@semics-tech/emdash-esign 0.0.0-bootstrap.0 → 1.0.0-rc.0

package/dist/manifest.json

@@ -0,0 +1,354 @@
+{
+  "id": "semics-esign",
+  "version": "1.0.0-rc.0",
+  "declaredAccess": {
+    "media": {
+      "read": {},
+      "bytesRead": {}
+    },
+    "network": {
+      "request": {
+        "allowedHosts": [
+          "challenges.cloudflare.com"
+        ]
+      }
+    },
+    "email": {
+      "send": {}
+    }
+  },
+  "capabilities": [
+    "media:read",
+    "media:bytes:read",
+    "network:request",
+    "email:send"
+  ],
+  "allowedHosts": [
+    "challenges.cloudflare.com"
+  ],
+  "storage": {
+    "templates": {
+      "indexes": [
+        "status",
+        "kind",
+        "public"
+      ]
+    },
+    "envelopes": {
+      "indexes": [
+        "status",
+        "expiresAt",
+        "createdAt",
+        "clientId",
+        "externalRef",
+        "pdfSha256",
+        "signerEmail",
+        [
+          "status",
+          "expiresAt"
+        ]
+      ]
+    },
+    "signers": {
+      "indexes": [
+        "envelopeId",
+        "email",
+        "copyTokenHash"
+      ],
+      "uniqueIndexes": [
+        "tokenHash"
+      ]
+    },
+    "snapshots": {
+      "indexes": [
+        "envelopeId"
+      ]
+    },
+    "artifacts": {
+      "indexes": [
+        "envelopeId",
+        [
+          "envelopeId",
+          "kind"
+        ]
+      ]
+    },
+    "audit_events": {
+      "indexes": [
+        "envelopeId",
+        [
+          "envelopeId",
+          "seq"
+        ]
+      ]
+    },
+    "clients": {
+      "indexes": [
+        "createdAt"
+      ],
+      "uniqueIndexes": [
+        "clientId"
+      ]
+    },
+    "nonces": {
+      "indexes": [
+        "expiresAt"
+      ],
+      "uniqueIndexes": [
+        "nonce"
+      ]
+    },
+    "outbox": {
+      "indexes": [
+        [
+          "status",
+          "nextAttemptAt"
+        ]
+      ]
+    }
+  },
+  "hooks": [
+    "plugin:activate",
+    "cron"
+  ],
+  "routes": [
+    {
+      "name": "public/envelopes/from-intent",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 16384
+      },
+      "public": true
+    },
+    {
+      "name": "public/session",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 8192
+      },
+      "public": true
+    },
+    {
+      "name": "public/otp/send",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 8192
+      },
+      "public": true
+    },
+    {
+      "name": "public/otp/verify",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 8192
+      },
+      "public": true
+    },
+    {
+      "name": "public/submit",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 262144
+      },
+      "public": true
+    },
+    {
+      "name": "public/decline",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 8192
+      },
+      "public": true
+    },
+    {
+      "name": "public/download",
+      "methods": [
+        "GET"
+      ],
+      "request": {
+        "body": "none"
+      },
+      "response": "raw",
+      "public": true
+    },
+    {
+      "name": "public/verify",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 8192
+      },
+      "public": true
+    },
+    {
+      "name": "public/receipts/lookup",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 8192
+      },
+      "public": true
+    },
+    {
+      "name": "public/templates/catalog",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 65536
+      },
+      "public": true
+    },
+    {
+      "name": "public/self-serve/start",
+      "methods": [
+        "POST"
+      ],
+      "request": {
+        "body": "json",
+        "maxBytes": 65536
+      },
+      "public": true
+    },
+    "admin",
+    "templates/create",
+    "templates/update",
+    "templates/get",
+    "templates/list",
+    "templates/archive",
+    "envelopes/create",
+    "envelopes/send",
+    "envelopes/get",
+    "envelopes/list",
+    "envelopes/resend",
+    "envelopes/void",
+    "outbox/status"
+  ],
+  "admin": {
+    "settingsSchema": {
+      "senderName": {
+        "label": "Sender name",
+        "description": "Shown as the sender of signing emails.",
+        "type": "string"
+      },
+      "consentVersion": {
+        "label": "Consent version",
+        "description": "Recorded with every signature; bump when the wording changes.",
+        "type": "string",
+        "default": "1"
+      },
+      "consentWording": {
+        "label": "Consent wording",
+        "description": "Shown to signers before they sign.",
+        "type": "string",
+        "default": "I agree to use electronic records and an electronic signature for this document.",
+        "multiline": true
+      },
+      "expiryDays": {
+        "label": "Envelope expiry (days)",
+        "type": "number",
+        "default": 30,
+        "min": 1,
+        "max": 365
+      },
+      "reminderCadenceDays": {
+        "label": "Reminder cadence (days)",
+        "description": "Pro: automatic reminders.",
+        "type": "number",
+        "default": 3,
+        "min": 1,
+        "max": 30
+      },
+      "otpDefault": {
+        "label": "Require email code by default",
+        "description": "Pro: one-time code before signing.",
+        "type": "boolean",
+        "default": false
+      },
+      "otpContractTemplates": {
+        "label": "Require email code for contract templates",
+        "description": "Pro.",
+        "type": "boolean",
+        "default": true
+      },
+      "retentionPersonalDataMonths": {
+        "label": "Keep personal data (months)",
+        "type": "number",
+        "default": 12,
+        "min": 1,
+        "max": 120
+      },
+      "retentionSignedRecordsYears": {
+        "label": "Keep signed records (years)",
+        "type": "number",
+        "default": 7,
+        "min": 1,
+        "max": 50
+      },
+      "turnstileSiteKey": {
+        "label": "Turnstile site key",
+        "type": "string"
+      },
+      "turnstileSecretKey": {
+        "label": "Turnstile secret key",
+        "type": "secret"
+      },
+      "integrationMasterKey": {
+        "label": "Integration master key",
+        "description": "Client secrets are derived from this key; it is never shown again.",
+        "type": "secret"
+      },
+      "licenceKey": {
+        "label": "Licence key (Pro)",
+        "description": "Used by E-sign Pro only; the Free edition ignores it. Stored encrypted.",
+        "type": "secret"
+      }
+    },
+    "pages": [
+      {
+        "path": "/envelopes",
+        "label": "Envelopes",
+        "icon": "file"
+      },
+      {
+        "path": "/templates",
+        "label": "Templates",
+        "icon": "file-text"
+      },
+      {
+        "path": "/integrations",
+        "label": "Integrations",
+        "icon": "link"
+      },
+      {
+        "path": "/settings",
+        "label": "Settings",
+        "icon": "gear"
+      }
+    ],
+    "widgets": []
+  }
+}

package/dist/plugin.d.mts

@@ -0,0 +1,7 @@
+import { SandboxedPlugin } from "emdash/plugin";
+
+//#region src/plugin.d.ts
+/** Sandboxed plugin entry. Route handlers are filled in by the tasks that own each route. */
+declare const plugin: SandboxedPlugin;
+//#endregion
+export { plugin as default };

package/dist/plugin.mjs

@@ -0,0 +1,38 @@
+function e(e){for(let t of Object.keys(e))e[t]===void 0&&delete e[t];return e}function t(t,n={}){return e({type:`header`,text:t,block_id:n.blockId})}function n(t,n={}){return e({type:`context`,text:t,block_id:n.blockId})}function r(t,n={}){return e({type:`fields`,fields:t,block_id:n.blockId})}function i(e,t,n){return n===void 0?{key:e,label:t}:{key:e,label:t,format:n}}function a(t){return e({type:`table`,columns:t.columns,rows:t.rows,page_action_id:t.pageActionId,next_cursor:t.nextCursor,empty_text:t.emptyText,block_id:t.blockId})}function o(t){return e({type:`code`,code:t.code,language:t.language,block_id:t.blockId})}const s={error:`error`,warning:`alert`,info:`default`};function c(t){if(t.title===void 0&&t.description===void 0)throw Error(`banner needs a title or a description`);return e({type:`banner`,title:t.title,description:t.description,variant:t.variant,block_id:t.blockId})}function l(e){return c({title:e.title,description:e.message,variant:s[e.severity],blockId:e.blockId})}function u(e){return e.filter(e=>!!e).map(l)}function d(t,n={}){return e({type:`actions`,elements:t,block_id:n.blockId})}function f(t,n,r={}){return e({type:`button`,action_id:t,label:n,style:r.style,value:r.value,confirm:r.confirm})}function p(t,n,r={}){return e({type:`link`,label:t,target:n,appearance:r.appearance})}function m(t,n,r={}){return e({type:`text_input`,action_id:t,label:n,placeholder:r.placeholder,initial_value:r.initialValue,multiline:r.multiline})}function h(t,n,r={}){return e({type:`number_input`,action_id:t,label:n,initial_value:r.initialValue,min:r.min,max:r.max})}function g(t,n,r,i={}){return e({type:`select`,action_id:t,label:n,options:r,initial_value:i.initialValue,optionsRoute:i.optionsRoute})}function _(t,n,r={}){return e({type:`toggle`,action_id:t,label:n,description:r.description,initial_value:r.initialValue})}function v(t,n,r={}){return e({type:`secret_input`,action_id:t,label:n,placeholder:r.placeholder,has_value:r.hasValue})}function y(t){return e({type:`form`,fields:t.fields,submit:{label:t.submit.label,action_id:t.submit.actionId},block_id:t.blockId})}const b=e=>crypto.getRandomValues(new Uint8Array(e));function x(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/,``)}function S(e){return Array.from(new Uint8Array(e),e=>e.toString(16).padStart(2,`0`)).join(``)}function C(e){return crypto.subtle.importKey(`raw`,new Uint8Array(e),{name:`HMAC`,hash:`SHA-256`},!1,[`sign`])}function w(e){return{ok:!0,value:e}}function T(e){return{ok:!1,error:e}}function E(e,t){return Object.freeze({status:e,message:t})}const D=Object.freeze({BAD_REQUEST:E(400,`The request was not valid.`),NOT_FOUND:E(404,`Not found.`),RATE_LIMITED:E(429,`Too many requests. Please try again shortly.`),TURNSTILE_FAILED:E(403,`The bot check failed. Please try again.`),TOKEN_IN_QUERY:E(400,`Tokens must not be sent in the URL.`),INTERNAL:E(500,`Something went wrong. Please try again later.`),SOLD_OUT:E(409,`This event is sold out.`),HOLD_EXPIRED:E(409,`Your hold has expired. Please start again.`),SALES_CLOSED:E(409,`Sales for this event are closed.`),BOOKING_TOKEN_INVALID:E(404,`Not found.`),BOOKING_TOKEN_EXPIRED:E(401,`This booking link has expired.`),CANCEL_NOT_ALLOWED:E(409,`This booking can no longer be cancelled online.`),ENVELOPE_NOT_FOUND:E(404,`Document not found.`),ENVELOPE_CLOSED:E(409,`This document can no longer be signed.`),SIGNING_TOKEN_INVALID:E(401,`This signing link is not valid.`),SIGNING_TOKEN_EXPIRED:E(401,`This signing link has expired.`),SESSION_REQUIRED:E(409,`Please reopen the signing page and try again.`),SIGNED_PDF_PENDING:E(409,`The signed document is still being prepared. Please try again in a minute.`),SIGNING_OUT_OF_TURN:E(409,`Another signer has to sign first. You will get an email when it is your turn.`),OTP_REQUIRED:E(403,`Enter the code we emailed you before signing.`),TOKEN_TOO_LARGE:E(413,`The token is too large.`),TOKEN_MALFORMED:E(400,`The token is malformed.`),CLIENT_UNKNOWN:E(401,`The client is not recognised.`),CLIENT_REVOKED:E(403,`The client has been revoked.`),TOKEN_INVALID:E(401,`The token is not valid.`),PAYLOAD_INVALID:E(400,`The token payload is not valid.`),TOKEN_LIFETIME_EXCEEDED:E(400,`The token lifetime is too long.`),TOKEN_NOT_YET_VALID:E(401,`The token is not valid yet.`),TOKEN_EXPIRED:E(401,`The token has expired.`),RETURN_URL_NOT_ALLOWED:E(400,`The return URL is not allowed.`),TOKEN_REPLAYED:E(409,`The token has already been used.`),PAIRING_MALFORMED:E(400,`The pairing string is malformed.`),TEMPLATE_NOT_FOUND:E(404,`Template not found.`),REF_UNKNOWN:E(404,`Reference not found.`),PAYMENT_FAILED:E(402,`The payment could not be completed.`),LICENCE_INVALID:E(403,`The licence is not valid.`),LICENCE_EXPIRED:E(403,`The licence has expired.`)});function ee(e){return typeof e==`string`&&Object.hasOwn(D,e)}function te(e){if(typeof e==`string`)return e;if(typeof e==`object`&&e&&`code`in e)return e.code}function ne(e){let t=te(e),n=ee(t)?t:`INTERNAL`,{status:r,message:i}=D[n];return{status:r,body:{ok:!1,error:{code:n,message:i}}}}const re=3600*1e3,ie=1e3,ae=new TextEncoder,oe=new Set([`exp`,`sig`]),se=/^\d{1,15}$/;function O(e=b){let t=e(32);if(t.length!==32)throw Error(`Random source must return 32 bytes.`);return x(t)}async function k(e){return S(new Uint8Array(await crypto.subtle.digest(`SHA-256`,ae.encode(e))))}function ce(e,t){let n=ae.encode(e),r=ae.encode(t),i=Math.max(n.length,r.length),a=n.length^r.length;for(let e=0;e<i;e++)a|=(n[e]??0)^(r[e]??0);return a===0}async function le(e,t){return ce(await k(e),t??`0`.repeat(64))}async function ue(e){if(e.length<32)throw Error(`Link secret must be at least 32 bytes.`);return C(e)}function de(e,t,n){let r=n.map(([e,t])=>`${encodeURIComponent(e)}=${encodeURIComponent(t)}`).sort();return[`semics-link/1`,encodeURIComponent(e),t,r.join(`&`)].join(`
+`)}async function fe(e,t){return x(new Uint8Array(await crypto.subtle.sign(`HMAC`,e,ae.encode(t))))}async function pe(e){let{secret:t,purpose:n,params:r,now:i,ttlMs:a=9e5}=e,o=await ue(t);if(n.length===0)throw Error(`Link purpose must not be empty.`);if(!Number.isFinite(i))throw Error(`Link now must be a finite epoch time in milliseconds.`);if(!(a>=ie&&a<=re))throw Error(`Link ttl must be between ${ie} and ${re} ms.`);let s=Object.entries(r);if(s.some(([e])=>oe.has(e)))throw Error(`Link params must not use the reserved names exp or sig.`);let c=String(Math.floor((i+a)/1e3)),l=new URLSearchParams(s);return l.set(`exp`,c),l.set(`sig`,await fe(o,de(n,c,s))),l}async function me(e){let{secret:t,purpose:n,query:r,now:i}=e,a=await ue(t),o=new Set,s=[],c,l;for(let[e,t]of r){if(o.has(e))return T(`TOKEN_INVALID`);o.add(e),e===`exp`?c=t:e===`sig`?l=t:s.push([e,t])}return c===void 0||l===void 0||!se.test(c)||!ce(await fe(a,de(n,c,s)),l)?T(`TOKEN_INVALID`):i>=Number(c)*1e3?T(`TOKEN_EXPIRED`):w(Object.fromEntries(s))}const he=Object.freeze({intent:`esign-intent/1`,receipt:`esign-receipt/1`,lookup:`esign-lookup/1`,catalog:`esign-catalog/1`}),ge=Object.freeze({intent:8192,receipt:2048,lookup:1024,catalog:1024}),_e=/^[A-Za-z0-9_-]{4,64}$/,ve=/^[A-Za-z0-9_-]*$/,ye=new TextEncoder;function be(e){if(!ve.test(e)||e.length%4==1)return;let t=atob(e.replace(/-/g,`+`).replace(/_/g,`/`)),n=Uint8Array.from(t,e=>e.charCodeAt(0));return x(n)===e?n:void 0}async function xe(e){if(e.length!==32)throw Error(`Client secret must be 32 bytes.`);return C(e)}async function Se(e,t,n){let r=await crypto.subtle.sign(`HMAC`,await xe(e),ye.encode(`${t}.${n}`));return x(new Uint8Array(r))}const Ce=/^[A-Za-z0-9_-]{1,64}$/,we=/^[A-Za-z0-9._:-]{1,128}$/,Te=/^[0-9a-f]{64}$/,Ee=/^[A-Za-z0-9_-]{16,64}$/,De=/^[A-Za-z0-9_]{1,64}$/,Oe=/[\uD800-\uDFFF]/u,ke=/[\u0000-\u001F\u007F]/,Ae=/[\u0000- \u007F]/;function je(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function Me(e){let t=0;for(let n of e)t++;return t}function Ne(e,t,n){if(typeof e!=`string`||Oe.test(e))return!1;let r=Me(e);return r>=t&&r<=n}function A(e,t){return typeof e==`string`&&t.test(e)}function Pe(e){return Number.isSafeInteger(e)&&e>=0}function Fe(e){return Ne(e,1,200)&&!ke.test(e)}function Ie(e){if(!Ne(e,1,254)||Ae.test(e))return!1;let t=e.split(`@`);return t.length===2&&t[0]!==``&&t[1]!==``}function Le(e){if(!je(e))return!1;let t=Object.entries(e);return t.length<=32&&t.every(([e,t])=>De.test(e)&&Ne(t,0,500))}function Re(e){return je(e)&&Fe(e.name)}function ze(e){let t=e.as===`guardian`;return Pe(e.iat)&&Pe(e.exp)&&e.exp>e.iat&&A(e.nonce,Ee)&&A(e.tpl,Ce)&&(e.tplVersion===void 0||Number.isSafeInteger(e.tplVersion)&&e.tplVersion>=1)&&A(e.ref,we)&&je(e.signer)&&Fe(e.signer.name)&&Ie(e.signer.email)&&(e.as===void 0||e.as===`self`||t||e.as===`buyer`)&&(t?Re(e.participant):!Object.hasOwn(e,`participant`))&&(e.delivery===void 0||e.delivery===`inline`||e.delivery===`email`)&&Le(e.prefill)&&Ne(e.returnUrl,1,2048)}const Be=new Set([`completed`,`declined`,`voided`,`expired`]);function Ve(e){let t=e.status===`completed`;return A(e.envelopeId,Ce)&&A(e.ref,we)&&Be.has(e.status)&&A(e.docSha256,Te)&&(t?e.pdfSha256===null||A(e.pdfSha256,Te):e.pdfSha256===null)&&(t?A(e.finalHash,Te):e.finalHash===null)&&Pe(e.at)}const He={intent:ze,receipt:Ve,lookup:e=>Pe(e.ts)&&A(e.ref,we),catalog:e=>Pe(e.ts)};function Ue(e,t){return!je(t)||t.v!==1||t.typ!==e||!A(t.cid,_e)||!He[e](t)?T(`PAYLOAD_INVALID`):e===`intent`&&t.exp-t.iat>1800?T(`TOKEN_LIFETIME_EXCEEDED`):w(t)}const We=new Set([`localhost`,`127.0.0.1`,`[::1]`]);function Ge(e){try{return new URL(e)}catch{return}}function Ke(e){return e.username!==``||e.password!==``}function qe(e){let t=Ge(e);if(!(t===void 0||Ke(t)||t.search!==``||e.includes(`#`)))return t.protocol===`https:`||t.protocol===`http:`&&We.has(t.hostname)?t:void 0}function Je(e,t){return t.endsWith(`/`)?e.startsWith(t):e===t||e.startsWith(`${t}/`)}function Ye(e,t){let n=Ge(e);return n===void 0||n.protocol!==`https:`&&n.protocol!==`http:`||Ke(n)||e.includes(`#`)?!1:t.some(e=>{let t=qe(e);return t!==void 0&&t.origin===n.origin&&Je(n.pathname,t.pathname)})}async function Xe(e,t){let{token:n}=t;if(typeof n!=`string`)return T(`TOKEN_MALFORMED`);if(n.length>ge[e])return T(`TOKEN_TOO_LARGE`);let r=n.split(`.`);if(r.length!==2)return T(`TOKEN_MALFORMED`);let[i,a]=r,o=be(i);if(o===void 0||o.length===0||a.length!==43||be(a)===void 0)return T(`TOKEN_MALFORMED`);let s=Ze(o);if(s===void 0||!A(s.cid,_e))return T(`TOKEN_MALFORMED`);let c=await t.getClient(s.cid);return c===void 0?T(`CLIENT_UNKNOWN`):c.revoked?T(`CLIENT_REVOKED`):ce(await Se(c.secret,he[e],i),a)?w({payload:s,client:c}):T(`TOKEN_INVALID`)}function Ze(e){if(!(e[0]===239&&e[1]===187&&e[2]===191))try{let t=JSON.parse(new TextDecoder(`utf-8`,{fatal:!0}).decode(e));return je(t)?t:void 0}catch{return}}function Qe(e,t){return e===`intent`?t.iat:e===`receipt`?t.at:t.ts}function $e(e,t){if(e===`intent`)return t.exp+60;if(e!==`receipt`)return t.ts+300+60}async function et(e,t){let n=await Xe(e,t);if(!n.ok)return n;let r=Ue(e,n.value.payload);if(!r.ok)return r;let i=Math.floor(t.now/1e3);if(Qe(e,r.value)>i+60)return T(`TOKEN_NOT_YET_VALID`);let a=$e(e,r.value);return a!==void 0&&i>a?T(`TOKEN_EXPIRED`):w({payload:r.value,client:n.value.client})}async function tt(e){let t=await et(`intent`,e);if(!t.ok)return t;let{payload:n,client:r}=t.value,i=r.returnUrlAllowlist?.length?r.returnUrlAllowlist:e.siteOrigin===void 0?[]:[`${e.siteOrigin}/`];return Ye(n.returnUrl,i)?await e.consumeNonce(n.cid,n.nonce,n.exp+60)?w(n):T(`TOKEN_REPLAYED`):T(`RETURN_URL_NOT_ALLOWED`)}async function nt(e,t){let n=await et(e,t);return n.ok?w(n.value.payload):n}function rt(e){return nt(`lookup`,e)}function it(e){return nt(`catalog`,e)}async function at(e,t,n){let r=Ue(e,t);if(!r.ok)throw Error(`Cannot sign ${e} token: ${r.error}.`);let i=x(ye.encode(JSON.stringify(t))),a=`${i}.${await Se(n,he[e],i)}`;if(a.length>ge[e])throw Error(`Cannot sign ${e} token: TOKEN_TOO_LARGE.`);return a}const j=(e=Date.now())=>new Date(e).toISOString();function ot(e){let t=e.kind;return{to:e.to,subject:e.subject,...typeof t==`string`?{kind:t}:{}}}async function st(e,t,n,r){let i=r();return await e.put(i,{message:t,status:`pending`,attempts:0,nextAttemptAt:n,createdAt:n}),i}function ct(e){return Math.min(6e4*2**(e-1),36e5)}async function lt(e){let t={sent:0,failed:0,gaveUp:0,remainingHint:!1};if(!e.email)return t;let n=Math.max(1,e.maxPerTick??6),{items:r}=await e.storage.query({status:`pending`,nextAttemptAtLte:e.now,limit:n+1});if(r.length===0)return t;let i=[],a=0,o=0,s=0;for(let{id:t,data:c}of r.slice(0,n)){let n=c.attempts+1;try{await e.email.send(c.message),a++;let r=ot(c.message);i.push({id:t,data:{...c,message:r,status:`sent`,attempts:n,sentAt:e.now}})}catch(r){let a=(r instanceof Error?r.message:String(r)).replace(/\S*:\/\/\S*|[\w-]{20,}/g,`…`).slice(0,300);n>=5?(s++,i.push({id:t,data:{...c,message:ot(c.message),status:`failed`,attempts:n,lastError:a}})):(o++,i.push({id:t,data:{...c,attempts:n,lastError:a,nextAttemptAt:e.now+ct(n)}}))}}return await e.storage.putMany(i),{sent:a,failed:o,gaveUp:s,remainingHint:r.length>n}}async function ut(e){let[t,n]=await Promise.all([e.storage.query({status:`pending`,limit:100}),e.storage.query({status:`failed`,limit:100})]);return{state:e.email?`ok`:`no_transport`,pending:t.items.length,failed:n.items.length}}const dt=new TextEncoder;function ft(e){if(!_e.test(e))throw Error(`Client id must match the esign-intent/1 clientId grammar.`)}function pt(e,t){if(ft(e),t.length!==32)throw Error(`Client secret must be 32 bytes.`);return`esign1.${e}.${x(t)}`}async function mt(e,t){if(e.length<32)throw Error(`Master key must be at least 32 bytes.`);ft(t);let n=await C(e);return new Uint8Array(await crypto.subtle.sign(`HMAC`,n,dt.encode(`esign-client/1.`+t)))}function ht(e=b){let t=e(16);if(t.length!==16)throw Error(`Random source must return 16 bytes.`);let n=`cl_`;for(let e of t)n+=`abcdefghijklmnopqrstuvwxyz234567`[e&31];return n}const gt=[{font:`regular`,resource:`F1`,baseFont:`Helvetica`},{font:`bold`,resource:`F2`,baseFont:`Helvetica-Bold`},{font:`italic`,resource:`F3`,baseFont:`Helvetica-Oblique`}];function _t(e){let t=new Uint16Array(256);for(let n=0;n<224;n++)t[32+n]=Number.parseInt(e.slice(2*n,2*n+2),36);return t}const vt=_t(`7q7q9vfgfgopij5b9999atg87q997q7qfgfgfgfgfgfgfgfgfgfg7q7qg8g8g8fgs7ijijk2k2ijgzlmk27qdwijfgn5k2lmijlmk2ijgzk2ijq8ijijgz7q7q7qd1fg99fgfgdwfgfg7qfgfg6666dw66n5fgfgfgfg99dw7qfgdwk2dwdwdw9a789ag800fg0066fg99rsfgfg99rsij99rs00gz0000666699999qfgrs99rsdw99q800dwij7q99fgfgfgfg78fg99khaafgg899kh99b4g8999999fgex7q9999a5fgn6n6n6gzijijijijijijrsk2ijijijij7q7q7q7qk2k2lmlmlmlmlmg8lmk2k2k2k2ijijgzfgfgfgfgfgfgopdwfgfgfgfg7q7q7q7qfgfgfgfgfgfgfgg8gzfgfgfgfgdwfgdw`),yt={regular:vt,bold:_t(`7q99d6fgfgopk26m9999atg87q997q7qfgfgfgfgfgfgfgfgfgfg9999g8g8g8gzr3k2k2k2k2ijgzlmk27qfgk2gzn5k2lmijlmk2ijgzk2ijq8ijijgz997q99g8fg99fggzfggzfg99gzgz7q7qfg7qopgzgzgzgzatfg99gzfglmfgfgdwat7satg800fg007qfgdwrsfgfg99rsij99rs00gz00007q7qdwdw9qfgrs99rsfg99q800dwij7q99fgfgfgfg7sfg99khaafgg899kh99b4g8999999gzfg7q9999a5fgn6n6n6gzk2k2k2k2k2k2rsk2ijijijij7q7q7q7qk2k2lmlmlmlmlmg8lmk2k2k2k2ijijgzfgfgfgfgfgfgopfgfgfgfgfg7q7q7q7qgzgzgzgzgzgzgzg8gzgzgzgzgzfggzfg`),italic:vt},bt=new Map([8364,0,8218,402,8222,8230,8224,8225,710,8240,352,8249,338,0,381,0,0,8216,8217,8220,8221,8226,8211,8212,732,8482,353,8250,339,0,382,376].flatMap((e,t)=>e?[[e,128+t]]:[])),xt=/^[\x20-\x7e\xa0-\xff]*$/;function St(e){return e>=32&&e<=126||e>=160&&e<=255?e:e===9||e===10||e===13?32:bt.get(e)??63}function Ct(e){if(xt.test(e))return e;let t=``;for(let n of e)t+=String.fromCharCode(St(n.codePointAt(0)));return t}function wt(e){return yt[e]}function Tt(e,t){let n=yt[t],r=0;for(let t=0;t<e.length;t++)r+=n[e.charCodeAt(t)];return r}const Et=1e7;function M(e){if(!Number.isFinite(e))return`0`;let t=Math.round(Math.min(Et,Math.max(-Et,e))*100)/100;return t===0?`0`:String(t)}function Dt(e){return`(${e.replace(/[\\()]/g,`\\$&`)})`}function Ot(e){if(/^[\x20-\x7e]*$/.test(e))return Dt(e);let t=`FEFF`;for(let n=0;n<e.length;n++)t+=e.charCodeAt(n).toString(16).toUpperCase().padStart(4,`0`);return`<${t}>`}function kt(e){let t=e.getTime();if(!Number.isFinite(t))return;let n=new Date(t).toISOString();return`D:${n.slice(0,4)}${n.slice(5,7)}${n.slice(8,10)}${n.slice(11,13)}${n.slice(14,16)}${n.slice(17,19)}Z`}function At(e){return`<< /Length ${e.length} >>\nstream\n${e}\nendstream`}function jt(e,t,n){let r=[`%PDF-1.7
+%âãÏÓ
+`],i=r[0].length,a=`xref\n0 ${e.length+1}\n0000000000 65535 f \n`;e.forEach((e,t)=>{let n=`${t+1} 0 obj\n${e}\nendobj\n`;a+=`${String(i).padStart(10,`0`)} 00000 n \n`,r.push(n),i+=n.length});let o=n===void 0?``:` /Info ${n} 0 R`;r.push(`${a}trailer\n<< /Size ${e.length+1} /Root ${t} 0 R${o} >>\nstartxref\n${i}\n%%EOF\n`);let s=r.join(``),c=new Uint8Array(s.length);for(let e=0;e<s.length;e++)c[e]=s.charCodeAt(e);return c}function Mt(e){let t,n;return Array.isArray(e)?[t,n]=e:typeof e==`object`&&e&&({x:t,y:n}=e),typeof t==`number`&&typeof n==`number`&&Number.isFinite(t)&&Number.isFinite(n)?[t,n]:void 0}function Nt(e){let t=e?.strokes;if(!Array.isArray(t))return[];let n=[],r=2e4;for(let e of t){if(!Array.isArray(e)||r<=0)continue;let t=[];for(let n of e){let e=Mt(n);e&&r>0&&(t.push(e),r--)}t.length>0&&n.push(t)}return n}function Pt(e,t){let n=Nt(e);if(n.length===0)return``;let r=e,i=typeof r.w==`number`&&Number.isFinite(r.w)&&r.w>0?r.w:0,a=typeof r.h==`number`&&Number.isFinite(r.h)&&r.h>0?r.h:0;if(i===0||a===0){for(let e of n)for(let[t,n]of e)i=Math.max(i,t),a=Math.max(a,n);i=Math.max(i,1),a=Math.max(a,1)}let o=Math.min(t.width/i,t.height/a),s=(t.height-a*o)/2,c=e=>M(t.x+Math.min(i,Math.max(0,e))*o),l=e=>M(t.top-s-Math.min(a,Math.max(0,e))*o),u=[`q 0.05 0.1 0.45 RG 1.2 w 1 J 1 j`];for(let e of n){let[t]=e;u.push(`${c(t[0])} ${l(t[1])} m`),e.length===1&&u.push(`${c(t[0])} ${l(t[1])} l`);for(let t=1;t<e.length;t++){let[n,r]=e[t];u.push(`${c(n)} ${l(r)} l`)}u.push(`S`)}return u.push(`Q`),u.join(`
+`)}const Ft=Ct(` `);function N(e,t,n,r){let i=n*1e3+1e-6,a=wt(r),o=Tt(Ft,r),s=[],c=[];for(let n of e.split(/\r\n|\r|\n/)){let e=/[\ud800-\udfff]/.test(n)?Array.from(n):void 0,r=(t,r)=>e?e.slice(t,r).join(``):n.slice(t,r),l=Ct(n),u=0,d=0,f=()=>{let e=c.length/2,n=c[0]??0,i=c[c.length-1]??0,a=e>0&&i-n===d+e-1,o,f;if(a)o=r(n,i),f=l.slice(n,i);else{let e=[],t=[];for(let n=0;n<c.length;n+=2)e.push(r(c[n],c[n+1])),t.push(l.slice(c[n],c[n+1]));o=e.join(` `),f=t.join(Ft)}s.push({text:o,bytes:f,width:u*t/1e3}),c.length=0,u=0,d=0},p=s.length;for(let e=0;e<l.length;){if(l.charCodeAt(e)===32){e++;continue}let n=e,r=l.indexOf(` `,n),s=r===-1?l.length:r;e=s;let p=0;for(let e=n;e<s;e++)p+=a[l.charCodeAt(e)];if(c.length>0&&(u+o+p)*t<=i){c.push(n,s),u+=o+p,d+=s-n;continue}if(c.length>0&&f(),p*t<=i){c.push(n,s),u=p,d=s-n;continue}for(;n<s;){let e=n,r=0;for(;e<s;){let o=a[l.charCodeAt(e)];if(e>n&&(r+o)*t>i)break;r+=o,e++}c.length=0,c.push(n,e),u=r,d=e-n,e<s&&f(),n=e}}(c.length>0||s.length===p)&&f()}return s}const It={width:595.28,height:841.89},Lt=1.3,Rt={1:18,2:13,3:11},zt=Object.fromEntries(gt.map(e=>[e.font,e.resource])),P=(e,t)=>typeof e==`number`&&Number.isFinite(e)&&e>0?e:t,Bt=(e,t)=>typeof e==`number`&&Number.isFinite(e)&&e>=0?e:t,F=e=>typeof e==`string`?e:e==null?``:String(e),Vt=e=>e===`bold`||e===`italic`?e:`regular`;function Ht(e){let t=Math.round(P(e?.width,It.width)*100)/100,n=Math.round(P(e?.height,It.height)*100)/100,r=e?.margin,i=e=>Bt(typeof r==`number`?r:typeof r==`object`&&r?r[e]:void 0,56),a={top:i(`top`),right:i(`right`),bottom:i(`bottom`),left:i(`left`)};if(t-a.left-a.right<72||n-a.top-a.bottom<72){let e=Math.max(0,Math.min((t-72)/2,(n-72)/2,56));a={top:e,right:e,bottom:e,left:e}}return{width:t,height:n,margin:a}}var Ut=class{pages=[];ops=[];y;left;right;bottom;constructor(e){this.g=e,this.left=e.margin.left,this.right=e.width-e.margin.right,this.bottom=e.height-e.margin.bottom,this.y=e.margin.top,this.pages.push(this.ops)}get contentWidth(){return this.right-this.left}get atTop(){return this.y<=this.g.margin.top}newPage(){this.ops=[],this.pages.push(this.ops),this.y=this.g.margin.top}ensure(e){this.y+e>this.bottom+1e-6&&!this.atTop&&this.newPage()}pdfY(e){return M(this.g.height-e)}text(e,t,n,r,i){i.length!==0&&this.ops.push(`BT /${zt[r]} ${M(n)} Tf ${M(e)} ${this.pdfY(t+n)} Td ${Dt(i)} Tj ET`)}alignX(e,t,n=this.left,r=this.contentWidth){return t===`center`?n+(r-e.width)/2:t===`right`?n+r-e.width:n}paragraph(e,t,n,r,i){let a=t*Lt;for(let i of N(e,t,this.contentWidth,n))this.ensure(a),this.text(this.alignX(i,r),this.y,t,n,i.bytes),this.y+=a;this.y+=i}heading(e,t){let n=Rt[t],r=N(e,n,this.contentWidth,`bold`),i=this.atTop?0:n*.6;this.ensure(i+r.length*n*Lt+n*.4+20*Lt),this.atTop||(this.y+=i),this.paragraph(e,n,`bold`,`left`,n*.4)}spacer(e){this.y+=e,this.y>this.bottom&&this.newPage()}rule(){this.ensure(12);let e=this.pdfY(this.y+6);this.ops.push(`0.75 w 0.6 G ${M(this.left)} ${e} m ${M(this.right)} ${e} l S 0 G`),this.y+=12}pageBreak(){this.atTop||this.newPage()}table(e,t,n){if(e.length===0)return;let r=e.map(e=>P(e.width,1)),i=r.reduce((e,t)=>e+t,0),a=[],o=r.map(e=>this.contentWidth*e/i);o.reduce((e,t)=>(a.push(e),e+t),this.left);let s=n*Lt,c=(e,t)=>o.map((r,i)=>N(F(e[i]),n,r-8,t)),l=c(e.map(e=>e.header),`bold`),u=e=>Math.max(1,...e.map(e=>e.length)),d=u(l)*s+8,f=(e,t,r,i,c)=>{let l=r*s+8,u=this.pdfY(this.y+l);c&&this.ops.push(`0.92 g ${M(this.left)} ${u} ${M(this.contentWidth)} ${M(l)} re f 0 g`),this.ops.push(`0.5 w 0.7 G`);for(let e=0;e<o.length;e++)this.ops.push(`${M(a[e])} ${u} ${M(o[e])} ${M(l)} re S`);this.ops.push(`0 G`),e.forEach((e,o)=>{for(let c=0;c<r;c++){let r=e[t+c];r&&this.text(a[o]+4,this.y+4+c*s,n,i,r.bytes)}}),this.y+=l},p=()=>f(l,0,u(l),`bold`,!0);this.ensure(d+s+8),p();let m=!0;for(let e of t){let t=c(Array.isArray(e)?e:[],`regular`),n=u(t),r=0;for(;r<n;){let e=Math.floor((this.bottom-this.y-8+1e-6)/s),i=n-r;if(e>=i){f(t,r,i,`regular`,!1),m=!1;break}if(m){let i=Math.max(1,e);if(f(t,r,i,`regular`,!1),r+=i,r>=n)break}this.newPage(),p(),m=!0}}this.y+=10*.5}signature(e){let t=Math.min(P(e.width,220),this.contentWidth),n=P(e.height,70),r=N(F(e.label),9,this.contentWidth,`regular`).filter(e=>e.bytes),i=(Array.isArray(e.caption)?e.caption:[]).flatMap(e=>N(F(e),9,this.contentWidth,`regular`)).filter(e=>e.bytes),a=9*Lt;this.ensure(r.length*a+n+4+i.length*a);for(let e of r)this.text(this.left,this.y,9,`regular`,e.bytes),this.y+=a;let o=this.y,s=N(F(e.typedName),20,t,`italic`)[0];s?.bytes&&this.text(this.left+4,o+n-28,20,`italic`,s.bytes);let c=Pt(e.strokes,{x:this.left,top:this.g.height-o,width:t,height:n});c&&this.ops.push(c),this.y=o+n+2;let l=this.pdfY(this.y);this.ops.push(`0.5 w 0.4 G ${M(this.left)} ${l} m ${M(this.left+t)} ${l} l S 0 G`),this.y+=2;for(let e of i)this.text(this.left,this.y,9,`regular`,e.bytes),this.y+=a;this.y+=12}block(e){switch(e.type){case`heading`:this.heading(F(e.text),e.level===2||e.level===3?e.level:1);break;case`paragraph`:{let t=P(e.size,10),n=e.align===`center`||e.align===`right`?e.align:`left`;this.paragraph(F(e.text),t,Vt(e.font),n,t*.5);break}case`spacer`:this.spacer(Bt(e.height,0));break;case`rule`:this.rule();break;case`pageBreak`:this.pageBreak();break;case`table`:this.table(Array.isArray(e.columns)?e.columns:[],Array.isArray(e.rows)?e.rows:[],P(e.size,9));break;case`signature`:this.signature(e);break}}footer(e){if(!e)return;let t=F(e.text),n=this.pages.length;this.pages.forEach((r,i)=>{let a=[t,e.pageNumbers?`Page ${i+1} of ${n}`:``].filter(Boolean);if(a.length===0)return;let[o]=N(a.join(` · `),8,this.contentWidth,`regular`),s=this.alignX(o,`center`),c=this.g.margin.bottom/2;r.push(`BT /F1 8 Tf ${M(s)} ${M(c)} Td ${Dt(o.bytes)} Tj ET`)})}};function Wt(e,t,n){let r=new Ut(e);for(let e of Array.isArray(t)?t:[])e&&typeof e==`object`&&r.block(e);return r.footer(n),r.pages.map(e=>e.join(`
+`))}function Gt(e){let t=[],n=(e,n)=>{typeof n==`string`&&n!==``&&t.push(`/${e} ${Ot(n)}`)};if(n(`Title`,e?.title),n(`Author`,e?.author),n(`Subject`,e?.subject),n(`Keywords`,e?.keywords),n(`Creator`,e?.creator),n(`Producer`,`semics pdf`),e?.creationDate instanceof Date){let n=kt(e.creationDate);n&&t.push(`/CreationDate (${n})`)}return`<< ${t.join(` `)} >>`}function Kt(e){let t=Ht(e.page),n=Wt(t,e.blocks,e.footer),r=[`<< /Type /Catalog /Pages 2 0 R >>`,``,Gt(e.info)],i=gt.map(e=>(r.push(`<< /Type /Font /Subtype /Type1 /BaseFont /${e.baseFont} /Encoding /WinAnsiEncoding >>`),`/${e.resource} ${r.length} 0 R`)).join(` `),a=`[0 0 ${M(t.width)} ${M(t.height)}]`,o=[];for(let e of n){r.push(At(e));let t=r.length;r.push(`<< /Type /Page /Parent 2 0 R /MediaBox ${a} /Resources << /Font << ${i} >> >> /Contents ${t} 0 R >>`),o.push(`${r.length} 0 R`)}return r[1]=`<< /Type /Pages /Kids [${o.join(` `)}] /Count ${o.length} >>`,jt(r,1,3)}async function qt(e,t){let n=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(`${t}:${e}`));return S(new Uint8Array(n).slice(0,16))}async function Jt(e,t,n,r){let i=Math.floor(n/(r.windowSeconds*1e3)),a=`rl:${r.scope}:${await qt(t,r.salt)}:${i}`,o=Number.parseInt(await e.get(a)??`0`,10),s=Number.isFinite(o)&&o>0?o:0;return s>=r.limit?T(`RATE_LIMITED`):(await e.set(a,`${s+1}:${(i+1)*r.windowSeconds}`,{ttlSeconds:r.windowSeconds*2}),w({remaining:r.limit-s-1}))}async function Yt(e,t,n){let r=(await e.list(`rl:`)).filter(({value:e})=>!(Number(String(e).split(`:`)[1])*1e3>t)).map(({key:e})=>e);for(let t of r.slice(0,n))await e.delete(t);return{calls:1+Math.min(n,r.length),more:r.length>n}}const Xt=`cron:scheduled:v11`,Zt=`ensure-schedules`;async function Qt(e,t){try{if(await e.kv.get(Xt))return;await e.cron?.schedule(Zt,{schedule:new Date(t).toISOString()})}catch{}}async function $t(e,t){let n=e.cron;if(!n)return!1;for(let e of t)await n.schedule(e.name,{schedule:e.schedule});return!0}async function en(e,t,n){await $t(e,t)&&await e.kv.set(Xt,{at:new Date(n).toISOString()})}async function tn(e,t,n,r){return e.name===Zt?(await en(t,n,r),!0):!1}function nn(e){return typeof e==`object`&&!!e&&e.type===`page_load`}function rn(e,t=()=>!0,n=Date.now){let r=e.handler,i=async(e,i)=>(t(e?.input)&&await Qt(i,n()),r(e,i));return{...e,handler:i}}var an=class extends Error{code=`TEMPLATE_MISSING_FIELD`;constructor(e){super(`Template field "${e}" has no value`),this.field=e,this.name=`TemplateError`}};const on=/\{\{\s*([A-Za-z_][A-Za-z0-9_.]*)\s*\}\}/g,sn={"&":`&amp;`,"<":`&lt;`,">":`&gt;`,'"':`&quot;`,"'":`&#39;`};function cn(e){return e.replace(/\s*[\r\n]+\s*/g,` `).replace(/[\\&<>"'#[\]()*_`~|{}+!-]/g,e=>sn[e]??`\\${e}`)}function ln(e){return[...new Set([...e.matchAll(on)].map(e=>e[1]))]}function un(e,t){return e.replace(on,(e,n)=>{let r=Object.hasOwn(t,n)?t[n]:void 0;if(r===void 0)throw new an(n);return cn(String(r))})}function dn(e){return`${e.replace(/^/,``).replace(/\r\n?/g,`
+`).normalize(`NFC`).split(`
+`).map(e=>e.replace(/[ \t]+$/,``)).join(`
+`).replace(/\n+$/,``)}\n`}async function I(e){let t=typeof e==`string`?new TextEncoder().encode(e):new Uint8Array(e);return S(await crypto.subtle.digest(`SHA-256`,t))}const fn={"&":`&amp;`,"<":`&lt;`,">":`&gt;`,'"':`&quot;`,"'":`&#39;`},pn=e=>e.replace(/[&<>"']/g,e=>fn[e]),mn=e=>e.replace(/\s*[\r\n]+\s*/g,` `),hn=/\{\{(\w+)\}\}/g;function gn(e,t,n){return e.replace(hn,(e,r)=>n(t[r]??``))}const _n=`January February March April May June July August September October November December`.split(` `);function vn(e){let t=new Date(e);return`${t.getUTCDate()} ${_n[t.getUTCMonth()]} ${t.getUTCFullYear()}`}function yn(e,t,n){let r=Object.fromEntries(Object.entries(n).map(([e,t])=>[e,mn(t)]));return{to:e,subject:gn(t.subject,r,e=>e),text:gn(t.text,r,e=>e),html:gn(t.html,r,pn)}}function bn(e){let t=e.expiresAt?`This request expires on ${vn(e.expiresAt)}.`:``;return yn(e.to,{subject:`{{sender}} asks you to sign: {{title}}`,text:`Hello {{name}},
+
+{{sender}} has asked you to review and sign "{{title}}" electronically.{{expiry}}
+
+Open this link to read the document and sign:
+{{link}}
+
+This link is personal to you. Please do not forward it.
+`,html:`<p>Hello {{name}},</p>
+<p>{{sender}} has asked you to review and sign &quot;{{title}}&quot; electronically.{{expiry}}</p>
+<p><a href="{{link}}">Review and sign the document</a></p>
+<p>This link is personal to you. Please do not forward it.</p>`},{name:e.signerName,title:e.title,sender:e.sender,link:e.link,expiry:t?` ${t}`:``})}function xn(e){return yn(e.to,{subject:`Signed: {{title}}`,text:`Hello {{name}},
+
+Thank you. "{{title}}" for {{sender}} is now signed.
+Get your signed copy here (the page issues a fresh download link each time):
+{{link}}
+`,html:`<p>Hello {{name}},</p>
+<p>Thank you. &quot;{{title}}&quot; for {{sender}} is now signed.</p>
+<p><a href="{{link}}">Get your signed copy</a> (the page issues a fresh download link each time).</p>`},{name:e.signerName,title:e.title,sender:e.sender,link:e.link})}const Sn=`outbox-drain`;function Cn(e){let t=e.storage.outbox;return{put:(e,n)=>t.put(e,n),putMany:e=>t.putMany([...e]),query:({status:e,nextAttemptAtLte:n,limit:r})=>t.query({where:{status:e,...n===void 0?{}:{nextAttemptAt:{lte:n}}},orderBy:{nextAttemptAt:`asc`},limit:r})}}function wn(e){try{let{origin:t}=new URL(e.site.url);return t===`null`?``:t}catch{return``}}const Tn=(e,t)=>typeof t==`string`&&t.trim()!==``?t.trim():e.site.name,En=`The site URL is not set, so signing invitations and signed-copy emails are not queued (their links would not work). Set the site URL in EmDash's settings, then use Resend invitation.`;async function Dn(e,t){let{signerId:n,envelope:r,token:i,now:a}=t,o=wn(e);if(!o)return null;let s=bn({to:r.signer.email,signerName:r.signer.name,title:r.title,sender:Tn(e,t.senderSetting),link:`${o}/sign/${i}`,expiresAt:r.expiresAt});return st(Cn(e),s,a,()=>`invite-${n}`)}async function On(e,t){let n=wn(e);if(!n)return null;let r={to:t.envelope.signer.email,signerName:t.envelope.signer.name,title:t.envelope.title,sender:Tn(e,t.senderSetting),link:`${n}/signed/${t.token}`};return st(Cn(e),xn(r),t.now,()=>`complete-${t.envelopeId}`)}async function kn(e,t,n=Date.now()){if(e.name!==Sn)return!1;let r=await lt({storage:Cn(t),email:t.email,now:n});return r.gaveUp>0&&t.log.error(`emails given up after repeated failures`,{count:r.gaveUp}),!0}async function An(e){return ut({storage:Cn(e),email:e.email,now:Date.now()})}const jn=`0`.repeat(64);function Mn(e=b){return S(e(32))}function Nn(e,t){return I(e+t)}function Pn(e,t){return`${e}:a${String(t).padStart(6,`0`)}`}const Fn=e=>Object.keys(e).sort().map(t=>[t,e[t]]);function In(e){let t=JSON.stringify([1,e.envelopeId,e.seq,e.type,e.at,e.actor,Fn(e.data),Fn(e.commitments)]);return I(e.prevHash+t)}async function Ln(e,t,n,r){let i=Object.entries(n.personal??{}).filter(e=>typeof e[1]==`string`),a={};for(let[e,t]of i)a[e]=await Nn(r,t);let o={envelopeId:e,seq:t?t.seq+1:0,type:n.type,at:n.at,actor:n.actor,data:{...n.data},commitments:a,prevHash:t?t.hash:jn};return{...o,personal:i.length>0?Object.fromEntries(i):null,hash:await In(o)}}function Rn(e,t,n){return zn(e,null,t,n)}async function zn(e,t,n,r){let i=[],a=t;for(let t of n){let n=await Ln(e,a,t,r);i.push({id:Pn(e,n.seq),data:n}),a=n}return i}async function Bn(e,t,n,r){let i=r.attempts??2;for(let a=0;a<i;a++){let{items:i}=await e.query({where:{envelopeId:t},orderBy:{seq:`desc`},limit:1}),a=await Ln(t,i[0]?.data??null,n,r.salt);if((await e.compareAndSet(Pn(t,a.seq),null,a)).applied)return w(a)}return T(`CONFLICT`)}async function Vn(e,t){let{items:n}=await e.query({where:{envelopeId:t},orderBy:{seq:`desc`},limit:1});return n[0]?.data??null}async function Hn(e,t){let[n,...r]=t;return n?(await e.compareAndSet(n.id,null,n.data)).applied?(r.length>0&&await e.putMany(r),!0):!1:!0}async function Un(e,t){for(let[n,r]of Object.entries(e.personal??{}))if(e.commitments[n]!==await Nn(t,r))return!1;return!0}async function Wn(e,t,n={}){let r=jn;for(let[i,a]of t.entries()){let t=e=>T({seq:i,reason:e});if(a.envelopeId!==e)return t(`ENVELOPE`);if(a.seq!==i)return t(`SEQ`);if(await In(a)!==a.hash)return t(`HASH`);if(a.prevHash!==r)return t(`PREV_HASH`);if(n.salt!==void 0&&!await Un(a,n.salt))return t(`COMMITMENT`);r=a.hash}return n.head!==void 0&&n.head!==r?T({seq:t.length,reason:`HEAD`}):w({head:r,length:t.length})}function Gn(e){return{...e,personal:null}}function Kn(e,t){return I(`esign-final/1\n${e}\n${t}`)}const qn=[`draft`,`sent`,`in_progress`,`completed`,`declined`,`voided`,`expired`],Jn=[`declined`,`voided`,`expired`],Yn=Object.freeze({draft:[`sent`,`voided`],sent:[`in_progress`,`completed`,...Jn],in_progress:[`completed`,...Jn],completed:[],declined:[],voided:[],expired:[]});function Xn(e){return typeof e==`string`&&qn.includes(e)}function Zn(e,t){return Xn(e)&&Xn(t)&&Yn[e].includes(t)}function Qn(e){return Yn[e].length===0}async function L(e,t,n,r,i={}){if(!Zn(n,r))return T(`ILLEGAL_TRANSITION`);let a=await e.updateIf(t,{where:{status:n},set:{...i,status:r}});return a.applied?w(a.data):T(`CONFLICT`)}const R=(e,t)=>`${e}:v${t}`;function $n(e){if(typeof e!=`object`||!e||Array.isArray(e))return T([{path:``,code:`INVALID_INPUT`}]);let{name:t,body:n,description:r,integrations:i}=e,a=[],o=typeof t==`string`?t.trim():``;return(o.length===0||o.length>200)&&a.push({path:`name`,code:`INVALID_NAME`}),(typeof n!=`string`||n.trim().length===0||n.length>1e5)&&a.push({path:`body`,code:`INVALID_BODY`}),r!==void 0&&(typeof r!=`string`||r.length>1e3)&&a.push({path:`description`,code:`INVALID_DESCRIPTION`}),i!==void 0&&typeof i!=`boolean`&&a.push({path:`integrations`,code:`INVALID_INTEGRATIONS`}),a.length>0?T(a):w({name:o,body:n,...typeof r==`string`&&r!==``?{description:r}:{},...typeof i==`boolean`?{integrations:i}:{}})}function er(e,t){return{...e,status:`version`,templateId:t}}function tr(e,t){let n=$n(e);if(!n.ok)return n;let r={name:n.value.name,...n.value.description===void 0?{}:{description:n.value.description},kind:`text`,status:`active`,public:!1,integrations:n.value.integrations??!1,version:1,body:n.value.body,fields:ln(n.value.body),createdAt:t.now,updatedAt:t.now};return w({head:r,versions:[{id:R(t.id,1),data:er(r,t.id)}]})}function nr(e,t,n){if(e.status===`archived`)return T([{path:``,code:`TEMPLATE_ARCHIVED`}]);let r=$n(t);if(!r.ok)return r;let{description:i,...a}=e,o={...a,...r.value.description===void 0?{}:{description:r.value.description},name:r.value.name,body:r.value.body,fields:ln(r.value.body),integrations:r.value.integrations??e.integrations===!0,version:e.version+1,updatedAt:n.now};return w({head:o,version:{id:R(n.id,o.version),data:er(o,n.id)}})}function rr(e,t){return e.status===`archived`?e:{...e,status:`archived`,updatedAt:t}}function ir(e){return e?.status===`active`&&e.integrations===!0}function ar(e){return e.status===`active`?w(e):T(`TEMPLATE_NOT_FOUND`)}const or=/[\u0000-\u001F\u007F]/,sr=/^[^\s@]+@[^\s@]+\.[^\s@]+$/,cr=/^[A-Za-z0-9_]{1,64}$/,lr=(e,t)=>`${e}:s${t}`,ur=e=>typeof e==`object`&&!!e&&!Array.isArray(e),dr=e=>typeof e==`string`&&e.length>0&&e.length<=200&&!e.includes(`:`);function fr(e){let t=typeof e==`string`?e.trim():``;return t.length>0&&t.length<=200&&!or.test(t)?t:null}function pr(e){let t=typeof e==`string`?e.trim().toLowerCase():``;return t.length<=254&&sr.test(t)?t:null}function mr(e){if(e===void 0)return{};if(!ur(e))return null;let t=Object.entries(e);if(t.length>32)return null;let n={};for(let[e,r]of t){if(!cr.test(e)||typeof r!=`string`||[...r].length>500)return null;n[e]=r}return n}function hr(e){if(e===void 0)return[];if(!Array.isArray(e)||e.length>16)return null;let t=[];for(let n of e){if(!ur(n)||typeof n.key!=`string`||!cr.test(n.key)||t.some(e=>e.key===n.key))return null;let e=typeof n.label==`string`?n.label.trim():``;if(e===``||[...e].length>100||or.test(e)||n.required!==void 0&&typeof n.required!=`boolean`)return null;t.push({key:n.key,label:e,...n.required?{required:!0}:{}})}return t}function gr(e){if(!ur(e))return T([{path:``,code:`INVALID_INPUT`}]);let{templateId:t,templateVersion:n,title:r,signer:i,fields:a}=e,o=[];dr(t)||o.push({path:`templateId`,code:`INVALID_TEMPLATE_ID`}),n!==void 0&&!(Number.isSafeInteger(n)&&n>=1)&&o.push({path:`templateVersion`,code:`INVALID_VERSION`});let s=typeof r==`string`?r.trim():void 0;r!==void 0&&!(s&&s.length<=200&&!or.test(s))&&o.push({path:`title`,code:`INVALID_TITLE`});let c=ur(i)?i:{},l=fr(c.name),u=pr(c.email);l===null&&o.push({path:`signer.name`,code:`INVALID_SIGNER_NAME`}),u===null&&o.push({path:`signer.email`,code:`INVALID_SIGNER_EMAIL`});let d=mr(a);d===null&&o.push({path:`fields`,code:`INVALID_FIELDS`});let f=hr(e.signerFields);return f===null&&o.push({path:`signerFields`,code:`INVALID_FIELDS`}),o.length>0?T(o):w({templateId:t,...n===void 0?{}:{templateVersion:n},...s===void 0?{}:{title:s},signer:{name:l,email:u,as:`self`},fieldValues:d,...f&&f.length>0?{signerFields:f}:{}})}function _r(e,t,n){let r=e?ar(e):T(`TEMPLATE_NOT_FOUND`);return!r.ok||n===void 0?r:t?.status===`version`&&t.version===n?w(t):T(`TEMPLATE_NOT_FOUND`)}function vr(e){let{signer:t}=e;return{...e.fieldValues,"signer.name":t.name,"signer.email":t.email,...t.participant?{"participant.name":t.participant.name}:{}}}function yr(e,t){let n=vr(e);return ln(t).filter(e=>!Object.hasOwn(n,e)).map(e=>({path:`fields.${e}`,code:`MISSING_FIELD`}))}function br(e,t,n){let{title:r,...i}=e,a={title:r??t.name,templateVersion:t.version,status:`draft`,routing:`parallel`,...i,signerEmail:i.signer.email.toLowerCase(),signerIds:[],docSha256:null,snapshot:null,expiresAt:null,sentAt:null,completedAt:null,finalHash:null,piiSalt:n.piiSalt,createdAt:n.now,updatedAt:n.now},o=yr(a,t.body);return o.length>0?T(o):w(a)}function xr(e,t,n){return br({templateId:e.templateId,signer:e.signer,fieldValues:e.fieldValues,delivery:`email`,...e.title===void 0?{}:{title:e.title},...e.signerFields?{signerFields:e.signerFields}:{}},t,n)}function Sr(e,t,n){let r={name:e.signer.name.trim(),email:e.signer.email.trim().toLowerCase(),as:e.as??`self`,...e.participant?{participant:{name:e.participant.name.trim()}}:{}};return br({templateId:e.tpl,signer:r,fieldValues:{...e.prefill},delivery:e.delivery??`inline`,clientId:e.cid,externalRef:e.ref,returnUrl:e.returnUrl},t,n)}function Cr(e){let t=0;for(let n=e.indexOf(`
+`);n!==-1;n=e.indexOf(`
+`,n+1))t++;return t}async function wr(e,t){let n;try{n=un(t,vr(e))}catch(e){if(e instanceof an)return T([{path:`fields.${e.field}`,code:`MISSING_FIELD`}]);throw e}let r=dn(n);return r.length>131072||Cr(r)>1500?T([{path:`body`,code:`DOCUMENT_TOO_LARGE`}]):w({text:r,docSha256:await I(r)})}const Tr=e=>e>=55296&&e<=56319;function Er(e,t,n){let r=[];for(let e=0;e<t.length;){let n=Math.min(e+65536,t.length);n<t.length&&Tr(t.charCodeAt(n-1))&&n--,r.push(t.slice(e,n)),e=n}let i=`${e}:${n.slice(0,16)}`;return r.map((t,a)=>({id:`${i}:${a}`,data:{envelopeId:e,contentType:`text/markdown`,index:a,count:r.length,data:t,sha256:n}}))}function Dr(e){let t=e[0];if(!t||e.length!==t.count)return null;let n=[...e].sort((e,t)=>e.index-t.index);return n.every((e,n)=>e.index===n&&e.count===t.count&&e.sha256===t.sha256)?n.map(e=>e.data).join(``):null}async function Or(e,t,n,r){if(!Zn(t.status,`sent`))return T(`ILLEGAL_TRANSITION`);if(n.version!==t.templateVersion)return T(`TEMPLATE_MISMATCH`);let i=await wr(t,n.body);if(!i.ok)return i;let{text:a,docSha256:o}=i.value,s=Er(e,a,o),c=lr(e,1),{signer:l}=t;return w({envelope:{...t,status:`sent`,docSha256:o,snapshot:{ids:s.map(e=>e.id),length:a.length},signerIds:[c],sentAt:r.now,expiresAt:j(Date.parse(r.now)+r.expiryDays*864e5),updatedAt:r.now},chunks:s,signer:{id:c,data:{envelopeId:e,order:1,role:`signer`,name:l.name,email:l.email,as:l.as,...l.participant?{participant:l.participant}:{},status:`pending`,tokenHash:r.tokenHash,createdAt:r.now}}})}const kr=[`declined`,`voided`,`expired`];function Ar(e){return e.find(e=>!kr.includes(e.data.status))}async function jr(e,t,n){return`env_${(await I(`${e}\n${t}`)).slice(0,32)}_${n}`}function Mr(e,t,n){let{signer:r,clientId:i,externalRef:a}=e;return{type:`envelope.created`,at:e.createdAt,actor:t,data:{source:t===`admin`?`admin`:`intent`,templateId:e.templateId,templateVersion:e.templateVersion,title:e.title,delivery:e.delivery,as:r.as,...i===void 0?{}:{clientId:i},...a===void 0?{}:{externalRef:a},...n?{userId:n}:{}},personal:{name:r.name,email:r.email,...r.participant?{participant:r.participant.name}:{}}}}function Nr(e,t,n){return{type:`envelope.sent`,at:e.updatedAt,actor:t,data:{docSha256:e.docSha256,expiresAt:e.expiresAt,signerIds:e.signerIds.join(`,`),...n?{userId:n}:{}},personal:{email:e.signer.email}}}function Pr(e={}){let t=[];return new Headers(e.headers).forEach((e,n)=>t.push([n,e])),{__emdashPluginResponse:!0,status:e.status??200,headers:t,body:e.body??null}}const Fr={amp:`&`,lt:`<`,gt:`>`,quot:`"`,"#39":`'`},Ir=/^&(amp|lt|gt|quot|#39);/,Lr=/[!-/:-@[-`{-~]/,Rr=/[\p{L}\p{N}]/u,zr=/[\s"'<>`\\\u0000-\u001F\u007F]/,Br=/^(https?:\/\/|mailto:)/i,Vr=new Set([`\\`,`&`,`
+`,"`",`*`,`_`,`[`,`!`,`<`]),Hr=/[\\&\n`*_[!<]/g;function Ur(e){if(!(e.length===0||zr.test(e)||!Br.test(e)))try{return new URL(e).href}catch{return}}function Wr(e){return e.replace(/\\([!-/:-@[-`{-~])|&(amp|lt|gt|quot|#39);/g,(e,t,n)=>t===void 0?Fr[n]:t)}function Gr(e){let t=new Map,n={"]":[],")":[]},r={"[":`]`,"(":`)`},i=/[\\[\]()]/g;for(let a=i.exec(e);a;a=i.exec(e)){let e=a.index,o=a[0];if(o===`\\`)i.lastIndex=e+2;else if(o in r)n[r[o]]?.push(e);else{let r=n[o]?.pop();r!==void 0&&t.set(r,e)}}return t}var Kr=class{partner;memo=new Map;constructor(e){this.src=e,this.partner=Gr(e)}parse(e,t,n){let{src:r}=this,i=[],a=``,o=()=>{a&&i.push({type:`text`,text:a}),a=``},s=e;for(;s<t;){let e=r[s];if(!Vr.has(e)){Hr.lastIndex=s;let e=Hr.exec(r),n=e&&e.index<t?e.index:t;a+=r.slice(s,n),s=n;continue}if(e===`\\`&&s+1<t&&Lr.test(r[s+1])){a+=r[s+1],s+=2;continue}let c=e===`&`?Ir.exec(r.slice(s,Math.min(t,s+6))):null;if(c){a+=Fr[c[1]],s+=c[0].length;continue}if(e===`
+`){o(),i.push({type:`break`}),s++;continue}let l=n<6?this.markup(s,t,n):void 0;l?.inline?(o(),i.push(l.inline)):a+=l?l.text:e,s=l?l.end:s+1}return o(),i}markup(e,t,n){let r=this.src[e];if(r==="`")return this.codeSpan(e,t);if(r===`*`||r===`_`)return this.emphasis(e,t,n);if(r===`[`)return this.link(e,t,n,!1);if(r===`!`&&this.src[e+1]===`[`)return this.link(e+1,t,n,!0);if(r===`<`)return this.autolink(e,t)}next(e,t,n,r){let i=this.memo.get(e);if(i&&t>=i.from&&(i.at===-1||t<=i.at))return i.at;let a=n(t);for(;a!==-1&&!r(a);)a=n(a+1);return this.memo.set(e,{from:t,at:a}),a}escaped(e){let t=0;for(let n=e-1;n>=0&&this.src[n]===`\\`;n--)t++;return t%2==1}codeSpan(e,t){let{src:n}=this,r=1;for(;n[e+r]==="`";)r++;let i="`".repeat(r),a=this.next(`code${r}`,e+r,e=>n.indexOf(i,e),e=>n[e-1]!=="`"&&n[e+r]!=="`");return a===-1||a+r>t?{text:i,end:e+r}:{inline:{type:`code`,text:Wr(n.slice(e+r,a))},end:a+r}}emphasis(e,t,n){let{src:r}=this,i=r[e],a=r[e+1]===i?i+i:i,o=e+a.length,s=e=>e>=0&&e<r.length&&Rr.test(r[e]),c=e=>i===`_`&&s(e),l={text:a,end:o};if(c(e-1)||o>=t||/\s/.test(r[o]))return l;let u=this.next(a,o+1,e=>r.indexOf(a,e),e=>!this.escaped(e)&&!/\s/.test(r[e-1])&&!c(e+a.length));if(u===-1||u+a.length>t)return l;let d=this.parse(o,u,n+1);return{inline:{type:a.length===2?`strong`:`em`,children:d},end:u+a.length}}link(e,t,n,r){let{src:i}=this,a={text:r?`![`:`[`,end:e+1},o=this.partner.get(e);if(o===void 0||o>=t||i[o+1]!==`(`)return a;let s=this.partner.get(o+1);if(s===void 0||s>=t)return a;let c=s+1;if(r)return{text:Wr(i.slice(e+1,o)),end:c};let l=Ur(Wr(i.slice(o+2,s)));return l?{inline:{type:`link`,href:l,children:this.parse(e+1,o,n+1)},end:c}:{text:Wr(i.slice(e,c)),end:c}}autolink(e,t){let n=/^<([A-Za-z][A-Za-z0-9+.-]*:[^\s<>]*)>/.exec(this.src.slice(e,Math.min(t,e+2048))),r=n?Ur(n[1]):void 0;if(!(!n||!r))return{inline:{type:`link`,href:r,children:[{type:`text`,text:n[1]}]},end:e+n[0].length}}};function qr(e){return new Kr(e).parse(0,e.length,0)}const Jr=/^ {0,3}(`{3,}|~{3,})/,Yr=/^ {0,3}(#{1,6})(?:[ \t]+(.*?))?(?:[ \t]+#+)?[ \t]*$/,Xr=/^ {0,3}([-*_])(?:[ \t]*\1){2,}[ \t]*$/,Zr=/^ {0,3}> ?(.*)$/,Qr=/^ {0,3}[-*+][ \t]+(.*)$/,$r=/^ {0,3}(\d{1,9})[.)][ \t]+(.*)$/,ei=e=>e.trim()===``,ti=e=>Jr.test(e)||Yr.test(e)||Xr.test(e)||Zr.test(e)||Qr.test(e)||$r.test(e);function ni(e,t){let n=[],r=0;for(;r<e.length;){let i=e[r];if(ei(i)){r++;continue}let a=Jr.exec(i);if(a){let t=a[1],i=RegExp(`^ {0,3}${t[0]}{${t.length},}[ \\t]*$`),o=[];for(r++;r<e.length&&!i.test(e[r]);)o.push(e[r]),r++;r++,n.push({type:`code`,text:Wr(o.join(`
+`))});continue}if(Xr.test(i)){n.push({type:`rule`}),r++;continue}let o=Yr.exec(i);if(o){let e=Math.min(6,o[1].length+1);n.push({type:`heading`,level:e,children:qr(o[2]??``)}),r++;continue}if(Zr.test(i)&&t<4){let i=[];for(;r<e.length&&Zr.test(e[r]);)i.push(Zr.exec(e[r])[1]),r++;n.push({type:`quote`,children:ni(i,t+1)});continue}let s=Qr.test(i),c=$r.exec(i);if(s||c){let t=s?Qr:$r,i=[];for(;r<e.length;){let n=e[r],a=t.exec(n);if(a)i.push([s?a[1]:a[2]]);else if(!ei(n)&&/^ {2,}\S/.test(n)&&!ti(n.trimStart()))i.at(-1).push(n.trim());else break;r++}n.push({type:`list`,ordered:!s,...c&&c[1]!==`1`?{start:Number(c[1])}:{},items:i.map(e=>qr(e.join(`
+`)))});continue}let l=[i.trim()];for(r++;r<e.length&&!ei(e[r])&&!ti(e[r]);)l.push(e[r].trim()),r++;n.push({type:`paragraph`,children:qr(l.join(`
+`))})}return n}function ri(e){return ni(e.replace(/\r\n?/g,`
+`).split(`
+`),0)}const ii=262144/4*3,ai={self:`Self`,guardian:`Parent or guardian`,buyer:`Buyer`},oi=e=>e?`${e.slice(0,10)} ${e.slice(11,19)} UTC`:``;function si(e){return e.map(e=>{switch(e.type){case`text`:case`code`:return e.text;case`break`:return`
+`;case`link`:{let t=si(e.children);return t===e.href?t:`${t} (${e.href})`}default:return si(e.children)}}).join(``)}function ci(e){let t=[],n=(e,r)=>{for(let i of e)switch(i.type){case`heading`:t.push({type:`heading`,text:si(i.children),level:Math.min(i.level,3)});break;case`paragraph`:t.push({type:`paragraph`,text:si(i.children),...r?{font:`italic`}:{}});break;case`list`:i.items.forEach((e,n)=>{let a=i.ordered?`${(i.start??1)+n}.`:`•`;t.push({type:`paragraph`,text:`${a} ${si(e)}`,...r?{font:`italic`}:{}})});break;case`quote`:n(i.children,!0);break;case`code`:t.push({type:`paragraph`,text:i.text,size:9});break;case`rule`:t.push({type:`rule`});break}};return n(ri(e),!1),t}function li(e){let t=e.signature,n=[e.name,`Signed ${oi(e.signedAt)}`];return t?.kind===`drawn`&&t.strokes?{type:`signature`,label:`Signature`,strokes:{v:1,w:1,h:1,strokes:t.strokes},caption:t.typedName?[t.typedName,...n]:n}:{type:`signature`,label:`Signature`,typedName:t?.typedName??e.name,caption:n}}function ui(e,t,n){let r=e.envelope.signerFields??[];if(r.length===0)return[];let i=t.fieldValues??{};return[{type:`spacer`,height:12},{type:`heading`,text:`Details entered by ${n?t.name:`the signer`}`,level:2},{type:`table`,columns:[{header:`Field`},{header:`Value`,width:2}],rows:r.map(e=>[e.label,i[e.key]??``])}]}function di(e){let{envelope:t,signers:n,events:r,head:i,envelopeId:a}=e,o=n.length>1,s=[[`Envelope`,a],[`Document`,t.title],[`Document SHA-256`,t.docSha256??``],...n.flatMap((e,t)=>[[o?`Signer ${t+1}`:`Signer`,e.name],[`Signing as`,ai[e.as]??e.as],...e.participant?[[`Participant`,e.participant.name]]:[],[`Signature`,e.signature?.kind===`drawn`?`Drawn`:`Typed`],[`Signature SHA-256`,e.signature?.sha256??``],[`Consent version`,e.consentVersion??``],...e.consentSha256?[[`Consent wording SHA-256`,e.consentSha256]]:[],...e.otpVerifiedAt?[[`Identity check`,`Email one-time code verified`]]:[],[`Signed`,oi(e.signedAt)]]),[`Completed`,oi(t.completedAt)],[`Audit events`,String(r.length)]],c=r.map(e=>[String(e.seq+1),oi(e.at),e.type,typeof e.data.signer==`number`?`signer ${e.data.signer}`:e.actor,e.personal?.ip??``,e.hash.slice(0,16)]);return{info:{title:t.title,subject:`Signed document and certificate of completion`,creator:`semics e-sign`,...t.completedAt?{creationDate:new Date(t.completedAt)}:{}},footer:{text:`Envelope ${a}`,pageNumbers:!0},blocks:[{type:`heading`,text:t.title,level:1},...ci(e.snapshot),...n.flatMap(t=>[...ui(e,t,o),{type:`spacer`,height:18},li(t)]),{type:`pageBreak`},{type:`heading`,text:`Certificate of completion`,level:1},{type:`paragraph`,text:`This certificate records how the document above was signed. It was signed with a simple electronic signature: the signer consented to sign electronically, confirmed their intent to sign, and signed the exact text identified by the document SHA-256 below. Every step is recorded in a hash-chained audit trail; the final hash binds the document to the end of that trail. Anyone holding this PDF can check these values on the verify page.`},{type:`spacer`,height:8},{type:`table`,columns:[{header:`Field`},{header:`Value`,width:3}],rows:s},{type:`spacer`,height:8},{type:`heading`,text:`Audit trail`,level:2},{type:`table`,columns:[{header:`#`,width:.4},{header:`Time`,width:1.6},{header:`Event`,width:1.6},{header:`Actor`,width:.8},{header:`IP address`,width:1.2},{header:`Event hash (first 16)`,width:1.6}],rows:c,size:8},{type:`spacer`,height:8},{type:`paragraph`,text:`Audit chain head`,font:`bold`,size:9},{type:`paragraph`,text:i,size:9},{type:`paragraph`,text:`Final hash`,font:`bold`,size:9},{type:`paragraph`,text:t.finalHash??``,size:9}]}}async function fi(e){let t=Kt(di(e));return{bytes:t,sha256:await I(t)}}const z=new TextEncoder().encode(`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/`);function pi(e){let t=new Uint8Array(Math.ceil(e.length/3)*4),n=e.length-e.length%3,r=0;for(let i=0;i<n;i+=3){let n=e[i]<<16|e[i+1]<<8|e[i+2];t[r++]=z[n>>18],t[r++]=z[n>>12&63],t[r++]=z[n>>6&63],t[r++]=z[n&63]}if(n<e.length){let i=n+1<e.length,a=e[n]<<16|(i?e[n+1]<<8:0);t[r++]=z[a>>18],t[r++]=z[a>>12&63],t[r++]=i?z[a>>6&63]:61,t[r++]=61}return new TextDecoder().decode(t)}function mi(e){try{let t=atob(e),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch{return null}}const hi=(e,t,n)=>`${e}:pdf:${t.slice(0,16)}:${n}`;function gi(e,t,n){let r=Math.max(1,Math.ceil(t.length/ii));return Array.from({length:r},(i,a)=>({id:hi(e,n,a),data:{envelopeId:e,kind:`signed-pdf`,contentType:`application/pdf`,index:a,count:r,bytes:t.length,sha256:n,data:pi(t.subarray(a*ii,(a+1)*ii))}}))}function _i(e){let t=e[0];if(!t||e.length!==t.count)return null;let n=[...e].sort((e,t)=>e.index-t.index),r=new Uint8Array(t.bytes),i=0;for(let[e,a]of n.entries()){if(a.index!==e||a.sha256!==t.sha256||a.bytes!==t.bytes)return null;let n=mi(a.data);if(!n||i+n.length>r.length)return null;r.set(n,i),i+=n.length}return i===r.length?r:null}const vi=`signed-pdf-`,yi=e=>`${vi}${e}`;function bi(e,t,n,r=0){return e?.schedule(yi(t),{schedule:j(n),data:{envelopeId:t,attempt:r}})}async function xi(e,t,n){let{envelopes:r,signers:i,snapshots:a,audit_events:o,artifacts:s}=V(e),c=await r.get(t);if(!c||c.status!==`completed`||c.pdfSha256||c.personalPurgedAt||c.signerIds.length===0||!c.snapshot||!c.docSha256)return`skipped`;let[l,u,d]=await Promise.all([i.getMany(c.signerIds),a.getMany(c.snapshot.ids),o.query({where:{envelopeId:t},orderBy:{seq:`asc`},limit:100})]),f=Dr([...u.values()]),p=d.items.map(e=>e.data),m=await Wn(t,p),h=m.ok&&p.at(-1)?.type===`envelope.completed`&&await Kn(c.docSha256,m.value.head)===c.finalHash,g=c.signerIds.map(e=>l.get(e));if(g.some(e=>e?.status!==`signed`)||f===null||!m.ok||!h){let r=n.attempt??0;return r+1>=5?(e.log.error(`signed PDF not generated: the envelope never settled`,{envelopeId:t}),`gave-up`):(await bi(e.cron,t,n.now+6e4,r+1),`retry`)}let{bytes:_,sha256:v}=await fi({envelopeId:t,envelope:c,signers:g,snapshot:f,events:p,head:m.value.head}),y=gi(t,_,v);return await s.putMany(y),(await r.updateIf(t,{where:{status:`completed`,pdfSha256:null},set:{pdfSha256:v,pdf:{ids:y.map(e=>e.id),bytes:_.length},updatedAt:j(n.now)}})).applied?(await Zi(e.cron,t,n.now),`stored`):`skipped`}async function Si(e,t){if(!e.name.startsWith(vi))return!1;let n=e.data?.envelopeId,r=e.data?.attempt;return typeof n!=`string`||n.length===0||await xi(t,n,{now:Date.now(),attempt:typeof r==`number`&&Number.isSafeInteger(r)?r:0}),!0}const Ci=`esign/download`,wi=`esign:download-link-key`,Ti=/^[A-Za-z0-9_:.-]{1,200}$/,Ei=RegExp(`^[0-9a-f]{64}$`);function Di(e){return typeof e!=`string`||!Ei.test(e)?null:Uint8Array.from(e.match(/../g),e=>Number.parseInt(e,16))}async function Oi(e){let t=Di(await e.get(wi));if(t)return t;let n=crypto.getRandomValues(new Uint8Array(32));if((await e.compareAndSet(wi,null,S(n))).applied)return n;let r=Di(await e.get(wi));if(!r)throw Error(`download link key unavailable`);return r}async function ki(e,t,n){let r=await pe({secret:await Oi(e.kv),purpose:Ci,params:{e:t},now:n,ttlMs:9e5}),i=j(Number(r.get(`exp`))*1e3);return{url:`/_emdash/api/plugins/${e.plugin.id}/public/download?${r}`,expiresAt:i}}function B(e){let{status:t,body:n}=ne(e);return Pr({status:t,headers:{"content-type":`application/json; charset=utf-8`,"cache-control":`no-store`},body:{kind:`text`,value:JSON.stringify(n)}})}function Ai(e){try{return e?.url?new URL(e.url).searchParams:null}catch{return null}}async function ji(e,t){let n=Ai(e.request);if(!n)return B(`TOKEN_INVALID`);if(n.has(`token`))return B(`TOKEN_IN_QUERY`);let r=Date.now(),i=await me({secret:await Oi(t.kv),purpose:Ci,query:n,now:r});if(!i.ok)return B(i.error);let a=i.value.e;if(typeof a!=`string`||!Ti.test(a))return B(`TOKEN_INVALID`);let{envelopes:o,artifacts:s}=V(t),c=await o.get(a);if(!c||c.status!==`completed`||c.recordsPurgedAt)return B(`ENVELOPE_NOT_FOUND`);if(!c.pdfSha256||!c.pdf)return await bi(t.cron,a,r),B(`SIGNED_PDF_PENDING`);let l=_i([...(await s.getMany(c.pdf.ids)).values()]);return!l||await I(l)!==c.pdfSha256?(t.log.error(`signed PDF chunks do not match pdfSha256`,{envelopeId:a}),B(`INTERNAL`)):Pr({status:200,headers:{"content-type":`application/pdf`,"content-disposition":`attachment; filename="signed-${a.replace(/[^A-Za-z0-9_-]/g,`_`)}.pdf"`,"cache-control":`private, no-store`,"x-content-type-options":`nosniff`,"referrer-policy":`no-referrer`},body:{kind:`bytes`,value:l}})}const Mi=(e,t)=>ji(e,t),Ni=e=>typeof e.user?.id==`string`&&e.user.id.length>0?e.user.id:void 0,V=e=>e.storage,H=e=>typeof e==`object`&&e?e:{},U=e=>({...ne(`BAD_REQUEST`).body,...e?{issues:e}:{}}),W=e=>ne(e).body;function Pi(e){let t=H(e).id;return typeof t==`string`&&t.length>0&&t.length<=200?t:null}function Fi(e){return Number.isSafeInteger(e)&&e>=1&&e<=365?e:30}function Ii(e){return e instanceof Error&&e.message.includes(`UNIQUE constraint failed`)}async function Li(e,t,n){let r=e;for(let e=1;;e++)try{return{token:r,value:await n(await k(r))}}catch(n){if(!Ii(n)||e>=3)throw n;r=O(t)}}async function Ri(e,t,n,r){let{token:i}=await Li(n,r,n=>e.put(t.id,{...t.data,tokenHash:n}));return i}const zi=(e,{piiSalt:t,...n})=>({id:e,...n}),Bi=(e,{snapshot:t,fieldValues:n,piiSalt:r,...i})=>({id:e,...i});async function Vi(e,t,n,r){if(!(await Bn(V(e).audit_events,t,r,{salt:n.piiSalt})).ok)throw Error(`audit chain contention`)}async function Hi(e,t){let n=gr(e.input);if(!n.ok)return U(n.error);let{templateId:r,templateVersion:i}=n.value,{templates:a,envelopes:o,audit_events:s}=V(t),c=await a.getMany(i===void 0?[r]:[r,R(r,i)]),l=_r(c.get(r),i===void 0?void 0:c.get(R(r,i)),i);if(!l.ok)return W(`TEMPLATE_NOT_FOUND`);let u=Mn(),d=xr(n.value,l.value,{now:j(),piiSalt:u});if(!d.ok)return U(d.error);let f=crypto.randomUUID();return await o.put(f,d.value),await s.putMany(await Rn(f,[Mr(d.value,`admin`,Ni(e))],u)),{ok:!0,envelope:zi(f,d.value)}}async function Ui(e,t){let n=Pi(e.input);if(!n)return U();let{envelopes:r,templates:i,snapshots:a,signers:o}=V(t),s=await r.get(n);if(!s)return W(`ENVELOPE_NOT_FOUND`);if(!Zn(s.status,`sent`))return W(`ENVELOPE_CLOSED`);let{templateId:c,templateVersion:l}=s,[u,d]=await Promise.all([i.getMany([c,R(c,l)]),t.settings.list()]),f=Object.fromEntries(d.map(e=>[e.key,e.value])),p=_r(u.get(c),u.get(R(c,l)),l);if(!p.ok)return W(`TEMPLATE_NOT_FOUND`);let m=O(),h=await Or(n,{...s,...await void 0},p.value,{now:j(),tokenHash:await k(m),expiryDays:Fi(f.expiryDays)});if(!h.ok)return Array.isArray(h.error)?U(h.error):W(`ENVELOPE_CLOSED`);await a.putMany(h.value.chunks);let g=await L(r,n,`draft`,`sent`,h.value.envelope);if(!g.ok)return W(`ENVELOPE_CLOSED`);let _=await Ri(o,h.value.signer,m),v=await Dn(t,{signerId:h.value.signer.id,envelope:g.value,token:_,senderSetting:f.senderName,now:Date.now()});return await Vi(t,n,g.value,Nr(g.value,`admin`,Ni(e))),{ok:!0,envelope:zi(n,g.value),...v?{}:{invitation:`SITE_URL_MISSING`}}}async function Wi(e,t){let n=Pi(e.input);if(!n)return U();let{envelopes:r,snapshots:i,signers:a}=V(t),o=await r.get(n);if(!o)return W(`ENVELOPE_NOT_FOUND`);let[s,c]=await Promise.all([o.snapshot?i.getMany(o.snapshot.ids):Promise.resolve(new Map),o.signerIds.length>0?a.getMany(o.signerIds):Promise.resolve(new Map)]),l=o.pdfSha256?await ki(t,n,Date.now()):null;return{ok:!0,envelope:zi(n,o),download:l,snapshot:o.snapshot?Dr([...s.values()]):null,signers:[...c].map(([e,t])=>({id:e,order:t.order,name:t.name,email:t.email,status:t.status}))}}async function Gi(e,t){let n=Pi(e.input);if(!n)return U();let{envelopes:r,signers:i,outbox:a,audit_events:o}=V(t),s=await r.get(n);if(!s)return W(`ENVELOPE_NOT_FOUND`);let c=s.signerIds[0];if(s.status!==`sent`||c===void 0)return W(`ENVELOPE_CLOSED`);if(!wn(t))return{ok:!1,error:{code:`SITE_URL_MISSING`,message:En}};let l=Pn(n,0),u=Pn(n,1),[d,f,p]=await Promise.all([t.settings.get(`senderName`),a.get(`invite-${c}`),o.getMany([l,u])]);if(f&&f.status!==`failed`)return{ok:!1,error:{code:`INVITATION_QUEUED`,message:`The invitation is already queued or sent.`}};let m=await Li(O(),void 0,e=>i.updateIf(c,{where:{status:`pending`},set:{tokenHash:e}}));if(!m.value.applied)return W(`ENVELOPE_CLOSED`);await Dn(t,{signerId:c,envelope:s,token:m.token,senderSetting:d,now:Date.now()});let h=!1;p.has(u)||(h=await Hn(o,await zn(n,p.get(l)??null,[Nr(s,`admin`,Ni(e))],s.piiSalt)));let{name:g,email:_,status:v}=m.value.data;return{ok:!0,envelope:zi(n,s),signers:[{id:c,order:m.value.data.order,name:g,email:_,status:v}],repaired:h}}async function Ki(e,t){let n=Pi(e.input);if(!n)return U();let r=await V(t).envelopes.get(n);if(!r)return W(`ENVELOPE_NOT_FOUND`);let i=j(),a=await L(V(t).envelopes,n,r.status,`voided`,{closedAt:i,updatedAt:i});return a.ok?(await Vi(t,n,a.value,{type:`envelope.voided`,at:i,actor:`admin`,...Ni(e)?{data:{userId:Ni(e)}}:{}}),{ok:!0,envelope:zi(n,a.value)}):W(`ENVELOPE_CLOSED`)}async function qi(e,t){let{status:n,cursor:r}=H(e.input);if(n!==void 0&&!Xn(n)||r!==void 0&&!(typeof r==`string`&&r.length>0&&r.length<=500))return U();let i=await V(t).envelopes.query({...n===void 0?{}:{where:{status:n}},orderBy:{createdAt:`desc`},limit:100,...r===void 0?{}:{cursor:r}});return{ok:!0,envelopes:i.items.map(e=>Bi(e.id,e.data)),...i.hasMore&&i.cursor?{nextCursor:i.cursor}:{}}}const Ji={"envelopes/create":{handler:Hi},"envelopes/send":{handler:Ui},"envelopes/get":{handler:Wi},"envelopes/list":{handler:qi},"envelopes/resend":{handler:Gi},"envelopes/void":{handler:Ki},"outbox/status":{handler:(async(e,t)=>({ok:!0,...await An(t)}))}},Yi=`completion-email-`,Xi=e=>`${Yi}${e}`;function Zi(e,t,n){return e?.schedule(Xi(t),{schedule:j(n),data:{envelopeId:t}})}async function Qi(e,t,n){let[r,i,a]=await Promise.all([V(e).envelopes.get(t),e.settings.get(`senderName`),V(e).outbox.get(`complete-${t}`)]);if(!r||r.status!==`completed`||!r.pdfSha256||a)return!1;let o=r.signerIds[0];if(o===void 0||!wn(e))return!1;let s=await Li(O(),void 0,t=>V(e).signers.updateIf(o,{where:{status:`signed`},set:{copyTokenHash:t}}));return s.value.applied?(await On(e,{envelopeId:t,envelope:r,token:s.token,senderSetting:i,now:n}),!0):!1}async function $i(e,t){if(!e.name.startsWith(Yi))return!1;let n=e.data?.envelopeId;return typeof n==`string`&&n.length>0&&await Qi(t,n,Date.now()),!0}const ea=`expire`,ta=`expire-more`;async function na(e,t){if(e.name!==ea&&e.name!==ta)return!1;let{envelopes:n}=V(t),r=j(),i=await n.query({where:{status:{in:[`sent`,`in_progress`]},expiresAt:{lt:r}},orderBy:{expiresAt:`asc`},limit:2});for(let{id:e,data:a}of i.items){let i=await L(n,e,a.status,`expired`,{closedAt:r,updatedAt:r});i.ok&&await Vi(t,e,i.value,{type:`envelope.expired`,at:r,actor:`system`})}return i.hasMore&&await t.cron?.schedule(ta,{schedule:j(Date.now()+6e4)}),!0}function ra(e){if(typeof e!=`string`)return null;let t=new TextEncoder().encode(e.trim());return t.length>=32?t:null}const ia=`intent-finish-`,aa=e=>`${ia}${e}`;function oa(e,t,n){return e?.schedule(aa(t),{schedule:j(n),data:{envelopeId:t}})}async function sa(e,t){let n=await C(e),r=await crypto.subtle.sign(`HMAC`,n,new TextEncoder().encode(`esign-invite/1.${t}`));return x(new Uint8Array(r))}async function ca(e,t,n){let{envelopes:r,templates:i,snapshots:a,signers:o,audit_events:s}=V(e),c=await r.get(t);if(!c||c.status!==`draft`||c.delivery!==`email`||!c.clientId)return`skipped`;let l=R(c.templateId,c.templateVersion),[u,d]=await Promise.all([i.getMany([c.templateId,l]),e.settings.list()]),f=Object.fromEntries(d.map(e=>[e.key,e.value])),p=_r(u.get(c.templateId),u.get(l),c.templateVersion);if(!p.ok)return`skipped`;let m=ra(f.integrationMasterKey);if(!m)return`skipped`;let h=await sa(m,t),g=await Or(t,c,p.value,{now:j(n),tokenHash:await k(h),expiryDays:Fi(f.expiryDays)});if(!g.ok)return`skipped`;await a.putMany(g.value.chunks);let _=await Ri(o,g.value.signer,h);await Dn(e,{signerId:g.value.signer.id,envelope:g.value.envelope,token:_,senderSetting:f.senderName,now:n});let v=[Mr(c,`integration`),Nr(g.value.envelope,`integration`)];return await s.putMany(await Rn(t,v,c.piiSalt)),(await L(r,t,`draft`,`sent`,g.value.envelope)).ok?`sent`:`skipped`}async function la(e,t){if(!e.name.startsWith(ia))return!1;let n=e.data?.envelopeId;return typeof n==`string`&&n.length>0&&await ca(t,n,Date.now()),!0}const ua=`nonce-sweep`,da=`nonce-sweep-more`;async function fa(e){let{nonces:t,cron:n,now:r,page:i=100,pages:a=3}=e,o=j(r),s=0,c=!1;for(let e=0;e<a;e++){let e=await t.query({where:{expiresAt:{lt:o}},orderBy:{expiresAt:`asc`},limit:i});if(e.items.length===0||(s+=await t.deleteMany(e.items.map(e=>e.id)),c=e.hasMore===!0,!c))break}return c&&await n?.schedule(da,{schedule:j(r+6e4)}),{deleted:s,more:c}}async function pa(e,t){if(e.name!==ua&&e.name!==da)return!1;let n=t.storage.nonces;return await fa({nonces:n,cron:t.cron,now:Date.now()}),!0}const ma=`retention`,ha=`retention-more`,ga=`cron:retention`,_a=e=>e.status===`sent`||e.status===`in_progress`,va=e=>_a(e)?null:Date.parse(e.completedAt??e.closedAt??e.updatedAt),ya=(e,t,n,r)=>{let i=e.find(e=>e.key===t)?.value;return typeof i==`number`&&Number.isFinite(i)?Math.min(r,Math.max(1,Math.round(i))):n};function ba(e,t){let n=new Date(t);n.setUTCMonth(n.getUTCMonth()-ya(e,`retentionPersonalDataMonths`,12,120));let r=new Date(t);return r.setUTCFullYear(r.getUTCFullYear()-ya(e,`retentionSignedRecordsYears`,7,50)),{p:Math.max(n.getTime(),r.getTime()),r:r.getTime()}}function xa(e,t){let{name:n,email:r,ip:i,ua:a,signature:o,fieldValues:s,declineReason:c,copyTokenHash:l,participant:u,...d}=t;return{...d,name:``,email:``,tokenHash:`purged:${e}`,...o?{signature:{kind:o.kind,sha256:o.sha256}}:{}}}function Sa(e,t){let{piiSalt:n,returnUrl:r,signerEmail:i,...a}=e;return{...a,signer:{name:``,email:``,as:e.signer.as},fieldValues:{},personalPurgedAt:t}}async function Ca(e,t,n){let r=new Set(t.filter(e=>e.data.status===`draft`).map(e=>e.id)),i=await e.audit_events.query({where:{envelopeId:{in:t.map(e=>e.id)}},limit:100,...n?{cursor:n}:{}}),a=i.items.filter(e=>!r.has(e.data.envelopeId)&&e.data.personal!==null),o=i.items.filter(e=>r.has(e.data.envelopeId)).map(e=>e.id);return a.length>0&&await e.audit_events.putMany(a.map(e=>({id:e.id,data:Gn(e.data)}))),o.length>0&&await e.audit_events.deleteMany(o),i.hasMore?i.cursor:void 0}async function wa(e,t,n){let r=j(n),i=t.filter(e=>e.data.status!==`draft`),a=i.flatMap(e=>e.data.signerIds),o=a.length>0?await e.signers.getMany(a):new Map,s=a.flatMap(e=>{let t=o.get(e);return t?[{id:e,data:xa(e,t)}]:[]});s.length>0&&await e.signers.putMany(s),i.length>0&&await e.envelopes.putMany(i.map(e=>({id:e.id,data:Sa(e.data,r)})));let c=t.filter(e=>e.data.status===`draft`).map(e=>e.id);c.length>0&&await e.envelopes.deleteMany(c)}async function Ta(e,t){let n=V(e),r={...await e.kv.get(ga)},i=!1;if(!r.phase||r.phase===`rl`)(await Yt(e.kv,t,3)).more?r.phase=`rl`:Object.assign(r,ba(await e.settings.list(`retention`),t),{phase:`personal`});else if(r.phase===`outbox`){let e=await n.outbox.query({where:{status:{in:[`sent`,`failed`]},nextAttemptAt:{lt:r.p}},limit:100});e.items.length>0&&await n.outbox.deleteMany(e.items.map(e=>e.id)),i=!e.hasMore}else{let e=r.phase===`personal`,i=e?r.p:r.r,a=await n.envelopes.query({where:{createdAt:{gte:(e?r.pf:r.rf)??``,lt:j(i)}},limit:10,...r.cursor?{cursor:r.cursor}:{}}),o=t=>e?t.personalPurgedAt:t.recordsPurgedAt,s=a.items.filter(({data:e})=>!o(e)&&(va(e)??i)<i),c=s.length===0;if(!r.step&&s.length>0){if(e)r.acursor=await Ca(n,s,r.acursor);else{let e=await n.audit_events.query({where:{envelopeId:{in:s.map(e=>e.id)}},limit:100});if(e.items.length>0&&await n.audit_events.deleteMany(e.items.map(e=>e.id)),e.hasMore)r.acursor=`more`;else{delete r.acursor;let e=s.flatMap(e=>e.data.pdf?.ids??[]),t=s.flatMap(e=>e.data.snapshot?.ids??[]);e.length>0&&await n.artifacts.deleteMany(e),t.length>0&&await n.snapshots.deleteMany(t)}}r.acursor||(r.step=1)}else if(s.length>0){if(e)await wa(n,s,t);else{let e=s.flatMap(e=>e.data.signerIds);e.length>0&&await n.signers.deleteMany(e);let r=j(t);await n.envelopes.putMany(s.map(({id:e,data:t})=>({id:e,data:{...t,title:``,signerIds:[],snapshot:null,pdf:null,pdfSha256:null,recordsPurgedAt:r}})))}c=!0}if(c){delete r.step;for(let{data:e}of a.items)!o(e)&&!s.some(t=>t.data===e)&&(!r.keep||e.createdAt<r.keep)&&(r.keep=e.createdAt);a.hasMore&&a.cursor?r.cursor=a.cursor:(r[e?`pf`:`rf`]=r.keep??j(i),delete r.cursor,delete r.keep,r.phase=e?`records`:`outbox`)}}return i&&delete r.phase,await e.kv.set(ga,r),i||await e.cron?.schedule(ha,{schedule:j(t)}),i}async function Ea(e,t,n=Date.now()){return e.name!==ma&&e.name!==ha?!1:(await Ta(t,n),!0)}const Da=e=>_a(e)||e.status===`completed`&&!e.pdfSha256;async function Oa(e,t){let n=V(e),r;if(t.includes(`@`)){let e=t.toLowerCase(),[i,a]=await Promise.all([n.signers.query({where:{email:e},limit:10}),n.envelopes.query({where:{signerEmail:e},limit:10})]),o=new Map(a.items.map(e=>[e.id,e.data])),s=[...new Set(i.items.map(e=>e.data.envelopeId))].filter(e=>!o.has(e));if(s.length>0)for(let[e,t]of await n.envelopes.getMany(s))o.set(e,t);r=[...o].slice(0,10).map(([e,t])=>({id:e,data:t}))}else{let e=await n.envelopes.get(t);r=e?[{id:t,data:e}]:[]}return{due:r.filter(e=>!Da(e.data)&&!e.data.personalPurgedAt),open:r.filter(e=>Da(e.data)).length}}async function ka(e,t,n){let r=V(e),i=await Ca(r,t.due);if(i&&=await Ca(r,t.due,i),i)throw Error(`audit trail too long for one request`);await wa(r,t.due,n),await r.outbox.deleteMany(t.due.flatMap(e=>[`complete-${e.id}`,...e.data.signerIds.map(e=>`invite-${e}`)]))}const Aa=new Set([`localhost`,`127.0.0.1`,`[::1]`]);function ja(e=b){return x(e(32))}const Ma=e=>ra(e)===null;function Na(e){let t=[];for(let n of e.split(/\r?\n/)){let e=n.trim();if(e===``)continue;let r;try{r=new URL(e)}catch{return{ok:!1,entry:e}}if(!(r.protocol===`https:`||r.protocol===`http:`&&Aa.has(r.hostname))||r.username||r.password||e.includes(`#`)||e.includes(`?`))return{ok:!1,entry:e};t.push(r.href)}return t.length>10?{ok:!1,entry:`too many entries`}:{ok:!0,entries:t}}async function Pa(e,t,n){let r=ra(t.masterKey);if(!r)return{ok:!1,code:`MASTER_KEY_MISSING`};let i=t.name.trim();if(i===``||i.length>100)return{ok:!1,code:`NAME_REQUIRED`};let a=ht(n.random),o={name:i,clientId:a,createdAt:n.now,lastUsedAt:null,revokedAt:null,returnUrlAllowlist:t.returnUrlAllowlist};return await e.put(a,o),{ok:!0,client:o,pairing:pt(a,await mt(r,a))}}async function Fa(e,t,n){return(await e.updateIf(t,{where:{revokedAt:null},set:{revokedAt:n}})).applied}async function Ia(e){return(await e.query({orderBy:{createdAt:`desc`},limit:100})).items.map(e=>e.data)}function La(e){let t=(e??``).split(`,`).filter(e=>e.trim()!==``).length;return t===0?{state:`missing`,canSaveSecrets:!1,keyCount:0,banner:{tone:`error`,message:`EMDASH_ENCRYPTION_KEY is not set, so secret settings (the integration master key and the Turnstile secret) cannot be saved. Set it in the site environment and restart.`}}:{state:`ready`,canSaveSecrets:!0,keyCount:t,banner:null}}function Ra(e){let t=`PLUGIN_SETTING_ENCRYPTION_KEY_MISSING`,n=e=>e.includes(t)||e.includes(`PluginSettingEncryptionError`);return typeof e==`string`?n(e):e instanceof Error?n(e.message)||e.name===`PluginSettingEncryptionError`:typeof e==`object`&&e?e.code===t:!1}const za=e=>e.storage.templates,G=e=>({...ne(`BAD_REQUEST`).body,...e?{issues:e}:{}}),Ba=()=>ne(`TEMPLATE_NOT_FOUND`).body;function Va(e){let t=H(e).id;return typeof t==`string`&&t.length>0&&t.length<=200&&!t.includes(`:`)?t:null}const Ha=(e,t)=>({id:e,...t}),Ua=(e,{body:t,...n})=>({id:e,...n});async function Wa(e,t){let n=await za(e).get(t);return n&&n.status!==`version`?n:null}const Ga={"templates/create":{handler:(async(e,t)=>{let n=crypto.randomUUID(),r=tr(e.input,{id:n,now:j()});if(!r.ok)return G(r.error);let{head:i,versions:a}=r.value;return await za(t).putMany([{id:n,data:i},...a]),{ok:!0,template:Ha(n,i)}})},"templates/update":{handler:(async(e,t)=>{let n=Va(e.input);if(!n)return G();let r=await Wa(t,n);if(!r)return Ba();let i=nr(r,e.input,{id:n,now:j()});return i.ok?(await za(t).putMany([{id:n,data:i.value.head},i.value.version]),{ok:!0,template:Ha(n,i.value.head)}):G(i.error)})},"templates/get":{handler:(async(e,t)=>{let n=Va(e.input);if(!n)return G();let r=H(e.input).version;if(r!==void 0&&!(Number.isSafeInteger(r)&&r>=1))return G();let i=r,a=await za(t).getMany(i===void 0?[n]:[n,R(n,i)]),o=a.get(n);if(!o||o.status===`version`)return Ba();let s=i===void 0?o:a.get(R(n,i));if(!s)return Ba();let c=Array.from({length:o.version},(e,t)=>t+1);return{ok:!0,template:Ha(n,{...s,status:o.status}),versions:c}})},"templates/list":{handler:(async(e,t)=>{let n=H(e.input).status??`active`;if(n!==`active`&&n!==`archived`)return G();let{items:r}=await za(t).query({where:{status:n},limit:200});return{ok:!0,templates:r.map(e=>Ua(e.id,e.data)).sort((e,t)=>e.name<t.name?-1:e.name>t.name?1:0)}})},"templates/archive":{handler:(async(e,t)=>{let n=Va(e.input);if(!n)return G();let r=await Wa(t,n);if(!r)return Ba();if(r.status===`archived`)return{ok:!0,template:Ha(n,r)};let i=rr(r,j());return await za(t).putMany([{id:n,data:i}]),{ok:!0,template:Ha(n,i)}})}},Ka=(e,t)=>({severity:`error`,title:e,...t?{message:t}:{}}),qa=e=>V(e.ctx).clients;async function Ja(e){return(await e.ctx.settings.list()).find(e=>e.key===`integrationMasterKey`)?.value}const Ya=e=>typeof e==`string`&&e.trim()!==``;function Xa(e,r,o=[]){let s=ra(e)!==null,c=typeof e==`object`&&!!e,l=La(null).banner;return q([t(`Integrations`),...u([c&&l&&{severity:`error`,title:`Encryption key missing`,message:l.message},!s&&!c&&{severity:`warning`,title:Ya(e)?`Integration master key is too short`:`Integration master key not set`,message:`Clients are paired with secrets derived from the master key. Generate one here, or save one of at least 32 characters in Settings.`}]),...o,...s||c||Ya(e)?[]:[d([f(`integrations.generate-key`,`Generate master key`,{style:`primary`})])],t(`Clients`),a({columns:[i(`name`,`Name`),i(`clientId`,`Client id`),i(`created`,`Created`,`relative_time`),i(`status`,`Status`,`badge`),i(`revoke`,``,`element`)],rows:r.map(e=>({name:e.name,clientId:e.clientId,created:e.createdAt,status:e.revokedAt?`Revoked`:`Active`,...e.revokedAt?{}:{revoke:f(`client.revoke`,`Revoke`,{style:`danger`,value:e.clientId,confirm:{title:`Revoke this client?`,text:`Its intents and receipts are refused from now on. This cannot be undone; create a new client to pair again.`,confirm:`Revoke client`,deny:`Keep`,style:`danger`}})}})),pageActionId:`clients.page`,emptyText:`No clients yet.`}),t(`Add a client`),n(`The pairing string is shown once, right after you create the client, and cannot be shown again. Paste it into the other plugin's settings. Return URLs: one per line, https (http only for localhost); leave blank to allow this site only.`),y({fields:[m(`name`,`Name`,{initialValue:``}),m(`returnUrlAllowlist`,`Allowed return URLs`,{multiline:!0,initialValue:``})],submit:{label:`Create client`,actionId:`client.create`}})])}async function K(e,t,n=[]){return Xa(t,await Ia(qa(e)),n)}async function Za(e){let[t,n]=await Promise.all([Ja(e),Ia(qa(e))]);return Xa(t,n)}async function Qa(e){let t=await Ja(e);if(Ya(t))return K(e,t,u([Ka(`Key already set`,`Changing it would re-pair every client.`)]));let n=ja();try{await e.ctx.settings.set(`integrationMasterKey`,n)}catch(n){if(!Ra(n))throw n;return K(e,t,u([Ka(`Encryption key missing`,La(null).banner?.message)]))}return K(e,n,u([{severity:`info`,title:`Master key generated`}]))}async function $a(e,t){let n=await Ja(e),r=(e,t)=>typeof e==`string`?e.slice(0,t):``,i=Na(r(t.returnUrlAllowlist,2e3));if(!i.ok)return K(e,n,u([Ka(`Not created`,`Return URL not allowed: ${i.entry.slice(0,200)}`)]));let a=await Pa(qa(e),{name:r(t.name,200),returnUrlAllowlist:i.entries,masterKey:n},{now:j(e.now)});return a.ok?K(e,n,[...u([{severity:`warning`,title:`Copy the pairing string now`,message:`It is shown only this once and cannot be recovered. Treat it like a password.`}]),o({code:a.pairing})]):K(e,n,u([Ka(`Not created`,a.code===`MASTER_KEY_MISSING`?`Set the integration master key first (at least 32 characters), or generate one.`:`Give the client a name of up to 100 characters.`)]))}async function eo(e,t){let n=await Fa(qa(e),t,j(e.now));return K(e,await Ja(e),u([n?{severity:`info`,title:`Client revoked`}:Ka(`Not revoked`,`Unknown or already revoked.`)]))}const q=e=>({blocks:e}),J=(e,t=200)=>typeof e==`string`?e.trim().slice(0,t):``,Y=(e,t,n)=>t.handler({input:n,user:e.user??null},e.ctx),to=e=>Ji[e],no=e=>Ga[e],ro={INVALID_NAME:`Give the template a name of up to 200 characters.`,INVALID_BODY:`The template text is required (up to 100,000 characters).`,INVALID_DESCRIPTION:`The description is too long (up to 1,000 characters).`,TEMPLATE_ARCHIVED:`This template is archived.`,INVALID_INTEGRATIONS:`Choose whether integrations may use the template.`,INVALID_TITLE:`The title is too long or has control characters.`,INVALID_SIGNER_NAME:`Enter the signer's name.`,INVALID_SIGNER_EMAIL:`Enter a valid email address for the signer.`,INVALID_FIELDS:`A field value is too long or not text.`,MISSING_FIELD:`A template field has no value.`,DOCUMENT_TOO_LARGE:`The document is too long to sign (up to 131,072 characters and 1,500 lines).`};function X(e,t=`The change was refused.`){let n=Array.isArray(e.issues)?e.issues:[];return n.length>0?n.map(e=>ro[e.code??``]??`${e.path??`input`} (${e.code??`invalid`})`).join(` `):e.error?.message??t}const io=(e,t,n)=>({severity:e,title:t,...n?{message:n}:{}}),Z=(e,t)=>io(`error`,e,t),ao=(e,t)=>io(`warning`,e,t),oo=(e,t)=>f(e,t,{style:`secondary`}),Q=(e,t)=>io(`info`,e,t),so=()=>oo(`envelopes.back`,`Back to envelopes`),co=()=>oo(`templates.back`,`Back to templates`),lo=e=>f(`envelope.open`,`Open envelope`,{value:e}),uo={"envelope.created":`Envelope created`,"envelope.sent":`Envelope sent`,"signer.viewed":`Signer opened the document`,"signer.consented":`Signer gave consent`,"signer.signed":`Signer signed`,"signer.declined":`Signer declined`,"envelope.completed":`Envelope completed`,"envelope.declined":`Envelope declined`,"envelope.voided":`Envelope voided`,"envelope.expired":`Envelope expired`},fo=e=>!wn(e.ctx)&&ao(`Set the site URL`,En);async function po(e){let t=await An(e.ctx);return[fo(e),t.state===`no_transport`&&ao(`No email transport`,`No email provider is configured, so signing invitations stay queued and are not delivered. Install an email provider plugin.`),t.failed>0&&ao(`${t.failed} email${t.failed===1?``:`s`} could not be delivered`,`Open the envelope and use Resend invitation if a signer never received theirs.`)]}async function mo(e,r,o=[],s){let c=Xn(r)?r:``,[l,d]=await Promise.all([Y(e,to(`envelopes/list`),{...c?{status:c}:{},...s?{cursor:s}:{}}),po(e)]),p=typeof l.nextCursor==`string`?l.nextCursor:void 0,h=(l.envelopes??[]).map(e=>{let t=e.signer;return{title:e.title,signer:t?`${t.name??``} <${t.email??``}>`:``,status:e.status,created:e.createdAt,open:f(`envelope.open`,`Open`,{value:e.id})}});return q([t(`Envelopes`),...u(d),...o,y({fields:[g(`status`,`Status`,[{label:`Any status`,value:``},...qn.map(e=>({label:e.replaceAll(`_`,` `),value:e}))],{initialValue:c})],submit:{label:`Filter`,actionId:`envelopes.filter`}}),n(`Newest first, 100 a page. Create an envelope from a template on the Templates page.`),a({columns:[i(`title`,`Title`),i(`signer`,`Signer`),i(`status`,`Status`,`badge`),i(`created`,`Created`,`relative_time`),i(`open`,``,`element`)],rows:h,pageActionId:`envelopes.page:${c}`,...p?{nextCursor:p}:{},emptyText:`No envelopes match.`}),t(ho),y({fields:[m(`subject`,`Signer email or envelope id`)],submit:{label:`Find`,actionId:`retention.preview`}})])}const ho=`Delete personal data`;async function go(e,n,r){let i=await Oa(e.ctx,n),a=i.due.length;return r&&a>0&&await ka(e.ctx,i,e.now),q([t(ho),...u([{severity:r?`info`:`warning`,title:r&&a>0?`Personal data deleted`:a+i.open>0?`${a} envelope(s) to delete, ${i.open} kept for now`:`No envelopes found`,message:`Signed records stay for their own period; open envelopes and pending PDFs are skipped.`}]),d([...!r&&a>0?[f(`retention.erase`,ho,{style:`danger`,value:n,confirm:{title:`${ho}?`,text:`This cannot be undone.`,confirm:`Delete`,deny:`Keep`,style:`danger`}})]:[],so()])])}async function _o(e,t){if(!t)return`missing`;let n=await V(e.ctx).outbox.get(`invite-${t}`);return n?n.status===`failed`?`failed`:`queued`:`missing`}async function $(e,o,s={}){let{envelopes:c,signers:l,audit_events:m}=V(e.ctx),h=s.envelope??await c.get(o);if(!h)return q([t(`Envelope`),...u([Z(`Envelope not found`,`It may have been removed.`)]),d([so()])]);let g=h.status===`sent`||h.status===`in_progress`,[_,v,y]=await Promise.all([m.query({where:{envelopeId:o},orderBy:{seq:`asc`},limit:200}),s.signers?Promise.resolve(s.signers):h.signerIds.length>0?l.getMany(h.signerIds).then(e=>[...e].map(([e,t])=>({id:e,name:t.name,email:t.email,status:t.status}))):Promise.resolve([]),s.invite??(h.status===`sent`?_o(e,h.signerIds[0]):Promise.resolve(`n/a`))]),b=v[0],x=h.status===`sent`&&(y===`missing`||y===`failed`),S=null;if(h.status===`completed`&&!h.recordsPurgedAt)if(h.pdfSha256){let t=await ki(e.ctx,o,e.now);S=d([p(`Download signed PDF`,{kind:`external`,url:`${e.origin}${t.url}`},{appearance:`primary`})])}else S=n(`The signed PDF is still being prepared. Reload in a minute.`);let C=[h.status===`draft`&&f(`envelope.send`,`Send for signature`,{style:`primary`,value:o}),x&&f(`envelope.resend`,`Resend invitation`,{style:`primary`,value:o}),(h.status===`draft`||g)&&f(`envelope.void`,`Void`,{style:`danger`,value:o,confirm:{title:`Void this envelope?`,text:`The signer will no longer be able to sign it. This cannot be undone.`,confirm:`Void envelope`,deny:`Keep`,style:`danger`}}),so()].filter(e=>e!==!1);return q([t(h.title),...u([x&&{severity:`warning`,title:`The invitation was not delivered`,message:y===`failed`?`The email gave up after repeated failures. Resend invitation queues a fresh email with a new signing link.`:`The invitation was never queued. Resend invitation queues it with a new signing link.`},x&&fo(e)]),...s.extra??[],...h.personalPurgedAt?[n(`Personal data deleted ${h.personalPurgedAt}${h.recordsPurgedAt?`; signed records deleted`:``} (retention).`)]:[],r([{label:`Status`,value:h.status.replaceAll(`_`,` `)},{label:`Template`,value:`${h.templateId} v${h.templateVersion}`},{label:`Signer`,value:b?`${b.name} <${b.email}>`:h.signer.email},{label:`Signer status`,value:b?.status??`not sent yet`},{label:`Delivery`,value:h.delivery},{label:`Created`,value:h.createdAt},{label:`Sent`,value:h.sentAt??`Not sent`},{label:`Expires`,value:h.expiresAt??`Not set`},{label:`Completed`,value:h.completedAt??`Not completed`},{label:`Document SHA-256`,value:h.docSha256??`Set when sent`},{label:`Final hash`,value:h.finalHash??`Set when completed`}]),...S?[S]:[],d(C),t(`Audit timeline`),a({columns:[i(`seq`,`#`,`number`),i(`event`,`Event`),i(`at`,`When`,`text`),i(`actor`,`By`)],rows:_.items.map(({data:e})=>({seq:e.seq,event:uo[e.type]??e.type,at:e.at,actor:e.actor})),pageActionId:`audit.page:${o}`,emptyText:`No events yet.`})])}async function vo(e,n){let r;try{r=await Y(e,to(`envelopes/send`),{id:n})}catch{return q([t(`Envelope`),...u([Z(`The envelope was sent but the invitation could not be queued`,`Open the envelope and use Resend invitation.`)]),d([lo(n)])])}if(r.ok!==!0)return q([t(`Envelope`),...u([Z(`Not sent`,X(r))]),d([lo(n),so()])]);let i=r.invitation===`SITE_URL_MISSING`;return q([t(`Envelope`),...u([i?{severity:`warning`,title:`Envelope sent, but no invitation was queued`,message:En}:Q(`Envelope sent`,`The signer's invitation is queued.`)]),d([lo(n),so()])])}async function yo(e,t){let n=await Y(e,to(`envelopes/void`),{id:t});if(n.ok!==!0){let r=n.error?.code===`ENVELOPE_CLOSED`;return $(e,t,{extra:u([Z(r?`This envelope cannot be voided`:`Not voided`,r?`It is already completed, declined, voided or expired.`:X(n))])})}return $(e,t,{envelope:n.envelope,invite:`n/a`,extra:u([Q(`Voided`,`The signer can no longer sign this envelope.`)])})}async function bo(e,t){let n=await Y(e,to(`envelopes/resend`),{id:t});return n.ok===!0?$(e,t,{envelope:n.envelope,invite:`queued`,signers:n.signers,extra:u([Q(`Invitation queued`,`A new email with a new signing link is on its way.`)])}):$(e,t,{extra:u([n.error?.code===`INVITATION_QUEUED`?Q(`Already queued`,`The invitation is queued or was sent.`):Z(`Not resent`,X(n,`Only an envelope that is sent and unsigned can be resent.`))])})}const xo=/^(signer|participant)\./;async function So(e,r,i=[]){let a=await Y(e,no(`templates/get`),{id:r}),o=a.template;return a.ok!==!0||!o?q([t(`New envelope`),...u([Z(`Template not found`)]),...i]):q([t(`New envelope: ${o.name}`),...i,n(`Creates a draft you can check before sending it for signature. Signer fields: one per line as key: Label, ending in * when required.`),y({fields:[m(`title`,`Title`,{initialValue:o.name}),m(`signerName`,`Signer name`),m(`signerEmail`,`Signer email`),...o.fields.filter(e=>!xo.test(e)).map(e=>m(`field:${e}`,e)),m(`signerFields`,`Fields the signer fills in (optional)`,{multiline:!0,placeholder:`phone: Phone number *`})],submit:{label:`Create draft`,actionId:`envelope.create`},blockId:`envelope-new:${r}`}),d([co()])])}function Co(e){return typeof e==`string`?e.slice(0,4e3).split(`
+`).map(e=>e.trim()).filter(e=>e!==``).map(e=>{let t=e.indexOf(`:`),n=(t===-1?e:e.slice(0,t)).trim(),r=t===-1?``:e.slice(t+1).trim(),i=r.endsWith(`*`);return i&&(r=r.slice(0,-1).trim()),{key:n,label:r,...i?{required:!0}:{}}}):[]}async function wo(e,t,n){let r=t?.startsWith(`envelope-new:`)?t.slice(13):``;if(!r)return q(u([Z(`Choose a template first`)]));let i={};for(let[e,t]of Object.entries(n))e.startsWith(`field:`)&&(i[e.slice(6)]=typeof t==`string`?t:``);let a=J(n.title),o=Co(n.signerFields),s=await Y(e,to(`envelopes/create`),{templateId:r,...a?{title:a}:{},signer:{name:J(n.signerName),email:J(n.signerEmail)},fields:i,...o.length>0?{signerFields:o}:{}});if(s.ok!==!0)return So(e,r,u([Z(`Not saved`,X(s))]));let c=s.envelope.id;return $(e,c,{extra:u([Q(`Draft created`,`Check the details, then send it.`)])})}async function To(e,r=[]){let o=((await Y(e,no(`templates/list`),{})).templates??[]).map(e=>({name:e.name,version:e.version,fields:(e.fields??[]).join(`, `),integrations:e.integrations===!0?`Yes`:`No`,updated:e.updatedAt,edit:f(`template.edit`,`Edit`,{value:e.id}),use:f(`envelope.new`,`New envelope`,{style:`primary`,value:e.id})}));return q([t(`Templates`),...r,a({columns:[i(`name`,`Name`),i(`version`,`Version`,`number`),i(`fields`,`Fields`),i(`integrations`,`Integrations`),i(`updated`,`Updated`,`relative_time`),i(`edit`,``,`element`),i(`use`,``,`element`)],rows:o,pageActionId:`templates.page`,emptyText:`No templates yet. Add one below.`}),t(`New template`),n(`Write the document in Markdown. Use {{field}} for values filled in per envelope, and {{signer.name}} for the signer.`),y({fields:[m(`name`,`Name`),m(`description`,`Description (optional)`),m(`body`,`Template text`,{multiline:!0}),Eo(!1)],submit:{label:`Create template`,actionId:`template.create`}})])}function Eo(e){return _(`integrations`,`Available to integrations`,{description:`Paired sites (such as Events) may send this template for signing.`,initialValue:e})}function Do(e){let t=Object.fromEntries(ln(e).map(e=>[e,`«${e}»`]));try{return un(e,t)}catch{return e}}function Oo(e,r,i=[]){let a=String(r.body??``),s=ln(a);return q([t(`Edit template: ${String(r.name??``)}`),...i,n(`Version ${String(r.version??1)}. Saving writes a new version; sent envelopes keep the text they were sent with.`),y({fields:[m(`name`,`Name`,{initialValue:String(r.name??``)}),m(`description`,`Description (optional)`,{initialValue:String(r.description??``)}),m(`body`,`Template text`,{initialValue:a,multiline:!0}),Eo(r.integrations===!0)],submit:{label:`Save new version`,actionId:`template.save`},blockId:`template:${e}`}),t(`Preview`),n(s.length>0?`Fields: ${s.join(`, `)}. Placeholders show as «name».`:`This template has no fields.`),o({code:Do(a)}),d([f(`envelope.new`,`New envelope from this template`,{style:`primary`,value:e}),f(`template.archive`,`Archive`,{style:`danger`,value:e,confirm:{title:`Archive this template?`,text:`It can no longer be used for new envelopes. Sent envelopes are not affected.`,confirm:`Archive`,deny:`Keep`,style:`danger`}}),co()])])}async function ko(e,t,n=[]){let r=await Y(e,no(`templates/get`),{id:t});return r.ok!==!0||!r.template?To(e,u([Z(`Template not found`)])):Oo(t,r.template,n)}async function Ao(e,t){let n=await Y(e,no(`templates/create`),{name:J(t.name),body:typeof t.body==`string`?t.body:``,...J(t.description,1e3)?{description:J(t.description,1e3)}:{},integrations:t.integrations===!0});return n.ok===!0?To(e,u([Q(`Template created`)])):To(e,u([Z(`Not saved`,X(n))]))}async function jo(e,t,n){let r=t?.startsWith(`template:`)?t.slice(9):``;if(!r)return q(u([Z(`Choose a template first`)]));let i={name:J(n.name),body:typeof n.body==`string`?n.body:``,description:J(n.description,1e3),integrations:n.integrations===!0},a=await Y(e,no(`templates/update`),{id:r,...i});return a.ok===!0?Oo(r,a.template,u([Q(`Saved`)])):Oo(r,{...i,version:`?`},u([Z(`Not saved`,X(a))]))}async function Mo(e,t){let n=await Y(e,no(`templates/archive`),{id:t});return To(e,u([n.ok===!0?Q(`Template archived`):Z(`Not archived`,X(n))]))}const No=[{key:`senderName`,label:`Sender name`,kind:`text`},{key:`expiryDays`,label:`Envelope expiry (days)`,kind:`number`,min:1,max:365},{key:`consentVersion`,label:`Consent version`,kind:`text`},{key:`consentWording`,label:`Consent wording`,kind:`long`},{key:`retentionPersonalDataMonths`,label:`Keep personal data (months)`,kind:`number`,min:1,max:120},{key:`retentionSignedRecordsYears`,label:`Keep signed records (years)`,kind:`number`,min:1,max:50},{key:`turnstileSiteKey`,label:`Turnstile site key`,kind:`text`}],Po=[{key:`turnstileSecretKey`,label:`Turnstile secret key`},{key:`integrationMasterKey`,label:`Integration master key`}],Fo=e=>typeof e==`string`&&e!==``?`readable`:typeof e==`object`&&e?`unreadable`:`unset`;function Io(e,r,i=[]){let a=Po.some(e=>r[e.key]===`unreadable`),o=La(null).banner;return q([t(`Settings`),...u([a&&o&&{severity:`error`,title:`Encryption key missing`,message:o.message},r.integrationMasterKey===`unset`&&ao(`Integration master key not set`,`Other plugins cannot create envelopes through the integration protocol until it is saved.`)]),...i,y({fields:[...No.map(t=>t.kind===`number`?h(t.key,t.label,{min:t.min,max:t.max,...typeof e[t.key]==`number`?{initialValue:e[t.key]}:{}}):m(t.key,t.label,{multiline:t.kind===`long`,initialValue:typeof e[t.key]==`string`?e[t.key]:``})),...Po.map(e=>v(e.key,`${e.label} (leave blank to keep)`,{hasValue:r[e.key]===`readable`}))],submit:{label:`Save settings`,actionId:`settings.save`}}),n(`Reminder and one-time-code settings (Pro) are in the plugin's own settings panel.`)])}async function Lo(e){let t=await e.ctx.settings.list(),n=Object.fromEntries(t.map(e=>[e.key,e.value]));return{values:n,secrets:Object.fromEntries(Po.map(e=>[e.key,Fo(n[e.key])]))}}async function Ro(e){let{values:t,secrets:n}=await Lo(e);return Io(t,n)}async function zo(e,t){let{values:n,secrets:r}=await Lo(e),i=[],a=[];for(let e of No){let r=t[e.key];if(r==null||r===``)continue;let o;if(e.kind===`number`){if(o=Number(r),!Number.isInteger(o)||o<(e.min??0)||o>(e.max??2**53-1)){a.push(`${e.label} must be a whole number from ${e.min} to ${e.max}.`);continue}}else o=J(r,e.kind===`long`?2e3:200);o!==n[e.key]&&i.push([e.key,o])}let o=Po.filter(e=>J(t[e.key],500)!==``);if(o.some(e=>e.key===`integrationMasterKey`&&Ma(J(t[e.key],500)))&&a.push(`The integration master key must be at least 32 characters, or use Generate on the Integrations page.`),a.length>0)return Io(n,r,u([Z(`Not saved`,a.join(` `))]));if(i.length+o.length>6)return Io(n,r,u([Z(`Too many changes at once`,`Save at most 6 settings at a time.`)]));if(i.length+o.length===0)return Io(n,r,u([Q(`Nothing to save`)]));let s={...n},c={...r};try{for(let n of o)await e.ctx.settings.set(n.key,J(t[n.key],500)),c[n.key]=`readable`;for(let[t,n]of i)await e.ctx.settings.set(t,n),s[t]=n}catch(e){if(!Ra(e))throw e;let t=La(null).banner;return Io(n,r,u([{severity:`error`,title:`Encryption key missing`,message:t?.message}]))}return Io(s,c,u([Q(`Saved`)]))}const Bo=e=>J(e,200);async function Vo(e,t){if(t.type===`page_load`)switch(t.page){case`/envelopes`:return mo(e,``);case`/templates`:return To(e);case`/settings`:return Ro(e);case`/integrations`:return Za(e);default:return q(u([Z(`Page not found`)]))}if(t.type===`form_submit`){let n=t.values;switch(t.action_id){case`envelopes.filter`:return mo(e,J(n.status));case`envelope.create`:return wo(e,t.block_id,n);case`template.create`:return Ao(e,n);case`template.save`:return jo(e,t.block_id,n);case`settings.save`:return zo(e,n);case`client.create`:return $a(e,n);case`retention.preview`:return go(e,J(n.subject),!1)}}else{let n=Bo(t.value);if(t.action_id.startsWith(`envelopes.page:`))return mo(e,t.action_id.slice(15),[],J(t.value,500)||void 0);if(t.action_id.startsWith(`audit.page:`))return $(e,Bo(t.action_id.slice(11)));switch(t.action_id){case`envelopes.back`:case`envelopes.page`:return mo(e,``);case`envelope.open`:return $(e,n);case`envelope.send`:return vo(e,n);case`envelope.void`:return yo(e,n);case`envelope.resend`:return bo(e,n);case`retention.erase`:return go(e,n,!0);case`envelope.new`:return So(e,n);case`integrations.generate-key`:return Qa(e);case`client.revoke`:return eo(e,n);case`clients.page`:return Za(e);case`templates.back`:case`templates.page`:return To(e);case`template.edit`:return ko(e,n);case`template.archive`:return Mo(e,n)}}return q(u([Z(`Unknown action`)]))}const Ho={admin:{handler:(async(e,t)=>{let n=`http://localhost`;try{n=new URL(e.request?.url??``).origin}catch{}return Vo({ctx:t,origin:n,now:Date.now(),user:e.user??null},e.input)})}},Uo=[`completed`,`declined`,`voided`,`expired`],Wo=e=>{if(!e)return;let t=Date.parse(e);return Number.isNaN(t)?void 0:Math.floor(t/1e3)};function Go(e,t){let{status:n,clientId:r,externalRef:i}=t;if(!Uo.includes(n)||!r||!i||t.docSha256===null)return;let a=n===`completed`,o=a?Wo(t.completedAt):Wo(t.closedAt)??Wo(t.updatedAt);if(o===void 0)return;let s={v:1,typ:`receipt`,cid:r,envelopeId:e,ref:i,status:n,docSha256:t.docSha256,pdfSha256:a?t.pdfSha256??null:null,finalHash:a?t.finalHash:null,at:o};return Ue(`receipt`,s).ok?s:void 0}async function Ko(e,t,n){let r=Go(e,t);return r?at(`receipt`,r,n):void 0}function qo(e){return Array.isArray(e)?e.filter(e=>typeof e==`string`):void 0}function Jo(e){let t={};return{settings:()=>t,async getClient(n){let[r,i]=await Promise.all([e.settings.list(),V(e).clients.query({where:{clientId:n},limit:1})]);t=Object.fromEntries(r.map(e=>[e.key,e.value]));let a=ra(t.integrationMasterKey),o=i.items[0]?.data;if(!(!a||!o))return{secret:await mt(a,n),revoked:o.revokedAt!==void 0&&o.revokedAt!==null,returnUrlAllowlist:qo(o.returnUrlAllowlist)}}}}async function Yo(e,t,n){let r=ra(n);if(!(!r||!t.clientId))return Ko(e,t,await mt(r,t.clientId))}async function Xo(e,t,n=Date.now()){let r=await it({token:H(e).request,now:n,getClient:Jo(t).getClient});if(!r.ok)return W(r.error);let i=[],a;for(let e=0;e<3;e++){let e=await V(t).templates.query({where:{status:`active`},limit:200,...a===void 0?{}:{cursor:a}});if(i.push(...e.items),!e.hasMore||!e.cursor)break;a=e.cursor}return{ok:!0,templates:i.filter(e=>ir(e.data)).map(e=>({id:e.id,name:e.data.name,version:e.data.version})).sort((e,t)=>e.name<t.name?-1:e.name>t.name?1:e.id<t.id?-1:1)}}const Zo=(e,t)=>Xo(e.input,t),Qo=/^[0-9a-f]{64}$/,$o=/[\u0000-\u001F\u007F]/,es=e=>Array.isArray(e)&&e.length===2&&e.every(e=>typeof e==`number`&&Number.isFinite(e)&&e>=0&&e<=1);function ts(e){let t=e=>T({path:`signature.strokes`,code:e});return!Array.isArray(e)||e.length===0||e.length>64?t(`INVALID_SIGNATURE`):JSON.stringify(e).length>32768?t(`STROKES_TOO_LARGE`):e.every(e=>Array.isArray(e)&&e.length>0&&e.every(es))?w(e):t(`INVALID_SIGNATURE`)}function ns(e){let t=T({path:`signature`,code:`INVALID_SIGNATURE`});if(!ur(e)||e.kind!==`typed`&&e.kind!==`drawn`)return t;let n=e.typedName===void 0?void 0:fr(e.typedName);if(n===null)return t;if(e.kind===`typed`)return n===void 0?t:w({kind:`typed`,typedName:n});let r=ts(e.strokes);return r.ok?w({kind:`drawn`,...n===void 0?{}:{typedName:n},strokes:r.value}):r}function rs(e){if(!ur(e))return T([{path:``,code:`INVALID_INPUT`}]);let t=[];e.consent!==!0&&t.push({path:`consent`,code:`CONSENT_REQUIRED`}),e.intent!==!0&&t.push({path:`intent`,code:`INTENT_REQUIRED`});let n=typeof e.docSha256==`string`&&Qo.test(e.docSha256)?e.docSha256:null;n===null&&t.push({path:`docSha256`,code:`INVALID_DOC_HASH`});let r=typeof e.consentSha256==`string`&&Qo.test(e.consentSha256)?e.consentSha256:null;r===null&&t.push({path:`consentSha256`,code:`INVALID_CONSENT_HASH`});let i=ns(e.signature);i.ok||t.push(i.error);let a=mr(e.fieldValues);return a===null&&t.push({path:`fieldValues`,code:`INVALID_FIELDS`}),t.length>0||n===null||r===null||!i.ok||a===null?T(t):w({docSha256:n,consentSha256:r,signature:i.value,fieldValues:a})}function is(e){if(e===void 0)return;let t=typeof e==`string`?e.trim():``;return t.length===0||[...t].length>500||$o.test(t)?null:t}async function as(e,t,n){let r=Object.keys(n.fieldValues).sort().map(e=>[e,n.fieldValues[e]]),i=await I(n.salt+JSON.stringify([e,t.kind,t.typedName??null,t.strokes??null,r]));return{...t,sha256:i}}const os=e=>({...e.ip===void 0?{}:{ip:e.ip},...e.ua===void 0?{}:{ua:e.ua}}),ss=e=>e===void 0?{}:{signer:e};function cs(e,t,n,r){return{type:`signer.viewed`,at:e,actor:`signer`,data:{docSha256:t,...ss(r)},personal:os(n)}}function ls(e){let{at:t,docSha256:n,signature:r}=e;return[{type:`signer.consented`,at:t,actor:`signer`,data:{docSha256:n,consentVersion:e.consentVersion,consentSha256:e.consentSha256,intent:!0},personal:os(e.who)},{type:`signer.signed`,at:t,actor:`signer`,data:{docSha256:n,kind:r.kind,signatureSha256:r.sha256},personal:{name:r.typedName??e.signerName,...os(e.who)}},{type:`envelope.completed`,at:t,actor:`system`,data:{docSha256:n}}]}function us(e){let{at:t,docSha256:n,hasReason:r}=e;return[{type:`signer.declined`,at:t,actor:`signer`,data:{docSha256:n,hasReason:r,...ss(e.order)},personal:os(e.who)},{type:`envelope.declined`,at:t,actor:`system`,data:{docSha256:n}}]}const ds=[`sent`,`in_progress`];function fs(e){let t=H(e).token;return typeof t==`string`&&t.length>0&&t.length<=200?t:null}const ps=e=>({...e.requestMeta?.ip?{ip:e.requestMeta.ip}:{},...e.requestMeta?.userAgent?{ua:e.requestMeta.userAgent}:{}});function ms(e){try{return e!==void 0&&new URL(e.url).searchParams.has(`token`)}catch{return!1}}function hs(e,t){let n=new Map,r,i={get:t=>{let r=n.get(t);return r||(r=e.kv.get(t),n.set(t,r)),r},set:async(e,t)=>{r={key:e,value:t}}},a=Date.now(),o=()=>Jt(i,t.requestMeta?.ip??`unknown`,a,{scope:`ceremony`,limit:20,windowSeconds:600,salt:`esign-ceremony/1`});return{async blocked(){return!(await o()).ok},async fail(){let t=await o();return t.ok&&r&&await e.kv.set(r.key,r.value),W(t.ok?`SIGNING_TOKEN_INVALID`:`RATE_LIMITED`)}}}async function gs(e,t){let{items:n}=await V(e).signers.query({where:{tokenHash:await k(t)},limit:1}),r=n[0];return r&&await le(t,r.data.tokenHash)?r:null}async function _s(e,t){let{items:n}=await V(e).signers.query({where:{copyTokenHash:await k(t)},limit:1}),r=n[0];return r?.data.copyTokenHash&&await le(t,r.data.copyTokenHash)?r:null}const vs=e=>!!(e.returnUrl&&e.clientId),ys=(e,t)=>vs(t)?e.settings.get(`integrationMasterKey`):Promise.resolve(void 0);async function bs(e,t,n){if(!t.returnUrl)return{};let r=await Yo(e,t,n);return{returnUrl:t.returnUrl,...r?{receipt:r}:{}}}const xs=(e,t)=>e.find(e=>e.key===t)?.value;async function Ss(e,t){let n=await(t?e.settings.list():e.settings.list(`consent`)),r=(e,t)=>{let r=xs(n,e);return typeof r==`string`&&r.length>0?r:t},i=r(`consentWording`,`I agree to use electronic records and an electronic signature for this document.`);return{version:r(`consentVersion`,`1`),wording:i,sha256:await I(i),masterKey:xs(n,`integrationMasterKey`)}}const Cs=(e,t)=>e.expiresAt!==null&&e.expiresAt<=t,ws=(e,t)=>e.signerIds.length>1?t.order:void 0;async function Ts(e,t,n,r,i){let a=V(e).audit_events,o=i;for(let e=0;e<2;e++){if(o??=await zn(t,await Vn(a,t),r,n),await Hn(a,o))return o;o=void 0}throw Error(`audit chain contention`)}async function Es(e,t){if(ms(e.request))return W(`TOKEN_IN_QUERY`);let n=hs(t,e),r=fs(e.input);if(r===null)return n.fail();if(await n.blocked())return W(`RATE_LIMITED`);let i=H(e.input).open===!0,{envelopes:a,snapshots:o}=V(t),s=await gs(t,r),c=s?null:await _s(t,r),l=s??c;if(!l)return n.fail();let u=await a.get(l.data.envelopeId);if(!u)return W(`ENVELOPE_NOT_FOUND`);if(c&&u.status!==`completed`)return n.fail();if(!ds.includes(u.status)||l.data.status!==`pending`){let e={ok:!0,state:`closed`,status:u.status,title:u.title,...c?{}:await bs(l.data.envelopeId,u,await ys(t,u))};return u.status!==`completed`||l.data.status!==`signed`?e:u.pdfSha256?{...e,pdf:`ready`,download:await ki(t,l.data.envelopeId,Date.now())}:{...e,pdf:`pending`}}let d=j();if(Cs(u,d))return W(`SIGNING_TOKEN_EXPIRED`);let f=u.document,[p,m]=await Promise.all([u.snapshot?o.getMany(u.snapshot.ids):Promise.resolve(new Map),Ss(t,!1)]),h=f&&!u.snapshot?``:Dr([...p.values()]);if(h===null)return W(`INTERNAL`);let g=u.status,_=ws(u,l.data);if(i){let n=!1;if(u.status===`sent`&&(n=(await L(a,l.data.envelopeId,`sent`,`in_progress`,{updatedAt:d})).ok,n&&(g=`in_progress`)),_!==void 0&&(n=(await V(t).signers.updateIf(l.id,{where:{viewedAt:null},set:{viewedAt:d}})).applied),n){let n=cs(d,u.docSha256??``,ps(e),_);if(!(await Bn(V(t).audit_events,l.data.envelopeId,n,{salt:u.piiSalt})).ok)throw Error(`audit chain contention`)}}let{participant:v}=l.data;return{ok:!0,state:`ready`,envelope:{id:l.data.envelopeId,title:u.title,status:g,docSha256:u.docSha256,expiresAt:u.expiresAt},signer:{name:l.data.name,as:l.data.as,...v?{participant:v}:{}},snapshot:h,...f?{document:{kind:f.kind,name:f.name,bytes:f.bytes,pages:f.pages}}:{},...u.otp?{otp:l.data.otpVerifiedAt?`verified`:`required`}:{},...u.signerFields?.length?{fields:u.signerFields}:{},consent:{version:m.version,wording:m.wording,sha256:m.sha256}}}async function Ds(e,t,n){if(ms(e.request))return W(`TOKEN_IN_QUERY`);let r=hs(t,e),i=fs(e.input);if(i===null)return r.fail();let a=rs(e.input);if(!a.ok)return U(a.error);let{envelopes:o,signers:s,audit_events:c}=V(t),l=await gs(t,i);if(!l||l.data.status!==`pending`)return r.fail();let u=l.data.envelopeId,d=await o.get(u);if(!d)return W(`ENVELOPE_NOT_FOUND`);if(d.status===`sent`)return W(`SESSION_REQUIRED`);if(d.status!==`in_progress`||d.document&&!n)return W(`ENVELOPE_CLOSED`);let f=j();if(Cs(d,f))return W(`SIGNING_TOKEN_EXPIRED`);if(d.otp&&!l.data.otpVerifiedAt)return W(`OTP_REQUIRED`);if(d.docSha256===null||a.value.docSha256!==d.docSha256)return U([{path:`docSha256`,code:`DOC_CHANGED`}]);let p=await Ss(t,vs(d));if(a.value.consentSha256!==p.sha256)return U([{path:`consentSha256`,code:`CONSENT_CHANGED`}]);let m=d.signerFields??[],h=a.value.fieldValues,g=[...Object.keys(h).filter(e=>!m.some(t=>t.key===e)).map(e=>({path:`fieldValues.${e}`,code:`INVALID_FIELDS`})),...m.filter(e=>e.required&&(h[e.key]??``).trim()===``).map(e=>({path:`fieldValues.${e.key}`,code:`INVALID_FIELDS`}))];if(g.length>0)return U(g);let _=await as(d.docSha256,a.value.signature,{fieldValues:h,salt:d.piiSalt}),v=ps(e),y={status:`signed`,signature:_,consentAt:f,consentVersion:p.version,consentSha256:p.sha256,signedAt:f,fieldValues:h,...v};if(d.signerIds.length>1)return n?n(t,{envelopeId:u,envelope:d,signer:l,set:y,now:f}):W(`ENVELOPE_CLOSED`);let b=ls({at:f,docSha256:d.docSha256,consentVersion:p.version,consentSha256:p.sha256,signature:_,signerName:l.data.name,who:v}),x=await zn(u,await Vn(c,u),b,d.piiSalt),S=await Kn(d.docSha256,x.at(-1)?.data.hash??``),C=await L(o,u,d.status,`completed`,{completedAt:f,finalHash:S,updatedAt:f});if(!C.ok)return W(`ENVELOPE_CLOSED`);if(await s.updateIf(l.id,{where:{status:`pending`},set:y}),!await Hn(c,x))throw Error(`audit chain contention`);return await bi(t.cron,u,Date.parse(f)),{ok:!0,status:`completed`,completedAt:f,...await bs(u,C.value,p.masterKey)}}async function Os(e,t){if(ms(e.request))return W(`TOKEN_IN_QUERY`);let n=hs(t,e),r=fs(e.input);if(r===null)return n.fail();let i=is(H(e.input).reason);if(i===null)return U([{path:`reason`,code:`INVALID_INPUT`}]);let{envelopes:a,signers:o}=V(t),s=await gs(t,r);if(!s||s.data.status!==`pending`)return n.fail();let c=s.data.envelopeId,l=await a.get(c);if(!l)return W(`ENVELOPE_NOT_FOUND`);if(!Zn(l.status,`declined`))return W(`ENVELOPE_CLOSED`);let u=j();if(Cs(l,u))return W(`SIGNING_TOKEN_EXPIRED`);let d=await L(a,c,l.status,`declined`,{closedAt:u,updatedAt:u});if(!d.ok)return W(`ENVELOPE_CLOSED`);let f=ps(e);return await o.updateIf(s.id,{where:{status:`pending`},set:{status:`declined`,declinedAt:u,...i===void 0?{}:{declineReason:i},...f}}),await Ts(t,c,l.piiSalt,us({at:u,docSha256:l.docSha256,hasReason:i!==void 0,who:f,order:ws(l,s.data)})),{ok:!0,status:`declined`,...await bs(c,d.value,await ys(t,d.value))}}const ks=e=>(t,n)=>e(t,n),As=(e=>({"public/session":ks(Es),"public/submit":ks((t,n)=>Ds(t,n,e)),"public/decline":ks(Os)}))();function js(e){try{return new URL(e.site.url).origin}catch{return}}async function Ms(e,t,n={}){let r=(n.now??Date.now)(),i=j(r),{envelopes:a,signers:o,snapshots:s,templates:c,nonces:l}=V(t),u=Jo(t),d=await tt({token:H(e).intent,now:r,getClient:u.getClient,consumeNonce:async(e,t,n)=>{let r=`${e}.${t}`;try{let t={nonce:r,cid:e,expiresAt:j(n*1e3)};return(await l.compareAndSet(r,null,t)).applied}catch(e){if(Ii(e))return!1;throw e}},siteOrigin:js(t)});if(!d.ok)return W(d.error);let f=d.value,p=u.settings(),m=f.tplVersion===void 0?void 0:R(f.tpl,f.tplVersion),h=await c.getMany(m===void 0?[f.tpl]:[f.tpl,m]),g=h.get(f.tpl);if(!ir(g))return W(`TEMPLATE_NOT_FOUND`);let _=_r(g,m===void 0?void 0:h.get(m),f.tplVersion);if(!_.ok)return W(`TEMPLATE_NOT_FOUND`);let v=Mn(n.random),y=Sr(f,_.value,{now:i,piiSalt:v});if(!y.ok)return U(y.error);let b={delivery:y.value.delivery,signer:y.value.signer},x=O(n.random),S=await k(x),C=async e=>{let t=await jr(f.cid,f.ref,e);return{id:t,sent:await Or(t,y.value,_.value,{now:i,tokenHash:S,expiryDays:Fi(p.expiryDays)})}},w=await C(1);if(!w.sent.ok)return Array.isArray(w.sent.error)?U(w.sent.error):W(`INTERNAL`);let T=await a.compareAndSet(w.id,null,w.sent.value.envelope);if(!T.applied){let e=await a.query({where:{clientId:f.cid,externalRef:f.ref},limit:100}),i=Ar(e.items);if(i)return i.data.status===`draft`&&await oa(t.cron,i.id,r),Fs(o,i.id,i.data,b,n.random);let s=Math.max(e.items.length,1)+1;if(y.value.delivery===`email`){let e=await jr(f.cid,f.ref,s);if(!(await a.compareAndSet(e,null,y.value)).applied){let t=await a.get(e);return t?Fs(o,e,t,b,n.random):W(`INTERNAL`)}return await oa(t.cron,e,r),Ns(e,y.value,void 0)}if(w=await C(s),!w.sent.ok)return Array.isArray(w.sent.error)?U(w.sent.error):W(`INTERNAL`);if(T=await a.compareAndSet(w.id,null,w.sent.value.envelope),!T.applied){let e=await a.get(w.id);return e?Fs(o,w.id,e,b,n.random):W(`INTERNAL`)}}let{id:E,sent:D}=w;if(!D.ok)return W(`INTERNAL`);await s.putMany(D.value.chunks);let ee=await Ri(o,D.value.signer,x,n.random);D.value.envelope.delivery===`email`&&await Dn(t,{signerId:D.value.signer.id,envelope:D.value.envelope,token:ee,senderSetting:p.senderName,now:r});let te=[Mr(y.value,`integration`),Nr(D.value.envelope,`integration`)];return await V(t).audit_events.putMany(await Rn(E,te,v)),Ns(E,D.value.envelope,ee)}function Ns(e,t,n,r=t.delivery===`inline`){return{ok:!0,envelopeId:e,status:t.status,...n!==void 0&&r?{signingToken:n}:{}}}function Ps(e,t){let n=e.signer;return n.email===t.email&&n.as===t.as&&(n.participant?.name??null)===(t.participant?.name??null)}async function Fs(e,t,n,r,i){let a=n.signerIds[0],o=n.status===`sent`||n.status===`in_progress`;if(!(r.delivery===`inline`&&o&&Ps(n,r.signer))||a===void 0)return Ns(t,n,void 0);let s=await Li(O(i),i,t=>e.updateIf(a,{where:{status:`pending`},set:{tokenHash:t}}));return Ns(t,n,s.value.applied?s.token:void 0,!0)}const Is=(e,t)=>Ms(e.input,t),Ls=64*1024,Rs=[{name:`public/envelopes/from-intent`,methods:[`POST`],body:`json`,maxBytes:16*1024},{name:`public/session`,methods:[`POST`],body:`json`,maxBytes:8*1024},{name:`public/otp/send`,methods:[`POST`],body:`json`,maxBytes:8*1024},{name:`public/otp/verify`,methods:[`POST`],body:`json`,maxBytes:8*1024},{name:`public/submit`,methods:[`POST`],body:`json`,maxBytes:256*1024},{name:`public/decline`,methods:[`POST`],body:`json`,maxBytes:8*1024},{name:`public/download`,methods:[`GET`],body:`none`,response:`raw`},{name:`public/verify`,methods:[`POST`],body:`json`,maxBytes:8*1024},{name:`public/receipts/lookup`,methods:[`POST`],body:`json`,maxBytes:8*1024},{name:`public/templates/catalog`,methods:[`POST`],body:`json`,maxBytes:Ls},{name:`public/self-serve/start`,methods:[`POST`],body:`json`,maxBytes:Ls}];async function zs(){return ne({code:`NOT_FOUND`}).body}function Bs(e={}){let t={};for(let n of Rs)t[n.name]={public:!0,methods:[...n.methods],request:n.maxBytes===void 0?{body:n.body}:{body:n.body,maxBytes:n.maxBytes},...n.response?{response:n.response}:{},handler:e[n.name]??zs};return t}const Vs=e=>Number(/_(\d+)$/.exec(e)?.[1]??0);function Hs(e){let t;for(let n of e)(!t||Vs(n.id)>Vs(t.id)||Vs(n.id)===Vs(t.id)&&n.data.createdAt>t.data.createdAt)&&(t=n);return t}async function Us(e,t,n=Date.now()){let r=Jo(t),i=await rt({token:H(e).request,now:n,getClient:r.getClient});if(!i.ok)return W(i.error);let{cid:a,ref:o}=i.value,s=Hs((await V(t).envelopes.query({where:{clientId:a,externalRef:o},limit:100})).items.filter(e=>e.data.clientId===a&&e.data.externalRef===o));if(!s)return{ok:!0,state:`none`,receipt:null};if(!Qn(s.data.status))return{ok:!0,state:`pending`,receipt:null};let c=await Yo(s.id,s.data,r.settings().integrationMasterKey);return c?{ok:!0,state:`terminal`,receipt:c}:W(`INTERNAL`)}const Ws=(e,t)=>Us(e.input,t),Gs=/^[0-9a-f]{64}$/,Ks=async(e,t)=>{let n=H(e.input).sha256,r=typeof n==`string`?n.toLowerCase():``;if(!Gs.test(r))return U([{path:`sha256`,code:`invalid`}]);if(!(await Jt({get:e=>t.kv.get(e),set:(e,n)=>t.kv.set(e,n)},e.requestMeta?.ip??`unknown`,Date.now(),{scope:`esign-verify`,limit:20,windowSeconds:600,salt:`esign-verify/1`})).ok)return W(`RATE_LIMITED`);let{envelopes:i,audit_events:a}=V(t),o=(await i.query({where:{pdfSha256:r},limit:1})).items[0];if(!o||o.data.status!==`completed`)return{ok:!0,matched:!1};let s=o.data,{items:c}=await a.query({where:{envelopeId:o.id},orderBy:{seq:`asc`},limit:101}),l=null;if(c.length<=100){let e=c.map(e=>e.data),t=await Wn(o.id,e);l=t.ok&&s.docSha256!==null&&e.at(-1)?.type===`envelope.completed`&&await Kn(s.docSha256,t.value.head)===s.finalHash}return{ok:!0,matched:!0,status:s.status,completedAt:s.completedAt,finalHash:s.finalHash,chainVerified:l}},qs=[{name:Sn,schedule:`* * * * *`},{name:ua,schedule:`0 * * * *`},{name:ma,schedule:`23 3 * * *`},{name:ea,schedule:`17 * * * *`}],Js=Bs({"public/envelopes/from-intent":Is,"public/download":Mi,"public/verify":Ks,"public/receipts/lookup":Ws,"public/templates/catalog":Zo,...As}),Ys={hooks:{"plugin:activate":async(e,t)=>{await $t(t,qs)},cron:async(e,t)=>{await tn(e,t,qs,Date.now())||await kn(e,t)||await $i(e,t)||await la(e,t)||await pa(e,t)||await Ea(e,t)||await na(e,t)||await Si(e,t)}},routes:{...Js,...Ho,...Ga,...Ji,admin:rn(Ho.admin,nn),"templates/create":rn(Ga[`templates/create`]),"public/verify":rn(Js[`public/verify`])}};export{Ys as default};