@redaktyn/cli 1.6.4 → 1.6.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/README.md +13 -4
  2. package/package.json +4 -1
  3. package/redaktyn-connect.mjs +6 -6
  4. package/redaktyn-decoder.mjs +6 -0
  5. package/redaktyn-lock-net.mjs +1 -1
  6. package/redaktyn-places.mjs +6 -0
  7. package/redaktyn-rail.mjs +21 -0
  8. package/redaktyn-scan.mjs +24 -10
  9. package/redaktyn-session.mjs +8 -8
  10. package/redaktyn-shared.cjs +6 -6
  11. package/redaktyn-ui.mjs +5 -5
package/redaktyn-shared.cjs CHANGED
@@ -1,16 +1,16 @@
1
- "use strict";var Ns=Object.create;var At=Object.defineProperty;var Hs=Object.getOwnPropertyDescriptor;var Gs=Object.getOwnPropertyNames;var Fs=Object.getPrototypeOf,Ws=Object.prototype.hasOwnProperty;var Vs=(e,t)=>{for(var n in t)At(e,n,{get:t[n],enumerable:!0})},Ar=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Gs(t))!Ws.call(e,o)&&o!==n&&At(e,o,{get:()=>t[o],enumerable:!(r=Hs(t,o))||r.enumerable});return e};var Ks=(e,t,n)=>(n=e!=null?Ns(Fs(e)):{},Ar(t||!e||!e.__esModule?At(n,"default",{value:e,enumerable:!0}):n,e)),js=e=>Ar(At({},"__esModule",{value:!0}),e);var $l={};Vs($l,{AIToolCategory:()=>ln,AI_REGISTRY:()=>St,ANNUAL_MONTHS_FREE:()=>ra,ANSI_ESCAPE_SOURCE:()=>no,ASSIGNED_SECRET_SLUG:()=>rl,AlertChannel:()=>Rr,AlertTrigger:()=>Tr,BUG_REPORT_KINDS:()=>ma,BUG_REPORT_LIMITS:()=>Ea,BUG_REPORT_RESPONSE_PROMISE:()=>ga,BUG_REPORT_SECRET_WARNING:()=>ba,BUG_REPORT_URGENT_KIND:()=>ya,CATEGORISED_SLUGS:()=>xl,COMMON_PASSPHRASE_ROOTS:()=>st,COVERAGE_SLUGS:()=>Ss,CUSTOM_EXTRA_ROOTS:()=>Dt,CUSTOM_PASSPHRASE_MIN_LENGTH:()=>Mt,CUSTOM_PASSPHRASE_WARNING:()=>ti,DETECTION_CATEGORIES:()=>br,DETECTION_FAMILY_BLURBS:()=>hl,DETECTION_FAMILY_NAMES:()=>_s,DETECTION_PROOF_NAMES:()=>ml,DETECTION_SOURCES:()=>Bs,DETECTION_SOURCE_LABELS:()=>Vl,DETECTION_UNIVERSAL_IGNORES:()=>yl,DIGEST_VERSION_HMAC_V1:()=>Na,EDITOR_DETECTION_SOURCES:()=>Wl,EDITOR_DEVICE_EMAIL:()=>Ls,EDITOR_EMAIL_PREFIX:()=>Nl,EMAIL_MAX:()=>hf,ENTERPRISE_FEATURES:()=>hn,EventAction:()=>Sr,EventType:()=>_r,FOUNDING_PERCENT_OFF:()=>Mr,FOUNDING_TEAMS:()=>Xs,FREE_FEATURES:()=>fn,FREE_SEATS:()=>Ze,GENERATED_PASSPHRASE_BITS_APPROX:()=>Qo,GENERATED_PASSPHRASE_ENTROPY_BITS:()=>Ii,GENERATED_PASSPHRASE_REQUIRED_MESSAGE:()=>co,GUESSABLE_SECRET_BITS:()=>ao,INVISIBLE_CHARS_CLASS:()=>to,ISSUE_LABEL:()=>Cl,KDF_ITERATIONS:()=>nt,KDF_VERSION_V2:()=>Fa,KeyShareUnavailableError:()=>tn,LEGACY_PRO_BANDS:()=>Zs,LIST_HOLD_MS:()=>$u,MATRIX_TIERS:()=>ca,MAX_ACTIVITY_SESSIONS_PER_BATCH:()=>nf,MAX_SCAN_WINDOWS:()=>sn,MAX_TOTAL_SCAN_CHARS:()=>xt,MIN_SECRET_LENGTH:()=>Ba,NAME_MAX:()=>pf,NORMALIZATION_VERSION_V1:()=>Ha,NORMALIZATION_VERSION_V2:()=>Ga,OFFICIAL_OPRF_PINS:()=>sr,OFFICIAL_SERVER_HOSTS:()=>qo,OPRF_ELEMENT_BYTES:()=>ze,OPRF_OUTPUT_BYTES:()=>Sc,OPRF_PROOF_BYTES:()=>Jt,ORG_KEY_LOCK_SCHEME:()=>Fc,OprfProofError:()=>Z,OrgPlan:()=>vr,PASSPHRASE_CREDENTIAL_NAME:()=>Ut,PASSPHRASE_CREDENTIAL_URL:()=>Cn,PASSPHRASE_VERIFY_LABEL:()=>oo,PASTE_CEILING_ALARM_CHARS:()=>ws,PASTE_CEILING_WARN_CHARS:()=>xs,PLAN_DESCRIPTORS:()=>da,PLAN_FEATURE_MATRIX:()=>la,PLAN_FEATURE_TIERS:()=>ia,PLAN_LIMITS:()=>Or,PLAN_PRICING:()=>ea,PLATFORM_SURFACES:()=>aa,PRIVACY_EMAIL:()=>ha,PROJECT_KDF_LABEL:()=>ro,PRO_BANDS:()=>X,PRO_ENTRY_BAND:()=>ne,PRO_FEATURES:()=>pn,PRO_TOP_BAND:()=>Qs,ROSTER_FILE_MAX_BYTES:()=>mf,ROSTER_MAX_ROWS:()=>ff,ROSTER_TEMPLATE_CSV:()=>kl,ROTATION_GUIDE_SLUGS:()=>fl,ROTATION_LINK_HOSTS:()=>ul,RiskLevel:()=>dn,SAFE_BLOCK_EVENT_FIELDS:()=>$s,SALES_EMAIL:()=>ua,SCAN_PREFILTER_LABEL:()=>ds,SCAN_PREFILTER_PATTERN:()=>ps,SCAN_PREFILTER_SPACE:()=>fr,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE:()=>Es,SECRET_PROVIDER_NAMES:()=>wt,SECRET_PROVIDER_SLUGS:()=>As,SECURITY_CODE_WHERE_TO_TYPE:()=>Ps,SECURITY_EMAIL:()=>fa,SEQUENCES:()=>Pt,SERVER_EMAIL_RE:()=>Ms,SUPPORT_EMAIL:()=>pa,SecretKeyNeededError:()=>mt,TRIAL_DAYS:()=>oa,TRUST_POINTS:()=>Gc,UNRECOGNISED_PROVIDER_SLUG:()=>Me,UserRole:()=>Ir,VSCODE_AWAY_AFTER_MS:()=>Fl,VSCODE_PLACES:()=>Us,VSCODE_PLACE_LABELS:()=>Ul,annualBilledNote:()=>Dr,appendPasskeyEnvelope:()=>Vi,assessSecretGuessability:()=>xi,behaviorExplanation:()=>qs,canonicalSecretPlaintextForHmac:()=>Ct,categoryOfSlug:()=>gl,checkOprfAnswer:()=>en,checkRosterFile:()=>Ol,checkShareAnswer:()=>ar,clientBehindProxies:()=>Bc,computePassphraseVerifyHmac:()=>vn,createLockedOrgKey:()=>jc,createShareHandler:()=>Nc,customPolicyDomains:()=>wl,decodeScanPrefilter:()=>pr,deriveBehaviorRisk:()=>zs,deriveHmacKeyFromPassphrase:()=>za,deriveProjectKey:()=>Ya,deriveScanPrefilterSeed:()=>ms,deviceEnvelopeCredential:()=>$c,encodeScanPrefilter:()=>bs,eventFor:()=>jl,extractAddedLinesFromUnifiedDiff:()=>Yc,familyDisplayName:()=>El,familyOfSlug:()=>Cs,findBand:()=>ta,findPasskeyEnvelope:()=>ji,foldLeet:()=>Ge,foldUuidHexCase:()=>rt,foundingMonthlyUsd:()=>Js,generateHmacKey:()=>Xa,generateLockSecretKey:()=>Wc,generateOrgKey:()=>as,generateOrgPassphrase:()=>Ti,generatePrfSalt:()=>Hi,getInjectionHostnames:()=>Ur,getLimitsForPlan:()=>Ys,getPrfSaltBytes:()=>Wi,guardListShrink:()=>zc,guessableSecretWarning:()=>wi,hexToKey:()=>Qa,hmacDigestHex:()=>Ot,inviteLinksCsv:()=>Pl,inviteShareText:()=>Ml,isAIToolDomain:()=>wa,isDetectionSource:()=>Kl,isEditorDevice:()=>Bl,isEditorExtensionId:()=>Hl,isEditorUserAgent:()=>Gl,isGeneratedPassphraseFormat:()=>On,isInjectionScopedHostname:()=>gn,isKeyShare:()=>cs,isKnownProviderSlug:()=>ol,isOrgKeyLock:()=>ls,isProtectableSlug:()=>bl,isStrictScope:()=>Yo,isV1PassphraseEnvelope:()=>uo,isV2Envelope:()=>lo,isValidOprfSecretKey:()=>tr,isVscodePlace:()=>Ll,joinLockCredential:()=>Vc,keyToHex:()=>Ja,lockOrgKey:()=>is,lockSecretKeyBytes:()=>nn,matchDomain:()=>Pr,matchPatternsForHostname:()=>Sa,maxScannablePasteChars:()=>tl,maxScannablePasteCharsFor:()=>on,memoryPinStore:()=>Oc,nameFromEmail:()=>Ds,normalizeAndHmacHex:()=>$a,normalizeAndHmacHexCollapsed:()=>Ka,normalizeAndHmacHexLower:()=>ja,normalizeDomainInput:()=>bn,normalizeSecretPlaintextCollapsed:()=>ot,normalizeSecretPlaintextForMatch:()=>In,normalizeSecretPlaintextLower:()=>He,oprfBlind:()=>ft,oprfBlindEvaluate:()=>vc,oprfBlindEvaluateWithProof:()=>rr,oprfDeriveSecretKey:()=>Rc,oprfFinalize:()=>pt,oprfGenerateSecretKey:()=>Tc,oprfPublicKey:()=>nr,oprfVerifyEvaluation:()=>ht,parseRoster:()=>_l,passphraseCsvText:()=>Oi,passphraseSheetText:()=>_i,perMonthOnAnnual:()=>sa,policyNamedDomains:()=>Os,projectedScanCost:()=>mr,providerDisplayName:()=>yr,publicKeyHex:()=>Mc,removePasskeyEnvelope:()=>Ki,rotationGuideFor:()=>pl,scanBudgetFor:()=>nl,scanPrefilterFingerprint:()=>rn,scanPrefilterForRawSecret:()=>Qc,scanPrefilterParams:()=>hs,scanPrefilterRoller:()=>Jc,scanPrefilterUnits:()=>ys,scanSweeps:()=>hr,scanWindowLengths:()=>el,scopeOf:()=>Cc,smallestBandFor:()=>na,splitLockCredential:()=>lr,unlockOrgKey:()=>Kc,unwrapHmacKeyWithPrf:()=>Fi,upgradeEnvelopeToV2:()=>Li,usd:()=>Ae,validateAnchorPassphrase:()=>Ui,validateCustomPassphrase:()=>Tn,validateGeneratedPassphrase:()=>Pi,validateNewPassphrase:()=>at,validatePassphraseStrength:()=>Rn,wrapHmacKeyWithPrf:()=>Gi});module.exports=js($l);var ln=(c=>(c.CODE_GEN="CODE_GEN",c.IMAGE_GEN="IMAGE_GEN",c.WRITING="WRITING",c.DATA_ANALYSIS="DATA_ANALYSIS",c.CHATBOT="CHATBOT",c.SEARCH="SEARCH",c.OTHER="OTHER",c))(ln||{}),dn=(o=>(o.LOW="LOW",o.MEDIUM="MEDIUM",o.HIGH="HIGH",o.CRITICAL="CRITICAL",o))(dn||{}),Sr=(n=>(n.BLOCKED="BLOCKED",n.LOGGED="LOGGED",n))(Sr||{}),Ir=(o=>(o.OWNER="OWNER",o.ADMIN="ADMIN",o.USER="USER",o.VIEWER="VIEWER",o))(Ir||{}),vr=(r=>(r.FREE="FREE",r.PRO="PRO",r.ENTERPRISE="ENTERPRISE",r))(vr||{}),Rr=(n=>(n.EMAIL="EMAIL",n.WEBHOOK="WEBHOOK",n))(Rr||{}),Tr=(r=>(r.CRITICAL_BLOCK="CRITICAL_BLOCK",r.DAILY_SUMMARY="DAILY_SUMMARY",r.WEEKLY_REPORT="WEEKLY_REPORT",r))(Tr||{}),_r=(s=>(s.PASTE="PASTE",s.FILE_UPLOAD="FILE_UPLOAD",s.SELECTION="SELECTION",s.PASTE_REDACTED="PASTE_REDACTED",s.DETECTED="DETECTED",s))(_r||{}),$s=["event","type","secretLabel","secretLabels","attemptCount","risk","toolDomain","sourceUrl","timestamp","eventType","scanMethod","scanMs","hmacBatches","secretIds","matchReason","matchReasonSource","bypassVariant","incidentId","detectedAt","policyAction"];function zs(e){return e<=1?"low":e===2?"medium":"high"}function qs(e){return e<=1?"User likely made an accidental paste.":e===2?"User may not be aware this is sensitive.":"Repeated attempts detected \u2014 potential risk."}var De={maxUsers:5,maxInviteCodes:5,alerts:["EMAIL"],customDetection:!1,advancedReports:!1,exportReports:!1,siem:!1,sso:!1,customerKeyShare:!1},un={maxUsers:200,maxInviteCodes:200,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!1,siem:!1,sso:!1,customerKeyShare:!1},Cr={maxUsers:9999,maxInviteCodes:9999,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!0,siem:!0,sso:!0,customerKeyShare:!0},Or={FREE:De,PRO:un,ENTERPRISE:Cr};function Ys(e){return Or[e]??De}var Ze=De.maxUsers,X=[{id:"team25c",name:"Team",maxUsers:25,monthlyUsd:99,annualUsd:990},{id:"growth50c",name:"Growth",maxUsers:50,monthlyUsd:179,annualUsd:1790},{id:"business100c",name:"Business",maxUsers:100,monthlyUsd:329,annualUsd:3290},{id:"scale200c",name:"Scale",maxUsers:200,monthlyUsd:599,annualUsd:5990}],Zs=[{id:"team25",name:"Team",maxUsers:25,monthlyUsd:49,annualUsd:490},{id:"growth50",name:"Growth",maxUsers:50,monthlyUsd:99,annualUsd:990},{id:"business100",name:"Business",maxUsers:100,monthlyUsd:179,annualUsd:1790},{id:"scale200b",name:"Scale",maxUsers:200,monthlyUsd:329,annualUsd:3290},{id:"team15",name:"Team",maxUsers:15,monthlyUsd:59,annualUsd:590},{id:"growth30",name:"Growth",maxUsers:30,monthlyUsd:119,annualUsd:1190},{id:"business75",name:"Business",maxUsers:75,monthlyUsd:279,annualUsd:2790},{id:"scale200",name:"Scale",maxUsers:200,monthlyUsd:649,annualUsd:6490}],Xs=100,Mr=45;function Js(e){return Math.round(e.monthlyUsd*(100-Mr))/100}var Zl=X[X.length-1].maxUsers,ne=X[0],Qs=X[X.length-1],ea={PRO:{monthlyUsd:ne.monthlyUsd,annualUsd:ne.annualUsd}};function ta(e){return X.find(t=>t.id===e)}function na(e){return X.find(t=>t.maxUsers>=e)}var ra=2,oa=14;function Ae(e){return`$${Number.isInteger(e)?e.toLocaleString("en-US"):e.toFixed(2)}`}function sa(e){return Ae(e/12)}function Dr(e,t){return`${Ae(t)} billed yearly \xB7 save ${Ae(e*12-t)}`}var fn=["The full detection engine \u2014 paste, send, typed input, drag and file upload","Chrome","Bypass detection \u2014 whitespace injection and case folding","Unregistered-secret suggestions \u2014 spots keys nobody registered, on by default and one click to turn off, never a block","VS Code extension \u2014 pastes into the terminal and the chat box are checked, and files are flagged on exactly the secret","Claude Code, Codex and Cursor \u2014 each prompt, attached or read file, command and tool call is checked before it is sent","Command line \u2014 redaktyn-scan as a git pre-commit hook, and on any file or folder","Block, or let people paste a redacted copy \u2014 your admin's choice, in the browser and in VS Code alike","Every stop in your Event Log as the secret's label and the place, never the text","Zero-knowledge by construction: only HMAC digests leave the device",`Up to ${Ze} people, plus ${Ze} editor machines running VS Code or the command line`,`${De.maxInviteCodes} invite codes`,"Email alerts","30-day compliance history","Community support"],pn=[`Pick your team's size \u2014 each covers that many people and the same number of editor machines: ${X.map(e=>`${e.name} ${e.maxUsers} + ${e.maxUsers}, ${Ae(e.monthlyUsd)}/mo`).join("; ")}`,"Everyone inside your size is covered; no per-seat metering or proration between invites","As many unused invite links as your size has seats","Webhook alerts alongside email","Executive PDF report, emailed every Monday and downloadable any time","Domain policies \u2014 add any site, beyond the built-in AI tools, to the places Redaktyn blocks","365-day compliance history","Priority support"],hn=["Custom seat limits, agreed rather than published","Customer-held key share \u2014 a key server you run must also answer before your workspace key opens, so Redaktyn cannot open it alone or test passphrase guesses, whatever passphrase you choose. We never receive your passphrase either way","CSV export of the full event log","SIEM webhook delivery","SSO \u2014 SAML 2.0","Dedicated support"],aa=[{id:"browser",name:"Browser extension",where:"Chrome",points:["Paste, send, typed input, drag and file upload are checked on the AI tools you use, and on any site you add (Pro)","A secret with its spaces changed or its case folded is still caught","Spots up to 50 categories of key nobody registered, and only ever suggests: it never blocks on a guess","Your admin can let people paste a redacted copy instead of being stopped"]},{id:"vscode",name:"VS Code extension",where:"Visual Studio Marketplace",points:["A paste into the terminal, where Claude Code and Codex run, is checked before it goes in","A secret typed or pasted into the VS Code chat box is taken back out before it can be submitted","Files are flagged on exactly the secret when they open and when they are saved","Connects with an invite link from your admin, made the same way as a browser's"]},{id:"agents",name:"Claude Code, Codex and Cursor",where:"Through each tool's own hooks",points:["Each prompt, each file attached or read, each command and tool call is checked before it is sent","Blocked, or the agent is handed a redacted copy and your real file is never changed","One command to install and one to remove, for each tool; your other hooks are left exactly as they were","The details, and what it cannot cover, are on the VS Code extension page"]},{id:"cli",name:"Command line and git",where:"redaktyn-scan",points:["Checks what git is about to commit and refuses the commit if it holds a registered secret","Installs as a pre-commit hook with one command, or scans any file or folder","Machine-readable output, so it can run in CI","Connects with an invite link from your admin, made the same way as the browser's and VS Code's"]},{id:"admin",name:"Dashboard and Event Log",where:"For the people who run it",points:["Every stop reaches your Event Log as the secret's label and the place, never the text, a prompt or a file name","See which developer machines are connected, their versions, and whether their Claude Code, Codex and Cursor hooks are installed","Device approval: a new device waits for an admin before it is connected","Pro adds the Monday executive report, webhook alerts and a year of history"]},{id:"projects",name:"Projects",where:"One key for each engagement",points:["A project is one piece of work: its secrets, its invites and its devices belong to it","On a named project, an invite hands over a key derived for that project alone, so the browser it enrols matches that project's fingerprints and no others","Closing a project stops its fingerprints being served, at each device's next sync","The project switcher narrows what an admin sees; it is not a permission, which still follows the person's role"]}],ia=[{key:"FREE",name:"Free",features:fn},{key:"PRO",name:"Pro",features:pn},{key:"ENTERPRISE",name:"Enterprise",features:hn}],ca=[{key:"FREE",name:"Free",price:"$0"},{key:"PRO",name:"Pro",price:`From ${Ae(ne.monthlyUsd)}/mo`},{key:"ENTERPRISE",name:"Enterprise",price:"Contact us"}],la=[{section:"Limits",rows:[{label:"People covered",note:`Dashboard logins and browsers. Pro is bought in ${X.length} sizes, up to ${X.map(e=>e.maxUsers).join(", ")} people \u2014 the figure here is the largest; a workspace's own limit is the size it bought.`,gate:"maxUsers",values:{FREE:String(Ze),PRO:"200",ENTERPRISE:"Custom"}},{label:"Editor machines covered",note:"Machines running VS Code, Claude Code, Codex or the command line, counted apart from the people: every size covers as many of them as it does people, so a developer on Chrome and VS Code uses one of each.",gate:"maxUsers",values:{FREE:String(Ze),PRO:"200",ENTERPRISE:"Custom"}},{label:"Invite codes",note:"Unused links held at once. A link is spent when a browser connects and takes a seat, so on Pro this is the size you bought.",gate:"maxInviteCodes",values:{FREE:String(De.maxInviteCodes),PRO:String(un.maxInviteCodes),ENTERPRISE:"Unlimited"}},{label:"Compliance history",note:"How far back a compliance report may be run. Event data itself is not deleted on any plan.",gate:"advancedReports",values:{FREE:"30 days",PRO:"365 days",ENTERPRISE:"365 days"}}]},{section:"Detection and blocking",rows:[{label:"Paste, send, typed input, drag and file upload",note:"All six enforcement paths (paste, drop, file upload, typing, insertion by script, and the check again at Send or Enter), on every plan. Detection has never been plan-gated and is the last thing that should be.",ungated:"No plan check exists on any enforcement path in the extension.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Chrome",ungated:"The extension reports its browser; no route reads a plan before accepting the heartbeat.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Bypass detection \u2014 whitespace injection, case folding",ungated:"Runs inside the same scan as the direct match; there is no flag to turn it off.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Detection engine \u2014 50 categories nobody registered",note:"Credentials, infrastructure files and personal data, each proven by a checksum, a decoded structure or the provider's format. On by default; suggests, never blocks.",ungated:"The org switch is an admin setting with no plan check, and the extension's resolver reads only that switch.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Personal-data detection \u2014 cards, Aadhaar, PAN, SSN, IBAN",note:"Checksum-verified and labelled, offered for removal only. Its own switch, on by default.",ungated:"The personal-data switch is an admin setting with no plan check; the resolver passes it straight to the engine.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Unprotected-secret counts by category",note:"A daily count per category on the dashboard \u2014 never a value, a fingerprint or a name.",ungated:"The coverage route checks the org's reporting switch and the enrolment, never the plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Custom domain policies",note:"Add a site that is not one of the built-in AI tools to the places Redaktyn blocks. Older warn and log policies keep working.",gate:"customDetection",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}}]},{section:"Where it runs",rows:[{label:"VS Code extension",note:"A paste into the terminal and into the chat box is checked; files are flagged on exactly the secret. It connects with an invite link, like the browser.",ungated:"The /api/vscode routes and the secrets list read no plan; a connected machine takes a seat like a browser does.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Claude Code, Codex and Cursor",note:"Each prompt, attached or read file, command and tool call is checked through the tool's own hooks, installed and removed with one command each.",ungated:"The hooks read only the secrets list and the redaction policy, and neither route reads a plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Command line and git pre-commit hook",note:"redaktyn-scan checks what git is about to commit, or any file or folder, and can run in CI.",ungated:"The CLI's routes read no plan; it uses the same secrets list and connects with an invite link like the other surfaces.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Redacted copy instead of a block",note:"One admin switch for the browser and VS Code. On unless the admin turns it off.",ungated:"The overlay-policy route is an admin setting with no plan check.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Device approval",note:"A new device waits for an admin before it is connected.",ungated:"The device-approval routes and service read no plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Who is connected, and what they have protected",note:"The VS Code page lists each developer's extension and VS Code versions, and whether their Claude Code, Codex and Cursor hooks are installed.",ungated:"The VS Code devices route reads no plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}}]},{section:"Alerting and reporting",rows:[{label:"Email alerts",ungated:"EMAIL is in every plan's channel list, so the row is true by construction.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Webhook alerts",gate:"alerts",channel:"WEBHOOK",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"Executive PDF report",note:"Emailed every Monday, and downloadable at any time from Reports.",gate:"advancedReports",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"CSV export of the event log",gate:"exportReports",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"SIEM webhook delivery",gate:"siem",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Customer-held key share",note:"A key server you run must also answer before your workspace key opens, so Redaktyn cannot open it alone or test passphrase guesses, whatever passphrase you choose. Cut it off and nobody, including Redaktyn, can unlock the workspace. If its key is lost, the way back is a reset that registers every secret again.",gate:"customerKeyShare",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}}]},{section:"Access and support",rows:[{label:"SSO \u2014 SAML 2.0",gate:"sso",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Support",note:"A commitment from people, not a switch in the code \u2014 which is why no flag backs this row.",ungated:"Support tiering is contractual; no route reads a plan to answer a support request.",values:{FREE:"Community",PRO:"Priority",ENTERPRISE:"Dedicated"}}]}],da=[{id:"FREE",name:"Free",tagline:"The whole detection engine, for a team that is still proving it works",priceMonthly:0,priceLabel:"$0",priceNote:"Forever free \xB7 no card",limits:De,features:fn,featuresHeading:"What's included",highlighted:!1,cta:"Get started"},{id:"PRO",name:"Pro",tagline:"For a team that has to answer questions about its own exposure",priceMonthly:ne.monthlyUsd,priceLabel:Ae(ne.monthlyUsd),priceNote:`per month \xB7 up to ${ne.maxUsers} people + ${ne.maxUsers} editor machines`,annualNote:Dr(ne.monthlyUsd,ne.annualUsd),limits:un,features:pn,featuresHeading:"Everything in Free, plus",highlighted:!0,cta:"Start free, then upgrade"},{id:"ENTERPRISE",name:"Enterprise",tagline:"For satisfying somebody else's auditor or IT department",priceMonthly:null,priceLabel:"Custom",priceNote:"Contact sales",limits:Cr,features:hn,featuresHeading:"Everything in Pro, plus",highlighted:!1,cta:"Contact sales"}],mn="ak8340651733@gmail.com",ua=mn,fa=mn,pa=mn,ha="support@redaktyn.com";var ma=[{id:"WRONG_BLOCK",label:"Something was blocked that should not have been"},{id:"LEAK",label:"A secret may have got through"},{id:"LOOKS_BROKEN",label:"Something looks or works wrong in the dashboard"},{id:"OTHER",label:"Something else"}],ya="LEAK",ga="We reply within 1 hour (Monday to Saturday, 10 am to 7 pm IST), and by the next morning outside those hours.",ba="Do not paste a secret, API key or passphrase here. We never need one, and a report can be read by more than one person.",Ea={message:4e3,expected:1500,pagePath:200,userAgent:300,shortField:40};function l(e,t,n,r="MEDIUM",o={}){return{domain:e,name:t,category:n,riskLevel:r,isEnterprise:o.isEnterprise??!1,...o.personalVersionDomain?{personalVersionDomain:o.personalVersionDomain}:{}}}var St=[l("chat.openai.com","ChatGPT","CODE_GEN","HIGH"),l("chatgpt.com","ChatGPT","CODE_GEN","HIGH"),l("platform.openai.com","OpenAI Platform","CODE_GEN","HIGH"),l("claude.ai","Claude","CODE_GEN","HIGH"),l("gemini.google.com","Gemini","CODE_GEN","MEDIUM"),l("aistudio.google.com","Google AI Studio","CODE_GEN","MEDIUM"),l("copilot.github.com","GitHub Copilot","CODE_GEN","MEDIUM"),l("github.com/copilot","GitHub Copilot Chat","CODE_GEN","MEDIUM"),l("cursor.sh","Cursor","CODE_GEN","MEDIUM"),l("cursor.com","Cursor","CODE_GEN","MEDIUM"),l("replit.com","Replit","CODE_GEN","HIGH"),l("codeium.com","Codeium","CODE_GEN","MEDIUM"),l("tabnine.com","Tabnine","CODE_GEN","MEDIUM"),l("codewhisperer.aws","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),l("aws.amazon.com/codewhisperer","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),l("phind.com","Phind","CODE_GEN","MEDIUM"),l("continue.dev","Continue","CODE_GEN","MEDIUM"),l("askcodi.com","AskCodi","CODE_GEN","MEDIUM"),l("sourcegraph.com","Sourcegraph Cody","CODE_GEN","MEDIUM"),l("windsurf.ai","Windsurf","CODE_GEN","MEDIUM"),l("v0.dev","Vercel v0","CODE_GEN","MEDIUM"),l("bolt.new","Bolt","CODE_GEN","HIGH"),l("lovable.dev","Lovable","CODE_GEN","HIGH"),l("aider.chat","Aider","CODE_GEN","MEDIUM"),l("cody.dev","Cody","CODE_GEN","MEDIUM"),l("blackbox.ai","Blackbox AI","CODE_GEN","HIGH"),l("deepcode.ai","DeepCode","CODE_GEN","MEDIUM"),l("codiga.io","Codiga","CODE_GEN","MEDIUM"),l("mutable.ai","Mutable AI","CODE_GEN","MEDIUM"),l("pieces.app","Pieces","CODE_GEN","MEDIUM"),l("codium.ai","CodiumAI","CODE_GEN","MEDIUM"),l("coderabbit.ai","CodeRabbit","CODE_GEN","MEDIUM"),l("devin.ai","Devin","CODE_GEN","HIGH"),l("idx.dev","Project IDX","CODE_GEN","MEDIUM"),l("stackblitz.com","StackBlitz","CODE_GEN","MEDIUM"),l("codepen.io","CodePen AI","CODE_GEN","MEDIUM"),l("codesandbox.io","CodeSandbox AI","CODE_GEN","MEDIUM"),l("gitpod.io","Gitpod","CODE_GEN","MEDIUM"),l("poe.com","Poe","CHATBOT","MEDIUM"),l("character.ai","Character.AI","CHATBOT","MEDIUM"),l("beta.character.ai","Character.AI Beta","CHATBOT","MEDIUM"),l("huggingface.co/chat","HuggingChat","CHATBOT","MEDIUM"),l("pi.ai","Pi","CHATBOT","LOW"),l("chat.mistral.ai","Mistral Chat","CHATBOT","MEDIUM"),l("chat.deepseek.com","DeepSeek Chat","CHATBOT","HIGH"),l("deepseek.com","DeepSeek","CHATBOT","HIGH"),l("groq.com","Groq","CHATBOT","MEDIUM"),l("console.groq.com","Groq Console","CHATBOT","MEDIUM"),l("cohere.com","Cohere","CHATBOT","MEDIUM"),l("coral.cohere.com","Cohere Coral","CHATBOT","MEDIUM"),l("inflection.ai","Inflection","CHATBOT","MEDIUM"),l("chat.lmsys.org","LMSYS Chatbot Arena","CHATBOT","HIGH"),l("open-assistant.io","Open Assistant","CHATBOT","MEDIUM"),l("bard.google.com","Google Bard","CHATBOT","MEDIUM"),l("copilot.microsoft.com","Microsoft Copilot","CHATBOT","LOW",{isEnterprise:!0}),l("bing.com/chat","Bing Chat","CHATBOT","MEDIUM"),l("meta.ai","Meta AI","CHATBOT","MEDIUM"),l("labs.perplexity.ai","Perplexity Labs","CHATBOT","MEDIUM"),l("together.ai","Together AI","CHATBOT","MEDIUM"),l("api.together.xyz","Together API","CHATBOT","MEDIUM"),l("fireworks.ai","Fireworks AI","CHATBOT","MEDIUM"),l("anyscale.com","Anyscale","CHATBOT","MEDIUM"),l("replicate.com","Replicate","CHATBOT","MEDIUM"),l("lepton.ai","Lepton AI","CHATBOT","MEDIUM"),l("forefront.ai","Forefront","CHATBOT","MEDIUM"),l("chat.vercel.ai","Vercel AI Chat","CHATBOT","MEDIUM"),l("llama.meta.com","Llama","CHATBOT","MEDIUM"),l("grok.com","Grok","CHATBOT","HIGH"),l("grok.x.ai","Grok","CHATBOT","MEDIUM"),l("x.ai","xAI","CHATBOT","MEDIUM"),l("duckduckgo.com/aichat","DuckDuckGo AI Chat","CHATBOT","LOW"),l("chatglm.cn","ChatGLM","CHATBOT","HIGH"),l("yiyan.baidu.com","Ernie Bot","CHATBOT","HIGH"),l("qianwen.aliyun.com","Qwen","CHATBOT","HIGH"),l("abacus.ai","Abacus AI","CHATBOT","MEDIUM"),l("midjourney.com","Midjourney","IMAGE_GEN","MEDIUM"),l("discord.com/channels/midjourney","Midjourney Discord","IMAGE_GEN","MEDIUM"),l("openai.com/dall-e","DALL-E","IMAGE_GEN","MEDIUM"),l("labs.openai.com","DALL-E Labs","IMAGE_GEN","MEDIUM"),l("stability.ai","Stable Diffusion","IMAGE_GEN","MEDIUM"),l("dreamstudio.ai","DreamStudio","IMAGE_GEN","MEDIUM"),l("leonardo.ai","Leonardo.ai","IMAGE_GEN","MEDIUM"),l("app.leonardo.ai","Leonardo.ai App","IMAGE_GEN","MEDIUM"),l("ideogram.ai","Ideogram","IMAGE_GEN","MEDIUM"),l("firefly.adobe.com","Adobe Firefly","IMAGE_GEN","LOW",{isEnterprise:!0}),l("clipdrop.co","ClipDrop","IMAGE_GEN","MEDIUM"),l("playground.ai","Playground AI","IMAGE_GEN","MEDIUM"),l("nightcafe.studio","NightCafe","IMAGE_GEN","MEDIUM"),l("creator.nightcafe.studio","NightCafe Creator","IMAGE_GEN","MEDIUM"),l("runwayml.com","Runway","IMAGE_GEN","MEDIUM"),l("app.runwayml.com","Runway App","IMAGE_GEN","MEDIUM"),l("canva.com/ai-image-generator","Canva AI","IMAGE_GEN","LOW"),l("imagine.meta.com","Meta Imagine","IMAGE_GEN","MEDIUM"),l("pika.art","Pika","IMAGE_GEN","MEDIUM"),l("kaiber.ai","Kaiber","IMAGE_GEN","MEDIUM"),l("bing.com/images/create","Bing Image Creator","IMAGE_GEN","MEDIUM"),l("designer.microsoft.com","Microsoft Designer","IMAGE_GEN","MEDIUM"),l("craiyon.com","Craiyon","IMAGE_GEN","LOW"),l("starryai.com","StarryAI","IMAGE_GEN","LOW"),l("hotpot.ai","Hotpot AI","IMAGE_GEN","LOW"),l("lexica.art","Lexica","IMAGE_GEN","LOW"),l("jasper.ai","Jasper","WRITING","MEDIUM"),l("app.jasper.ai","Jasper App","WRITING","MEDIUM"),l("copy.ai","Copy.ai","WRITING","MEDIUM"),l("app.copy.ai","Copy.ai App","WRITING","MEDIUM"),l("writesonic.com","Writesonic","WRITING","MEDIUM"),l("app.writesonic.com","Writesonic App","WRITING","MEDIUM"),l("grammarly.com","Grammarly AI","WRITING","MEDIUM"),l("app.grammarly.com","Grammarly App","WRITING","MEDIUM"),l("notion.so","Notion AI","WRITING","MEDIUM"),l("quillbot.com","QuillBot","WRITING","MEDIUM"),l("wordtune.com","Wordtune","WRITING","MEDIUM"),l("rytr.me","Rytr","WRITING","MEDIUM"),l("anyword.com","Anyword","WRITING","MEDIUM"),l("hyperwriteai.com","HyperWrite","WRITING","MEDIUM"),l("writer.com","Writer","WRITING","MEDIUM",{isEnterprise:!0}),l("textcortex.com","TextCortex","WRITING","MEDIUM"),l("app.textcortex.com","TextCortex App","WRITING","MEDIUM"),l("peppertype.ai","Peppertype","WRITING","MEDIUM"),l("simplified.com","Simplified AI","WRITING","MEDIUM"),l("contentbot.ai","ContentBot","WRITING","MEDIUM"),l("ink.co","INK Editor","WRITING","MEDIUM"),l("sudowrite.com","Sudowrite","WRITING","MEDIUM"),l("novelai.net","NovelAI","WRITING","LOW"),l("shortlyai.com","ShortlyAI","WRITING","MEDIUM"),l("lex.page","Lex","WRITING","MEDIUM"),l("julius.ai","Julius","DATA_ANALYSIS","HIGH"),l("hex.tech","Hex","DATA_ANALYSIS","HIGH"),l("app.hex.tech","Hex App","DATA_ANALYSIS","HIGH"),l("obviously.ai","Obviously AI","DATA_ANALYSIS","HIGH"),l("akkio.com","Akkio","DATA_ANALYSIS","HIGH"),l("monkeylearn.com","MonkeyLearn","DATA_ANALYSIS","HIGH"),l("rows.com","Rows","DATA_ANALYSIS","MEDIUM"),l("breadcrumbs.io","Breadcrumbs","DATA_ANALYSIS","MEDIUM"),l("polymer.co","Polymer","DATA_ANALYSIS","HIGH"),l("databricks.com","Databricks AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("datarobot.com","DataRobot","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("h2o.ai","H2O.ai","DATA_ANALYSIS","MEDIUM"),l("rapidminer.com","RapidMiner","DATA_ANALYSIS","MEDIUM"),l("knime.com","KNIME","DATA_ANALYSIS","MEDIUM"),l("alteryx.com","Alteryx","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("tableau.com","Tableau AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("mode.com","Mode Analytics","DATA_ANALYSIS","MEDIUM"),l("deepnote.com","Deepnote","DATA_ANALYSIS","HIGH"),l("observable.com","Observable","DATA_ANALYSIS","MEDIUM"),l("noteable.io","Noteable","DATA_ANALYSIS","HIGH"),l("perplexity.ai","Perplexity Search","SEARCH","MEDIUM"),l("you.com","You.com Search","SEARCH","MEDIUM"),l("andi.ai","Andi","SEARCH","LOW"),l("kagi.com","Kagi","SEARCH","LOW"),l("metaphor.systems","Metaphor","SEARCH","MEDIUM"),l("exa.ai","Exa","SEARCH","MEDIUM"),l("tavily.com","Tavily","SEARCH","MEDIUM"),l("consensus.app","Consensus","SEARCH","LOW"),l("elicit.com","Elicit","SEARCH","MEDIUM"),l("elicit.org","Elicit","SEARCH","MEDIUM"),l("searchgpt.com","SearchGPT","SEARCH","MEDIUM"),l("brave.com/search/ai","Brave AI Search","SEARCH","LOW"),l("neeva.com","Neeva","SEARCH","LOW"),l("socratic.org","Socratic","SEARCH","LOW"),l("devv.ai","Devv AI","SEARCH","MEDIUM"),l("iask.ai","iAsk AI","SEARCH","LOW"),l("chatpdf.com","ChatPDF","SEARCH","MEDIUM"),l("smodin.io","Smodin","WRITING","MEDIUM"),l("ai-writer.com","AI Writer","WRITING","MEDIUM"),l("scalenut.com","Scalenut","WRITING","MEDIUM"),l("closerscopy.com","ClosersCopy","WRITING","MEDIUM"),l("longshot.ai","LongShot AI","WRITING","MEDIUM"),l("fig.io","Fig AI","CODE_GEN","MEDIUM"),l("warp.dev","Warp Terminal AI","CODE_GEN","MEDIUM"),l("raycast.com","Raycast AI","CODE_GEN","MEDIUM"),l("app.codeanywhere.com","Codeanywhere AI","CODE_GEN","MEDIUM"),l("zed.dev","Zed AI","CODE_GEN","MEDIUM"),l("gencraft.com","Gencraft","IMAGE_GEN","LOW"),l("deepai.org","DeepAI","IMAGE_GEN","LOW"),l("artbreeder.com","Artbreeder","IMAGE_GEN","LOW"),l("fotor.com/ai","Fotor AI","IMAGE_GEN","LOW"),l("remove.bg","Remove.bg","IMAGE_GEN","LOW"),l("photoroom.com","PhotoRoom AI","IMAGE_GEN","LOW"),l("app.recraft.ai","Recraft AI","IMAGE_GEN","MEDIUM"),l("pecan.ai","Pecan AI","DATA_ANALYSIS","HIGH"),l("apteo.co","Apteo","DATA_ANALYSIS","HIGH"),l("mindsdb.com","MindsDB","DATA_ANALYSIS","MEDIUM"),l("zapier.com/ai","Zapier AI","OTHER","MEDIUM"),l("make.com","Make (Integromat) AI","OTHER","MEDIUM"),l("otter.ai","Otter.ai","OTHER","HIGH"),l("fireflies.ai","Fireflies.ai","OTHER","HIGH"),l("descript.com","Descript","OTHER","MEDIUM"),l("synthesia.io","Synthesia","OTHER","MEDIUM"),l("elevenlabs.io","ElevenLabs","OTHER","MEDIUM"),l("murf.ai","Murf AI","OTHER","MEDIUM"),l("resemble.ai","Resemble AI","OTHER","MEDIUM"),l("loom.com","Loom AI","OTHER","MEDIUM"),l("beautiful.ai","Beautiful.ai","OTHER","LOW"),l("gamma.app","Gamma","OTHER","MEDIUM"),l("tome.app","Tome","OTHER","MEDIUM"),l("magician.design","Magician","OTHER","MEDIUM"),l("uizard.io","Uizard","OTHER","MEDIUM"),l("huggingface.co/spaces","HuggingFace Spaces","OTHER","MEDIUM"),l("roboflow.com","Roboflow","OTHER","MEDIUM"),l("scale.com","Scale AI","OTHER","MEDIUM"),l("labelbox.com","Labelbox","OTHER","MEDIUM")],td=new Set(St.map(e=>e.domain.toLowerCase())),Xe=new Map;for(let e of St){let t=e.domain.toLowerCase();Xe.has(t)||Xe.set(t,e)}function xa(e){try{return e.includes("://")||(e="https://"+e),new URL(e).hostname.toLowerCase()}catch{return null}}function Pr(e){let t=xa(e);if(!t)return null;let n=Xe.get(t);if(n)return n;try{let o=new URL(e.includes("://")?e:"https://"+e),s=(o.hostname+o.pathname).toLowerCase().replace(/\/+$/,""),a=Xe.get(s);if(a)return a}catch{}let r=t.split(".");for(let o=1;o<r.length-1;o++){let s=r.slice(o).join("."),a=Xe.get(s);if(a)return a}return null}function wa(e){return Pr(e)!==null}var ka=new Set(["replit.com","sourcegraph.com","idx.dev","stackblitz.com","codepen.io","codesandbox.io","gitpod.io","fig.io","warp.dev","raycast.com","app.codeanywhere.com","zed.dev","anyscale.com","grammarly.com","notion.so","hex.tech","app.hex.tech","rows.com","breadcrumbs.io","databricks.com","datarobot.com","h2o.ai","rapidminer.com","knime.com","alteryx.com","tableau.com","mode.com","deepnote.com","observable.com","noteable.io","mindsdb.com","kagi.com","make.com","loom.com","roboflow.com","scale.com","labelbox.com"]),Aa=["redaktyn.com"];function Ur(){let e=new Set;for(let t of St){let n=t.domain.toLowerCase();n.includes("/")||ka.has(n)||e.add(n)}for(let t of Aa)e.add(t.toLowerCase());return Array.from(e).sort()}var yn=null;function gn(e){yn||(yn=new Set(Ur()));let t=e.toLowerCase();for(let n of yn)if(t===n||t.endsWith(`.${n}`))return!0;return!1}function Sa(e){let t=e.toLowerCase();return[`*://${t}/*`,`*://*.${t}/*`]}function bn(e){let t=e.trim().toLowerCase();return!t||(t=t.replace(/^[a-z][a-z0-9+.-]*:\/\//,""),t=t.split(/[/?#]/)[0],t=t.split("@").pop(),t=t.split(":")[0],!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/.test(t))?null:t}var ie=Ks(require("node:crypto"),1),Se=ie&&typeof ie=="object"&&"webcrypto"in ie?ie.webcrypto:ie&&typeof ie=="object"&&"randomBytes"in ie?ie:void 0;function re(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function q(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function L(e,...t){if(!re(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function Ie(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash should be wrapped by utils.createHasher");q(e.outputLen),q(e.blockLen)}function Ue(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function Br(e,t){L(e);let n=t.outputLen;if(e.length<n)throw new Error("digestInto() expects output buffer of length at least "+n)}function $(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Le(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function J(e,t){return e<<32-t|e>>>t}var Nr=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",Ia=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function V(e){if(L(e),Nr)return e.toHex();let t="";for(let n=0;n<e.length;n++)t+=Ia[e[n]];return t}var ce={_0:48,_9:57,A:65,F:70,a:97,f:102};function Lr(e){if(e>=ce._0&&e<=ce._9)return e-ce._0;if(e>=ce.A&&e<=ce.F)return e-(ce.A-10);if(e>=ce.a&&e<=ce.f)return e-(ce.a-10)}function Q(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(Nr)return Uint8Array.fromHex(e);let t=e.length,n=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let r=new Uint8Array(n);for(let o=0,s=0;o<n;o++,s+=2){let a=Lr(e.charCodeAt(s)),c=Lr(e.charCodeAt(s+1));if(a===void 0||c===void 0){let i=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+i+'" at index '+s)}r[o]=a*16+c}return r}var va=async()=>{};async function Hr(e,t,n){let r=Date.now();for(let o=0;o<e;o++){n(o);let s=Date.now()-r;s>=0&&s<t||(await va(),r+=s)}}function C(e){if(typeof e!="string")throw new Error("string expected");return new Uint8Array(new TextEncoder().encode(e))}function ye(e){return typeof e=="string"&&(e=C(e)),L(e),e}function En(e){return typeof e=="string"&&(e=C(e)),L(e),e}function B(...e){let t=0;for(let r=0;r<e.length;r++){let o=e[r];L(o),t+=o.length}let n=new Uint8Array(t);for(let r=0,o=0;r<e.length;r++){let s=e[r];n.set(s,o),o+=s.length}return n}function Gr(e,t){if(t!==void 0&&{}.toString.call(t)!=="[object Object]")throw new Error("options should be object or undefined");return Object.assign(e,t)}var Pe=class{};function xn(e){let t=r=>e().update(ye(r)).digest(),n=e();return t.outputLen=n.outputLen,t.blockLen=n.blockLen,t.create=()=>e(),t}function Be(e=32){if(Se&&typeof Se.getRandomValues=="function")return Se.getRandomValues(new Uint8Array(e));if(Se&&typeof Se.randomBytes=="function")return Uint8Array.from(Se.randomBytes(e));throw new Error("crypto.getRandomValues must be defined")}var It=class extends Pe{constructor(t,n){super(),this.finished=!1,this.destroyed=!1,Ie(t);let r=ye(n);if(this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let o=this.blockLen,s=new Uint8Array(o);s.set(r.length>o?t.create().update(r).digest():r);for(let a=0;a<s.length;a++)s[a]^=54;this.iHash.update(s),this.oHash=t.create();for(let a=0;a<s.length;a++)s[a]^=106;this.oHash.update(s),$(s)}update(t){return Ue(this),this.iHash.update(t),this}digestInto(t){Ue(this),L(t,this.outputLen),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:n,iHash:r,finished:o,destroyed:s,blockLen:a,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=a,t.outputLen=c,t.oHash=n._cloneInto(t.oHash),t.iHash=r._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},ee=(e,t,n)=>new It(e,t).update(n).digest();ee.create=(e,t)=>new It(e,t);function Ra(e,t,n,r){if(typeof e.setBigUint64=="function")return e.setBigUint64(t,n,r);let o=BigInt(32),s=BigInt(4294967295),a=Number(n>>o&s),c=Number(n&s),i=r?4:0,f=r?0:4;e.setUint32(t+i,a,r),e.setUint32(t+f,c,r)}function Fr(e,t,n){return e&t^~e&n}function Wr(e,t,n){return e&t^e&n^t&n}var Je=class extends Pe{constructor(t,n,r,o){super(),this.finished=!1,this.length=0,this.pos=0,this.destroyed=!1,this.blockLen=t,this.outputLen=n,this.padOffset=r,this.isLE=o,this.buffer=new Uint8Array(t),this.view=Le(this.buffer)}update(t){Ue(this),t=ye(t),L(t);let{view:n,buffer:r,blockLen:o}=this,s=t.length;for(let a=0;a<s;){let c=Math.min(o-this.pos,s-a);if(c===o){let i=Le(t);for(;o<=s-a;a+=o)this.process(i,a);continue}r.set(t.subarray(a,a+c),this.pos),this.pos+=c,a+=c,this.pos===o&&(this.process(n,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){Ue(this),Br(t,this),this.finished=!0;let{buffer:n,view:r,blockLen:o,isLE:s}=this,{pos:a}=this;n[a++]=128,$(this.buffer.subarray(a)),this.padOffset>o-a&&(this.process(r,0),a=0);for(let p=a;p<o;p++)n[p]=0;Ra(r,o-8,BigInt(this.length*8),s),this.process(r,0);let c=Le(t),i=this.outputLen;if(i%4)throw new Error("_sha2: outputLen should be aligned to 32bit");let f=i/4,d=this.get();if(f>d.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<f;p++)c.setUint32(4*p,d[p],s)}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let r=t.slice(0,n);return this.destroy(),r}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:n,buffer:r,length:o,finished:s,destroyed:a,pos:c}=this;return t.destroyed=a,t.finished=s,t.length=o,t.pos=c,o%n&&t.buffer.set(r),t}clone(){return this._cloneInto()}},le=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var G=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]);var vt=BigInt(4294967295),Vr=BigInt(32);function Ta(e,t=!1){return t?{h:Number(e&vt),l:Number(e>>Vr&vt)}:{h:Number(e>>Vr&vt)|0,l:Number(e&vt)|0}}function Kr(e,t=!1){let n=e.length,r=new Uint32Array(n),o=new Uint32Array(n);for(let s=0;s<n;s++){let{h:a,l:c}=Ta(e[s],t);[r[s],o[s]]=[a,c]}return[r,o]}var wn=(e,t,n)=>e>>>n,kn=(e,t,n)=>e<<32-n|t>>>n,ve=(e,t,n)=>e>>>n|t<<32-n,Re=(e,t,n)=>e<<32-n|t>>>n,Qe=(e,t,n)=>e<<64-n|t>>>n-32,et=(e,t,n)=>e>>>n-32|t<<64-n;function oe(e,t,n,r){let o=(t>>>0)+(r>>>0);return{h:e+n+(o/2**32|0)|0,l:o|0}}var jr=(e,t,n)=>(e>>>0)+(t>>>0)+(n>>>0),$r=(e,t,n,r)=>t+n+r+(e/2**32|0)|0,zr=(e,t,n,r)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0),qr=(e,t,n,r,o)=>t+n+r+o+(e/2**32|0)|0,Yr=(e,t,n,r,o)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0)+(o>>>0),Zr=(e,t,n,r,o,s)=>t+n+r+o+s+(e/2**32|0)|0;var Ca=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),ge=new Uint32Array(64),Rt=class extends Je{constructor(t=32){super(64,t,8,!1),this.A=le[0]|0,this.B=le[1]|0,this.C=le[2]|0,this.D=le[3]|0,this.E=le[4]|0,this.F=le[5]|0,this.G=le[6]|0,this.H=le[7]|0}get(){let{A:t,B:n,C:r,D:o,E:s,F:a,G:c,H:i}=this;return[t,n,r,o,s,a,c,i]}set(t,n,r,o,s,a,c,i){this.A=t|0,this.B=n|0,this.C=r|0,this.D=o|0,this.E=s|0,this.F=a|0,this.G=c|0,this.H=i|0}process(t,n){for(let p=0;p<16;p++,n+=4)ge[p]=t.getUint32(n,!1);for(let p=16;p<64;p++){let u=ge[p-15],h=ge[p-2],m=J(u,7)^J(u,18)^u>>>3,g=J(h,17)^J(h,19)^h>>>10;ge[p]=g+ge[p-7]+m+ge[p-16]|0}let{A:r,B:o,C:s,D:a,E:c,F:i,G:f,H:d}=this;for(let p=0;p<64;p++){let u=J(c,6)^J(c,11)^J(c,25),h=d+u+Fr(c,i,f)+Ca[p]+ge[p]|0,g=(J(r,2)^J(r,13)^J(r,22))+Wr(r,o,s)|0;d=f,f=i,i=c,c=a+h|0,a=s,s=o,o=r,r=h+g|0}r=r+this.A|0,o=o+this.B|0,s=s+this.C|0,a=a+this.D|0,c=c+this.E|0,i=i+this.F|0,f=f+this.G|0,d=d+this.H|0,this.set(r,o,s,a,c,i,f,d)}roundClean(){$(ge)}destroy(){this.set(0,0,0,0,0,0,0,0),$(this.buffer)}};var Xr=Kr(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(e=>BigInt(e))),Oa=Xr[0],Ma=Xr[1],be=new Uint32Array(80),Ee=new Uint32Array(80),Tt=class extends Je{constructor(t=64){super(128,t,16,!1),this.Ah=G[0]|0,this.Al=G[1]|0,this.Bh=G[2]|0,this.Bl=G[3]|0,this.Ch=G[4]|0,this.Cl=G[5]|0,this.Dh=G[6]|0,this.Dl=G[7]|0,this.Eh=G[8]|0,this.El=G[9]|0,this.Fh=G[10]|0,this.Fl=G[11]|0,this.Gh=G[12]|0,this.Gl=G[13]|0,this.Hh=G[14]|0,this.Hl=G[15]|0}get(){let{Ah:t,Al:n,Bh:r,Bl:o,Ch:s,Cl:a,Dh:c,Dl:i,Eh:f,El:d,Fh:p,Fl:u,Gh:h,Gl:m,Hh:g,Hl:E}=this;return[t,n,r,o,s,a,c,i,f,d,p,u,h,m,g,E]}set(t,n,r,o,s,a,c,i,f,d,p,u,h,m,g,E){this.Ah=t|0,this.Al=n|0,this.Bh=r|0,this.Bl=o|0,this.Ch=s|0,this.Cl=a|0,this.Dh=c|0,this.Dl=i|0,this.Eh=f|0,this.El=d|0,this.Fh=p|0,this.Fl=u|0,this.Gh=h|0,this.Gl=m|0,this.Hh=g|0,this.Hl=E|0}process(t,n){for(let b=0;b<16;b++,n+=4)be[b]=t.getUint32(n),Ee[b]=t.getUint32(n+=4);for(let b=16;b<80;b++){let I=be[b-15]|0,R=Ee[b-15]|0,D=ve(I,R,1)^ve(I,R,8)^wn(I,R,7),P=Re(I,R,1)^Re(I,R,8)^kn(I,R,7),v=be[b-2]|0,x=Ee[b-2]|0,k=ve(v,x,19)^Qe(v,x,61)^wn(v,x,6),S=Re(v,x,19)^et(v,x,61)^kn(v,x,6),T=zr(P,S,Ee[b-7],Ee[b-16]),O=qr(T,D,k,be[b-7],be[b-16]);be[b]=O|0,Ee[b]=T|0}let{Ah:r,Al:o,Bh:s,Bl:a,Ch:c,Cl:i,Dh:f,Dl:d,Eh:p,El:u,Fh:h,Fl:m,Gh:g,Gl:E,Hh:y,Hl:w}=this;for(let b=0;b<80;b++){let I=ve(p,u,14)^ve(p,u,18)^Qe(p,u,41),R=Re(p,u,14)^Re(p,u,18)^et(p,u,41),D=p&h^~p&g,P=u&m^~u&E,v=Yr(w,R,P,Ma[b],Ee[b]),x=Zr(v,y,I,D,Oa[b],be[b]),k=v|0,S=ve(r,o,28)^Qe(r,o,34)^Qe(r,o,39),T=Re(r,o,28)^et(r,o,34)^et(r,o,39),O=r&s^r&c^s&c,_=o&a^o&i^a&i;y=g|0,w=E|0,g=h|0,E=m|0,h=p|0,m=u|0,{h:p,l:u}=oe(f|0,d|0,x|0,k|0),f=c|0,d=i|0,c=s|0,i=a|0,s=r|0,a=o|0;let U=jr(k,T,_);r=$r(U,x,S,O),o=U|0}({h:r,l:o}=oe(this.Ah|0,this.Al|0,r|0,o|0)),{h:s,l:a}=oe(this.Bh|0,this.Bl|0,s|0,a|0),{h:c,l:i}=oe(this.Ch|0,this.Cl|0,c|0,i|0),{h:f,l:d}=oe(this.Dh|0,this.Dl|0,f|0,d|0),{h:p,l:u}=oe(this.Eh|0,this.El|0,p|0,u|0),{h,l:m}=oe(this.Fh|0,this.Fl|0,h|0,m|0),{h:g,l:E}=oe(this.Gh|0,this.Gl|0,g|0,E|0),{h:y,l:w}=oe(this.Hh|0,this.Hl|0,y|0,w|0),this.set(r,o,s,a,c,i,f,d,p,u,h,m,g,E,y,w)}roundClean(){$(be,Ee)}destroy(){$(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}};var Jr=xn(()=>new Rt);var Ne=xn(()=>new Tt);var z=Jr;function Da(e,t,n,r){Ie(e);let o=Gr({dkLen:32,asyncTick:10},r),{c:s,dkLen:a,asyncTick:c}=o;if(q(s),q(a),q(c),s<1)throw new Error("iterations (c) should be >= 1");let i=En(t),f=En(n),d=new Uint8Array(a),p=ee.create(e,i),u=p._cloneInto().update(f);return{c:s,dkLen:a,asyncTick:c,DK:d,PRF:p,PRFSalt:u}}function Pa(e,t,n,r,o){return e.destroy(),t.destroy(),r&&r.destroy(),$(o),n}async function _t(e,t,n,r){let{c:o,dkLen:s,asyncTick:a,DK:c,PRF:i,PRFSalt:f}=Da(e,t,n,r),d,p=new Uint8Array(4),u=Le(p),h=new Uint8Array(i.outputLen);for(let m=1,g=0;g<s;m++,g+=i.outputLen){let E=c.subarray(g,g+i.outputLen);u.setInt32(0,m,!1),(d=f._cloneInto(d)).update(p).digestInto(h),E.set(h.subarray(0,E.length)),await Hr(o-1,a,()=>{i._cloneInto(d).update(h).digestInto(h);for(let y=0;y<E.length;y++)E[y]^=h[y]})}return Pa(i,f,c,d,h)}function Ua(e,t,n){return Ie(e),n===void 0&&(n=new Uint8Array(e.outputLen)),ee(e,ye(n),ye(t))}var An=Uint8Array.from([0]),Qr=Uint8Array.of();function La(e,t,n,r=32){Ie(e),q(r);let o=e.outputLen;if(r>255*o)throw new Error("Length should be <= 255*HashLen");let s=Math.ceil(r/o);n===void 0&&(n=Qr);let a=new Uint8Array(s*o),c=ee.create(e,t),i=c._cloneInto(),f=new Uint8Array(c.outputLen);for(let d=0;d<s;d++)An[0]=d+1,i.update(d===0?Qr:f).update(n).update(An).digestInto(f),a.set(f,o*d),c._cloneInto(i);return c.destroy(),i.destroy(),$(f,An),a.slice(0,r)}var tt=(e,t,n,r,o)=>La(e,Ua(e,t,n),r,o);var Ba=8,Na="hmac-sha256-v1",Ha="normalization-v1",Ga="normalization-v2",Fa="pbkdf2-sha256-600k-v2",eo=6e5,nt=eo,Sn=32,to="[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f-\\u0084\\u0086-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180f\\u200b-\\u200f\\u202a-\\u202e\\u2060-\\u2064\\u2066-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]",Wa=new RegExp(to,"g"),no="\\u001b(?:\\[[0-?]*[ -/]*[@-~]|\\][^\\u0007\\u001b]{0,512}(?:\\u0007|\\u001b\\\\))",Va=new RegExp(no,"g");function In(e){let t=e.includes("\x1B")?e.replace(Va,""):e;return t=t.normalize("NFC"),t=t.replace(/\r\n/g,`
1
+ "use strict";var Ns=Object.create;var St=Object.defineProperty;var Hs=Object.getOwnPropertyDescriptor;var Gs=Object.getOwnPropertyNames;var Fs=Object.getPrototypeOf,Ws=Object.prototype.hasOwnProperty;var Vs=(e,t)=>{for(var n in t)St(e,n,{get:t[n],enumerable:!0})},Ar=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Gs(t))!Ws.call(e,o)&&o!==n&&St(e,o,{get:()=>t[o],enumerable:!(r=Hs(t,o))||r.enumerable});return e};var Ks=(e,t,n)=>(n=e!=null?Ns(Fs(e)):{},Ar(t||!e||!e.__esModule?St(n,"default",{value:e,enumerable:!0}):n,e)),js=e=>Ar(St({},"__esModule",{value:!0}),e);var $l={};Vs($l,{AIToolCategory:()=>dn,AI_REGISTRY:()=>It,ANNUAL_MONTHS_FREE:()=>ra,ANSI_ESCAPE_SOURCE:()=>no,ASSIGNED_SECRET_SLUG:()=>rl,AlertChannel:()=>Rr,AlertTrigger:()=>Tr,BUG_REPORT_KINDS:()=>ma,BUG_REPORT_LIMITS:()=>Ea,BUG_REPORT_RESPONSE_PROMISE:()=>ga,BUG_REPORT_SECRET_WARNING:()=>ba,BUG_REPORT_URGENT_KIND:()=>ya,CATEGORISED_SLUGS:()=>xl,COMMON_PASSPHRASE_ROOTS:()=>at,COVERAGE_SLUGS:()=>Ss,CUSTOM_EXTRA_ROOTS:()=>Pt,CUSTOM_PASSPHRASE_MIN_LENGTH:()=>Dt,CUSTOM_PASSPHRASE_WARNING:()=>ti,DETECTION_CATEGORIES:()=>br,DETECTION_FAMILY_BLURBS:()=>hl,DETECTION_FAMILY_NAMES:()=>_s,DETECTION_PROOF_NAMES:()=>ml,DETECTION_SOURCES:()=>Bs,DETECTION_SOURCE_LABELS:()=>Vl,DETECTION_UNIVERSAL_IGNORES:()=>yl,DIGEST_VERSION_HMAC_V1:()=>Na,EDITOR_DETECTION_SOURCES:()=>Wl,EDITOR_DEVICE_EMAIL:()=>Ls,EDITOR_EMAIL_PREFIX:()=>Nl,EMAIL_MAX:()=>hf,ENTERPRISE_FEATURES:()=>hn,EventAction:()=>Sr,EventType:()=>_r,FOUNDING_PERCENT_OFF:()=>Mr,FOUNDING_TEAMS:()=>Xs,FREE_FEATURES:()=>fn,FREE_SEATS:()=>Xe,GENERATED_PASSPHRASE_BITS_APPROX:()=>Qo,GENERATED_PASSPHRASE_ENTROPY_BITS:()=>Ii,GENERATED_PASSPHRASE_REQUIRED_MESSAGE:()=>co,GUESSABLE_SECRET_BITS:()=>ao,INVISIBLE_CHARS_CLASS:()=>to,ISSUE_LABEL:()=>Cl,KDF_ITERATIONS:()=>rt,KDF_VERSION_V2:()=>Fa,KeyShareUnavailableError:()=>nn,LEGACY_PRO_BANDS:()=>Zs,LIST_HOLD_MS:()=>$u,MATRIX_TIERS:()=>ca,MAX_ACTIVITY_SESSIONS_PER_BATCH:()=>nf,MAX_SCAN_WINDOWS:()=>an,MAX_TOTAL_SCAN_CHARS:()=>wt,MIN_SECRET_LENGTH:()=>Ba,NAME_MAX:()=>pf,NORMALIZATION_VERSION_V1:()=>Ha,NORMALIZATION_VERSION_V2:()=>Ga,OFFICIAL_OPRF_PINS:()=>sr,OFFICIAL_SERVER_HOSTS:()=>qo,OPRF_ELEMENT_BYTES:()=>ze,OPRF_OUTPUT_BYTES:()=>Sc,OPRF_PROOF_BYTES:()=>Qt,ORG_KEY_LOCK_SCHEME:()=>Fc,OprfProofError:()=>Z,OrgPlan:()=>vr,PASSPHRASE_CREDENTIAL_NAME:()=>Lt,PASSPHRASE_CREDENTIAL_URL:()=>Cn,PASSPHRASE_VERIFY_LABEL:()=>oo,PASTE_CEILING_ALARM_CHARS:()=>ws,PASTE_CEILING_WARN_CHARS:()=>xs,PLAN_DESCRIPTORS:()=>da,PLAN_FEATURE_MATRIX:()=>la,PLAN_FEATURE_TIERS:()=>ia,PLAN_LIMITS:()=>Or,PLAN_PRICING:()=>ea,PLATFORM_SURFACES:()=>aa,PRIVACY_EMAIL:()=>ha,PROJECT_KDF_LABEL:()=>ro,PRO_BANDS:()=>X,PRO_ENTRY_BAND:()=>ne,PRO_FEATURES:()=>pn,PRO_TOP_BAND:()=>Qs,ROSTER_FILE_MAX_BYTES:()=>mf,ROSTER_MAX_ROWS:()=>ff,ROSTER_TEMPLATE_CSV:()=>kl,ROTATION_GUIDE_SLUGS:()=>fl,ROTATION_LINK_HOSTS:()=>ul,RiskLevel:()=>un,SAFE_BLOCK_EVENT_FIELDS:()=>$s,SALES_EMAIL:()=>ua,SCAN_PREFILTER_LABEL:()=>ds,SCAN_PREFILTER_PATTERN:()=>ps,SCAN_PREFILTER_SPACE:()=>fr,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE:()=>Es,SECRET_PROVIDER_NAMES:()=>kt,SECRET_PROVIDER_SLUGS:()=>As,SECURITY_CODE_WHERE_TO_TYPE:()=>Ps,SECURITY_EMAIL:()=>fa,SEQUENCES:()=>Ut,SERVER_EMAIL_RE:()=>Ms,SUPPORT_EMAIL:()=>pa,SecretKeyNeededError:()=>yt,TRIAL_DAYS:()=>oa,TRUST_POINTS:()=>Gc,UNRECOGNISED_PROVIDER_SLUG:()=>Me,UserRole:()=>Ir,VSCODE_AWAY_AFTER_MS:()=>Fl,VSCODE_PLACES:()=>Us,VSCODE_PLACE_LABELS:()=>Ul,annualBilledNote:()=>Dr,appendPasskeyEnvelope:()=>Vi,assessSecretGuessability:()=>xi,behaviorExplanation:()=>qs,canonicalSecretPlaintextForHmac:()=>Ot,categoryOfSlug:()=>gl,checkOprfAnswer:()=>tn,checkRosterFile:()=>Ol,checkShareAnswer:()=>ar,clientBehindProxies:()=>Bc,computePassphraseVerifyHmac:()=>vn,createLockedOrgKey:()=>jc,createShareHandler:()=>Nc,customPolicyDomains:()=>wl,decodeScanPrefilter:()=>pr,deriveBehaviorRisk:()=>zs,deriveHmacKeyFromPassphrase:()=>za,deriveProjectKey:()=>Ya,deriveScanPrefilterSeed:()=>ms,deviceEnvelopeCredential:()=>$c,encodeScanPrefilter:()=>bs,eventFor:()=>jl,extractAddedLinesFromUnifiedDiff:()=>Yc,familyDisplayName:()=>El,familyOfSlug:()=>Cs,findBand:()=>ta,findPasskeyEnvelope:()=>ji,foldLeet:()=>Ge,foldUuidHexCase:()=>ot,foundingMonthlyUsd:()=>Js,generateHmacKey:()=>Xa,generateLockSecretKey:()=>Wc,generateOrgKey:()=>as,generateOrgPassphrase:()=>Ti,generatePrfSalt:()=>Hi,getInjectionHostnames:()=>Ur,getLimitsForPlan:()=>Ys,getPrfSaltBytes:()=>Wi,guardListShrink:()=>zc,guessableSecretWarning:()=>wi,hexToKey:()=>Qa,hmacDigestHex:()=>Mt,inviteLinksCsv:()=>Pl,inviteShareText:()=>Ml,isAIToolDomain:()=>wa,isDetectionSource:()=>Kl,isEditorDevice:()=>Bl,isEditorExtensionId:()=>Hl,isEditorUserAgent:()=>Gl,isGeneratedPassphraseFormat:()=>On,isInjectionScopedHostname:()=>gn,isKeyShare:()=>cs,isKnownProviderSlug:()=>ol,isOrgKeyLock:()=>ls,isProtectableSlug:()=>bl,isStrictScope:()=>Yo,isV1PassphraseEnvelope:()=>uo,isV2Envelope:()=>lo,isValidOprfSecretKey:()=>tr,isVscodePlace:()=>Ll,joinLockCredential:()=>Vc,keyToHex:()=>Ja,lockOrgKey:()=>is,lockSecretKeyBytes:()=>rn,matchDomain:()=>Pr,matchPatternsForHostname:()=>Sa,maxScannablePasteChars:()=>tl,maxScannablePasteCharsFor:()=>sn,memoryPinStore:()=>Oc,nameFromEmail:()=>Ds,normalizeAndHmacHex:()=>$a,normalizeAndHmacHexCollapsed:()=>Ka,normalizeAndHmacHexLower:()=>ja,normalizeDomainInput:()=>bn,normalizeSecretPlaintextCollapsed:()=>st,normalizeSecretPlaintextForMatch:()=>In,normalizeSecretPlaintextLower:()=>He,oprfBlind:()=>pt,oprfBlindEvaluate:()=>vc,oprfBlindEvaluateWithProof:()=>rr,oprfDeriveSecretKey:()=>Rc,oprfFinalize:()=>ht,oprfGenerateSecretKey:()=>Tc,oprfPublicKey:()=>nr,oprfVerifyEvaluation:()=>mt,parseRoster:()=>_l,passphraseCsvText:()=>Oi,passphraseSheetText:()=>_i,perMonthOnAnnual:()=>sa,policyNamedDomains:()=>Os,projectedScanCost:()=>mr,providerDisplayName:()=>yr,publicKeyHex:()=>Mc,removePasskeyEnvelope:()=>Ki,rotationGuideFor:()=>pl,scanBudgetFor:()=>nl,scanPrefilterFingerprint:()=>on,scanPrefilterForRawSecret:()=>Qc,scanPrefilterParams:()=>hs,scanPrefilterRoller:()=>Jc,scanPrefilterUnits:()=>ys,scanSweeps:()=>hr,scanWindowLengths:()=>el,scopeOf:()=>Cc,smallestBandFor:()=>na,splitLockCredential:()=>lr,unlockOrgKey:()=>Kc,unwrapHmacKeyWithPrf:()=>Fi,upgradeEnvelopeToV2:()=>Li,usd:()=>Ae,validateAnchorPassphrase:()=>Ui,validateCustomPassphrase:()=>Tn,validateGeneratedPassphrase:()=>Pi,validateNewPassphrase:()=>it,validatePassphraseStrength:()=>Rn,wrapHmacKeyWithPrf:()=>Gi});module.exports=js($l);var dn=(c=>(c.CODE_GEN="CODE_GEN",c.IMAGE_GEN="IMAGE_GEN",c.WRITING="WRITING",c.DATA_ANALYSIS="DATA_ANALYSIS",c.CHATBOT="CHATBOT",c.SEARCH="SEARCH",c.OTHER="OTHER",c))(dn||{}),un=(o=>(o.LOW="LOW",o.MEDIUM="MEDIUM",o.HIGH="HIGH",o.CRITICAL="CRITICAL",o))(un||{}),Sr=(n=>(n.BLOCKED="BLOCKED",n.LOGGED="LOGGED",n))(Sr||{}),Ir=(o=>(o.OWNER="OWNER",o.ADMIN="ADMIN",o.USER="USER",o.VIEWER="VIEWER",o))(Ir||{}),vr=(r=>(r.FREE="FREE",r.PRO="PRO",r.ENTERPRISE="ENTERPRISE",r))(vr||{}),Rr=(n=>(n.EMAIL="EMAIL",n.WEBHOOK="WEBHOOK",n))(Rr||{}),Tr=(r=>(r.CRITICAL_BLOCK="CRITICAL_BLOCK",r.DAILY_SUMMARY="DAILY_SUMMARY",r.WEEKLY_REPORT="WEEKLY_REPORT",r))(Tr||{}),_r=(s=>(s.PASTE="PASTE",s.FILE_UPLOAD="FILE_UPLOAD",s.SELECTION="SELECTION",s.PASTE_REDACTED="PASTE_REDACTED",s.DETECTED="DETECTED",s))(_r||{}),$s=["event","type","secretLabel","secretLabels","attemptCount","risk","toolDomain","sourceUrl","timestamp","eventType","scanMethod","scanMs","hmacBatches","secretIds","matchReason","matchReasonSource","bypassVariant","incidentId","detectedAt","policyAction"];function zs(e){return e<=1?"low":e===2?"medium":"high"}function qs(e){return e<=1?"User likely made an accidental paste.":e===2?"User may not be aware this is sensitive.":"Repeated attempts detected \u2014 potential risk."}var De={maxUsers:5,maxInviteCodes:5,alerts:["EMAIL"],customDetection:!1,advancedReports:!1,exportReports:!1,siem:!1,sso:!1,customerKeyShare:!1},Ze={maxUsers:100,maxInviteCodes:100,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!1,siem:!1,sso:!1,customerKeyShare:!1},Cr={maxUsers:9999,maxInviteCodes:9999,alerts:["EMAIL","WEBHOOK"],customDetection:!0,advancedReports:!0,exportReports:!0,siem:!0,sso:!0,customerKeyShare:!0},Or={FREE:De,PRO:Ze,ENTERPRISE:Cr};function Ys(e){return Or[e]??De}var Xe=De.maxUsers,X=[{id:"team10d",name:"Starter",maxUsers:10,monthlyUsd:99,annualUsd:990},{id:"growth25d",name:"Growth",maxUsers:25,monthlyUsd:249,annualUsd:2490},{id:"scale50d",name:"Scale",maxUsers:50,monthlyUsd:449,annualUsd:4490},{id:"business100d",name:"Business",maxUsers:100,monthlyUsd:799,annualUsd:7990}],Zs=[{id:"team25c",name:"Team",maxUsers:25,monthlyUsd:99,annualUsd:990},{id:"growth50c",name:"Growth",maxUsers:50,monthlyUsd:179,annualUsd:1790},{id:"business100c",name:"Business",maxUsers:100,monthlyUsd:329,annualUsd:3290},{id:"scale200c",name:"Scale",maxUsers:200,monthlyUsd:599,annualUsd:5990},{id:"team25",name:"Team",maxUsers:25,monthlyUsd:49,annualUsd:490},{id:"growth50",name:"Growth",maxUsers:50,monthlyUsd:99,annualUsd:990},{id:"business100",name:"Business",maxUsers:100,monthlyUsd:179,annualUsd:1790},{id:"scale200b",name:"Scale",maxUsers:200,monthlyUsd:329,annualUsd:3290},{id:"team15",name:"Team",maxUsers:15,monthlyUsd:59,annualUsd:590},{id:"growth30",name:"Growth",maxUsers:30,monthlyUsd:119,annualUsd:1190},{id:"business75",name:"Business",maxUsers:75,monthlyUsd:279,annualUsd:2790},{id:"scale200",name:"Scale",maxUsers:200,monthlyUsd:649,annualUsd:6490}],Xs=100,Mr=45;function Js(e){return Math.round(e.monthlyUsd*(100-Mr))/100}var Zl=X[X.length-1].maxUsers,ne=X[0],Qs=X[X.length-1],ea={PRO:{monthlyUsd:ne.monthlyUsd,annualUsd:ne.annualUsd}};function ta(e){return X.find(t=>t.id===e)}function na(e){return X.find(t=>t.maxUsers>=e)}var ra=2,oa=14;function Ae(e){return`$${Number.isInteger(e)?e.toLocaleString("en-US"):e.toFixed(2)}`}function sa(e){return Ae(e/12)}function Dr(e,t){return`${Ae(t)} billed yearly \xB7 save ${Ae(e*12-t)}`}var fn=["The full detection engine \u2014 paste, send, typed input, drag and file upload","Chrome","Bypass detection \u2014 whitespace injection and case folding","Unregistered-secret suggestions \u2014 spots keys nobody registered, on by default and one click to turn off, never a block","VS Code extension \u2014 pastes into the terminal and the chat box are checked, and files are flagged on exactly the secret","Claude Code, Codex and Cursor \u2014 each prompt, attached or read file, command and tool call is checked before it is sent","Command line \u2014 redaktyn-scan as a git pre-commit hook, and on any file or folder","Block, or let people paste a redacted copy \u2014 your admin's choice, in the browser and in VS Code alike","Every stop in your Event Log as the secret's label and the place, never the text","Zero-knowledge by construction: only HMAC digests leave the device",`Up to ${Xe} people, plus ${Xe} editor machines running VS Code or the command line`,`${De.maxInviteCodes} invite codes`,"Email alerts","30-day compliance history","Community support"],pn=[`Pick your team's size \u2014 each covers that many people and the same number of editor machines: ${X.map(e=>`${e.name} ${e.maxUsers} + ${e.maxUsers}, ${Ae(e.monthlyUsd)}/mo`).join("; ")}`,"Everyone inside your size is covered; no per-seat metering or proration between invites","As many unused invite links as your size has seats","Webhook alerts alongside email","Executive PDF report, emailed every Monday and downloadable any time","Domain policies \u2014 add any site, beyond the built-in AI tools, to the places Redaktyn blocks","365-day compliance history","Priority support"],hn=["Custom seat limits, agreed rather than published","Customer-held key share \u2014 a key server you run must also answer before your workspace key opens, so Redaktyn cannot open it alone or test passphrase guesses, whatever passphrase you choose. We never receive your passphrase either way","CSV export of the full event log","SIEM webhook delivery","SSO \u2014 SAML 2.0","Dedicated support"],aa=[{id:"browser",name:"Browser extension",where:"Chrome",points:["Paste, send, typed input, drag and file upload are checked on the AI tools you use, and on any site you add (Pro)","A secret with its spaces changed or its case folded is still caught","Spots up to 50 categories of key nobody registered, and only ever suggests: it never blocks on a guess","Your admin can let people paste a redacted copy instead of being stopped"]},{id:"vscode",name:"VS Code extension",where:"Visual Studio Marketplace",points:["A paste into the terminal, where Claude Code and Codex run, is checked before it goes in","A secret typed or pasted into the VS Code chat box is taken back out before it can be submitted","Files are flagged on exactly the secret when they open and when they are saved","Connects with an invite link from your admin, made the same way as a browser's"]},{id:"agents",name:"Claude Code, Codex and Cursor",where:"Through each tool's own hooks",points:["Each prompt, each file attached or read, each command and tool call is checked before it is sent","Blocked, or the agent is handed a redacted copy and your real file is never changed","One command to install and one to remove, for each tool; your other hooks are left exactly as they were","The details, and what it cannot cover, are on the VS Code extension page"]},{id:"cli",name:"Command line and git",where:"redaktyn-scan",points:["Checks what git is about to commit and refuses the commit if it holds a registered secret","Installs as a pre-commit hook with one command, or scans any file or folder","Machine-readable output, so it can run in CI","Connects with an invite link from your admin, made the same way as the browser's and VS Code's"]},{id:"admin",name:"Dashboard and Event Log",where:"For the people who run it",points:["Every stop reaches your Event Log as the secret's label and the place, never the text, a prompt or a file name","See which developer machines are connected, their versions, and whether their Claude Code, Codex and Cursor hooks are installed","Device approval: a new device waits for an admin before it is connected","Pro adds the Monday executive report, webhook alerts and a year of history"]},{id:"projects",name:"Projects",where:"One key for each engagement",points:["A project is one piece of work: its secrets, its invites and its devices belong to it","On a named project, an invite hands over a key derived for that project alone, so the browser it enrols matches that project's fingerprints and no others","Closing a project stops its fingerprints being served, at each device's next sync","The project switcher narrows what an admin sees; it is not a permission, which still follows the person's role"]}],ia=[{key:"FREE",name:"Free",features:fn},{key:"PRO",name:"Pro",features:pn},{key:"ENTERPRISE",name:"Enterprise",features:hn}],ca=[{key:"FREE",name:"Free",price:"$0"},{key:"PRO",name:"Pro",price:`From ${Ae(ne.monthlyUsd)}/mo`},{key:"ENTERPRISE",name:"Enterprise",price:"Contact us"}],la=[{section:"Limits",rows:[{label:"People covered",note:`Dashboard logins and browsers. Pro is bought in ${X.length} sizes, up to ${X.map(e=>e.maxUsers).join(", ")} people \u2014 the figure here is the largest; a workspace's own limit is the size it bought.`,gate:"maxUsers",values:{FREE:String(Xe),PRO:String(Ze.maxUsers),ENTERPRISE:"Custom"}},{label:"Editor machines covered",note:"Machines running VS Code, Claude Code, Codex or the command line, counted apart from the people: every size covers as many of them as it does people, so a developer on Chrome and VS Code uses one of each.",gate:"maxUsers",values:{FREE:String(Xe),PRO:String(Ze.maxUsers),ENTERPRISE:"Custom"}},{label:"Invite codes",note:"Unused links held at once. A link is spent when a browser connects and takes a seat, so on Pro this is the size you bought.",gate:"maxInviteCodes",values:{FREE:String(De.maxInviteCodes),PRO:String(Ze.maxInviteCodes),ENTERPRISE:"Unlimited"}},{label:"Compliance history",note:"How far back a compliance report may be run. Event data itself is not deleted on any plan.",gate:"advancedReports",values:{FREE:"30 days",PRO:"365 days",ENTERPRISE:"365 days"}}]},{section:"Detection and blocking",rows:[{label:"Paste, send, typed input, drag and file upload",note:"All six enforcement paths (paste, drop, file upload, typing, insertion by script, and the check again at Send or Enter), on every plan. Detection has never been plan-gated and is the last thing that should be.",ungated:"No plan check exists on any enforcement path in the extension.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Chrome",ungated:"The extension reports its browser; no route reads a plan before accepting the heartbeat.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Bypass detection \u2014 whitespace injection, case folding",ungated:"Runs inside the same scan as the direct match; there is no flag to turn it off.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Detection engine \u2014 50 categories nobody registered",note:"Credentials, infrastructure files and personal data, each proven by a checksum, a decoded structure or the provider's format. On by default; suggests, never blocks.",ungated:"The org switch is an admin setting with no plan check, and the extension's resolver reads only that switch.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Personal-data detection \u2014 cards, Aadhaar, PAN, SSN, IBAN",note:"Checksum-verified and labelled, offered for removal only. Its own switch, on by default.",ungated:"The personal-data switch is an admin setting with no plan check; the resolver passes it straight to the engine.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Unprotected-secret counts by category",note:"A daily count per category on the dashboard \u2014 never a value, a fingerprint or a name.",ungated:"The coverage route checks the org's reporting switch and the enrolment, never the plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Custom domain policies",note:"Add a site that is not one of the built-in AI tools to the places Redaktyn blocks. Older warn and log policies keep working.",gate:"customDetection",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}}]},{section:"Where it runs",rows:[{label:"VS Code extension",note:"A paste into the terminal and into the chat box is checked; files are flagged on exactly the secret. It connects with an invite link, like the browser.",ungated:"The /api/vscode routes and the secrets list read no plan; a connected machine takes a seat like a browser does.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Claude Code, Codex and Cursor",note:"Each prompt, attached or read file, command and tool call is checked through the tool's own hooks, installed and removed with one command each.",ungated:"The hooks read only the secrets list and the redaction policy, and neither route reads a plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Command line and git pre-commit hook",note:"redaktyn-scan checks what git is about to commit, or any file or folder, and can run in CI.",ungated:"The CLI's routes read no plan; it uses the same secrets list and connects with an invite link like the other surfaces.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Redacted copy instead of a block",note:"One admin switch for the browser and VS Code. On unless the admin turns it off.",ungated:"The overlay-policy route is an admin setting with no plan check.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Device approval",note:"A new device waits for an admin before it is connected.",ungated:"The device-approval routes and service read no plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Who is connected, and what they have protected",note:"The VS Code page lists each developer's extension and VS Code versions, and whether their Claude Code, Codex and Cursor hooks are installed.",ungated:"The VS Code devices route reads no plan.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}}]},{section:"Alerting and reporting",rows:[{label:"Email alerts",ungated:"EMAIL is in every plan's channel list, so the row is true by construction.",values:{FREE:!0,PRO:!0,ENTERPRISE:!0}},{label:"Webhook alerts",gate:"alerts",channel:"WEBHOOK",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"Executive PDF report",note:"Emailed every Monday, and downloadable at any time from Reports.",gate:"advancedReports",values:{FREE:!1,PRO:!0,ENTERPRISE:!0}},{label:"CSV export of the event log",gate:"exportReports",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"SIEM webhook delivery",gate:"siem",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Customer-held key share",note:"A key server you run must also answer before your workspace key opens, so Redaktyn cannot open it alone or test passphrase guesses, whatever passphrase you choose. Cut it off and nobody, including Redaktyn, can unlock the workspace. If its key is lost, the way back is a reset that registers every secret again.",gate:"customerKeyShare",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}}]},{section:"Access and support",rows:[{label:"SSO \u2014 SAML 2.0",gate:"sso",values:{FREE:!1,PRO:!1,ENTERPRISE:!0}},{label:"Support",note:"A commitment from people, not a switch in the code \u2014 which is why no flag backs this row.",ungated:"Support tiering is contractual; no route reads a plan to answer a support request.",values:{FREE:"Community",PRO:"Priority",ENTERPRISE:"Dedicated"}}]}],da=[{id:"FREE",name:"Free",tagline:"The whole detection engine, for a team that is still proving it works",priceMonthly:0,priceLabel:"$0",priceNote:"Forever free \xB7 no card",limits:De,features:fn,featuresHeading:"What's included",highlighted:!1,cta:"Get started"},{id:"PRO",name:"Pro",tagline:"For a team that has to answer questions about its own exposure",priceMonthly:ne.monthlyUsd,priceLabel:Ae(ne.monthlyUsd),priceNote:`per month \xB7 up to ${ne.maxUsers} people + ${ne.maxUsers} editor machines`,annualNote:Dr(ne.monthlyUsd,ne.annualUsd),limits:Ze,features:pn,featuresHeading:"Everything in Free, plus",highlighted:!0,cta:"Start free, then upgrade"},{id:"ENTERPRISE",name:"Enterprise",tagline:"For satisfying somebody else's auditor or IT department",priceMonthly:null,priceLabel:"Custom",priceNote:"Contact sales",limits:Cr,features:hn,featuresHeading:"Everything in Pro, plus",highlighted:!1,cta:"Contact sales"}],mn="ak8340651733@gmail.com",ua=mn,fa=mn,pa=mn,ha="support@redaktyn.com";var ma=[{id:"WRONG_BLOCK",label:"Something was blocked that should not have been"},{id:"LEAK",label:"A secret may have got through"},{id:"LOOKS_BROKEN",label:"Something looks or works wrong in the dashboard"},{id:"OTHER",label:"Something else"}],ya="LEAK",ga="We reply within 1 hour (Monday to Saturday, 10 am to 7 pm IST), and by the next morning outside those hours.",ba="Do not paste a secret, API key or passphrase here. We never need one, and a report can be read by more than one person.",Ea={message:4e3,expected:1500,pagePath:200,userAgent:300,shortField:40};function l(e,t,n,r="MEDIUM",o={}){return{domain:e,name:t,category:n,riskLevel:r,isEnterprise:o.isEnterprise??!1,...o.personalVersionDomain?{personalVersionDomain:o.personalVersionDomain}:{}}}var It=[l("chat.openai.com","ChatGPT","CODE_GEN","HIGH"),l("chatgpt.com","ChatGPT","CODE_GEN","HIGH"),l("platform.openai.com","OpenAI Platform","CODE_GEN","HIGH"),l("claude.ai","Claude","CODE_GEN","HIGH"),l("gemini.google.com","Gemini","CODE_GEN","MEDIUM"),l("aistudio.google.com","Google AI Studio","CODE_GEN","MEDIUM"),l("copilot.github.com","GitHub Copilot","CODE_GEN","MEDIUM"),l("github.com/copilot","GitHub Copilot Chat","CODE_GEN","MEDIUM"),l("cursor.sh","Cursor","CODE_GEN","MEDIUM"),l("cursor.com","Cursor","CODE_GEN","MEDIUM"),l("replit.com","Replit","CODE_GEN","HIGH"),l("codeium.com","Codeium","CODE_GEN","MEDIUM"),l("tabnine.com","Tabnine","CODE_GEN","MEDIUM"),l("codewhisperer.aws","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),l("aws.amazon.com/codewhisperer","Amazon CodeWhisperer","CODE_GEN","LOW",{isEnterprise:!0}),l("phind.com","Phind","CODE_GEN","MEDIUM"),l("continue.dev","Continue","CODE_GEN","MEDIUM"),l("askcodi.com","AskCodi","CODE_GEN","MEDIUM"),l("sourcegraph.com","Sourcegraph Cody","CODE_GEN","MEDIUM"),l("windsurf.ai","Windsurf","CODE_GEN","MEDIUM"),l("v0.dev","Vercel v0","CODE_GEN","MEDIUM"),l("bolt.new","Bolt","CODE_GEN","HIGH"),l("lovable.dev","Lovable","CODE_GEN","HIGH"),l("aider.chat","Aider","CODE_GEN","MEDIUM"),l("cody.dev","Cody","CODE_GEN","MEDIUM"),l("blackbox.ai","Blackbox AI","CODE_GEN","HIGH"),l("deepcode.ai","DeepCode","CODE_GEN","MEDIUM"),l("codiga.io","Codiga","CODE_GEN","MEDIUM"),l("mutable.ai","Mutable AI","CODE_GEN","MEDIUM"),l("pieces.app","Pieces","CODE_GEN","MEDIUM"),l("codium.ai","CodiumAI","CODE_GEN","MEDIUM"),l("coderabbit.ai","CodeRabbit","CODE_GEN","MEDIUM"),l("devin.ai","Devin","CODE_GEN","HIGH"),l("idx.dev","Project IDX","CODE_GEN","MEDIUM"),l("stackblitz.com","StackBlitz","CODE_GEN","MEDIUM"),l("codepen.io","CodePen AI","CODE_GEN","MEDIUM"),l("codesandbox.io","CodeSandbox AI","CODE_GEN","MEDIUM"),l("gitpod.io","Gitpod","CODE_GEN","MEDIUM"),l("poe.com","Poe","CHATBOT","MEDIUM"),l("character.ai","Character.AI","CHATBOT","MEDIUM"),l("beta.character.ai","Character.AI Beta","CHATBOT","MEDIUM"),l("huggingface.co/chat","HuggingChat","CHATBOT","MEDIUM"),l("pi.ai","Pi","CHATBOT","LOW"),l("chat.mistral.ai","Mistral Chat","CHATBOT","MEDIUM"),l("chat.deepseek.com","DeepSeek Chat","CHATBOT","HIGH"),l("deepseek.com","DeepSeek","CHATBOT","HIGH"),l("groq.com","Groq","CHATBOT","MEDIUM"),l("console.groq.com","Groq Console","CHATBOT","MEDIUM"),l("cohere.com","Cohere","CHATBOT","MEDIUM"),l("coral.cohere.com","Cohere Coral","CHATBOT","MEDIUM"),l("inflection.ai","Inflection","CHATBOT","MEDIUM"),l("chat.lmsys.org","LMSYS Chatbot Arena","CHATBOT","HIGH"),l("open-assistant.io","Open Assistant","CHATBOT","MEDIUM"),l("bard.google.com","Google Bard","CHATBOT","MEDIUM"),l("copilot.microsoft.com","Microsoft Copilot","CHATBOT","LOW",{isEnterprise:!0}),l("bing.com/chat","Bing Chat","CHATBOT","MEDIUM"),l("meta.ai","Meta AI","CHATBOT","MEDIUM"),l("labs.perplexity.ai","Perplexity Labs","CHATBOT","MEDIUM"),l("together.ai","Together AI","CHATBOT","MEDIUM"),l("api.together.xyz","Together API","CHATBOT","MEDIUM"),l("fireworks.ai","Fireworks AI","CHATBOT","MEDIUM"),l("anyscale.com","Anyscale","CHATBOT","MEDIUM"),l("replicate.com","Replicate","CHATBOT","MEDIUM"),l("lepton.ai","Lepton AI","CHATBOT","MEDIUM"),l("forefront.ai","Forefront","CHATBOT","MEDIUM"),l("chat.vercel.ai","Vercel AI Chat","CHATBOT","MEDIUM"),l("llama.meta.com","Llama","CHATBOT","MEDIUM"),l("grok.com","Grok","CHATBOT","HIGH"),l("grok.x.ai","Grok","CHATBOT","MEDIUM"),l("x.ai","xAI","CHATBOT","MEDIUM"),l("duckduckgo.com/aichat","DuckDuckGo AI Chat","CHATBOT","LOW"),l("chatglm.cn","ChatGLM","CHATBOT","HIGH"),l("yiyan.baidu.com","Ernie Bot","CHATBOT","HIGH"),l("qianwen.aliyun.com","Qwen","CHATBOT","HIGH"),l("abacus.ai","Abacus AI","CHATBOT","MEDIUM"),l("midjourney.com","Midjourney","IMAGE_GEN","MEDIUM"),l("discord.com/channels/midjourney","Midjourney Discord","IMAGE_GEN","MEDIUM"),l("openai.com/dall-e","DALL-E","IMAGE_GEN","MEDIUM"),l("labs.openai.com","DALL-E Labs","IMAGE_GEN","MEDIUM"),l("stability.ai","Stable Diffusion","IMAGE_GEN","MEDIUM"),l("dreamstudio.ai","DreamStudio","IMAGE_GEN","MEDIUM"),l("leonardo.ai","Leonardo.ai","IMAGE_GEN","MEDIUM"),l("app.leonardo.ai","Leonardo.ai App","IMAGE_GEN","MEDIUM"),l("ideogram.ai","Ideogram","IMAGE_GEN","MEDIUM"),l("firefly.adobe.com","Adobe Firefly","IMAGE_GEN","LOW",{isEnterprise:!0}),l("clipdrop.co","ClipDrop","IMAGE_GEN","MEDIUM"),l("playground.ai","Playground AI","IMAGE_GEN","MEDIUM"),l("nightcafe.studio","NightCafe","IMAGE_GEN","MEDIUM"),l("creator.nightcafe.studio","NightCafe Creator","IMAGE_GEN","MEDIUM"),l("runwayml.com","Runway","IMAGE_GEN","MEDIUM"),l("app.runwayml.com","Runway App","IMAGE_GEN","MEDIUM"),l("canva.com/ai-image-generator","Canva AI","IMAGE_GEN","LOW"),l("imagine.meta.com","Meta Imagine","IMAGE_GEN","MEDIUM"),l("pika.art","Pika","IMAGE_GEN","MEDIUM"),l("kaiber.ai","Kaiber","IMAGE_GEN","MEDIUM"),l("bing.com/images/create","Bing Image Creator","IMAGE_GEN","MEDIUM"),l("designer.microsoft.com","Microsoft Designer","IMAGE_GEN","MEDIUM"),l("craiyon.com","Craiyon","IMAGE_GEN","LOW"),l("starryai.com","StarryAI","IMAGE_GEN","LOW"),l("hotpot.ai","Hotpot AI","IMAGE_GEN","LOW"),l("lexica.art","Lexica","IMAGE_GEN","LOW"),l("jasper.ai","Jasper","WRITING","MEDIUM"),l("app.jasper.ai","Jasper App","WRITING","MEDIUM"),l("copy.ai","Copy.ai","WRITING","MEDIUM"),l("app.copy.ai","Copy.ai App","WRITING","MEDIUM"),l("writesonic.com","Writesonic","WRITING","MEDIUM"),l("app.writesonic.com","Writesonic App","WRITING","MEDIUM"),l("grammarly.com","Grammarly AI","WRITING","MEDIUM"),l("app.grammarly.com","Grammarly App","WRITING","MEDIUM"),l("notion.so","Notion AI","WRITING","MEDIUM"),l("quillbot.com","QuillBot","WRITING","MEDIUM"),l("wordtune.com","Wordtune","WRITING","MEDIUM"),l("rytr.me","Rytr","WRITING","MEDIUM"),l("anyword.com","Anyword","WRITING","MEDIUM"),l("hyperwriteai.com","HyperWrite","WRITING","MEDIUM"),l("writer.com","Writer","WRITING","MEDIUM",{isEnterprise:!0}),l("textcortex.com","TextCortex","WRITING","MEDIUM"),l("app.textcortex.com","TextCortex App","WRITING","MEDIUM"),l("peppertype.ai","Peppertype","WRITING","MEDIUM"),l("simplified.com","Simplified AI","WRITING","MEDIUM"),l("contentbot.ai","ContentBot","WRITING","MEDIUM"),l("ink.co","INK Editor","WRITING","MEDIUM"),l("sudowrite.com","Sudowrite","WRITING","MEDIUM"),l("novelai.net","NovelAI","WRITING","LOW"),l("shortlyai.com","ShortlyAI","WRITING","MEDIUM"),l("lex.page","Lex","WRITING","MEDIUM"),l("julius.ai","Julius","DATA_ANALYSIS","HIGH"),l("hex.tech","Hex","DATA_ANALYSIS","HIGH"),l("app.hex.tech","Hex App","DATA_ANALYSIS","HIGH"),l("obviously.ai","Obviously AI","DATA_ANALYSIS","HIGH"),l("akkio.com","Akkio","DATA_ANALYSIS","HIGH"),l("monkeylearn.com","MonkeyLearn","DATA_ANALYSIS","HIGH"),l("rows.com","Rows","DATA_ANALYSIS","MEDIUM"),l("breadcrumbs.io","Breadcrumbs","DATA_ANALYSIS","MEDIUM"),l("polymer.co","Polymer","DATA_ANALYSIS","HIGH"),l("databricks.com","Databricks AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("datarobot.com","DataRobot","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("h2o.ai","H2O.ai","DATA_ANALYSIS","MEDIUM"),l("rapidminer.com","RapidMiner","DATA_ANALYSIS","MEDIUM"),l("knime.com","KNIME","DATA_ANALYSIS","MEDIUM"),l("alteryx.com","Alteryx","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("tableau.com","Tableau AI","DATA_ANALYSIS","LOW",{isEnterprise:!0}),l("mode.com","Mode Analytics","DATA_ANALYSIS","MEDIUM"),l("deepnote.com","Deepnote","DATA_ANALYSIS","HIGH"),l("observable.com","Observable","DATA_ANALYSIS","MEDIUM"),l("noteable.io","Noteable","DATA_ANALYSIS","HIGH"),l("perplexity.ai","Perplexity Search","SEARCH","MEDIUM"),l("you.com","You.com Search","SEARCH","MEDIUM"),l("andi.ai","Andi","SEARCH","LOW"),l("kagi.com","Kagi","SEARCH","LOW"),l("metaphor.systems","Metaphor","SEARCH","MEDIUM"),l("exa.ai","Exa","SEARCH","MEDIUM"),l("tavily.com","Tavily","SEARCH","MEDIUM"),l("consensus.app","Consensus","SEARCH","LOW"),l("elicit.com","Elicit","SEARCH","MEDIUM"),l("elicit.org","Elicit","SEARCH","MEDIUM"),l("searchgpt.com","SearchGPT","SEARCH","MEDIUM"),l("brave.com/search/ai","Brave AI Search","SEARCH","LOW"),l("neeva.com","Neeva","SEARCH","LOW"),l("socratic.org","Socratic","SEARCH","LOW"),l("devv.ai","Devv AI","SEARCH","MEDIUM"),l("iask.ai","iAsk AI","SEARCH","LOW"),l("chatpdf.com","ChatPDF","SEARCH","MEDIUM"),l("smodin.io","Smodin","WRITING","MEDIUM"),l("ai-writer.com","AI Writer","WRITING","MEDIUM"),l("scalenut.com","Scalenut","WRITING","MEDIUM"),l("closerscopy.com","ClosersCopy","WRITING","MEDIUM"),l("longshot.ai","LongShot AI","WRITING","MEDIUM"),l("fig.io","Fig AI","CODE_GEN","MEDIUM"),l("warp.dev","Warp Terminal AI","CODE_GEN","MEDIUM"),l("raycast.com","Raycast AI","CODE_GEN","MEDIUM"),l("app.codeanywhere.com","Codeanywhere AI","CODE_GEN","MEDIUM"),l("zed.dev","Zed AI","CODE_GEN","MEDIUM"),l("gencraft.com","Gencraft","IMAGE_GEN","LOW"),l("deepai.org","DeepAI","IMAGE_GEN","LOW"),l("artbreeder.com","Artbreeder","IMAGE_GEN","LOW"),l("fotor.com/ai","Fotor AI","IMAGE_GEN","LOW"),l("remove.bg","Remove.bg","IMAGE_GEN","LOW"),l("photoroom.com","PhotoRoom AI","IMAGE_GEN","LOW"),l("app.recraft.ai","Recraft AI","IMAGE_GEN","MEDIUM"),l("pecan.ai","Pecan AI","DATA_ANALYSIS","HIGH"),l("apteo.co","Apteo","DATA_ANALYSIS","HIGH"),l("mindsdb.com","MindsDB","DATA_ANALYSIS","MEDIUM"),l("zapier.com/ai","Zapier AI","OTHER","MEDIUM"),l("make.com","Make (Integromat) AI","OTHER","MEDIUM"),l("otter.ai","Otter.ai","OTHER","HIGH"),l("fireflies.ai","Fireflies.ai","OTHER","HIGH"),l("descript.com","Descript","OTHER","MEDIUM"),l("synthesia.io","Synthesia","OTHER","MEDIUM"),l("elevenlabs.io","ElevenLabs","OTHER","MEDIUM"),l("murf.ai","Murf AI","OTHER","MEDIUM"),l("resemble.ai","Resemble AI","OTHER","MEDIUM"),l("loom.com","Loom AI","OTHER","MEDIUM"),l("beautiful.ai","Beautiful.ai","OTHER","LOW"),l("gamma.app","Gamma","OTHER","MEDIUM"),l("tome.app","Tome","OTHER","MEDIUM"),l("magician.design","Magician","OTHER","MEDIUM"),l("uizard.io","Uizard","OTHER","MEDIUM"),l("huggingface.co/spaces","HuggingFace Spaces","OTHER","MEDIUM"),l("roboflow.com","Roboflow","OTHER","MEDIUM"),l("scale.com","Scale AI","OTHER","MEDIUM"),l("labelbox.com","Labelbox","OTHER","MEDIUM")],td=new Set(It.map(e=>e.domain.toLowerCase())),Je=new Map;for(let e of It){let t=e.domain.toLowerCase();Je.has(t)||Je.set(t,e)}function xa(e){try{return e.includes("://")||(e="https://"+e),new URL(e).hostname.toLowerCase()}catch{return null}}function Pr(e){let t=xa(e);if(!t)return null;let n=Je.get(t);if(n)return n;try{let o=new URL(e.includes("://")?e:"https://"+e),s=(o.hostname+o.pathname).toLowerCase().replace(/\/+$/,""),a=Je.get(s);if(a)return a}catch{}let r=t.split(".");for(let o=1;o<r.length-1;o++){let s=r.slice(o).join("."),a=Je.get(s);if(a)return a}return null}function wa(e){return Pr(e)!==null}var ka=new Set(["replit.com","sourcegraph.com","idx.dev","stackblitz.com","codepen.io","codesandbox.io","gitpod.io","fig.io","warp.dev","raycast.com","app.codeanywhere.com","zed.dev","anyscale.com","grammarly.com","notion.so","hex.tech","app.hex.tech","rows.com","breadcrumbs.io","databricks.com","datarobot.com","h2o.ai","rapidminer.com","knime.com","alteryx.com","tableau.com","mode.com","deepnote.com","observable.com","noteable.io","mindsdb.com","kagi.com","make.com","loom.com","roboflow.com","scale.com","labelbox.com"]),Aa=["redaktyn.com"];function Ur(){let e=new Set;for(let t of It){let n=t.domain.toLowerCase();n.includes("/")||ka.has(n)||e.add(n)}for(let t of Aa)e.add(t.toLowerCase());return Array.from(e).sort()}var yn=null;function gn(e){yn||(yn=new Set(Ur()));let t=e.toLowerCase();for(let n of yn)if(t===n||t.endsWith(`.${n}`))return!0;return!1}function Sa(e){let t=e.toLowerCase();return[`*://${t}/*`,`*://*.${t}/*`]}function bn(e){let t=e.trim().toLowerCase();return!t||(t=t.replace(/^[a-z][a-z0-9+.-]*:\/\//,""),t=t.split(/[/?#]/)[0],t=t.split("@").pop(),t=t.split(":")[0],!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/.test(t))?null:t}var ie=Ks(require("node:crypto"),1),Se=ie&&typeof ie=="object"&&"webcrypto"in ie?ie.webcrypto:ie&&typeof ie=="object"&&"randomBytes"in ie?ie:void 0;function re(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name==="Uint8Array"}function q(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("positive integer expected, got "+e)}function L(e,...t){if(!re(e))throw new Error("Uint8Array expected");if(t.length>0&&!t.includes(e.length))throw new Error("Uint8Array expected of length "+t+", got length="+e.length)}function Ie(e){if(typeof e!="function"||typeof e.create!="function")throw new Error("Hash should be wrapped by utils.createHasher");q(e.outputLen),q(e.blockLen)}function Ue(e,t=!0){if(e.destroyed)throw new Error("Hash instance has been destroyed");if(t&&e.finished)throw new Error("Hash#digest() has already been called")}function Br(e,t){L(e);let n=t.outputLen;if(e.length<n)throw new Error("digestInto() expects output buffer of length at least "+n)}function $(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Le(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}function J(e,t){return e<<32-t|e>>>t}var Nr=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",Ia=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,"0"));function V(e){if(L(e),Nr)return e.toHex();let t="";for(let n=0;n<e.length;n++)t+=Ia[e[n]];return t}var ce={_0:48,_9:57,A:65,F:70,a:97,f:102};function Lr(e){if(e>=ce._0&&e<=ce._9)return e-ce._0;if(e>=ce.A&&e<=ce.F)return e-(ce.A-10);if(e>=ce.a&&e<=ce.f)return e-(ce.a-10)}function Q(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);if(Nr)return Uint8Array.fromHex(e);let t=e.length,n=t/2;if(t%2)throw new Error("hex string expected, got unpadded hex of length "+t);let r=new Uint8Array(n);for(let o=0,s=0;o<n;o++,s+=2){let a=Lr(e.charCodeAt(s)),c=Lr(e.charCodeAt(s+1));if(a===void 0||c===void 0){let i=e[s]+e[s+1];throw new Error('hex string expected, got non-hex character "'+i+'" at index '+s)}r[o]=a*16+c}return r}var va=async()=>{};async function Hr(e,t,n){let r=Date.now();for(let o=0;o<e;o++){n(o);let s=Date.now()-r;s>=0&&s<t||(await va(),r+=s)}}function C(e){if(typeof e!="string")throw new Error("string expected");return new Uint8Array(new TextEncoder().encode(e))}function ye(e){return typeof e=="string"&&(e=C(e)),L(e),e}function En(e){return typeof e=="string"&&(e=C(e)),L(e),e}function B(...e){let t=0;for(let r=0;r<e.length;r++){let o=e[r];L(o),t+=o.length}let n=new Uint8Array(t);for(let r=0,o=0;r<e.length;r++){let s=e[r];n.set(s,o),o+=s.length}return n}function Gr(e,t){if(t!==void 0&&{}.toString.call(t)!=="[object Object]")throw new Error("options should be object or undefined");return Object.assign(e,t)}var Pe=class{};function xn(e){let t=r=>e().update(ye(r)).digest(),n=e();return t.outputLen=n.outputLen,t.blockLen=n.blockLen,t.create=()=>e(),t}function Be(e=32){if(Se&&typeof Se.getRandomValues=="function")return Se.getRandomValues(new Uint8Array(e));if(Se&&typeof Se.randomBytes=="function")return Uint8Array.from(Se.randomBytes(e));throw new Error("crypto.getRandomValues must be defined")}var vt=class extends Pe{constructor(t,n){super(),this.finished=!1,this.destroyed=!1,Ie(t);let r=ye(n);if(this.iHash=t.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let o=this.blockLen,s=new Uint8Array(o);s.set(r.length>o?t.create().update(r).digest():r);for(let a=0;a<s.length;a++)s[a]^=54;this.iHash.update(s),this.oHash=t.create();for(let a=0;a<s.length;a++)s[a]^=106;this.oHash.update(s),$(s)}update(t){return Ue(this),this.iHash.update(t),this}digestInto(t){Ue(this),L(t,this.outputLen),this.finished=!0,this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let t=new Uint8Array(this.oHash.outputLen);return this.digestInto(t),t}_cloneInto(t){t||(t=Object.create(Object.getPrototypeOf(this),{}));let{oHash:n,iHash:r,finished:o,destroyed:s,blockLen:a,outputLen:c}=this;return t=t,t.finished=o,t.destroyed=s,t.blockLen=a,t.outputLen=c,t.oHash=n._cloneInto(t.oHash),t.iHash=r._cloneInto(t.iHash),t}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},ee=(e,t,n)=>new vt(e,t).update(n).digest();ee.create=(e,t)=>new vt(e,t);function Ra(e,t,n,r){if(typeof e.setBigUint64=="function")return e.setBigUint64(t,n,r);let o=BigInt(32),s=BigInt(4294967295),a=Number(n>>o&s),c=Number(n&s),i=r?4:0,f=r?0:4;e.setUint32(t+i,a,r),e.setUint32(t+f,c,r)}function Fr(e,t,n){return e&t^~e&n}function Wr(e,t,n){return e&t^e&n^t&n}var Qe=class extends Pe{constructor(t,n,r,o){super(),this.finished=!1,this.length=0,this.pos=0,this.destroyed=!1,this.blockLen=t,this.outputLen=n,this.padOffset=r,this.isLE=o,this.buffer=new Uint8Array(t),this.view=Le(this.buffer)}update(t){Ue(this),t=ye(t),L(t);let{view:n,buffer:r,blockLen:o}=this,s=t.length;for(let a=0;a<s;){let c=Math.min(o-this.pos,s-a);if(c===o){let i=Le(t);for(;o<=s-a;a+=o)this.process(i,a);continue}r.set(t.subarray(a,a+c),this.pos),this.pos+=c,a+=c,this.pos===o&&(this.process(n,0),this.pos=0)}return this.length+=t.length,this.roundClean(),this}digestInto(t){Ue(this),Br(t,this),this.finished=!0;let{buffer:n,view:r,blockLen:o,isLE:s}=this,{pos:a}=this;n[a++]=128,$(this.buffer.subarray(a)),this.padOffset>o-a&&(this.process(r,0),a=0);for(let p=a;p<o;p++)n[p]=0;Ra(r,o-8,BigInt(this.length*8),s),this.process(r,0);let c=Le(t),i=this.outputLen;if(i%4)throw new Error("_sha2: outputLen should be aligned to 32bit");let f=i/4,d=this.get();if(f>d.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<f;p++)c.setUint32(4*p,d[p],s)}digest(){let{buffer:t,outputLen:n}=this;this.digestInto(t);let r=t.slice(0,n);return this.destroy(),r}_cloneInto(t){t||(t=new this.constructor),t.set(...this.get());let{blockLen:n,buffer:r,length:o,finished:s,destroyed:a,pos:c}=this;return t.destroyed=a,t.finished=s,t.length=o,t.pos=c,o%n&&t.buffer.set(r),t}clone(){return this._cloneInto()}},le=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var G=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]);var Rt=BigInt(4294967295),Vr=BigInt(32);function Ta(e,t=!1){return t?{h:Number(e&Rt),l:Number(e>>Vr&Rt)}:{h:Number(e>>Vr&Rt)|0,l:Number(e&Rt)|0}}function Kr(e,t=!1){let n=e.length,r=new Uint32Array(n),o=new Uint32Array(n);for(let s=0;s<n;s++){let{h:a,l:c}=Ta(e[s],t);[r[s],o[s]]=[a,c]}return[r,o]}var wn=(e,t,n)=>e>>>n,kn=(e,t,n)=>e<<32-n|t>>>n,ve=(e,t,n)=>e>>>n|t<<32-n,Re=(e,t,n)=>e<<32-n|t>>>n,et=(e,t,n)=>e<<64-n|t>>>n-32,tt=(e,t,n)=>e>>>n-32|t<<64-n;function oe(e,t,n,r){let o=(t>>>0)+(r>>>0);return{h:e+n+(o/2**32|0)|0,l:o|0}}var jr=(e,t,n)=>(e>>>0)+(t>>>0)+(n>>>0),$r=(e,t,n,r)=>t+n+r+(e/2**32|0)|0,zr=(e,t,n,r)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0),qr=(e,t,n,r,o)=>t+n+r+o+(e/2**32|0)|0,Yr=(e,t,n,r,o)=>(e>>>0)+(t>>>0)+(n>>>0)+(r>>>0)+(o>>>0),Zr=(e,t,n,r,o,s)=>t+n+r+o+s+(e/2**32|0)|0;var Ca=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),ge=new Uint32Array(64),Tt=class extends Qe{constructor(t=32){super(64,t,8,!1),this.A=le[0]|0,this.B=le[1]|0,this.C=le[2]|0,this.D=le[3]|0,this.E=le[4]|0,this.F=le[5]|0,this.G=le[6]|0,this.H=le[7]|0}get(){let{A:t,B:n,C:r,D:o,E:s,F:a,G:c,H:i}=this;return[t,n,r,o,s,a,c,i]}set(t,n,r,o,s,a,c,i){this.A=t|0,this.B=n|0,this.C=r|0,this.D=o|0,this.E=s|0,this.F=a|0,this.G=c|0,this.H=i|0}process(t,n){for(let p=0;p<16;p++,n+=4)ge[p]=t.getUint32(n,!1);for(let p=16;p<64;p++){let u=ge[p-15],h=ge[p-2],m=J(u,7)^J(u,18)^u>>>3,g=J(h,17)^J(h,19)^h>>>10;ge[p]=g+ge[p-7]+m+ge[p-16]|0}let{A:r,B:o,C:s,D:a,E:c,F:i,G:f,H:d}=this;for(let p=0;p<64;p++){let u=J(c,6)^J(c,11)^J(c,25),h=d+u+Fr(c,i,f)+Ca[p]+ge[p]|0,g=(J(r,2)^J(r,13)^J(r,22))+Wr(r,o,s)|0;d=f,f=i,i=c,c=a+h|0,a=s,s=o,o=r,r=h+g|0}r=r+this.A|0,o=o+this.B|0,s=s+this.C|0,a=a+this.D|0,c=c+this.E|0,i=i+this.F|0,f=f+this.G|0,d=d+this.H|0,this.set(r,o,s,a,c,i,f,d)}roundClean(){$(ge)}destroy(){this.set(0,0,0,0,0,0,0,0),$(this.buffer)}};var Xr=Kr(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(e=>BigInt(e))),Oa=Xr[0],Ma=Xr[1],be=new Uint32Array(80),Ee=new Uint32Array(80),_t=class extends Qe{constructor(t=64){super(128,t,16,!1),this.Ah=G[0]|0,this.Al=G[1]|0,this.Bh=G[2]|0,this.Bl=G[3]|0,this.Ch=G[4]|0,this.Cl=G[5]|0,this.Dh=G[6]|0,this.Dl=G[7]|0,this.Eh=G[8]|0,this.El=G[9]|0,this.Fh=G[10]|0,this.Fl=G[11]|0,this.Gh=G[12]|0,this.Gl=G[13]|0,this.Hh=G[14]|0,this.Hl=G[15]|0}get(){let{Ah:t,Al:n,Bh:r,Bl:o,Ch:s,Cl:a,Dh:c,Dl:i,Eh:f,El:d,Fh:p,Fl:u,Gh:h,Gl:m,Hh:g,Hl:E}=this;return[t,n,r,o,s,a,c,i,f,d,p,u,h,m,g,E]}set(t,n,r,o,s,a,c,i,f,d,p,u,h,m,g,E){this.Ah=t|0,this.Al=n|0,this.Bh=r|0,this.Bl=o|0,this.Ch=s|0,this.Cl=a|0,this.Dh=c|0,this.Dl=i|0,this.Eh=f|0,this.El=d|0,this.Fh=p|0,this.Fl=u|0,this.Gh=h|0,this.Gl=m|0,this.Hh=g|0,this.Hl=E|0}process(t,n){for(let b=0;b<16;b++,n+=4)be[b]=t.getUint32(n),Ee[b]=t.getUint32(n+=4);for(let b=16;b<80;b++){let I=be[b-15]|0,R=Ee[b-15]|0,D=ve(I,R,1)^ve(I,R,8)^wn(I,R,7),P=Re(I,R,1)^Re(I,R,8)^kn(I,R,7),v=be[b-2]|0,x=Ee[b-2]|0,k=ve(v,x,19)^et(v,x,61)^wn(v,x,6),S=Re(v,x,19)^tt(v,x,61)^kn(v,x,6),T=zr(P,S,Ee[b-7],Ee[b-16]),O=qr(T,D,k,be[b-7],be[b-16]);be[b]=O|0,Ee[b]=T|0}let{Ah:r,Al:o,Bh:s,Bl:a,Ch:c,Cl:i,Dh:f,Dl:d,Eh:p,El:u,Fh:h,Fl:m,Gh:g,Gl:E,Hh:y,Hl:w}=this;for(let b=0;b<80;b++){let I=ve(p,u,14)^ve(p,u,18)^et(p,u,41),R=Re(p,u,14)^Re(p,u,18)^tt(p,u,41),D=p&h^~p&g,P=u&m^~u&E,v=Yr(w,R,P,Ma[b],Ee[b]),x=Zr(v,y,I,D,Oa[b],be[b]),k=v|0,S=ve(r,o,28)^et(r,o,34)^et(r,o,39),T=Re(r,o,28)^tt(r,o,34)^tt(r,o,39),O=r&s^r&c^s&c,_=o&a^o&i^a&i;y=g|0,w=E|0,g=h|0,E=m|0,h=p|0,m=u|0,{h:p,l:u}=oe(f|0,d|0,x|0,k|0),f=c|0,d=i|0,c=s|0,i=a|0,s=r|0,a=o|0;let U=jr(k,T,_);r=$r(U,x,S,O),o=U|0}({h:r,l:o}=oe(this.Ah|0,this.Al|0,r|0,o|0)),{h:s,l:a}=oe(this.Bh|0,this.Bl|0,s|0,a|0),{h:c,l:i}=oe(this.Ch|0,this.Cl|0,c|0,i|0),{h:f,l:d}=oe(this.Dh|0,this.Dl|0,f|0,d|0),{h:p,l:u}=oe(this.Eh|0,this.El|0,p|0,u|0),{h,l:m}=oe(this.Fh|0,this.Fl|0,h|0,m|0),{h:g,l:E}=oe(this.Gh|0,this.Gl|0,g|0,E|0),{h:y,l:w}=oe(this.Hh|0,this.Hl|0,y|0,w|0),this.set(r,o,s,a,c,i,f,d,p,u,h,m,g,E,y,w)}roundClean(){$(be,Ee)}destroy(){$(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}};var Jr=xn(()=>new Tt);var Ne=xn(()=>new _t);var z=Jr;function Da(e,t,n,r){Ie(e);let o=Gr({dkLen:32,asyncTick:10},r),{c:s,dkLen:a,asyncTick:c}=o;if(q(s),q(a),q(c),s<1)throw new Error("iterations (c) should be >= 1");let i=En(t),f=En(n),d=new Uint8Array(a),p=ee.create(e,i),u=p._cloneInto().update(f);return{c:s,dkLen:a,asyncTick:c,DK:d,PRF:p,PRFSalt:u}}function Pa(e,t,n,r,o){return e.destroy(),t.destroy(),r&&r.destroy(),$(o),n}async function Ct(e,t,n,r){let{c:o,dkLen:s,asyncTick:a,DK:c,PRF:i,PRFSalt:f}=Da(e,t,n,r),d,p=new Uint8Array(4),u=Le(p),h=new Uint8Array(i.outputLen);for(let m=1,g=0;g<s;m++,g+=i.outputLen){let E=c.subarray(g,g+i.outputLen);u.setInt32(0,m,!1),(d=f._cloneInto(d)).update(p).digestInto(h),E.set(h.subarray(0,E.length)),await Hr(o-1,a,()=>{i._cloneInto(d).update(h).digestInto(h);for(let y=0;y<E.length;y++)E[y]^=h[y]})}return Pa(i,f,c,d,h)}function Ua(e,t,n){return Ie(e),n===void 0&&(n=new Uint8Array(e.outputLen)),ee(e,ye(n),ye(t))}var An=Uint8Array.from([0]),Qr=Uint8Array.of();function La(e,t,n,r=32){Ie(e),q(r);let o=e.outputLen;if(r>255*o)throw new Error("Length should be <= 255*HashLen");let s=Math.ceil(r/o);n===void 0&&(n=Qr);let a=new Uint8Array(s*o),c=ee.create(e,t),i=c._cloneInto(),f=new Uint8Array(c.outputLen);for(let d=0;d<s;d++)An[0]=d+1,i.update(d===0?Qr:f).update(n).update(An).digestInto(f),a.set(f,o*d),c._cloneInto(i);return c.destroy(),i.destroy(),$(f,An),a.slice(0,r)}var nt=(e,t,n,r,o)=>La(e,Ua(e,t,n),r,o);var Ba=8,Na="hmac-sha256-v1",Ha="normalization-v1",Ga="normalization-v2",Fa="pbkdf2-sha256-600k-v2",eo=6e5,rt=eo,Sn=32,to="[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f-\\u0084\\u0086-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180f\\u200b-\\u200f\\u202a-\\u202e\\u2060-\\u2064\\u2066-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]",Wa=new RegExp(to,"g"),no="\\u001b(?:\\[[0-?]*[ -/]*[@-~]|\\][^\\u0007\\u001b]{0,512}(?:\\u0007|\\u001b\\\\))",Va=new RegExp(no,"g");function In(e){let t=e.includes("\x1B")?e.replace(Va,""):e;return t=t.normalize("NFC"),t=t.replace(/\r\n/g,`
2
2
  `).replace(/[\r\u2028\u2029]/g,`
3
- `),t=t.replace(Wa,""),t=t.trim(),t}function rt(e){if(e.length===36&&e[8]==="-"&&e[13]==="-"&&e[18]==="-"&&e[23]==="-"){let t=e.replace(/-/g,"");if(/^[0-9a-fA-F]{32}$/.test(t))return e.toLowerCase()}return e}function Ct(e){return rt(In(e))}function ot(e){return In(e).replace(/\s/g,"")}function Ka(e,t){return Ot(rt(ot(e)),t)}function He(e){return ot(e).toLowerCase()}function ja(e,t){return Ot(He(e),t)}function Ot(e,t){return V(ee(z,t,C(e)))}function $a(e,t){return Ot(Ct(e),t)}async function za(e,t){let n=C(e),r=z(C(t));return _t(z,n,r,{c:eo,dkLen:Sn})}var ro="redaktyn-project-key-v1",qa=C(ro);function Ya(e,t){if(e.length!==Sn)throw new Error("deriveProjectKey: org key must be 32 bytes");if(!t)throw new Error("deriveProjectKey: projectId is required");return tt(z,e,C(t),qa,Sn)}var oo="vaultx-passphrase-verify-v1",Za=C(oo);function vn(e){return V(ee(z,e,Za))}function Xa(){return crypto.getRandomValues(new Uint8Array(32))}function Ja(e){return V(e)}function Qa(e){return Q(e)}function Rn(e){return e.length<12?{ok:!1,error:"Passphrase must be at least 12 characters."}:/[A-Z]/.test(e)?/[a-z]/.test(e)?/[0-9]/.test(e)?/[^A-Za-z0-9]/.test(e)?{ok:!0}:{ok:!1,error:"Passphrase must include at least one special character (e.g. !@#$%)."}:{ok:!1,error:"Passphrase must include at least one number."}:{ok:!1,error:"Passphrase must include at least one lowercase letter."}:{ok:!1,error:"Passphrase must include at least one uppercase letter."}}var st=["password","passphrase","letmein","welcome","monkey","dragon","qwerty","qwertyuiop","asdfgh","zxcvbn","iloveyou","sunshine","princess","football","baseball","superman","batman","master","shadow","michael","jennifer","trustno","starwars","whatever","freedom","computer","internet","samsung","google","facebook","admin","administrator","root","changeme","secret","default","login","abc","test","temp","demo","company","corporate"];function Ge(e){return e.toLowerCase().replace(/[@4]/g,"a").replace(/[3]/g,"e").replace(/[1!|]/g,"i").replace(/[0]/g,"o").replace(/[5$]/g,"s").replace(/[7]/g,"t")}function ei(e){let t=e.toLowerCase();if(/^(.)\1+$/.test(t))return!0;let n=["abcdefghijklmnopqrstuvwxyz","0123456789","qwertyuiopasdfghjklzxcvbnm"],r=t.replace(/[^a-z0-9]/g,"");if(r.length>=6){for(let o of n)if(o.includes(r)||[...o].reverse().join("").includes(r))return!0}return!1}function at(e){let t=Rn(e);if(!t.ok)return t;let r=Ge(e).replace(/[^a-z]/g,"");for(let o of st)if(r===o||r.startsWith(o)||r.endsWith(o))return{ok:!1,error:"That passphrase is built on a word attackers try first, so it would fall to the first few guesses \u2014 pick something unrelated to a common word."};return ei(e)?{ok:!1,error:"That passphrase is a repeated character or a keyboard sequence. Pick something without a predictable pattern."}:new Set(e).size<8?{ok:!1,error:"That passphrase reuses too few distinct characters. Use at least eight different ones."}:{ok:!0}}var Mt=13,ti=`You are choosing the passphrase that protects every secret in this workspace. Every guess at it has to go through our server, which allows only a few at a time, but someone who took over our server could guess offline without that limit. Make it very strong: at least ${Mt} characters (20 or more is better), never used anywhere else, mixing upper and lower case, numbers and symbols through it rather than at the end. Nobody, including Redaktyn, can reset it.`,Dt=["redaktyn","workspace","summer","winter","spring","autumn","hello","love","money","office","user"],so=6,Pt=["abcdefghijklmnopqrstuvwxyz","1234567890","qwertyuiop","asdfghjkl","zxcvbnm"];function ni(e,t){let n=e.toLowerCase(),r=Pt.flatMap(o=>[o,[...o].reverse().join("")]);for(let o=0;o+t<=n.length;o++){let s=n.slice(o,o+t);if(r.some(a=>a.includes(s)))return!0}return!1}function Tn(e){if(e.length<Mt)return{ok:!1,error:`Your own passphrase must be at least ${Mt} characters. Longer is stronger: 20 or more is better.`};if(e!==e.trim())return{ok:!1,error:"The passphrase cannot start or end with a space. It is too easy to lose when you type it again."};if(/^[=+\-@]/.test(e))return{ok:!1,error:"The passphrase cannot start with =, +, - or @."};let t=Rn(e);if(!t.ok)return t;let n=Ge(e).replace(/[^a-z]/g,"");for(let o of[...st,...Dt])if(n.includes(o))return{ok:!1,error:`That passphrase contains "${o}" (or a look-alike), which attackers try first. Leave common words out entirely.`};if(/(.)\1\1/.test(e.toLowerCase()))return{ok:!1,error:"That passphrase repeats a character three times in a row."};if(ni(e,4))return{ok:!1,error:"That passphrase contains a sequence like abcd, 1234 or qwer. Leave predictable runs out."};if(/(^|\D)(19|20)\d\d(\D|$)/.test(e))return{ok:!1,error:"That passphrase contains what looks like a year. Dates are among the first things guessed."};let r=/^[A-Za-z]+([^A-Za-z]+)$/.exec(e)??/^([^A-Za-z]+)[A-Za-z]+$/.exec(e);return r&&r[1].length<so?{ok:!1,error:`That passphrase is letters with only a few numbers or symbols added at one end, the first pattern attackers try. Mix them through it, or add at least ${so}.`}:new Set(e).size<10?{ok:!1,error:"That passphrase reuses too few characters. Use at least ten different ones."}:{ok:!0}}var ao=64,ri=16,oi=7,si=8,ai=4,ii=10,ci=32,li=17,di=6,ui=20,fi=/(?<![0-9])(?:\+?91|0)?[6-9][0-9]{9}(?![0-9])/g,pi=[/(?<![0-9])(?:(?:0[1-9]|[12][0-9]|3[01])(?:0[1-9]|1[0-2])(?:19|20)[0-9]{2}|(?:19|20)[0-9]{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12][0-9]|3[01])|(?:0[1-9]|1[0-2])(?:0[1-9]|[12][0-9]|3[01])(?:19|20)[0-9]{2})(?![0-9])/g,/(?<![0-9])(?:0?[1-9]|[12][0-9]|3[01])[-/.](?:0?[1-9]|1[0-2])[-/.](?:19|20)[0-9]{2}(?![0-9])/g,/(?<![0-9])(?:19|20)[0-9]{2}[-/.](?:0?[1-9]|1[0-2])[-/.](?:0?[1-9]|[12][0-9]|3[01])(?![0-9])/g],hi=["amit","rahul","rohit","priya","neha","pooja","vikas","sunil","anil","sanjay","ajay","vijay","suresh","ramesh","mahesh","ravi","rajesh","deepak","manoj","arjun","karan","rohan","sachin","nitin","ankit","varun","vivek","kunal","mohit","gaurav","ashish","abhishek","sandeep","sumit","anita","sunita","kavita","anjali","divya","shweta","swati","meera","sneha","pankaj","naveen","naresh","harish","ganesh","kiran","tarun","aman","akash","manish","prakash","john","david","james","robert","daniel","thomas","chris","steve","peter","sarah","emma","linda","kevin","brian","jason","alex","ahmed","mohammed","ali","omar"],mi=["prod","production","staging","develop","database","postgres","mysql","mongo","redis","oracle","pass","pwd","token","access","server","service","backup","guest","manager","support","system","india","mumbai","delhi","bangalore","london","january","february","march","april","june","july","august","september","october","november","december","monday","friday","sunday","cricket","tiger",...hi],yi=[...new Set([...st,...Dt,...mi])].filter(e=>e.length>=3).sort((e,t)=>t.length-e.length);function gi(e){if(/^[0-9a-f]+$/.test(e))return 16;let t=0;return/[a-z]/.test(e)&&(t+=26),/[0-9]/.test(e)&&(t+=10),/[!-/:-@[-`{-~]/.test(e)&&(t+=33),/[^\x00-\x7f]/.test(e)&&(t+=100),Math.max(t,2)}function bi(e,t){let n=0,r=1;for(;t+r<e.length&&e[t+r]===e[t];)r++;r>=4&&(n=r);for(let o of Pt)for(let s of[o,[...o].reverse().join("")]){let a=0;for(;t+a<e.length&&s.includes(e.slice(t,t+a+1));)a++;a>=4&&a>n&&(n=a)}return n}function Ei(e){let t=new Set;for(let n of e??[])for(let r of String(n).toLowerCase().split(/[^a-z]+/))if(r.length>=3&&t.add(Ge(r)),t.size>=ui)return[...t];return[...t]}function xi(e,t={}){let n=He(e),r=Math.log2(gi(n)),o=Ge(n),s=new Array(n.length).fill(!1),a=[],c=0,i=(d,p,u,h)=>{for(let m=d;m<d+p;m++)if(s[m])return!1;for(let m=d;m<d+p;m++)s[m]=!0;return c+=Math.min(u,p*r),a.push(h),!0};for(let d of n.matchAll(fi))i(d.index,d[0].length,ci,"a mobile phone number");for(let d of pi)for(let p of n.matchAll(d))i(p.index,p[0].length,li,"a date");for(let d of Ei(t.knownWords))for(let p=o.indexOf(d);p>=0;p=o.indexOf(d,p+1))i(p,d.length,di,"a word from the person's own details")&&(p+=d.length-1);for(let d of yi)for(let p=o.indexOf(d);p>=0;p=o.indexOf(d,p+1))i(p,d.length,ri,`the word ${d}`)&&(p+=d.length-1);for(let d of n.matchAll(/(?:19|20)\d\d/g))i(d.index,4,oi,`the year ${d[0]}`);for(let d=0;d<n.length;d++){let p=s[d]?0:bi(n,d);p>=4&&i(d,p,si,`the run ${n.slice(d,d+p)}`)&&(d+=p-1)}let f=a.some(d=>d.startsWith("the word "));for(let d=0;d<n.length;){if(s[d]){d++;continue}let p=d;for(;p<n.length&&!s[p];)p++;let u=p-d;c+=f&&u<=ai?Math.min(ii,u*r):u*r,d=p}return{guessable:c<ao,bits:Math.floor(c),patterns:a}}function wi(e){return`This value could be found by guessing.${e.patterns.length>0?` It is built from ${e.patterns.slice(0,3).join(", ")}.`:" It is short."} Redaktyn keeps only its fingerprint, but anyone who copies the key off one of your team's devices can test guesses against that fingerprint very fast, and a value like this can be found that way. A long random value cannot. If you can, change it to a random one and register that. Registering this one still stops it being pasted.`}var ki="ABCDEFGHJKLMNPQRSTUVWXYZ",Ai="abcdefghijkmnpqrstuvwxyz",Si="23456789",Lt=ki+Ai+Si,io=5,_n=5,Ii=128;function vi(e){let t=256-256%e,n=new Uint8Array(1);for(;;){globalThis.crypto.getRandomValues(n);let r=n[0]??255;if(r<t)return r%e}}function Ri(){let e=[];for(let t=0;t<io;t++){let n="";for(let r=0;r<_n;r++)n+=Lt[vi(Lt.length)];e.push(n)}return e.join("-")}function Ti(){for(;;){let e=Ri();if(!(!/[A-Z]/.test(e)||!/[a-z]/.test(e)||!/[0-9]/.test(e))&&at(e).ok)return e}}function _i(e,t){return["Redaktyn workspace passphrase","",e,"",`Created ${t.toISOString().slice(0,10)}.`,"","This passphrase derives the key your workspace's fingerprints are made with.","Redaktyn never receives it, so nobody can reset it for you.","Move it into a password manager or a safe, then delete this file.",""].join(`
4
- `)}var Ut="Redaktyn workspace",Cn="https://passphrase.redaktyn.invalid/";function Ci(e){return`"${e.replace(/"/g,'""')}"`}function Oi(e){let t="Redaktyn workspace passphrase. Nobody can reset it. Delete this file after importing it.";for(let n of[Ut,Cn,e,t])if(/^[=+\-@\t\r]/.test(n))throw new Error("A password-manager file field cannot start with a formula character");return["name,url,username,password,note",[Ut,Cn,Ut,e,t].map(Ci).join(","),""].join(`
5
- `)}var co='A new workspace needs a generated passphrase here: a generated one cannot be guessed, and one a person makes up often can. Use "Generate" to create one.',Mi=new RegExp(`^[${Lt}]{${_n}}(?:-[${Lt}]{${_n}}){${io-1}}$`),Di=12;function On(e){if(!Mi.test(e))return!1;let t=e.replace(/-/g,"");return new Set(t).size>=Di}function Pi(e){return On(e)?at(e):{ok:!1,error:co}}function Ui(e){return On(e)?at(e):Tn(e)}function lo(e){return!e||typeof e!="object"?!1:e.version===2}function uo(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.encryptedKey=="string"&&t.encryptedKey.length>0&&typeof t.iv=="string"&&t.iv.length>0&&typeof t.salt=="string"&&t.salt.length>0}function Li(e){return lo(e)?e:uo(e)?{version:2,passphrase:e}:null}function it(e){let t=new ArrayBuffer(e.byteLength);return new Uint8Array(t).set(e),t}function Mn(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function Dn(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function fo(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}var Bt=32,Bi=256,Ni=12;function Hi(){return fo(Bt)}async function po(e){if(e.byteLength===0)throw new Error("PRF output is empty");let t=await crypto.subtle.digest("SHA-256",it(e));return crypto.subtle.importKey("raw",t,{name:"AES-GCM",length:Bi},!1,["encrypt","decrypt"])}async function Gi(e,t,n,r,o){if(e.byteLength!==32)throw new Error("HMAC key must be 32 bytes");if(t.byteLength!==Bt)throw new Error("PRF output must be 32 bytes");if(n.byteLength!==Bt)throw new Error("PRF salt must be 32 bytes");if(!r)throw new Error("credentialId is required");let s=await po(t),a=fo(Ni),c=await crypto.subtle.encrypt({name:"AES-GCM",iv:it(a)},s,it(e)),i={credentialId:r,prfSalt:Mn(n),iv:Mn(a),ciphertext:Mn(new Uint8Array(c)),createdAt:Date.now()};return o&&o.trim().length>0&&(i.label=o.trim().slice(0,64)),i}async function Fi(e,t){if(t.byteLength!==Bt)throw new Error("PRF output must be 32 bytes");let n=await po(t),r=Dn(e.iv),o=Dn(e.ciphertext),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:it(r)},n,it(o)),a=new Uint8Array(s);if(a.byteLength!==32)throw a.fill(0),new Error("Invalid HMAC key material");return a}function Wi(e){return Dn(e.prfSalt)}function Vi(e,t){let r=(e?.passkey??[]).filter(o=>o.credentialId!==t.credentialId);return{version:2,passphrase:e?.passphrase,passkey:[...r,t]}}function Ki(e,t){let n=e?.passkey??[];return{version:2,passphrase:e?.passphrase,passkey:n.filter(r=>r.credentialId!==t)}}function ji(e,t){return e?.passkey?.find(n=>n.credentialId===t)}var Ln=BigInt(0),Un=BigInt(1);function Nt(e,t=""){if(typeof e!="boolean"){let n=t&&`"${t}"`;throw new Error(n+"expected boolean, got type="+typeof e)}return e}function ct(e,t,n=""){let r=re(e),o=e?.length,s=t!==void 0;if(!r||s&&o!==t){let a=n&&`"${n}" `,c=s?` of length ${t}`:"",i=r?`length=${o}`:`type=${typeof e}`;throw new Error(a+"expected Uint8Array"+c+", got "+i)}return e}function Bn(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?Ln:BigInt("0x"+e)}function lt(e){return Bn(V(e))}function Y(e){return L(e),Bn(V(Uint8Array.from(e).reverse()))}function Fe(e,t){return Q(e.toString(16).padStart(t*2,"0"))}function Ht(e,t){return Fe(e,t).reverse()}function K(e,t,n){let r;if(typeof t=="string")try{r=Q(t)}catch(s){throw new Error(e+" must be hex string or Uint8Array, cause: "+s)}else if(re(t))r=Uint8Array.from(t);else throw new Error(e+" must be hex string or Uint8Array");let o=r.length;if(typeof n=="number"&&o!==n)throw new Error(e+" of length "+n+" expected, got "+o);return r}function Nn(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function Gt(e){return Uint8Array.from(e)}var Pn=e=>typeof e=="bigint"&&Ln<=e;function ho(e,t,n){return Pn(e)&&Pn(t)&&Pn(n)&&t<=e&&e<n}function Ft(e,t,n,r){if(!ho(t,n,r))throw new Error("expected valid "+e+": "+n+" <= n < "+r+", got "+t)}function Hn(e){let t;for(t=0;e>Ln;e>>=Un,t+=1);return t}var We=e=>(Un<<BigInt(e))-Un;function Ve(e,t,n={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function r(o,s,a){let c=e[o];if(a&&c===void 0)return;let i=typeof c;if(i!==s||c===null)throw new Error(`param "${o}" is invalid: expected ${s}, got ${i}`)}Object.entries(t).forEach(([o,s])=>r(o,s,!1)),Object.entries(n).forEach(([o,s])=>r(o,s,!0))}var Wt=()=>{throw new Error("not implemented")};function Vt(e){let t=new WeakMap;return(n,...r)=>{let o=t.get(n);if(o!==void 0)return o;let s=e(n,...r);return t.set(n,s),s}}var W=BigInt(0),N=BigInt(1),Te=BigInt(2),go=BigInt(3),bo=BigInt(4),Eo=BigInt(5),qi=BigInt(7),xo=BigInt(8),Yi=BigInt(9),wo=BigInt(16);function M(e,t){let n=e%t;return n>=W?n:t+n}function te(e,t,n){let r=e;for(;t-- >W;)r*=r,r%=n;return r}function mo(e,t){if(e===W)throw new Error("invert: expected non-zero number");if(t<=W)throw new Error("invert: expected positive modulus, got "+t);let n=M(e,t),r=t,o=W,s=N,a=N,c=W;for(;n!==W;){let f=r/n,d=r%n,p=o-a*f,u=s-c*f;r=n,n=d,o=a,s=c,a=p,c=u}if(r!==N)throw new Error("invert: does not exist");return M(o,t)}function Gn(e,t,n){if(!e.eql(e.sqr(t),n))throw new Error("Cannot find square root")}function ko(e,t){let n=(e.ORDER+N)/bo,r=e.pow(t,n);return Gn(e,r,t),r}function Zi(e,t){let n=(e.ORDER-Eo)/xo,r=e.mul(t,Te),o=e.pow(r,n),s=e.mul(t,o),a=e.mul(e.mul(s,Te),o),c=e.mul(s,e.sub(a,e.ONE));return Gn(e,c,t),c}function Xi(e){let t=ue(e),n=Ao(e),r=n(t,t.neg(t.ONE)),o=n(t,r),s=n(t,t.neg(r)),a=(e+qi)/wo;return(c,i)=>{let f=c.pow(i,a),d=c.mul(f,r),p=c.mul(f,o),u=c.mul(f,s),h=c.eql(c.sqr(d),i),m=c.eql(c.sqr(p),i);f=c.cmov(f,d,h),d=c.cmov(u,p,m);let g=c.eql(c.sqr(d),i),E=c.cmov(f,d,g);return Gn(c,E,i),E}}function Ao(e){if(e<go)throw new Error("sqrt is not defined for small field");let t=e-N,n=0;for(;t%Te===W;)t/=Te,n++;let r=Te,o=ue(e);for(;yo(o,r)===1;)if(r++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(n===1)return ko;let s=o.pow(r,t),a=(t+N)/Te;return function(i,f){if(i.is0(f))return f;if(yo(i,f)!==1)throw new Error("Cannot find square root");let d=n,p=i.mul(i.ONE,s),u=i.pow(f,t),h=i.pow(f,a);for(;!i.eql(u,i.ONE);){if(i.is0(u))return i.ZERO;let m=1,g=i.sqr(u);for(;!i.eql(g,i.ONE);)if(m++,g=i.sqr(g),m===d)throw new Error("Cannot find square root");let E=N<<BigInt(d-m-1),y=i.pow(p,E);d=m,p=i.sqr(y),u=i.mul(u,p),h=i.mul(h,y)}return h}}function Ji(e){return e%bo===go?ko:e%xo===Eo?Zi:e%wo===Yi?Xi(e):Ao(e)}var de=(e,t)=>(M(e,t)&N)===N,Qi=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function So(e){let t={ORDER:"bigint",MASK:"bigint",BYTES:"number",BITS:"number"},n=Qi.reduce((r,o)=>(r[o]="function",r),t);return Ve(e,n),e}function ec(e,t,n){if(n<W)throw new Error("invalid exponent, negatives unsupported");if(n===W)return e.ONE;if(n===N)return t;let r=e.ONE,o=t;for(;n>W;)n&N&&(r=e.mul(r,o)),o=e.sqr(o),n>>=N;return r}function Kt(e,t,n=!1){let r=new Array(t.length).fill(n?e.ZERO:void 0),o=t.reduce((a,c,i)=>e.is0(c)?a:(r[i]=a,e.mul(a,c)),e.ONE),s=e.inv(o);return t.reduceRight((a,c,i)=>e.is0(c)?a:(r[i]=e.mul(a,r[i]),e.mul(a,c)),s),r}function yo(e,t){let n=(e.ORDER-N)/Te,r=e.pow(t,n),o=e.eql(r,e.ONE),s=e.eql(r,e.ZERO),a=e.eql(r,e.neg(e.ONE));if(!o&&!s&&!a)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function Io(e,t){t!==void 0&&q(t);let n=t!==void 0?t:e.toString(2).length,r=Math.ceil(n/8);return{nBitLength:n,nByteLength:r}}function ue(e,t,n=!1,r={}){if(e<=W)throw new Error("invalid field: expected ORDER > 0, got "+e);let o,s,a=!1,c;if(typeof t=="object"&&t!=null){if(r.sqrt||n)throw new Error("cannot specify opts in two arguments");let u=t;u.BITS&&(o=u.BITS),u.sqrt&&(s=u.sqrt),typeof u.isLE=="boolean"&&(n=u.isLE),typeof u.modFromBytes=="boolean"&&(a=u.modFromBytes),c=u.allowedLengths}else typeof t=="number"&&(o=t),r.sqrt&&(s=r.sqrt);let{nBitLength:i,nByteLength:f}=Io(e,o);if(f>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");let d,p=Object.freeze({ORDER:e,isLE:n,BITS:i,BYTES:f,MASK:We(i),ZERO:W,ONE:N,allowedLengths:c,create:u=>M(u,e),isValid:u=>{if(typeof u!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof u);return W<=u&&u<e},is0:u=>u===W,isValidNot0:u=>!p.is0(u)&&p.isValid(u),isOdd:u=>(u&N)===N,neg:u=>M(-u,e),eql:(u,h)=>u===h,sqr:u=>M(u*u,e),add:(u,h)=>M(u+h,e),sub:(u,h)=>M(u-h,e),mul:(u,h)=>M(u*h,e),pow:(u,h)=>ec(p,u,h),div:(u,h)=>M(u*mo(h,e),e),sqrN:u=>u*u,addN:(u,h)=>u+h,subN:(u,h)=>u-h,mulN:(u,h)=>u*h,inv:u=>mo(u,e),sqrt:s||(u=>(d||(d=Ji(e)),d(p,u))),toBytes:u=>n?Ht(u,f):Fe(u,f),fromBytes:(u,h=!0)=>{if(c){if(!c.includes(u.length)||u.length>f)throw new Error("Field.fromBytes: expected "+c+" bytes, got "+u.length);let g=new Uint8Array(f);g.set(u,n?0:g.length-u.length),u=g}if(u.length!==f)throw new Error("Field.fromBytes: expected "+f+" bytes, got "+u.length);let m=n?Y(u):lt(u);if(a&&(m=M(m,e)),!h&&!p.isValid(m))throw new Error("invalid field element: outside of range 0..ORDER");return m},invertBatch:u=>Kt(p,u),cmov:(u,h,m)=>m?h:u});return Object.freeze(p)}function vo(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function Fn(e){let t=vo(e);return t+Math.ceil(t/2)}function Ro(e,t,n=!1){let r=e.length,o=vo(t),s=Fn(t);if(r<16||r<s||r>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+r);let a=n?Y(e):lt(e),c=M(a,t-N)+N;return n?Ht(c,o):Fe(c,o)}var jt=BigInt(0),jn=BigInt(1);function To(e,t){let n=t.negate();return e?n:t}function dt(e,t){let n=Kt(e.Fp,t.map(r=>r.Z));return t.map((r,o)=>e.fromAffine(r.toAffine(n[o])))}function Mo(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function Wn(e,t){Mo(e,t);let n=Math.ceil(t/e)+1,r=2**(e-1),o=2**e,s=We(e),a=BigInt(e);return{windows:n,windowSize:r,mask:s,maxNumber:o,shiftBy:a}}function _o(e,t,n){let{windowSize:r,mask:o,maxNumber:s,shiftBy:a}=n,c=Number(e&o),i=e>>a;c>r&&(c-=s,i+=jn);let f=t*r,d=f+Math.abs(c)-1,p=c===0,u=c<0,h=t%2!==0;return{nextN:i,offset:d,isZero:p,isNeg:u,isNegF:h,offsetF:f}}function nc(e,t){if(!Array.isArray(e))throw new Error("array expected");e.forEach((n,r)=>{if(!(n instanceof t))throw new Error("invalid point at index "+r)})}function rc(e,t){if(!Array.isArray(e))throw new Error("array of scalars expected");e.forEach((n,r)=>{if(!t.isValid(n))throw new Error("invalid scalar at index "+r)})}var Vn=new WeakMap,Do=new WeakMap;function Kn(e){return Do.get(e)||1}function Co(e){if(e!==jt)throw new Error("invalid wNAF")}var $t=class{constructor(t,n){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=n}_unsafeLadder(t,n,r=this.ZERO){let o=t;for(;n>jt;)n&jn&&(r=r.add(o)),o=o.double(),n>>=jn;return r}precomputeWindow(t,n){let{windows:r,windowSize:o}=Wn(n,this.bits),s=[],a=t,c=a;for(let i=0;i<r;i++){c=a,s.push(c);for(let f=1;f<o;f++)c=c.add(a),s.push(c);a=c.double()}return s}wNAF(t,n,r){if(!this.Fn.isValid(r))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,a=Wn(t,this.bits);for(let c=0;c<a.windows;c++){let{nextN:i,offset:f,isZero:d,isNeg:p,isNegF:u,offsetF:h}=_o(r,c,a);r=i,d?s=s.add(To(u,n[h])):o=o.add(To(p,n[f]))}return Co(r),{p:o,f:s}}wNAFUnsafe(t,n,r,o=this.ZERO){let s=Wn(t,this.bits);for(let a=0;a<s.windows&&r!==jt;a++){let{nextN:c,offset:i,isZero:f,isNeg:d}=_o(r,a,s);if(r=c,!f){let p=n[i];o=o.add(d?p.negate():p)}}return Co(r),o}getPrecomputes(t,n,r){let o=Vn.get(n);return o||(o=this.precomputeWindow(n,t),t!==1&&(typeof r=="function"&&(o=r(o)),Vn.set(n,o))),o}cached(t,n,r){let o=Kn(t);return this.wNAF(o,this.getPrecomputes(o,t,r),n)}unsafe(t,n,r,o){let s=Kn(t);return s===1?this._unsafeLadder(t,n,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,r),n,o)}createCache(t,n){Mo(n,this.bits),Do.set(t,n),Vn.delete(t)}hasCache(t){return Kn(t)!==1}};function zt(e,t,n,r){nc(n,e),rc(r,t);let o=n.length,s=r.length;if(o!==s)throw new Error("arrays of points and scalars must have equal length");let a=e.ZERO,c=Hn(BigInt(o)),i=1;c>12?i=c-3:c>4?i=c-2:c>0&&(i=2);let f=We(i),d=new Array(Number(f)+1).fill(a),p=Math.floor((t.BITS-1)/i)*i,u=a;for(let h=p;h>=0;h-=i){d.fill(a);for(let g=0;g<s;g++){let E=r[g],y=Number(E>>BigInt(h)&f);d[y]=d[y].add(n[g])}let m=a;for(let g=d.length-1,E=a;g>0;g--)E=E.add(d[g]),m=m.add(E);if(u=u.add(m),h!==0)for(let g=0;g<i;g++)u=u.double()}return u}function Oo(e,t,n){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return So(t),t}else return ue(e,{isLE:n})}function Po(e,t,n={},r){if(r===void 0&&(r=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let i of["p","n","h"]){let f=t[i];if(!(typeof f=="bigint"&&f>jt))throw new Error(`CURVE.${i} must be positive bigint`)}let o=Oo(t.p,n.Fp,r),s=Oo(t.n,n.Fn,r),c=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let i of c)if(!o.isValid(t[i]))throw new Error(`CURVE.${i} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}var xe=BigInt(0),H=BigInt(1),$n=BigInt(2),oc=BigInt(8);function sc(e,t,n,r){let o=e.sqr(n),s=e.sqr(r),a=e.add(e.mul(t.a,o),s),c=e.add(e.ONE,e.mul(t.d,e.mul(o,s)));return e.eql(a,c)}function ac(e,t={}){let n=Po("edwards",e,t,t.FpFnLE),{Fp:r,Fn:o}=n,s=n.CURVE,{h:a}=s;Ve(t,{},{uvRatio:"function"});let c=$n<<BigInt(o.BYTES*8)-H,i=E=>r.create(E),f=t.uvRatio||((E,y)=>{try{return{isValid:!0,value:r.sqrt(r.div(E,y))}}catch{return{isValid:!1,value:xe}}});if(!sc(r,s,s.Gx,s.Gy))throw new Error("bad curve params: generator point");function d(E,y,w=!1){let b=w?H:xe;return Ft("coordinate "+E,y,b,c),y}function p(E){if(!(E instanceof m))throw new Error("ExtendedPoint expected")}let u=Vt((E,y)=>{let{X:w,Y:b,Z:I}=E,R=E.is0();y==null&&(y=R?oc:r.inv(I));let D=i(w*y),P=i(b*y),v=r.mul(I,y);if(R)return{x:xe,y:H};if(v!==H)throw new Error("invZ was invalid");return{x:D,y:P}}),h=Vt(E=>{let{a:y,d:w}=s;if(E.is0())throw new Error("bad point: ZERO");let{X:b,Y:I,Z:R,T:D}=E,P=i(b*b),v=i(I*I),x=i(R*R),k=i(x*x),S=i(P*y),T=i(x*i(S+v)),O=i(k+i(w*i(P*v)));if(T!==O)throw new Error("bad point: equation left != right (1)");let _=i(b*I),U=i(R*D);if(_!==U)throw new Error("bad point: equation left != right (2)");return!0});class m{constructor(y,w,b,I){this.X=d("x",y),this.Y=d("y",w),this.Z=d("z",b,!0),this.T=d("t",I),Object.freeze(this)}static CURVE(){return s}static fromAffine(y){if(y instanceof m)throw new Error("extended point not allowed");let{x:w,y:b}=y||{};return d("x",w),d("y",b),new m(w,b,H,i(w*b))}static fromBytes(y,w=!1){let b=r.BYTES,{a:I,d:R}=s;y=Gt(ct(y,b,"point")),Nt(w,"zip215");let D=Gt(y),P=y[b-1];D[b-1]=P&-129;let v=Y(D),x=w?c:r.ORDER;Ft("point.y",v,xe,x);let k=i(v*v),S=i(k-H),T=i(R*k-I),{isValid:O,value:_}=f(S,T);if(!O)throw new Error("bad point: invalid y coordinate");let U=(_&H)===H,j=(P&128)!==0;if(!w&&_===xe&&j)throw new Error("bad point: x=0 and x_0=1");return j!==U&&(_=i(-_)),m.fromAffine({x:_,y:v})}static fromHex(y,w=!1){return m.fromBytes(K("point",y),w)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(y=8,w=!0){return g.createCache(this,y),w||this.multiply($n),this}assertValidity(){h(this)}equals(y){p(y);let{X:w,Y:b,Z:I}=this,{X:R,Y:D,Z:P}=y,v=i(w*P),x=i(R*I),k=i(b*P),S=i(D*I);return v===x&&k===S}is0(){return this.equals(m.ZERO)}negate(){return new m(i(-this.X),this.Y,this.Z,i(-this.T))}double(){let{a:y}=s,{X:w,Y:b,Z:I}=this,R=i(w*w),D=i(b*b),P=i($n*i(I*I)),v=i(y*R),x=w+b,k=i(i(x*x)-R-D),S=v+D,T=S-P,O=v-D,_=i(k*T),U=i(S*O),j=i(k*O),me=i(T*S);return new m(_,U,me,j)}add(y){p(y);let{a:w,d:b}=s,{X:I,Y:R,Z:D,T:P}=this,{X:v,Y:x,Z:k,T:S}=y,T=i(I*v),O=i(R*x),_=i(P*b*S),U=i(D*k),j=i((I+R)*(v+x)-T-O),me=U-_,ke=U+_,ae=i(O-w*T),Ye=i(j*me),kt=i(ke*ae),cn=i(j*ae),kr=i(me*ke);return new m(Ye,kt,kr,cn)}subtract(y){return this.add(y.negate())}multiply(y){if(!o.isValidNot0(y))throw new Error("invalid scalar: expected 1 <= sc < curve.n");let{p:w,f:b}=g.cached(this,y,I=>dt(m,I));return dt(m,[w,b])[0]}multiplyUnsafe(y,w=m.ZERO){if(!o.isValid(y))throw new Error("invalid scalar: expected 0 <= sc < curve.n");return y===xe?m.ZERO:this.is0()||y===H?this:g.unsafe(this,y,b=>dt(m,b),w)}isSmallOrder(){return this.multiplyUnsafe(a).is0()}isTorsionFree(){return g.unsafe(this,s.n).is0()}toAffine(y){return u(this,y)}clearCofactor(){return a===H?this:this.multiplyUnsafe(a)}toBytes(){let{x:y,y:w}=this.toAffine(),b=r.toBytes(w);return b[b.length-1]|=y&H?128:0,b}toHex(){return V(this.toBytes())}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}get ex(){return this.X}get ey(){return this.Y}get ez(){return this.Z}get et(){return this.T}static normalizeZ(y){return dt(m,y)}static msm(y,w){return zt(m,o,y,w)}_setWindowSize(y){this.precompute(y)}toRawBytes(){return this.toBytes()}}m.BASE=new m(s.Gx,s.Gy,H,i(s.Gx*s.Gy)),m.ZERO=new m(xe,H,H,xe),m.Fp=r,m.Fn=o;let g=new $t(m,o.BITS);return m.BASE.precompute(8),m}var qt=class{constructor(t){this.ep=t}static fromBytes(t){Wt()}static fromHex(t){Wt()}get x(){return this.toAffine().x}get y(){return this.toAffine().y}clearCofactor(){return this}assertValidity(){this.ep.assertValidity()}toAffine(t){return this.ep.toAffine(t)}toHex(){return V(this.toBytes())}toString(){return this.toHex()}isTorsionFree(){return!0}isSmallOrder(){return!1}add(t){return this.assertSame(t),this.init(this.ep.add(t.ep))}subtract(t){return this.assertSame(t),this.init(this.ep.subtract(t.ep))}multiply(t){return this.init(this.ep.multiply(t))}multiplyUnsafe(t){return this.init(this.ep.multiplyUnsafe(t))}double(){return this.init(this.ep.double())}negate(){return this.init(this.ep.negate())}precompute(t,n){return this.init(this.ep.precompute(t,n))}toRawBytes(){return this.toBytes()}};function ic(e,t,n={}){if(typeof t!="function")throw new Error('"hash" function param is required');Ve(n,{},{adjustScalarBytes:"function",randomBytes:"function",domain:"function",prehash:"function",mapToCurve:"function"});let{prehash:r}=n,{BASE:o,Fp:s,Fn:a}=e,c=n.randomBytes||Be,i=n.adjustScalarBytes||(x=>x),f=n.domain||((x,k,S)=>{if(Nt(S,"phflag"),k.length||S)throw new Error("Contexts/pre-hash are not supported");return x});function d(x){return a.create(Y(x))}function p(x){let k=b.secretKey;x=K("private key",x,k);let S=K("hashed private key",t(x),2*k),T=i(S.slice(0,k)),O=S.slice(k,2*k),_=d(T);return{head:T,prefix:O,scalar:_}}function u(x){let{head:k,prefix:S,scalar:T}=p(x),O=o.multiply(T),_=O.toBytes();return{head:k,prefix:S,scalar:T,point:O,pointBytes:_}}function h(x){return u(x).pointBytes}function m(x=Uint8Array.of(),...k){let S=B(...k);return d(t(f(S,K("context",x),!!r)))}function g(x,k,S={}){x=K("message",x),r&&(x=r(x));let{prefix:T,scalar:O,pointBytes:_}=u(k),U=m(S.context,T,x),j=o.multiply(U).toBytes(),me=m(S.context,j,_,x),ke=a.create(U+me*O);if(!a.isValid(ke))throw new Error("sign failed: invalid s");let ae=B(j,a.toBytes(ke));return ct(ae,b.signature,"result")}let E={zip215:!0};function y(x,k,S,T=E){let{context:O,zip215:_}=T,U=b.signature;x=K("signature",x,U),k=K("message",k),S=K("publicKey",S,b.publicKey),_!==void 0&&Nt(_,"zip215"),r&&(k=r(k));let j=U/2,me=x.subarray(0,j),ke=Y(x.subarray(j,U)),ae,Ye,kt;try{ae=e.fromBytes(S,_),Ye=e.fromBytes(me,_),kt=o.multiplyUnsafe(ke)}catch{return!1}if(!_&&ae.isSmallOrder())return!1;let cn=m(O,Ye.toBytes(),ae.toBytes(),k);return Ye.add(ae.multiplyUnsafe(cn)).subtract(kt).clearCofactor().is0()}let w=s.BYTES,b={secretKey:w,publicKey:w,signature:2*w,seed:w};function I(x=c(b.seed)){return ct(x,b.seed,"seed")}function R(x){let k=v.randomSecretKey(x);return{secretKey:k,publicKey:h(k)}}function D(x){return re(x)&&x.length===a.BYTES}function P(x,k){try{return!!e.fromBytes(x,k)}catch{return!1}}let v={getExtendedPublicKey:u,randomSecretKey:I,isValidSecretKey:D,isValidPublicKey:P,toMontgomery(x){let{y:k}=e.fromBytes(x),S=b.publicKey,T=S===32;if(!T&&S!==57)throw new Error("only defined for 25519 and 448");let O=T?s.div(H+k,H-k):s.div(k-H,k+H);return s.toBytes(O)},toMontgomerySecret(x){let k=b.secretKey;ct(x,k);let S=t(x.subarray(0,k));return i(S).subarray(0,k)},randomPrivateKey:I,precompute(x=8,k=e.BASE){return k.precompute(x,!1)}};return Object.freeze({keygen:R,getPublicKey:h,sign:g,verify:y,utils:v,Point:e,lengths:b})}function cc(e){let t={a:e.a,d:e.d,p:e.Fp.ORDER,n:e.n,h:e.h,Gx:e.Gx,Gy:e.Gy},n=e.Fp,r=ue(t.n,e.nBitLength,!0),o={Fp:n,Fn:r,uvRatio:e.uvRatio},s={randomBytes:e.randomBytes,adjustScalarBytes:e.adjustScalarBytes,domain:e.domain,prehash:e.prehash,mapToCurve:e.mapToCurve};return{CURVE:t,curveOpts:o,hash:e.hash,eddsaOpts:s}}function lc(e,t){let n=t.Point;return Object.assign({},t,{ExtendedPoint:n,CURVE:e,nBitLength:n.Fn.BITS,nByteLength:n.Fn.BYTES})}function Uo(e){let{CURVE:t,curveOpts:n,hash:r,eddsaOpts:o}=cc(e),s=ac(t,n),a=ic(s,r,o);return lc(e,a)}function Ke(e,t){if(zn(e),zn(t),e<0||e>=1<<8*t)throw new Error("invalid I2OSP input: "+e);let n=Array.from({length:t}).fill(0);for(let r=t-1;r>=0;r--)n[r]=e&255,e>>>=8;return new Uint8Array(n)}function uc(e,t){let n=new Uint8Array(e.length);for(let r=0;r<e.length;r++)n[r]=e[r]^t[r];return n}function zn(e){if(!Number.isSafeInteger(e))throw new Error("number expected")}function fc(e){if(!re(e)&&typeof e!="string")throw new Error("DST must be Uint8Array or string");return typeof e=="string"?C(e):e}function qn(e,t,n,r){L(e),zn(n),t=fc(t),t.length>255&&(t=r(B(C("H2C-OVERSIZE-DST-"),t)));let{outputLen:o,blockLen:s}=r,a=Math.ceil(n/o);if(n>65535||a>255)throw new Error("expand_message_xmd: invalid lenInBytes");let c=B(t,Ke(t.length,1)),i=Ke(0,s),f=Ke(n,2),d=new Array(a),p=r(B(i,e,f,Ke(0,1),c));d[0]=r(B(p,Ke(1,1),c));for(let h=1;h<=a;h++){let m=[uc(p,d[h-1]),Ke(h+1,1),c];d[h]=r(B(...m))}return B(...d).slice(0,n)}var Lo=C("HashToScalar-");var pc=BigInt(0),fe=BigInt(1),Bo=BigInt(2),iu=BigInt(3),hc=BigInt(5),mc=BigInt(8),je=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),ut={p:je,n:BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),h:mc,a:BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),d:BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),Gx:BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),Gy:BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")};function yc(e){let t=BigInt(10),n=BigInt(20),r=BigInt(40),o=BigInt(80),s=je,c=e*e%s*e%s,i=te(c,Bo,s)*c%s,f=te(i,fe,s)*e%s,d=te(f,hc,s)*f%s,p=te(d,t,s)*d%s,u=te(p,n,s)*p%s,h=te(u,r,s)*u%s,m=te(h,o,s)*h%s,g=te(m,o,s)*h%s,E=te(g,t,s)*d%s;return{pow_p_5_8:te(E,Bo,s)*e%s,b2:c}}function gc(e){return e[0]&=248,e[31]&=127,e[31]|=64,e}var Yn=BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");function Jn(e,t){let n=je,r=M(t*t*t,n),o=M(r*r*t,n),s=yc(e*o).pow_p_5_8,a=M(e*r*s,n),c=M(t*a*a,n),i=a,f=M(a*Yn,n),d=c===e,p=c===M(-e,n),u=c===M(-e*Yn,n);return d&&(a=i),(p||u)&&(a=f),de(a,n)&&(a=M(-a,n)),{isValid:d||p,value:a}}var we=ue(ut.p,{isLE:!0}),Go=ue(ut.n,{isLE:!0}),bc={...ut,Fp:we,hash:Ne,adjustScalarBytes:gc,uvRatio:Jn},_e=Uo(bc);var Zn=Yn,Ec=BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235"),xc=BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578"),wc=BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838"),kc=BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952"),No=e=>Jn(fe,e),Ac=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),Xn=e=>_e.Point.Fp.create(Y(e)&Ac);function Ho(e){let{d:t}=ut,n=je,r=y=>we.create(y),o=r(Zn*e*e),s=r((o+fe)*wc),a=BigInt(-1),c=r((a-t*o)*r(o+t)),{isValid:i,value:f}=Jn(s,c),d=r(f*e);de(d,n)||(d=r(-d)),i||(f=d),i||(a=o);let p=r(a*(o-fe)*kc-c),u=f*f,h=r((f+f)*c),m=r(p*Ec),g=r(fe-u),E=r(fe+u);return new _e.Point(r(h*E),r(g*m),r(m*E),r(h*g))}function Fo(e){L(e,64);let t=Xn(e.subarray(0,32)),n=Ho(t),r=Xn(e.subarray(32,64)),o=Ho(r);return new se(n.add(o))}var se=class e extends qt{constructor(t){super(t)}static fromAffine(t){return new e(_e.Point.fromAffine(t))}assertSame(t){if(!(t instanceof e))throw new Error("RistrettoPoint expected")}init(t){return new e(t)}static hashToCurve(t){return Fo(K("ristrettoHash",t,64))}static fromBytes(t){L(t,32);let{a:n,d:r}=ut,o=je,s=I=>we.create(I),a=Xn(t);if(!Nn(we.toBytes(a),t)||de(a,o))throw new Error("invalid ristretto255 encoding 1");let c=s(a*a),i=s(fe+n*c),f=s(fe-n*c),d=s(i*i),p=s(f*f),u=s(n*r*d-p),{isValid:h,value:m}=No(s(u*p)),g=s(m*f),E=s(m*g*u),y=s((a+a)*g);de(y,o)&&(y=s(-y));let w=s(i*E),b=s(y*w);if(!h||de(b,o)||w===pc)throw new Error("invalid ristretto255 encoding 2");return new e(new _e.Point(y,w,fe,b))}static fromHex(t){return e.fromBytes(K("ristrettoHex",t,32))}static msm(t,n){return zt(e,_e.Point.Fn,t,n)}toBytes(){let{X:t,Y:n,Z:r,T:o}=this.ep,s=je,a=E=>we.create(E),c=a(a(r+n)*a(r-n)),i=a(t*n),f=a(i*i),{value:d}=No(a(c*f)),p=a(d*c),u=a(d*i),h=a(p*u*o),m;if(de(o*h,s)){let E=a(n*Zn),y=a(t*Zn);t=E,n=y,m=a(p*xc)}else m=u;de(t*h,s)&&(n=a(-n));let g=a((r-n)*m);return de(g,s)&&(g=a(-g)),we.toBytes(g)}equals(t){this.assertSame(t);let{X:n,Y:r}=this.ep,{X:o,Y:s}=t.ep,a=f=>we.create(f),c=a(n*s)===a(r*o),i=a(r*s)===a(n*o);return c||i}is0(){return this.equals(e.ZERO)}};se.BASE=new se(_e.Point.BASE);se.ZERO=new se(_e.Point.ZERO);se.Fp=we;se.Fn=Go;var Wo={Point:se},Yt={hashToCurve(e,t){let n=t?.DST||"ristretto255_XMD:SHA-512_R255MAP_RO_",r=qn(e,n,64,Ne);return Fo(r)},hashToScalar(e,t={DST:Lo}){let n=qn(e,t.DST,64,Ne);return Go.create(Y(n))}};var pe=B;var Zt=Y,Vo=Fe;var Ko=Ne;var he=Wo.Point,F=he.Fn,Ce=e=>new TextEncoder().encode(e),Qn=pe(Ce("OPRFV1-"),Uint8Array.of(0),Ce("-ristretto255-SHA512")),ze=32,Sc=64;function $o(...e){let t=[];for(let n of e)if(typeof n=="string")t.push(Ce(n));else{if(n.length>65535)throw new Error("OPRF input longer than 65535 bytes");t.push(Vo(n.length,2),n)}return pe(...t)}function Ic(e){let t=Yt.hashToCurve(e,{DST:pe(Ce("HashToGroup-"),Qn)});if(t.equals(he.ZERO))throw new Error("OPRF input maps to the identity");return t}function $e(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} element must be 32 bytes`);let n=he.fromBytes(t);if(n.equals(he.ZERO))throw new Error(`OPRF ${e} element is the identity`);return n}function qe(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} must be 32 bytes`);let n=Zt(t);if(n>=F.ORDER)throw new Error(`OPRF ${e} is not a canonical scalar`);if(F.is0(n))throw new Error(`OPRF ${e} is zero`);return n}function er(){for(;;){let e=Zt(Ro(Be(Fn(F.ORDER)),F.ORDER,!0));if(!F.is0(e))return e}}function ft(e,t){let n=t?qe("blind",t):er(),r=Ic(e).multiply(n);return{blind:F.toBytes(n),blinded:r.toBytes()}}function vc(e,t){return $e("blinded",t).multiply(qe("secret key",e)).toBytes()}function pt(e,t,n){let r=$e("evaluated",n).multiply(F.inv(qe("blind",t))).toBytes();return Ko($o(e,r,"Finalize"))}function Rc(e,t){if(e.length!==32)throw new Error("OPRF key seed must be 32 bytes");let n=pe(e,$o(t),Uint8Array.of(0)),r=pe(Ce("DeriveKeyPair"),Qn);for(let o=0;o<=255;o++){n[n.length-1]=o;let s=Yt.hashToScalar(n,{DST:r});if(!F.is0(s))return F.toBytes(s)}throw new Error("Cannot derive OPRF key")}function Tc(){return F.toBytes(er())}function tr(e){try{return qe("secret key",e),!0}catch{return!1}}var Jt=64,_c=pe(Ce("DLEQ-redaktyn-v1-"),Qn);function Xt(e,t){return F.is0(t)?he.ZERO:e.multiply(t)}function jo(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} must be 32 bytes`);let n=Zt(t);if(n>=F.ORDER)throw new Error(`OPRF ${e} is not a canonical scalar`);return n}function zo(e,t,n,r,o){let s=pe(e.toBytes(),t.toBytes(),n.toBytes(),r.toBytes(),o.toBytes(),Ce("Challenge"));return Yt.hashToScalar(s,{DST:_c})}function nr(e){return he.BASE.multiply(qe("secret key",e)).toBytes()}function rr(e,t){let n=qe("secret key",e),r=$e("blinded",t),o=r.multiply(n),s=he.BASE.multiply(n),a=er(),c=zo(s,r,o,he.BASE.multiply(a),r.multiply(a)),i=F.sub(a,F.mul(c,n));return{evaluated:o.toBytes(),proof:pe(F.toBytes(c),F.toBytes(i))}}function ht(e,t,n,r){try{if(r.length!==Jt)return!1;let o=$e("public key",e),s=$e("blinded",t),a=$e("evaluated",n),c=jo("proof challenge",r.subarray(0,ze)),i=jo("proof response",r.subarray(ze)),f=Xt(he.BASE,i).add(Xt(o,c)),d=Xt(s,i).add(Xt(a,c));return zo(o,s,a,f,d)===c}catch{return!1}}var sr={},qo=["redaktyn.com","www.redaktyn.com"],Z=class extends Error{constructor(t){super(t),this.name="OprfProofError"}},or=/^[0-9a-f]{64}$/;function Qt(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function Cc(e){return new URL(e).host.toLowerCase()}function Yo(e){let t=e.officialHosts??qo,n=e.officialPins??sr;return t.includes(e.scope.toLowerCase())&&Object.keys(n).length>0}function Oc(e={}){let t=new Map(Object.entries(e));return{entries:t,get:(n,r)=>t.get(`${n}|${r}`)??null,set:(n,r,o)=>{t.set(`${n}|${r}`,o)}}}async function en(e,t,n){if(typeof n.proof!="string")throw new Z("This server did not prove which key it answered with. Update the server, or do not trust this connection.");let r,o;try{r=Qt(n.proof),o=Qt(n.evaluated)}catch{throw new Z("The server's answer was not understood.")}if(r.length!==Jt)throw new Z("The server's proof was not understood.");let s=e.officialPins??sr,a=Yo(e),c=a?s[n.keyId]:void 0;if(a&&!c)throw new Z(`The server answered with a key (${n.keyId}) that Redaktyn does not publish.`);if(c||(c=await e.pins.get(e.scope,n.keyId)),c){if(!or.test(c)||!ht(Q(c),t,o,r))throw new Z("The server's answer was not made with the key this workspace was set up with. It may have been changed on the way.");return c}if(e.firstUse!=="allow")throw new Z("This server's key is not one this client has been told to trust.");let i=typeof n.publicKey=="string"?n.publicKey.toLowerCase():"";if(!or.test(i)||!ht(Q(i),t,o,r))throw new Z("The server's proof did not check out.");return await e.pins.set(e.scope,n.keyId,i),i}function ar(e,t,n){let r,o;try{r=Qt(n.evaluated),o=Qt(n.proof)}catch{throw new Z("The key share's answer was not understood.")}if(!or.test(e)||!ht(Q(e),t,r,o))throw new Z("The key share's answer was not made with the key this workspace was set up with.")}var Mc=e=>V(e);var Dc=/^[A-Za-z0-9_-]{1,32}$/,Pc=/^[A-Za-z0-9+/]{43}=$/,Jo={"Access-Control-Allow-Origin":"*","Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"Content-Type, Authorization","Access-Control-Max-Age":"86400"};function Oe(e,t,n={}){return new Response(JSON.stringify(t),{status:e,headers:{"Content-Type":"application/json","Cache-Control":"no-store",...Jo,...n}})}function Uc(e,t){let n=e.length^t.length,r=Math.max(e.length,t.length);for(let o=0;o<r;o++)n|=(e.charCodeAt(o)||0)^(t.charCodeAt(o)||0);return n===0}function Zo(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function Lc(){return"shared"}var Xo=64;function Bc(e,t,n){let r=n.slice(0,Xo);if(t<1||!e)return r;let o=e.split(",").map(a=>a.trim()),s=o[o.length-t];return s?s.slice(0,Xo):r}function Nc(e){if(!tr(e.secretKey))throw new Error("The share's OPRF key is not a valid key");if(!Dc.test(e.kid))throw new Error("The share's key id must be 1-32 letters, digits, - or _");let t=Array.from(nr(e.secretKey),i=>i.toString(16).padStart(2,"0")).join(""),n=e.limits??{perMinute:20,perHour:200},r=e.now??(()=>Date.now()),o=e.clientOf??Lc,s=new Map;function a(i,f){let d=(s.get(i)??[]).filter(u=>f-u<36e5),p=d.filter(u=>f-u<60*1e3).length;if(d.length>=n.perHour||p>=n.perMinute)return s.set(i,d),!0;if(d.push(f),s.set(i,d),s.size>1e4){for(let u of s.keys())if(s.delete(u),s.size<=5e3)break}return!1}let c=(i,f)=>{try{e.onEvaluate?.({at:r(),client:i,outcome:f})}catch{}};return async i=>{let d=new URL(i.url).pathname.replace(/\/+$/,"")||"/";if(i.method==="OPTIONS")return new Response(null,{status:204,headers:Jo});if(i.method==="GET"&&(d==="/"||d==="/public-key"))return Oe(200,{kid:e.kid,publicKey:t,scheme:"ristretto255-sha512-oprf-dleq"});if(i.method==="POST"&&d==="/evaluate"){let p=o(i);if(e.token!==void 0){let m=/^Bearer (.+)$/.exec(i.headers.get("authorization")??"")?.[1]??"";if(!Uc(m,e.token))return c(p,"refused"),Oe(401,{error:"Unauthorised",code:"UNAUTHORIZED"})}let u=r();if(a(p,u))return c(p,"limited"),Oe(429,{error:"Too many attempts. Wait and try again.",code:"RATE_LIMITED"},{"Retry-After":"60"});let h;try{let m=await i.json();if(typeof m.blinded!="string"||!Pc.test(m.blinded))throw new Error("shape");h=Uint8Array.from(atob(m.blinded),g=>g.charCodeAt(0))}catch{return c(p,"invalid"),Oe(400,{error:"blinded must be a base64 32-byte element",code:"VALIDATION"})}try{let{evaluated:m,proof:g}=rr(e.secretKey,h);return c(p,"ok"),Oe(200,{kid:e.kid,evaluated:Zo(m),proof:Zo(g)})}catch{return c(p,"invalid"),Oe(400,{error:"blinded is not a valid group element",code:"VALIDATION"})}}return Oe(404,{error:"Not found",code:"NOT_FOUND"})}}var Qo=Math.round(25*Math.log2(56)),Hc=nt.toLocaleString("en-US"),Gc=[{id:"never-receive",title:"We never receive your passphrase",body:"It is typed only on a page that belongs to the extension, or in the command line, never in a web page. To open your workspace key, your device sends our server one blinded value that it cannot learn the passphrase from.",plan:"all"},{id:"cannot-work-out",title:"We cannot work it out either",body:`A generated passphrase has about ${Qo} bits of randomness, and every guess costs ${Hc} rounds of key derivation. Even holding a copy of our database and our server's key, guessing it is out of reach. One you choose yourself is held to a strength check, but cannot match that.`,plan:"all"},{id:"key-outside-database",title:"Our server's key is not in the database",body:"A copy of the database holds nothing a passphrase guess can be checked against. Every guess has to be a request our server limits, per person and per workspace.",plan:"all"},{id:"answers-are-proved",title:"Our answers are proved, not just trusted",body:"Every answer from the key-lock server carries a proof that it was made with a particular key. The extension and the command line remember the key they first met and refuse a different one, so something sitting in front of our server cannot quietly answer with a key of its own.",plan:"all"},{id:"invite-links-carry-no-passphrase",title:"Invite links never carry your passphrase",body:"A link sits in inboxes and chats for good, so it holds only a one-time key that opens one wrapped copy of the workspace key, once, on the first connection. On its own it opens nothing, and a link in the old format that carried the passphrase is refused.",plan:"all"},{id:"customer-key-server",title:"A key server you run",body:"Add a second server of your own to your workspace's lock. Opening the workspace key then needs its answer as well, so we cannot open it alone or test passphrase guesses, whatever passphrase you choose, and you can end our ability to by switching it off. If its key is ever lost, nothing can open the workspace, so keep two copies.",plan:"enterprise"},{id:"fingerprints-only",title:"We hold fingerprints, not secrets",body:"Registered secrets exist on our servers only as keyed fingerprints we cannot reverse, under a key we never hold unlocked.",plan:"all"},{id:"removed-stays-removed",title:"A person you remove stays removed",body:"A device that was removed cannot enrol itself again by syncing: every request it makes is checked against the removal, so removing someone is not undone by a laptop that is still running.",plan:"all"},{id:"checked-against-code",title:"Our claims are checked against the code",body:"What these pages say about the lock is held to the code by tests that fail when the two disagree, including the figures above.",plan:"all"}];var Fc="oprf-lock-v1",cr="redaktyn-org-key-lock-v1",ts="redaktyn-org-key-lock-v2",ns="redaktyn-org-key-lock-v3",ir="::RSK-",mt=class extends Error{constructor(){super("This workspace also needs its Secret Key, which was shown when it was set up and is in your recovery codes."),this.name="SecretKeyNeededError"}};function Wc(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));return`RSK-${Array.from(e,t=>t.toString(16).padStart(2,"0")).join("")}`}function nn(e){let t=e.trim().toLowerCase().replace(/^rsk-/,"").replace(/[^0-9a-f]/g,"");if(t.length!==32)return null;let n=new Uint8Array(16);for(let r=0;r<16;r++)n[r]=parseInt(t.slice(r*2,r*2+2),16);return n}function lr(e){let t=e.lastIndexOf(ir);if(t<=0)return{passphrase:e,secretKey:null};let n=`RSK-${e.slice(t+ir.length)}`;return nn(n)?{passphrase:e.slice(0,t),secretKey:n}:{passphrase:e,secretKey:null}}function Vc(e,t){return!t||lr(e).secretKey?e:`${e}${ir}${t.replace(/^RSK-/i,"")}`}var tn=class extends Error{constructor(t="This workspace's key needs your key-share server, and it could not be reached."){super(t),this.name="KeyShareUnavailableError"}};function yt(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function gt(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function dr(){let e=globalThis.crypto?.subtle;if(!e)throw new Error("Web Crypto is not available");return e}function bt(e){let t=new Uint8Array(new ArrayBuffer(e.byteLength));return t.set(e),t}var rs=(e,t,n,r)=>bt(C(n?`${ts}|${e}|${t}|${n.url}|${n.kid}|${n.publicKey}`:r?`${ns}|${e}|${t}`:`${cr}|${e}|${t}`));async function os(e,t){return _t(z,C(e),z(C(`${cr}|${t}`)),{c:nt,dkLen:32})}async function ss(e,t,n,r,o,s){if(o&&s)throw new Error("A lock takes a key share or a Secret Key, not both");if(o&&!n.evaluateShare)throw new tn;let a=await os(e,t),c=[];try{let i=ft(a),f=o?ft(a):null,[d,p]=await Promise.all([n.evaluate({blinded:yt(i.blinded),...r?{keyId:r}:{}}),o&&f?n.evaluateShare({share:o,blinded:yt(f.blinded)}):Promise.resolve(null)]);if(r&&d.keyId!==r)throw new Error("The server answered with a different key than the lock uses");await en(n.trust,i.blinded,d);let u=pt(a,i.blind,gt(d.evaluated));c.push(u),i.blind.fill(0);let h=u,m=`${cr}|kek`;if(o&&f&&p){ar(o.publicKey,f.blinded,p);let y=pt(a,f.blind,gt(p.evaluated));c.push(y),f.blind.fill(0),h=B(u,y),c.push(h),m=`${ts}|kek`}s&&(h=B(u,s),c.push(h),m=`${ns}|kek`);let g=tt(z,h,C(t),C(m),32),E=await dr().importKey("raw",bt(g),{name:"AES-GCM"},!1,["encrypt","decrypt"]);return g.fill(0),{key:E,keyId:d.keyId}}finally{for(let i of c)i.fill(0);a.fill(0)}}function as(){let e=new Uint8Array(32);return globalThis.crypto.getRandomValues(e),e}async function is(e,t,n,r,o,s){if(e.byteLength!==32)throw new Error("An org key is 32 bytes");let a=s?nn(s):void 0;if(s&&!a)throw new Error("That is not a Secret Key");let{key:c,keyId:i}=await ss(t,n,r,void 0,o,a??void 0),f=globalThis.crypto.getRandomValues(new Uint8Array(12)),d=new Uint8Array(await dr().encrypt({name:"AES-GCM",iv:f,additionalData:rs(n,i,o,a??void 0)},c,bt(e))),p={keyId:i,iv:yt(f),ciphertext:yt(d)};return a?{v:3,...p}:o?{v:2,...p,share:{url:o.url,kid:o.kid,publicKey:o.publicKey}}:{v:1,...p}}async function Kc(e,t,n,r){if(!ls(e))throw new Error("Not an org key lock");let o=e.v===2?e.share:void 0,s=t,a;if(e.v===3){let f=lr(t);s=f.passphrase;let d=f.secretKey??r.secretKey;if(!d)throw new mt;if(a=nn(d)??void 0,!a)throw new mt}let{key:c}=await ss(s,n,r,e.keyId,o,a),i;try{i=new Uint8Array(await dr().decrypt({name:"AES-GCM",iv:bt(gt(e.iv)),additionalData:rs(n,e.keyId,o,a)},c,bt(gt(e.ciphertext))))}catch{return null}if(i.byteLength!==32)throw i.fill(0),new Error("An org key lock did not hold a 32-byte key");return i}async function jc(e,t,n,r,o){let s=as(),a=await is(s,e,t,n,r,o);return{orgKey:s,lock:a,verifier:vn(s)}}var es="redaktyn-device-envelope-v1";async function $c(e,t,n,r){let o=await os(e,t),s=null;try{let a=ft(o);try{let c=await n.evaluate({blinded:yt(a.blinded),...r?{keyId:r}:{}});if(r&&c.keyId!==r)throw new Error("The server answered with a different key than this browser's copy uses");await en(n.trust,a.blinded,c),s=pt(o,a.blind,gt(c.evaluated));let i=tt(z,s,C(t),C(`${es}|kek`),32),f=Array.from(i,d=>d.toString(16).padStart(2,"0")).join("");return i.fill(0),{credential:`${es}:${f}`,keyId:c.keyId}}finally{a.blind.fill(0)}}finally{s?.fill(0),o.fill(0)}}function cs(e){if(!e||typeof e!="object")return!1;let t=e;if(typeof t.url!="string"||t.url.length>200||typeof t.kid!="string"||!/^[A-Za-z0-9_-]{1,32}$/.test(t.kid)||typeof t.publicKey!="string"||!/^[0-9a-f]{64}$/.test(t.publicKey))return!1;let n;try{n=new URL(t.url)}catch{return!1}let r=n.hostname==="localhost"||n.hostname==="127.0.0.1"||n.hostname==="[::1]";return!(n.protocol!=="https:"&&!(n.protocol==="http:"&&r)||n.username||n.password||n.search||n.hash)}function ls(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.keyId=="string"&&/^[A-Za-z0-9_-]{1,32}$/.test(t.keyId)&&typeof t.iv=="string"&&t.iv.length===16&&typeof t.ciphertext=="string"&&t.ciphertext.length===64?t.v===1||t.v===3?t.share===void 0:t.v===2&&cs(t.share):!1}var $u=864e5;function zc(e,t,n,r){let o=new Set(t.map(a=>a.id));if(n&&Array.isArray(n.held)&&r-n.since>=0&&r-n.since<864e5){let a=n.held.filter(c=>!o.has(c.id));return a.length===0?{list:[...t],hold:null}:{list:[...t,...a],hold:{held:a,since:n.since}}}if(n)return{list:[...t],hold:null};let s=e.filter(a=>!o.has(a.id));return s.length>=3&&s.length*2>=e.length?{list:[...t,...s],hold:{held:s,since:r}}:{list:[...t],hold:null}}var qc=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/;function Yc(e){let t=e.split(/\r?\n/),n=[],r=0,o=0;for(let s of t){if(r>0||o>0){if(s.startsWith("\\"))continue;if(s.startsWith("+")){n.push(s.slice(1)),o--;continue}if(s.startsWith("-")){r--;continue}if(s.startsWith(" ")){r--,o--;continue}r=0,o=0}let a=qc.exec(s);if(a){r=a[1]===void 0?1:Number(a[1]),o=a[2]===void 0?1:Number(a[2]);continue}s.startsWith("+++")||s.startsWith("---")||s.startsWith("+")&&n.push(s.slice(1))}return n.join(`
6
- `)}var ds="redaktyn-scan-prefilter-v1",us="v1.",fs=65535,Et=Math.imul,fr=fs+1,ps=/^v1\.[0-9a-f]{12}$/;function hs(e){if(e.length<4)throw new Error("scanPrefilterParams: seed too short");return{base:e[0]<<24|e[1]<<16|e[2]<<8|e[3]|1}}function ms(e){return ee(z,e,C(ds))}function Zc(e){return(e>=65&&e<=90?e+32:e)+1}function ys(e){let t=new Int32Array(e.length);for(let n=0;n<e.length;n++)t[n]=Zc(e.charCodeAt(n));return t}function Xc(e,t){let n=1,r=e|0,o=t;for(;o>0;)o&1&&(n=Et(n,r)),r=Et(r,r),o>>>=1;return n}function gs(e,t,n,r){let o=0;for(let s=n;s<n+r;s++)o=Et(o,e)+t[s]|0;return o}function rn(e,t){return gs(e.base,ys(t),0,t.length)>>>16}function Jc(e,t,n){let r=e.base,o=Xc(r,n-1),s=-2,a=0;return c=>(c===s+1?a=Et(a-Et(t[s],o)|0,r)+t[s+n]|0:a=gs(r,t,c,n),s=c,a>>>16)}function ur(e){return(e&fs).toString(16).padStart(4,"0")}function bs(e,t){return us+ur(rn(e,t.exact))+ur(rn(e,t.collapsed))+ur(rn(e,t.lower))}function Qc(e,t){return bs(hs(ms(t)),{exact:Ct(e),collapsed:rt(ot(e)),lower:He(e)})}function pr(e){if(typeof e!="string"||!ps.test(e))return null;let t=e.slice(us.length);return{exact:parseInt(t.slice(0,4),16),collapsed:parseInt(t.slice(4,8),16),lower:parseInt(t.slice(8,12),16)}}var sn=15e7,xt=50*1024*1024,Es=256,xs=5e4,ws=1e4;function ks(e){return pr(e.scanPrefilter)!==null}function hr(e,t=!1){let n=[new Map,new Map,new Map],r=(o,s,a)=>{if(typeof s!="number"||!(s>0))return;let c=n[o].get(s);n[o].set(s,c?{windowLen:s,prefiltered:c.prefiltered&&a,entries:c.entries+1}:{windowLen:s,prefiltered:a,entries:1})};for(let o of e){let s=t||ks(o);r(0,o.length,s),r(1,o.lengthStripped,s),r(2,o.lengthLower,s)}return n.flatMap(o=>[...o.values()])}function mr(e,t){let n=0;for(let r of t){let o=Math.max(0,e-r.windowLen+1);n+=r.prefiltered?Math.ceil(o/Es)+Math.ceil(o*r.entries/fr):o}return n}function on(e){if(e.length===0)return 1/0;if(mr(xt,e)<=sn)return xt;let t=0,n=xt;for(;t<n;){let r=Math.ceil((t+n)/2);mr(r,e)<=sn?t=r:n=r-1}return t}function el(e){let t=new Set,n=new Set,r=new Set;for(let o of e)o.length>0&&t.add(o.length),typeof o.lengthStripped=="number"&&o.lengthStripped>0&&n.add(o.lengthStripped),typeof o.lengthLower=="number"&&o.lengthLower>0&&r.add(o.lengthLower);return[...t,...n,...r]}function tl(e){let t=e.length;if(t===0)return 1/0;let n=e.reduce((r,o)=>r+o,0);return Math.max(0,Math.floor((sn+n-t)/t))}function nl(e){let t=hr(e),n=on(t),o={windowLen:t.length?Math.round(t.reduce((a,c)=>a+c.windowLen,0)/t.length):40,prefiltered:!0,entries:1},s=on([...t,o,o,o]);return{windowLengths:t.length,maxPasteChars:n,severity:n<ws?"alarm":n<xs?"warn":"ok",maxPasteCharsAfterOneMore:s,legacySecrets:e.filter(a=>!ks(a)).length,maxPasteCharsIfReenrolled:on(hr(e,!0)),atCharacterCap:n===xt}}var nf=200;var wt={"stripe-live-secret":"Stripe live secret key","stripe-restricted-live":"Stripe restricted live key","stripe-test":"Stripe test key","stripe-publishable":"Stripe publishable key","github-pat":"GitHub personal access token","github-oauth":"GitHub OAuth token","github-app":"GitHub app token","github-fine-grained":"GitHub fine-grained token","npm-token":"npm access token","aws-access-key-id":"AWS access key ID","google-api-key":"Google API key","anthropic-api-key":"Anthropic API key","openai-api-key":"OpenAI API key","gitlab-pat":"GitLab personal access token","slack-token":"Slack token","slack-app-token":"Slack app token","shopify-token":"Shopify access token","digitalocean-token":"DigitalOcean token","huggingface-token":"Hugging Face token","stripe-webhook-secret":"Stripe webhook signing secret","openrouter-api-key":"OpenRouter API key","groq-api-key":"Groq API key","xai-api-key":"xAI API key","perplexity-api-key":"Perplexity API key","replicate-token":"Replicate API token","google-oauth-client-secret":"Google OAuth client secret","azure-ad-client-secret":"Azure AD client secret","gitlab-token":"GitLab token","slack-webhook":"Slack webhook URL","discord-webhook":"Discord webhook URL","discord-bot-token":"Discord bot token","telegram-bot-token":"Telegram bot token","sendgrid-api-key":"SendGrid API key","twilio-api-key":"Twilio API key","mailgun-api-key":"Mailgun API key","mailchimp-api-key":"Mailchimp API key","pypi-token":"PyPI upload token","docker-hub-token":"Docker Hub access token","vault-token":"HashiCorp Vault token","terraform-cloud-token":"Terraform Cloud token","doppler-token":"Doppler token","linear-api-key":"Linear API key","notion-token":"Notion integration token","airtable-token":"Airtable personal access token","atlassian-api-token":"Atlassian API token","square-token":"Square access token","sentry-token":"Sentry auth token","new-relic-key":"New Relic API key","grafana-token":"Grafana token","postman-api-key":"Postman API key","supabase-token":"Supabase secret key","supabase-publishable":"Supabase publishable key","netlify-token":"Netlify access token","age-secret-key":"age secret key","private-key":"Private key","connection-string-password":"Password in a connection string","neon-db-password":"Neon database password","assigned-secret":"Value assigned to a credential name","aws-secret-access-key":"AWS secret access key","aws-session-token":"AWS session token","gcp-service-account-key":"Google Cloud service-account key","azure-storage-key":"Azure storage account key","cloudflare-api-token":"Cloudflare API token","cloud-provider-token":"Cloud platform token","hyperscaler-access-key":"Cloud access key (Alibaba, Tencent, IBM, Oracle)","bitbucket-token":"Bitbucket token","ci-token":"CI/CD token","package-registry-token":"Package registry token","pulumi-token":"Pulumi access token","managed-db-token":"Managed database token","jdbc-ado-password":"Password in a JDBC or ADO.NET connection string","warehouse-credential":"Data warehouse credential","payment-provider-secret":"Payment gateway secret","commerce-token":"Commerce platform token","llm-provider-key":"AI provider API key","email-provider-key":"Email provider key","sms-provider-secret":"SMS or voice provider secret","productivity-saas-token":"Productivity SaaS token","observability-key":"Monitoring or logging key","signing-secret":"Signing or encryption secret","oauth-client-secret":"OAuth client secret","long-lived-jwt":"Long-lived JWT","http-basic-auth":"HTTP basic-auth credentials","session-cookie":"Session cookie","config-password":"Password in configuration","crypto-wallet-secret":"Crypto wallet key or seed phrase","vpn-private-key":"VPN private key","env-file":"Secrets in an .env file","kubeconfig-credential":"Kubernetes config credential","k8s-secret-manifest":"Kubernetes Secret value","terraform-secret":"Secret in Terraform state or variables","credential-file":"Credentials file (.npmrc, .netrc, docker, git)","presigned-url":"Pre-signed URL that is still valid","payment-card-number":"Payment card number","aadhaar-number":"Aadhaar number","india-tax-id":"PAN or personal GSTIN","national-id-number":"SSN or National Insurance number","bank-account-details":"Bank account details","customer-data-dump":"Customer data export"},As=Object.keys(wt),Me="unrecognised",rl="assigned-secret",Ss=[...As,Me];function ol(e){return Ss.includes(e)}function yr(e){return e===Me?"Unrecognised credential":wt[e]??e}var sl=new Set(["payment-card-number","aadhaar-number","india-tax-id","national-id-number","bank-account-details","customer-data-dump"]),al=new Set(["private-key","vpn-private-key","age-secret-key"]),il=new Set(["crypto-wallet-secret"]),cl=["Create a replacement credential at the provider. Leave the old one working for now.","Switch everything that uses it (services, CI settings, teammates' environment files) to the new value, and check that each one still works.","Revoke the old credential at the provider. Until you do, a copy that was shared anywhere else still works.","Register the new value in Redaktyn so it is protected the same way, then remove the old fingerprint here."],ll=["Generate a new key pair.","Put the new public key everywhere the old one is authorised (servers, services, allow-lists), and check access with the new private key.","Remove the old public key from those places, so the old private key stops working.","Register the new private key in Redaktyn so it is protected the same way, then remove the old fingerprint here."],dl=["A wallet key or seed phrase cannot be changed, only replaced.","Create a new wallet, ideally on a device you trust.","Move the funds and any approvals to the new wallet.","Stop using the old wallet. Register the new key in Redaktyn if you want it protected."],Is=[{label:"Stripe documentation: API keys",url:"https://docs.stripe.com/keys"},{label:"Stripe Dashboard: API keys",url:"https://dashboard.stripe.com/apikeys"}],vs=[{label:"GitHub documentation: managing your personal access tokens",url:"https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens"}],gr=[{label:"AWS documentation: IAM access keys",url:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"}],Rs=[{label:"Slack: your apps",url:"https://api.slack.com/apps"}],Ts={"stripe-live-secret":{links:Is,tips:["Stripe lets you roll a key and expire the old one once your services have moved to the new one."]},"stripe-restricted-live":{links:Is,tips:["Stripe lets you roll a key and expire the old one once your services have moved to the new one."]},"github-pat":{links:vs},"github-fine-grained":{links:vs},"gitlab-pat":{links:[{label:"GitLab documentation: personal access tokens",url:"https://docs.gitlab.com/user/profile/personal_access_tokens/"}],tips:["GitLab lets you rotate a personal access token as well as revoke it."]},"npm-token":{links:[{label:"npm documentation: revoking access tokens",url:"https://docs.npmjs.com/revoking-access-tokens/"}]},"aws-access-key-id":{links:gr},"aws-secret-access-key":{links:gr},"aws-session-token":{links:gr},"anthropic-api-key":{links:[{label:"Anthropic console: API keys",url:"https://platform.claude.com/settings/keys"}]},"google-api-key":{links:[{label:"Google Cloud console: credentials",url:"https://console.cloud.google.com/apis/credentials"}]},"slack-token":{links:Rs},"slack-app-token":{links:Rs},"sendgrid-api-key":{links:[{label:"SendGrid documentation: API keys",url:"https://www.twilio.com/docs/sendgrid/ui/account-and-settings/api-keys"}]},"huggingface-token":{links:[{label:"Hugging Face: access tokens",url:"https://huggingface.co/settings/tokens"}]},"pypi-token":{links:[{label:"PyPI: API tokens",url:"https://pypi.org/manage/account/token/"}]},"digitalocean-token":{links:[{label:"DigitalOcean: API tokens",url:"https://cloud.digitalocean.com/account/api/tokens"}]},"docker-hub-token":{links:[{label:"Docker Hub: security settings",url:"https://hub.docker.com/settings/security"}]}},ul=["docs.stripe.com","dashboard.stripe.com","docs.github.com","docs.gitlab.com","docs.npmjs.com","docs.aws.amazon.com","platform.claude.com","console.cloud.google.com","api.slack.com","www.twilio.com","huggingface.co","pypi.org","cloud.digitalocean.com","hub.docker.com"],fl=Object.keys(Ts);function pl(e){if(e&&sl.has(e))return null;let t=e&&e!==Me&&Object.prototype.hasOwnProperty.call(wt,e)?e:null,n=t&&il.has(t)?"wallet":t&&al.has(t)?"keypair":"credential",r=n==="wallet"?dl:n==="keypair"?ll:cl,o=t?Ts[t]:void 0;return{slug:e??null,provider:t?yr(t):null,kind:n,steps:r,tips:o?.tips??[],links:o?.links??[]}}var _s={credential:"Credentials",infra:"Infrastructure",pii:"Personal data"},hl={credential:"Keys, tokens and passwords that grant access to something. An admin can protect one on the spot, and the next paste of it is blocked.",infra:"Files that carry credentials in bulk \u2014 an .env dump, a kubeconfig, a Terraform state file. One paste can hand over a whole environment.",pii:"Card, identity and bank numbers that belong to people, not to the org. Never protected, only removed from the message."},ml={checksum:"Checksum verified",structure:"Structure decoded",prefix:"Provider format",context:"Named and random"},A=(e,t,n,r,o)=>({id:e,family:t,name:n,slugs:r,...o}),br=[A(1,"credential","AWS access keys",["aws-access-key-id","aws-secret-access-key"],{proof:"prefix",catches:"AKIA\u2026 access key IDs, and the 40-character secret access key beside them in a credentials file, an env var or a chat message.",ignores:"AWS's documented example keys (AKIAIOSFODNN7EXAMPLE), ARNs and account IDs."}),A(2,"credential","AWS session tokens",["aws-session-token"],{proof:"prefix",catches:"Temporary STS session tokens (IQoJb3JpZ2lu\u2026, FwoGZXIvYXdz\u2026) copied out of a console or a CLI profile.",ignores:"Tokens cut short with an ellipsis, and placeholders."}),A(3,"credential","Google Cloud credentials",["gcp-service-account-key","google-api-key"],{proof:"structure",catches:"Service-account JSON files whose private key is a real key, and AIza\u2026 API keys.",ignores:"Service-account JSON with a truncated or random-filler private key, and AIza followed by filler."}),A(4,"credential","Azure storage keys",["azure-storage-key"],{proof:"context",catches:"AccountKey= and SharedAccessKey= inside Azure Storage, Service Bus and Event Hubs connection strings.",ignores:"The public Azurite emulator key (devstoreaccount1) and <your-account-key> placeholders."}),A(5,"credential","Azure AD client secrets",["azure-ad-client-secret"],{proof:"prefix",catches:"Entra ID app client secrets \u2014 the 40-character values with Q~ at position four.",ignores:"Tenant and client IDs, which are GUIDs and not secret."}),A(6,"credential","Cloudflare tokens",["cloudflare-api-token"],{proof:"context",catches:"Cloudflare API tokens assigned to a Cloudflare variable, and v1.0- origin CA keys.",ignores:"Zone and account IDs."}),A(7,"credential","Developer cloud tokens",["digitalocean-token","netlify-token","cloud-provider-token"],{proof:"prefix",catches:"DigitalOcean (dop_v1_), Netlify (nfp_), Heroku (HRKU-), Fly.io (fo1_), Render (rnd_) and Vercel tokens.",ignores:"App names and region settings, and tokens made of filler characters."}),A(8,"credential","Other cloud access keys",["hyperscaler-access-key"],{proof:"prefix",catches:"Alibaba Cloud (LTAI\u2026), Tencent Cloud (AKID\u2026) and IBM Cloud API keys.",ignores:"Region names and other configuration that sits next to them."}),A(9,"credential","GitHub tokens",["github-pat","github-oauth","github-app","github-fine-grained"],{proof:"checksum",catches:"Classic and fine-grained personal access tokens, OAuth tokens and app tokens (ghp_, gho_, ghs_, github_pat_) \u2014 each carries a CRC32 checksum, and it has to verify.",ignores:"Strings shaped like a GitHub token whose checksum fails, ${{ secrets.GITHUB_TOKEN }} references, and repository URLs."}),A(10,"credential","GitLab tokens",["gitlab-pat","gitlab-token"],{proof:"prefix",catches:"GitLab personal access tokens (glpat-) and runner tokens (glrt-).",ignores:"GitLab URLs and filler tokens."}),A(11,"credential","Bitbucket and Atlassian tokens",["atlassian-api-token","bitbucket-token"],{proof:"prefix",catches:"Atlassian API tokens (ATATT\u2026), Bitbucket app passwords and access tokens (ATBB\u2026).",ignores:"Jira and Confluence site URLs."}),A(12,"credential","CI/CD tokens",["ci-token"],{proof:"prefix",catches:"CircleCI (CCIPAT_), Buildkite (bkua_) and Jenkins API tokens.",ignores:"Build numbers, job URLs and pipeline names."}),A(13,"credential","Package registry tokens",["npm-token","pypi-token","docker-hub-token","package-registry-token"],{proof:"checksum",catches:"npm tokens (npm_, checksum-verified), PyPI upload tokens, Docker Hub PATs (dckr_pat_), RubyGems and NuGet keys.",ignores:"npm-shaped tokens whose checksum fails, and registry URLs."}),A(14,"credential","Infrastructure-as-code and secret-manager tokens",["vault-token","terraform-cloud-token","doppler-token","pulumi-token"],{proof:"prefix",catches:"HashiCorp Vault tokens (hvs.), Terraform Cloud tokens (.atlasv1.), Doppler (dp.st.) and Pulumi (pul-) tokens.",ignores:"Vault addresses and workspace names."}),A(15,"credential","Database connection strings",["connection-string-password"],{proof:"context",catches:"The password inside a postgres://, mysql://, mongodb+srv://, redis:// or amqp:// URL pointing at a real host.",ignores:"localhost and example.com hosts, user:password, ${DB_PASSWORD} references and <password> placeholders."}),A(16,"credential","Managed database tokens",["neon-db-password","supabase-token","supabase-publishable","managed-db-token"],{proof:"prefix",catches:"Neon passwords (npg_), Supabase service and secret keys (sbp_, sb_secret_), PlanetScale and Upstash tokens.",ignores:"Supabase publishable keys, which are meant to be public, and project IDs."}),A(17,"credential","JDBC and ADO.NET passwords",["jdbc-ado-password"],{proof:"context",catches:"password= and Password= inside JDBC URLs and SQL Server / ADO.NET connection strings.",ignores:"Password=password, ${SA_PASSWORD} and <your_password>."}),A(18,"credential","Data warehouse credentials",["warehouse-credential"],{proof:"prefix",catches:"Databricks tokens (dapi\u2026), and Snowflake and ClickHouse passwords.",ignores:"Account locators and warehouse names."}),A(19,"credential","Stripe keys",["stripe-live-secret","stripe-restricted-live","stripe-webhook-secret","stripe-test","stripe-publishable"],{proof:"prefix",catches:"Live secret keys (sk_live_), restricted live keys (rk_live_) and webhook signing secrets (whsec_).",ignores:"Test-mode keys, publishable keys (pk_), which are public, and keys cut short with an ellipsis."}),A(20,"credential","Payment gateway secrets",["square-token","payment-provider-secret"],{proof:"prefix",catches:"Square access tokens, Braintree production tokens, Plaid production secrets, Razorpay key secrets and PayPal client secrets.",ignores:"Razorpay key IDs on their own, test-mode and sandbox keys."}),A(21,"credential","Commerce platform tokens",["shopify-token","commerce-token"],{proof:"prefix",catches:"Shopify admin tokens (shpat_), WooCommerce consumer keys (ck_) and BigCommerce access tokens.",ignores:"Store domains and all-zero filler tokens."}),A(22,"credential","OpenAI keys",["openai-api-key"],{proof:"prefix",catches:"Project keys (sk-proj-\u2026 with the T3BlbkFJ marker) and legacy sk- keys.",ignores:"Model names, sk-abcdef\u2026 keyboard strings and keys masked as sk-\u2026a1B2."}),A(23,"credential","Anthropic keys",["anthropic-api-key"],{proof:"prefix",catches:"Anthropic API keys (sk-ant-api03-\u2026AA).",ignores:"Model names and sk-ant-\u2026 placeholders."}),A(24,"credential","Other AI provider keys",["groq-api-key","xai-api-key","perplexity-api-key","replicate-token","huggingface-token","openrouter-api-key","llm-provider-key"],{proof:"prefix",catches:"Groq, xAI, Perplexity, Replicate, Hugging Face, OpenRouter, DeepSeek, LangSmith and Mistral keys.",ignores:"Cache paths like HF_HOME and filler tokens."}),A(25,"credential","Slack tokens and webhooks",["slack-token","slack-app-token","slack-webhook"],{proof:"prefix",catches:"Bot, user and app tokens (xoxb-, xoxp-, xapp-) and incoming webhook URLs.",ignores:"Slack's documented placeholder bot token, and channel names."}),A(26,"credential","Discord and Telegram bots",["discord-webhook","discord-bot-token","telegram-bot-token"],{proof:"structure",catches:"Discord webhook URLs and bot tokens, and Telegram bot tokens (a bot ID, a colon, then AA\u2026).",ignores:"Guild and channel IDs."}),A(27,"credential","Email provider keys",["sendgrid-api-key","mailgun-api-key","mailchimp-api-key","email-provider-key"],{proof:"prefix",catches:"SendGrid (SG.), Mailgun (key-), Mailchimp (\u2026-us1), Resend (re_), Brevo (xkeysib-) and Postmark keys.",ignores:"SMTP hosts and sender addresses."}),A(28,"credential","SMS and voice provider secrets",["twilio-api-key","sms-provider-secret"],{proof:"context",catches:"Twilio API keys (SK\u2026) and auth tokens, and MSG91 auth keys.",ignores:"Account SIDs and phone numbers on their own."}),A(29,"credential","Productivity SaaS tokens",["linear-api-key","notion-token","airtable-token","postman-api-key","productivity-saas-token"],{proof:"prefix",catches:"Linear, Notion, Airtable, Postman, HubSpot, Figma, Asana and Zendesk tokens.",ignores:"Database and page IDs, which are not secret."}),A(30,"credential","Monitoring and logging keys",["sentry-token","new-relic-key","grafana-token","observability-key"],{proof:"prefix",catches:"Sentry auth tokens, New Relic (NRAK-), Grafana service accounts (glsa_), Dynatrace, PostHog personal keys and Datadog API keys.",ignores:"Sentry DSNs and PostHog project keys, which are designed to ship in browser code."}),A(31,"credential","Private keys (PEM, OpenSSH, PGP)",["private-key"],{proof:"structure",catches:"RSA, EC, PKCS#8, OpenSSH and PGP private key blocks whose body decodes to a real key.",ignores:"Public keys and certificates, key blocks with ... for a body, and blocks filled with random text."}),A(32,"credential","Signing and encryption secrets",["signing-secret"],{proof:"context",catches:"JWT_SECRET, SECRET_KEY_BASE, NEXTAUTH_SECRET, Django SECRET_KEY and similar, when the value is random.",ignores:"changeme, algorithm names like HS256 and expiry settings."}),A(33,"credential","OAuth client secrets",["google-oauth-client-secret","oauth-client-secret"],{proof:"prefix",catches:"Google client secrets (GOCSPX-) and refresh tokens, and Okta, Auth0 and generic client_secret values.",ignores:"Client IDs, which are public."}),A(34,"credential","Long-lived JWTs",["long-lived-jwt"],{proof:"structure",catches:"Signed JWTs that are still valid for a long time \u2014 service-role keys, service-account tokens, tokens that never expire.",ignores:"Expired tokens, short-lived session tokens, Supabase anon keys and the jwt.io sample token."}),A(35,"credential","Basic auth and session cookies",["http-basic-auth","session-cookie"],{proof:"structure",catches:"Authorization: Basic headers that decode to user:password, curl -u credentials, and login session cookies.",ignores:"Analytics and preference cookies, and user:pass examples."}),A(36,"credential","Passwords in configuration",["config-password","assigned-secret"],{proof:"context",catches:"Values assigned to DB_PASSWORD, API_TOKEN, password: and their kin in env files, YAML and code, when they are random enough to be real.",ignores:"********, length settings, keyboard walks like qwertyuiop123, and placeholders."}),A(37,"credential","Crypto wallet keys and seed phrases",["crypto-wallet-secret"],{proof:"checksum",catches:"BIP39 recovery phrases whose checksum word verifies, WIF and xprv keys (Base58Check) and raw Ethereum private keys.",ignores:"The abandon \u2026 about test phrase, Hardhat's published dev keys, and wallet addresses."}),A(38,"credential","age and WireGuard keys",["age-secret-key","vpn-private-key"],{proof:"structure",catches:"age secret keys (AGE-SECRET-KEY-1\u2026) and the PrivateKey of a WireGuard [Interface].",ignores:"WireGuard peer public keys."}),A(39,"infra",".env files",["env-file"],{proof:"context",catches:"A pasted .env file with real secrets in it, flagged as one file rather than line by line.",ignores:".env files with only settings, ${VAR} references or your_key_here placeholders."}),A(40,"infra","Kubernetes configs",["kubeconfig-credential"],{proof:"structure",catches:"kubeconfig files carrying a client key or a bearer token for a cluster.",ignores:"kubeconfigs that authenticate through an exec plugin, and REDACTED tokens."}),A(41,"infra","Kubernetes Secret manifests",["k8s-secret-manifest"],{proof:"structure",catches:"kind: Secret manifests \u2014 the base64 under data: is decoded and checked, and stringData: is read as is.",ignores:"Secrets that decode to password or admin, and certificates."}),A(42,"infra","Terraform state and variables",["terraform-secret"],{proof:"structure",catches:"Passwords in terraform.tfstate attributes and hard-coded in .tf resources.",ignores:"null attributes and var.db_password references."}),A(43,"infra","Credential files",["credential-file"],{proof:"structure",catches:".netrc logins, Docker config.json auths, .pgpass lines and tokens embedded in git remote URLs.",ignores:"example.com entries, user:password auths and plain clone URLs."}),A(44,"infra","Pre-signed URLs",["presigned-url"],{proof:"structure",catches:"S3 pre-signed and Azure SAS URLs that have not expired yet \u2014 anyone holding one can read the file.",ignores:"Expired links, unsigned URLs and documentation pages."}),A(45,"pii","Payment card numbers",["payment-card-number"],{proof:"checksum",catches:"Visa, Mastercard, Amex, RuPay and other card numbers that pass the Luhn check and sit next to a card label, an expiry or a card network name.",ignores:"Published test cards (4242\u2026, 4111\u2026), order IDs and numbers that fail Luhn."}),A(46,"pii","Aadhaar numbers",["aadhaar-number"],{proof:"checksum",catches:"Aadhaar numbers that pass the Verhoeff check, labelled or in the 4-4-4 grouping.",ignores:"UIDAI's sample numbers, transaction references and numbers that fail Verhoeff."}),A(47,"pii","PAN and GSTIN",["india-tax-id"],{proof:"checksum",catches:"Individual PANs and GSTINs whose check character verifies.",ignores:"Company PANs, unlabelled lookalikes and GSTINs with a wrong check character."}),A(48,"pii","SSN and National Insurance numbers",["national-id-number"],{proof:"structure",catches:"US Social Security numbers and UK National Insurance numbers that follow the issuing rules and are labelled or listed.",ignores:"Numbers never issued (000, 666, 9xx areas), the famous Woolworth card number, and part numbers."}),A(49,"pii","Bank account details",["bank-account-details"],{proof:"checksum",catches:"IBANs that pass mod-97, and account numbers next to a valid ABA routing number or an IFSC code.",ignores:"Published example IBANs, IBANs with a wrong check digit and IFSC codes alone."}),A(50,"pii","Customer data exports",["customer-data-dump"],{proof:"context",catches:"Pasted tables of real people \u2014 rows with names, personal email addresses and phone numbers.",ignores:"example.com addresses, 555 phone numbers, short lists and staff email lists."})],yl=["Placeholders \u2014 <your-key>, ${VAR}, {{ secret }}, xxxx, changeme, your_key_here","Values cut short or masked \u2014 sk_live_\u2026, ****, REDACTED","Anything marked fake, mock, dummy, stub, fixture or sample \u2014 in a comment beside it or in its variable name","Vendors' published example and test keys","Variable names, file paths, URLs, hashes, UUIDs and regex source","Public keys, publishable keys and IDs that are not secret"],Er=new Map;for(let e of br)for(let t of e.slugs)Er.set(t,e);function gl(e){return Er.get(e)}function Cs(e){return e===Me?"credential":Er.get(e)?.family??"credential"}function bl(e){return Cs(e)!=="pii"}function El(e){return _s[e]}var xl=br.flatMap(e=>e.slugs);function Os(e){let t=new Set;for(let n of e)if(n?.isActive)for(let r of n.rules??[])for(let o of r?.specificDomains??[]){let s=bn(o);s&&t.add(s)}return Array.from(t).sort()}function wl(e){return Os(e).filter(t=>!gn(t))}var ff=1e3,pf=100,hf=254,mf=1048576,Ms=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,kl=`Name,Email
3
+ `),t=t.replace(Wa,""),t=t.trim(),t}function ot(e){if(e.length===36&&e[8]==="-"&&e[13]==="-"&&e[18]==="-"&&e[23]==="-"){let t=e.replace(/-/g,"");if(/^[0-9a-fA-F]{32}$/.test(t))return e.toLowerCase()}return e}function Ot(e){return ot(In(e))}function st(e){return In(e).replace(/\s/g,"")}function Ka(e,t){return Mt(ot(st(e)),t)}function He(e){return st(e).toLowerCase()}function ja(e,t){return Mt(He(e),t)}function Mt(e,t){return V(ee(z,t,C(e)))}function $a(e,t){return Mt(Ot(e),t)}async function za(e,t){let n=C(e),r=z(C(t));return Ct(z,n,r,{c:eo,dkLen:Sn})}var ro="redaktyn-project-key-v1",qa=C(ro);function Ya(e,t){if(e.length!==Sn)throw new Error("deriveProjectKey: org key must be 32 bytes");if(!t)throw new Error("deriveProjectKey: projectId is required");return nt(z,e,C(t),qa,Sn)}var oo="vaultx-passphrase-verify-v1",Za=C(oo);function vn(e){return V(ee(z,e,Za))}function Xa(){return crypto.getRandomValues(new Uint8Array(32))}function Ja(e){return V(e)}function Qa(e){return Q(e)}function Rn(e){return e.length<12?{ok:!1,error:"Passphrase must be at least 12 characters."}:/[A-Z]/.test(e)?/[a-z]/.test(e)?/[0-9]/.test(e)?/[^A-Za-z0-9]/.test(e)?{ok:!0}:{ok:!1,error:"Passphrase must include at least one special character (e.g. !@#$%)."}:{ok:!1,error:"Passphrase must include at least one number."}:{ok:!1,error:"Passphrase must include at least one lowercase letter."}:{ok:!1,error:"Passphrase must include at least one uppercase letter."}}var at=["password","passphrase","letmein","welcome","monkey","dragon","qwerty","qwertyuiop","asdfgh","zxcvbn","iloveyou","sunshine","princess","football","baseball","superman","batman","master","shadow","michael","jennifer","trustno","starwars","whatever","freedom","computer","internet","samsung","google","facebook","admin","administrator","root","changeme","secret","default","login","abc","test","temp","demo","company","corporate"];function Ge(e){return e.toLowerCase().replace(/[@4]/g,"a").replace(/[3]/g,"e").replace(/[1!|]/g,"i").replace(/[0]/g,"o").replace(/[5$]/g,"s").replace(/[7]/g,"t")}function ei(e){let t=e.toLowerCase();if(/^(.)\1+$/.test(t))return!0;let n=["abcdefghijklmnopqrstuvwxyz","0123456789","qwertyuiopasdfghjklzxcvbnm"],r=t.replace(/[^a-z0-9]/g,"");if(r.length>=6){for(let o of n)if(o.includes(r)||[...o].reverse().join("").includes(r))return!0}return!1}function it(e){let t=Rn(e);if(!t.ok)return t;let r=Ge(e).replace(/[^a-z]/g,"");for(let o of at)if(r===o||r.startsWith(o)||r.endsWith(o))return{ok:!1,error:"That passphrase is built on a word attackers try first, so it would fall to the first few guesses \u2014 pick something unrelated to a common word."};return ei(e)?{ok:!1,error:"That passphrase is a repeated character or a keyboard sequence. Pick something without a predictable pattern."}:new Set(e).size<8?{ok:!1,error:"That passphrase reuses too few distinct characters. Use at least eight different ones."}:{ok:!0}}var Dt=13,ti=`You are choosing the passphrase that protects every secret in this workspace. Every guess at it has to go through our server, which allows only a few at a time, but someone who took over our server could guess offline without that limit. Make it very strong: at least ${Dt} characters (20 or more is better), never used anywhere else, mixing upper and lower case, numbers and symbols through it rather than at the end. Nobody, including Redaktyn, can reset it.`,Pt=["redaktyn","workspace","summer","winter","spring","autumn","hello","love","money","office","user"],so=6,Ut=["abcdefghijklmnopqrstuvwxyz","1234567890","qwertyuiop","asdfghjkl","zxcvbnm"];function ni(e,t){let n=e.toLowerCase(),r=Ut.flatMap(o=>[o,[...o].reverse().join("")]);for(let o=0;o+t<=n.length;o++){let s=n.slice(o,o+t);if(r.some(a=>a.includes(s)))return!0}return!1}function Tn(e){if(e.length<Dt)return{ok:!1,error:`Your own passphrase must be at least ${Dt} characters. Longer is stronger: 20 or more is better.`};if(e!==e.trim())return{ok:!1,error:"The passphrase cannot start or end with a space. It is too easy to lose when you type it again."};if(/^[=+\-@]/.test(e))return{ok:!1,error:"The passphrase cannot start with =, +, - or @."};let t=Rn(e);if(!t.ok)return t;let n=Ge(e).replace(/[^a-z]/g,"");for(let o of[...at,...Pt])if(n.includes(o))return{ok:!1,error:`That passphrase contains "${o}" (or a look-alike), which attackers try first. Leave common words out entirely.`};if(/(.)\1\1/.test(e.toLowerCase()))return{ok:!1,error:"That passphrase repeats a character three times in a row."};if(ni(e,4))return{ok:!1,error:"That passphrase contains a sequence like abcd, 1234 or qwer. Leave predictable runs out."};if(/(^|\D)(19|20)\d\d(\D|$)/.test(e))return{ok:!1,error:"That passphrase contains what looks like a year. Dates are among the first things guessed."};let r=/^[A-Za-z]+([^A-Za-z]+)$/.exec(e)??/^([^A-Za-z]+)[A-Za-z]+$/.exec(e);return r&&r[1].length<so?{ok:!1,error:`That passphrase is letters with only a few numbers or symbols added at one end, the first pattern attackers try. Mix them through it, or add at least ${so}.`}:new Set(e).size<10?{ok:!1,error:"That passphrase reuses too few characters. Use at least ten different ones."}:{ok:!0}}var ao=64,ri=16,oi=7,si=8,ai=4,ii=10,ci=32,li=17,di=6,ui=20,fi=/(?<![0-9])(?:\+?91|0)?[6-9][0-9]{9}(?![0-9])/g,pi=[/(?<![0-9])(?:(?:0[1-9]|[12][0-9]|3[01])(?:0[1-9]|1[0-2])(?:19|20)[0-9]{2}|(?:19|20)[0-9]{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12][0-9]|3[01])|(?:0[1-9]|1[0-2])(?:0[1-9]|[12][0-9]|3[01])(?:19|20)[0-9]{2})(?![0-9])/g,/(?<![0-9])(?:0?[1-9]|[12][0-9]|3[01])[-/.](?:0?[1-9]|1[0-2])[-/.](?:19|20)[0-9]{2}(?![0-9])/g,/(?<![0-9])(?:19|20)[0-9]{2}[-/.](?:0?[1-9]|1[0-2])[-/.](?:0?[1-9]|[12][0-9]|3[01])(?![0-9])/g],hi=["amit","rahul","rohit","priya","neha","pooja","vikas","sunil","anil","sanjay","ajay","vijay","suresh","ramesh","mahesh","ravi","rajesh","deepak","manoj","arjun","karan","rohan","sachin","nitin","ankit","varun","vivek","kunal","mohit","gaurav","ashish","abhishek","sandeep","sumit","anita","sunita","kavita","anjali","divya","shweta","swati","meera","sneha","pankaj","naveen","naresh","harish","ganesh","kiran","tarun","aman","akash","manish","prakash","john","david","james","robert","daniel","thomas","chris","steve","peter","sarah","emma","linda","kevin","brian","jason","alex","ahmed","mohammed","ali","omar"],mi=["prod","production","staging","develop","database","postgres","mysql","mongo","redis","oracle","pass","pwd","token","access","server","service","backup","guest","manager","support","system","india","mumbai","delhi","bangalore","london","january","february","march","april","june","july","august","september","october","november","december","monday","friday","sunday","cricket","tiger",...hi],yi=[...new Set([...at,...Pt,...mi])].filter(e=>e.length>=3).sort((e,t)=>t.length-e.length);function gi(e){if(/^[0-9a-f]+$/.test(e))return 16;let t=0;return/[a-z]/.test(e)&&(t+=26),/[0-9]/.test(e)&&(t+=10),/[!-/:-@[-`{-~]/.test(e)&&(t+=33),/[^\x00-\x7f]/.test(e)&&(t+=100),Math.max(t,2)}function bi(e,t){let n=0,r=1;for(;t+r<e.length&&e[t+r]===e[t];)r++;r>=4&&(n=r);for(let o of Ut)for(let s of[o,[...o].reverse().join("")]){let a=0;for(;t+a<e.length&&s.includes(e.slice(t,t+a+1));)a++;a>=4&&a>n&&(n=a)}return n}function Ei(e){let t=new Set;for(let n of e??[])for(let r of String(n).toLowerCase().split(/[^a-z]+/))if(r.length>=3&&t.add(Ge(r)),t.size>=ui)return[...t];return[...t]}function xi(e,t={}){let n=He(e),r=Math.log2(gi(n)),o=Ge(n),s=new Array(n.length).fill(!1),a=[],c=0,i=(d,p,u,h)=>{for(let m=d;m<d+p;m++)if(s[m])return!1;for(let m=d;m<d+p;m++)s[m]=!0;return c+=Math.min(u,p*r),a.push(h),!0};for(let d of n.matchAll(fi))i(d.index,d[0].length,ci,"a mobile phone number");for(let d of pi)for(let p of n.matchAll(d))i(p.index,p[0].length,li,"a date");for(let d of Ei(t.knownWords))for(let p=o.indexOf(d);p>=0;p=o.indexOf(d,p+1))i(p,d.length,di,"a word from the person's own details")&&(p+=d.length-1);for(let d of yi)for(let p=o.indexOf(d);p>=0;p=o.indexOf(d,p+1))i(p,d.length,ri,`the word ${d}`)&&(p+=d.length-1);for(let d of n.matchAll(/(?:19|20)\d\d/g))i(d.index,4,oi,`the year ${d[0]}`);for(let d=0;d<n.length;d++){let p=s[d]?0:bi(n,d);p>=4&&i(d,p,si,`the run ${n.slice(d,d+p)}`)&&(d+=p-1)}let f=a.some(d=>d.startsWith("the word "));for(let d=0;d<n.length;){if(s[d]){d++;continue}let p=d;for(;p<n.length&&!s[p];)p++;let u=p-d;c+=f&&u<=ai?Math.min(ii,u*r):u*r,d=p}return{guessable:c<ao,bits:Math.floor(c),patterns:a}}function wi(e){return`This value could be found by guessing.${e.patterns.length>0?` It is built from ${e.patterns.slice(0,3).join(", ")}.`:" It is short."} Redaktyn keeps only its fingerprint, but anyone who copies the key off one of your team's devices can test guesses against that fingerprint very fast, and a value like this can be found that way. A long random value cannot. If you can, change it to a random one and register that. Registering this one still stops it being pasted.`}var ki="ABCDEFGHJKLMNPQRSTUVWXYZ",Ai="abcdefghijkmnpqrstuvwxyz",Si="23456789",Bt=ki+Ai+Si,io=5,_n=5,Ii=128;function vi(e){let t=256-256%e,n=new Uint8Array(1);for(;;){globalThis.crypto.getRandomValues(n);let r=n[0]??255;if(r<t)return r%e}}function Ri(){let e=[];for(let t=0;t<io;t++){let n="";for(let r=0;r<_n;r++)n+=Bt[vi(Bt.length)];e.push(n)}return e.join("-")}function Ti(){for(;;){let e=Ri();if(!(!/[A-Z]/.test(e)||!/[a-z]/.test(e)||!/[0-9]/.test(e))&&it(e).ok)return e}}function _i(e,t){return["Redaktyn workspace passphrase","",e,"",`Created ${t.toISOString().slice(0,10)}.`,"","This passphrase derives the key your workspace's fingerprints are made with.","Redaktyn never receives it, so nobody can reset it for you.","Move it into a password manager or a safe, then delete this file.",""].join(`
4
+ `)}var Lt="Redaktyn workspace",Cn="https://passphrase.redaktyn.invalid/";function Ci(e){return`"${e.replace(/"/g,'""')}"`}function Oi(e){let t="Redaktyn workspace passphrase. Nobody can reset it. Delete this file after importing it.";for(let n of[Lt,Cn,e,t])if(/^[=+\-@\t\r]/.test(n))throw new Error("A password-manager file field cannot start with a formula character");return["name,url,username,password,note",[Lt,Cn,Lt,e,t].map(Ci).join(","),""].join(`
5
+ `)}var co='A new workspace needs a generated passphrase here: a generated one cannot be guessed, and one a person makes up often can. Use "Generate" to create one.',Mi=new RegExp(`^[${Bt}]{${_n}}(?:-[${Bt}]{${_n}}){${io-1}}$`),Di=12;function On(e){if(!Mi.test(e))return!1;let t=e.replace(/-/g,"");return new Set(t).size>=Di}function Pi(e){return On(e)?it(e):{ok:!1,error:co}}function Ui(e){return On(e)?it(e):Tn(e)}function lo(e){return!e||typeof e!="object"?!1:e.version===2}function uo(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.encryptedKey=="string"&&t.encryptedKey.length>0&&typeof t.iv=="string"&&t.iv.length>0&&typeof t.salt=="string"&&t.salt.length>0}function Li(e){return lo(e)?e:uo(e)?{version:2,passphrase:e}:null}function ct(e){let t=new ArrayBuffer(e.byteLength);return new Uint8Array(t).set(e),t}function Mn(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function Dn(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function fo(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}var Nt=32,Bi=256,Ni=12;function Hi(){return fo(Nt)}async function po(e){if(e.byteLength===0)throw new Error("PRF output is empty");let t=await crypto.subtle.digest("SHA-256",ct(e));return crypto.subtle.importKey("raw",t,{name:"AES-GCM",length:Bi},!1,["encrypt","decrypt"])}async function Gi(e,t,n,r,o){if(e.byteLength!==32)throw new Error("HMAC key must be 32 bytes");if(t.byteLength!==Nt)throw new Error("PRF output must be 32 bytes");if(n.byteLength!==Nt)throw new Error("PRF salt must be 32 bytes");if(!r)throw new Error("credentialId is required");let s=await po(t),a=fo(Ni),c=await crypto.subtle.encrypt({name:"AES-GCM",iv:ct(a)},s,ct(e)),i={credentialId:r,prfSalt:Mn(n),iv:Mn(a),ciphertext:Mn(new Uint8Array(c)),createdAt:Date.now()};return o&&o.trim().length>0&&(i.label=o.trim().slice(0,64)),i}async function Fi(e,t){if(t.byteLength!==Nt)throw new Error("PRF output must be 32 bytes");let n=await po(t),r=Dn(e.iv),o=Dn(e.ciphertext),s=await crypto.subtle.decrypt({name:"AES-GCM",iv:ct(r)},n,ct(o)),a=new Uint8Array(s);if(a.byteLength!==32)throw a.fill(0),new Error("Invalid HMAC key material");return a}function Wi(e){return Dn(e.prfSalt)}function Vi(e,t){let r=(e?.passkey??[]).filter(o=>o.credentialId!==t.credentialId);return{version:2,passphrase:e?.passphrase,passkey:[...r,t]}}function Ki(e,t){let n=e?.passkey??[];return{version:2,passphrase:e?.passphrase,passkey:n.filter(r=>r.credentialId!==t)}}function ji(e,t){return e?.passkey?.find(n=>n.credentialId===t)}var Ln=BigInt(0),Un=BigInt(1);function Ht(e,t=""){if(typeof e!="boolean"){let n=t&&`"${t}"`;throw new Error(n+"expected boolean, got type="+typeof e)}return e}function lt(e,t,n=""){let r=re(e),o=e?.length,s=t!==void 0;if(!r||s&&o!==t){let a=n&&`"${n}" `,c=s?` of length ${t}`:"",i=r?`length=${o}`:`type=${typeof e}`;throw new Error(a+"expected Uint8Array"+c+", got "+i)}return e}function Bn(e){if(typeof e!="string")throw new Error("hex string expected, got "+typeof e);return e===""?Ln:BigInt("0x"+e)}function dt(e){return Bn(V(e))}function Y(e){return L(e),Bn(V(Uint8Array.from(e).reverse()))}function Fe(e,t){return Q(e.toString(16).padStart(t*2,"0"))}function Gt(e,t){return Fe(e,t).reverse()}function K(e,t,n){let r;if(typeof t=="string")try{r=Q(t)}catch(s){throw new Error(e+" must be hex string or Uint8Array, cause: "+s)}else if(re(t))r=Uint8Array.from(t);else throw new Error(e+" must be hex string or Uint8Array");let o=r.length;if(typeof n=="number"&&o!==n)throw new Error(e+" of length "+n+" expected, got "+o);return r}function Nn(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function Ft(e){return Uint8Array.from(e)}var Pn=e=>typeof e=="bigint"&&Ln<=e;function ho(e,t,n){return Pn(e)&&Pn(t)&&Pn(n)&&t<=e&&e<n}function Wt(e,t,n,r){if(!ho(t,n,r))throw new Error("expected valid "+e+": "+n+" <= n < "+r+", got "+t)}function Hn(e){let t;for(t=0;e>Ln;e>>=Un,t+=1);return t}var We=e=>(Un<<BigInt(e))-Un;function Ve(e,t,n={}){if(!e||typeof e!="object")throw new Error("expected valid options object");function r(o,s,a){let c=e[o];if(a&&c===void 0)return;let i=typeof c;if(i!==s||c===null)throw new Error(`param "${o}" is invalid: expected ${s}, got ${i}`)}Object.entries(t).forEach(([o,s])=>r(o,s,!1)),Object.entries(n).forEach(([o,s])=>r(o,s,!0))}var Vt=()=>{throw new Error("not implemented")};function Kt(e){let t=new WeakMap;return(n,...r)=>{let o=t.get(n);if(o!==void 0)return o;let s=e(n,...r);return t.set(n,s),s}}var W=BigInt(0),N=BigInt(1),Te=BigInt(2),go=BigInt(3),bo=BigInt(4),Eo=BigInt(5),qi=BigInt(7),xo=BigInt(8),Yi=BigInt(9),wo=BigInt(16);function M(e,t){let n=e%t;return n>=W?n:t+n}function te(e,t,n){let r=e;for(;t-- >W;)r*=r,r%=n;return r}function mo(e,t){if(e===W)throw new Error("invert: expected non-zero number");if(t<=W)throw new Error("invert: expected positive modulus, got "+t);let n=M(e,t),r=t,o=W,s=N,a=N,c=W;for(;n!==W;){let f=r/n,d=r%n,p=o-a*f,u=s-c*f;r=n,n=d,o=a,s=c,a=p,c=u}if(r!==N)throw new Error("invert: does not exist");return M(o,t)}function Gn(e,t,n){if(!e.eql(e.sqr(t),n))throw new Error("Cannot find square root")}function ko(e,t){let n=(e.ORDER+N)/bo,r=e.pow(t,n);return Gn(e,r,t),r}function Zi(e,t){let n=(e.ORDER-Eo)/xo,r=e.mul(t,Te),o=e.pow(r,n),s=e.mul(t,o),a=e.mul(e.mul(s,Te),o),c=e.mul(s,e.sub(a,e.ONE));return Gn(e,c,t),c}function Xi(e){let t=ue(e),n=Ao(e),r=n(t,t.neg(t.ONE)),o=n(t,r),s=n(t,t.neg(r)),a=(e+qi)/wo;return(c,i)=>{let f=c.pow(i,a),d=c.mul(f,r),p=c.mul(f,o),u=c.mul(f,s),h=c.eql(c.sqr(d),i),m=c.eql(c.sqr(p),i);f=c.cmov(f,d,h),d=c.cmov(u,p,m);let g=c.eql(c.sqr(d),i),E=c.cmov(f,d,g);return Gn(c,E,i),E}}function Ao(e){if(e<go)throw new Error("sqrt is not defined for small field");let t=e-N,n=0;for(;t%Te===W;)t/=Te,n++;let r=Te,o=ue(e);for(;yo(o,r)===1;)if(r++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(n===1)return ko;let s=o.pow(r,t),a=(t+N)/Te;return function(i,f){if(i.is0(f))return f;if(yo(i,f)!==1)throw new Error("Cannot find square root");let d=n,p=i.mul(i.ONE,s),u=i.pow(f,t),h=i.pow(f,a);for(;!i.eql(u,i.ONE);){if(i.is0(u))return i.ZERO;let m=1,g=i.sqr(u);for(;!i.eql(g,i.ONE);)if(m++,g=i.sqr(g),m===d)throw new Error("Cannot find square root");let E=N<<BigInt(d-m-1),y=i.pow(p,E);d=m,p=i.sqr(y),u=i.mul(u,p),h=i.mul(h,y)}return h}}function Ji(e){return e%bo===go?ko:e%xo===Eo?Zi:e%wo===Yi?Xi(e):Ao(e)}var de=(e,t)=>(M(e,t)&N)===N,Qi=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function So(e){let t={ORDER:"bigint",MASK:"bigint",BYTES:"number",BITS:"number"},n=Qi.reduce((r,o)=>(r[o]="function",r),t);return Ve(e,n),e}function ec(e,t,n){if(n<W)throw new Error("invalid exponent, negatives unsupported");if(n===W)return e.ONE;if(n===N)return t;let r=e.ONE,o=t;for(;n>W;)n&N&&(r=e.mul(r,o)),o=e.sqr(o),n>>=N;return r}function jt(e,t,n=!1){let r=new Array(t.length).fill(n?e.ZERO:void 0),o=t.reduce((a,c,i)=>e.is0(c)?a:(r[i]=a,e.mul(a,c)),e.ONE),s=e.inv(o);return t.reduceRight((a,c,i)=>e.is0(c)?a:(r[i]=e.mul(a,r[i]),e.mul(a,c)),s),r}function yo(e,t){let n=(e.ORDER-N)/Te,r=e.pow(t,n),o=e.eql(r,e.ONE),s=e.eql(r,e.ZERO),a=e.eql(r,e.neg(e.ONE));if(!o&&!s&&!a)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function Io(e,t){t!==void 0&&q(t);let n=t!==void 0?t:e.toString(2).length,r=Math.ceil(n/8);return{nBitLength:n,nByteLength:r}}function ue(e,t,n=!1,r={}){if(e<=W)throw new Error("invalid field: expected ORDER > 0, got "+e);let o,s,a=!1,c;if(typeof t=="object"&&t!=null){if(r.sqrt||n)throw new Error("cannot specify opts in two arguments");let u=t;u.BITS&&(o=u.BITS),u.sqrt&&(s=u.sqrt),typeof u.isLE=="boolean"&&(n=u.isLE),typeof u.modFromBytes=="boolean"&&(a=u.modFromBytes),c=u.allowedLengths}else typeof t=="number"&&(o=t),r.sqrt&&(s=r.sqrt);let{nBitLength:i,nByteLength:f}=Io(e,o);if(f>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");let d,p=Object.freeze({ORDER:e,isLE:n,BITS:i,BYTES:f,MASK:We(i),ZERO:W,ONE:N,allowedLengths:c,create:u=>M(u,e),isValid:u=>{if(typeof u!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof u);return W<=u&&u<e},is0:u=>u===W,isValidNot0:u=>!p.is0(u)&&p.isValid(u),isOdd:u=>(u&N)===N,neg:u=>M(-u,e),eql:(u,h)=>u===h,sqr:u=>M(u*u,e),add:(u,h)=>M(u+h,e),sub:(u,h)=>M(u-h,e),mul:(u,h)=>M(u*h,e),pow:(u,h)=>ec(p,u,h),div:(u,h)=>M(u*mo(h,e),e),sqrN:u=>u*u,addN:(u,h)=>u+h,subN:(u,h)=>u-h,mulN:(u,h)=>u*h,inv:u=>mo(u,e),sqrt:s||(u=>(d||(d=Ji(e)),d(p,u))),toBytes:u=>n?Gt(u,f):Fe(u,f),fromBytes:(u,h=!0)=>{if(c){if(!c.includes(u.length)||u.length>f)throw new Error("Field.fromBytes: expected "+c+" bytes, got "+u.length);let g=new Uint8Array(f);g.set(u,n?0:g.length-u.length),u=g}if(u.length!==f)throw new Error("Field.fromBytes: expected "+f+" bytes, got "+u.length);let m=n?Y(u):dt(u);if(a&&(m=M(m,e)),!h&&!p.isValid(m))throw new Error("invalid field element: outside of range 0..ORDER");return m},invertBatch:u=>jt(p,u),cmov:(u,h,m)=>m?h:u});return Object.freeze(p)}function vo(e){if(typeof e!="bigint")throw new Error("field order must be bigint");let t=e.toString(2).length;return Math.ceil(t/8)}function Fn(e){let t=vo(e);return t+Math.ceil(t/2)}function Ro(e,t,n=!1){let r=e.length,o=vo(t),s=Fn(t);if(r<16||r<s||r>1024)throw new Error("expected "+s+"-1024 bytes of input, got "+r);let a=n?Y(e):dt(e),c=M(a,t-N)+N;return n?Gt(c,o):Fe(c,o)}var $t=BigInt(0),jn=BigInt(1);function To(e,t){let n=t.negate();return e?n:t}function ut(e,t){let n=jt(e.Fp,t.map(r=>r.Z));return t.map((r,o)=>e.fromAffine(r.toAffine(n[o])))}function Mo(e,t){if(!Number.isSafeInteger(e)||e<=0||e>t)throw new Error("invalid window size, expected [1.."+t+"], got W="+e)}function Wn(e,t){Mo(e,t);let n=Math.ceil(t/e)+1,r=2**(e-1),o=2**e,s=We(e),a=BigInt(e);return{windows:n,windowSize:r,mask:s,maxNumber:o,shiftBy:a}}function _o(e,t,n){let{windowSize:r,mask:o,maxNumber:s,shiftBy:a}=n,c=Number(e&o),i=e>>a;c>r&&(c-=s,i+=jn);let f=t*r,d=f+Math.abs(c)-1,p=c===0,u=c<0,h=t%2!==0;return{nextN:i,offset:d,isZero:p,isNeg:u,isNegF:h,offsetF:f}}function nc(e,t){if(!Array.isArray(e))throw new Error("array expected");e.forEach((n,r)=>{if(!(n instanceof t))throw new Error("invalid point at index "+r)})}function rc(e,t){if(!Array.isArray(e))throw new Error("array of scalars expected");e.forEach((n,r)=>{if(!t.isValid(n))throw new Error("invalid scalar at index "+r)})}var Vn=new WeakMap,Do=new WeakMap;function Kn(e){return Do.get(e)||1}function Co(e){if(e!==$t)throw new Error("invalid wNAF")}var zt=class{constructor(t,n){this.BASE=t.BASE,this.ZERO=t.ZERO,this.Fn=t.Fn,this.bits=n}_unsafeLadder(t,n,r=this.ZERO){let o=t;for(;n>$t;)n&jn&&(r=r.add(o)),o=o.double(),n>>=jn;return r}precomputeWindow(t,n){let{windows:r,windowSize:o}=Wn(n,this.bits),s=[],a=t,c=a;for(let i=0;i<r;i++){c=a,s.push(c);for(let f=1;f<o;f++)c=c.add(a),s.push(c);a=c.double()}return s}wNAF(t,n,r){if(!this.Fn.isValid(r))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,a=Wn(t,this.bits);for(let c=0;c<a.windows;c++){let{nextN:i,offset:f,isZero:d,isNeg:p,isNegF:u,offsetF:h}=_o(r,c,a);r=i,d?s=s.add(To(u,n[h])):o=o.add(To(p,n[f]))}return Co(r),{p:o,f:s}}wNAFUnsafe(t,n,r,o=this.ZERO){let s=Wn(t,this.bits);for(let a=0;a<s.windows&&r!==$t;a++){let{nextN:c,offset:i,isZero:f,isNeg:d}=_o(r,a,s);if(r=c,!f){let p=n[i];o=o.add(d?p.negate():p)}}return Co(r),o}getPrecomputes(t,n,r){let o=Vn.get(n);return o||(o=this.precomputeWindow(n,t),t!==1&&(typeof r=="function"&&(o=r(o)),Vn.set(n,o))),o}cached(t,n,r){let o=Kn(t);return this.wNAF(o,this.getPrecomputes(o,t,r),n)}unsafe(t,n,r,o){let s=Kn(t);return s===1?this._unsafeLadder(t,n,o):this.wNAFUnsafe(s,this.getPrecomputes(s,t,r),n,o)}createCache(t,n){Mo(n,this.bits),Do.set(t,n),Vn.delete(t)}hasCache(t){return Kn(t)!==1}};function qt(e,t,n,r){nc(n,e),rc(r,t);let o=n.length,s=r.length;if(o!==s)throw new Error("arrays of points and scalars must have equal length");let a=e.ZERO,c=Hn(BigInt(o)),i=1;c>12?i=c-3:c>4?i=c-2:c>0&&(i=2);let f=We(i),d=new Array(Number(f)+1).fill(a),p=Math.floor((t.BITS-1)/i)*i,u=a;for(let h=p;h>=0;h-=i){d.fill(a);for(let g=0;g<s;g++){let E=r[g],y=Number(E>>BigInt(h)&f);d[y]=d[y].add(n[g])}let m=a;for(let g=d.length-1,E=a;g>0;g--)E=E.add(d[g]),m=m.add(E);if(u=u.add(m),h!==0)for(let g=0;g<i;g++)u=u.double()}return u}function Oo(e,t,n){if(t){if(t.ORDER!==e)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return So(t),t}else return ue(e,{isLE:n})}function Po(e,t,n={},r){if(r===void 0&&(r=e==="edwards"),!t||typeof t!="object")throw new Error(`expected valid ${e} CURVE object`);for(let i of["p","n","h"]){let f=t[i];if(!(typeof f=="bigint"&&f>$t))throw new Error(`CURVE.${i} must be positive bigint`)}let o=Oo(t.p,n.Fp,r),s=Oo(t.n,n.Fn,r),c=["Gx","Gy","a",e==="weierstrass"?"b":"d"];for(let i of c)if(!o.isValid(t[i]))throw new Error(`CURVE.${i} must be valid field element of CURVE.Fp`);return t=Object.freeze(Object.assign({},t)),{CURVE:t,Fp:o,Fn:s}}var xe=BigInt(0),H=BigInt(1),$n=BigInt(2),oc=BigInt(8);function sc(e,t,n,r){let o=e.sqr(n),s=e.sqr(r),a=e.add(e.mul(t.a,o),s),c=e.add(e.ONE,e.mul(t.d,e.mul(o,s)));return e.eql(a,c)}function ac(e,t={}){let n=Po("edwards",e,t,t.FpFnLE),{Fp:r,Fn:o}=n,s=n.CURVE,{h:a}=s;Ve(t,{},{uvRatio:"function"});let c=$n<<BigInt(o.BYTES*8)-H,i=E=>r.create(E),f=t.uvRatio||((E,y)=>{try{return{isValid:!0,value:r.sqrt(r.div(E,y))}}catch{return{isValid:!1,value:xe}}});if(!sc(r,s,s.Gx,s.Gy))throw new Error("bad curve params: generator point");function d(E,y,w=!1){let b=w?H:xe;return Wt("coordinate "+E,y,b,c),y}function p(E){if(!(E instanceof m))throw new Error("ExtendedPoint expected")}let u=Kt((E,y)=>{let{X:w,Y:b,Z:I}=E,R=E.is0();y==null&&(y=R?oc:r.inv(I));let D=i(w*y),P=i(b*y),v=r.mul(I,y);if(R)return{x:xe,y:H};if(v!==H)throw new Error("invZ was invalid");return{x:D,y:P}}),h=Kt(E=>{let{a:y,d:w}=s;if(E.is0())throw new Error("bad point: ZERO");let{X:b,Y:I,Z:R,T:D}=E,P=i(b*b),v=i(I*I),x=i(R*R),k=i(x*x),S=i(P*y),T=i(x*i(S+v)),O=i(k+i(w*i(P*v)));if(T!==O)throw new Error("bad point: equation left != right (1)");let _=i(b*I),U=i(R*D);if(_!==U)throw new Error("bad point: equation left != right (2)");return!0});class m{constructor(y,w,b,I){this.X=d("x",y),this.Y=d("y",w),this.Z=d("z",b,!0),this.T=d("t",I),Object.freeze(this)}static CURVE(){return s}static fromAffine(y){if(y instanceof m)throw new Error("extended point not allowed");let{x:w,y:b}=y||{};return d("x",w),d("y",b),new m(w,b,H,i(w*b))}static fromBytes(y,w=!1){let b=r.BYTES,{a:I,d:R}=s;y=Ft(lt(y,b,"point")),Ht(w,"zip215");let D=Ft(y),P=y[b-1];D[b-1]=P&-129;let v=Y(D),x=w?c:r.ORDER;Wt("point.y",v,xe,x);let k=i(v*v),S=i(k-H),T=i(R*k-I),{isValid:O,value:_}=f(S,T);if(!O)throw new Error("bad point: invalid y coordinate");let U=(_&H)===H,j=(P&128)!==0;if(!w&&_===xe&&j)throw new Error("bad point: x=0 and x_0=1");return j!==U&&(_=i(-_)),m.fromAffine({x:_,y:v})}static fromHex(y,w=!1){return m.fromBytes(K("point",y),w)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(y=8,w=!0){return g.createCache(this,y),w||this.multiply($n),this}assertValidity(){h(this)}equals(y){p(y);let{X:w,Y:b,Z:I}=this,{X:R,Y:D,Z:P}=y,v=i(w*P),x=i(R*I),k=i(b*P),S=i(D*I);return v===x&&k===S}is0(){return this.equals(m.ZERO)}negate(){return new m(i(-this.X),this.Y,this.Z,i(-this.T))}double(){let{a:y}=s,{X:w,Y:b,Z:I}=this,R=i(w*w),D=i(b*b),P=i($n*i(I*I)),v=i(y*R),x=w+b,k=i(i(x*x)-R-D),S=v+D,T=S-P,O=v-D,_=i(k*T),U=i(S*O),j=i(k*O),me=i(T*S);return new m(_,U,me,j)}add(y){p(y);let{a:w,d:b}=s,{X:I,Y:R,Z:D,T:P}=this,{X:v,Y:x,Z:k,T:S}=y,T=i(I*v),O=i(R*x),_=i(P*b*S),U=i(D*k),j=i((I+R)*(v+x)-T-O),me=U-_,ke=U+_,ae=i(O-w*T),Ye=i(j*me),At=i(ke*ae),ln=i(j*ae),kr=i(me*ke);return new m(Ye,At,kr,ln)}subtract(y){return this.add(y.negate())}multiply(y){if(!o.isValidNot0(y))throw new Error("invalid scalar: expected 1 <= sc < curve.n");let{p:w,f:b}=g.cached(this,y,I=>ut(m,I));return ut(m,[w,b])[0]}multiplyUnsafe(y,w=m.ZERO){if(!o.isValid(y))throw new Error("invalid scalar: expected 0 <= sc < curve.n");return y===xe?m.ZERO:this.is0()||y===H?this:g.unsafe(this,y,b=>ut(m,b),w)}isSmallOrder(){return this.multiplyUnsafe(a).is0()}isTorsionFree(){return g.unsafe(this,s.n).is0()}toAffine(y){return u(this,y)}clearCofactor(){return a===H?this:this.multiplyUnsafe(a)}toBytes(){let{x:y,y:w}=this.toAffine(),b=r.toBytes(w);return b[b.length-1]|=y&H?128:0,b}toHex(){return V(this.toBytes())}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}get ex(){return this.X}get ey(){return this.Y}get ez(){return this.Z}get et(){return this.T}static normalizeZ(y){return ut(m,y)}static msm(y,w){return qt(m,o,y,w)}_setWindowSize(y){this.precompute(y)}toRawBytes(){return this.toBytes()}}m.BASE=new m(s.Gx,s.Gy,H,i(s.Gx*s.Gy)),m.ZERO=new m(xe,H,H,xe),m.Fp=r,m.Fn=o;let g=new zt(m,o.BITS);return m.BASE.precompute(8),m}var Yt=class{constructor(t){this.ep=t}static fromBytes(t){Vt()}static fromHex(t){Vt()}get x(){return this.toAffine().x}get y(){return this.toAffine().y}clearCofactor(){return this}assertValidity(){this.ep.assertValidity()}toAffine(t){return this.ep.toAffine(t)}toHex(){return V(this.toBytes())}toString(){return this.toHex()}isTorsionFree(){return!0}isSmallOrder(){return!1}add(t){return this.assertSame(t),this.init(this.ep.add(t.ep))}subtract(t){return this.assertSame(t),this.init(this.ep.subtract(t.ep))}multiply(t){return this.init(this.ep.multiply(t))}multiplyUnsafe(t){return this.init(this.ep.multiplyUnsafe(t))}double(){return this.init(this.ep.double())}negate(){return this.init(this.ep.negate())}precompute(t,n){return this.init(this.ep.precompute(t,n))}toRawBytes(){return this.toBytes()}};function ic(e,t,n={}){if(typeof t!="function")throw new Error('"hash" function param is required');Ve(n,{},{adjustScalarBytes:"function",randomBytes:"function",domain:"function",prehash:"function",mapToCurve:"function"});let{prehash:r}=n,{BASE:o,Fp:s,Fn:a}=e,c=n.randomBytes||Be,i=n.adjustScalarBytes||(x=>x),f=n.domain||((x,k,S)=>{if(Ht(S,"phflag"),k.length||S)throw new Error("Contexts/pre-hash are not supported");return x});function d(x){return a.create(Y(x))}function p(x){let k=b.secretKey;x=K("private key",x,k);let S=K("hashed private key",t(x),2*k),T=i(S.slice(0,k)),O=S.slice(k,2*k),_=d(T);return{head:T,prefix:O,scalar:_}}function u(x){let{head:k,prefix:S,scalar:T}=p(x),O=o.multiply(T),_=O.toBytes();return{head:k,prefix:S,scalar:T,point:O,pointBytes:_}}function h(x){return u(x).pointBytes}function m(x=Uint8Array.of(),...k){let S=B(...k);return d(t(f(S,K("context",x),!!r)))}function g(x,k,S={}){x=K("message",x),r&&(x=r(x));let{prefix:T,scalar:O,pointBytes:_}=u(k),U=m(S.context,T,x),j=o.multiply(U).toBytes(),me=m(S.context,j,_,x),ke=a.create(U+me*O);if(!a.isValid(ke))throw new Error("sign failed: invalid s");let ae=B(j,a.toBytes(ke));return lt(ae,b.signature,"result")}let E={zip215:!0};function y(x,k,S,T=E){let{context:O,zip215:_}=T,U=b.signature;x=K("signature",x,U),k=K("message",k),S=K("publicKey",S,b.publicKey),_!==void 0&&Ht(_,"zip215"),r&&(k=r(k));let j=U/2,me=x.subarray(0,j),ke=Y(x.subarray(j,U)),ae,Ye,At;try{ae=e.fromBytes(S,_),Ye=e.fromBytes(me,_),At=o.multiplyUnsafe(ke)}catch{return!1}if(!_&&ae.isSmallOrder())return!1;let ln=m(O,Ye.toBytes(),ae.toBytes(),k);return Ye.add(ae.multiplyUnsafe(ln)).subtract(At).clearCofactor().is0()}let w=s.BYTES,b={secretKey:w,publicKey:w,signature:2*w,seed:w};function I(x=c(b.seed)){return lt(x,b.seed,"seed")}function R(x){let k=v.randomSecretKey(x);return{secretKey:k,publicKey:h(k)}}function D(x){return re(x)&&x.length===a.BYTES}function P(x,k){try{return!!e.fromBytes(x,k)}catch{return!1}}let v={getExtendedPublicKey:u,randomSecretKey:I,isValidSecretKey:D,isValidPublicKey:P,toMontgomery(x){let{y:k}=e.fromBytes(x),S=b.publicKey,T=S===32;if(!T&&S!==57)throw new Error("only defined for 25519 and 448");let O=T?s.div(H+k,H-k):s.div(k-H,k+H);return s.toBytes(O)},toMontgomerySecret(x){let k=b.secretKey;lt(x,k);let S=t(x.subarray(0,k));return i(S).subarray(0,k)},randomPrivateKey:I,precompute(x=8,k=e.BASE){return k.precompute(x,!1)}};return Object.freeze({keygen:R,getPublicKey:h,sign:g,verify:y,utils:v,Point:e,lengths:b})}function cc(e){let t={a:e.a,d:e.d,p:e.Fp.ORDER,n:e.n,h:e.h,Gx:e.Gx,Gy:e.Gy},n=e.Fp,r=ue(t.n,e.nBitLength,!0),o={Fp:n,Fn:r,uvRatio:e.uvRatio},s={randomBytes:e.randomBytes,adjustScalarBytes:e.adjustScalarBytes,domain:e.domain,prehash:e.prehash,mapToCurve:e.mapToCurve};return{CURVE:t,curveOpts:o,hash:e.hash,eddsaOpts:s}}function lc(e,t){let n=t.Point;return Object.assign({},t,{ExtendedPoint:n,CURVE:e,nBitLength:n.Fn.BITS,nByteLength:n.Fn.BYTES})}function Uo(e){let{CURVE:t,curveOpts:n,hash:r,eddsaOpts:o}=cc(e),s=ac(t,n),a=ic(s,r,o);return lc(e,a)}function Ke(e,t){if(zn(e),zn(t),e<0||e>=1<<8*t)throw new Error("invalid I2OSP input: "+e);let n=Array.from({length:t}).fill(0);for(let r=t-1;r>=0;r--)n[r]=e&255,e>>>=8;return new Uint8Array(n)}function uc(e,t){let n=new Uint8Array(e.length);for(let r=0;r<e.length;r++)n[r]=e[r]^t[r];return n}function zn(e){if(!Number.isSafeInteger(e))throw new Error("number expected")}function fc(e){if(!re(e)&&typeof e!="string")throw new Error("DST must be Uint8Array or string");return typeof e=="string"?C(e):e}function qn(e,t,n,r){L(e),zn(n),t=fc(t),t.length>255&&(t=r(B(C("H2C-OVERSIZE-DST-"),t)));let{outputLen:o,blockLen:s}=r,a=Math.ceil(n/o);if(n>65535||a>255)throw new Error("expand_message_xmd: invalid lenInBytes");let c=B(t,Ke(t.length,1)),i=Ke(0,s),f=Ke(n,2),d=new Array(a),p=r(B(i,e,f,Ke(0,1),c));d[0]=r(B(p,Ke(1,1),c));for(let h=1;h<=a;h++){let m=[uc(p,d[h-1]),Ke(h+1,1),c];d[h]=r(B(...m))}return B(...d).slice(0,n)}var Lo=C("HashToScalar-");var pc=BigInt(0),fe=BigInt(1),Bo=BigInt(2),iu=BigInt(3),hc=BigInt(5),mc=BigInt(8),je=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),ft={p:je,n:BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),h:mc,a:BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),d:BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),Gx:BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),Gy:BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")};function yc(e){let t=BigInt(10),n=BigInt(20),r=BigInt(40),o=BigInt(80),s=je,c=e*e%s*e%s,i=te(c,Bo,s)*c%s,f=te(i,fe,s)*e%s,d=te(f,hc,s)*f%s,p=te(d,t,s)*d%s,u=te(p,n,s)*p%s,h=te(u,r,s)*u%s,m=te(h,o,s)*h%s,g=te(m,o,s)*h%s,E=te(g,t,s)*d%s;return{pow_p_5_8:te(E,Bo,s)*e%s,b2:c}}function gc(e){return e[0]&=248,e[31]&=127,e[31]|=64,e}var Yn=BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");function Jn(e,t){let n=je,r=M(t*t*t,n),o=M(r*r*t,n),s=yc(e*o).pow_p_5_8,a=M(e*r*s,n),c=M(t*a*a,n),i=a,f=M(a*Yn,n),d=c===e,p=c===M(-e,n),u=c===M(-e*Yn,n);return d&&(a=i),(p||u)&&(a=f),de(a,n)&&(a=M(-a,n)),{isValid:d||p,value:a}}var we=ue(ft.p,{isLE:!0}),Go=ue(ft.n,{isLE:!0}),bc={...ft,Fp:we,hash:Ne,adjustScalarBytes:gc,uvRatio:Jn},_e=Uo(bc);var Zn=Yn,Ec=BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235"),xc=BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578"),wc=BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838"),kc=BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952"),No=e=>Jn(fe,e),Ac=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),Xn=e=>_e.Point.Fp.create(Y(e)&Ac);function Ho(e){let{d:t}=ft,n=je,r=y=>we.create(y),o=r(Zn*e*e),s=r((o+fe)*wc),a=BigInt(-1),c=r((a-t*o)*r(o+t)),{isValid:i,value:f}=Jn(s,c),d=r(f*e);de(d,n)||(d=r(-d)),i||(f=d),i||(a=o);let p=r(a*(o-fe)*kc-c),u=f*f,h=r((f+f)*c),m=r(p*Ec),g=r(fe-u),E=r(fe+u);return new _e.Point(r(h*E),r(g*m),r(m*E),r(h*g))}function Fo(e){L(e,64);let t=Xn(e.subarray(0,32)),n=Ho(t),r=Xn(e.subarray(32,64)),o=Ho(r);return new se(n.add(o))}var se=class e extends Yt{constructor(t){super(t)}static fromAffine(t){return new e(_e.Point.fromAffine(t))}assertSame(t){if(!(t instanceof e))throw new Error("RistrettoPoint expected")}init(t){return new e(t)}static hashToCurve(t){return Fo(K("ristrettoHash",t,64))}static fromBytes(t){L(t,32);let{a:n,d:r}=ft,o=je,s=I=>we.create(I),a=Xn(t);if(!Nn(we.toBytes(a),t)||de(a,o))throw new Error("invalid ristretto255 encoding 1");let c=s(a*a),i=s(fe+n*c),f=s(fe-n*c),d=s(i*i),p=s(f*f),u=s(n*r*d-p),{isValid:h,value:m}=No(s(u*p)),g=s(m*f),E=s(m*g*u),y=s((a+a)*g);de(y,o)&&(y=s(-y));let w=s(i*E),b=s(y*w);if(!h||de(b,o)||w===pc)throw new Error("invalid ristretto255 encoding 2");return new e(new _e.Point(y,w,fe,b))}static fromHex(t){return e.fromBytes(K("ristrettoHex",t,32))}static msm(t,n){return qt(e,_e.Point.Fn,t,n)}toBytes(){let{X:t,Y:n,Z:r,T:o}=this.ep,s=je,a=E=>we.create(E),c=a(a(r+n)*a(r-n)),i=a(t*n),f=a(i*i),{value:d}=No(a(c*f)),p=a(d*c),u=a(d*i),h=a(p*u*o),m;if(de(o*h,s)){let E=a(n*Zn),y=a(t*Zn);t=E,n=y,m=a(p*xc)}else m=u;de(t*h,s)&&(n=a(-n));let g=a((r-n)*m);return de(g,s)&&(g=a(-g)),we.toBytes(g)}equals(t){this.assertSame(t);let{X:n,Y:r}=this.ep,{X:o,Y:s}=t.ep,a=f=>we.create(f),c=a(n*s)===a(r*o),i=a(r*s)===a(n*o);return c||i}is0(){return this.equals(e.ZERO)}};se.BASE=new se(_e.Point.BASE);se.ZERO=new se(_e.Point.ZERO);se.Fp=we;se.Fn=Go;var Wo={Point:se},Zt={hashToCurve(e,t){let n=t?.DST||"ristretto255_XMD:SHA-512_R255MAP_RO_",r=qn(e,n,64,Ne);return Fo(r)},hashToScalar(e,t={DST:Lo}){let n=qn(e,t.DST,64,Ne);return Go.create(Y(n))}};var pe=B;var Xt=Y,Vo=Fe;var Ko=Ne;var he=Wo.Point,F=he.Fn,Ce=e=>new TextEncoder().encode(e),Qn=pe(Ce("OPRFV1-"),Uint8Array.of(0),Ce("-ristretto255-SHA512")),ze=32,Sc=64;function $o(...e){let t=[];for(let n of e)if(typeof n=="string")t.push(Ce(n));else{if(n.length>65535)throw new Error("OPRF input longer than 65535 bytes");t.push(Vo(n.length,2),n)}return pe(...t)}function Ic(e){let t=Zt.hashToCurve(e,{DST:pe(Ce("HashToGroup-"),Qn)});if(t.equals(he.ZERO))throw new Error("OPRF input maps to the identity");return t}function $e(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} element must be 32 bytes`);let n=he.fromBytes(t);if(n.equals(he.ZERO))throw new Error(`OPRF ${e} element is the identity`);return n}function qe(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} must be 32 bytes`);let n=Xt(t);if(n>=F.ORDER)throw new Error(`OPRF ${e} is not a canonical scalar`);if(F.is0(n))throw new Error(`OPRF ${e} is zero`);return n}function er(){for(;;){let e=Xt(Ro(Be(Fn(F.ORDER)),F.ORDER,!0));if(!F.is0(e))return e}}function pt(e,t){let n=t?qe("blind",t):er(),r=Ic(e).multiply(n);return{blind:F.toBytes(n),blinded:r.toBytes()}}function vc(e,t){return $e("blinded",t).multiply(qe("secret key",e)).toBytes()}function ht(e,t,n){let r=$e("evaluated",n).multiply(F.inv(qe("blind",t))).toBytes();return Ko($o(e,r,"Finalize"))}function Rc(e,t){if(e.length!==32)throw new Error("OPRF key seed must be 32 bytes");let n=pe(e,$o(t),Uint8Array.of(0)),r=pe(Ce("DeriveKeyPair"),Qn);for(let o=0;o<=255;o++){n[n.length-1]=o;let s=Zt.hashToScalar(n,{DST:r});if(!F.is0(s))return F.toBytes(s)}throw new Error("Cannot derive OPRF key")}function Tc(){return F.toBytes(er())}function tr(e){try{return qe("secret key",e),!0}catch{return!1}}var Qt=64,_c=pe(Ce("DLEQ-redaktyn-v1-"),Qn);function Jt(e,t){return F.is0(t)?he.ZERO:e.multiply(t)}function jo(e,t){if(t.length!==ze)throw new Error(`OPRF ${e} must be 32 bytes`);let n=Xt(t);if(n>=F.ORDER)throw new Error(`OPRF ${e} is not a canonical scalar`);return n}function zo(e,t,n,r,o){let s=pe(e.toBytes(),t.toBytes(),n.toBytes(),r.toBytes(),o.toBytes(),Ce("Challenge"));return Zt.hashToScalar(s,{DST:_c})}function nr(e){return he.BASE.multiply(qe("secret key",e)).toBytes()}function rr(e,t){let n=qe("secret key",e),r=$e("blinded",t),o=r.multiply(n),s=he.BASE.multiply(n),a=er(),c=zo(s,r,o,he.BASE.multiply(a),r.multiply(a)),i=F.sub(a,F.mul(c,n));return{evaluated:o.toBytes(),proof:pe(F.toBytes(c),F.toBytes(i))}}function mt(e,t,n,r){try{if(r.length!==Qt)return!1;let o=$e("public key",e),s=$e("blinded",t),a=$e("evaluated",n),c=jo("proof challenge",r.subarray(0,ze)),i=jo("proof response",r.subarray(ze)),f=Jt(he.BASE,i).add(Jt(o,c)),d=Jt(s,i).add(Jt(a,c));return zo(o,s,a,f,d)===c}catch{return!1}}var sr={},qo=["redaktyn.com","www.redaktyn.com"],Z=class extends Error{constructor(t){super(t),this.name="OprfProofError"}},or=/^[0-9a-f]{64}$/;function en(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function Cc(e){return new URL(e).host.toLowerCase()}function Yo(e){let t=e.officialHosts??qo,n=e.officialPins??sr;return t.includes(e.scope.toLowerCase())&&Object.keys(n).length>0}function Oc(e={}){let t=new Map(Object.entries(e));return{entries:t,get:(n,r)=>t.get(`${n}|${r}`)??null,set:(n,r,o)=>{t.set(`${n}|${r}`,o)}}}async function tn(e,t,n){if(typeof n.proof!="string")throw new Z("This server did not prove which key it answered with. Update the server, or do not trust this connection.");let r,o;try{r=en(n.proof),o=en(n.evaluated)}catch{throw new Z("The server's answer was not understood.")}if(r.length!==Qt)throw new Z("The server's proof was not understood.");let s=e.officialPins??sr,a=Yo(e),c=a?s[n.keyId]:void 0;if(a&&!c)throw new Z(`The server answered with a key (${n.keyId}) that Redaktyn does not publish.`);if(c||(c=await e.pins.get(e.scope,n.keyId)),c){if(!or.test(c)||!mt(Q(c),t,o,r))throw new Z("The server's answer was not made with the key this workspace was set up with. It may have been changed on the way.");return c}if(e.firstUse!=="allow")throw new Z("This server's key is not one this client has been told to trust.");let i=typeof n.publicKey=="string"?n.publicKey.toLowerCase():"";if(!or.test(i)||!mt(Q(i),t,o,r))throw new Z("The server's proof did not check out.");return await e.pins.set(e.scope,n.keyId,i),i}function ar(e,t,n){let r,o;try{r=en(n.evaluated),o=en(n.proof)}catch{throw new Z("The key share's answer was not understood.")}if(!or.test(e)||!mt(Q(e),t,r,o))throw new Z("The key share's answer was not made with the key this workspace was set up with.")}var Mc=e=>V(e);var Dc=/^[A-Za-z0-9_-]{1,32}$/,Pc=/^[A-Za-z0-9+/]{43}=$/,Jo={"Access-Control-Allow-Origin":"*","Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"Content-Type, Authorization","Access-Control-Max-Age":"86400"};function Oe(e,t,n={}){return new Response(JSON.stringify(t),{status:e,headers:{"Content-Type":"application/json","Cache-Control":"no-store",...Jo,...n}})}function Uc(e,t){let n=e.length^t.length,r=Math.max(e.length,t.length);for(let o=0;o<r;o++)n|=(e.charCodeAt(o)||0)^(t.charCodeAt(o)||0);return n===0}function Zo(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function Lc(){return"shared"}var Xo=64;function Bc(e,t,n){let r=n.slice(0,Xo);if(t<1||!e)return r;let o=e.split(",").map(a=>a.trim()),s=o[o.length-t];return s?s.slice(0,Xo):r}function Nc(e){if(!tr(e.secretKey))throw new Error("The share's OPRF key is not a valid key");if(!Dc.test(e.kid))throw new Error("The share's key id must be 1-32 letters, digits, - or _");let t=Array.from(nr(e.secretKey),i=>i.toString(16).padStart(2,"0")).join(""),n=e.limits??{perMinute:20,perHour:200},r=e.now??(()=>Date.now()),o=e.clientOf??Lc,s=new Map;function a(i,f){let d=(s.get(i)??[]).filter(u=>f-u<36e5),p=d.filter(u=>f-u<60*1e3).length;if(d.length>=n.perHour||p>=n.perMinute)return s.set(i,d),!0;if(d.push(f),s.set(i,d),s.size>1e4){for(let u of s.keys())if(s.delete(u),s.size<=5e3)break}return!1}let c=(i,f)=>{try{e.onEvaluate?.({at:r(),client:i,outcome:f})}catch{}};return async i=>{let d=new URL(i.url).pathname.replace(/\/+$/,"")||"/";if(i.method==="OPTIONS")return new Response(null,{status:204,headers:Jo});if(i.method==="GET"&&(d==="/"||d==="/public-key"))return Oe(200,{kid:e.kid,publicKey:t,scheme:"ristretto255-sha512-oprf-dleq"});if(i.method==="POST"&&d==="/evaluate"){let p=o(i);if(e.token!==void 0){let m=/^Bearer (.+)$/.exec(i.headers.get("authorization")??"")?.[1]??"";if(!Uc(m,e.token))return c(p,"refused"),Oe(401,{error:"Unauthorised",code:"UNAUTHORIZED"})}let u=r();if(a(p,u))return c(p,"limited"),Oe(429,{error:"Too many attempts. Wait and try again.",code:"RATE_LIMITED"},{"Retry-After":"60"});let h;try{let m=await i.json();if(typeof m.blinded!="string"||!Pc.test(m.blinded))throw new Error("shape");h=Uint8Array.from(atob(m.blinded),g=>g.charCodeAt(0))}catch{return c(p,"invalid"),Oe(400,{error:"blinded must be a base64 32-byte element",code:"VALIDATION"})}try{let{evaluated:m,proof:g}=rr(e.secretKey,h);return c(p,"ok"),Oe(200,{kid:e.kid,evaluated:Zo(m),proof:Zo(g)})}catch{return c(p,"invalid"),Oe(400,{error:"blinded is not a valid group element",code:"VALIDATION"})}}return Oe(404,{error:"Not found",code:"NOT_FOUND"})}}var Qo=Math.round(25*Math.log2(56)),Hc=rt.toLocaleString("en-US"),Gc=[{id:"never-receive",title:"We never receive your passphrase",body:"It is typed only on a page that belongs to the extension, or in the command line, never in a web page. To open your workspace key, your device sends our server one blinded value that it cannot learn the passphrase from.",plan:"all"},{id:"cannot-work-out",title:"We cannot work it out either",body:`A generated passphrase has about ${Qo} bits of randomness, and every guess costs ${Hc} rounds of key derivation. Even holding a copy of our database and our server's key, guessing it is out of reach. One you choose yourself is held to a strength check, but cannot match that.`,plan:"all"},{id:"key-outside-database",title:"Our server's key is not in the database",body:"A copy of the database holds nothing a passphrase guess can be checked against. Every guess has to be a request our server limits, per person and per workspace.",plan:"all"},{id:"answers-are-proved",title:"Our answers are proved, not just trusted",body:"Every answer from the key-lock server carries a proof that it was made with a particular key. The extension and the command line remember the key they first met and refuse a different one, so something sitting in front of our server cannot quietly answer with a key of its own.",plan:"all"},{id:"invite-links-carry-no-passphrase",title:"Invite links never carry your passphrase",body:"A link sits in inboxes and chats for good, so it holds only a one-time key that opens one wrapped copy of the workspace key, once, on the first connection. On its own it opens nothing, and a link in the old format that carried the passphrase is refused.",plan:"all"},{id:"customer-key-server",title:"A key server you run",body:"Add a second server of your own to your workspace's lock. Opening the workspace key then needs its answer as well, so we cannot open it alone or test passphrase guesses, whatever passphrase you choose, and you can end our ability to by switching it off. If its key is ever lost, nothing can open the workspace, so keep two copies.",plan:"enterprise"},{id:"fingerprints-only",title:"We hold fingerprints, not secrets",body:"Registered secrets exist on our servers only as keyed fingerprints we cannot reverse, under a key we never hold unlocked.",plan:"all"},{id:"removed-stays-removed",title:"A person you remove stays removed",body:"A device that was removed cannot enrol itself again by syncing: every request it makes is checked against the removal, so removing someone is not undone by a laptop that is still running.",plan:"all"},{id:"checked-against-code",title:"Our claims are checked against the code",body:"What these pages say about the lock is held to the code by tests that fail when the two disagree, including the figures above.",plan:"all"}];var Fc="oprf-lock-v1",cr="redaktyn-org-key-lock-v1",ts="redaktyn-org-key-lock-v2",ns="redaktyn-org-key-lock-v3",ir="::RSK-",yt=class extends Error{constructor(){super("This workspace also needs its Secret Key, which was shown when it was set up and is in your recovery codes."),this.name="SecretKeyNeededError"}};function Wc(){let e=globalThis.crypto.getRandomValues(new Uint8Array(16));return`RSK-${Array.from(e,t=>t.toString(16).padStart(2,"0")).join("")}`}function rn(e){let t=e.trim().toLowerCase().replace(/^rsk-/,"").replace(/[^0-9a-f]/g,"");if(t.length!==32)return null;let n=new Uint8Array(16);for(let r=0;r<16;r++)n[r]=parseInt(t.slice(r*2,r*2+2),16);return n}function lr(e){let t=e.lastIndexOf(ir);if(t<=0)return{passphrase:e,secretKey:null};let n=`RSK-${e.slice(t+ir.length)}`;return rn(n)?{passphrase:e.slice(0,t),secretKey:n}:{passphrase:e,secretKey:null}}function Vc(e,t){return!t||lr(e).secretKey?e:`${e}${ir}${t.replace(/^RSK-/i,"")}`}var nn=class extends Error{constructor(t="This workspace's key needs your key-share server, and it could not be reached."){super(t),this.name="KeyShareUnavailableError"}};function gt(e){let t="";for(let n of e)t+=String.fromCharCode(n);return btoa(t)}function bt(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function dr(){let e=globalThis.crypto?.subtle;if(!e)throw new Error("Web Crypto is not available");return e}function Et(e){let t=new Uint8Array(new ArrayBuffer(e.byteLength));return t.set(e),t}var rs=(e,t,n,r)=>Et(C(n?`${ts}|${e}|${t}|${n.url}|${n.kid}|${n.publicKey}`:r?`${ns}|${e}|${t}`:`${cr}|${e}|${t}`));async function os(e,t){return Ct(z,C(e),z(C(`${cr}|${t}`)),{c:rt,dkLen:32})}async function ss(e,t,n,r,o,s){if(o&&s)throw new Error("A lock takes a key share or a Secret Key, not both");if(o&&!n.evaluateShare)throw new nn;let a=await os(e,t),c=[];try{let i=pt(a),f=o?pt(a):null,[d,p]=await Promise.all([n.evaluate({blinded:gt(i.blinded),...r?{keyId:r}:{}}),o&&f?n.evaluateShare({share:o,blinded:gt(f.blinded)}):Promise.resolve(null)]);if(r&&d.keyId!==r)throw new Error("The server answered with a different key than the lock uses");await tn(n.trust,i.blinded,d);let u=ht(a,i.blind,bt(d.evaluated));c.push(u),i.blind.fill(0);let h=u,m=`${cr}|kek`;if(o&&f&&p){ar(o.publicKey,f.blinded,p);let y=ht(a,f.blind,bt(p.evaluated));c.push(y),f.blind.fill(0),h=B(u,y),c.push(h),m=`${ts}|kek`}s&&(h=B(u,s),c.push(h),m=`${ns}|kek`);let g=nt(z,h,C(t),C(m),32),E=await dr().importKey("raw",Et(g),{name:"AES-GCM"},!1,["encrypt","decrypt"]);return g.fill(0),{key:E,keyId:d.keyId}}finally{for(let i of c)i.fill(0);a.fill(0)}}function as(){let e=new Uint8Array(32);return globalThis.crypto.getRandomValues(e),e}async function is(e,t,n,r,o,s){if(e.byteLength!==32)throw new Error("An org key is 32 bytes");let a=s?rn(s):void 0;if(s&&!a)throw new Error("That is not a Secret Key");let{key:c,keyId:i}=await ss(t,n,r,void 0,o,a??void 0),f=globalThis.crypto.getRandomValues(new Uint8Array(12)),d=new Uint8Array(await dr().encrypt({name:"AES-GCM",iv:f,additionalData:rs(n,i,o,a??void 0)},c,Et(e))),p={keyId:i,iv:gt(f),ciphertext:gt(d)};return a?{v:3,...p}:o?{v:2,...p,share:{url:o.url,kid:o.kid,publicKey:o.publicKey}}:{v:1,...p}}async function Kc(e,t,n,r){if(!ls(e))throw new Error("Not an org key lock");let o=e.v===2?e.share:void 0,s=t,a;if(e.v===3){let f=lr(t);s=f.passphrase;let d=f.secretKey??r.secretKey;if(!d)throw new yt;if(a=rn(d)??void 0,!a)throw new yt}let{key:c}=await ss(s,n,r,e.keyId,o,a),i;try{i=new Uint8Array(await dr().decrypt({name:"AES-GCM",iv:Et(bt(e.iv)),additionalData:rs(n,e.keyId,o,a)},c,Et(bt(e.ciphertext))))}catch{return null}if(i.byteLength!==32)throw i.fill(0),new Error("An org key lock did not hold a 32-byte key");return i}async function jc(e,t,n,r,o){let s=as(),a=await is(s,e,t,n,r,o);return{orgKey:s,lock:a,verifier:vn(s)}}var es="redaktyn-device-envelope-v1";async function $c(e,t,n,r){let o=await os(e,t),s=null;try{let a=pt(o);try{let c=await n.evaluate({blinded:gt(a.blinded),...r?{keyId:r}:{}});if(r&&c.keyId!==r)throw new Error("The server answered with a different key than this browser's copy uses");await tn(n.trust,a.blinded,c),s=ht(o,a.blind,bt(c.evaluated));let i=nt(z,s,C(t),C(`${es}|kek`),32),f=Array.from(i,d=>d.toString(16).padStart(2,"0")).join("");return i.fill(0),{credential:`${es}:${f}`,keyId:c.keyId}}finally{a.blind.fill(0)}}finally{s?.fill(0),o.fill(0)}}function cs(e){if(!e||typeof e!="object")return!1;let t=e;if(typeof t.url!="string"||t.url.length>200||typeof t.kid!="string"||!/^[A-Za-z0-9_-]{1,32}$/.test(t.kid)||typeof t.publicKey!="string"||!/^[0-9a-f]{64}$/.test(t.publicKey))return!1;let n;try{n=new URL(t.url)}catch{return!1}let r=n.hostname==="localhost"||n.hostname==="127.0.0.1"||n.hostname==="[::1]";return!(n.protocol!=="https:"&&!(n.protocol==="http:"&&r)||n.username||n.password||n.search||n.hash)}function ls(e){if(!e||typeof e!="object")return!1;let t=e;return typeof t.keyId=="string"&&/^[A-Za-z0-9_-]{1,32}$/.test(t.keyId)&&typeof t.iv=="string"&&t.iv.length===16&&typeof t.ciphertext=="string"&&t.ciphertext.length===64?t.v===1||t.v===3?t.share===void 0:t.v===2&&cs(t.share):!1}var $u=864e5;function zc(e,t,n,r){let o=new Set(t.map(a=>a.id));if(n&&Array.isArray(n.held)&&r-n.since>=0&&r-n.since<864e5){let a=n.held.filter(c=>!o.has(c.id));return a.length===0?{list:[...t],hold:null}:{list:[...t,...a],hold:{held:a,since:n.since}}}if(n)return{list:[...t],hold:null};let s=e.filter(a=>!o.has(a.id));return s.length>=3&&s.length*2>=e.length?{list:[...t,...s],hold:{held:s,since:r}}:{list:[...t],hold:null}}var qc=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/;function Yc(e){let t=e.split(/\r?\n/),n=[],r=0,o=0;for(let s of t){if(r>0||o>0){if(s.startsWith("\\"))continue;if(s.startsWith("+")){n.push(s.slice(1)),o--;continue}if(s.startsWith("-")){r--;continue}if(s.startsWith(" ")){r--,o--;continue}r=0,o=0}let a=qc.exec(s);if(a){r=a[1]===void 0?1:Number(a[1]),o=a[2]===void 0?1:Number(a[2]);continue}s.startsWith("+++")||s.startsWith("---")||s.startsWith("+")&&n.push(s.slice(1))}return n.join(`
6
+ `)}var ds="redaktyn-scan-prefilter-v1",us="v1.",fs=65535,xt=Math.imul,fr=fs+1,ps=/^v1\.[0-9a-f]{12}$/;function hs(e){if(e.length<4)throw new Error("scanPrefilterParams: seed too short");return{base:e[0]<<24|e[1]<<16|e[2]<<8|e[3]|1}}function ms(e){return ee(z,e,C(ds))}function Zc(e){return(e>=65&&e<=90?e+32:e)+1}function ys(e){let t=new Int32Array(e.length);for(let n=0;n<e.length;n++)t[n]=Zc(e.charCodeAt(n));return t}function Xc(e,t){let n=1,r=e|0,o=t;for(;o>0;)o&1&&(n=xt(n,r)),r=xt(r,r),o>>>=1;return n}function gs(e,t,n,r){let o=0;for(let s=n;s<n+r;s++)o=xt(o,e)+t[s]|0;return o}function on(e,t){return gs(e.base,ys(t),0,t.length)>>>16}function Jc(e,t,n){let r=e.base,o=Xc(r,n-1),s=-2,a=0;return c=>(c===s+1?a=xt(a-xt(t[s],o)|0,r)+t[s+n]|0:a=gs(r,t,c,n),s=c,a>>>16)}function ur(e){return(e&fs).toString(16).padStart(4,"0")}function bs(e,t){return us+ur(on(e,t.exact))+ur(on(e,t.collapsed))+ur(on(e,t.lower))}function Qc(e,t){return bs(hs(ms(t)),{exact:Ot(e),collapsed:ot(st(e)),lower:He(e)})}function pr(e){if(typeof e!="string"||!ps.test(e))return null;let t=e.slice(us.length);return{exact:parseInt(t.slice(0,4),16),collapsed:parseInt(t.slice(4,8),16),lower:parseInt(t.slice(8,12),16)}}var an=15e7,wt=50*1024*1024,Es=256,xs=5e4,ws=1e4;function ks(e){return pr(e.scanPrefilter)!==null}function hr(e,t=!1){let n=[new Map,new Map,new Map],r=(o,s,a)=>{if(typeof s!="number"||!(s>0))return;let c=n[o].get(s);n[o].set(s,c?{windowLen:s,prefiltered:c.prefiltered&&a,entries:c.entries+1}:{windowLen:s,prefiltered:a,entries:1})};for(let o of e){let s=t||ks(o);r(0,o.length,s),r(1,o.lengthStripped,s),r(2,o.lengthLower,s)}return n.flatMap(o=>[...o.values()])}function mr(e,t){let n=0;for(let r of t){let o=Math.max(0,e-r.windowLen+1);n+=r.prefiltered?Math.ceil(o/Es)+Math.ceil(o*r.entries/fr):o}return n}function sn(e){if(e.length===0)return 1/0;if(mr(wt,e)<=an)return wt;let t=0,n=wt;for(;t<n;){let r=Math.ceil((t+n)/2);mr(r,e)<=an?t=r:n=r-1}return t}function el(e){let t=new Set,n=new Set,r=new Set;for(let o of e)o.length>0&&t.add(o.length),typeof o.lengthStripped=="number"&&o.lengthStripped>0&&n.add(o.lengthStripped),typeof o.lengthLower=="number"&&o.lengthLower>0&&r.add(o.lengthLower);return[...t,...n,...r]}function tl(e){let t=e.length;if(t===0)return 1/0;let n=e.reduce((r,o)=>r+o,0);return Math.max(0,Math.floor((an+n-t)/t))}function nl(e){let t=hr(e),n=sn(t),o={windowLen:t.length?Math.round(t.reduce((a,c)=>a+c.windowLen,0)/t.length):40,prefiltered:!0,entries:1},s=sn([...t,o,o,o]);return{windowLengths:t.length,maxPasteChars:n,severity:n<ws?"alarm":n<xs?"warn":"ok",maxPasteCharsAfterOneMore:s,legacySecrets:e.filter(a=>!ks(a)).length,maxPasteCharsIfReenrolled:sn(hr(e,!0)),atCharacterCap:n===wt}}var nf=200;var kt={"stripe-live-secret":"Stripe live secret key","stripe-restricted-live":"Stripe restricted live key","stripe-test":"Stripe test key","stripe-publishable":"Stripe publishable key","github-pat":"GitHub personal access token","github-oauth":"GitHub OAuth token","github-app":"GitHub app token","github-fine-grained":"GitHub fine-grained token","npm-token":"npm access token","aws-access-key-id":"AWS access key ID","google-api-key":"Google API key","anthropic-api-key":"Anthropic API key","openai-api-key":"OpenAI API key","gitlab-pat":"GitLab personal access token","slack-token":"Slack token","slack-app-token":"Slack app token","shopify-token":"Shopify access token","digitalocean-token":"DigitalOcean token","huggingface-token":"Hugging Face token","stripe-webhook-secret":"Stripe webhook signing secret","openrouter-api-key":"OpenRouter API key","groq-api-key":"Groq API key","xai-api-key":"xAI API key","perplexity-api-key":"Perplexity API key","replicate-token":"Replicate API token","google-oauth-client-secret":"Google OAuth client secret","azure-ad-client-secret":"Azure AD client secret","gitlab-token":"GitLab token","slack-webhook":"Slack webhook URL","discord-webhook":"Discord webhook URL","discord-bot-token":"Discord bot token","telegram-bot-token":"Telegram bot token","sendgrid-api-key":"SendGrid API key","twilio-api-key":"Twilio API key","mailgun-api-key":"Mailgun API key","mailchimp-api-key":"Mailchimp API key","pypi-token":"PyPI upload token","docker-hub-token":"Docker Hub access token","vault-token":"HashiCorp Vault token","terraform-cloud-token":"Terraform Cloud token","doppler-token":"Doppler token","linear-api-key":"Linear API key","notion-token":"Notion integration token","airtable-token":"Airtable personal access token","atlassian-api-token":"Atlassian API token","square-token":"Square access token","sentry-token":"Sentry auth token","new-relic-key":"New Relic API key","grafana-token":"Grafana token","postman-api-key":"Postman API key","supabase-token":"Supabase secret key","supabase-publishable":"Supabase publishable key","netlify-token":"Netlify access token","age-secret-key":"age secret key","private-key":"Private key","connection-string-password":"Password in a connection string","neon-db-password":"Neon database password","assigned-secret":"Value assigned to a credential name","aws-secret-access-key":"AWS secret access key","aws-session-token":"AWS session token","gcp-service-account-key":"Google Cloud service-account key","azure-storage-key":"Azure storage account key","cloudflare-api-token":"Cloudflare API token","cloud-provider-token":"Cloud platform token","hyperscaler-access-key":"Cloud access key (Alibaba, Tencent, IBM, Oracle)","bitbucket-token":"Bitbucket token","ci-token":"CI/CD token","package-registry-token":"Package registry token","pulumi-token":"Pulumi access token","managed-db-token":"Managed database token","jdbc-ado-password":"Password in a JDBC or ADO.NET connection string","warehouse-credential":"Data warehouse credential","payment-provider-secret":"Payment gateway secret","commerce-token":"Commerce platform token","llm-provider-key":"AI provider API key","email-provider-key":"Email provider key","sms-provider-secret":"SMS or voice provider secret","productivity-saas-token":"Productivity SaaS token","observability-key":"Monitoring or logging key","signing-secret":"Signing or encryption secret","oauth-client-secret":"OAuth client secret","long-lived-jwt":"Long-lived JWT","http-basic-auth":"HTTP basic-auth credentials","session-cookie":"Session cookie","config-password":"Password in configuration","crypto-wallet-secret":"Crypto wallet key or seed phrase","vpn-private-key":"VPN private key","env-file":"Secrets in an .env file","kubeconfig-credential":"Kubernetes config credential","k8s-secret-manifest":"Kubernetes Secret value","terraform-secret":"Secret in Terraform state or variables","credential-file":"Credentials file (.npmrc, .netrc, docker, git)","presigned-url":"Pre-signed URL that is still valid","payment-card-number":"Payment card number","aadhaar-number":"Aadhaar number","india-tax-id":"PAN or personal GSTIN","national-id-number":"SSN or National Insurance number","bank-account-details":"Bank account details","customer-data-dump":"Customer data export"},As=Object.keys(kt),Me="unrecognised",rl="assigned-secret",Ss=[...As,Me];function ol(e){return Ss.includes(e)}function yr(e){return e===Me?"Unrecognised credential":kt[e]??e}var sl=new Set(["payment-card-number","aadhaar-number","india-tax-id","national-id-number","bank-account-details","customer-data-dump"]),al=new Set(["private-key","vpn-private-key","age-secret-key"]),il=new Set(["crypto-wallet-secret"]),cl=["Create a replacement credential at the provider. Leave the old one working for now.","Switch everything that uses it (services, CI settings, teammates' environment files) to the new value, and check that each one still works.","Revoke the old credential at the provider. Until you do, a copy that was shared anywhere else still works.","Register the new value in Redaktyn so it is protected the same way, then remove the old fingerprint here."],ll=["Generate a new key pair.","Put the new public key everywhere the old one is authorised (servers, services, allow-lists), and check access with the new private key.","Remove the old public key from those places, so the old private key stops working.","Register the new private key in Redaktyn so it is protected the same way, then remove the old fingerprint here."],dl=["A wallet key or seed phrase cannot be changed, only replaced.","Create a new wallet, ideally on a device you trust.","Move the funds and any approvals to the new wallet.","Stop using the old wallet. Register the new key in Redaktyn if you want it protected."],Is=[{label:"Stripe documentation: API keys",url:"https://docs.stripe.com/keys"},{label:"Stripe Dashboard: API keys",url:"https://dashboard.stripe.com/apikeys"}],vs=[{label:"GitHub documentation: managing your personal access tokens",url:"https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens"}],gr=[{label:"AWS documentation: IAM access keys",url:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"}],Rs=[{label:"Slack: your apps",url:"https://api.slack.com/apps"}],Ts={"stripe-live-secret":{links:Is,tips:["Stripe lets you roll a key and expire the old one once your services have moved to the new one."]},"stripe-restricted-live":{links:Is,tips:["Stripe lets you roll a key and expire the old one once your services have moved to the new one."]},"github-pat":{links:vs},"github-fine-grained":{links:vs},"gitlab-pat":{links:[{label:"GitLab documentation: personal access tokens",url:"https://docs.gitlab.com/user/profile/personal_access_tokens/"}],tips:["GitLab lets you rotate a personal access token as well as revoke it."]},"npm-token":{links:[{label:"npm documentation: revoking access tokens",url:"https://docs.npmjs.com/revoking-access-tokens/"}]},"aws-access-key-id":{links:gr},"aws-secret-access-key":{links:gr},"aws-session-token":{links:gr},"anthropic-api-key":{links:[{label:"Anthropic console: API keys",url:"https://platform.claude.com/settings/keys"}]},"google-api-key":{links:[{label:"Google Cloud console: credentials",url:"https://console.cloud.google.com/apis/credentials"}]},"slack-token":{links:Rs},"slack-app-token":{links:Rs},"sendgrid-api-key":{links:[{label:"SendGrid documentation: API keys",url:"https://www.twilio.com/docs/sendgrid/ui/account-and-settings/api-keys"}]},"huggingface-token":{links:[{label:"Hugging Face: access tokens",url:"https://huggingface.co/settings/tokens"}]},"pypi-token":{links:[{label:"PyPI: API tokens",url:"https://pypi.org/manage/account/token/"}]},"digitalocean-token":{links:[{label:"DigitalOcean: API tokens",url:"https://cloud.digitalocean.com/account/api/tokens"}]},"docker-hub-token":{links:[{label:"Docker Hub: security settings",url:"https://hub.docker.com/settings/security"}]}},ul=["docs.stripe.com","dashboard.stripe.com","docs.github.com","docs.gitlab.com","docs.npmjs.com","docs.aws.amazon.com","platform.claude.com","console.cloud.google.com","api.slack.com","www.twilio.com","huggingface.co","pypi.org","cloud.digitalocean.com","hub.docker.com"],fl=Object.keys(Ts);function pl(e){if(e&&sl.has(e))return null;let t=e&&e!==Me&&Object.prototype.hasOwnProperty.call(kt,e)?e:null,n=t&&il.has(t)?"wallet":t&&al.has(t)?"keypair":"credential",r=n==="wallet"?dl:n==="keypair"?ll:cl,o=t?Ts[t]:void 0;return{slug:e??null,provider:t?yr(t):null,kind:n,steps:r,tips:o?.tips??[],links:o?.links??[]}}var _s={credential:"Credentials",infra:"Infrastructure",pii:"Personal data"},hl={credential:"Keys, tokens and passwords that grant access to something. An admin can protect one on the spot, and the next paste of it is blocked.",infra:"Files that carry credentials in bulk \u2014 an .env dump, a kubeconfig, a Terraform state file. One paste can hand over a whole environment.",pii:"Card, identity and bank numbers that belong to people, not to the org. Never protected, only removed from the message."},ml={checksum:"Checksum verified",structure:"Structure decoded",prefix:"Provider format",context:"Named and random"},A=(e,t,n,r,o)=>({id:e,family:t,name:n,slugs:r,...o}),br=[A(1,"credential","AWS access keys",["aws-access-key-id","aws-secret-access-key"],{proof:"prefix",catches:"AKIA\u2026 access key IDs, and the 40-character secret access key beside them in a credentials file, an env var or a chat message.",ignores:"AWS's documented example keys (AKIAIOSFODNN7EXAMPLE), ARNs and account IDs."}),A(2,"credential","AWS session tokens",["aws-session-token"],{proof:"prefix",catches:"Temporary STS session tokens (IQoJb3JpZ2lu\u2026, FwoGZXIvYXdz\u2026) copied out of a console or a CLI profile.",ignores:"Tokens cut short with an ellipsis, and placeholders."}),A(3,"credential","Google Cloud credentials",["gcp-service-account-key","google-api-key"],{proof:"structure",catches:"Service-account JSON files whose private key is a real key, and AIza\u2026 API keys.",ignores:"Service-account JSON with a truncated or random-filler private key, and AIza followed by filler."}),A(4,"credential","Azure storage keys",["azure-storage-key"],{proof:"context",catches:"AccountKey= and SharedAccessKey= inside Azure Storage, Service Bus and Event Hubs connection strings.",ignores:"The public Azurite emulator key (devstoreaccount1) and <your-account-key> placeholders."}),A(5,"credential","Azure AD client secrets",["azure-ad-client-secret"],{proof:"prefix",catches:"Entra ID app client secrets \u2014 the 40-character values with Q~ at position four.",ignores:"Tenant and client IDs, which are GUIDs and not secret."}),A(6,"credential","Cloudflare tokens",["cloudflare-api-token"],{proof:"context",catches:"Cloudflare API tokens assigned to a Cloudflare variable, and v1.0- origin CA keys.",ignores:"Zone and account IDs."}),A(7,"credential","Developer cloud tokens",["digitalocean-token","netlify-token","cloud-provider-token"],{proof:"prefix",catches:"DigitalOcean (dop_v1_), Netlify (nfp_), Heroku (HRKU-), Fly.io (fo1_), Render (rnd_) and Vercel tokens.",ignores:"App names and region settings, and tokens made of filler characters."}),A(8,"credential","Other cloud access keys",["hyperscaler-access-key"],{proof:"prefix",catches:"Alibaba Cloud (LTAI\u2026), Tencent Cloud (AKID\u2026) and IBM Cloud API keys.",ignores:"Region names and other configuration that sits next to them."}),A(9,"credential","GitHub tokens",["github-pat","github-oauth","github-app","github-fine-grained"],{proof:"checksum",catches:"Classic and fine-grained personal access tokens, OAuth tokens and app tokens (ghp_, gho_, ghs_, github_pat_) \u2014 each carries a CRC32 checksum, and it has to verify.",ignores:"Strings shaped like a GitHub token whose checksum fails, ${{ secrets.GITHUB_TOKEN }} references, and repository URLs."}),A(10,"credential","GitLab tokens",["gitlab-pat","gitlab-token"],{proof:"prefix",catches:"GitLab personal access tokens (glpat-) and runner tokens (glrt-).",ignores:"GitLab URLs and filler tokens."}),A(11,"credential","Bitbucket and Atlassian tokens",["atlassian-api-token","bitbucket-token"],{proof:"prefix",catches:"Atlassian API tokens (ATATT\u2026), Bitbucket app passwords and access tokens (ATBB\u2026).",ignores:"Jira and Confluence site URLs."}),A(12,"credential","CI/CD tokens",["ci-token"],{proof:"prefix",catches:"CircleCI (CCIPAT_), Buildkite (bkua_) and Jenkins API tokens.",ignores:"Build numbers, job URLs and pipeline names."}),A(13,"credential","Package registry tokens",["npm-token","pypi-token","docker-hub-token","package-registry-token"],{proof:"checksum",catches:"npm tokens (npm_, checksum-verified), PyPI upload tokens, Docker Hub PATs (dckr_pat_), RubyGems and NuGet keys.",ignores:"npm-shaped tokens whose checksum fails, and registry URLs."}),A(14,"credential","Infrastructure-as-code and secret-manager tokens",["vault-token","terraform-cloud-token","doppler-token","pulumi-token"],{proof:"prefix",catches:"HashiCorp Vault tokens (hvs.), Terraform Cloud tokens (.atlasv1.), Doppler (dp.st.) and Pulumi (pul-) tokens.",ignores:"Vault addresses and workspace names."}),A(15,"credential","Database connection strings",["connection-string-password"],{proof:"context",catches:"The password inside a postgres://, mysql://, mongodb+srv://, redis:// or amqp:// URL pointing at a real host.",ignores:"localhost and example.com hosts, user:password, ${DB_PASSWORD} references and <password> placeholders."}),A(16,"credential","Managed database tokens",["neon-db-password","supabase-token","supabase-publishable","managed-db-token"],{proof:"prefix",catches:"Neon passwords (npg_), Supabase service and secret keys (sbp_, sb_secret_), PlanetScale and Upstash tokens.",ignores:"Supabase publishable keys, which are meant to be public, and project IDs."}),A(17,"credential","JDBC and ADO.NET passwords",["jdbc-ado-password"],{proof:"context",catches:"password= and Password= inside JDBC URLs and SQL Server / ADO.NET connection strings.",ignores:"Password=password, ${SA_PASSWORD} and <your_password>."}),A(18,"credential","Data warehouse credentials",["warehouse-credential"],{proof:"prefix",catches:"Databricks tokens (dapi\u2026), and Snowflake and ClickHouse passwords.",ignores:"Account locators and warehouse names."}),A(19,"credential","Stripe keys",["stripe-live-secret","stripe-restricted-live","stripe-webhook-secret","stripe-test","stripe-publishable"],{proof:"prefix",catches:"Live secret keys (sk_live_), restricted live keys (rk_live_) and webhook signing secrets (whsec_).",ignores:"Test-mode keys, publishable keys (pk_), which are public, and keys cut short with an ellipsis."}),A(20,"credential","Payment gateway secrets",["square-token","payment-provider-secret"],{proof:"prefix",catches:"Square access tokens, Braintree production tokens, Plaid production secrets, Razorpay key secrets and PayPal client secrets.",ignores:"Razorpay key IDs on their own, test-mode and sandbox keys."}),A(21,"credential","Commerce platform tokens",["shopify-token","commerce-token"],{proof:"prefix",catches:"Shopify admin tokens (shpat_), WooCommerce consumer keys (ck_) and BigCommerce access tokens.",ignores:"Store domains and all-zero filler tokens."}),A(22,"credential","OpenAI keys",["openai-api-key"],{proof:"prefix",catches:"Project keys (sk-proj-\u2026 with the T3BlbkFJ marker) and legacy sk- keys.",ignores:"Model names, sk-abcdef\u2026 keyboard strings and keys masked as sk-\u2026a1B2."}),A(23,"credential","Anthropic keys",["anthropic-api-key"],{proof:"prefix",catches:"Anthropic API keys (sk-ant-api03-\u2026AA).",ignores:"Model names and sk-ant-\u2026 placeholders."}),A(24,"credential","Other AI provider keys",["groq-api-key","xai-api-key","perplexity-api-key","replicate-token","huggingface-token","openrouter-api-key","llm-provider-key"],{proof:"prefix",catches:"Groq, xAI, Perplexity, Replicate, Hugging Face, OpenRouter, DeepSeek, LangSmith and Mistral keys.",ignores:"Cache paths like HF_HOME and filler tokens."}),A(25,"credential","Slack tokens and webhooks",["slack-token","slack-app-token","slack-webhook"],{proof:"prefix",catches:"Bot, user and app tokens (xoxb-, xoxp-, xapp-) and incoming webhook URLs.",ignores:"Slack's documented placeholder bot token, and channel names."}),A(26,"credential","Discord and Telegram bots",["discord-webhook","discord-bot-token","telegram-bot-token"],{proof:"structure",catches:"Discord webhook URLs and bot tokens, and Telegram bot tokens (a bot ID, a colon, then AA\u2026).",ignores:"Guild and channel IDs."}),A(27,"credential","Email provider keys",["sendgrid-api-key","mailgun-api-key","mailchimp-api-key","email-provider-key"],{proof:"prefix",catches:"SendGrid (SG.), Mailgun (key-), Mailchimp (\u2026-us1), Resend (re_), Brevo (xkeysib-) and Postmark keys.",ignores:"SMTP hosts and sender addresses."}),A(28,"credential","SMS and voice provider secrets",["twilio-api-key","sms-provider-secret"],{proof:"context",catches:"Twilio API keys (SK\u2026) and auth tokens, and MSG91 auth keys.",ignores:"Account SIDs and phone numbers on their own."}),A(29,"credential","Productivity SaaS tokens",["linear-api-key","notion-token","airtable-token","postman-api-key","productivity-saas-token"],{proof:"prefix",catches:"Linear, Notion, Airtable, Postman, HubSpot, Figma, Asana and Zendesk tokens.",ignores:"Database and page IDs, which are not secret."}),A(30,"credential","Monitoring and logging keys",["sentry-token","new-relic-key","grafana-token","observability-key"],{proof:"prefix",catches:"Sentry auth tokens, New Relic (NRAK-), Grafana service accounts (glsa_), Dynatrace, PostHog personal keys and Datadog API keys.",ignores:"Sentry DSNs and PostHog project keys, which are designed to ship in browser code."}),A(31,"credential","Private keys (PEM, OpenSSH, PGP)",["private-key"],{proof:"structure",catches:"RSA, EC, PKCS#8, OpenSSH and PGP private key blocks whose body decodes to a real key.",ignores:"Public keys and certificates, key blocks with ... for a body, and blocks filled with random text."}),A(32,"credential","Signing and encryption secrets",["signing-secret"],{proof:"context",catches:"JWT_SECRET, SECRET_KEY_BASE, NEXTAUTH_SECRET, Django SECRET_KEY and similar, when the value is random.",ignores:"changeme, algorithm names like HS256 and expiry settings."}),A(33,"credential","OAuth client secrets",["google-oauth-client-secret","oauth-client-secret"],{proof:"prefix",catches:"Google client secrets (GOCSPX-) and refresh tokens, and Okta, Auth0 and generic client_secret values.",ignores:"Client IDs, which are public."}),A(34,"credential","Long-lived JWTs",["long-lived-jwt"],{proof:"structure",catches:"Signed JWTs that are still valid for a long time \u2014 service-role keys, service-account tokens, tokens that never expire.",ignores:"Expired tokens, short-lived session tokens, Supabase anon keys and the jwt.io sample token."}),A(35,"credential","Basic auth and session cookies",["http-basic-auth","session-cookie"],{proof:"structure",catches:"Authorization: Basic headers that decode to user:password, curl -u credentials, and login session cookies.",ignores:"Analytics and preference cookies, and user:pass examples."}),A(36,"credential","Passwords in configuration",["config-password","assigned-secret"],{proof:"context",catches:"Values assigned to DB_PASSWORD, API_TOKEN, password: and their kin in env files, YAML and code, when they are random enough to be real.",ignores:"********, length settings, keyboard walks like qwertyuiop123, and placeholders."}),A(37,"credential","Crypto wallet keys and seed phrases",["crypto-wallet-secret"],{proof:"checksum",catches:"BIP39 recovery phrases whose checksum word verifies, WIF and xprv keys (Base58Check) and raw Ethereum private keys.",ignores:"The abandon \u2026 about test phrase, Hardhat's published dev keys, and wallet addresses."}),A(38,"credential","age and WireGuard keys",["age-secret-key","vpn-private-key"],{proof:"structure",catches:"age secret keys (AGE-SECRET-KEY-1\u2026) and the PrivateKey of a WireGuard [Interface].",ignores:"WireGuard peer public keys."}),A(39,"infra",".env files",["env-file"],{proof:"context",catches:"A pasted .env file with real secrets in it, flagged as one file rather than line by line.",ignores:".env files with only settings, ${VAR} references or your_key_here placeholders."}),A(40,"infra","Kubernetes configs",["kubeconfig-credential"],{proof:"structure",catches:"kubeconfig files carrying a client key or a bearer token for a cluster.",ignores:"kubeconfigs that authenticate through an exec plugin, and REDACTED tokens."}),A(41,"infra","Kubernetes Secret manifests",["k8s-secret-manifest"],{proof:"structure",catches:"kind: Secret manifests \u2014 the base64 under data: is decoded and checked, and stringData: is read as is.",ignores:"Secrets that decode to password or admin, and certificates."}),A(42,"infra","Terraform state and variables",["terraform-secret"],{proof:"structure",catches:"Passwords in terraform.tfstate attributes and hard-coded in .tf resources.",ignores:"null attributes and var.db_password references."}),A(43,"infra","Credential files",["credential-file"],{proof:"structure",catches:".netrc logins, Docker config.json auths, .pgpass lines and tokens embedded in git remote URLs.",ignores:"example.com entries, user:password auths and plain clone URLs."}),A(44,"infra","Pre-signed URLs",["presigned-url"],{proof:"structure",catches:"S3 pre-signed and Azure SAS URLs that have not expired yet \u2014 anyone holding one can read the file.",ignores:"Expired links, unsigned URLs and documentation pages."}),A(45,"pii","Payment card numbers",["payment-card-number"],{proof:"checksum",catches:"Visa, Mastercard, Amex, RuPay and other card numbers that pass the Luhn check and sit next to a card label, an expiry or a card network name.",ignores:"Published test cards (4242\u2026, 4111\u2026), order IDs and numbers that fail Luhn."}),A(46,"pii","Aadhaar numbers",["aadhaar-number"],{proof:"checksum",catches:"Aadhaar numbers that pass the Verhoeff check, labelled or in the 4-4-4 grouping.",ignores:"UIDAI's sample numbers, transaction references and numbers that fail Verhoeff."}),A(47,"pii","PAN and GSTIN",["india-tax-id"],{proof:"checksum",catches:"Individual PANs and GSTINs whose check character verifies.",ignores:"Company PANs, unlabelled lookalikes and GSTINs with a wrong check character."}),A(48,"pii","SSN and National Insurance numbers",["national-id-number"],{proof:"structure",catches:"US Social Security numbers and UK National Insurance numbers that follow the issuing rules and are labelled or listed.",ignores:"Numbers never issued (000, 666, 9xx areas), the famous Woolworth card number, and part numbers."}),A(49,"pii","Bank account details",["bank-account-details"],{proof:"checksum",catches:"IBANs that pass mod-97, and account numbers next to a valid ABA routing number or an IFSC code.",ignores:"Published example IBANs, IBANs with a wrong check digit and IFSC codes alone."}),A(50,"pii","Customer data exports",["customer-data-dump"],{proof:"context",catches:"Pasted tables of real people \u2014 rows with names, personal email addresses and phone numbers.",ignores:"example.com addresses, 555 phone numbers, short lists and staff email lists."})],yl=["Placeholders \u2014 <your-key>, ${VAR}, {{ secret }}, xxxx, changeme, your_key_here","Values cut short or masked \u2014 sk_live_\u2026, ****, REDACTED","Anything marked fake, mock, dummy, stub, fixture or sample \u2014 in a comment beside it or in its variable name","Vendors' published example and test keys","Variable names, file paths, URLs, hashes, UUIDs and regex source","Public keys, publishable keys and IDs that are not secret"],Er=new Map;for(let e of br)for(let t of e.slugs)Er.set(t,e);function gl(e){return Er.get(e)}function Cs(e){return e===Me?"credential":Er.get(e)?.family??"credential"}function bl(e){return Cs(e)!=="pii"}function El(e){return _s[e]}var xl=br.flatMap(e=>e.slugs);function Os(e){let t=new Set;for(let n of e)if(n?.isActive)for(let r of n.rules??[])for(let o of r?.specificDomains??[]){let s=bn(o);s&&t.add(s)}return Array.from(t).sort()}function wl(e){return Os(e).filter(t=>!gn(t))}var ff=1e3,pf=100,hf=254,mf=1048576,Ms=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,kl=`Name,Email
7
7
  Jane Smith,jane@company.com
8
8
  Aarav Shah,aarav@company.com
9
9
  `,Al=/[​-‍⁠]/g;function wr(e){if(!e)return"";let t=e.replace(Al,"").replace(/ /g," ").replace(/\s+/g," ").trim();return t.length>=2&&(t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'"))&&(t=t.slice(1,-1).trim()),t}var xr=/[^\s<>,;"'()]+@[^\s<>,;"'()]+/;function Sl(e,t){let n=[],r=[],o="",s=!1,a=!0,c=()=>{r.push(o),o="",a=!0},i=()=>{c(),r.some(f=>f.trim()!=="")&&n.push(r),r=[]};for(let f=0;f<e.length;f++){let d=e[f];if(s){d==='"'?e[f+1]==='"'?(o+='"',f++):s=!1:o+=d;continue}if(d==='"'&&a){s=!0,a=!1;continue}if(t!==null&&d===t){c();continue}if(d==="\r"){e[f+1]===`
10
10
  `&&f++,i();continue}if(d===`
11
11
  `){i();continue}d!==" "&&d!==" "&&(a=!1),o+=d}return i(),n}function Il(e){let t=e.split(/\r?\n/).filter(a=>a.trim()!=="").slice(0,6),n={" ":0,",":0,";":0};for(let a of t){let c=!1;for(let i of a)i==='"'?c=!c:!c&&i in n&&(n[i]+=1)}let r=[" ",",",";"],o=null,s=0;for(let a of r)n[a]>s&&(o=a,s=n[a]);return o}var vl={email:"email",emailaddress:"email",mail:"email",workemail:"email",emailid:"email",eaddress:"email",name:"name",fullname:"name",displayname:"name",person:"name",employee:"name",employeename:"name",firstname:"first",givenname:"first",first:"first",forename:"first",lastname:"last",surname:"last",familyname:"last",last:"last"};function Rl(e){return vl[e.toLowerCase().replace(/[^a-z]/g,"")]??null}function Ds(e){let t=e.split("@")[0]??"";return t.split("+")[0].split(/[._-]+/).filter(o=>o!==""&&!/^\d+$/.test(o)).map(o=>o.charAt(0).toUpperCase()+o.slice(1)).join(" ")||t}function Tl(e,t){let n=e.map(wr);if(t&&t.email>=0){let f=n[t.email]??"",d=t.names.map(p=>n[p]??"").filter(Boolean).join(" ");if(f!==""||!n.some(p=>xr.test(p)))return{name:d,email:f,unreadable:!1}}let r=n.findIndex(f=>xr.test(f));if(r<0)return{name:n.filter(Boolean).join(" "),email:"",unreadable:!1};let o=xr.exec(n[r]),s=n[r];if(s!==o[0]&&!s.includes(`<${o[0]}>`)&&!s.includes(`(${o[0]})`))return{name:"",email:s,unreadable:!1};let a=n.filter((f,d)=>d!==r).filter(Boolean),c=wr(n[r].replace(o[0],"").replace(/[<>]/g,""));return{name:[...a,c].filter(Boolean).join(" "),email:o[0],unreadable:!1}}function _l(e,t={}){let n=e.replace(/^/,"");if(n.trim()==="")return{rows:[],people:[],hadHeader:!1,skipped:0};let r=Il(n),o=Sl(n,r),s=!1,a=null,c=o[0];if(c&&!c.some(h=>h.includes("@"))){let h=c.map(g=>Rl(wr(g))),m=h.indexOf("email");if(m>=0){let g=[],E=h.indexOf("name");if(E>=0)g.push(E);else{let y=h.indexOf("first"),w=h.indexOf("last");y>=0&&g.push(y),w>=0&&g.push(w)}a={email:m,names:g},s=!0,o.shift()}else h.some(g=>g!==null)&&(s=!0,o.shift())}let i=t.existingEmails??new Set,f=new Set,d=[],p=0;o.forEach((h,m)=>{if(d.length>=1e3){p+=1;return}let g=Tl(h,a),E=g.email.toLowerCase(),y=[];(E===""||E.length>254||!Ms.test(E))&&y.push("bad-email");let w=g.name,b=!1;w===""&&y.length===0&&(w=Ds(E),b=!0),w.length>100&&y.push("name-too-long"),y.length===0&&(f.has(E)?y.push("duplicate"):i.has(E)&&y.push("already-invited")),E!==""&&!f.has(E)&&!y.includes("bad-email")&&f.add(E),d.push({line:m+1,name:w,email:g.email===""?"":E,nameDerived:b,issues:y})});let u=d.filter(h=>h.issues.length===0).map(h=>({name:h.name,email:h.email}));return{rows:d,people:u,hadHeader:s,skipped:p}}var Cl={"bad-email":"Not a valid email","name-too-long":"Name over 100 characters",duplicate:"Already in this list","already-invited":"Already has an unused invite"};function Ol(e){let t=e.name.toLowerCase();return/\.(xlsx|xlsm|xlsb|xls|numbers|ods)$/.test(t)?{ok:!1,reason:"That is a spreadsheet file. In your spreadsheet choose File, then Save as (or Download), then CSV, and upload that. Or select the cells, copy, and paste them here."}:/\.(csv|tsv|txt)$/.test(t)?e.size>1048576?{ok:!1,reason:"That file is over 1 MB, far more than a list of people. Check it is the right file."}:e.size===0?{ok:!1,reason:"That file is empty."}:{ok:!0}:{ok:!1,reason:"Upload a .csv, .tsv or .txt file, or paste the rows here."}}var Ps="Type the security code only where Redaktyn itself asks for it (the extension, VS Code or a terminal), never on a web page.";function Ml(e,t){return t?`${e}
12
12
  Security code: ${t}
13
- ${Ps}`:e}var Dl=/^[=+\-@\t\r]/;function an(e){return`"${(Dl.test(e)?`'${e}`:e).replace(/"/g,'""')}"`}function Pl(e){let t=["name,email,link,security_code"];for(let n of e)t.push([an(n.name),an(n.email),an(n.link??""),an(n.inviteCode??"")].join(","));return t.join(`
13
+ ${Ps}`:e}var Dl=/^[=+\-@\t\r]/;function cn(e){return`"${(Dl.test(e)?`'${e}`:e).replace(/"/g,'""')}"`}function Pl(e){let t=["name,email,link,security_code"];for(let n of e)t.push([cn(n.name),cn(n.email),cn(n.link??""),cn(n.inviteCode??"")].join(","));return t.join(`
14
14
  `)}var Us=["vscode-terminal","vscode-chat","vscode-editor","claude-code","codex","cursor"],Ul={"vscode-terminal":"VS Code terminal","vscode-chat":"VS Code chat","vscode-editor":"VS Code editor","claude-code":"Claude Code",codex:"Codex",cursor:"Cursor"};function Ll(e){return typeof e=="string"&&Us.includes(e)}var Ls=/^extension-cli-[0-9a-f]+@/i;function Bl(e){return!!e&&Ls.test(e)}var Nl="extension-cli-";function Hl(e){return!!e&&/^cli-[a-f0-9]{32}$/i.test(e)}function Gl(e){return!!e&&/^(node|undici)(\/|\s|$)/i.test(e.trim())}var Fl=36*60*60*1e3;var Bs=["browser","vscode","cursor","claude-code","codex"],Wl=["vscode","cursor","claude-code","codex"],Vl={browser:"Browser",vscode:"VS Code editor",cursor:"Cursor editor","claude-code":"Claude Code",codex:"Codex"};function Kl(e){return typeof e=="string"&&Bs.includes(e)}function jl(e,t,n,r=new Date,o=!1){let s=[...new Set(e.map(f=>f.label))].slice(0,64),a=[...new Set(e.map(f=>f.secretId))].slice(0,64),c=new Set(e.map(f=>f.pass)),i=c.has("exact")?null:c.has("whitespace_collapse")?"whitespace_collapse":c.has("case_fold")?"case_fold":null;return{event:"blocked",type:"hmac_match",secretLabel:s.join(", ").slice(0,200),secretLabels:s.map(f=>f.slice(0,200)),attemptCount:1,risk:"high",toolDomain:t,timestamp:r.toISOString(),eventType:n,secretIds:a.filter(f=>/^[0-9a-f-]{36}$/i.test(f)),scanMethod:"sliding_window",bypassVariant:i,...o?{policyAction:"LOG"}:{}}}0&&(module.exports={AIToolCategory,AI_REGISTRY,ANNUAL_MONTHS_FREE,ANSI_ESCAPE_SOURCE,ASSIGNED_SECRET_SLUG,AlertChannel,AlertTrigger,BUG_REPORT_KINDS,BUG_REPORT_LIMITS,BUG_REPORT_RESPONSE_PROMISE,BUG_REPORT_SECRET_WARNING,BUG_REPORT_URGENT_KIND,CATEGORISED_SLUGS,COMMON_PASSPHRASE_ROOTS,COVERAGE_SLUGS,CUSTOM_EXTRA_ROOTS,CUSTOM_PASSPHRASE_MIN_LENGTH,CUSTOM_PASSPHRASE_WARNING,DETECTION_CATEGORIES,DETECTION_FAMILY_BLURBS,DETECTION_FAMILY_NAMES,DETECTION_PROOF_NAMES,DETECTION_SOURCES,DETECTION_SOURCE_LABELS,DETECTION_UNIVERSAL_IGNORES,DIGEST_VERSION_HMAC_V1,EDITOR_DETECTION_SOURCES,EDITOR_DEVICE_EMAIL,EDITOR_EMAIL_PREFIX,EMAIL_MAX,ENTERPRISE_FEATURES,EventAction,EventType,FOUNDING_PERCENT_OFF,FOUNDING_TEAMS,FREE_FEATURES,FREE_SEATS,GENERATED_PASSPHRASE_BITS_APPROX,GENERATED_PASSPHRASE_ENTROPY_BITS,GENERATED_PASSPHRASE_REQUIRED_MESSAGE,GUESSABLE_SECRET_BITS,INVISIBLE_CHARS_CLASS,ISSUE_LABEL,KDF_ITERATIONS,KDF_VERSION_V2,KeyShareUnavailableError,LEGACY_PRO_BANDS,LIST_HOLD_MS,MATRIX_TIERS,MAX_ACTIVITY_SESSIONS_PER_BATCH,MAX_SCAN_WINDOWS,MAX_TOTAL_SCAN_CHARS,MIN_SECRET_LENGTH,NAME_MAX,NORMALIZATION_VERSION_V1,NORMALIZATION_VERSION_V2,OFFICIAL_OPRF_PINS,OFFICIAL_SERVER_HOSTS,OPRF_ELEMENT_BYTES,OPRF_OUTPUT_BYTES,OPRF_PROOF_BYTES,ORG_KEY_LOCK_SCHEME,OprfProofError,OrgPlan,PASSPHRASE_CREDENTIAL_NAME,PASSPHRASE_CREDENTIAL_URL,PASSPHRASE_VERIFY_LABEL,PASTE_CEILING_ALARM_CHARS,PASTE_CEILING_WARN_CHARS,PLAN_DESCRIPTORS,PLAN_FEATURE_MATRIX,PLAN_FEATURE_TIERS,PLAN_LIMITS,PLAN_PRICING,PLATFORM_SURFACES,PRIVACY_EMAIL,PROJECT_KDF_LABEL,PRO_BANDS,PRO_ENTRY_BAND,PRO_FEATURES,PRO_TOP_BAND,ROSTER_FILE_MAX_BYTES,ROSTER_MAX_ROWS,ROSTER_TEMPLATE_CSV,ROTATION_GUIDE_SLUGS,ROTATION_LINK_HOSTS,RiskLevel,SAFE_BLOCK_EVENT_FIELDS,SALES_EMAIL,SCAN_PREFILTER_LABEL,SCAN_PREFILTER_PATTERN,SCAN_PREFILTER_SPACE,SCAN_PREFILTER_WINDOWS_PER_SIGNATURE,SECRET_PROVIDER_NAMES,SECRET_PROVIDER_SLUGS,SECURITY_CODE_WHERE_TO_TYPE,SECURITY_EMAIL,SEQUENCES,SERVER_EMAIL_RE,SUPPORT_EMAIL,SecretKeyNeededError,TRIAL_DAYS,TRUST_POINTS,UNRECOGNISED_PROVIDER_SLUG,UserRole,VSCODE_AWAY_AFTER_MS,VSCODE_PLACES,VSCODE_PLACE_LABELS,annualBilledNote,appendPasskeyEnvelope,assessSecretGuessability,behaviorExplanation,canonicalSecretPlaintextForHmac,categoryOfSlug,checkOprfAnswer,checkRosterFile,checkShareAnswer,clientBehindProxies,computePassphraseVerifyHmac,createLockedOrgKey,createShareHandler,customPolicyDomains,decodeScanPrefilter,deriveBehaviorRisk,deriveHmacKeyFromPassphrase,deriveProjectKey,deriveScanPrefilterSeed,deviceEnvelopeCredential,encodeScanPrefilter,eventFor,extractAddedLinesFromUnifiedDiff,familyDisplayName,familyOfSlug,findBand,findPasskeyEnvelope,foldLeet,foldUuidHexCase,foundingMonthlyUsd,generateHmacKey,generateLockSecretKey,generateOrgKey,generateOrgPassphrase,generatePrfSalt,getInjectionHostnames,getLimitsForPlan,getPrfSaltBytes,guardListShrink,guessableSecretWarning,hexToKey,hmacDigestHex,inviteLinksCsv,inviteShareText,isAIToolDomain,isDetectionSource,isEditorDevice,isEditorExtensionId,isEditorUserAgent,isGeneratedPassphraseFormat,isInjectionScopedHostname,isKeyShare,isKnownProviderSlug,isOrgKeyLock,isProtectableSlug,isStrictScope,isV1PassphraseEnvelope,isV2Envelope,isValidOprfSecretKey,isVscodePlace,joinLockCredential,keyToHex,lockOrgKey,lockSecretKeyBytes,matchDomain,matchPatternsForHostname,maxScannablePasteChars,maxScannablePasteCharsFor,memoryPinStore,nameFromEmail,normalizeAndHmacHex,normalizeAndHmacHexCollapsed,normalizeAndHmacHexLower,normalizeDomainInput,normalizeSecretPlaintextCollapsed,normalizeSecretPlaintextForMatch,normalizeSecretPlaintextLower,oprfBlind,oprfBlindEvaluate,oprfBlindEvaluateWithProof,oprfDeriveSecretKey,oprfFinalize,oprfGenerateSecretKey,oprfPublicKey,oprfVerifyEvaluation,parseRoster,passphraseCsvText,passphraseSheetText,perMonthOnAnnual,policyNamedDomains,projectedScanCost,providerDisplayName,publicKeyHex,removePasskeyEnvelope,rotationGuideFor,scanBudgetFor,scanPrefilterFingerprint,scanPrefilterForRawSecret,scanPrefilterParams,scanPrefilterRoller,scanPrefilterUnits,scanSweeps,scanWindowLengths,scopeOf,smallestBandFor,splitLockCredential,unlockOrgKey,unwrapHmacKeyWithPrf,upgradeEnvelopeToV2,usd,validateAnchorPassphrase,validateCustomPassphrase,validateGeneratedPassphrase,validateNewPassphrase,validatePassphraseStrength,wrapHmacKeyWithPrf});
15
15
  /*! Bundled license information:
16
16