Redaktyn keeps only its fingerprint, but anyone who copies the key off one of your team's devices can test guesses against that fingerprint very fast, and a value like this can be found that way. A long random value cannot. If you can, change it to a random one and register that. Registering this one still stops it being pasted.`}var aa="ABCDEFGHJKLMNPQRSTUVWXYZ",ca="abcdefghijkmnpqrstuvwxyz",la="23456789",Lt=aa+ca+la,ao=5,Tn=5,ua=128;function da(e){let t=256-256%e,n=new Uint8Array(1);for(;;){globalThis.crypto.getRandomValues(n);let r=n[0]??255;if(r<t)return r%e}}function fa(){let e=[];for(let t=0;t<ao;t++){let n="";for(let r=0;r<Tn;r++)n+=Lt[da(Lt.length)];e.push(n)}return e.join("-")}function pa(){for(;;){let e=fa();if(!(!/[A-Z]/.test(e)||!/[a-z]/.test(e)||!/[0-9]/.test(e))&&it(e).ok)return e}}function ha(e,t){return["Redaktyn workspace passphrase","",e,"",`Created ${t.toISOString().slice(0,10)}.`,"","This passphrase derives the key your workspace's fingerprints are made with.","Redaktyn never receives it, so nobody can reset it for you.","Move it into a password manager or a safe, then delete this file.",""].join(`
+`)}var Ut="Redaktyn workspace",_n="https://passphrase.redaktyn.invalid/";function ma(e){return`"${e.replace(/"/g,'""')}"`}function ya(e){let t="Redaktyn workspace passphrase. Nobody can reset it. Delete this file after importing it.";for(let n of[Ut,_n,e,t])if(/^[=+\-@\t\r]/.test(n))throw new Error("A password-manager file field cannot start with a formula character");return["name,url,username,password,note",[Ut,_n,Ut,e,t].map(ma).join(","),""].join(`
+`)}var co='A new workspace needs a generated passphrase here: a generated one cannot be guessed, and one a person makes up often can. Use "Generate" to create one.',ga=new RegExp(`^[${Lt}]{${Tn}}(?:-[${Lt}]{${Tn}}){${ao-1}}$`),ba=12;function Mn(e){if(!ga.test(e))return!1;let t=e.replace(/-/g,"");return new Set(t).size>=ba}function Ea(e){return Mn(e)?it(e):{ok:!1,error:co}}function xa(e){return Mn(e)?it(e):Rn(e)}function lo(e){return!e||typeof e!="object"?!1:e.version===2}function uo(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.encryptedKey=="string"&&t.encryptedKey.length>0&&typeof t.iv=="string"&&t.iv.length>0&&typeof t.salt=="string"&&t.salt.length>0}function wa(e){return lo(e)?e:uo(e)?{version:2,passphrase:e}:null}function at(e){let t=new ArrayBuffer(e.byteLength);return new Uint8Array(t).set(e),t}function Cn(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function On(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function fo(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}var Bt=32,ka=256,Aa=12;function Sa(){return fo(Bt)}async function po(e){if(e.byteLength===0)throw new Error("PRF output is empty");let t=await crypto.subtle.digest("SHA-256",at(e));return crypto.subtle.importKey("raw",t,{name:"AES-GCM",length:ka},!1,["encrypt","decrypt"])}async function Ia(e,t,n,r,o){if(e.byteLength!==32)throw new Error("HMAC key must be 32 bytes");if(t.byteLength!==Bt)throw new Error("PRF output must be 32 bytes");if(n.byteLength!==Bt)throw new Error("PRF salt must be 32 bytes");if(!r)throw new Error("credentialId is required");let s=await po(t),i=fo(Aa),c=await crypto.subtle.encrypt({name:"AES-GCM",iv:at(i)},s,at(e)),a={credentialId:r,prfSalt:Cn(n),iv:Cn(i),ciphertext:Cn(new Uint8Array(c)),createdAt:Date.now()};return o&&o.trim().length>0&&(a.label=o.trim().slice(0,64)),a}async function va(e,t){if(t.byteLength!==Bt)throw new Error("PRF output must be 32 bytes");let n=await po(t),r=On(e.iv),o=On(e.ciphertext),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:at(r)},n,at(o)),i=new Uint8Array(s);if(i.byteLength!==32)throw i.fill(0),new Error("Invalid HMAC key material");return i}function Ra(e){return On(e.prfSalt)}function Ta(e,t){let r=(e?.passkey??[]).filter(o=>o.credentialId!==t.credentialId);return{version:2,passphrase:e?.passphrase,passkey:[...r,t]}}function _a(e,t){let n=e?.passkey??[];return{version:2,passphrase:e?.passphrase,passkey:n.filter(r=>r.credentialId!==t)}}function Ma(e,t){return e?.passkey?.find(n=>n.credentialId===t)}var Un=BigInt(0),Pn=BigInt(1);function Nt(e,t=""){if(typeof e!="boolean"){let n=t&&`"${t}"`;throw new Error(n+"expected boolean, got type="+typeof e)}return e}function ct(e,t,n=""){let r=re(e),o=e?.length,s=t!==void 0;if(!r||s&&o!==t){let i=n&&`"${n}" `,c=s?` of length ${t}`:"",a=r?`length=${o}`:`type=${typeof e}`;throw new Error(i+"expected Uint8Array"+c+", got "+a)}return e}function Ln(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?Un:BigInt("0x"+e)}function lt(e){return Ln(W(e))}function Y(e){return L(e),Ln(W(Uint8Array.from(e).reverse()))}function Ge(e,t){return Q(e.toString(16).padStart(t*2,"0"))}function Ht(e,t){return Ge(e,t).reverse()}function K(e,t,n){let r;if(typeof t=="string")try{r=Q(t)}catch(s){throw new Error(e+" must be hex string or Uint8Array, cause: "+s)}else if(re(t))r=Uint8Array.from(t);else throw new Error(e+" must be hex string or Uint8Array");let o=r.length;if(typeof n=="number"&&o!==n)throw new Error(e+" of length "+n+" expected, got "+o);return r}function Bn(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function Gt(e){return Uint8Array.from(e)}var Dn=e=>typeof e=="bigint"&&Un<=e;function ho(e,t,n){return Dn(e)&&Dn(t)&&Dn(n)&&t<=e&&e<n}function Ft(e,t,n,r){if(!ho(t,n,r))throw new Error("expected valid "+e+": "+n+" <= n < "+r+", got "+t)}function Nn(e){let t;for(t=0;e>Un;e>>=Pn,t+=1);return t}var Fe=e=>(Pn<<BigInt(e))-Pn;function Ve(e,t,n={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function r(o,s,i){let c=e[o];if(i&&c===void 0)return;let a=typeof c;if(a!==s||c===null)throw new Error(`param "${o}" is invalid: expected ${s}, got ${a}`)}Object.entries(t).forEach(([o,s])=>r(o,s,!1)),Object.entries(n).forEach(([o,s])=>r(o,s,!0))}var Vt=()=>{throw new Error("not implemented")};function Wt(e){let t=new WeakMap;return(n,...r)=>{let o=t.get(n);if(o!==void 0)return o;let s=e(n,...r);return t.set(n,s),s}}var V=BigInt(0),N=BigInt(1),Te=BigInt(2),go=BigInt(3),bo=BigInt(4),Eo=BigInt(5),Da=BigInt(7),xo=BigInt(8),Pa=BigInt(9),wo=BigInt(16);function O(e,t){let n=e%t;return n>=V?n:t+n}function te(e,t,n){let r=e;for(;t-- >V;)r*=r,r%=n;return r}function mo(e,t){if(e===V)throw new Error("invert: expected non-zero number");if(t<=V)throw new Error("invert: expected positive modulus, got "+t);let n=O(e,t),r=t,o=V,s=N,i=N,c=V;for(;n!==V;){let u=r/n,f=r%n,p=o-i*u,d=s-c*u;r=n,n=f,o=i,s=c,i=p,c=d}if(r!==N)throw new Error("invert: does not exist");return O(o,t)}function Hn(e,t,n){if(!e.eql(e.sqr(t),n))throw new Error("Cannot find square root")}function ko(e,t){let n=(e.ORDER+N)/bo,r=e.pow(t,n);return Hn(e,r,t),r}function Ua(e,t){let n=(e.ORDER-Eo)/xo,r=e.mul(t,Te),o=e.pow(r,n),s=e.mul(t,o),i=e.mul(e.mul(s,Te),o),c=e.mul(s,e.sub(i,e.ONE));return Hn(e,c,t),c}function La(e){let t=de(e),n=Ao(e),r=n(t,t.neg(t.ONE)),o=n(t,r),s=n(t,t.neg(r)),i=(e+Da)/wo;return(c,a)=>{let u=c.pow(a,i),f=c.mul(u,r),p=c.mul(u,o),d=c.mul(u,s),h=c.eql(c.sqr(f),a),y=c.eql(c.sqr(p),a);u=c.cmov(u,f,h),f=c.cmov(d,p,y);let g=c.eql(c.sqr(f),a),E=c.cmov(u,f,g);return Hn(c,E,a),E}}function Ao(e){if(e<go)throw new Error("sqrt is not defined for small field");let t=e-N,n=0;for(;t%Te===V;)t/=Te,n++;let r=Te,o=de(e);for(;yo(o,r)===1;)if(r++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(n===1)return ko;let s=o.pow(r,t),i=(t+N)/Te;return function(a,u){if(a.is0(u))return u;if(yo(a,u)!==1)throw new Error("Cannot find square root");let f=n,p=a.mul(a.ONE,s),d=a.pow(u,t),h=a.pow(u,i);for(;!a.eql(d,a.ONE);){if(a.is0(d))return a.ZERO;let y=1,g=a.sqr(d);for(;!a.eql(g,a.ONE);)if(y++,g=a.sqr(g),y===f)throw new Error("Cannot find square root");let E=N<<BigInt(f-y-1),m=a.pow(p,E);f=y,p=a.sqr(m),d=a.mul(d,p),h=a.mul(h,m)}return h}}function Ba(e){return e%bo===go?ko:e%xo===Eo?Ua:e%wo===Pa?La(e):Ao(e)}var ue=(e,t)=>(O(e,t)&N)===N,Na=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function So(e){let t={ORDER:"bigint",MASK:"bigint",BYTES:"number",BITS:"number"},n=Na.reduce((r,o)=>(r[o]="function",r),t);return Ve(e,n),e}function Ha(e,t,n){if(n<V)throw new Error("invalid exponent, negatives unsupported");if(n===V)return e.ONE;if(n===N)return t;let r=e.ONE,o=t;for(;n>V;)n&N&&(r=e.mul(r,o)),o=e.sqr(o),n>>=N;return r}function Kt(e,t,n=!1){let r=new Array(t.length).fill(n?e.ZERO:void 0),o=t.reduce((i,c,a)=>e.is0(c)?i:(r[a]=i,e.mul(i,c)),e.ONE),s=e.inv(o);return t.reduceRight((i,c,a)=>e.is0(c)?i:(r[a]=e.mul(i,r[a]),e.mul(i,c)),s),r}function yo(e,t){let n=(e.ORDER-N)/Te,r=e.pow(t,n),o=e.eql(r,e.ONE),s=e.eql(r,e.ZERO),i=e.eql(r,e.neg(e.ONE));if(!o&&!s&&!i)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function Io(e,t){t!==void 0&&q(t);let n=t!==void 0?t:e.toString(2).length,r=Math.ceil(n/8);return{nBitLength:n,nByteLength:r}}function de(e,t,n=!1,r={}){if(e<=V)throw new Error("invalid field: expected ORDER > 0, got "+e);let o,s,i=!1,c;if(typeof t=="object"&&t!=null){if(r.sqrt||n)throw new Error("cannot specify opts in two arguments");let d=t;d.BITS&&(o=d.BITS),d.sqrt&&(s=d.sqrt),typeof d.isLE=="boolean"&&(n=d.isLE),typeof d.modFromBytes=="boolean"&&(i=d.modFromBytes),c=d.allowedLengths}else typeof t=="number"&&(o=t),r.sqrt&&(s=r.sqrt);let{nBitLength:a,nByteLength:u}=Io(e,o);if(u>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");let f,p=Object.freeze({ORDER:e,isLE:n,BITS:a,BYTES:u,MASK:Fe(a),ZERO:V,ONE:N,allowedLengths:c,create:d=>O(d,e),isValid:d=>{if(typeof d!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof d);return V<=d&&d<e},is0:d=>d===V,isValidNot0:d=>!p.is0(d)&&p.isValid(d),isOdd:d=>(d&N)===N,neg:d=>O(-d,e),eql:(d,h)=>d===h,sqr:d=>O(d*d,e),add:(d,h)=>O(d+h,e),sub:(d,h)=>O(d-h,e),mul:(d,h)=>O(d*h,e),pow:(d,h)=>Ha(p,d,h),div:(d,h)=>O(d*mo(h,e),e),sqrN:d=>d*d,addN:(d,h)=>d+h,subN:(d,h)=>d-h,mulN:(d,h)=>d*h,inv:d=>mo(d,e),sqrt:s||(d=>(f||(f=Ba(e)),f(p,d))),toBytes:d=>n?Ht(d,u):Ge(d,u),fromBytes:(d,h=!0)=>{if(c){if(!c.includes(d.length)||d.length>u)throw new Error("Field.fromBytes: expected "+c+" bytes, got "+d.length);let g=new Uint8Array(u);g.set(d,n?0:g.length-d.length),d=g}if(d.length!==u)throw new Error("Field.fromBytes: expected "+u+" bytes, got "+d.length);let y=n?Y(d):lt(d);if(i&&(y=O(y,e)),!h&&!p.isValid(y))throw new Error("invalid field element: outside of range 0..ORDER");return y},invertBatch:d=>Kt(p,d),cmov:(d,h,y)=>y?h:d});return Object.freeze(p)}function vo(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function Gn(e){let t=vo(e);return t+Math.ceil(t/2)}function Ro(e,t,n=!1){let r=e.length,o=vo(t),s=Gn(t);if(r<16||r<s||r>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+r);let i=n?Y(e):lt(e),c=O(i,t-N)+N;return n?Ht(c,o):Ge(c,o)}var $t=BigInt(0),Kn=BigInt(1);function To(e,t){let n=t.negate();return e?n:t}function ut(e,t){let n=Kt(e.Fp,t.map(r=>r.Z));return t.map((r,o)=>e.fromAffine(r.toAffine(n[o])))}function Oo(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function Fn(e,t){Oo(e,t);let n=Math.ceil(t/e)+1,r=2**(e-1),o=2**e,s=Fe(e),i=BigInt(e);return{windows:n,windowSize:r,mask:s,maxNumber:o,shiftBy:i}}function _o(e,t,n){let{windowSize:r,mask:o,maxNumber:s,shiftBy:i}=n,c=Number(e&o),a=e>>i;c>r&&(c-=s,a+=Kn);let u=t*r,f=u+Math.abs(c)-1,p=c===0,d=c<0,h=t%2!==0;return{nextN:a,offset:f,isZero:p,isNeg:d,isNegF:h,offsetF:u}}function Fa(e,t){if(!Array.isArray(e))throw new Error("array expected");e.forEach((n,r)=>{if(!(n instanceof t))throw new Error("invalid point at index "+r)})}function Va(e,t){if(!Array.isArray(e))throw new Error("array of scalars expected");e.forEach((n,r)=>{if(!t.isValid(n))throw new Error("invalid scalar at index "+r)})}var Vn=new WeakMap,Do=new WeakMap;function Wn(e){return Do.get(e)||1}function Mo(e){if(e!==$t)throw new Error("invalid wNAF")}var jt=class{constructor(t,n){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=n}_unsafeLadder(t,n,r=this.ZERO){let o=t;for(;n>$t;)n&Kn&&(r=r.add(o)),o=o.double(),n>>=Kn;return r}precomputeWindow(t,n){let{windows:r,windowSize:o}=Fn(n,this.bits),s=[],i=t,c=i;for(let a=0;a<r;a++){c=i,s.push(c);for(let u=1;u<o;u++)c=c.add(i),s.push(c);i=c.double()}return s}wNAF(t,n,r){if(!this.Fn.isValid(r))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,i=Fn(t,this.bits);for(let c=0;c<i.windows;c++){let{nextN:a,offset:u,isZero:f,isNeg:p,isNegF:d,offsetF:h}=_o(r,c,i);r=a,f?s=s.add(To(d,n[h])):o=o.add(To(p,n[u]))}return Mo(r),{p:o,f:s}}wNAFUnsafe(t,n,r,o=this.ZERO){let s=Fn(t,this.bits);for(let i=0;i<s.windows&&r!==$t;i++){let{nextN:c,offset:a,isZero:u,isNeg:f}=_o(r,i,s);if(r=c,!u){let p=n[a];o=o.add(f?p.negate():p)}}return Mo(r),o}getPrecomputes(t,n,r){let o=Vn.get(n);return o||(o=this.precomputeWindow(n,t),t!==1&&(typeof r=="function"&&(o=r(o)),Vn.set(n,o))),o}cached(t,n,r){let o=Wn(t);return this.wNAF(o,this.getPrecomputes(o,t,r),n)}unsafe(t,n,r,o){let s=Wn(t);return s===1?this._unsafeLadder(t,n,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,r),n,o)}createCache(t,n){Oo(n,this.bits),Do.set(t,n),Vn.delete(t)}hasCache(t){return Wn(t)!==1}};function zt(e,t,n,r){Fa(n,e),Va(r,t);let o=n.length,s=r.length;if(o!==s)throw new Error("arrays of points and scalars must have equal length");let i=e.ZERO,c=Nn(BigInt(o)),a=1;c>12?a=c-3:c>4?a=c-2:c>0&&(a=2);let u=Fe(a),f=new Array(Number(u)+1).fill(i),p=Math.floor((t.BITS-1)/a)*a,d=i;for(let h=p;h>=0;h-=a){f.fill(i);for(let g=0;g<s;g++){let E=r[g],m=Number(E>>BigInt(h)&u);f[m]=f[m].add(n[g])}let y=i;for(let g=f.length-1,E=i;g>0;g--)E=E.add(f[g]),y=y.add(E);if(d=d.add(y),h!==0)for(let g=0;g<a;g++)d=d.double()}return d}function Co(e,t,n){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return So(t),t}else return de(e,{isLE:n})}function Po(e,t,n={},r){if(r===void 0&&(r=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let a of["p","n","h"]){let u=t[a];if(!(typeof u=="bigint"&&u>$t))throw new Error(`CURVE.${a} must be positive bigint`)}let o=Co(t.p,n.Fp,r),s=Co(t.n,n.Fn,r),c=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let a of c)if(!o.isValid(t[a]))throw new Error(`CURVE.${a} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}var xe=BigInt(0),H=BigInt(1),$n=BigInt(2),Wa=BigInt(8);function Ka(e,t,n,r){let o=e.sqr(n),s=e.sqr(r),i=e.add(e.mul(t.a,o),s),c=e.add(e.ONE,e.mul(t.d,e.mul(o,s)));return e.eql(i,c)}function $a(e,t={}){let n=Po("edwards",e,t,t.FpFnLE),{Fp:r,Fn:o}=n,s=n.CURVE,{h:i}=s;Ve(t,{},{uvRatio:"function"});let c=$n<<BigInt(o.BYTES*8)-H,a=E=>r.create(E),u=t.uvRatio||((E,m)=>{try{return{isValid:!0,value:r.sqrt(r.div(E,m))}}catch{return{isValid:!1,value:xe}}});if(!Ka(r,s,s.Gx,s.Gy))throw new Error("bad curve params: generator point");function f(E,m,w=!1){let b=w?H:xe;return Ft("coordinate "+E,m,b,c),m}function p(E){if(!(E instanceof y))throw new Error("ExtendedPoint expected")}let d=Wt((E,m)=>{let{X:w,Y:b,Z:I}=E,R=E.is0();m==null&&(m=R?Wa:r.inv(I));let D=a(w*m),P=a(b*m),v=r.mul(I,m);if(R)return{x:xe,y:H};if(v!==H)throw new Error("invZ was invalid");return{x:D,y:P}}),h=Wt(E=>{let{a:m,d:w}=s;if(E.is0())throw new Error("bad point: ZERO");let{X:b,Y:I,Z:R,T:D}=E,P=a(b*b),v=a(I*I),x=a(R*R),k=a(x*x),S=a(P*m),T=a(x*a(S+v)),C=a(k+a(w*a(P*v)));if(T!==C)throw new Error("bad point: equation left != right (1)");let _=a(b*I),U=a(R*D);if(_!==U)throw new Error("bad point: equation left != right (2)");return!0});class y{constructor(m,w,b,I){this.X=f("x",m),this.Y=f("y",w),this.Z=f("z",b,!0),this.T=f("t",I),Object.freeze(this)}static CURVE(){return s}static fromAffine(m){if(m instanceof y)throw new Error("extended point not allowed");let{x:w,y:b}=m||{};return f("x",w),f("y",b),new y(w,b,H,a(w*b))}static fromBytes(m,w=!1){let b=r.BYTES,{a:I,d:R}=s;m=Gt(ct(m,b,"point")),Nt(w,"zip215");let D=Gt(m),P=m[b-1];D[b-1]=P&-129;let v=Y(D),x=w?c:r.ORDER;Ft("point.y",v,xe,x);let k=a(v*v),S=a(k-H),T=a(R*k-I),{isValid:C,value:_}=u(S,T);if(!C)throw new Error("bad point: invalid y coordinate");let U=(_&H)===H,$=(P&128)!==0;if(!w&&_===xe&&$)throw new Error("bad point: x=0 and x_0=1");return $!==U&&(_=a(-_)),y.fromAffine({x:_,y:v})}static fromHex(m,w=!1){return y.fromBytes(K("point",m),w)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(m=8,w=!0){return g.createCache(this,m),w||this.multiply($n),this}assertValidity(){h(this)}equals(m){p(m);let{X:w,Y:b,Z:I}=this,{X:R,Y:D,Z:P}=m,v=a(w*P),x=a(R*I),k=a(b*P),S=a(D*I);return v===x&&k===S}is0(){return this.equals(y.ZERO)}negate(){return new y(a(-this.X),this.Y,this.Z,a(-this.T))}double(){let{a:m}=s,{X:w,Y:b,Z:I}=this,R=a(w*w),D=a(b*b),P=a($n*a(I*I)),v=a(m*R),x=w+b,k=a(a(x*x)-R-D),S=v+D,T=S-P,C=v-D,_=a(k*T),U=a(S*C),$=a(k*C),me=a(T*S);return new y(_,U,me,$)}add(m){p(m);let{a:w,d:b}=s,{X:I,Y:R,Z:D,T:P}=this,{X:v,Y:x,Z:k,T:S}=m,T=a(I*v),C=a(R*x),_=a(P*b*S),U=a(D*k),$=a((I+R)*(v+x)-T-C),me=U-_,ke=U+_,ie=a(C-w*T),qe=a($*me),kt=a(ke*ie),cn=a($*ie),wr=a(me*ke);return new y(qe,kt,wr,cn)}subtract(m){return this.add(m.negate())}multiply(m){if(!o.isValidNot0(m))throw new Error("invalid scalar: expected 1 <= sc < curve.n");let{p:w,f:b}=g.cached(this,m,I=>ut(y,I));return ut(y,[w,b])[0]}multiplyUnsafe(m,w=y.ZERO){if(!o.isValid(m))throw new Error("invalid scalar: expected 0 <= sc < curve.n");return m===xe?y.ZERO:this.is0()||m===H?this:g.unsafe(this,m,b=>ut(y,b),w)}isSmallOrder(){return this.multiplyUnsafe(i).is0()}isTorsionFree(){return g.unsafe(this,s.n).is0()}toAffine(m){return d(this,m)}clearCofactor(){return i===H?this:this.multiplyUnsafe(i)}toBytes(){let{x:m,y:w}=this.toAffine(),b=r.toBytes(w);return b[b.length-1]|=m&H?128:0,b}toHex(){return W(this.toBytes())}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}get ex(){return this.X}get ey(){return this.Y}get ez(){return this.Z}get et(){return this.T}static normalizeZ(m){return ut(y,m)}static msm(m,w){return zt(y,o,m,w)}_setWindowSize(m){this.precompute(m)}toRawBytes(){return this.toBytes()}}y.BASE=new y(s.Gx,s.Gy,H,a(s.Gx*s.Gy)),y.ZERO=new y(xe,H,H,xe),y.Fp=r,y.Fn=o;let g=new jt(y,o.BITS);return y.BASE.precompute(8),y}var qt=class{constructor(t){this.ep=t}static fromBytes(t){Vt()}static fromHex(t){Vt()}get x(){return this.toAffine().x}get y(){return this.toAffine().y}clearCofactor(){return this}assertValidity(){this.ep.assertValidity()}toAffine(t){return this.ep.toAffine(t)}toHex(){return W(this.toBytes())}toString(){return this.toHex()}isTorsionFree(){return!0}isSmallOrder(){return!1}add(t){return this.assertSame(t),this.init(this.ep.add(t.ep))}subtract(t){return this.assertSame(t),this.init(this.ep.subtract(t.ep))}multiply(t){return this.init(this.ep.multiply(t))}multiplyUnsafe(t){return this.init(this.ep.multiplyUnsafe(t))}double(){return this.init(this.ep.double())}negate(){return this.init(this.ep.negate())}precompute(t,n){return this.init(this.ep.precompute(t,n))}toRawBytes(){return this.toBytes()}};function ja(e,t,n={}){if(typeof t!="function")throw new Error('"hash" function param is required');Ve(n,{},{adjustScalarBytes:"function",randomBytes:"function",domain:"function",prehash:"function",mapToCurve:"function"});let{prehash:r}=n,{BASE:o,Fp:s,Fn:i}=e,c=n.randomBytes||Be,a=n.adjustScalarBytes||(x=>x),u=n.domain||((x,k,S)=>{if(Nt(S,"phflag"),k.length||S)throw new Error("Contexts/pre-hash are not supported");return x});function f(x){return i.create(Y(x))}function p(x){let k=b.secretKey;x=K("private key",x,k);let S=K("hashed private key",t(x),2*k),T=a(S.slice(0,k)),C=S.slice(k,2*k),_=f(T);return{head:T,prefix:C,scalar:_}}function d(x){let{head:k,prefix:S,scalar:T}=p(x),C=o.multiply(T),_=C.toBytes();return{head:k,prefix:S,scalar:T,point:C,pointBytes:_}}function h(x){return d(x).pointBytes}function y(x=Uint8Array.of(),...k){let S=B(...k);return f(t(u(S,K("context",x),!!r)))}function g(x,k,S={}){x=K("message",x),r&&(x=r(x));let{prefix:T,scalar:C,pointBytes:_}=d(k),U=y(S.context,T,x),$=o.multiply(U).toBytes(),me=y(S.context,$,_,x),ke=i.create(U+me*C);if(!i.isValid(ke))throw new Error("sign failed: invalid s");let ie=B($,i.toBytes(ke));return ct(ie,b.signature,"result")}let E={zip215:!0};function m(x,k,S,T=E){let{context:C,zip215:_}=T,U=b.signature;x=K("signature",x,U),k=K("message",k),S=K("publicKey",S,b.publicKey),_!==void 0&&Nt(_,"zip215"),r&&(k=r(k));let $=U/2,me=x.subarray(0,$),ke=Y(x.subarray($,U)),ie,qe,kt;try{ie=e.fromBytes(S,_),qe=e.fromBytes(me,_),kt=o.multiplyUnsafe(ke)}catch{return!1}if(!_&&ie.isSmallOrder())return!1;let cn=y(C,qe.toBytes(),ie.toBytes(),k);return qe.add(ie.multiplyUnsafe(cn)).subtract(kt).clearCofactor().is0()}let w=s.BYTES,b={secretKey:w,publicKey:w,signature:2*w,seed:w};function I(x=c(b.seed)){return ct(x,b.seed,"seed")}function R(x){let k=v.randomSecretKey(x);return{secretKey:k,publicKey:h(k)}}function D(x){return re(x)&&x.length===i.BYTES}function P(x,k){try{return!!e.fromBytes(x,k)}catch{return!1}}let v={getExtendedPublicKey:d,randomSecretKey:I,isValidSecretKey:D,isValidPublicKey:P,toMontgomery(x){let{y:k}=e.fromBytes(x),S=b.publicKey,T=S===32;if(!T&&S!==57)throw new Error("only defined for 25519 and 448");let C=T?s.div(H+k,H-k):s.div(k-H,k+H);return s.toBytes(C)},toMontgomerySecret(x){let k=b.secretKey;ct(x,k);let S=t(x.subarray(0,k));return a(S).subarray(0,k)},randomPrivateKey:I,precompute(x=8,k=e.BASE){return k.precompute(x,!1)}};return Object.freeze({keygen:R,getPublicKey:h,sign:g,verify:m,utils:v,Point:e,lengths:b})}function za(e){let t={a:e.a,d:e.d,p:e.Fp.ORDER,n:e.n,h:e.h,Gx:e.Gx,Gy:e.Gy},n=e.Fp,r=de(t.n,e.nBitLength,!0),o={Fp:n,Fn:r,uvRatio:e.uvRatio},s={randomBytes:e.randomBytes,adjustScalarBytes:e.adjustScalarBytes,domain:e.domain,prehash:e.prehash,mapToCurve:e.mapToCurve};return{CURVE:t,curveOpts:o,hash:e.hash,eddsaOpts:s}}function qa(e,t){let n=t.Point;return Object.assign({},t,{ExtendedPoint:n,CURVE:e,nBitLength:n.Fn.BITS,nByteLength:n.Fn.BYTES})}function Uo(e){let{CURVE:t,curveOpts:n,hash:r,eddsaOpts:o}=za(e),s=$a(t,n),i=ja(s,r,o);return qa(e,i)}function We(e,t){if(jn(e),jn(t),e<0||e>=1<<8*t)throw new Error("invalid I2OSP input: "+e);let n=Array.from({length:t}).fill(0);for(let r=t-1;r>=0;r--)n[r]=e&255,e>>>=8;return new Uint8Array(n)}function Za(e,t){let n=new Uint8Array(e.length);for(let r=0;r<e.length;r++)n[r]=e[r]^t[r];return n}function jn(e){if(!Number.isSafeInteger(e))throw new Error("number expected")}function Xa(e){if(!re(e)&&typeof e!="string")throw new Error("DST must be Uint8Array or string");return typeof e=="string"?M(e):e}function zn(e,t,n,r){L(e),jn(n),t=Xa(t),t.length>255&&(t=r(B(M("H2C-OVERSIZE-DST-"),t)));let{outputLen:o,blockLen:s}=r,i=Math.ceil(n/o);if(n>65535||i>255)throw new Error("expand_message_xmd: invalid lenInBytes");let c=B(t,We(t.length,1)),a=We(0,s),u=We(n,2),f=new Array(i),p=r(B(a,e,u,We(0,1),c));f[0]=r(B(p,We(1,1),c));for(let h=1;h<=i;h++){let y=[Za(p,f[h-1]),We(h+1,1),c];f[h]=r(B(...y))}return B(...f).slice(0,n)}var Lo=M("HashToScalar-");var Ja=BigInt(0),fe=BigInt(1),Bo=BigInt(2),Vu=BigInt(3),Qa=BigInt(5),ec=BigInt(8),Ke=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),dt={p:Ke,n:BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),h:ec,a:BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),d:BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),Gx:BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),Gy:BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")};function tc(e){let t=BigInt(10),n=BigInt(20),r=BigInt(40),o=BigInt(80),s=Ke,c=e*e%s*e%s,a=te(c,Bo,s)*c%s,u=te(a,fe,s)*e%s,f=te(u,Qa,s)*u%s,p=te(f,t,s)*f%s,d=te(p,n,s)*p%s,h=te(d,r,s)*d%s,y=te(h,o,s)*h%s,g=te(y,o,s)*h%s,E=te(g,t,s)*f%s;return{pow_p_5_8:te(E,Bo,s)*e%s,b2:c}}function nc(e){return e[0]&=248,e[31]&=127,e[31]|=64,e}var qn=BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");function Xn(e,t){let n=Ke,r=O(t*t*t,n),o=O(r*r*t,n),s=tc(e*o).pow_p_5_8,i=O(e*r*s,n),c=O(t*i*i,n),a=i,u=O(i*qn,n),f=c===e,p=c===O(-e,n),d=c===O(-e*qn,n);return f&&(i=a),(p||d)&&(i=u),ue(i,n)&&(i=O(-i,n)),{isValid:f||p,value:i}}var we=de(dt.p,{isLE:!0}),Go=de(dt.n,{isLE:!0}),rc={...dt,Fp:we,hash:Ne,adjustScalarBytes:nc,uvRatio:Xn},_e=Uo(rc);var Yn=qn,oc=BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235"),sc=BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578"),ic=BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838"),ac=BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952"),No=e=>Xn(fe,e),cc=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),Zn=e=>_e.Point.Fp.create(Y(e)&cc);function Ho(e){let{d:t}=dt,n=Ke,r=m=>we.create(m),o=r(Yn*e*e),s=r((o+fe)*ic),i=BigInt(-1),c=r((i-t*o)*r(o+t)),{isValid:a,value:u}=Xn(s,c),f=r(u*e);ue(f,n)||(f=r(-f)),a||(u=f),a||(i=o);let p=r(i*(o-fe)*ac-c),d=u*u,h=r((u+u)*c),y=r(p*oc),g=r(fe-d),E=r(fe+d);return new _e.Point(r(h*E),r(g*y),r(y*E),r(h*g))}function Fo(e){L(e,64);let t=Zn(e.subarray(0,32)),n=Ho(t),r=Zn(e.subarray(32,64)),o=Ho(r);return new se(n.add(o))}var se=class e extends qt{constructor(t){super(t)}static fromAffine(t){return new e(_e.Point.fromAffine(t))}assertSame(t){if(!(t instanceof e))throw new Error("RistrettoPoint expected")}init(t){return new e(t)}static hashToCurve(t){return Fo(K("ristrettoHash",t,64))}static fromBytes(t){L(t,32);let{a:n,d:r}=dt,o=Ke,s=I=>we.create(I),i=Zn(t);if(!Bn(we.toBytes(i),t)||ue(i,o))throw new Error("invalid ristretto255 encoding 1");let c=s(i*i),a=s(fe+n*c),u=s(fe-n*c),f=s(a*a),p=s(u*u),d=s(n*r*f-p),{isValid:h,value:y}=No(s(d*p)),g=s(y*u),E=s(y*g*d),m=s((i+i)*g);ue(m,o)&&(m=s(-m));let w=s(a*E),b=s(m*w);if(!h||ue(b,o)||w===Ja)throw new Error("invalid ristretto255 encoding 2");return new e(new _e.Point(m,w,fe,b))}static fromHex(t){return e.fromBytes(K("ristrettoHex",t,32))}static msm(t,n){return zt(e,_e.Point.Fn,t,n)}toBytes(){let{X:t,Y:n,Z:r,T:o}=this.ep,s=Ke,i=E=>we.create(E),c=i(i(r+n)*i(r-n)),a=i(t*n),u=i(a*a),{value:f}=No(i(c*u)),p=i(f*c),d=i(f*a),h=i(p*d*o),y;if(ue(o*h,s)){let E=i(n*Yn),m=i(t*Yn);t=E,n=m,y=i(p*sc)}else y=d;ue(t*h,s)&&(n=i(-n));let g=i((r-n)*y);return ue(g,s)&&(g=i(-g)),we.toBytes(g)}equals(t){this.assertSame(t);let{X:n,Y:r}=this.ep,{X:o,Y:s}=t.ep,i=u=>we.create(u),c=i(n*s)===i(r*o),a=i(r*s)===i(n*o);return c||a}is0(){return this.equals(e.ZERO)}};se.BASE=new se(_e.Point.BASE);se.ZERO=new se(_e.Point.ZERO);se.Fp=we;se.Fn=Go;var Vo={Point:se},Yt={hashToCurve(e,t){let n=t?.DST||"ristretto255_XMD:SHA-512_R255MAP_RO_",r=zn(e,n,64,Ne);return Fo(r)},hashToScalar(e,t={DST:Lo}){let n=zn(e,t.DST,64,Ne);return Go.create(Y(n))}};var pe=B;var Zt=Y,Wo=Ge;var Ko=Ne;var he=Vo.Point,F=he.Fn,Me=e=>new TextEncoder().encode(e),Jn=pe(Me("OPRFV1-"),Uint8Array.of(0),Me("-ristretto255-SHA512")),je=32,lc=64;function jo(...e){let t=[];for(let n of e)if(typeof n=="string")t.push(Me(n));else{if(n.length>65535)throw new Error("OPRF input longer than 65535 bytes");t.push(Wo(n.length,2),n)}return pe(...t)}function uc(e){let t=Yt.hashToCurve(e,{DST:pe(Me("HashToGroup-"),Jn)});if(t.equals(he.ZERO))throw new Error("OPRF input maps to the identity");return t}function $e(e,t){if(t.length!==je)throw new Error(`OPRF ${e} element must be 32 bytes`);let n=he.fromBytes(t);if(n.equals(he.ZERO))throw new Error(`OPRF ${e} element is the identity`);return n}function ze(e,t){if(t.length!==je)throw new Error(`OPRF ${e} must be 32 bytes`);let n=Zt(t);if(n>=F.ORDER)throw new Error(`OPRF ${e} is not a canonical scalar`);if(F.is0(n))throw new Error(`OPRF ${e} is zero`);return n}function Qn(){for(;;){let e=Zt(Ro(Be(Gn(F.ORDER)),F.ORDER,!0));if(!F.is0(e))return e}}function ft(e,t){let n=t?ze("blind",t):Qn(),r=uc(e).multiply(n);return{blind:F.toBytes(n),blinded:r.toBytes()}}function dc(e,t){return $e("blinded",t).multiply(ze("secret key",e)).toBytes()}function pt(e,t,n){let r=$e("evaluated",n).multiply(F.inv(ze("blind",t))).toBytes();return Ko(jo(e,r,"Finalize"))}function fc(e,t){if(e.length!==32)throw new Error("OPRF key seed must be 32 bytes");let n=pe(e,jo(t),Uint8Array.of(0)),r=pe(Me("DeriveKeyPair"),Jn);for(let o=0;o<=255;o++){n[n.length-1]=o;let s=Yt.hashToScalar(n,{DST:r});if(!F.is0(s))return F.toBytes(s)}throw new Error("Cannot derive OPRF key")}function pc(){return F.toBytes(Qn())}function er(e){try{return ze("secret key",e),!0}catch{return!1}}var Jt=64,hc=pe(Me("DLEQ-redaktyn-v1-"),Jn);function Xt(e,t){return F.is0(t)?he.ZERO:e.multiply(t)}function $o(e,t){if(t.length!==je)throw new Error(`OPRF ${e} must be 32 bytes`);let n=Zt(t);if(n>=F.ORDER)throw new Error(`OPRF ${e} is not a canonical scalar`);return n}function zo(e,t,n,r,o){let s=pe(e.toBytes(),t.toBytes(),n.toBytes(),r.toBytes(),o.toBytes(),Me("Challenge"));return Yt.hashToScalar(s,{DST:hc})}function tr(e){return he.BASE.multiply(ze("secret key",e)).toBytes()}function nr(e,t){let n=ze("secret key",e),r=$e("blinded",t),o=r.multiply(n),s=he.BASE.multiply(n),i=Qn(),c=zo(s,r,o,he.BASE.multiply(i),r.multiply(i)),a=F.sub(i,F.mul(c,n));return{evaluated:o.toBytes(),proof:pe(F.toBytes(c),F.toBytes(a))}}function ht(e,t,n,r){try{if(r.length!==Jt)return!1;let o=$e("public key",e),s=$e("blinded",t),i=$e("evaluated",n),c=$o("proof challenge",r.subarray(0,je)),a=$o("proof response",r.subarray(je)),u=Xt(he.BASE,a).add(Xt(o,c)),f=Xt(s,a).add(Xt(i,c));return zo(o,s,i,u,f)===c}catch{return!1}}var or={},qo=["redaktyn.com","www.redaktyn.com"],Z=class extends Error{constructor(t){super(t),this.name="OprfProofError"}},rr=/^[0-9a-f]{64}$/;function Qt(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function mc(e){return new URL(e).host.toLowerCase()}function Yo(e){let t=e.officialHosts??qo,n=e.officialPins??or;return t.includes(e.scope.toLowerCase())&&Object.keys(n).length>0}function yc(e={}){let t=new Map(Object.entries(e));return{entries:t,get:(n,r)=>t.get(`${n}|${r}`)??null,set:(n,r,o)=>{t.set(`${n}|${r}`,o)}}}async function en(e,t,n){if(typeof n.proof!="string")throw new Z("This server did not prove which key it answered with. Update the server, or do not trust this connection.");let r,o;try{r=Qt(n.proof),o=Qt(n.evaluated)}catch{throw new Z("The server's answer was not understood.")}if(r.length!==Jt)throw new Z("The server's proof was not understood.");let s=e.officialPins??or,i=Yo(e),c=i?s[n.keyId]:void 0;if(i&&!c)throw new Z(`The server answered with a key (${n.keyId}) that Redaktyn does not publish.`);if(c||(c=await e.pins.get(e.scope,n.keyId)),c){if(!rr.test(c)||!ht(Q(c),t,o,r))throw new Z("The server's answer was not made with the key this workspace was set up with. It may have been changed on the way.");return c}if(e.firstUse!=="allow")throw new Z("This server's key is not one this client has been told to trust.");let a=typeof n.publicKey=="string"?n.publicKey.toLowerCase():"";if(!rr.test(a)||!ht(Q(a),t,o,r))throw new Z("The server's proof did not check out.");return await e.pins.set(e.scope,n.keyId,a),a}function sr(e,t,n){let r,o;try{r=Qt(n.evaluated),o=Qt(n.proof)}catch{throw new Z("The key share's answer was not understood.")}if(!rr.test(e)||!ht(Q(e),t,r,o))throw new Z("The key share's answer was not made with the key this workspace was set up with.")}var gc=e=>W(e);var bc=/^[A-Za-z0-9_-]{1,32}$/,Ec=/^[A-Za-z0-9+/]{43}=$/,Jo={"Access-Control-Allow-Origin":"*","Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"Content-Type, Authorization","Access-Control-Max-Age":"86400"};function Ce(e,t,n={}){return new Response(JSON.stringify(t),{status:e,headers:{"Content-Type":"application/json","Cache-Control":"no-store",...Jo,...n}})}function xc(e,t){let n=e.length^t.length,r=Math.max(e.length,t.length);for(let o=0;o<r;o++)n|=(e.charCodeAt(o)||0)^(t.charCodeAt(o)||0);return n===0}function Zo(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function wc(){return"shared"}var Xo=64;function kc(e,t,n){let r=n.slice(0,Xo);if(t<1||!e)return r;let o=e.split(",").map(i=>i.trim()),s=o[o.length-t];return s?s.slice(0,Xo):r}function Ac(e){if(!er(e.secretKey))throw new Error("The share's OPRF key is not a valid key");if(!bc.test(e.kid))throw new Error("The share's key id must be 1-32 letters, digits, - or _");let t=Array.from(tr(e.secretKey),a=>a.toString(16).padStart(2,"0")).join(""),n=e.limits??{perMinute:20,perHour:200},r=e.now??(()=>Date.now()),o=e.clientOf??wc,s=new Map;function i(a,u){let f=(s.get(a)??[]).filter(d=>u-d<36e5),p=f.filter(d=>u-d<60*1e3).length;if(f.length>=n.perHour||p>=n.perMinute)return s.set(a,f),!0;if(f.push(u),s.set(a,f),s.size>1e4){for(let d of s.keys())if(s.delete(d),s.size<=5e3)break}return!1}let c=(a,u)=>{try{e.onEvaluate?.({at:r(),client:a,outcome:u})}catch{}};return async a=>{let f=new URL(a.url).pathname.replace(/\/+$/,"")||"/";if(a.method==="OPTIONS")return new Response(null,{status:204,headers:Jo});if(a.method==="GET"&&(f==="/"||f==="/public-key"))return Ce(200,{kid:e.kid,publicKey:t,scheme:"ristretto255-sha512-oprf-dleq"});if(a.method==="POST"&&f==="/evaluate"){let p=o(a);if(e.token!==void 0){let y=/^Bearer (.+)$/.exec(a.headers.get("authorization")??"")?.[1]??"";if(!xc(y,e.token))return c(p,"refused"),Ce(401,{error:"Unauthorised",code:"UNAUTHORIZED"})}let d=r();if(i(p,d))return c(p,"limited"),Ce(429,{error:"Too many attempts. Wait and try again.",code:"RATE_LIMITED"},{"Retry-After":"60"});let h;try{let y=await a.json();if(typeof y.blinded!="string"||!Ec.test(y.blinded))throw new Error("shape");h=Uint8Array.from(atob(y.blinded),g=>g.charCodeAt(0))}catch{return c(p,"invalid"),Ce(400,{error:"blinded must be a base64 32-byte element",code:"VALIDATION"})}try{let{evaluated:y,proof:g}=nr(e.secretKey,h);return c(p,"ok"),Ce(200,{kid:e.kid,evaluated:Zo(y),proof:Zo(g)})}catch{return c(p,"invalid"),Ce(400,{error:"blinded is not a valid group element",code:"VALIDATION"})}}return Ce(404,{error:"Not found",code:"NOT_FOUND"})}}var Qo=Math.round(25*Math.log2(56)),Sc=tt.toLocaleString("en-US"),Ic=[{id:"never-receive",title:"We never receive your passphrase",body:"It is typed only on a page that belongs to the extension, or in the command line, never in a web page. To open your workspace key, your device sends our server one blinded value that it cannot learn the passphrase from.",plan:"all"},{id:"cannot-work-out",title:"We cannot work it out either",body:`A generated passphrase has about ${Qo} bits of randomness, and every guess costs ${Sc} rounds of key derivation. Even holding a copy of our database and our server's key, guessing it is out of reach. One you choose yourself is held to a strength check, but cannot match that.`,plan:"all"},{id:"key-outside-database",title:"Our server's key is not in the database",body:"A copy of the database holds nothing a passphrase guess can be checked against. Every guess has to be a request our server limits, per person and per workspace.",plan:"all"},{id:"answers-are-proved",title:"Our answers are proved, not just trusted",body:"Every answer from the key-lock server carries a proof that it was made with a particular key. The extension and the command line remember the key they first met and refuse a different one, so something sitting in front of our server cannot quietly answer with a key of its own.",plan:"all"},{id:"invite-links-carry-no-passphrase",title:"Invite links never carry your passphrase",body:"A link sits in inboxes and chats for good, so it holds only a one-time key that opens one wrapped copy of the workspace key, once, on the first connection. On its own it opens nothing, and a link in the old format that carried the passphrase is refused.",plan:"all"},{id:"customer-key-server",title:"A key server you run",body:"Add a second server of your own to your workspace's lock. Opening the workspace key then needs its answer as well, so we cannot open it alone or test passphrase guesses, whatever passphrase you choose, and you can end our ability to by switching it off. If its key is ever lost, nothing can open the workspace, so keep two copies.",plan:"enterprise"},{id:"fingerprints-only",title:"We hold fingerprints, not secrets",body:"Registered secrets exist on our servers only as keyed fingerprints we cannot reverse, under a key we never hold unlocked.",plan:"all"},{id:"removed-stays-removed",title:"A person you remove stays removed",body:"A device that was removed cannot enrol itself again by syncing: every request it makes is checked against the removal, so removing someone is not undone by a laptop that is still running.",plan:"all"},{id:"checked-against-code",title:"Our claims are checked against the code",body:"What these pages say about the lock is held to the code by tests that fail when the two disagree, including the figures above.",plan:"all"}];var vc="oprf-lock-v1",ar="redaktyn-org-key-lock-v1",ts="redaktyn-org-key-lock-v2",ns="redaktyn-org-key-lock-v3",ir="::RSK-",mt=class extends Error{constructor(){super("This workspace also needs its Secret Key, which was shown when it was set up and is in your recovery codes."),this.name="SecretKeyNeededError"}};function Rc(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));return`RSK-${Array.from(e,t=>t.toString(16).padStart(2,"0")).join("")}`}function nn(e){let t=e.trim().toLowerCase().replace(/^rsk-/,"").replace(/[^0-9a-f]/g,"");if(t.length!==32)return null;let n=new Uint8Array(16);for(let r=0;r<16;r++)n[r]=parseInt(t.slice(r*2,r*2+2),16);return n}function cr(e){let t=e.lastIndexOf(ir);if(t<=0)return{passphrase:e,secretKey:null};let n=`RSK-${e.slice(t+ir.length)}`;return nn(n)?{passphrase:e.slice(0,t),secretKey:n}:{passphrase:e,secretKey:null}}function Tc(e,t){return!t||cr(e).secretKey?e:`${e}${ir}${t.replace(/^RSK-/i,"")}`}var tn=class extends Error{constructor(t="This workspace's key needs your key-share server, and it could not be reached."){super(t),this.name="KeyShareUnavailableError"}};function yt(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function gt(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function lr(){let e=globalThis.crypto?.subtle;if(!e)throw new Error("Web Crypto is not available");return e}function bt(e){let t=new Uint8Array(new ArrayBuffer(e.byteLength));return t.set(e),t}var rs=(e,t,n,r)=>bt(M(n?`${ts}|${e}|${t}|${n.url}|${n.kid}|${n.publicKey}`:r?`${ns}|${e}|${t}`:`${ar}|${e}|${t}`));async function os(e,t){return _t(z,M(e),z(M(`${ar}|${t}`)),{c:tt,dkLen:32})}async function ss(e,t,n,r,o,s){if(o&&s)throw new Error("A lock takes a key share or a Secret Key, not both");if(o&&!n.evaluateShare)throw new tn;let i=await os(e,t),c=[];try{let a=ft(i),u=o?ft(i):null,[f,p]=await Promise.all([n.evaluate({blinded:yt(a.blinded),...r?{keyId:r}:{}}),o&&u?n.evaluateShare({share:o,blinded:yt(u.blinded)}):Promise.resolve(null)]);if(r&&f.keyId!==r)throw new Error("The server answered with a different key than the lock uses");await en(n.trust,a.blinded,f);let d=pt(i,a.blind,gt(f.evaluated));c.push(d),a.blind.fill(0);let h=d,y=`${ar}|kek`;if(o&&u&&p){sr(o.publicKey,u.blinded,p);let m=pt(i,u.blind,gt(p.evaluated));c.push(m),u.blind.fill(0),h=B(d,m),c.push(h),y=`${ts}|kek`}s&&(h=B(d,s),c.push(h),y=`${ns}|kek`);let g=et(z,h,M(t),M(y),32),E=await lr().importKey("raw",bt(g),{name:"AES-GCM"},!1,["encrypt","decrypt"]);return g.fill(0),{key:E,keyId:f.keyId}}finally{for(let a of c)a.fill(0);i.fill(0)}}function is(){let e=new Uint8Array(32);return globalThis.crypto.getRandomValues(e),e}async function as(e,t,n,r,o,s){if(e.byteLength!==32)throw new Error("An org key is 32 bytes");let i=s?nn(s):void 0;if(s&&!i)throw new Error("That is not a Secret Key");let{key:c,keyId:a}=await ss(t,n,r,void 0,o,i??void 0),u=globalThis.crypto.getRandomValues(new Uint8Array(12)),f=new Uint8Array(await lr().encrypt({name:"AES-GCM",iv:u,additionalData:rs(n,a,o,i??void 0)},c,bt(e))),p={keyId:a,iv:yt(u),ciphertext:yt(f)};return i?{v:3,...p}:o?{v:2,...p,share:{url:o.url,kid:o.kid,publicKey:o.publicKey}}:{v:1,...p}}async function _c(e,t,n,r){if(!ls(e))throw new Error("Not an org key lock");let o=e.v===2?e.share:void 0,s=t,i;if(e.v===3){let u=cr(t);s=u.passphrase;let f=u.secretKey??r.secretKey;if(!f)throw new mt;if(i=nn(f)??void 0,!i)throw new mt}let{key:c}=await ss(s,n,r,e.keyId,o,i),a;try{a=new Uint8Array(await lr().decrypt({name:"AES-GCM",iv:bt(gt(e.iv)),additionalData:rs(n,e.keyId,o,i)},c,bt(gt(e.ciphertext))))}catch{return null}if(a.byteLength!==32)throw a.fill(0),new Error("An org key lock did not hold a 32-byte key");return a}async function Mc(e,t,n,r,o){let s=is(),i=await as(s,e,t,n,r,o);return{orgKey:s,lock:i,verifier:In(s)}}var es="redaktyn-device-envelope-v1";async function Cc(e,t,n,r){let o=await os(e,t),s=null;try{let i=ft(o);try{let c=await n.evaluate({blinded:yt(i.blinded),...r?{keyId:r}:{}});if(r&&c.keyId!==r)throw new Error("The server answered with a different key than this browser's copy uses");await en(n.trust,i.blinded,c),s=pt(o,i.blind,gt(c.evaluated));let a=et(z,s,M(t),M(`${es}|kek`),32),u=Array.from(a,f=>f.toString(16).padStart(2,"0")).join("");return a.fill(0),{credential:`${es}:${u}`,keyId:c.keyId}}finally{i.blind.fill(0)}}finally{s?.fill(0),o.fill(0)}}function cs(e){if(!e||typeof e!="object")return!1;let t=e;if(typeof t.url!="string"||t.url.length>200||typeof t.kid!="string"||!/^[A-Za-z0-9_-]{1,32}$/.test(t.kid)||typeof t.publicKey!="string"||!/^[0-9a-f]{64}$/.test(t.publicKey))return!1;let n;try{n=new URL(t.url)}catch{return!1}let r=n.hostname==="localhost"||n.hostname==="127.0.0.1"||n.hostname==="[::1]";return!(n.protocol!=="https:"&&!(n.protocol==="http:"&&r)||n.username||n.password||n.search||n.hash)}function ls(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.keyId=="string"&&/^[A-Za-z0-9_-]{1,32}$/.test(t.keyId)&&typeof t.iv=="string"&&t.iv.length===16&&typeof t.ciphertext=="string"&&t.ciphertext.length===64?t.v===1||t.v===3?t.share===void 0:t.v===2&&cs(t.share):!1}var Rd=864e5;function Oc(e,t,n,r){let o=new Set(t.map(i=>i.id));if(n&&Array.isArray(n.held)&&r-n.since>=0&&r-n.since<864e5){let i=n.held.filter(c=>!o.has(c.id));return i.length===0?{list:[...t],hold:null}:{list:[...t,...i],hold:{held:i,since:n.since}}}if(n)return{list:[...t],hold:null};let s=e.filter(i=>!o.has(i.id));return s.length>=3&&s.length*2>=e.length?{list:[...t,...s],hold:{held:s,since:r}}:{list:[...t],hold:null}}var Dc=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/;function Pc(e){let t=e.split(/\r?\n/),n=[],r=0,o=0;for(let s of t){if(r>0||o>0){if(s.startsWith("\\"))continue;if(s.startsWith("+")){n.push(s.slice(1)),o--;continue}if(s.startsWith("-")){r--;continue}if(s.startsWith(" ")){r--,o--;continue}r=0,o=0}let i=Dc.exec(s);if(i){r=i[1]===void 0?1:Number(i[1]),o=i[2]===void 0?1:Number(i[2]);continue}s.startsWith("+++")||s.startsWith("---")||s.startsWith("+")&&n.push(s.slice(1))}return n.join(`
+`)}var us="redaktyn-scan-prefilter-v1",ds="v1.",fs=65535,Et=Math.imul,dr=fs+1,ps=/^v1\.[0-9a-f]{12}$/;function hs(e){if(e.length<4)throw new Error("scanPrefilterParams: seed too short");return{base:e[0]<<24|e[1]<<16|e[2]<<8|e[3]|1}}function ms(e){return ee(z,e,M(us))}function Uc(e){return(e>=65&&e<=90?e+32:e)+1}function ys(e){let t=new Int32Array(e.length);for(let n=0;n<e.length;n++)t[n]=Uc(e.charCodeAt(n));return t}function Lc(e,t){let n=1,r=e|0,o=t;for(;o>0;)o&1&&(n=Et(n,r)),r=Et(r,r),o>>>=1;return n}function gs(e,t,n,r){let o=0;for(let s=n;s<n+r;s++)o=Et(o,e)+t[s]|0;return o}function rn(e,t){return gs(e.base,ys(t),0,t.length)>>>16}function Bc(e,t,n){let r=e.base,o=Lc(r,n-1),s=-2,i=0;return c=>(c===s+1?i=Et(i-Et(t[s],o)|0,r)+t[s+n]|0:i=gs(r,t,c,n),s=c,i>>>16)}function ur(e){return(e&fs).toString(16).padStart(4,"0")}function bs(e,t){return ds+ur(rn(e,t.exact))+ur(rn(e,t.collapsed))+ur(rn(e,t.lower))}function Nc(e,t){return bs(hs(ms(t)),{exact:Mt(e),collapsed:nt(rt(e)),lower:He(e)})}function fr(e){if(typeof e!="string"||!ps.test(e))return null;let t=e.slice(ds.length);return{exact:parseInt(t.slice(0,4),16),collapsed:parseInt(t.slice(4,8),16),lower:parseInt(t.slice(8,12),16)}}var sn=15e5,xt=5*1024*1024,Es=256,xs=5e4,ws=1e4;function ks(e){return fr(e.scanPrefilter)!==null}function pr(e,t=!1){let n=[new Map,new Map,new Map],r=(o,s,i)=>{if(typeof s!="number"||!(s>0))return;let c=n[o].get(s);n[o].set(s,c?{windowLen:s,prefiltered:c.prefiltered&&i,entries:c.entries+1}:{windowLen:s,prefiltered:i,entries:1})};for(let o of e){let s=t||ks(o);r(0,o.length,s),r(1,o.lengthStripped,s),r(2,o.lengthLower,s)}return n.flatMap(o=>[...o.values()])}function hr(e,t){let n=0;for(let r of t){let o=Math.max(0,e-r.windowLen+1);n+=r.prefiltered?Math.ceil(o/Es)+Math.ceil(o*r.entries/dr):o}return n}function on(e){if(e.length===0)return 1/0;if(hr(xt,e)<=sn)return xt;let t=0,n=xt;for(;t<n;){let r=Math.ceil((t+n)/2);hr(r,e)<=sn?t=r:n=r-1}return t}function Hc(e){let t=new Set,n=new Set,r=new Set;for(let o of e)o.length>0&&t.add(o.length),typeof o.lengthStripped=="number"&&o.lengthStripped>0&&n.add(o.lengthStripped),typeof o.lengthLower=="number"&&o.lengthLower>0&&r.add(o.lengthLower);return[...t,...n,...r]}function Gc(e){let t=e.length;if(t===0)return 1/0;let n=e.reduce((r,o)=>r+o,0);return Math.max(0,Math.floor((sn+n-t)/t))}function Fc(e){let t=pr(e),n=on(t),o={windowLen:t.length?Math.round(t.reduce((i,c)=>i+c.windowLen,0)/t.length):40,prefiltered:!0,entries:1},s=on([...t,o,o,o]);return{windowLengths:t.length,maxPasteChars:n,severity:n<ws?"alarm":n<xs?"warn":"ok",maxPasteCharsAfterOneMore:s,legacySecrets:e.filter(i=>!ks(i)).length,maxPasteCharsIfReenrolled:on(pr(e,!0)),atCharacterCap:n===xt}}var Bd=200;var wt={"stripe-live-secret":"Stripe live secret key","stripe-restricted-live":"Stripe restricted live key","stripe-test":"Stripe test key","stripe-publishable":"Stripe publishable key","github-pat":"GitHub personal access token","github-oauth":"GitHub OAuth token","github-app":"GitHub app token","github-fine-grained":"GitHub fine-grained token","npm-token":"npm access token","aws-access-key-id":"AWS access key ID","google-api-key":"Google API key","anthropic-api-key":"Anthropic API key","openai-api-key":"OpenAI API key","gitlab-pat":"GitLab personal access token","slack-token":"Slack token","slack-app-token":"Slack app token","shopify-token":"Shopify access token","digitalocean-token":"DigitalOcean token","huggingface-token":"Hugging Face token","stripe-webhook-secret":"Stripe webhook signing secret","openrouter-api-key":"OpenRouter API key","groq-api-key":"Groq API key","xai-api-key":"xAI API key","perplexity-api-key":"Perplexity API key","replicate-token":"Replicate API token","google-oauth-client-secret":"Google OAuth client secret","azure-ad-client-secret":"Azure AD client secret","gitlab-token":"GitLab token","slack-webhook":"Slack webhook URL","discord-webhook":"Discord webhook URL","discord-bot-token":"Discord bot token","telegram-bot-token":"Telegram bot token","sendgrid-api-key":"SendGrid API key","twilio-api-key":"Twilio API key","mailgun-api-key":"Mailgun API key","mailchimp-api-key":"Mailchimp API key","pypi-token":"PyPI upload token","docker-hub-token":"Docker Hub access token","vault-token":"HashiCorp Vault token","terraform-cloud-token":"Terraform Cloud token","doppler-token":"Doppler token","linear-api-key":"Linear API key","notion-token":"Notion integration token","airtable-token":"Airtable personal access token","atlassian-api-token":"Atlassian API token","square-token":"Square access token","sentry-token":"Sentry auth token","new-relic-key":"New Relic API key","grafana-token":"Grafana token","postman-api-key":"Postman API key","supabase-token":"Supabase secret key","supabase-publishable":"Supabase publishable key","netlify-token":"Netlify access token","age-secret-key":"age secret key","private-key":"Private key","connection-string-password":"Password in a connection string","neon-db-password":"Neon database password","assigned-secret":"Value assigned to a credential name","aws-secret-access-key":"AWS secret access key","aws-session-token":"AWS session token","gcp-service-account-key":"Google Cloud service-account key","azure-storage-key":"Azure storage account key","cloudflare-api-token":"Cloudflare API token","cloud-provider-token":"Cloud platform token","hyperscaler-access-key":"Cloud access key (Alibaba, Tencent, IBM, Oracle)","bitbucket-token":"Bitbucket token","ci-token":"CI/CD token","package-registry-token":"Package registry token","pulumi-token":"Pulumi access token","managed-db-token":"Managed database token","jdbc-ado-password":"Password in a JDBC or ADO.NET connection string","warehouse-credential":"Data warehouse credential","payment-provider-secret":"Payment gateway secret","commerce-token":"Commerce platform token","llm-provider-key":"AI provider API key","email-provider-key":"Email provider key","sms-provider-secret":"SMS or voice provider secret","productivity-saas-token":"Productivity SaaS token","observability-key":"Monitoring or logging key","signing-secret":"Signing or encryption secret","oauth-client-secret":"OAuth client secret","long-lived-jwt":"Long-lived JWT","http-basic-auth":"HTTP basic-auth credentials","session-cookie":"Session cookie","config-password":"Password in configuration","crypto-wallet-secret":"Crypto wallet key or seed phrase","vpn-private-key":"VPN private key","env-file":"Secrets in an .env file","kubeconfig-credential":"Kubernetes config credential","k8s-secret-manifest":"Kubernetes Secret value","terraform-secret":"Secret in Terraform state or variables","credential-file":"Credentials file (.npmrc, .netrc, docker, git)","presigned-url":"Pre-signed URL that is still valid","payment-card-number":"Payment card number","aadhaar-number":"Aadhaar number","india-tax-id":"PAN or personal GSTIN","national-id-number":"SSN or National Insurance number","bank-account-details":"Bank account details","customer-data-dump":"Customer data export"},As=Object.keys(wt),Oe="unrecognised",Vc="assigned-secret",Ss=[...As,Oe];function Wc(e){return Ss.includes(e)}function mr(e){return e===Oe?"Unrecognised credential":wt[e]??e}var Kc=new Set(["payment-card-number","aadhaar-number","india-tax-id","national-id-number","bank-account-details","customer-data-dump"]),$c=new Set(["private-key","vpn-private-key","age-secret-key"]),jc=new Set(["crypto-wallet-secret"]),zc=["Create a replacement credential at the provider. Leave the old one working for now.","Switch everything that uses it (services, CI settings, teammates' environment files) to the new value, and check that each one still works.","Revoke the old credential at the provider. Until you do, a copy that was shared anywhere else still works.","Register the new value in Redaktyn so it is protected the same way, then remove the old fingerprint here."],qc=["Generate a new key pair.","Put the new public key everywhere the old one is authorised (servers, services, allow-lists), and check access with the new private key.","Remove the old public key from those places, so the old private key stops working.","Register the new private key in Redaktyn so it is protected the same way, then remove the old fingerprint here."],Yc=["A wallet key or seed phrase cannot be changed, only replaced.","Create a new wallet, ideally on a device you trust.","Move the funds and any approvals to the new wallet.","Stop using the old wallet. Register the new key in Redaktyn if you want it protected."],Is=[{label:"Stripe documentation: API keys",url:"https://docs.stripe.com/keys"},{label:"Stripe Dashboard: API keys",url:"https://dashboard.stripe.com/apikeys"}],vs=[{label:"GitHub documentation: managing your personal access tokens",url:"https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens"}],yr=[{label:"AWS documentation: IAM access keys",url:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"}],Rs=[{label:"Slack: your apps",url:"https://api.slack.com/apps"}],Ts={"stripe-live-secret":{links:Is,tips:["Stripe lets you roll a key and expire the old one once your services have moved to the new one."]},"stripe-restricted-live":{links:Is,tips:["Stripe lets you roll a key and expire the old one once your services have moved to the new one."]},"github-pat":{links:vs},"github-fine-grained":{links:vs},"gitlab-pat":{links:[{label:"GitLab documentation: personal access tokens",url:"https://docs.gitlab.com/user/profile/personal_access_tokens/"}],tips:["GitLab lets you rotate a personal access token as well as revoke it."]},"npm-token":{links:[{label:"npm documentation: revoking access tokens",url:"https://docs.npmjs.com/revoking-access-tokens/"}]},"aws-access-key-id":{links:yr},"aws-secret-access-key":{links:yr},"aws-session-token":{links:yr},"anthropic-api-key":{links:[{label:"Anthropic console: API keys",url:"https://platform.claude.com/settings/keys"}]},"google-api-key":{links:[{label:"Google Cloud console: credentials",url:"https://console.cloud.google.com/apis/credentials"}]},"slack-token":{links:Rs},"slack-app-token":{links:Rs},"sendgrid-api-key":{links:[{label:"SendGrid documentation: API keys",url:"https://www.twilio.com/docs/sendgrid/ui/account-and-settings/api-keys"}]},"huggingface-token":{links:[{label:"Hugging Face: access tokens",url:"https://huggingface.co/settings/tokens"}]},"pypi-token":{links:[{label:"PyPI: API tokens",url:"https://pypi.org/manage/account/token/"}]},"digitalocean-token":{links:[{label:"DigitalOcean: API tokens",url:"https://cloud.digitalocean.com/account/api/tokens"}]},"docker-hub-token":{links:[{label:"Docker Hub: security settings",url:"https://hub.docker.com/settings/security"}]}},Zc=["docs.stripe.com","dashboard.stripe.com","docs.github.com","docs.gitlab.com","docs.npmjs.com","docs.aws.amazon.com","platform.claude.com","console.cloud.google.com","api.slack.com","www.twilio.com","huggingface.co","pypi.org","cloud.digitalocean.com","hub.docker.com"],Xc=Object.keys(Ts);function Jc(e){if(e&&Kc.has(e))return null;let t=e&&e!==Oe&&Object.prototype.hasOwnProperty.call(wt,e)?e:null,n=t&&jc.has(t)?"wallet":t&&$c.has(t)?"keypair":"credential",r=n==="wallet"?Yc:n==="keypair"?qc:zc,o=t?Ts[t]:void 0;return{slug:e??null,provider:t?mr(t):null,kind:n,steps:r,tips:o?.tips??[],links:o?.links??[]}}var _s={credential:"Credentials",infra:"Infrastructure",pii:"Personal data"},Qc={credential:"Keys, tokens and passwords that grant access to something. An admin can protect one on the spot, and the next paste of it is blocked.",infra:"Files that carry credentials in bulk \u2014 an .env dump, a kubeconfig, a Terraform state file. One paste can hand over a whole environment.",pii:"Card, identity and bank numbers that belong to people, not to the org. Never protected, only removed from the message."},el={checksum:"Checksum verified",structure:"Structure decoded",prefix:"Provider format",context:"Named and random"},A=(e,t,n,r,o)=>({id:e,family:t,name:n,slugs:r,...o}),gr=[A(1,"credential","AWS access keys",["aws-access-key-id","aws-secret-access-key"],{proof:"prefix",catches:"AKIA\u2026 access key IDs, and the 40-character secret access key beside them in a credentials file, an env var or a chat message.",ignores:"AWS's documented example keys (AKIAIOSFODNN7EXAMPLE), ARNs and account IDs."}),A(2,"credential","AWS session tokens",["aws-session-token"],{proof:"prefix",catches:"Temporary STS session tokens (IQoJb3JpZ2lu\u2026, FwoGZXIvYXdz\u2026) copied out of a console or a CLI profile.",ignores:"Tokens cut short with an ellipsis, and placeholders."}),A(3,"credential","Google Cloud credentials",["gcp-service-account-key","google-api-key"],{proof:"structure",catches:"Service-account JSON files whose private key is a real key, and AIza\u2026 API keys.",ignores:"Service-account JSON with a truncated or random-filler private key, and AIza followed by filler."}),A(4,"credential","Azure storage keys",["azure-storage-key"],{proof:"context",catches:"AccountKey= and SharedAccessKey= inside Azure Storage, Service Bus and Event Hubs connection strings.",ignores:"The public Azurite emulator key (devstoreaccount1) and <your-account-key> placeholders."}),A(5,"credential","Azure AD client secrets",["azure-ad-client-secret"],{proof:"prefix",catches:"Entra ID app client secrets \u2014 the 40-character values with Q~ at position four.",ignores:"Tenant and client IDs, which are GUIDs and not secret."}),A(6,"credential","Cloudflare tokens",["cloudflare-api-token"],{proof:"context",catches:"Cloudflare API tokens assigned to a Cloudflare variable, and v1.0- origin CA keys.",ignores:"Zone and account IDs."}),A(7,"credential","Developer cloud tokens",["digitalocean-token","netlify-token","cloud-provider-token"],{proof:"prefix",catches:"DigitalOcean (dop_v1_), Netlify (nfp_), Heroku (HRKU-), Fly.io (fo1_), Render (rnd_) and Vercel tokens.",ignores:"App names and region settings, and tokens made of filler characters."}),A(8,"credential","Other cloud access keys",["hyperscaler-access-key"],{proof:"prefix",catches:"Alibaba Cloud (LTAI\u2026), Tencent Cloud (AKID\u2026) and IBM Cloud API keys.",ignores:"Region names and other configuration that sits next to them."}),A(9,"credential","GitHub tokens",["github-pat","github-oauth","github-app","github-fine-grained"],{proof:"checksum",catches:"Classic and fine-grained personal access tokens, OAuth tokens and app tokens (ghp_, gho_, ghs_, github_pat_) \u2014 each carries a CRC32 checksum, and it has to verify.",ignores:"Strings shaped like a GitHub token whose checksum fails, ${{ secrets.GITHUB_TOKEN }} references, and repository URLs."}),A(10,"credential","GitLab tokens",["gitlab-pat","gitlab-token"],{proof:"prefix",catches:"GitLab personal access tokens (glpat-) and runner tokens (glrt-).",ignores:"GitLab URLs and filler tokens."}),A(11,"credential","Bitbucket and Atlassian tokens",["atlassian-api-token","bitbucket-token"],{proof:"prefix",catches:"Atlassian API tokens (ATATT\u2026), Bitbucket app passwords and access tokens (ATBB\u2026).",ignores:"Jira and Confluence site URLs."}),A(12,"credential","CI/CD tokens",["ci-token"],{proof:"prefix",catches:"CircleCI (CCIPAT_), Buildkite (bkua_) and Jenkins API tokens.",ignores:"Build numbers, job URLs and pipeline names."}),A(13,"credential","Package registry tokens",["npm-token","pypi-token","docker-hub-token","package-registry-token"],{proof:"checksum",catches:"npm tokens (npm_, checksum-verified), PyPI upload tokens, Docker Hub PATs (dckr_pat_), RubyGems and NuGet keys.",ignores:"npm-shaped tokens whose checksum fails, and registry URLs."}),A(14,"credential","Infrastructure-as-code and secret-manager tokens",["vault-token","terraform-cloud-token","doppler-token","pulumi-token"],{proof:"prefix",catches:"HashiCorp Vault tokens (hvs.), Terraform Cloud tokens (.atlasv1.), Doppler (dp.st.) and Pulumi (pul-) tokens.",ignores:"Vault addresses and workspace names."}),A(15,"credential","Database connection strings",["connection-string-password"],{proof:"context",catches:"The password inside a postgres://, mysql://, mongodb+srv://, redis:// or amqp:// URL pointing at a real host.",ignores:"localhost and example.com hosts, user:password, ${DB_PASSWORD} references and <password> placeholders."}),A(16,"credential","Managed database tokens",["neon-db-password","supabase-token","supabase-publishable","managed-db-token"],{proof:"prefix",catches:"Neon passwords (npg_), Supabase service and secret keys (sbp_, sb_secret_), PlanetScale and Upstash tokens.",ignores:"Supabase publishable keys, which are meant to be public, and project IDs."}),A(17,"credential","JDBC and ADO.NET passwords",["jdbc-ado-password"],{proof:"context",catches:"password= and Password= inside JDBC URLs and SQL Server / ADO.NET connection strings.",ignores:"Password=password, ${SA_PASSWORD} and <your_password>."}),A(18,"credential","Data warehouse credentials",["warehouse-credential"],{proof:"prefix",catches:"Databricks tokens (dapi\u2026), and Snowflake and ClickHouse passwords.",ignores:"Account locators and warehouse names."}),A(19,"credential","Stripe keys",["stripe-live-secret","stripe-restricted-live","stripe-webhook-secret","stripe-test","stripe-publishable"],{proof:"prefix",catches:"Live secret keys (sk_live_), restricted live keys (rk_live_) and webhook signing secrets (whsec_).",ignores:"Test-mode keys, publishable keys (pk_), which are public, and keys cut short with an ellipsis."}),A(20,"credential","Payment gateway secrets",["square-token","payment-provider-secret"],{proof:"prefix",catches:"Square access tokens, Braintree production tokens, Plaid production secrets, Razorpay key secrets and PayPal client secrets.",ignores:"Razorpay key IDs on their own, test-mode and sandbox keys."}),A(21,"credential","Commerce platform tokens",["shopify-token","commerce-token"],{proof:"prefix",catches:"Shopify admin tokens (shpat_), WooCommerce consumer keys (ck_) and BigCommerce access tokens.",ignores:"Store domains and all-zero filler tokens."}),A(22,"credential","OpenAI keys",["openai-api-key"],{proof:"prefix",catches:"Project keys (sk-proj-\u2026 with the T3BlbkFJ marker) and legacy sk- keys.",ignores:"Model names, sk-abcdef\u2026 keyboard strings and keys masked as sk-\u2026a1B2."}),A(23,"credential","Anthropic keys",["anthropic-api-key"],{proof:"prefix",catches:"Anthropic API keys (sk-ant-api03-\u2026AA).",ignores:"Model names and sk-ant-\u2026 placeholders."}),A(24,"credential","Other AI provider keys",["groq-api-key","xai-api-key","perplexity-api-key","replicate-token","huggingface-token","openrouter-api-key","llm-provider-key"],{proof:"prefix",catches:"Groq, xAI, Perplexity, Replicate, Hugging Face, OpenRouter, DeepSeek, LangSmith and Mistral keys.",ignores:"Cache paths like HF_HOME and filler tokens."}),A(25,"credential","Slack tokens and webhooks",["slack-token","slack-app-token","slack-webhook"],{proof:"prefix",catches:"Bot, user and app tokens (xoxb-, xoxp-, xapp-) and incoming webhook URLs.",ignores:"xoxb-your-bot-token and channel names."}),A(26,"credential","Discord and Telegram bots",["discord-webhook","discord-bot-token","telegram-bot-token"],{proof:"structure",catches:"Discord webhook URLs and bot tokens, and Telegram bot tokens (a bot ID, a colon, then AA\u2026).",ignores:"Guild and channel IDs."}),A(27,"credential","Email provider keys",["sendgrid-api-key","mailgun-api-key","mailchimp-api-key","email-provider-key"],{proof:"prefix",catches:"SendGrid (SG.), Mailgun (key-), Mailchimp (\u2026-us1), Resend (re_), Brevo (xkeysib-) and Postmark keys.",ignores:"SMTP hosts and sender addresses."}),A(28,"credential","SMS and voice provider secrets",["twilio-api-key","sms-provider-secret"],{proof:"context",catches:"Twilio API keys (SK\u2026) and auth tokens, and MSG91 auth keys.",ignores:"Account SIDs and phone numbers on their own."}),A(29,"credential","Productivity SaaS tokens",["linear-api-key","notion-token","airtable-token","postman-api-key","productivity-saas-token"],{proof:"prefix",catches:"Linear, Notion, Airtable, Postman, HubSpot, Figma, Asana and Zendesk tokens.",ignores:"Database and page IDs, which are not secret."}),A(30,"credential","Monitoring and logging keys",["sentry-token","new-relic-key","grafana-token","observability-key"],{proof:"prefix",catches:"Sentry auth tokens, New Relic (NRAK-), Grafana service accounts (glsa_), Dynatrace, PostHog personal keys and Datadog API keys.",ignores:"Sentry DSNs and PostHog project keys, which are designed to ship in browser code."}),A(31,"credential","Private keys (PEM, OpenSSH, PGP)",["private-key"],{proof:"structure",catches:"RSA, EC, PKCS#8, OpenSSH and PGP private key blocks whose body decodes to a real key.",ignores:"Public keys and certificates, key blocks with ... for a body, and blocks filled with random text."}),A(32,"credential","Signing and encryption secrets",["signing-secret"],{proof:"context",catches:"JWT_SECRET, SECRET_KEY_BASE, NEXTAUTH_SECRET, Django SECRET_KEY and similar, when the value is random.",ignores:"changeme, algorithm names like HS256 and expiry settings."}),A(33,"credential","OAuth client secrets",["google-oauth-client-secret","oauth-client-secret"],{proof:"prefix",catches:"Google client secrets (GOCSPX-) and refresh tokens, and Okta, Auth0 and generic client_secret values.",ignores:"Client IDs, which are public."}),A(34,"credential","Long-lived JWTs",["long-lived-jwt"],{proof:"structure",catches:"Signed JWTs that are still valid for a long time \u2014 service-role keys, service-account tokens, tokens that never expire.",ignores:"Expired tokens, short-lived session tokens, Supabase anon keys and the jwt.io sample token."}),A(35,"credential","Basic auth and session cookies",["http-basic-auth","session-cookie"],{proof:"structure",catches:"Authorization: Basic headers that decode to user:password, curl -u credentials, and login session cookies.",ignores:"Analytics and preference cookies, and user:pass examples."}),A(36,"credential","Passwords in configuration",["config-password","assigned-secret"],{proof:"context",catches:"Values assigned to DB_PASSWORD, API_TOKEN, password: and their kin in env files, YAML and code, when they are random enough to be real.",ignores:"********, length settings, keyboard walks like qwertyuiop123, and placeholders."}),A(37,"credential","Crypto wallet keys and seed phrases",["crypto-wallet-secret"],{proof:"checksum",catches:"BIP39 recovery phrases whose checksum word verifies, WIF and xprv keys (Base58Check) and raw Ethereum private keys.",ignores:"The abandon \u2026 about test phrase, Hardhat's published dev keys, and wallet addresses."}),A(38,"credential","age and WireGuard keys",["age-secret-key","vpn-private-key"],{proof:"structure",catches:"age secret keys (AGE-SECRET-KEY-1\u2026) and the PrivateKey of a WireGuard [Interface].",ignores:"WireGuard peer public keys."}),A(39,"infra",".env files",["env-file"],{proof:"context",catches:"A pasted .env file with real secrets in it, flagged as one file rather than line by line.",ignores:".env files with only settings, ${VAR} references or your_key_here placeholders."}),A(40,"infra","Kubernetes configs",["kubeconfig-credential"],{proof:"structure",catches:"kubeconfig files carrying a client key or a bearer token for a cluster.",ignores:"kubeconfigs that authenticate through an exec plugin, and REDACTED tokens."}),A(41,"infra","Kubernetes Secret manifests",["k8s-secret-manifest"],{proof:"structure",catches:"kind: Secret manifests \u2014 the base64 under data: is decoded and checked, and stringData: is read as is.",ignores:"Secrets that decode to password or admin, and certificates."}),A(42,"infra","Terraform state and variables",["terraform-secret"],{proof:"structure",catches:"Passwords in terraform.tfstate attributes and hard-coded in .tf resources.",ignores:"null attributes and var.db_password references."}),A(43,"infra","Credential files",["credential-file"],{proof:"structure",catches:".netrc logins, Docker config.json auths, .pgpass lines and tokens embedded in git remote URLs.",ignores:"example.com entries, user:password auths and plain clone URLs."}),A(44,"infra","Pre-signed URLs",["presigned-url"],{proof:"structure",catches:"S3 pre-signed and Azure SAS URLs that have not expired yet \u2014 anyone holding one can read the file.",ignores:"Expired links, unsigned URLs and documentation pages."}),A(45,"pii","Payment card numbers",["payment-card-number"],{proof:"checksum",catches:"Visa, Mastercard, Amex, RuPay and other card numbers that pass the Luhn check and sit next to a card label, an expiry or a card network name.",ignores:"Published test cards (4242\u2026, 4111\u2026), order IDs and numbers that fail Luhn."}),A(46,"pii","Aadhaar numbers",["aadhaar-number"],{proof:"checksum",catches:"Aadhaar numbers that pass the Verhoeff check, labelled or in the 4-4-4 grouping.",ignores:"UIDAI's sample numbers, transaction references and numbers that fail Verhoeff."}),A(47,"pii","PAN and GSTIN",["india-tax-id"],{proof:"checksum",catches:"Individual PANs and GSTINs whose check character verifies.",ignores:"Company PANs, unlabelled lookalikes and GSTINs with a wrong check character."}),A(48,"pii","SSN and National Insurance numbers",["national-id-number"],{proof:"structure",catches:"US Social Security numbers and UK National Insurance numbers that follow the issuing rules and are labelled or listed.",ignores:"Numbers never issued (000, 666, 9xx areas), the famous Woolworth card number, and part numbers."}),A(49,"pii","Bank account details",["bank-account-details"],{proof:"checksum",catches:"IBANs that pass mod-97, and account numbers next to a valid ABA routing number or an IFSC code.",ignores:"Published example IBANs, IBANs with a wrong check digit and IFSC codes alone."}),A(50,"pii","Customer data exports",["customer-data-dump"],{proof:"context",catches:"Pasted tables of real people \u2014 rows with names, personal email addresses and phone numbers.",ignores:"example.com addresses, 555 phone numbers, short lists and staff email lists."})],tl=["Placeholders \u2014 <your-key>, ${VAR}, {{ secret }}, xxxx, changeme, your_key_here","Values cut short or masked \u2014 sk_live_\u2026, ****, REDACTED","Anything marked fake, mock, dummy, stub, fixture or sample \u2014 in a comment beside it or in its variable name","Vendors' published example and test keys","Variable names, file paths, URLs, hashes, UUIDs and regex source","Public keys, publishable keys and IDs that are not secret"],br=new Map;for(let e of gr)for(let t of e.slugs)br.set(t,e);function nl(e){return br.get(e)}function Ms(e){return e===Oe?"credential":br.get(e)?.family??"credential"}function rl(e){return Ms(e)!=="pii"}function ol(e){return _s[e]}var sl=gr.flatMap(e=>e.slugs);function Cs(e){let t=new Set;for(let n of e)if(n?.isActive)for(let r of n.rules??[])for(let o of r?.specificDomains??[]){let s=gn(o);s&&t.add(s)}return Array.from(t).sort()}function il(e){return Cs(e).filter(t=>!yn(t))}var jd=1e3,zd=100,qd=254,Yd=1048576,Os=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,al=`Name,Email
 Jane Smith,jane@company.com
 Aarav Shah,aarav@company.com
-`,zc=/[​-‍⁠]/g;function yr(e){if(!e)return"";let t=e.replace(zc,"").replace(/ /g," ").replace(/\s+/g," ").trim();return t.length>=2&&(t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'"))&&(t=t.slice(1,-1).trim()),t}var mr=/[^\s<>,;"'()]+@[^\s<>,;"'()]+/;function qc(e,t){let n=[],r=[],o="",s=!1,a=!0,c=()=>{r.push(o),o="",a=!0},i=()=>{c(),r.some(u=>u.trim()!=="")&&n.push(r),r=[]};for(let u=0;u<e.length;u++){let f=e[u];if(s){f==='"'?e[u+1]==='"'?(o+='"',u++):s=!1:o+=f;continue}if(f==='"'&&a){s=!0,a=!1;continue}if(t!==null&&f===t){c();continue}if(f==="\r"){e[u+1]===`
-`&&u++,i();continue}if(f===`
-`){i();continue}f!==" "&&f!=="	"&&(a=!1),o+=f}return i(),n}function jc(e){let t=e.split(/\r?\n/).filter(a=>a.trim()!=="").slice(0,6),n={"	":0,",":0,";":0};for(let a of t){let c=!1;for(let i of a)i==='"'?c=!c:!c&&i in n&&(n[i]+=1)}let r=["	",",",";"],o=null,s=0;for(let a of r)n[a]>s&&(o=a,s=n[a]);return o}var $c={email:"email",emailaddress:"email",mail:"email",workemail:"email",emailid:"email",eaddress:"email",name:"name",fullname:"name",displayname:"name",person:"name",employee:"name",employeename:"name",firstname:"first",givenname:"first",first:"first",forename:"first",lastname:"last",surname:"last",familyname:"last",last:"last"};function Yc(e){return $c[e.toLowerCase().replace(/[^a-z]/g,"")]??null}function Rs(e){let t=e.split("@")[0]??"";return t.split("+")[0].split(/[._-]+/).filter(o=>o!==""&&!/^\d+$/.test(o)).map(o=>o.charAt(0).toUpperCase()+o.slice(1)).join(" ")||t}function Zc(e,t){let n=e.map(yr);if(t&&t.email>=0){let u=n[t.email]??"",f=t.names.map(p=>n[p]??"").filter(Boolean).join(" ");if(u!==""||!n.some(p=>mr.test(p)))return{name:f,email:u,unreadable:!1}}let r=n.findIndex(u=>mr.test(u));if(r<0)return{name:n.filter(Boolean).join(" "),email:"",unreadable:!1};let o=mr.exec(n[r]),s=n[r];if(s!==o[0]&&!s.includes(`<${o[0]}>`)&&!s.includes(`(${o[0]})`))return{name:"",email:s,unreadable:!1};let a=n.filter((u,f)=>f!==r).filter(Boolean),c=yr(n[r].replace(o[0],"").replace(/[<>]/g,""));return{name:[...a,c].filter(Boolean).join(" "),email:o[0],unreadable:!1}}function Xc(e,t={}){let n=e.replace(/^/,"");if(n.trim()==="")return{rows:[],people:[],hadHeader:!1,skipped:0};let r=jc(n),o=qc(n,r),s=!1,a=null,c=o[0];if(c&&!c.some(h=>h.includes("@"))){let h=c.map(g=>Yc(yr(g))),y=h.indexOf("email");if(y>=0){let g=[],E=h.indexOf("name");if(E>=0)g.push(E);else{let m=h.indexOf("first"),w=h.indexOf("last");m>=0&&g.push(m),w>=0&&g.push(w)}a={email:y,names:g},s=!0,o.shift()}else h.some(g=>g!==null)&&(s=!0,o.shift())}let i=t.existingEmails??new Set,u=new Set,f=[],p=0;o.forEach((h,y)=>{if(f.length>=1e3){p+=1;return}let g=Zc(h,a),E=g.email.toLowerCase(),m=[];(E===""||E.length>254||!vs.test(E))&&m.push("bad-email");let w=g.name,b=!1;w===""&&m.length===0&&(w=Rs(E),b=!0),w.length>100&&m.push("name-too-long"),m.length===0&&(u.has(E)?m.push("duplicate"):i.has(E)&&m.push("already-invited")),E!==""&&!u.has(E)&&!m.includes("bad-email")&&u.add(E),f.push({line:y+1,name:w,email:g.email===""?"":E,nameDerived:b,issues:m})});let d=f.filter(h=>h.issues.length===0).map(h=>({name:h.name,email:h.email}));return{rows:f,people:d,hadHeader:s,skipped:p}}var Jc={"bad-email":"Not a valid email","name-too-long":"Name over 100 characters",duplicate:"Already in this list","already-invited":"Already has an unused invite"};function Qc(e){let t=e.name.toLowerCase();return/\.(xlsx|xlsm|xlsb|xls|numbers|ods)$/.test(t)?{ok:!1,reason:"That is a spreadsheet file. In your spreadsheet choose File, then Save as (or Download), then CSV, and upload that. Or select the cells, copy, and paste them here."}:/\.(csv|tsv|txt)$/.test(t)?e.size>1048576?{ok:!1,reason:"That file is over 1 MB, far more than a list of people. Check it is the right file."}:e.size===0?{ok:!1,reason:"That file is empty."}:{ok:!0}:{ok:!1,reason:"Upload a .csv, .tsv or .txt file, or paste the rows here."}}var el=/^[=+\-@\t\r]/;function tn(e){return`"${(el.test(e)?`'${e}`:e).replace(/"/g,'""')}"`}function tl(e){let t=["name,email,link,security_code"];for(let n of e)t.push([tn(n.name),tn(n.email),tn(n.link??""),tn(n.inviteCode??"")].join(","));return t.join(`
-`)}var Ts=["vscode-terminal","vscode-chat","vscode-editor","claude-code","codex","cursor"],nl={"vscode-terminal":"VS Code terminal","vscode-chat":"VS Code chat","vscode-editor":"VS Code editor","claude-code":"Claude Code",codex:"Codex",cursor:"Cursor"};function rl(e){return typeof e=="string"&&Ts.includes(e)}var _s=/^extension-cli-[0-9a-f]+@/i;function ol(e){return!!e&&_s.test(e)}var sl="extension-cli-";function al(e){return!!e&&/^cli-[a-f0-9]{32}$/i.test(e)}function il(e){return!!e&&/^(node|undici)(\/|\s|$)/i.test(e.trim())}var cl=36*60*60*1e3;function ll(e,t,n,r=new Date,o=!1){let s=[...new Set(e.map(u=>u.label))].slice(0,64),a=[...new Set(e.map(u=>u.secretId))].slice(0,64),c=new Set(e.map(u=>u.pass)),i=c.has("exact")?null:c.has("whitespace_collapse")?"whitespace_collapse":c.has("case_fold")?"case_fold":null;return{event:"blocked",type:"hmac_match",secretLabel:s.join(", ").slice(0,200),secretLabels:s.map(u=>u.slice(0,200)),attemptCount:1,risk:"high",toolDomain:t,timestamp:r.toISOString(),eventType:n,secretIds:a.filter(u=>/^[0-9a-f-]{36}$/i.test(u)),scanMethod:"sliding_window",bypassVariant:i,...o?{policyAction:"LOG"}:{}}}0&&(module.exports={AIToolCategory,AI_REGISTRY,ANNUAL_MONTHS_FREE,ASSIGNED_SECRET_SLUG,AlertChannel,AlertTrigger,CATEGORISED_SLUGS,COVERAGE_SLUGS,CUSTOM_PASSPHRASE_MIN_LENGTH,CUSTOM_PASSPHRASE_WARNING,DETECTION_CATEGORIES,DETECTION_FAMILY_BLURBS,DETECTION_FAMILY_NAMES,DETECTION_PROOF_NAMES,DETECTION_UNIVERSAL_IGNORES,DIGEST_VERSION_HMAC_V1,EDITOR_DEVICE_EMAIL,EDITOR_EMAIL_PREFIX,EMAIL_MAX,ENTERPRISE_FEATURES,EventAction,EventType,FOUNDING_PERCENT_OFF,FOUNDING_TEAMS,FREE_FEATURES,FREE_SEATS,GENERATED_PASSPHRASE_BITS_APPROX,GENERATED_PASSPHRASE_ENTROPY_BITS,GENERATED_PASSPHRASE_REQUIRED_MESSAGE,INVISIBLE_CHARS_CLASS,ISSUE_LABEL,KDF_ITERATIONS,KDF_VERSION_V2,KeyShareUnavailableError,LEGACY_PRO_BANDS,LIST_HOLD_MS,MATRIX_TIERS,MAX_ACTIVITY_SESSIONS_PER_BATCH,MAX_SCAN_WINDOWS,MAX_TOTAL_SCAN_CHARS,MIN_SECRET_LENGTH,NAME_MAX,NORMALIZATION_VERSION_V1,NORMALIZATION_VERSION_V2,OFFICIAL_OPRF_PINS,OFFICIAL_SERVER_HOSTS,OPRF_ELEMENT_BYTES,OPRF_OUTPUT_BYTES,OPRF_PROOF_BYTES,ORG_KEY_LOCK_SCHEME,OprfProofError,OrgPlan,PASSPHRASE_CREDENTIAL_NAME,PASSPHRASE_CREDENTIAL_URL,PASSPHRASE_VERIFY_LABEL,PASTE_CEILING_ALARM_CHARS,PASTE_CEILING_WARN_CHARS,PLAN_DESCRIPTORS,PLAN_FEATURE_MATRIX,PLAN_FEATURE_TIERS,PLAN_LIMITS,PLAN_PRICING,PLATFORM_SURFACES,PRIVACY_EMAIL,PROJECT_KDF_LABEL,PRO_BANDS,PRO_ENTRY_BAND,PRO_FEATURES,PRO_TOP_BAND,ROSTER_FILE_MAX_BYTES,ROSTER_MAX_ROWS,ROSTER_TEMPLATE_CSV,ROTATION_GUIDE_SLUGS,ROTATION_LINK_HOSTS,RiskLevel,SAFE_BLOCK_EVENT_FIELDS,SALES_EMAIL,SCAN_PREFILTER_LABEL,SCAN_PREFILTER_PATTERN,SCAN_PREFILTER_SPACE,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE,SECRET_PROVIDER_NAMES,SECRET_PROVIDER_SLUGS,SECURITY_EMAIL,SERVER_EMAIL_RE,SecretKeyNeededError,TRIAL_DAYS,TRUST_POINTS,UNRECOGNISED_PROVIDER_SLUG,UserRole,VSCODE_AWAY_AFTER_MS,VSCODE_PLACES,VSCODE_PLACE_LABELS,annualBilledNote,appendPasskeyEnvelope,behaviorExplanation,canonicalSecretPlaintextForHmac,categoryOfSlug,checkOprfAnswer,checkRosterFile,checkShareAnswer,clientBehindProxies,computePassphraseVerifyHmac,createLockedOrgKey,createShareHandler,customPolicyDomains,decodeScanPrefilter,deriveBehaviorRisk,deriveHmacKeyFromPassphrase,deriveProjectKey,deriveScanPrefilterSeed,encodeScanPrefilter,eventFor,extractAddedLinesFromUnifiedDiff,familyDisplayName,familyOfSlug,findBand,findPasskeyEnvelope,foldUuidHexCase,foundingMonthlyUsd,generateHmacKey,generateLockSecretKey,generateOrgKey,generateOrgPassphrase,generatePrfSalt,getInjectionHostnames,getLimitsForPlan,getPrfSaltBytes,guardListShrink,hexToKey,hmacDigestHex,inviteLinksCsv,isAIToolDomain,isEditorDevice,isEditorExtensionId,isEditorUserAgent,isGeneratedPassphraseFormat,isInjectionScopedHostname,isKeyShare,isKnownProviderSlug,isOrgKeyLock,isProtectableSlug,isStrictScope,isV1PassphraseEnvelope,isV2Envelope,isValidOprfSecretKey,isVscodePlace,joinLockCredential,keyToHex,lockOrgKey,lockSecretKeyBytes,matchDomain,matchPatternsForHostname,maxScannablePasteChars,maxScannablePasteCharsFor,memoryPinStore,nameFromEmail,normalizeAndHmacHex,normalizeAndHmacHexCollapsed,normalizeAndHmacHexLower,normalizeDomainInput,normalizeSecretPlaintextCollapsed,normalizeSecretPlaintextForMatch,normalizeSecretPlaintextLower,oprfBlind,oprfBlindEvaluate,oprfBlindEvaluateWithProof,oprfDeriveSecretKey,oprfFinalize,oprfGenerateSecretKey,oprfPublicKey,oprfVerifyEvaluation,parseRoster,passphraseCsvText,passphraseSheetText,perMonthOnAnnual,policyNamedDomains,projectedScanCost,providerDisplayName,publicKeyHex,removePasskeyEnvelope,rotationGuideFor,scanBudgetFor,scanPrefilterFingerprint,scanPrefilterForRawSecret,scanPrefilterParams,scanPrefilterRoller,scanPrefilterUnits,scanSweeps,scanWindowLengths,scopeOf,smallestBandFor,splitLockCredential,unlockOrgKey,unwrapHmacKeyWithPrf,upgradeEnvelopeToV2,usd,validateAnchorPassphrase,validateCustomPassphrase,validateGeneratedPassphrase,validateNewPassphrase,validatePassphraseStrength,wrapHmacKeyWithPrf});
+`,cl=/[​-‍⁠]/g;function xr(e){if(!e)return"";let t=e.replace(cl,"").replace(/ /g," ").replace(/\s+/g," ").trim();return t.length>=2&&(t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'"))&&(t=t.slice(1,-1).trim()),t}var Er=/[^\s<>,;"'()]+@[^\s<>,;"'()]+/;function ll(e,t){let n=[],r=[],o="",s=!1,i=!0,c=()=>{r.push(o),o="",i=!0},a=()=>{c(),r.some(u=>u.trim()!=="")&&n.push(r),r=[]};for(let u=0;u<e.length;u++){let f=e[u];if(s){f==='"'?e[u+1]==='"'?(o+='"',u++):s=!1:o+=f;continue}if(f==='"'&&i){s=!0,i=!1;continue}if(t!==null&&f===t){c();continue}if(f==="\r"){e[u+1]===`
+`&&u++,a();continue}if(f===`
+`){a();continue}f!==" "&&f!=="	"&&(i=!1),o+=f}return a(),n}function ul(e){let t=e.split(/\r?\n/).filter(i=>i.trim()!=="").slice(0,6),n={"	":0,",":0,";":0};for(let i of t){let c=!1;for(let a of i)a==='"'?c=!c:!c&&a in n&&(n[a]+=1)}let r=["	",",",";"],o=null,s=0;for(let i of r)n[i]>s&&(o=i,s=n[i]);return o}var dl={email:"email",emailaddress:"email",mail:"email",workemail:"email",emailid:"email",eaddress:"email",name:"name",fullname:"name",displayname:"name",person:"name",employee:"name",employeename:"name",firstname:"first",givenname:"first",first:"first",forename:"first",lastname:"last",surname:"last",familyname:"last",last:"last"};function fl(e){return dl[e.toLowerCase().replace(/[^a-z]/g,"")]??null}function Ds(e){let t=e.split("@")[0]??"";return t.split("+")[0].split(/[._-]+/).filter(o=>o!==""&&!/^\d+$/.test(o)).map(o=>o.charAt(0).toUpperCase()+o.slice(1)).join(" ")||t}function pl(e,t){let n=e.map(xr);if(t&&t.email>=0){let u=n[t.email]??"",f=t.names.map(p=>n[p]??"").filter(Boolean).join(" ");if(u!==""||!n.some(p=>Er.test(p)))return{name:f,email:u,unreadable:!1}}let r=n.findIndex(u=>Er.test(u));if(r<0)return{name:n.filter(Boolean).join(" "),email:"",unreadable:!1};let o=Er.exec(n[r]),s=n[r];if(s!==o[0]&&!s.includes(`<${o[0]}>`)&&!s.includes(`(${o[0]})`))return{name:"",email:s,unreadable:!1};let i=n.filter((u,f)=>f!==r).filter(Boolean),c=xr(n[r].replace(o[0],"").replace(/[<>]/g,""));return{name:[...i,c].filter(Boolean).join(" "),email:o[0],unreadable:!1}}function hl(e,t={}){let n=e.replace(/^/,"");if(n.trim()==="")return{rows:[],people:[],hadHeader:!1,skipped:0};let r=ul(n),o=ll(n,r),s=!1,i=null,c=o[0];if(c&&!c.some(h=>h.includes("@"))){let h=c.map(g=>fl(xr(g))),y=h.indexOf("email");if(y>=0){let g=[],E=h.indexOf("name");if(E>=0)g.push(E);else{let m=h.indexOf("first"),w=h.indexOf("last");m>=0&&g.push(m),w>=0&&g.push(w)}i={email:y,names:g},s=!0,o.shift()}else h.some(g=>g!==null)&&(s=!0,o.shift())}let a=t.existingEmails??new Set,u=new Set,f=[],p=0;o.forEach((h,y)=>{if(f.length>=1e3){p+=1;return}let g=pl(h,i),E=g.email.toLowerCase(),m=[];(E===""||E.length>254||!Os.test(E))&&m.push("bad-email");let w=g.name,b=!1;w===""&&m.length===0&&(w=Ds(E),b=!0),w.length>100&&m.push("name-too-long"),m.length===0&&(u.has(E)?m.push("duplicate"):a.has(E)&&m.push("already-invited")),E!==""&&!u.has(E)&&!m.includes("bad-email")&&u.add(E),f.push({line:y+1,name:w,email:g.email===""?"":E,nameDerived:b,issues:m})});let d=f.filter(h=>h.issues.length===0).map(h=>({name:h.name,email:h.email}));return{rows:f,people:d,hadHeader:s,skipped:p}}var ml={"bad-email":"Not a valid email","name-too-long":"Name over 100 characters",duplicate:"Already in this list","already-invited":"Already has an unused invite"};function yl(e){let t=e.name.toLowerCase();return/\.(xlsx|xlsm|xlsb|xls|numbers|ods)$/.test(t)?{ok:!1,reason:"That is a spreadsheet file. In your spreadsheet choose File, then Save as (or Download), then CSV, and upload that. Or select the cells, copy, and paste them here."}:/\.(csv|tsv|txt)$/.test(t)?e.size>1048576?{ok:!1,reason:"That file is over 1 MB, far more than a list of people. Check it is the right file."}:e.size===0?{ok:!1,reason:"That file is empty."}:{ok:!0}:{ok:!1,reason:"Upload a .csv, .tsv or .txt file, or paste the rows here."}}var Ps="Type the security code only where Redaktyn itself asks for it (the extension, VS Code or a terminal), never on a web page.";function gl(e,t){return t?`${e}
+Security code: ${t}
+${Ps}`:e}var bl=/^[=+\-@\t\r]/;function an(e){return`"${(bl.test(e)?`'${e}`:e).replace(/"/g,'""')}"`}function El(e){let t=["name,email,link,security_code"];for(let n of e)t.push([an(n.name),an(n.email),an(n.link??""),an(n.inviteCode??"")].join(","));return t.join(`
+`)}var Us=["vscode-terminal","vscode-chat","vscode-editor","claude-code","codex","cursor"],xl={"vscode-terminal":"VS Code terminal","vscode-chat":"VS Code chat","vscode-editor":"VS Code editor","claude-code":"Claude Code",codex:"Codex",cursor:"Cursor"};function wl(e){return typeof e=="string"&&Us.includes(e)}var Ls=/^extension-cli-[0-9a-f]+@/i;function kl(e){return!!e&&Ls.test(e)}var Al="extension-cli-";function Sl(e){return!!e&&/^cli-[a-f0-9]{32}$/i.test(e)}function Il(e){return!!e&&/^(node|undici)(\/|\s|$)/i.test(e.trim())}var vl=36*60*60*1e3;function Rl(e,t,n,r=new Date,o=!1){let s=[...new Set(e.map(u=>u.label))].slice(0,64),i=[...new Set(e.map(u=>u.secretId))].slice(0,64),c=new Set(e.map(u=>u.pass)),a=c.has("exact")?null:c.has("whitespace_collapse")?"whitespace_collapse":c.has("case_fold")?"case_fold":null;return{event:"blocked",type:"hmac_match",secretLabel:s.join(", ").slice(0,200),secretLabels:s.map(u=>u.slice(0,200)),attemptCount:1,risk:"high",toolDomain:t,timestamp:r.toISOString(),eventType:n,secretIds:i.filter(u=>/^[0-9a-f-]{36}$/i.test(u)),scanMethod:"sliding_window",bypassVariant:a,...o?{policyAction:"LOG"}:{}}}0&&(module.exports={AIToolCategory,AI_REGISTRY,ANNUAL_MONTHS_FREE,ANSI_ESCAPE_SOURCE,ASSIGNED_SECRET_SLUG,AlertChannel,AlertTrigger,CATEGORISED_SLUGS,COMMON_PASSPHRASE_ROOTS,COVERAGE_SLUGS,CUSTOM_EXTRA_ROOTS,CUSTOM_PASSPHRASE_MIN_LENGTH,CUSTOM_PASSPHRASE_WARNING,DETECTION_CATEGORIES,DETECTION_FAMILY_BLURBS,DETECTION_FAMILY_NAMES,DETECTION_PROOF_NAMES,DETECTION_UNIVERSAL_IGNORES,DIGEST_VERSION_HMAC_V1,EDITOR_DEVICE_EMAIL,EDITOR_EMAIL_PREFIX,EMAIL_MAX,ENTERPRISE_FEATURES,EventAction,EventType,FOUNDING_PERCENT_OFF,FOUNDING_TEAMS,FREE_FEATURES,FREE_SEATS,GENERATED_PASSPHRASE_BITS_APPROX,GENERATED_PASSPHRASE_ENTROPY_BITS,GENERATED_PASSPHRASE_REQUIRED_MESSAGE,GUESSABLE_SECRET_BITS,INVISIBLE_CHARS_CLASS,ISSUE_LABEL,KDF_ITERATIONS,KDF_VERSION_V2,KeyShareUnavailableError,LEGACY_PRO_BANDS,LIST_HOLD_MS,MATRIX_TIERS,MAX_ACTIVITY_SESSIONS_PER_BATCH,MAX_SCAN_WINDOWS,MAX_TOTAL_SCAN_CHARS,MIN_SECRET_LENGTH,NAME_MAX,NORMALIZATION_VERSION_V1,NORMALIZATION_VERSION_V2,OFFICIAL_OPRF_PINS,OFFICIAL_SERVER_HOSTS,OPRF_ELEMENT_BYTES,OPRF_OUTPUT_BYTES,OPRF_PROOF_BYTES,ORG_KEY_LOCK_SCHEME,OprfProofError,OrgPlan,PASSPHRASE_CREDENTIAL_NAME,PASSPHRASE_CREDENTIAL_URL,PASSPHRASE_VERIFY_LABEL,PASTE_CEILING_ALARM_CHARS,PASTE_CEILING_WARN_CHARS,PLAN_DESCRIPTORS,PLAN_FEATURE_MATRIX,PLAN_FEATURE_TIERS,PLAN_LIMITS,PLAN_PRICING,PLATFORM_SURFACES,PRIVACY_EMAIL,PROJECT_KDF_LABEL,PRO_BANDS,PRO_ENTRY_BAND,PRO_FEATURES,PRO_TOP_BAND,ROSTER_FILE_MAX_BYTES,ROSTER_MAX_ROWS,ROSTER_TEMPLATE_CSV,ROTATION_GUIDE_SLUGS,ROTATION_LINK_HOSTS,RiskLevel,SAFE_BLOCK_EVENT_FIELDS,SALES_EMAIL,SCAN_PREFILTER_LABEL,SCAN_PREFILTER_PATTERN,SCAN_PREFILTER_SPACE,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE,SECRET_PROVIDER_NAMES,SECRET_PROVIDER_SLUGS,SECURITY_CODE_WHERE_TO_TYPE,SECURITY_EMAIL,SEQUENCES,SERVER_EMAIL_RE,SecretKeyNeededError,TRIAL_DAYS,TRUST_POINTS,UNRECOGNISED_PROVIDER_SLUG,UserRole,VSCODE_AWAY_AFTER_MS,VSCODE_PLACES,VSCODE_PLACE_LABELS,annualBilledNote,appendPasskeyEnvelope,assessSecretGuessability,behaviorExplanation,canonicalSecretPlaintextForHmac,categoryOfSlug,checkOprfAnswer,checkRosterFile,checkShareAnswer,clientBehindProxies,computePassphraseVerifyHmac,createLockedOrgKey,createShareHandler,customPolicyDomains,decodeScanPrefilter,deriveBehaviorRisk,deriveHmacKeyFromPassphrase,deriveProjectKey,deriveScanPrefilterSeed,deviceEnvelopeCredential,encodeScanPrefilter,eventFor,extractAddedLinesFromUnifiedDiff,familyDisplayName,familyOfSlug,findBand,findPasskeyEnvelope,foldLeet,foldUuidHexCase,foundingMonthlyUsd,generateHmacKey,generateLockSecretKey,generateOrgKey,generateOrgPassphrase,generatePrfSalt,getInjectionHostnames,getLimitsForPlan,getPrfSaltBytes,guardListShrink,guessableSecretWarning,hexToKey,hmacDigestHex,inviteLinksCsv,inviteShareText,isAIToolDomain,isEditorDevice,isEditorExtensionId,isEditorUserAgent,isGeneratedPassphraseFormat,isInjectionScopedHostname,isKeyShare,isKnownProviderSlug,isOrgKeyLock,isProtectableSlug,isStrictScope,isV1PassphraseEnvelope,isV2Envelope,isValidOprfSecretKey,isVscodePlace,joinLockCredential,keyToHex,lockOrgKey,lockSecretKeyBytes,matchDomain,matchPatternsForHostname,maxScannablePasteChars,maxScannablePasteCharsFor,memoryPinStore,nameFromEmail,normalizeAndHmacHex,normalizeAndHmacHexCollapsed,normalizeAndHmacHexLower,normalizeDomainInput,normalizeSecretPlaintextCollapsed,normalizeSecretPlaintextForMatch,normalizeSecretPlaintextLower,oprfBlind,oprfBlindEvaluate,oprfBlindEvaluateWithProof,oprfDeriveSecretKey,oprfFinalize,oprfGenerateSecretKey,oprfPublicKey,oprfVerifyEvaluation,parseRoster,passphraseCsvText,passphraseSheetText,perMonthOnAnnual,policyNamedDomains,projectedScanCost,providerDisplayName,publicKeyHex,removePasskeyEnvelope,rotationGuideFor,scanBudgetFor,scanPrefilterFingerprint,scanPrefilterForRawSecret,scanPrefilterParams,scanPrefilterRoller,scanPrefilterUnits,scanSweeps,scanWindowLengths,scopeOf,smallestBandFor,splitLockCredential,unlockOrgKey,unwrapHmacKeyWithPrf,upgradeEnvelopeToV2,usd,validateAnchorPassphrase,validateCustomPassphrase,validateGeneratedPassphrase,validateNewPassphrase,validatePassphraseStrength,wrapHmacKeyWithPrf});
 /*! Bundled license information:
 
 @noble/hashes/esm/utils.js: