@vicacha-devs/strapi-plugin-certificates 0.0.0-stage → 1.0.0

package/dist/server/index.js

@@ -0,0 +1,2282 @@
+import { formatDateInCalendarSystem, extractCalendarParts } from "@vicacha-devs/strapi-plugin-calendar/shared";
+import { createHash, sign, generateKeyPairSync, createHmac, timingSafeEqual, verify, randomBytes } from "node:crypto";
+const PLUGIN_ID = "certificates";
+function formatSecondaryCalendars(date, systems, locale = "en") {
+  const result = {};
+  const dateStr = date.toISOString().slice(0, 10);
+  for (const sys of systems) {
+    if (!sys || !sys.enabled || !sys.id) continue;
+    const formatted = formatDateInCalendarSystem(dateStr, sys, locale, {
+      compact: false
+    });
+    const compact = formatDateInCalendarSystem(dateStr, sys, locale, {
+      compact: true
+    });
+    const parts = extractCalendarParts(
+      date,
+      sys.intlCalendar,
+      sys.dayOffset ?? 0
+    );
+    if (formatted) {
+      result[sys.id] = {
+        calendarId: sys.id,
+        label: sys.label || sys.id,
+        formatted,
+        compact: compact || formatted,
+        intlCalendar: sys.intlCalendar,
+        year: parts?.year,
+        month: parts?.month,
+        day: parts?.day,
+        isOverridden: false
+      };
+    }
+  }
+  return result;
+}
+function computePublicKeyFingerprint(publicKeyPem) {
+  const normalized = String(publicKeyPem || "").trim();
+  if (!normalized) return "";
+  const digest = createHash("sha256").update(normalized, "utf8").digest("hex");
+  return `SHA256:${digest.slice(0, 32).toUpperCase()}`;
+}
+function generateEd25519KeyPair() {
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
+    publicKeyEncoding: { type: "spki", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" }
+  });
+  return {
+    publicKeyPem: publicKey,
+    privateKeyPem: privateKey,
+    fingerprint: computePublicKeyFingerprint(publicKey)
+  };
+}
+function sanitizeSerialPrefix(prefix) {
+  const cleaned = String(prefix || "CERT").toUpperCase().replace(/[^A-Z0-9]/g, "").slice(0, 6);
+  return cleaned || "CERT";
+}
+function generateSerialNumber(prefix = "CERT", year) {
+  const safePrefix = sanitizeSerialPrefix(prefix);
+  const targetYear = typeof year === "number" && Number.isFinite(year) ? year : (/* @__PURE__ */ new Date()).getUTCFullYear();
+  const entropy = randomBytes(4).toString("hex").toUpperCase();
+  return `${safePrefix}-${targetYear}-${entropy}`;
+}
+function generateVerificationToken() {
+  return randomBytes(24).toString("hex");
+}
+function normalizeNationalId(rawId) {
+  return String(rawId || "").toUpperCase().replace(/[^A-Z0-9]/g, "");
+}
+function maskNationalId(rawId) {
+  const normalized = normalizeNationalId(rawId);
+  if (!normalized) return "";
+  if (normalized.length <= 4) {
+    return `***-${normalized}`;
+  }
+  const tail = normalized.slice(-4);
+  return `***-***-${tail}`;
+}
+function hashNationalId(rawId, serialNumber) {
+  const normalized = normalizeNationalId(rawId);
+  if (!normalized) return "";
+  const cleanSerial = String(serialNumber || "").trim().toUpperCase();
+  return createHash("sha256").update(`${cleanSerial}:${normalized}`, "utf8").digest("hex");
+}
+function verifyNationalIdHash(rawId, serialNumber, expectedHash) {
+  if (!expectedHash || !rawId) return false;
+  const computed = hashNationalId(rawId, serialNumber);
+  if (!computed) return false;
+  return verifyTokenConstantTime(computed, expectedHash);
+}
+function maskRecipientName(fullName) {
+  const parts = String(fullName || "").trim().split(/\s+/).filter(Boolean);
+  if (parts.length === 0) return "***";
+  if (parts.length === 1) {
+    const word = parts[0];
+    return word.length <= 2 ? `${word[0]}*` : `${word.slice(0, 2)}***`;
+  }
+  const first = parts[0];
+  const initials = parts.slice(1).map((part) => `${part.charAt(0).toUpperCase()}.`).join(" ");
+  return `${first} ${initials}`;
+}
+function cleanStr(val) {
+  return String(val ?? "").trim();
+}
+function serializeCanonicalPayload(payload) {
+  const signatories = payload.signatories ?? [];
+  const witnesses = payload.witnesses ?? [];
+  const ordered = {
+    version: "1.0",
+    serialNumber: cleanStr(payload.serialNumber),
+    templateSlug: cleanStr(payload.templateSlug),
+    organizationName: cleanStr(payload.organizationName),
+    recipientFullName: cleanStr(payload.recipientFullName),
+    recipientChosenName: cleanStr(payload.recipientChosenName),
+    nationalIdHash: cleanStr(payload.nationalIdHash),
+    issuedAt: cleanStr(payload.issuedAt),
+    expiresAt: cleanStr(payload.expiresAt),
+    signatories: signatories.map((s) => ({
+      name: cleanStr(s.name),
+      title: cleanStr(s.title)
+    })),
+    witnesses: witnesses.map((w) => ({
+      fullName: cleanStr(w.fullName),
+      role: cleanStr(w.role)
+    }))
+  };
+  return JSON.stringify(ordered);
+}
+function signCanonicalPayload(payload, privateKeyPem) {
+  const canonicalJson = serializeCanonicalPayload(payload);
+  const payloadHash = createHash("sha256").update(canonicalJson, "utf8").digest("hex");
+  const dataBuffer = Buffer.from(canonicalJson, "utf8");
+  const signature = sign(null, dataBuffer, privateKeyPem).toString("base64url");
+  return {
+    canonicalJson,
+    payloadHash,
+    signature
+  };
+}
+function verifyCanonicalPayloadSignature(payload, signatureBase64Url, publicKeyPem) {
+  try {
+    if (!signatureBase64Url || !publicKeyPem) return false;
+    const canonicalJson = serializeCanonicalPayload(payload);
+    const dataBuffer = Buffer.from(canonicalJson, "utf8");
+    const sigBuffer = Buffer.from(signatureBase64Url, "base64url");
+    return verify(null, dataBuffer, publicKeyPem, sigBuffer);
+  } catch {
+    return false;
+  }
+}
+function verifyTokenConstantTime(providedToken, expectedToken) {
+  if (!providedToken || !expectedToken) return false;
+  const a = Buffer.from(String(providedToken), "utf8");
+  const b = Buffer.from(String(expectedToken), "utf8");
+  if (a.length !== b.length || a.length === 0) {
+    return false;
+  }
+  return timingSafeEqual(a, b);
+}
+function computeDocuSignWebhookHmac(rawPayload, webhookSecret) {
+  return createHmac("sha256", webhookSecret).update(rawPayload, "utf8").digest("base64");
+}
+function verifyDocuSignWebhookHmac(rawPayload, signatureHeaderBase64, webhookSecret) {
+  if (!rawPayload || !signatureHeaderBase64 || !webhookSecret) {
+    return false;
+  }
+  const computedBase64 = computeDocuSignWebhookHmac(rawPayload, webhookSecret);
+  return verifyTokenConstantTime(
+    String(signatureHeaderBase64).trim(),
+    computedBase64
+  );
+}
+function computeDeterministicHex(input) {
+  const out = [];
+  for (let pass = 0; pass < 8; pass++) {
+    let h = (2166136261 ^ pass) >>> 0;
+    for (let i = 0; i < input.length; i++) {
+      h ^= input.charCodeAt(i);
+      h = Math.imul(h, 16777619) >>> 0;
+    }
+    out.push(h.toString(16).padStart(8, "0"));
+  }
+  return out.join("");
+}
+function escapeHtml(input) {
+  return String(input ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function sanitizeHexColor(input, fallback = "#14532d") {
+  const cleaned = String(input || "").trim();
+  if (/^#[0-9a-fA-F]{6}$/.test(cleaned)) {
+    return cleaned;
+  }
+  return fallback;
+}
+function interpolateBodyTemplate(templateText, variables) {
+  const safeTemplate = escapeHtml(templateText);
+  return safeTemplate.replace(
+    /\{\{\s*([a-zA-Z0-9_]+)\s*\}\}/g,
+    (_match, key) => {
+      const rawVal = variables[key] ?? "";
+      return `<strong>${escapeHtml(rawVal)}</strong>`;
+    }
+  );
+}
+function renderVerificationMatrixSvg(seedText, accentColor = "#14532d") {
+  const safeColor = sanitizeHexColor(accentColor);
+  const hashHex = computeDeterministicHex(seedText);
+  const size = 9;
+  const cells = [];
+  for (let row = 0; row < size; row++) {
+    for (let col = 0; col < size; col++) {
+      const isCornerFinder = row < 3 && col < 3 || row < 3 && col >= size - 3 || row >= size - 3 && col < 3;
+      const hexIdx = (row * size + col) % hashHex.length;
+      const nibble = parseInt(hashHex[hexIdx], 16);
+      const filled = isCornerFinder || nibble % 2 === 0;
+      if (filled) {
+        const x = 6 + col * 8;
+        const y = 6 + row * 8;
+        cells.push(
+          `<rect x="${x}" y="${y}" width="6.5" height="6.5" rx="1" fill="${safeColor}" />`
+        );
+      }
+    }
+  }
+  return [
+    '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 84 84" width="84" height="84" role="img" aria-label="Cryptographic Verification Matrix">',
+    `<rect x="1" y="1" width="82" height="82" rx="6" fill="#ffffff" stroke="${safeColor}" stroke-width="2" />`,
+    ...cells,
+    "</svg>"
+  ].join("");
+}
+function buildTemplateVariables(certificate, template, issuedDateFormatted, secondaryFormattedList) {
+  return {
+    recipientFullName: certificate.recipientFullName,
+    recipientChosenName: certificate.recipientChosenName || certificate.recipientFullName,
+    chosenName: certificate.recipientChosenName || "",
+    nationalIdMasked: certificate.nationalIdMasked || "N/A",
+    recipientNationality: certificate.recipientNationality || "",
+    issuedDateFormatted,
+    secondaryDateFormatted: secondaryFormattedList || issuedDateFormatted,
+    serialNumber: certificate.serialNumber,
+    organizationName: template.organizationName,
+    ...certificate.customData
+  };
+}
+function renderSignatoriesHtml(signatories) {
+  return (signatories || []).map(
+    (sig, idx) => `
+      <div class="sig-block">
+        <div class="sig-line"><span class="esign-anchor">/sig_${idx + 1}/</span></div>
+        <div class="sig-name">${escapeHtml(sig.name)}</div>
+        <div class="sig-title">${escapeHtml(sig.title)}</div>
+        ${sig.role ? `<div class="sig-role">${escapeHtml(sig.role)}</div>` : ""}
+      </div>`
+  ).join("");
+}
+function renderWitnessesHtml(witnesses) {
+  const list = witnesses || [];
+  if (list.length === 0) return "";
+  const cards = list.map(
+    (w, idx) => `
+            <div class="witness-card">
+              <div class="sig-line"><span class="esign-anchor">/wit_${idx + 1}/</span></div>
+              <div class="witness-name">${escapeHtml(w.fullName)}</div>
+              <div class="witness-meta">
+                ${w.role ? `<span>${escapeHtml(w.role)}</span>` : ""}
+                ${w.documentIdMasked ? `<span>ID: ${escapeHtml(w.documentIdMasked)}</span>` : ""}
+              </div>
+            </div>`
+  ).join("");
+  return `
+      <div class="witness-section">
+        <div class="witness-heading">Official Witnesses</div>
+        <div class="witness-grid">${cards}
+        </div>
+      </div>`;
+}
+function renderOptionalHtmlFragments(certificate, template, secondaryFormattedList) {
+  return {
+    statusBanner: certificate.status !== "issued" ? `<div class="watermark-alert">STATUS: ${escapeHtml(certificate.status.toUpperCase())}</div>` : "",
+    headerHtml: template.headerText ? `<div class="header-Invocation">${escapeHtml(template.headerText)}</div>` : "",
+    subheaderHtml: template.organizationSubheader ? `<div class="org-subheader">${escapeHtml(template.organizationSubheader)}</div>` : "",
+    chosenNameHtml: certificate.recipientChosenName ? `<div class="recipient-chosen">Chosen Name / Title: ${escapeHtml(certificate.recipientChosenName)}</div>` : "",
+    secondaryDateHtml: secondaryFormattedList ? `<span><strong>Secondary Calendar:</strong> ${escapeHtml(secondaryFormattedList)}</span>` : "",
+    nationalIdHtml: certificate.nationalIdMasked ? `<span><strong>Document ID:</strong> ${escapeHtml(certificate.nationalIdMasked)}</span>` : "",
+    esignLineHtml: certificate.esignEnvelopeId ? `<div>E-Sign Envelope (${escapeHtml(certificate.esignProvider || "docusign")}): ${escapeHtml(certificate.esignEnvelopeId)} [${escapeHtml(certificate.esignEnvelopeStatus || "sent")}]</div>` : ""
+  };
+}
+function renderPrintableCertificateHtml(params) {
+  const { certificate, template, verificationUrl } = params;
+  const accent = sanitizeHexColor(template.accentColor, "#14532d");
+  const issuedDateFormatted = certificate.issuedAt.slice(0, 10);
+  const secondaryFormattedList = Object.values(certificate.secondaryDates || {}).map((d) => `${d.label}: ${d.formatted}`).join(" • ");
+  const variables = buildTemplateVariables(
+    certificate,
+    template,
+    issuedDateFormatted,
+    secondaryFormattedList
+  );
+  const renderedBody = interpolateBodyTemplate(
+    template.bodyTemplate,
+    variables
+  );
+  const matrixSvg = renderVerificationMatrixSvg(
+    `${certificate.serialNumber}:${certificate.cryptographicSignature}`,
+    accent
+  );
+  const signatoriesHtml = renderSignatoriesHtml(certificate.signatories);
+  const witnessesHtml = renderWitnessesHtml(certificate.witnesses);
+  const fragments = renderOptionalHtmlFragments(
+    certificate,
+    template,
+    secondaryFormattedList
+  );
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(template.titleText)} — ${escapeHtml(certificate.serialNumber)}</title>
+  <style>
+    @page { size: A4 landscape; margin: 12mm; }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      padding: 24px;
+      font-family: Georgia, "Times New Roman", serif;
+      background: #f8fafc;
+      color: #0f172a;
+    }
+    .certificate-frame {
+      max-width: 1020px;
+      margin: 0 auto;
+      background: #ffffff;
+      border: 3px solid ${accent};
+      padding: 10px;
+      box-shadow: 0 10px 25px rgba(15, 23, 42, 0.08);
+      position: relative;
+    }
+    .certificate-inner {
+      border: 1px solid ${accent};
+      padding: 36px 48px;
+      position: relative;
+    }
+    .watermark-alert {
+      background: #fef2f2;
+      color: #991b1b;
+      border: 2px solid #dc2626;
+      padding: 8px 16px;
+      text-align: center;
+      font-weight: bold;
+      letter-spacing: 0.1em;
+      margin-bottom: 16px;
+    }
+    .header-Invocation {
+      text-align: center;
+      font-size: 20px;
+      color: ${accent};
+      margin-bottom: 8px;
+      font-weight: 600;
+    }
+    .org-name {
+      text-align: center;
+      font-size: 24px;
+      font-weight: 700;
+      letter-spacing: 0.06em;
+      text-transform: uppercase;
+      color: #0f172a;
+    }
+    .org-subheader {
+      text-align: center;
+      font-size: 13px;
+      color: #475569;
+      margin-top: 4px;
+      margin-bottom: 24px;
+    }
+    .cert-title {
+      text-align: center;
+      font-size: 30px;
+      color: ${accent};
+      margin: 18px 0 24px;
+      font-weight: 700;
+      border-bottom: 2px solid ${accent};
+      display: inline-block;
+      padding-bottom: 6px;
+    }
+    .title-wrap { text-align: center; }
+    .recipient-banner {
+      text-align: center;
+      margin: 16px 0 20px;
+    }
+    .recipient-name {
+      font-size: 28px;
+      font-weight: 700;
+      color: #0f172a;
+    }
+    .recipient-chosen {
+      font-size: 18px;
+      color: ${accent};
+      margin-top: 4px;
+      font-style: italic;
+    }
+    .cert-body {
+      font-size: 16px;
+      line-height: 1.75;
+      text-align: center;
+      max-width: 820px;
+      margin: 0 auto 28px;
+      color: #1e293b;
+    }
+    .dates-bar {
+      display: flex;
+      justify-content: center;
+      gap: 28px;
+      font-size: 13px;
+      color: #334155;
+      margin-bottom: 28px;
+      flex-wrap: wrap;
+    }
+    .sig-row {
+      display: flex;
+      justify-content: space-around;
+      gap: 24px;
+      margin-top: 32px;
+      margin-bottom: 24px;
+      flex-wrap: wrap;
+    }
+    .sig-block {
+      min-width: 200px;
+      text-align: center;
+    }
+    .sig-line {
+      border-bottom: 1px solid #334155;
+      height: 36px;
+      margin-bottom: 8px;
+    }
+    .esign-anchor {
+      color: #ffffff;
+      font-size: 1px;
+      line-height: 1px;
+      opacity: 0.01;
+      user-select: none;
+    }
+    .sig-name { font-weight: 700; font-size: 15px; }
+    .sig-title { font-size: 13px; color: #475569; }
+    .sig-role { font-size: 12px; color: ${accent}; }
+    .witness-section {
+      border-top: 1px dashed #cbd5e1;
+      padding-top: 14px;
+      margin-top: 16px;
+      margin-bottom: 20px;
+    }
+    .witness-heading {
+      text-align: center;
+      font-size: 12px;
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+      color: #64748b;
+      margin-bottom: 10px;
+    }
+    .witness-grid {
+      display: flex;
+      justify-content: center;
+      gap: 24px;
+      flex-wrap: wrap;
+    }
+    .witness-card {
+      font-size: 13px;
+      text-align: center;
+      padding: 6px 14px;
+      background: #f8fafc;
+      border-radius: 6px;
+      border: 1px solid #e2e8f0;
+    }
+    .witness-name { font-weight: 600; }
+    .witness-meta { font-size: 11px; color: #64748b; display: flex; gap: 8px; justify-content: center; }
+    .crypto-footer {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      border-top: 2px solid #e2e8f0;
+      padding-top: 16px;
+      margin-top: 16px;
+      gap: 16px;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 11px;
+      color: #475569;
+    }
+    .crypto-details { line-height: 1.5; }
+    @media print {
+      body { background: #ffffff; padding: 0; }
+      .certificate-frame { box-shadow: none; }
+    }
+  </style>
+</head>
+<body>
+  <div class="certificate-frame">
+    <div class="certificate-inner">
+      ${fragments.statusBanner}
+      ${fragments.headerHtml}
+      <div class="org-name">${escapeHtml(template.organizationName)}</div>
+      ${fragments.subheaderHtml}
+      <div class="title-wrap">
+        <div class="cert-title">${escapeHtml(template.titleText)}</div>
+      </div>
+      <div class="recipient-banner">
+        <div class="recipient-name">${escapeHtml(certificate.recipientFullName)}</div>
+        ${fragments.chosenNameHtml}
+      </div>
+      <div class="cert-body">${renderedBody}</div>
+      <div class="dates-bar">
+        <span><strong>Serial No:</strong> ${escapeHtml(certificate.serialNumber)}</span>
+        <span><strong>Issued Date:</strong> ${escapeHtml(issuedDateFormatted)}</span>
+        ${fragments.secondaryDateHtml}
+        ${fragments.nationalIdHtml}
+      </div>
+      <div class="sig-row">${signatoriesHtml}</div>
+      ${witnessesHtml}
+      <div class="crypto-footer">
+        <div class="crypto-details">
+          <div><strong>CRYPTOGRAPHICALLY SIGNED RECORD (Ed25519)</strong></div>
+          <div>Serial: ${escapeHtml(certificate.serialNumber)} | Key Fingerprint: ${escapeHtml(certificate.publicKeyFingerprint)}</div>
+          <div>Payload SHA-256: ${escapeHtml(certificate.canonicalPayloadHash.slice(0, 32))}...</div>
+          <div>Signature (Ed25519): ${escapeHtml(certificate.cryptographicSignature.slice(0, 40))}...</div>
+          ${fragments.esignLineHtml}
+          <div>Verify Online: ${escapeHtml(verificationUrl)}</div>
+        </div>
+        <div>${matrixSvg}</div>
+      </div>
+    </div>
+  </div>
+</body>
+</html>`;
+}
+function escapeCsvCell(value) {
+  let str = String(value ?? "").replace(/\r?\n/g, " ").trim();
+  if (/^[=+\-@\t\r]/.test(str)) {
+    str = `'${str}`;
+  }
+  if (str.includes(",") || str.includes('"') || str.includes("'")) {
+    return `"${str.replace(/"/g, '""')}"`;
+  }
+  return str;
+}
+function exportCertificatesToCsv(records) {
+  const headers = [
+    "Serial Number",
+    "Template",
+    "Status",
+    "Recipient Full Name",
+    "Chosen Name / Title",
+    "Masked ID",
+    "Issued At",
+    "Expires At",
+    "Signatories",
+    "Witnesses Count",
+    "Key Fingerprint"
+  ];
+  const rows = records.map((r) => [
+    escapeCsvCell(r.serialNumber),
+    escapeCsvCell(r.templateName || r.templateSlug),
+    escapeCsvCell(r.status),
+    escapeCsvCell(r.recipientFullName),
+    escapeCsvCell(r.recipientChosenName || ""),
+    escapeCsvCell(r.nationalIdMasked || ""),
+    escapeCsvCell(r.issuedAt),
+    escapeCsvCell(r.expiresAt || ""),
+    escapeCsvCell((r.signatories || []).map((s) => s.name).join("; ")),
+    escapeCsvCell((r.witnesses || []).length),
+    escapeCsvCell(r.publicKeyFingerprint)
+  ]);
+  return [headers.join(","), ...rows.map((row) => row.join(","))].join("\n");
+}
+const bootstrap = async ({ strapi }) => {
+  const actions = [
+    {
+      section: "plugins",
+      displayName: "Access the Certificates Registry",
+      uid: "read",
+      pluginName: PLUGIN_ID
+    },
+    {
+      section: "plugins",
+      displayName: "Issue, Approve, and Revoke Certificates",
+      uid: "issue",
+      pluginName: PLUGIN_ID
+    },
+    {
+      section: "plugins",
+      displayName: "Manage Certificate Templates & Signing Keys",
+      uid: "settings",
+      pluginName: PLUGIN_ID
+    }
+  ];
+  await strapi.admin?.services?.permission?.actionProvider?.registerMany(
+    actions
+  );
+  const settingsService = strapi.plugin(PLUGIN_ID).service("settings");
+  const keyPair = await settingsService.getSigningKeyPair();
+  const issuanceService = strapi.plugin(PLUGIN_ID).service("issuance");
+  const seeded = await issuanceService.seedDefaultTemplates();
+  strapi.log.info(
+    `[${PLUGIN_ID}] Bootstrapped with Ed25519 key fingerprint ${keyPair.fingerprint} (seeded ${seeded} default template(s))`
+  );
+};
+const kind$1 = "collectionType";
+const collectionName$1 = "certificates_records";
+const info$1 = { "singularName": "certificate", "pluralName": "certificates", "displayName": "Issued Certificate", "description": "Cryptographically signed official certificate record with signatory and witness attestation" };
+const options$1 = { "draftAndPublish": false };
+const pluginOptions$1 = { "content-manager": { "visible": true }, "content-type-builder": { "visible": true } };
+const attributes$1 = { "serialNumber": { "type": "string", "required": true, "unique": true, "maxLength": 64 }, "templateDocumentId": { "type": "string", "required": true, "maxLength": 120 }, "templateSlug": { "type": "string", "required": true, "maxLength": 120 }, "templateName": { "type": "string", "required": true, "maxLength": 160 }, "status": { "type": "enumeration", "enum": ["pending_approval", "issued", "revoked", "expired"], "default": "pending_approval", "required": true }, "recipientFullName": { "type": "string", "required": true, "maxLength": 200 }, "recipientChosenName": { "type": "string", "maxLength": 200 }, "recipientEmail": { "type": "email" }, "recipientPhone": { "type": "string", "maxLength": 64 }, "recipientNationality": { "type": "string", "maxLength": 120 }, "nationalIdMasked": { "type": "string", "maxLength": 32 }, "nationalIdHash": { "type": "string", "private": true, "maxLength": 128 }, "issuedAt": { "type": "string", "required": true, "maxLength": 40 }, "expiresAt": { "type": "string", "maxLength": 40 }, "revokedAt": { "type": "string", "maxLength": 40 }, "revocationReason": { "type": "text" }, "signatories": { "type": "json", "default": [] }, "witnesses": { "type": "json", "default": [] }, "customData": { "type": "json", "default": {} }, "secondaryDates": { "type": "json", "default": {} }, "canonicalPayloadHash": { "type": "string", "required": true, "maxLength": 128 }, "cryptographicSignature": { "type": "text", "required": true }, "publicKeyFingerprint": { "type": "string", "required": true, "maxLength": 96 }, "verificationToken": { "type": "string", "private": true, "maxLength": 128 }, "esignProvider": { "type": "enumeration", "enum": ["none", "docusign", "webhook"], "default": "none" }, "esignEnvelopeId": { "type": "string", "maxLength": 128 }, "esignEnvelopeStatus": { "type": "enumeration", "enum": ["not_sent", "sent", "delivered", "completed", "declined", "voided"], "default": "not_sent" }, "esignCompletedAt": { "type": "string", "maxLength": 40 }, "linkedBookingCode": { "type": "string", "maxLength": 64 }, "notes": { "type": "text" } };
+const certificateSchema = {
+  kind: kind$1,
+  collectionName: collectionName$1,
+  info: info$1,
+  options: options$1,
+  pluginOptions: pluginOptions$1,
+  attributes: attributes$1
+};
+const kind = "collectionType";
+const collectionName = "certificates_templates";
+const info = { "singularName": "template", "pluralName": "templates", "displayName": "Certificate Template", "description": "Reusable official certificate template with signatory rules, witness requirements, and body statement" };
+const options = { "draftAndPublish": false };
+const pluginOptions = { "content-manager": { "visible": true }, "content-type-builder": { "visible": true } };
+const attributes = { "name": { "type": "string", "required": true, "maxLength": 160 }, "slug": { "type": "uid", "targetField": "name", "required": true }, "description": { "type": "text" }, "serialPrefix": { "type": "string", "required": true, "default": "CERT", "maxLength": 8 }, "defaultValidityDays": { "type": "integer", "min": 0 }, "requiresWitnesses": { "type": "boolean", "default": false }, "minWitnesses": { "type": "integer", "default": 0, "min": 0, "max": 10 }, "requiresApproval": { "type": "boolean", "default": true }, "esignEnabled": { "type": "boolean", "default": false }, "esignProvider": { "type": "enumeration", "enum": ["none", "docusign", "webhook"], "default": "none" }, "organizationName": { "type": "string", "required": true, "maxLength": 200 }, "organizationSubheader": { "type": "string", "maxLength": 240 }, "headerText": { "type": "string", "maxLength": 240 }, "titleText": { "type": "string", "required": true, "maxLength": 200 }, "bodyTemplate": { "type": "text", "required": true }, "footerText": { "type": "text" }, "defaultSignatories": { "type": "json", "default": [] }, "customFieldsSchema": { "type": "json", "default": [] }, "secondaryCalendars": { "type": "json", "default": [] }, "accentColor": { "type": "string", "default": "#14532d", "maxLength": 16 }, "active": { "type": "boolean", "default": true } };
+const templateSchema = {
+  kind,
+  collectionName,
+  info,
+  options,
+  pluginOptions,
+  attributes
+};
+const contentTypes = {
+  template: { schema: templateSchema },
+  certificate: { schema: certificateSchema }
+};
+const admin$1 = ({ strapi }) => {
+  const getSettings = () => strapi.plugin(PLUGIN_ID).service("settings");
+  const getIssuance = () => strapi.plugin(PLUGIN_ID).service("issuance");
+  const getDocuSign = () => strapi.plugin(PLUGIN_ID).service("docusign");
+  return {
+    async getSettings(ctx) {
+      const data = await getSettings().getSettings();
+      ctx.body = { data };
+    },
+    async updateSettings(ctx) {
+      const payload = ctx.request.body || {};
+      const data = await getSettings().updateSettings(payload);
+      ctx.body = { data };
+    },
+    async rotateKeys(ctx) {
+      const data = await getSettings().rotateKeyPair();
+      ctx.body = { data };
+    },
+    async listTemplates(ctx) {
+      const data = await getIssuance().listTemplates(false);
+      ctx.body = { data };
+    },
+    async createTemplate(ctx) {
+      try {
+        const payload = ctx.request.body || {};
+        const data = await getIssuance().createTemplate(payload);
+        ctx.body = { data };
+      } catch (err) {
+        return ctx.badRequest(
+          err.message || "Failed to create template"
+        );
+      }
+    },
+    async seedTemplates(ctx) {
+      const seededCount = await getIssuance().seedDefaultTemplates();
+      const templates = await getIssuance().listTemplates(false);
+      ctx.body = { data: { seededCount, templates } };
+    },
+    async listCertificates(ctx) {
+      const { status, templateSlug, search } = ctx.query;
+      const result = await getIssuance().listCertificates({
+        status,
+        templateSlug,
+        search
+      });
+      ctx.body = { data: result.records, meta: { stats: result.stats } };
+    },
+    async issueCertificate(ctx) {
+      try {
+        const body = ctx.request.body || {};
+        const autoApprove = body.sendViaESign === true ? false : body.autoApprove !== false;
+        let data = await getIssuance().issueCertificate({
+          ...body,
+          autoApprove
+        });
+        if (body.sendViaESign === true) {
+          const sent = await getDocuSign().sendEnvelopeForCertificate(
+            data.documentId
+          );
+          data = sent.certificate;
+        }
+        ctx.body = { data };
+      } catch (err) {
+        return ctx.badRequest(
+          err.message || "Failed to issue certificate"
+        );
+      }
+    },
+    async sendDocuSignEnvelope(ctx) {
+      const documentId = ctx.params.documentId;
+      if (!documentId) {
+        return ctx.badRequest("documentId is required");
+      }
+      try {
+        const result = await getDocuSign().sendEnvelopeForCertificate(documentId);
+        ctx.body = { data: result };
+      } catch (err) {
+        return ctx.badRequest(
+          err.message || "Failed to dispatch DocuSign envelope"
+        );
+      }
+    },
+    async approveCertificate(ctx) {
+      const documentId = ctx.params.documentId;
+      if (!documentId) {
+        return ctx.badRequest("documentId is required");
+      }
+      try {
+        const body = ctx.request.body || {};
+        const data = await getIssuance().approveCertificate(documentId, body);
+        ctx.body = { data };
+      } catch (err) {
+        return ctx.badRequest(
+          err.message || "Failed to approve certificate"
+        );
+      }
+    },
+    async revokeCertificate(ctx) {
+      const documentId = ctx.params.documentId;
+      if (!documentId) {
+        return ctx.badRequest("documentId is required");
+      }
+      try {
+        const reason = String(
+          (ctx.request.body || {}).reason || "Revoked by administrator"
+        );
+        const data = await getIssuance().revokeCertificate(documentId, reason);
+        ctx.body = { data };
+      } catch (err) {
+        return ctx.badRequest(
+          err.message || "Failed to revoke certificate"
+        );
+      }
+    },
+    async printCertificate(ctx) {
+      const documentId = ctx.params.documentId;
+      if (!documentId) {
+        return ctx.badRequest("documentId is required");
+      }
+      const rendered = await getIssuance().renderCertificateDocument(
+        { documentId },
+        { isAdmin: true }
+      );
+      if (!rendered) {
+        return ctx.notFound("Certificate not found");
+      }
+      ctx.set("Content-Type", "text/html; charset=utf-8");
+      ctx.set(
+        "Content-Security-Policy",
+        "default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:;"
+      );
+      ctx.set("X-Content-Type-Options", "nosniff");
+      ctx.set("X-Frame-Options", "SAMEORIGIN");
+      ctx.set("Cache-Control", "no-store");
+      ctx.body = rendered.html;
+    },
+    async exportCsv(ctx) {
+      const { status, templateSlug } = ctx.query;
+      const csv = await getIssuance().exportCsv({ status, templateSlug });
+      ctx.set("Content-Type", "text/csv; charset=utf-8");
+      ctx.set(
+        "Content-Disposition",
+        'attachment; filename="certificates-registry.csv"'
+      );
+      ctx.set("X-Content-Type-Options", "nosniff");
+      ctx.set("Cache-Control", "no-store");
+      ctx.body = csv;
+    }
+  };
+};
+const rateLimitStore = /* @__PURE__ */ new Map();
+function checkRateLimit(key, maxRequests = 20, windowMs = 6e4) {
+  const now = Date.now();
+  const existing = rateLimitStore.get(key) || [];
+  const recent = existing.filter((ts) => now - ts < windowMs);
+  if (recent.length >= maxRequests) {
+    rateLimitStore.set(key, recent);
+    return false;
+  }
+  recent.push(now);
+  rateLimitStore.set(key, recent);
+  return true;
+}
+function normalizeSignatories(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.filter(
+    (item) => Boolean(item && typeof item === "object")
+  ).map((item) => ({
+    name: String(item.name || "").trim(),
+    title: String(item.title || "").trim(),
+    role: item.role ? String(item.role).trim() : void 0,
+    email: item.email ? String(item.email).trim() : void 0,
+    routingOrder: typeof item.routingOrder === "number" && Number.isFinite(item.routingOrder) ? Math.max(1, Math.trunc(item.routingOrder)) : void 0,
+    signatureImageUrl: item.signatureImageUrl ? String(item.signatureImageUrl).trim() : void 0,
+    signedAt: item.signedAt ? String(item.signedAt).trim() : void 0
+  })).filter((s) => Boolean(s.name && s.title));
+}
+function normalizeWitnesses(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.filter(
+    (item) => Boolean(item && typeof item === "object")
+  ).map((item) => {
+    const rawDocId = item.documentIdRaw ? String(item.documentIdRaw) : void 0;
+    const maskedDocId = item.documentIdMasked ? String(item.documentIdMasked).trim() : rawDocId ? maskNationalId(rawDocId) : void 0;
+    return {
+      fullName: String(item.fullName || "").trim(),
+      documentIdMasked: maskedDocId,
+      role: item.role ? String(item.role).trim() : void 0,
+      email: item.email ? String(item.email).trim() : void 0,
+      routingOrder: typeof item.routingOrder === "number" && Number.isFinite(item.routingOrder) ? Math.max(1, Math.trunc(item.routingOrder)) : void 0,
+      signedAt: item.signedAt ? String(item.signedAt).trim() : void 0
+    };
+  }).filter((w) => Boolean(w.fullName));
+}
+function asStr(val, fallback = "") {
+  return val ? String(val) : fallback;
+}
+function asOptStr(val) {
+  return val ? String(val) : void 0;
+}
+function asNullStr(val) {
+  return val ? String(val) : null;
+}
+function asArr(val, fallback = []) {
+  return Array.isArray(val) ? val : fallback;
+}
+function asObj(val) {
+  return val && typeof val === "object" ? val : {};
+}
+function asEsignProvider(val) {
+  const raw = asStr(val, "none");
+  return raw === "docusign" || raw === "webhook" ? raw : "none";
+}
+function asNonNegativeInt(val, fallback = 0) {
+  return typeof val === "number" && Number.isFinite(val) ? Math.max(0, Math.trunc(val)) : fallback;
+}
+function normalizeTemplateRecord(doc) {
+  return {
+    id: doc.id,
+    documentId: asStr(doc.documentId, asStr(doc.id)),
+    name: asStr(doc.name),
+    slug: asStr(doc.slug),
+    description: asOptStr(doc.description),
+    serialPrefix: asStr(doc.serialPrefix, "CERT"),
+    defaultValidityDays: typeof doc.defaultValidityDays === "number" ? doc.defaultValidityDays : null,
+    requiresWitnesses: Boolean(doc.requiresWitnesses),
+    minWitnesses: asNonNegativeInt(doc.minWitnesses, 0),
+    requiresApproval: doc.requiresApproval !== false,
+    esignEnabled: Boolean(doc.esignEnabled),
+    esignProvider: asEsignProvider(doc.esignProvider),
+    organizationName: asStr(doc.organizationName),
+    organizationSubheader: asOptStr(doc.organizationSubheader),
+    headerText: asOptStr(doc.headerText),
+    titleText: asStr(doc.titleText),
+    bodyTemplate: asStr(doc.bodyTemplate),
+    footerText: asOptStr(doc.footerText),
+    defaultSignatories: normalizeSignatories(doc.defaultSignatories),
+    customFieldsSchema: asArr(doc.customFieldsSchema),
+    secondaryCalendars: asArr(doc.secondaryCalendars),
+    accentColor: asStr(doc.accentColor, "#14532d"),
+    active: doc.active !== false
+  };
+}
+function normalizeCertificateRecord(doc, includePrivate = false) {
+  const record = {
+    id: doc.id,
+    documentId: asStr(doc.documentId, asStr(doc.id)),
+    serialNumber: asStr(doc.serialNumber),
+    templateDocumentId: asStr(doc.templateDocumentId),
+    templateSlug: asStr(doc.templateSlug),
+    templateName: asStr(doc.templateName),
+    status: asStr(doc.status, "pending_approval"),
+    recipientFullName: asStr(doc.recipientFullName),
+    recipientChosenName: asOptStr(doc.recipientChosenName),
+    recipientEmail: asOptStr(doc.recipientEmail),
+    recipientPhone: asOptStr(doc.recipientPhone),
+    recipientNationality: asOptStr(doc.recipientNationality),
+    nationalIdMasked: asOptStr(doc.nationalIdMasked),
+    issuedAt: asStr(doc.issuedAt),
+    expiresAt: asNullStr(doc.expiresAt),
+    revokedAt: asNullStr(doc.revokedAt),
+    revocationReason: asNullStr(doc.revocationReason),
+    signatories: normalizeSignatories(doc.signatories),
+    witnesses: normalizeWitnesses(doc.witnesses),
+    customData: asObj(doc.customData),
+    secondaryDates: asObj(
+      doc.secondaryDates
+    ),
+    canonicalPayloadHash: asStr(doc.canonicalPayloadHash),
+    cryptographicSignature: asStr(doc.cryptographicSignature),
+    publicKeyFingerprint: asStr(doc.publicKeyFingerprint),
+    esignProvider: asEsignProvider(doc.esignProvider),
+    esignEnvelopeId: asOptStr(doc.esignEnvelopeId),
+    esignEnvelopeStatus: asStr(
+      doc.esignEnvelopeStatus,
+      "not_sent"
+    ),
+    esignCompletedAt: asNullStr(doc.esignCompletedAt),
+    linkedBookingCode: asOptStr(doc.linkedBookingCode),
+    notes: asOptStr(doc.notes)
+  };
+  if (includePrivate) {
+    record.nationalIdHash = asOptStr(doc.nationalIdHash);
+    record.verificationToken = asOptStr(doc.verificationToken);
+  }
+  return record;
+}
+function buildCanonicalPayload(params) {
+  return {
+    version: "1.0",
+    serialNumber: params.serialNumber,
+    templateSlug: params.templateSlug,
+    organizationName: params.organizationName,
+    recipientFullName: params.recipientFullName,
+    recipientChosenName: params.recipientChosenName || "",
+    nationalIdHash: params.nationalIdHash || "",
+    issuedAt: params.issuedAt,
+    expiresAt: params.expiresAt || "",
+    signatories: (params.signatories || []).map((s) => ({
+      name: s.name,
+      title: s.title
+    })),
+    witnesses: (params.witnesses || []).map((w) => ({
+      fullName: w.fullName,
+      role: w.role || "Witness"
+    }))
+  };
+}
+function evaluateCertificateVerification(params) {
+  const { cert, template, settings: settings2, options: options2 } = params;
+  const organizationName = template?.organizationName || settings2.organizationName;
+  const canonicalPayload = buildCanonicalPayload({
+    serialNumber: cert.serialNumber,
+    templateSlug: cert.templateSlug,
+    organizationName,
+    recipientFullName: cert.recipientFullName,
+    recipientChosenName: cert.recipientChosenName,
+    nationalIdHash: cert.nationalIdHash,
+    issuedAt: cert.issuedAt,
+    expiresAt: cert.expiresAt,
+    signatories: cert.signatories,
+    witnesses: cert.witnesses
+  });
+  const cryptographicallyVerified = verifyCanonicalPayloadSignature(
+    canonicalPayload,
+    cert.cryptographicSignature,
+    settings2.publicKeyPem
+  );
+  let effectiveStatus = cert.status;
+  if (effectiveStatus === "issued" && cert.expiresAt && new Date(cert.expiresAt).getTime() < Date.now()) {
+    effectiveStatus = "expired";
+  }
+  const isTokenValid = verifyTokenConstantTime(
+    options2?.token,
+    cert.verificationToken
+  );
+  const isUnmasked = isTokenValid || !settings2.maskPublicRecipientName;
+  const nationalIdMatches = options2?.nationalId ? verifyNationalIdHash(
+    options2.nationalId,
+    cert.serialNumber,
+    cert.nationalIdHash
+  ) : void 0;
+  return {
+    valid: effectiveStatus === "issued" && cryptographicallyVerified,
+    cryptographicallyVerified,
+    status: effectiveStatus,
+    serialNumber: cert.serialNumber,
+    templateSlug: cert.templateSlug,
+    templateName: cert.templateName,
+    organizationName,
+    recipientNameDisplay: isUnmasked ? cert.recipientFullName : maskRecipientName(cert.recipientFullName),
+    recipientChosenName: cert.recipientChosenName,
+    nationalIdMasked: cert.nationalIdMasked,
+    nationalIdMatches,
+    issuedAt: cert.issuedAt,
+    expiresAt: cert.expiresAt,
+    revokedAt: cert.revokedAt,
+    revocationReason: cert.revocationReason,
+    secondaryDates: cert.secondaryDates,
+    signatories: cert.signatories,
+    witnesses: cert.witnesses.map((w) => ({
+      fullName: isUnmasked ? w.fullName : maskRecipientName(w.fullName),
+      role: w.role
+    })),
+    canonicalPayloadHash: cert.canonicalPayloadHash,
+    cryptographicSignature: cert.cryptographicSignature,
+    publicKeyFingerprint: cert.publicKeyFingerprint,
+    publicKeyPem: settings2.publicKeyPem,
+    esignProvider: cert.esignProvider,
+    esignEnvelopeId: cert.esignEnvelopeId,
+    esignEnvelopeStatus: cert.esignEnvelopeStatus,
+    esignCompletedAt: cert.esignCompletedAt,
+    isUnmasked,
+    verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function renderPrintableFromRecord(params) {
+  const { cert, template, settings: settings2, options: options2 } = params;
+  if (!options2?.isAdmin) {
+    const tokenOk = verifyTokenConstantTime(
+      options2?.token,
+      cert.verificationToken
+    );
+    if (!tokenOk) {
+      throw new Error("Valid verificationToken required to print certificate");
+    }
+  }
+  const effectiveTemplate = template || {
+    documentId: "fallback",
+    name: cert.templateName,
+    slug: cert.templateSlug,
+    serialPrefix: "CERT",
+    requiresWitnesses: false,
+    minWitnesses: 0,
+    requiresApproval: false,
+    organizationName: settings2.organizationName,
+    organizationSubheader: settings2.organizationSubheader,
+    titleText: cert.templateName,
+    bodyTemplate: "This is to certify that {{recipientFullName}} has been officially attested by {{organizationName}} on {{issuedDateFormatted}}.",
+    defaultSignatories: cert.signatories,
+    active: true
+  };
+  const verificationUrl = `${settings2.verificationBaseUrl}/${encodeURIComponent(
+    cert.serialNumber
+  )}`;
+  const html = renderPrintableCertificateHtml({
+    certificate: cert,
+    template: effectiveTemplate,
+    verificationUrl
+  });
+  return { html, serialNumber: cert.serialNumber };
+}
+function filterAndComputeCertificateStats(allRecords, filters) {
+  const stats = {
+    total: allRecords.length,
+    issued: allRecords.filter((r) => r.status === "issued").length,
+    pending_approval: allRecords.filter((r) => r.status === "pending_approval").length,
+    revoked: allRecords.filter((r) => r.status === "revoked").length,
+    expired: allRecords.filter((r) => r.status === "expired").length
+  };
+  const records = allRecords.filter((r) => {
+    if (filters?.status && r.status !== filters.status) return false;
+    if (filters?.templateSlug && r.templateSlug !== filters.templateSlug) {
+      return false;
+    }
+    if (filters?.search) {
+      const q = filters.search.toLowerCase();
+      const hay = [
+        r.serialNumber,
+        r.recipientFullName,
+        r.recipientChosenName || "",
+        r.recipientEmail || ""
+      ].join(" ").toLowerCase();
+      if (!hay.includes(q)) return false;
+    }
+    return true;
+  });
+  return { records, stats };
+}
+const contentApi$1 = ({ strapi }) => {
+  const getSettings = () => strapi.plugin(PLUGIN_ID).service("settings");
+  const getIssuance = () => strapi.plugin(PLUGIN_ID).service("issuance");
+  const getDocuSign = () => strapi.plugin(PLUGIN_ID).service("docusign");
+  return {
+    async listPublicTemplates(ctx) {
+      const templates = await getIssuance().listTemplates(true);
+      const sanitized = templates.map((t) => ({
+        documentId: t.documentId,
+        name: t.name,
+        slug: t.slug,
+        description: t.description,
+        requiresWitnesses: t.requiresWitnesses,
+        minWitnesses: t.minWitnesses,
+        organizationName: t.organizationName,
+        titleText: t.titleText,
+        customFieldsSchema: t.customFieldsSchema || []
+      }));
+      ctx.body = { data: sanitized };
+    },
+    async getPublicKey(ctx) {
+      const settings2 = await getSettings().getSettings();
+      ctx.body = {
+        data: {
+          organizationName: settings2.organizationName,
+          algorithm: "Ed25519",
+          publicKeyFingerprint: settings2.publicKeyFingerprint,
+          publicKeyPem: settings2.publicKeyPem
+        }
+      };
+    },
+    async applyCertificate(ctx) {
+      const ipKey = `apply:${ctx.ip || "unknown"}`;
+      if (!checkRateLimit(ipKey, 10, 6e4)) {
+        ctx.status = 429;
+        ctx.body = {
+          error: { message: "Too many certificate requests. Please wait." }
+        };
+        return;
+      }
+      const settings2 = await getSettings().getSettings();
+      if (!settings2.allowPublicApplications) {
+        return ctx.forbidden("Public certificate applications are disabled");
+      }
+      try {
+        const body = ctx.request.body || {};
+        const created = await getIssuance().issueCertificate({
+          ...body,
+          autoApprove: false
+        });
+        ctx.body = {
+          data: {
+            serialNumber: created.serialNumber,
+            status: created.status,
+            templateSlug: created.templateSlug,
+            templateName: created.templateName,
+            recipientFullName: created.recipientFullName,
+            recipientChosenName: created.recipientChosenName,
+            issuedAt: created.issuedAt,
+            verificationToken: created.verificationToken
+          }
+        };
+      } catch (err) {
+        return ctx.badRequest(
+          err.message || "Invalid certificate application"
+        );
+      }
+    },
+    async verifyBySerial(ctx) {
+      const ipKey = `verify:${ctx.ip || "unknown"}`;
+      if (!checkRateLimit(ipKey, 30, 6e4)) {
+        ctx.status = 429;
+        ctx.body = {
+          error: { message: "Rate limit exceeded for verification." }
+        };
+        return;
+      }
+      const serial = ctx.params.serial;
+      if (!serial) {
+        return ctx.badRequest("Certificate serial number is required");
+      }
+      const result = await getIssuance().verifyCertificateBySerial(serial, {
+        token: ctx.query.token,
+        nationalId: ctx.query.nationalId
+      });
+      if (!result) {
+        return ctx.notFound(
+          "Certificate serial number not found in official registry"
+        );
+      }
+      ctx.set("Cache-Control", "no-store");
+      ctx.body = { data: result };
+    },
+    async downloadPrintableHtml(ctx) {
+      const serial = ctx.params.serial;
+      const token = ctx.query.token;
+      if (!serial || !token) {
+        return ctx.badRequest(
+          "Both serial and verification token are required"
+        );
+      }
+      try {
+        const rendered = await getIssuance().renderCertificateDocument(
+          { serialNumber: serial },
+          { token, isAdmin: false }
+        );
+        if (!rendered) {
+          return ctx.notFound("Certificate not found");
+        }
+        ctx.set("Content-Type", "text/html; charset=utf-8");
+        ctx.set(
+          "Content-Security-Policy",
+          "default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:;"
+        );
+        ctx.set("X-Content-Type-Options", "nosniff");
+        ctx.set("X-Frame-Options", "SAMEORIGIN");
+        ctx.set("Cache-Control", "no-store");
+        ctx.body = rendered.html;
+      } catch (err) {
+        return ctx.forbidden(
+          err.message || "Invalid verification token"
+        );
+      }
+    },
+    async docusignWebhook(ctx) {
+      const ipKey = `webhook:${ctx.ip || "unknown"}`;
+      if (!checkRateLimit(ipKey, 60, 6e4)) {
+        ctx.status = 429;
+        ctx.body = { error: { message: "Webhook rate limit exceeded." } };
+        return;
+      }
+      const payload = ctx.request.body || {};
+      const rawBody = typeof ctx.request.rawBody === "string" && ctx.request.rawBody ? ctx.request.rawBody : JSON.stringify(payload);
+      const signatureHeader = ctx.headers?.["x-docusign-signature-1"] || ctx.headers?.["X-DocuSign-Signature-1"];
+      try {
+        const result = await getDocuSign().handleWebhookEvent({
+          rawBody,
+          signatureHeader,
+          payload
+        });
+        ctx.body = {
+          data: {
+            envelopeId: result.envelopeId,
+            envelopeStatus: result.envelopeStatus,
+            serialNumber: result.certificate.serialNumber,
+            status: result.certificate.status
+          }
+        };
+      } catch (err) {
+        return ctx.forbidden(
+          err.message || "DocuSign webhook verification failed"
+        );
+      }
+    }
+  };
+};
+const controllers = {
+  admin: admin$1,
+  "content-api": contentApi$1
+};
+function mergeAttributesIntoTarget(target, attrName, attrDef) {
+  if (!target) return;
+  target[attrName] = {
+    ...target[attrName],
+    ...attrDef
+  };
+}
+function applyExtraAttributesToSchema(schema, extraAttributes) {
+  for (const [attrName, attrDef] of Object.entries(extraAttributes)) {
+    if (!attrName || !attrDef || typeof attrDef !== "object") continue;
+    mergeAttributesIntoTarget(schema?.attributes, attrName, attrDef);
+    mergeAttributesIntoTarget(
+      schema?.__schema__?.attributes,
+      attrName,
+      attrDef
+    );
+  }
+}
+const register = ({ strapi }) => {
+  const config = strapi.config?.get?.(`plugin::${PLUGIN_ID}`) ?? {};
+  for (const [targetKey, extraAttributes] of Object.entries(
+    config.schemaExtensions ?? {}
+  )) {
+    if (!extraAttributes || typeof extraAttributes !== "object") continue;
+    const resolvedUid = targetKey.startsWith("plugin::") ? targetKey : `plugin::${PLUGIN_ID}.${targetKey}`;
+    const schema = strapi.contentTypes?.[resolvedUid];
+    applyExtraAttributesToSchema(schema, extraAttributes);
+  }
+  strapi.log.debug(`[${PLUGIN_ID}] Registering official certificates plugin`);
+};
+const admin = {
+  type: "admin",
+  routes: [
+    {
+      method: "GET",
+      path: "/settings",
+      handler: "admin.getSettings",
+      config: { policies: [] }
+    },
+    {
+      method: "PUT",
+      path: "/settings",
+      handler: "admin.updateSettings",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/settings/rotate-keys",
+      handler: "admin.rotateKeys",
+      config: { policies: [] }
+    },
+    {
+      method: "GET",
+      path: "/templates",
+      handler: "admin.listTemplates",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/templates",
+      handler: "admin.createTemplate",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/templates/seed",
+      handler: "admin.seedTemplates",
+      config: { policies: [] }
+    },
+    {
+      method: "GET",
+      path: "/certificates",
+      handler: "admin.listCertificates",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/certificates/issue",
+      handler: "admin.issueCertificate",
+      config: { policies: [] }
+    },
+    {
+      method: "POST",
+      path: "/certificates/:documentId/send-docusign",
+      handler: "admin.sendDocuSignEnvelope",
+      config: { policies: [] }
+    },
+    {
+      method: "PUT",
+      path: "/certificates/:documentId/approve",
+      handler: "admin.approveCertificate",
+      config: { policies: [] }
+    },
+    {
+      method: "PUT",
+      path: "/certificates/:documentId/revoke",
+      handler: "admin.revokeCertificate",
+      config: { policies: [] }
+    },
+    {
+      method: "GET",
+      path: "/certificates/:documentId/print",
+      handler: "admin.printCertificate",
+      config: { policies: [] }
+    },
+    {
+      method: "GET",
+      path: "/certificates/export/csv",
+      handler: "admin.exportCsv",
+      config: { policies: [] }
+    }
+  ]
+};
+const contentApi = {
+  type: "content-api",
+  routes: [
+    {
+      method: "GET",
+      path: "/templates",
+      handler: "content-api.listPublicTemplates",
+      config: { auth: false }
+    },
+    {
+      method: "GET",
+      path: "/public-key",
+      handler: "content-api.getPublicKey",
+      config: { auth: false }
+    },
+    {
+      method: "POST",
+      path: "/apply",
+      handler: "content-api.applyCertificate",
+      config: { auth: false }
+    },
+    {
+      method: "GET",
+      path: "/verify/:serial",
+      handler: "content-api.verifyBySerial",
+      config: { auth: false }
+    },
+    {
+      method: "GET",
+      path: "/verify/:serial/print",
+      handler: "content-api.downloadPrintableHtml",
+      config: { auth: false }
+    },
+    {
+      method: "POST",
+      path: "/webhooks/docusign",
+      handler: "content-api.docusignWebhook",
+      config: { auth: false }
+    }
+  ]
+};
+const routes = {
+  admin,
+  "content-api": contentApi
+};
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) {
+    end -= 1;
+  }
+  return end === value.length ? value : value.slice(0, end);
+}
+const CERTIFICATE_UID$1 = "plugin::certificates.certificate";
+const PRIVATE_HOST_PREFIXES = ["127.", "10.", "192.168.", "169.254."];
+function isPrivateOrLoopbackHost(host) {
+  if (!host || host === "localhost") return true;
+  if (PRIVATE_HOST_PREFIXES.some((prefix) => host.startsWith(prefix))) {
+    return true;
+  }
+  return /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(host);
+}
+function validateDocuSignBaseUrl(rawUrl) {
+  const cleaned = stripTrailingSlashes(String(rawUrl || "").trim());
+  if (!cleaned.startsWith("https://")) {
+    throw new Error("DocuSign baseUrl must use HTTPS");
+  }
+  const withoutScheme = cleaned.slice("https://".length);
+  const host = withoutScheme.split("/")[0].split(":")[0].toLowerCase();
+  if (isPrivateOrLoopbackHost(host)) {
+    throw new Error("DocuSign baseUrl cannot target private or loopback hosts");
+  }
+  const isOfficialDocuSign = host.endsWith(".docusign.net") || host.endsWith(".docusign.com");
+  if (!isOfficialDocuSign) {
+    throw new Error(
+      "DocuSign baseUrl must belong to *.docusign.net or *.docusign.com"
+    );
+  }
+  return cleaned;
+}
+function buildDocuSignEnvelopePayload(params) {
+  const { certificate, htmlDocument, emailSubjectPrefix } = params;
+  const signers = [];
+  let recipientIdSeq = 1;
+  (certificate.witnesses || []).forEach((w, idx) => {
+    if (!w.email) return;
+    signers.push({
+      email: w.email,
+      name: w.fullName,
+      recipientId: String(recipientIdSeq++),
+      routingOrder: String(w.routingOrder ?? 1),
+      roleName: w.role || `Witness ${idx + 1}`,
+      tabs: {
+        signHereTabs: [
+          {
+            anchorString: `/wit_${idx + 1}/`,
+            anchorUnits: "pixels",
+            anchorXOffset: "0",
+            anchorYOffset: "-6"
+          }
+        ]
+      }
+    });
+  });
+  (certificate.signatories || []).forEach((s, idx) => {
+    if (!s.email) return;
+    signers.push({
+      email: s.email,
+      name: s.name,
+      recipientId: String(recipientIdSeq++),
+      routingOrder: String(s.routingOrder ?? 2),
+      roleName: s.role || s.title,
+      tabs: {
+        signHereTabs: [
+          {
+            anchorString: `/sig_${idx + 1}/`,
+            anchorUnits: "pixels",
+            anchorXOffset: "0",
+            anchorYOffset: "-6"
+          }
+        ]
+      }
+    });
+  });
+  if (signers.length === 0) {
+    throw new Error(
+      "At least one signatory or witness must have an email address to send a DocuSign envelope"
+    );
+  }
+  const subjectPrefix = emailSubjectPrefix || "Official Certificate Signature Request";
+  const documentBase64 = Buffer.from(htmlDocument, "utf8").toString("base64");
+  return {
+    emailSubject: `${subjectPrefix} — ${certificate.serialNumber} (${certificate.recipientFullName})`,
+    status: "sent",
+    documents: [
+      {
+        documentBase64,
+        name: `${certificate.serialNumber}.html`,
+        fileExtension: "html",
+        documentId: "1"
+      }
+    ],
+    recipients: { signers },
+    customFields: {
+      textCustomFields: [
+        {
+          name: "serialNumber",
+          value: certificate.serialNumber,
+          show: "false"
+        },
+        {
+          name: "certificateDocumentId",
+          value: certificate.documentId,
+          show: "false"
+        }
+      ]
+    }
+  };
+}
+function resolveDocuSignCredentials(settings2, options2) {
+  if (!settings2.esign?.enabled || settings2.esign.provider !== "docusign") {
+    throw new Error(
+      "DocuSign eSignature provider is not enabled in Certificates settings"
+    );
+  }
+  const safeBaseUrl = validateDocuSignBaseUrl(settings2.esign.baseUrl);
+  const accountId = firstNonEmptyString(
+    settings2.esign.accountId,
+    process.env.DOCUSIGN_ACCOUNT_ID
+  );
+  if (!accountId) {
+    throw new Error("DocuSign accountId is required");
+  }
+  const accessToken = firstNonEmptyString(
+    options2?.accessToken,
+    process.env.DOCUSIGN_ACCESS_TOKEN
+  );
+  if (!accessToken) {
+    throw new Error(
+      "DOCUSIGN_ACCESS_TOKEN environment variable is required to dispatch DocuSign envelopes"
+    );
+  }
+  const fetchFn = options2?.fetchImpl ?? globalThis.fetch;
+  if (!fetchFn) {
+    throw new Error("Fetch implementation unavailable");
+  }
+  return { safeBaseUrl, accountId, accessToken, fetchFn };
+}
+async function dispatchDocuSignEnvelopeRequest(fetchFn, endpoint, accessToken, envelopePayload) {
+  const response = await fetchFn(endpoint, {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${accessToken}`,
+      "Content-Type": "application/json",
+      "Accept": "application/json"
+    },
+    body: JSON.stringify(envelopePayload)
+  });
+  if (!response.ok) {
+    throw new Error(
+      `DocuSign API returned HTTP ${response.status} when creating envelope`
+    );
+  }
+  const responseJson = await response.json();
+  const envelopeId = String(responseJson.envelopeId || "").trim();
+  if (!envelopeId) {
+    throw new Error("DocuSign API did not return an envelopeId");
+  }
+  return envelopeId;
+}
+function asRecord(val, fallback) {
+  return val && typeof val === "object" ? val : fallback;
+}
+const ALLOWED_ENVELOPE_STATUSES = [
+  "sent",
+  "delivered",
+  "completed",
+  "declined",
+  "voided"
+];
+function firstNonEmptyString(...values) {
+  for (const val of values) {
+    if (typeof val === "string" && val.trim().length > 0) {
+      return val.trim();
+    }
+  }
+  return "";
+}
+function parseWebhookEnvelopeInfo(payload) {
+  const dataObj = asRecord(payload.data, payload);
+  const summaryObj = asRecord(dataObj.envelopeSummary, dataObj);
+  const envelopeId = firstNonEmptyString(
+    dataObj.envelopeId,
+    summaryObj.envelopeId,
+    payload.envelopeId
+  );
+  if (!envelopeId) {
+    throw new Error("Missing envelopeId in DocuSign webhook payload");
+  }
+  const rawStatus = firstNonEmptyString(
+    summaryObj.status,
+    payload.status,
+    "sent"
+  ).toLowerCase();
+  const envelopeStatus = ALLOWED_ENVELOPE_STATUSES.includes(rawStatus) ? rawStatus : "sent";
+  return { envelopeId, envelopeStatus };
+}
+const docusign = ({ strapi }) => {
+  const getSettingsService = () => strapi.plugin(PLUGIN_ID).service("settings");
+  const getIssuanceService = () => strapi.plugin(PLUGIN_ID).service("issuance");
+  const completeWebhookEnvelope = async (existing, fallbackDoc, envelopeId) => {
+    const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+    const stampedWitnesses = existing.witnesses.map((w) => ({
+      ...w,
+      signedAt: w.signedAt || nowIso
+    }));
+    const stampedSignatories = existing.signatories.map((s) => ({
+      ...s,
+      signedAt: s.signedAt || nowIso
+    }));
+    await getIssuanceService().approveCertificate(existing.documentId, {
+      witnesses: stampedWitnesses,
+      signatories: stampedSignatories
+    });
+    const updatedCompleted = await strapi.documents(CERTIFICATE_UID$1).update({
+      documentId: existing.documentId,
+      data: {
+        esignProvider: "docusign",
+        esignEnvelopeStatus: "completed",
+        esignCompletedAt: nowIso
+      }
+    });
+    const finalRecord = normalizeCertificateRecord(
+      updatedCompleted || fallbackDoc,
+      true
+    );
+    strapi.eventHub?.emit("certificates.docusign.completed", {
+      serialNumber: finalRecord.serialNumber,
+      envelopeId
+    });
+    return {
+      envelopeId,
+      envelopeStatus: "completed",
+      certificate: finalRecord
+    };
+  };
+  return {
+    async sendEnvelopeForCertificate(documentId, options2) {
+      const settings2 = await getSettingsService().getSettings();
+      const { safeBaseUrl, accountId, accessToken, fetchFn } = resolveDocuSignCredentials(settings2, options2);
+      const rawDoc = await strapi.documents(CERTIFICATE_UID$1).findOne({ documentId });
+      if (!rawDoc) {
+        throw new Error("Certificate record not found");
+      }
+      const cert = normalizeCertificateRecord(rawDoc, true);
+      const rendered = await getIssuanceService().renderCertificateDocument(
+        { documentId },
+        { isAdmin: true }
+      );
+      if (!rendered) {
+        throw new Error(
+          "Failed to render certificate HTML for DocuSign envelope"
+        );
+      }
+      const envelopePayload = buildDocuSignEnvelopePayload({
+        certificate: cert,
+        htmlDocument: rendered.html,
+        emailSubjectPrefix: settings2.esign.emailSubjectPrefix
+      });
+      const endpoint = `${safeBaseUrl}/v2.1/accounts/${encodeURIComponent(accountId)}/envelopes`;
+      const envelopeId = await dispatchDocuSignEnvelopeRequest(
+        fetchFn,
+        endpoint,
+        accessToken,
+        envelopePayload
+      );
+      const updated = await strapi.documents(CERTIFICATE_UID$1).update({
+        documentId,
+        data: {
+          esignProvider: "docusign",
+          esignEnvelopeId: envelopeId,
+          esignEnvelopeStatus: "sent"
+        }
+      });
+      const updatedRecord = normalizeCertificateRecord(updated || rawDoc, true);
+      strapi.eventHub?.emit("certificates.docusign.sent", {
+        serialNumber: updatedRecord.serialNumber,
+        envelopeId
+      });
+      return {
+        envelopeId,
+        envelopeStatus: "sent",
+        certificate: updatedRecord
+      };
+    },
+    async handleWebhookEvent(params) {
+      const secret = firstNonEmptyString(
+        params.webhookSecret,
+        process.env.DOCUSIGN_WEBHOOK_SECRET
+      );
+      if (!secret) {
+        throw new Error("DOCUSIGN_WEBHOOK_SECRET is not configured");
+      }
+      if (!verifyDocuSignWebhookHmac(
+        params.rawBody,
+        params.signatureHeader,
+        secret
+      )) {
+        throw new Error("Invalid DocuSign webhook HMAC-SHA256 signature");
+      }
+      const { envelopeId, envelopeStatus } = parseWebhookEnvelopeInfo(
+        params.payload
+      );
+      const matches = await strapi.documents(CERTIFICATE_UID$1).findMany({
+        filters: { esignEnvelopeId: envelopeId },
+        limit: 1
+      });
+      if (matches.length === 0) {
+        throw new Error(
+          `No certificate found for DocuSign envelopeId ${envelopeId}`
+        );
+      }
+      const existing = normalizeCertificateRecord(matches[0], true);
+      if (envelopeStatus === "completed") {
+        return completeWebhookEnvelope(existing, matches[0], envelopeId);
+      }
+      const updated = await strapi.documents(CERTIFICATE_UID$1).update({
+        documentId: existing.documentId,
+        data: { esignEnvelopeStatus: envelopeStatus }
+      });
+      return {
+        envelopeId,
+        envelopeStatus,
+        certificate: normalizeCertificateRecord(updated || matches[0], true)
+      };
+    }
+  };
+};
+const TEMPLATE_UID = "plugin::certificates.template";
+const CERTIFICATE_UID = "plugin::certificates.certificate";
+const trimStr = (val, fallback = "") => (val ? String(val).trim() : "") || fallback;
+const trimOptStr = (val) => trimStr(val) || void 0;
+const pickNonEmptyArray = (primary, fallback) => Array.isArray(primary) && primary.length > 0 ? primary : fallback;
+const slugifyName = (name, explicitSlug) => trimStr(explicitSlug) || name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+const DEFAULT_BODY_TEMPLATE = "This is to certify that {{recipientFullName}} has been officially attested by {{organizationName}} on {{issuedDateFormatted}}.";
+function buildTemplateCreateData(name, data, settings2) {
+  const days = data.defaultValidityDays;
+  return {
+    name,
+    slug: slugifyName(name, data.slug),
+    description: trimStr(data.description),
+    serialPrefix: trimStr(data.serialPrefix, "CERT").toUpperCase().slice(0, 8),
+    defaultValidityDays: typeof days === "number" ? days : null,
+    requiresWitnesses: Boolean(data.requiresWitnesses),
+    minWitnesses: typeof data.minWitnesses === "number" ? data.minWitnesses : 0,
+    requiresApproval: data.requiresApproval !== false,
+    organizationName: trimStr(data.organizationName, settings2.organizationName),
+    organizationSubheader: data.organizationSubheader ?? settings2.organizationSubheader,
+    headerText: trimStr(data.headerText),
+    titleText: trimStr(data.titleText, name),
+    bodyTemplate: trimStr(data.bodyTemplate, DEFAULT_BODY_TEMPLATE),
+    footerText: trimStr(data.footerText),
+    defaultSignatories: normalizeSignatories(data.defaultSignatories),
+    customFieldsSchema: Array.isArray(data.customFieldsSchema) ? data.customFieldsSchema : [],
+    secondaryCalendars: Array.isArray(data.secondaryCalendars) ? data.secondaryCalendars : settings2.secondaryCalendars,
+    accentColor: trimStr(data.accentColor, "#14532d"),
+    active: data.active !== false
+  };
+}
+function assertWitnessCount(template, witnesses, enforceNow) {
+  if (enforceNow && template?.requiresWitnesses) {
+    if (witnesses.length < template.minWitnesses) {
+      throw new Error(
+        `Template "${template.name}" requires at least ${template.minWitnesses} official witness(es) before issuance`
+      );
+    }
+  }
+}
+function emitCertEvent(strapi, event, record) {
+  strapi.eventHub?.emit(event, {
+    serialNumber: record.serialNumber,
+    templateSlug: record.templateSlug,
+    status: record.status
+  });
+}
+function resolveIssueDatesAndIdentity(input, template) {
+  const issuedDateObj = input.issuedAt ? new Date(input.issuedAt) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(issuedDateObj.getTime())) {
+    throw new Error("Invalid issuedAt date");
+  }
+  const issuedAt = issuedDateObj.toISOString();
+  const days = template.defaultValidityDays;
+  const computedExpiry = typeof days === "number" && days > 0 ? new Date(issuedDateObj.getTime() + days * 864e5).toISOString() : null;
+  const serialNumber = generateSerialNumber(
+    template.serialPrefix,
+    issuedDateObj.getUTCFullYear()
+  );
+  const rawNationalId = trimOptStr(input.nationalIdRaw);
+  return {
+    issuedDateObj,
+    fields: {
+      issuedAt,
+      expiresAt: input.expiresAt ?? computedExpiry,
+      serialNumber,
+      verificationToken: generateVerificationToken(),
+      nationalIdMasked: rawNationalId ? maskNationalId(rawNationalId) : "",
+      nationalIdHash: rawNationalId ? hashNationalId(rawNationalId, serialNumber) : ""
+    }
+  };
+}
+function resolveApprovalFields(existing, options2) {
+  return {
+    witnesses: options2?.witnesses !== void 0 ? normalizeWitnesses(options2.witnesses) : existing.witnesses,
+    signatories: options2?.signatories !== void 0 ? normalizeSignatories(options2.signatories) : existing.signatories,
+    recipientChosenName: options2?.recipientChosenName !== void 0 ? trimStr(options2.recipientChosenName) : existing.recipientChosenName,
+    notes: options2?.notes !== void 0 ? options2.notes : existing.notes
+  };
+}
+const issuance = ({ strapi }) => {
+  const getSettingsService = () => strapi.plugin(PLUGIN_ID).service("settings");
+  return {
+    async listTemplates(activeOnly = false) {
+      const filters = activeOnly ? { active: true } : void 0;
+      const docs = await strapi.documents(TEMPLATE_UID).findMany({ filters, limit: 100 });
+      return docs.map(normalizeTemplateRecord);
+    },
+    async findTemplate(identifier) {
+      if (identifier.templateDocumentId) {
+        const doc = await strapi.documents(TEMPLATE_UID).findOne({
+          documentId: identifier.templateDocumentId
+        });
+        if (doc) return normalizeTemplateRecord(doc);
+      }
+      if (identifier.templateSlug) {
+        const [first] = await strapi.documents(TEMPLATE_UID).findMany({
+          filters: { slug: identifier.templateSlug },
+          limit: 1
+        });
+        if (first) return normalizeTemplateRecord(first);
+      }
+      return null;
+    },
+    async createTemplate(data) {
+      const settings2 = await getSettingsService().getSettings();
+      const name = trimStr(data.name);
+      if (!name) throw new Error("Template name is required");
+      const created = await strapi.documents(TEMPLATE_UID).create({
+        data: buildTemplateCreateData(name, data, settings2)
+      });
+      return normalizeTemplateRecord(created);
+    },
+    async seedDefaultTemplates() {
+      const settings2 = await getSettingsService().getSettings();
+      let seededCount = 0;
+      for (const tpl of settings2.defaultTemplates || []) {
+        if (!await this.findTemplate({ templateSlug: tpl.slug })) {
+          await this.createTemplate(tpl);
+          seededCount++;
+        }
+      }
+      return seededCount;
+    },
+    async issueCertificate(input) {
+      const recipientFullName = trimStr(input.recipientFullName);
+      if (!recipientFullName) throw new Error("recipientFullName is required");
+      const template = await this.findTemplate({
+        templateDocumentId: input.templateDocumentId,
+        templateSlug: input.templateSlug
+      });
+      if (!template?.active)
+        throw new Error("Active certificate template not found");
+      const settings2 = await getSettingsService().getSettings();
+      const keyPair = await getSettingsService().getSigningKeyPair();
+      const isIssued = input.autoApprove === true || !template.requiresApproval;
+      const status = isIssued ? "issued" : "pending_approval";
+      const witnesses = normalizeWitnesses(input.witnesses);
+      assertWitnessCount(template, witnesses, isIssued);
+      const signatories = pickNonEmptyArray(
+        normalizeSignatories(input.signatories),
+        template.defaultSignatories
+      );
+      const { issuedDateObj, fields } = resolveIssueDatesAndIdentity(
+        input,
+        template
+      );
+      const secondaryDates = formatSecondaryCalendars(
+        issuedDateObj,
+        pickNonEmptyArray(
+          template.secondaryCalendars,
+          settings2.secondaryCalendars
+        ),
+        trimStr(input.locale, trimStr(settings2.defaultLocale, "en"))
+      );
+      const signed = signCanonicalPayload(
+        buildCanonicalPayload({
+          ...fields,
+          templateSlug: template.slug,
+          organizationName: trimStr(
+            template.organizationName,
+            settings2.organizationName
+          ),
+          recipientFullName,
+          recipientChosenName: input.recipientChosenName,
+          signatories,
+          witnesses
+        }),
+        keyPair.privateKeyPem
+      );
+      const created = await strapi.documents(CERTIFICATE_UID).create({
+        data: {
+          ...fields,
+          templateDocumentId: template.documentId,
+          templateSlug: template.slug,
+          templateName: template.name,
+          status,
+          recipientFullName,
+          recipientChosenName: trimStr(input.recipientChosenName),
+          recipientEmail: trimOptStr(input.recipientEmail),
+          recipientPhone: trimStr(input.recipientPhone),
+          recipientNationality: trimStr(input.recipientNationality),
+          signatories,
+          witnesses,
+          customData: input.customData ?? {},
+          secondaryDates,
+          canonicalPayloadHash: signed.payloadHash,
+          cryptographicSignature: signed.signature,
+          publicKeyFingerprint: keyPair.fingerprint,
+          linkedBookingCode: trimStr(input.linkedBookingCode),
+          notes: trimStr(input.notes)
+        }
+      });
+      const record = normalizeCertificateRecord(created, true);
+      emitCertEvent(
+        strapi,
+        isIssued ? "certificates.issued" : "certificates.requested",
+        record
+      );
+      return record;
+    },
+    async approveCertificate(documentId, options2) {
+      const existingDoc = await strapi.documents(CERTIFICATE_UID).findOne({ documentId });
+      if (!existingDoc) throw new Error("Certificate record not found");
+      const existing = normalizeCertificateRecord(existingDoc, true);
+      const template = await this.findTemplate({
+        templateDocumentId: existing.templateDocumentId,
+        templateSlug: existing.templateSlug
+      });
+      const { witnesses, signatories, recipientChosenName, notes } = resolveApprovalFields(existing, options2);
+      assertWitnessCount(template, witnesses, true);
+      const keyPair = await getSettingsService().getSigningKeyPair();
+      const settings2 = await getSettingsService().getSettings();
+      const issuedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const signed = signCanonicalPayload(
+        buildCanonicalPayload({
+          ...existing,
+          organizationName: trimStr(
+            template?.organizationName,
+            settings2.organizationName
+          ),
+          recipientChosenName,
+          issuedAt,
+          signatories,
+          witnesses
+        }),
+        keyPair.privateKeyPem
+      );
+      const updated = await strapi.documents(CERTIFICATE_UID).update({
+        documentId,
+        data: {
+          status: "issued",
+          issuedAt,
+          recipientChosenName: trimStr(recipientChosenName),
+          signatories,
+          witnesses,
+          canonicalPayloadHash: signed.payloadHash,
+          cryptographicSignature: signed.signature,
+          publicKeyFingerprint: keyPair.fingerprint,
+          notes
+        }
+      });
+      if (!updated) throw new Error("Failed to update certificate record");
+      const record = normalizeCertificateRecord(updated, true);
+      emitCertEvent(strapi, "certificates.issued", record);
+      return record;
+    },
+    async revokeCertificate(documentId, reason) {
+      const cleanReason = trimStr(reason, "Revoked by administrator");
+      const updated = await strapi.documents(CERTIFICATE_UID).update({
+        documentId,
+        data: {
+          status: "revoked",
+          revokedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          revocationReason: cleanReason
+        }
+      });
+      if (!updated) throw new Error("Certificate record not found");
+      const record = normalizeCertificateRecord(updated, false);
+      strapi.eventHub?.emit("certificates.revoked", {
+        serialNumber: record.serialNumber,
+        revocationReason: cleanReason
+      });
+      return record;
+    },
+    async verifyCertificateBySerial(serialNumber, options2) {
+      const cleanSerial = trimStr(serialNumber).toUpperCase();
+      if (!cleanSerial) return null;
+      const [match] = await strapi.documents(CERTIFICATE_UID).findMany({
+        filters: { serialNumber: cleanSerial },
+        limit: 1
+      });
+      if (!match) return null;
+      const cert = normalizeCertificateRecord(match, true);
+      const settings2 = await getSettingsService().getSettings();
+      const template = await this.findTemplate({
+        templateDocumentId: cert.templateDocumentId,
+        templateSlug: cert.templateSlug
+      });
+      return evaluateCertificateVerification({
+        cert,
+        template,
+        settings: settings2,
+        options: options2
+      });
+    },
+    async renderCertificateDocument(identifier, options2) {
+      let rawDoc = null;
+      if (identifier.documentId) {
+        rawDoc = await strapi.documents(CERTIFICATE_UID).findOne({
+          documentId: identifier.documentId
+        });
+      } else if (identifier.serialNumber) {
+        const [first] = await strapi.documents(CERTIFICATE_UID).findMany({
+          filters: {
+            serialNumber: identifier.serialNumber.trim().toUpperCase()
+          },
+          limit: 1
+        });
+        rawDoc = first || null;
+      }
+      if (!rawDoc) return null;
+      const cert = normalizeCertificateRecord(rawDoc, true);
+      const settings2 = await getSettingsService().getSettings();
+      const template = await this.findTemplate({
+        templateDocumentId: cert.templateDocumentId,
+        templateSlug: cert.templateSlug
+      });
+      return renderPrintableFromRecord({
+        cert,
+        template,
+        settings: settings2,
+        options: options2
+      });
+    },
+    async listCertificates(filters) {
+      const docs = await strapi.documents(CERTIFICATE_UID).findMany({ limit: 500 });
+      return filterAndComputeCertificateStats(
+        docs.map((d) => normalizeCertificateRecord(d, true)),
+        filters
+      );
+    },
+    async exportCsv(filters) {
+      return exportCertificatesToCsv(
+        (await this.listCertificates(filters)).records
+      );
+    }
+  };
+};
+const SETTINGS_STORE_KEY = "settings";
+const KEYPAIR_STORE_KEY = "ed25519_keypair";
+const DEFAULT_SECONDARY_CALENDARS = [
+  {
+    id: "islamic-umalqura",
+    label: "Hijri (Umm al-Qura)",
+    intlCalendar: "islamic-umalqura",
+    enabled: true,
+    dayOffset: 0
+  }
+];
+const DEFAULT_ESIGN_CONFIG = {
+  enabled: false,
+  provider: "none",
+  baseUrl: "https://demo.docusign.net/restapi",
+  accountId: "",
+  integrationKey: "",
+  emailSubjectPrefix: "Official Certificate Signature Request"
+};
+const DEFAULT_SETTINGS = {
+  organizationName: "Official Certification Authority",
+  organizationSubheader: "Office of Official Records & Attestation",
+  verificationBaseUrl: "http://localhost:1337/api/certificates/verify",
+  defaultTimezone: "UTC",
+  defaultLocale: "en",
+  maskPublicRecipientName: true,
+  allowPublicApplications: true,
+  secondaryCalendars: DEFAULT_SECONDARY_CALENDARS,
+  esign: DEFAULT_ESIGN_CONFIG,
+  defaultTemplates: []
+};
+function sanitizeCalendarSystems(raw) {
+  if (!Array.isArray(raw)) return DEFAULT_SECONDARY_CALENDARS;
+  return raw.filter(
+    (item) => Boolean(item && typeof item === "object")
+  ).map((item) => ({
+    id: String(item.id || "islamic-umalqura").trim(),
+    label: String(item.label || item.id || "Hijri").trim(),
+    intlCalendar: String(item.intlCalendar || "islamic-umalqura").trim(),
+    enabled: item.enabled !== false,
+    dayOffset: typeof item.dayOffset === "number" && Number.isFinite(item.dayOffset) ? Math.max(-5, Math.min(5, Math.trunc(item.dayOffset))) : 0
+  }));
+}
+function pickFirstString(...candidates) {
+  for (const candidate of candidates) {
+    if (candidate !== void 0 && candidate !== "") {
+      return String(candidate).trim();
+    }
+  }
+  return "";
+}
+function normalizeEsignProvider(providerRaw, enabled) {
+  if (providerRaw === "docusign" || providerRaw === "webhook") {
+    return providerRaw;
+  }
+  return enabled ? "docusign" : "none";
+}
+function toRecordObject(raw) {
+  return raw && typeof raw === "object" ? raw : {};
+}
+function sanitizeESignConfig(raw, fallback) {
+  const obj = toRecordObject(raw);
+  const envAccountId = process.env.DOCUSIGN_ACCOUNT_ID?.trim();
+  const envBaseUrl = process.env.DOCUSIGN_BASE_URL?.trim();
+  const envIntegrationKey = process.env.DOCUSIGN_INTEGRATION_KEY?.trim();
+  const enabled = Boolean(
+    obj.enabled ?? fallback.enabled ?? Boolean(envAccountId)
+  );
+  const providerRaw = pickFirstString(obj.provider, fallback.provider, "none");
+  return {
+    enabled,
+    provider: normalizeEsignProvider(providerRaw, Boolean(obj.enabled)),
+    baseUrl: stripTrailingSlashes(
+      pickFirstString(
+        obj.baseUrl,
+        envBaseUrl,
+        fallback.baseUrl,
+        DEFAULT_ESIGN_CONFIG.baseUrl
+      )
+    ),
+    accountId: pickFirstString(obj.accountId, envAccountId, fallback.accountId),
+    integrationKey: pickFirstString(
+      obj.integrationKey,
+      envIntegrationKey,
+      fallback.integrationKey
+    ),
+    emailSubjectPrefix: pickFirstString(
+      obj.emailSubjectPrefix,
+      fallback.emailSubjectPrefix,
+      DEFAULT_ESIGN_CONFIG.emailSubjectPrefix
+    )
+  };
+}
+const settings = ({ strapi }) => {
+  const getPluginStore = () => strapi.store({
+    type: "plugin",
+    name: PLUGIN_ID
+  });
+  return {
+    async getSigningKeyPair() {
+      const envPrivate = process.env.CERTIFICATES_PRIVATE_KEY_PEM?.trim();
+      const envPublic = process.env.CERTIFICATES_PUBLIC_KEY_PEM?.trim();
+      if (envPrivate && envPublic) {
+        return {
+          privateKeyPem: envPrivate.replace(/\\n/g, "\n"),
+          publicKeyPem: envPublic.replace(/\\n/g, "\n"),
+          fingerprint: computePublicKeyFingerprint(
+            envPublic.replace(/\\n/g, "\n")
+          )
+        };
+      }
+      const store = getPluginStore();
+      const stored = await store.get({ key: KEYPAIR_STORE_KEY });
+      if (stored?.privateKeyPem && stored?.publicKeyPem) {
+        return {
+          privateKeyPem: stored.privateKeyPem,
+          publicKeyPem: stored.publicKeyPem,
+          fingerprint: stored.fingerprint || computePublicKeyFingerprint(stored.publicKeyPem)
+        };
+      }
+      const generated = generateEd25519KeyPair();
+      await store.set({
+        key: KEYPAIR_STORE_KEY,
+        value: generated
+      });
+      strapi.log.info(
+        `[${PLUGIN_ID}] Generated and persisted new Ed25519 signing keypair (${generated.fingerprint}). Set CERTIFICATES_PRIVATE_KEY_PEM and CERTIFICATES_PUBLIC_KEY_PEM in production.`
+      );
+      return generated;
+    },
+    async rotateKeyPair() {
+      const store = getPluginStore();
+      const generated = generateEd25519KeyPair();
+      await store.set({
+        key: KEYPAIR_STORE_KEY,
+        value: generated
+      });
+      strapi.log.warn(
+        `[${PLUGIN_ID}] Rotated Ed25519 signing keypair to ${generated.fingerprint}`
+      );
+      return {
+        publicKeyPem: generated.publicKeyPem,
+        publicKeyFingerprint: generated.fingerprint
+      };
+    },
+    async getSettings() {
+      const store = getPluginStore();
+      const configDefaults = strapi.config.get(
+        `plugin::${PLUGIN_ID}`,
+        {}
+      ) || {};
+      const stored = await store.get({ key: SETTINGS_STORE_KEY }) || {};
+      const keyPair = await this.getSigningKeyPair();
+      const merged = {
+        ...DEFAULT_SETTINGS,
+        ...configDefaults,
+        ...stored
+      };
+      const defaultEsign = sanitizeESignConfig(
+        configDefaults.esign,
+        DEFAULT_ESIGN_CONFIG
+      );
+      return {
+        organizationName: String(
+          merged.organizationName || DEFAULT_SETTINGS.organizationName
+        ).trim(),
+        organizationSubheader: String(
+          merged.organizationSubheader ?? DEFAULT_SETTINGS.organizationSubheader
+        ).trim(),
+        verificationBaseUrl: stripTrailingSlashes(
+          String(
+            merged.verificationBaseUrl || DEFAULT_SETTINGS.verificationBaseUrl
+          ).trim()
+        ),
+        defaultTimezone: String(
+          merged.defaultTimezone || DEFAULT_SETTINGS.defaultTimezone
+        ).trim(),
+        defaultLocale: String(
+          merged.defaultLocale || DEFAULT_SETTINGS.defaultLocale
+        ).trim(),
+        maskPublicRecipientName: merged.maskPublicRecipientName !== false,
+        allowPublicApplications: merged.allowPublicApplications !== false,
+        publicKeyPem: keyPair.publicKeyPem,
+        publicKeyFingerprint: keyPair.fingerprint,
+        secondaryCalendars: sanitizeCalendarSystems(merged.secondaryCalendars),
+        esign: sanitizeESignConfig(stored.esign, defaultEsign),
+        defaultTemplates: Array.isArray(merged.defaultTemplates) ? merged.defaultTemplates : []
+      };
+    },
+    async updateSettings(partial) {
+      const current = await this.getSettings();
+      const updated = {
+        organizationName: typeof partial.organizationName === "string" ? partial.organizationName.trim() : current.organizationName,
+        organizationSubheader: typeof partial.organizationSubheader === "string" ? partial.organizationSubheader.trim() : current.organizationSubheader,
+        verificationBaseUrl: typeof partial.verificationBaseUrl === "string" ? stripTrailingSlashes(partial.verificationBaseUrl.trim()) : current.verificationBaseUrl,
+        defaultTimezone: typeof partial.defaultTimezone === "string" ? partial.defaultTimezone.trim() : current.defaultTimezone,
+        defaultLocale: typeof partial.defaultLocale === "string" ? partial.defaultLocale.trim() : current.defaultLocale,
+        maskPublicRecipientName: typeof partial.maskPublicRecipientName === "boolean" ? partial.maskPublicRecipientName : current.maskPublicRecipientName,
+        allowPublicApplications: typeof partial.allowPublicApplications === "boolean" ? partial.allowPublicApplications : current.allowPublicApplications,
+        secondaryCalendars: partial.secondaryCalendars !== void 0 ? sanitizeCalendarSystems(partial.secondaryCalendars) : current.secondaryCalendars,
+        esign: partial.esign !== void 0 ? sanitizeESignConfig(partial.esign, current.esign) : current.esign,
+        defaultTemplates: current.defaultTemplates
+      };
+      const store = getPluginStore();
+      await store.set({
+        key: SETTINGS_STORE_KEY,
+        value: updated
+      });
+      return this.getSettings();
+    }
+  };
+};
+const services = {
+  settings,
+  issuance,
+  docusign
+};
+const index = {
+  register,
+  bootstrap,
+  contentTypes,
+  controllers,
+  routes,
+  services
+};
+export {
+  index as default
+};