@stacksjs/ts-cloud 0.16.65 → 0.16.66

package/dist/aws/index.js

@@ -1 +1 @@
-import{Te,Er,Os,_s,Cg,Ac,yc,Ls,$s,Sc,dt,re,lt,pe,T,we,Mn,Ic,Ue,bc,Un,Eg,Th,Ms,Fs,Qn,Hn,wh,Rh,XS,YS,ZS,eI,Qt,tI,rI,nI,iI,Ht,Dh,Ph,kh,Gt,Nh,Bh,xh,Gn,sI,oI,aI,vr,cI,dI,lI,Cc,Ec,vg,uI,gI,pI,Tr,Oh,_h,wr,ut,Vn,vc,Tg,mI,wg,fI,Vt,hI,yI,SI,II,fe,bI,CI,EI,vI,Rr,TI,wI,RI,qn,Tc,wc,Rg,Dg,Rc,Dr}from"../chunk-f512g4fq.js";import{Re,gt,jn,Lh}from"../chunk-rs8v7c67.js";import{Dc,Qe,I}from"../chunk-pjdp30dn.js";import{He}from"../chunk-n0xw26th.js";import{ne}from"../chunk-7mw4x3ay.js";import{pt,he,Ge,H,Kt,Kn,Us,Qs,Pr,kr,Wn,Nr,Hs,Gs,Vs,qs,ie,js,zs,Ks,Ws,Ae,Js,Xs,Ys,N,Nc,Jn,Bc,ye,Br}from"../chunk-bn3jfrg5.js";import{b}from"../chunk-n3sydv3m.js";import{Gr,Be}from"../chunk-bydj8p3h.js";import{A}from"../chunk-tt3pn05f.js";import{o}from"../chunk-betvtvy7.js";import{qr,Ep,vp,Ni,n,u,Zh}from"../chunk-et77ydjb.js";export{ye as ACMClient,Br as ACMDnsValidator,n as AWSClient,vc as ApplicationAutoScalingClient,Er as AwsBackupClient,Rh as BedrockAgentClient,wh as BedrockAgentRuntimeClient,Hn as BedrockClient,Qn as BedrockRuntimeClient,A as CloudFormationClient,I as CloudFrontClient,we as CloudWatchLogsClient,H as CloudflareProvider,Qt as ComprehendClient,Mn as ConnectClient,$s as CostExplorerClient,Jn as DnsProviderFactory,Ue as DynamoDBClient,Gr as EC2Client,He as ECRClient,dt as ECSClient,Dr as EFSClient,Ic as ELBv2Client,ut as ElastiCacheClient,jn as EmailClient,wr as EventBridgeClient,Ge as GoDaddyProvider,Re as IAMClient,Tg as ImapServer,Tr as KendraClient,T as LambdaClient,bc as OpenSearchClient,pt as PROXIABLE_RECORD_TYPES,Cc as PersonalizeClient,vg as PersonalizeEventsClient,Ec as PersonalizeRuntimeClient,Gn as PollyClient,he as PorkbunProvider,ne as RDSClient,Ht as RekognitionClient,b as Route53Client,Sc as Route53DomainsClient,ie as Route53Provider,o as S3Client,gt as SESClient,lt as SNSClient,pe as SQSClient,Be as SSMClient,Te as STSClient,Vn as SchedulerClient,re as SecretsManagerClient,Vt as SmsClient,Rc as SmsVoiceClient,wg as SmtpServer,qn as SupportClient,Tc as SupportTemplates,Gt as TextractClient,Un as TranscribeClient,vr as TranslateClient,Ae as UnifiedDnsValidator,Rr as VoiceClient,tI as analyzeSentiment,Vs as applyDeclaredZoneSettings,Ks as applyZoneMigration,u as buildQueryParams,vp as canonicalUriFor,Ni as coerceXmlValues,ZS as completeWithClaude,Dc as configOrigins,iI as containsPii,Ph as countFacesInS3Image,Eg as crc32,II as createDeliveryReceiptHandler,N as createDnsProvider,Xs as createGoDaddyValidator,Ls as createObjectStorageClient,Js as createPorkbunValidator,wI as createRecordingHandler,Ys as createRoute53Validator,aI as createSSML,yI as createScheduledSmsHandler,SI as createSmsClient,hI as createSmsInboxHandler,Dg as createSmsInfrastructure,RI as createVoiceClient,TI as createVoicemailHandler,Ms as decodeEventStream,Th as decodeEventStreamMessage,Nr as delegateZone,Hs as delegateZoneFromConfig,Gs as describeDelegation,qs as describeZoneSettings,Zh as detectCredentialSource,Nc as detectDnsProvider,Dh as detectLabelsFromS3,nI as detectLanguage,Bc as dnsProviders,Lh as email,Fs as eventStreamError,js as exportRoute53Zone,rI as extractEntities,Bh as extractFormsFromS3,xh as extractTablesFromS3,Nh as extractTextFromS3,bI as formatPhoneNumber,eI as generateEmbeddings,EI as getCountryCode,uI as getRecommendations,gI as getSimilarItems,Rg as getSmsInfrastructureStatus,kh as isContentSafe,Pr as isNameserverRegistrar,vI as isSamePhoneNumber,CI as isValidPhoneNumber,kr as isZoneHost,_s as keyMatchesFilters,YS as listClaudeModels,lI as listLanguages,oI as listVoices,Cg as migrateObjectStorage,fe as normalizePhoneNumber,zs as planZoneMigration,Kt as policyTag,Ac as providerEndpoint,Kn as qualifyName,Qs as reconcileDeclaredRecords,Os as remapKey,XS as requestModelAccess,Us as resolveDeclaredRecords,yc as resolveObjectStorage,qr as resolveS3Endpoint,_h as retrieveForRag,Qe as s3OriginBucket,Wn as sameNameservers,Oh as search,wc as setupSmsInfrastructure,Ep as signingNameFor,mI as startImapServer,fI as startSmtpServer,sI as textToSpeech,pI as trackEvent,cI as translate,dI as translateToMultiple,Ws as verifyZoneParity};
+import{Te,Er,Os,_s,Cg,Ac,yc,Ls,$s,Sc,dt,re,lt,pe,T,we,Mn,Ic,Ue,bc,Un,Eg,wh,Ms,Fs,Qn,Hn,Rh,Dh,YS,ZS,eI,tI,Qt,rI,nI,iI,sI,Ht,Ph,kh,Nh,Gt,Bh,xh,Oh,Gn,oI,aI,cI,vr,dI,lI,uI,Cc,Ec,vg,gI,pI,mI,Tr,_h,Lh,wr,ut,Vn,vc,Tg,fI,wg,hI,Vt,yI,SI,II,bI,fe,CI,EI,vI,TI,Rr,wI,RI,DI,qn,Tc,wc,Rg,Dg,Rc,Dr}from"../chunk-a92gvctb.js";import{Re,gt,jn,$h}from"../chunk-03eny26f.js";import{Dc,Qe,I}from"../chunk-r49ynkag.js";import{He}from"../chunk-3ca6cb1s.js";import{ne}from"../chunk-tngsyawj.js";import{pt,he,Ge,H,Kt,Kn,Us,Qs,Pr,kr,Wn,Nr,Hs,Gs,Vs,qs,ie,js,zs,Ks,Ws,Ae,Js,Xs,Ys,N,Nc,Jn,Bc,ye,Br}from"../chunk-q4408fwg.js";import{b}from"../chunk-q8vvwmka.js";import{Gr,Be}from"../chunk-axcxfz8p.js";import{A}from"../chunk-0kemzwpg.js";import{o}from"../chunk-1t3rjvf9.js";import{qr,vp,Tp,Ni,n,u,eA}from"../chunk-9w5ncn9s.js";export{ye as ACMClient,Br as ACMDnsValidator,n as AWSClient,vc as ApplicationAutoScalingClient,Er as AwsBackupClient,Dh as BedrockAgentClient,Rh as BedrockAgentRuntimeClient,Hn as BedrockClient,Qn as BedrockRuntimeClient,A as CloudFormationClient,I as CloudFrontClient,we as CloudWatchLogsClient,H as CloudflareProvider,Qt as ComprehendClient,Mn as ConnectClient,$s as CostExplorerClient,Jn as DnsProviderFactory,Ue as DynamoDBClient,Gr as EC2Client,He as ECRClient,dt as ECSClient,Dr as EFSClient,Ic as ELBv2Client,ut as ElastiCacheClient,jn as EmailClient,wr as EventBridgeClient,Ge as GoDaddyProvider,Re as IAMClient,Tg as ImapServer,Tr as KendraClient,T as LambdaClient,bc as OpenSearchClient,pt as PROXIABLE_RECORD_TYPES,Cc as PersonalizeClient,vg as PersonalizeEventsClient,Ec as PersonalizeRuntimeClient,Gn as PollyClient,he as PorkbunProvider,ne as RDSClient,Ht as RekognitionClient,b as Route53Client,Sc as Route53DomainsClient,ie as Route53Provider,o as S3Client,gt as SESClient,lt as SNSClient,pe as SQSClient,Be as SSMClient,Te as STSClient,Vn as SchedulerClient,re as SecretsManagerClient,Vt as SmsClient,Rc as SmsVoiceClient,wg as SmtpServer,qn as SupportClient,Tc as SupportTemplates,Gt as TextractClient,Un as TranscribeClient,vr as TranslateClient,Ae as UnifiedDnsValidator,Rr as VoiceClient,rI as analyzeSentiment,Vs as applyDeclaredZoneSettings,Ks as applyZoneMigration,u as buildQueryParams,Tp as canonicalUriFor,Ni as coerceXmlValues,eI as completeWithClaude,Dc as configOrigins,sI as containsPii,kh as countFacesInS3Image,Eg as crc32,bI as createDeliveryReceiptHandler,N as createDnsProvider,Xs as createGoDaddyValidator,Ls as createObjectStorageClient,Js as createPorkbunValidator,RI as createRecordingHandler,Ys as createRoute53Validator,cI as createSSML,SI as createScheduledSmsHandler,II as createSmsClient,yI as createSmsInboxHandler,Dg as createSmsInfrastructure,DI as createVoiceClient,wI as createVoicemailHandler,Ms as decodeEventStream,wh as decodeEventStreamMessage,Nr as delegateZone,Hs as delegateZoneFromConfig,Gs as describeDelegation,qs as describeZoneSettings,eA as detectCredentialSource,Nc as detectDnsProvider,Ph as detectLabelsFromS3,iI as detectLanguage,Bc as dnsProviders,$h as email,Fs as eventStreamError,js as exportRoute53Zone,nI as extractEntities,xh as extractFormsFromS3,Oh as extractTablesFromS3,Bh as extractTextFromS3,CI as formatPhoneNumber,tI as generateEmbeddings,vI as getCountryCode,gI as getRecommendations,pI as getSimilarItems,Rg as getSmsInfrastructureStatus,Nh as isContentSafe,Pr as isNameserverRegistrar,TI as isSamePhoneNumber,EI as isValidPhoneNumber,kr as isZoneHost,_s as keyMatchesFilters,ZS as listClaudeModels,uI as listLanguages,aI as listVoices,Cg as migrateObjectStorage,fe as normalizePhoneNumber,zs as planZoneMigration,Kt as policyTag,Ac as providerEndpoint,Kn as qualifyName,Qs as reconcileDeclaredRecords,Os as remapKey,YS as requestModelAccess,Us as resolveDeclaredRecords,yc as resolveObjectStorage,qr as resolveS3Endpoint,Lh as retrieveForRag,Qe as s3OriginBucket,Wn as sameNameservers,_h as search,wc as setupSmsInfrastructure,vp as signingNameFor,fI as startImapServer,hI as startSmtpServer,oI as textToSpeech,mI as trackEvent,dI as translate,lI as translateToMultiple,Ws as verifyZoneParity};

package/dist/bin/{chunk-mxa9rrw0.js → chunk-3954zb9r.js}

@@ -1 +1 @@
-import{yi}from"./chunk-75x772gr.js";import"./chunk-90ds3vw7.js";import"./chunk-tpttr74v.js";import"./chunk-zs0q8sh5.js";import"./chunk-sbjzewvk.js";import"./chunk-8bgfn8ek.js";import"./chunk-qpvydcfm.js";import"./chunk-v3j9wgmn.js";import"./chunk-d0q93ecd.js";export{yi as resolveServerDashboardData};
+import{yi}from"./chunk-w4axqmyc.js";import"./chunk-90ds3vw7.js";import"./chunk-tpttr74v.js";import"./chunk-zs0q8sh5.js";import"./chunk-sbjzewvk.js";import"./chunk-8bgfn8ek.js";import"./chunk-qpvydcfm.js";import"./chunk-v3j9wgmn.js";import"./chunk-d0q93ecd.js";export{yi as resolveServerDashboardData};

package/dist/bin/{chunk-eap6bmrq.js → chunk-nbqja2ja.js}

@@ -1,4 +1,4 @@
-import{la,Ve,R,H,A,B,$e,er}from"./chunk-v3j9wgmn.js";import{ce,vn,re,Cn,h,Ur,aa}from"./chunk-2avtspqd.js";import{Fe,S,Ss,Cr,vi,Ci,ln,wc,Bt,dn,yt,Ze,Be,et,Ac,St,Tr,je,tt,Ti,Ei,po,mo,rt,un,Ar,vt,m,Co,_s,Os}from"./chunk-tw6z2mvh.js";import{Kt,p}from"./chunk-qpvydcfm.js";import{v}from"./chunk-zs0q8sh5.js";import{g}from"./chunk-8bgfn8ek.js";import{J,w,D,Et,Fo,xr,hn}from"./chunk-sbjzewvk.js";import{Ke,hr,io,O,an,yc,bc,Ut,hi,yi}from"./chunk-75x772gr.js";import{No}from"./chunk-tpttr74v.js";import{fe}from"./chunk-zesb85ra.js";import{qs,Ws}from"./chunk-38qy0dj2.js";import{_r,It,Or,$r,Lr,Mr,Sn}from"./chunk-v5x06h8w.js";import{se,q,ui}from"./chunk-n667tnf3.js";import{E}from"./chunk-5ad4b744.js";import{V}from"./chunk-nn8k84cd.js";import{P}from"./chunk-aekwpste.js";import{K,Fs,Bs,$o,Gt,z,js}from"./chunk-vbq4ten8.js";import{bs}from"./chunk-tg3vzzc4.js";import{cn}from"./chunk-71b4t3d8.js";import{L,x,oa}from"./chunk-6r04kx46.js";import{createCipheriv as $b,createDecipheriv as Lb,createHash as $p,randomBytes as Ui}from"node:crypto";import{createHmac as Nb,timingSafeEqual as Mb}from"node:crypto";var $d="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Ha(e){let t=0,r=0,n="";for(let i of e){r=r<<8|i,t+=8;while(t>=5)n+=$d[r>>>t-5&31],t-=5}if(t>0)n+=$d[r<<5-t&31];return n}function xp(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,n=0,i=[];for(let o of t){let s=$d.indexOf(o);if(s<0)throw Error("Invalid base32 secret");if(n=n<<5|s,r+=5,r>=8)i.push(n>>>r-8&255),r-=8}return Buffer.from(i)}function Dp(e,t,r=6){let n=Buffer.alloc(8);n.writeBigUInt64BE(BigInt(t));let i=Nb("sha1",xp(e)).update(n).digest(),o=i[i.length-1]&15,s=(i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255;return String(s%10**r).padStart(r,"0")}function Wa(e,t,r=Date.now(),n=1){let i=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(i))return;let o=Buffer.from(i),s=Math.floor(r/1000/30);for(let c=-n;c<=n;c++){if(s+c<0)continue;let u=Buffer.from(Dp(e,s+c));if(o.length===u.length&&Mb(o,u))return s+c}return}function Ld(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var Lp=1800000,bo=43200000,Bp=3600000,Fp=300000,jp=600000;function fn(e){return typeof e==="string"?e:void 0}function Up(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function Bb(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function Bd(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function Fb(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function jb(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function Ub(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function zb(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function Fn(e){return $p("sha256").update(e).digest("hex")}function pa(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:fn(e.email),emailVerifiedAt:fn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:fn(e.disabled_at),lastLoginAt:fn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Op(e,t){let r=fn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Up(e.metadata),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Fd(e,t){let r=fn(e.revoked_at),n=String(e.idle_expires_at),i=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:fn(e.user_agent),networkHint:fn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:n,absoluteExpiresAt:i,recentAuthAt:String(e.recent_auth_at),mfaAt:fn(e.mfa_at),revokedAt:r,state:r?"revoked":n<=t||i<=t?"expired":"active"}}function _p(e){let t=fn(e.verified_at),r=fn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function jd(e,t){let r=fn(e.consumed_at),n=String(e.expires_at),i=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:i,expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":i>=5?"locked":n<=t?"expired":"pending"}}function Np(e){let t=Up(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Ka(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Np(e.scopes),allowedDomains:Np(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Mp(e,t){let r=fn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Vb(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Me{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?$p("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=Ui(12),r=$b("aes-256-gcm",this.encryptionKey,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted authentication value is unavailable");let o=Lb("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=Bb(e.username),r=Bd(e.email),n=e.id??this.idFn(),i=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
+import{la,Ve,R,H,A,B,$e,er}from"./chunk-v3j9wgmn.js";import{ce,vn,re,Cn,h,Ur,aa}from"./chunk-2avtspqd.js";import{Fe,S,Ss,Cr,vi,Ci,ln,wc,Bt,dn,yt,Ze,Be,et,Ac,St,Tr,je,tt,Ti,Ei,po,mo,rt,un,Ar,vt,m,Co,_s,Os}from"./chunk-tw6z2mvh.js";import{Kt,p}from"./chunk-qpvydcfm.js";import{v}from"./chunk-zs0q8sh5.js";import{g}from"./chunk-8bgfn8ek.js";import{J,w,D,Et,Fo,xr,hn}from"./chunk-sbjzewvk.js";import{Ke,hr,io,O,an,yc,bc,Ut,hi,yi}from"./chunk-w4axqmyc.js";import{No}from"./chunk-tpttr74v.js";import{fe}from"./chunk-zesb85ra.js";import{qs,Ws}from"./chunk-38qy0dj2.js";import{_r,It,Or,$r,Lr,Mr,Sn}from"./chunk-v5x06h8w.js";import{se,q,ui}from"./chunk-n667tnf3.js";import{E}from"./chunk-5ad4b744.js";import{V}from"./chunk-nn8k84cd.js";import{P}from"./chunk-aekwpste.js";import{K,Fs,Bs,$o,Gt,z,js}from"./chunk-vbq4ten8.js";import{bs}from"./chunk-tg3vzzc4.js";import{cn}from"./chunk-71b4t3d8.js";import{L,x,oa}from"./chunk-6r04kx46.js";import{createCipheriv as $b,createDecipheriv as Lb,createHash as $p,randomBytes as Ui}from"node:crypto";import{createHmac as Nb,timingSafeEqual as Mb}from"node:crypto";var $d="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Ha(e){let t=0,r=0,n="";for(let i of e){r=r<<8|i,t+=8;while(t>=5)n+=$d[r>>>t-5&31],t-=5}if(t>0)n+=$d[r<<5-t&31];return n}function xp(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,n=0,i=[];for(let o of t){let s=$d.indexOf(o);if(s<0)throw Error("Invalid base32 secret");if(n=n<<5|s,r+=5,r>=8)i.push(n>>>r-8&255),r-=8}return Buffer.from(i)}function Dp(e,t,r=6){let n=Buffer.alloc(8);n.writeBigUInt64BE(BigInt(t));let i=Nb("sha1",xp(e)).update(n).digest(),o=i[i.length-1]&15,s=(i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255;return String(s%10**r).padStart(r,"0")}function Wa(e,t,r=Date.now(),n=1){let i=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(i))return;let o=Buffer.from(i),s=Math.floor(r/1000/30);for(let c=-n;c<=n;c++){if(s+c<0)continue;let u=Buffer.from(Dp(e,s+c));if(o.length===u.length&&Mb(o,u))return s+c}return}function Ld(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var Lp=1800000,bo=43200000,Bp=3600000,Fp=300000,jp=600000;function fn(e){return typeof e==="string"?e:void 0}function Up(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function Bb(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function Bd(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function Fb(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function jb(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function Ub(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function zb(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function Fn(e){return $p("sha256").update(e).digest("hex")}function pa(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:fn(e.email),emailVerifiedAt:fn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:fn(e.disabled_at),lastLoginAt:fn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Op(e,t){let r=fn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Up(e.metadata),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Fd(e,t){let r=fn(e.revoked_at),n=String(e.idle_expires_at),i=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:fn(e.user_agent),networkHint:fn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:n,absoluteExpiresAt:i,recentAuthAt:String(e.recent_auth_at),mfaAt:fn(e.mfa_at),revokedAt:r,state:r?"revoked":n<=t||i<=t?"expired":"active"}}function _p(e){let t=fn(e.verified_at),r=fn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function jd(e,t){let r=fn(e.consumed_at),n=String(e.expires_at),i=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:i,expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":i>=5?"locked":n<=t?"expired":"pending"}}function Np(e){let t=Up(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Ka(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Np(e.scopes),allowedDomains:Np(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Mp(e,t){let r=fn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Vb(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Me{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?$p("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=Ui(12),r=$b("aes-256-gcm",this.encryptionKey,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted authentication value is unavailable");let o=Lb("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=Bb(e.username),r=Bd(e.email),n=e.id??this.idFn(),i=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[n,e.actorId,t,r??null,e.emailVerified&&r?i:null,e.passwordHash,e.requiresPasswordUpgrade?1:0,i,i]),this.getIdentity(n)}getIdentity(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE id = ?").get(e);return t?pa(t):void 0}getIdentityByActor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE actor_id = ?").get(e);return t?pa(t):void 0}getIdentityByUsername(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE username = ? COLLATE NOCASE").get(e.trim());return t?pa(t):void 0}getIdentityByEmail(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE email = ? COLLATE NOCASE").get(e.trim().toLowerCase());return t?pa(t):void 0}listIdentities(){return this.controlPlane.database.query("SELECT * FROM auth_identities ORDER BY username COLLATE NOCASE").all().map(pa)}updatePassword(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let i=this.now();return this.controlPlane.transaction(()=>{if(this.run(`UPDATE auth_identities SET password_hash = ?, credential_version = credential_version + 1,
         requires_password_upgrade = ?, updated_at = ? WHERE id = ?`,[t,r.requiresUpgrade?1:0,i,e]),r.revokeSessions!==!1)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[i,e])}),this.getIdentity(e)}rehashPassword(e,t){let r=this.now();this.run("UPDATE auth_identities SET password_hash = ?, requires_password_upgrade = 0, updated_at = ? WHERE id = ?",[t,r,e]);let n=this.getIdentity(e);if(!n)throw Error("Authentication identity was not found");return n}setVerifiedEmail(e,t){let r=Bd(t),n=this.now();this.run("UPDATE auth_identities SET email = ?, email_verified_at = ?, updated_at = ? WHERE id = ?",[r,n,n,e]);let i=this.getIdentity(e);if(!i)throw Error("Authentication identity was not found");return i}recordLogin(e){let t=this.now();this.run("UPDATE auth_identities SET last_login_at = ?, updated_at = ? WHERE id = ?",[t,t,e]);let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");return r}setDisabled(e,t){let r=this.now();this.controlPlane.transaction(()=>{if(this.run("UPDATE auth_identities SET disabled_at = ?, credential_version = credential_version + 1, updated_at = ? WHERE id = ?",[t?r:null,r,e]),t)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[r,e])});let n=this.getIdentity(e);if(!n)throw Error("Authentication identity was not found");return n}createActionToken(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let n=Ui(32).toString("base64url"),i=this.idFn(),o=this.now(),s=new Date(this.nowFn().getTime()+Math.min(86400000,Math.max(60000,r.ttlMs??Bp))).toISOString();return this.run("INSERT INTO auth_action_tokens (id, identity_id, type, token_hash, metadata, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[i,e,t,Fn(n),JSON.stringify(r.metadata??{}),s,o]),{actionToken:this.getActionToken(i),token:n}}getActionToken(e){let t=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE id = ?").get(e);return t?Op(t,this.now()):void 0}consumeActionToken(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE token_hash = ? AND type = ?").get(Fn(e),t);if(!r)throw Error("Action token is invalid");let n=Op(r,this.now());if(n.state!=="pending")throw Error(`Action token is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("Action token is no longer available");return this.getActionToken(n.id)})}revokeActionTokens(e,t){return this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE identity_id = ? AND type = ? AND consumed_at IS NULL",[this.now(),e,t]).changes}createSession(e){let t=this.getIdentity(e.identityId);if(!t||t.disabledAt)throw Error("Authentication identity is unavailable");let r=this.idFn(),n=Ui(32).toString("base64url"),i=`v2.${r}.${n}`,o=this.now(),s=Math.min(86400000,Math.max(60000,e.idleTtlMs??Lp)),c=Math.min(2592000000,Math.max(s,e.absoluteTtlMs??bo));return this.run(`INSERT INTO auth_sessions (id, identity_id, token_hash, credential_version, auth_method, user_agent, network_hint,
       created_at, last_used_at, idle_expires_at, absolute_expires_at, recent_auth_at, mfa_at)